1
2 /*
3 * Copyright (C) 2012 by Darren Reed.
4 *
5 * See the IPFILTER.LICENCE file for details on licencing.
6 */
7 #if defined(KERNEL) || defined(_KERNEL)
8 # undef KERNEL
9 # undef _KERNEL
10 # define KERNEL 1
11 # define _KERNEL 1
12 #endif
13 #include <sys/errno.h>
14 #include <sys/types.h>
15 #include <sys/param.h>
16 #include <sys/time.h>
17 #include <sys/file.h>
18 #if defined(_KERNEL) && \
19 (defined(__NetBSD_Version) && (__NetBSD_Version >= 399002000))
20 # include <sys/kauth.h>
21 #endif
22 #if !defined(_KERNEL)
23 # include <stdio.h>
24 # include <string.h>
25 # include <stdlib.h>
26 # define KERNEL
27 # ifdef _OpenBSD__
28 struct file;
29 # endif
30 # include <sys/uio.h>
31 # undef KERNEL
32 #endif
33 #if defined(_KERNEL) && defined(__FreeBSD__)
34 # include <sys/filio.h>
35 # include <sys/fcntl.h>
36 #else
37 # include <sys/ioctl.h>
38 #endif
39 # include <sys/fcntl.h>
40 # include <sys/protosw.h>
41 #include <sys/socket.h>
42 #if defined(_KERNEL)
43 # include <sys/systm.h>
44 # if defined(__FreeBSD__)
45 # include <sys/jail.h>
46 # endif
47 # if !defined(__SVR4)
48 # include <sys/mbuf.h>
49 # endif
50 #endif
51 #if defined(__SVR4)
52 # include <sys/filio.h>
53 # include <sys/byteorder.h>
54 # ifdef KERNEL
55 # include <sys/dditypes.h>
56 # endif
57 # include <sys/stream.h>
58 # include <sys/kmem.h>
59 #endif
60 #if defined(__FreeBSD__)
61 # include <sys/queue.h>
62 #endif
63 #include <net/if.h>
64 #if defined(__FreeBSD__)
65 # include <net/if_var.h>
66 #endif
67 #ifdef sun
68 # include <net/af.h>
69 #endif
70 #include <netinet/in.h>
71 #include <netinet/in_systm.h>
72 #include <netinet/ip.h>
73
74 #ifdef RFC1825
75 # include <vpn/md5.h>
76 # include <vpn/ipsec.h>
77 extern struct ifnet vpnif;
78 #endif
79
80 # include <netinet/ip_var.h>
81 #include <netinet/tcp.h>
82 #include <netinet/udp.h>
83 #include <netinet/ip_icmp.h>
84 #include "netinet/ip_compat.h"
85 #include <netinet/tcpip.h>
86 #include "netinet/ipl.h"
87 #include "netinet/ip_fil.h"
88 #include "netinet/ip_nat.h"
89 #include "netinet/ip_frag.h"
90 #include "netinet/ip_state.h"
91 #include "netinet/ip_proxy.h"
92 #include "netinet/ip_lookup.h"
93 #include "netinet/ip_dstlist.h"
94 #include "netinet/ip_sync.h"
95 #if defined(__FreeBSD__)
96 # include <sys/malloc.h>
97 #endif
98 #ifdef HAS_SYS_MD5_H
99 # include <sys/md5.h>
100 #else
101 # include "md5.h"
102 #endif
103 /* END OF INCLUDES */
104
105 #undef SOCKADDR_IN
106 #define SOCKADDR_IN struct sockaddr_in
107
108
109
110 #define NATFSUM(n,v,f) ((v) == 4 ? (n)->f.in4.s_addr : (n)->f.i6[0] + \
111 (n)->f.i6[1] + (n)->f.i6[2] + (n)->f.i6[3])
112 #define NBUMP(x) softn->(x)++
113 #define NBUMPD(x, y) do { \
114 softn->x.y++; \
115 DT(y); \
116 } while (0)
117 #define NBUMPSIDE(y,x) softn->ipf_nat_stats.ns_side[y].x++
118 #define NBUMPSIDED(y,x) do { softn->ipf_nat_stats.ns_side[y].x++; \
119 DT(x); } while (0)
120 #define NBUMPSIDEX(y,x,z) \
121 do { softn->ipf_nat_stats.ns_side[y].x++; \
122 DT(z); } while (0)
123 #define NBUMPSIDEDF(y,x)do { softn->ipf_nat_stats.ns_side[y].x++; \
124 DT1(x, fr_info_t *, fin); } while (0)
125
126 static ipftuneable_t ipf_nat_tuneables[] = {
127 /* nat */
128 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_lock) },
129 "nat_lock", 0, 1,
130 stsizeof(ipf_nat_softc_t, ipf_nat_lock),
131 IPFT_RDONLY, NULL, NULL },
132 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_sz) },
133 "nat_table_size", 1, 0x7fffffff,
134 stsizeof(ipf_nat_softc_t, ipf_nat_table_sz),
135 0, NULL, ipf_nat_rehash },
136 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_max) },
137 "nat_table_max", 1, 0x7fffffff,
138 stsizeof(ipf_nat_softc_t, ipf_nat_table_max),
139 0, NULL, NULL },
140 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_maprules_sz) },
141 "nat_rules_size", 1, 0x7fffffff,
142 stsizeof(ipf_nat_softc_t, ipf_nat_maprules_sz),
143 0, NULL, ipf_nat_rehash_rules },
144 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_rdrrules_sz) },
145 "rdr_rules_size", 1, 0x7fffffff,
146 stsizeof(ipf_nat_softc_t, ipf_nat_rdrrules_sz),
147 0, NULL, ipf_nat_rehash_rules },
148 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_hostmap_sz) },
149 "hostmap_size", 1, 0x7fffffff,
150 stsizeof(ipf_nat_softc_t, ipf_nat_hostmap_sz),
151 0, NULL, ipf_nat_hostmap_rehash },
152 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_maxbucket) },
153 "nat_maxbucket",1, 0x7fffffff,
154 stsizeof(ipf_nat_softc_t, ipf_nat_maxbucket),
155 0, NULL, NULL },
156 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_logging) },
157 "nat_logging", 0, 1,
158 stsizeof(ipf_nat_softc_t, ipf_nat_logging),
159 0, NULL, NULL },
160 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_doflush) },
161 "nat_doflush", 0, 1,
162 stsizeof(ipf_nat_softc_t, ipf_nat_doflush),
163 0, NULL, NULL },
164 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_wm_low) },
165 "nat_table_wm_low", 1, 99,
166 stsizeof(ipf_nat_softc_t, ipf_nat_table_wm_low),
167 0, NULL, NULL },
168 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_wm_high) },
169 "nat_table_wm_high", 2, 100,
170 stsizeof(ipf_nat_softc_t, ipf_nat_table_wm_high),
171 0, NULL, NULL },
172 { { 0 },
173 NULL, 0, 0,
174 0,
175 0, NULL, NULL }
176 };
177
178 /* ======================================================================== */
179 /* How the NAT is organised and works. */
180 /* */
181 /* Inside (interface y) NAT Outside (interface x) */
182 /* -------------------- -+- ------------------------------------- */
183 /* Packet going | out, processed by ipf_nat_checkout() for x */
184 /* ------------> | ------------> */
185 /* src=10.1.1.1 | src=192.1.1.1 */
186 /* | */
187 /* | in, processed by ipf_nat_checkin() for x */
188 /* <------------ | <------------ */
189 /* dst=10.1.1.1 | dst=192.1.1.1 */
190 /* -------------------- -+- ------------------------------------- */
191 /* ipf_nat_checkout() - changes ip_src and if required, sport */
192 /* - creates a new mapping, if required. */
193 /* ipf_nat_checkin() - changes ip_dst and if required, dport */
194 /* */
195 /* In the NAT table, internal source is recorded as "in" and externally */
196 /* seen as "out". */
197 /* ======================================================================== */
198
199
200 #if SOLARIS && !defined(INSTANCES)
201 extern int pfil_delayed_copy;
202 #endif
203
204 static int ipf_nat_flush_entry(ipf_main_softc_t *, void *);
205 static int ipf_nat_getent(ipf_main_softc_t *, caddr_t, int);
206 static int ipf_nat_getsz(ipf_main_softc_t *, caddr_t, int);
207 static int ipf_nat_putent(ipf_main_softc_t *, caddr_t, int);
208 static void ipf_nat_addmap(ipf_nat_softc_t *, ipnat_t *);
209 static void ipf_nat_addrdr(ipf_nat_softc_t *, ipnat_t *);
210 static int ipf_nat_builddivertmp(ipf_nat_softc_t *, ipnat_t *);
211 static int ipf_nat_clearlist(ipf_main_softc_t *, ipf_nat_softc_t *);
212 static int ipf_nat_cmp_rules(ipnat_t *, ipnat_t *);
213 static int ipf_nat_decap(fr_info_t *, nat_t *);
214 static void ipf_nat_delrule(ipf_main_softc_t *, ipf_nat_softc_t *,
215 ipnat_t *, int);
216 static int ipf_nat_extraflush(ipf_main_softc_t *, ipf_nat_softc_t *, int);
217 static int ipf_nat_finalise(fr_info_t *, nat_t *);
218 static int ipf_nat_flushtable(ipf_main_softc_t *, ipf_nat_softc_t *);
219 static int ipf_nat_getnext(ipf_main_softc_t *, ipftoken_t *,
220 ipfgeniter_t *, ipfobj_t *);
221 static int ipf_nat_gettable(ipf_main_softc_t *, ipf_nat_softc_t *,
222 char *);
223 static hostmap_t *ipf_nat_hostmap(ipf_nat_softc_t *, ipnat_t *,
224 struct in_addr, struct in_addr,
225 struct in_addr, u_32_t);
226 static int ipf_nat_icmpquerytype(int);
227 static int ipf_nat_iterator(ipf_main_softc_t *, ipftoken_t *,
228 ipfgeniter_t *, ipfobj_t *);
229 static int ipf_nat_match(fr_info_t *, ipnat_t *);
230 static int ipf_nat_matcharray(nat_t *, int *, u_long);
231 static int ipf_nat_matchflush(ipf_main_softc_t *, ipf_nat_softc_t *,
232 caddr_t);
233 static void ipf_nat_mssclamp(tcphdr_t *, u_32_t, fr_info_t *,
234 u_short *);
235 static int ipf_nat_newmap(fr_info_t *, nat_t *, natinfo_t *);
236 static int ipf_nat_newdivert(fr_info_t *, nat_t *, natinfo_t *);
237 static int ipf_nat_newrdr(fr_info_t *, nat_t *, natinfo_t *);
238 static int ipf_nat_newrewrite(fr_info_t *, nat_t *, natinfo_t *);
239 static int ipf_nat_nextaddr(fr_info_t *, nat_addr_t *, u_32_t *,
240 u_32_t *);
241 static int ipf_nat_nextaddrinit(ipf_main_softc_t *, char *,
242 nat_addr_t *, int, void *);
243 static int ipf_nat_resolverule(ipf_main_softc_t *, ipnat_t *);
244 static int ipf_nat_ruleaddrinit(ipf_main_softc_t *,
245 ipf_nat_softc_t *, ipnat_t *);
246 static void ipf_nat_rule_fini(ipf_main_softc_t *, ipnat_t *);
247 static int ipf_nat_rule_init(ipf_main_softc_t *, ipf_nat_softc_t *,
248 ipnat_t *);
249 static int ipf_nat_siocaddnat(ipf_main_softc_t *, ipf_nat_softc_t *,
250 ipnat_t *, int);
251 static void ipf_nat_siocdelnat(ipf_main_softc_t *, ipf_nat_softc_t *,
252 ipnat_t *, int);
253 static void ipf_nat_tabmove(ipf_nat_softc_t *, nat_t *);
254
255 /* ------------------------------------------------------------------------ */
256 /* Function: ipf_nat_main_load */
257 /* Returns: int - 0 == success, -1 == failure */
258 /* Parameters: Nil */
259 /* */
260 /* The only global NAT structure that needs to be initialised is the filter */
261 /* rule that is used with blocking packets. */
262 /* ------------------------------------------------------------------------ */
263 int
ipf_nat_main_load(void)264 ipf_nat_main_load(void)
265 {
266
267 return (0);
268 }
269
270
271 /* ------------------------------------------------------------------------ */
272 /* Function: ipf_nat_main_unload */
273 /* Returns: int - 0 == success, -1 == failure */
274 /* Parameters: Nil */
275 /* */
276 /* A null-op function that exists as a placeholder so that the flow in */
277 /* other functions is obvious. */
278 /* ------------------------------------------------------------------------ */
279 int
ipf_nat_main_unload(void)280 ipf_nat_main_unload(void)
281 {
282 return (0);
283 }
284
285
286 /* ------------------------------------------------------------------------ */
287 /* Function: ipf_nat_soft_create */
288 /* Returns: void * - NULL = failure, else pointer to NAT context */
289 /* Parameters: softc(I) - pointer to soft context main structure */
290 /* */
291 /* Allocate the initial soft context structure for NAT and populate it with */
292 /* some default values. Creating the tables is left until we call _init so */
293 /* that sizes can be changed before we get under way. */
294 /* ------------------------------------------------------------------------ */
295 void *
ipf_nat_soft_create(ipf_main_softc_t * softc)296 ipf_nat_soft_create(ipf_main_softc_t *softc)
297 {
298 ipf_nat_softc_t *softn;
299
300 KMALLOC(softn, ipf_nat_softc_t *);
301 if (softn == NULL)
302 return (NULL);
303
304 bzero((char *)softn, sizeof(*softn));
305
306 softn->ipf_nat_tune = ipf_tune_array_copy(softn,
307 sizeof(ipf_nat_tuneables),
308 ipf_nat_tuneables);
309 if (softn->ipf_nat_tune == NULL) {
310 ipf_nat_soft_destroy(softc, softn);
311 return (NULL);
312 }
313 if (ipf_tune_array_link(softc, softn->ipf_nat_tune) == -1) {
314 ipf_nat_soft_destroy(softc, softn);
315 return (NULL);
316 }
317
318 softn->ipf_nat_list_tail = &softn->ipf_nat_list;
319
320 if (softc->ipf_large_nat) {
321 softn->ipf_nat_table_max = NAT_TABLE_MAX_LARGE;
322 softn->ipf_nat_table_sz = NAT_TABLE_SZ_LARGE;
323 softn->ipf_nat_maprules_sz = NAT_SIZE_LARGE;
324 softn->ipf_nat_rdrrules_sz = RDR_SIZE_LARGE;
325 softn->ipf_nat_hostmap_sz = HOSTMAP_SIZE_LARGE;
326 } else {
327 softn->ipf_nat_table_max = NAT_TABLE_MAX_NORMAL;
328 softn->ipf_nat_table_sz = NAT_TABLE_SZ_NORMAL;
329 softn->ipf_nat_maprules_sz = NAT_SIZE_NORMAL;
330 softn->ipf_nat_rdrrules_sz = RDR_SIZE_NORMAL;
331 softn->ipf_nat_hostmap_sz = HOSTMAP_SIZE_NORMAL;
332 }
333 softn->ipf_nat_doflush = 0;
334 #ifdef IPFILTER_LOG
335 softn->ipf_nat_logging = 1;
336 #else
337 softn->ipf_nat_logging = 0;
338 #endif
339
340 softn->ipf_nat_defage = DEF_NAT_AGE;
341 softn->ipf_nat_defipage = IPF_TTLVAL(60);
342 softn->ipf_nat_deficmpage = IPF_TTLVAL(3);
343 softn->ipf_nat_table_wm_high = 99;
344 softn->ipf_nat_table_wm_low = 90;
345
346 return (softn);
347 }
348
349 /* ------------------------------------------------------------------------ */
350 /* Function: ipf_nat_soft_destroy */
351 /* Returns: Nil */
352 /* Parameters: softc(I) - pointer to soft context main structure */
353 /* */
354 /* ------------------------------------------------------------------------ */
355 void
ipf_nat_soft_destroy(ipf_main_softc_t * softc,void * arg)356 ipf_nat_soft_destroy(ipf_main_softc_t *softc, void *arg)
357 {
358 ipf_nat_softc_t *softn = arg;
359
360 if (softn->ipf_nat_tune != NULL) {
361 ipf_tune_array_unlink(softc, softn->ipf_nat_tune);
362 KFREES(softn->ipf_nat_tune, sizeof(ipf_nat_tuneables));
363 softn->ipf_nat_tune = NULL;
364 }
365
366 KFREE(softn);
367 }
368
369
370 /* ------------------------------------------------------------------------ */
371 /* Function: ipf_nat_init */
372 /* Returns: int - 0 == success, -1 == failure */
373 /* Parameters: softc(I) - pointer to soft context main structure */
374 /* */
375 /* Initialise all of the NAT locks, tables and other structures. */
376 /* ------------------------------------------------------------------------ */
377 int
ipf_nat_soft_init(ipf_main_softc_t * softc,void * arg)378 ipf_nat_soft_init(ipf_main_softc_t *softc, void *arg)
379 {
380 ipf_nat_softc_t *softn = arg;
381 ipftq_t *tq;
382 int i;
383
384 KMALLOCS(softn->ipf_nat_table[0], nat_t **, \
385 sizeof(nat_t *) * softn->ipf_nat_table_sz);
386
387 if (softn->ipf_nat_table[0] != NULL) {
388 bzero((char *)softn->ipf_nat_table[0],
389 softn->ipf_nat_table_sz * sizeof(nat_t *));
390 } else {
391 return (-1);
392 }
393
394 KMALLOCS(softn->ipf_nat_table[1], nat_t **, \
395 sizeof(nat_t *) * softn->ipf_nat_table_sz);
396
397 if (softn->ipf_nat_table[1] != NULL) {
398 bzero((char *)softn->ipf_nat_table[1],
399 softn->ipf_nat_table_sz * sizeof(nat_t *));
400 } else {
401 return (-2);
402 }
403
404 KMALLOCS(softn->ipf_nat_map_rules, ipnat_t **, \
405 sizeof(ipnat_t *) * softn->ipf_nat_maprules_sz);
406
407 if (softn->ipf_nat_map_rules != NULL) {
408 bzero((char *)softn->ipf_nat_map_rules,
409 softn->ipf_nat_maprules_sz * sizeof(ipnat_t *));
410 } else {
411 return (-3);
412 }
413
414 KMALLOCS(softn->ipf_nat_rdr_rules, ipnat_t **, \
415 sizeof(ipnat_t *) * softn->ipf_nat_rdrrules_sz);
416
417 if (softn->ipf_nat_rdr_rules != NULL) {
418 bzero((char *)softn->ipf_nat_rdr_rules,
419 softn->ipf_nat_rdrrules_sz * sizeof(ipnat_t *));
420 } else {
421 return (-4);
422 }
423
424 KMALLOCS(softn->ipf_hm_maptable, hostmap_t **, \
425 sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
426
427 if (softn->ipf_hm_maptable != NULL) {
428 bzero((char *)softn->ipf_hm_maptable,
429 sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
430 } else {
431 return (-5);
432 }
433 softn->ipf_hm_maplist = NULL;
434
435 KMALLOCS(softn->ipf_nat_stats.ns_side[0].ns_bucketlen, u_int *,
436 softn->ipf_nat_table_sz * sizeof(u_int));
437
438 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen == NULL) {
439 return (-6);
440 }
441 bzero((char *)softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
442 softn->ipf_nat_table_sz * sizeof(u_int));
443
444 KMALLOCS(softn->ipf_nat_stats.ns_side[1].ns_bucketlen, u_int *,
445 softn->ipf_nat_table_sz * sizeof(u_int));
446
447 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen == NULL) {
448 return (-7);
449 }
450
451 bzero((char *)softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
452 softn->ipf_nat_table_sz * sizeof(u_int));
453
454 if (softn->ipf_nat_maxbucket == 0) {
455 for (i = softn->ipf_nat_table_sz; i > 0; i >>= 1)
456 softn->ipf_nat_maxbucket++;
457 softn->ipf_nat_maxbucket *= 2;
458 }
459
460 ipf_sttab_init(softc, softn->ipf_nat_tcptq);
461 /*
462 * Increase this because we may have "keep state" following this too
463 * and packet storms can occur if this is removed too quickly.
464 */
465 softn->ipf_nat_tcptq[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcplastack;
466 softn->ipf_nat_tcptq[IPF_TCP_NSTATES - 1].ifq_next =
467 &softn->ipf_nat_udptq;
468
469 IPFTQ_INIT(&softn->ipf_nat_udptq, softn->ipf_nat_defage,
470 "nat ipftq udp tab");
471 softn->ipf_nat_udptq.ifq_next = &softn->ipf_nat_udpacktq;
472
473 IPFTQ_INIT(&softn->ipf_nat_udpacktq, softn->ipf_nat_defage,
474 "nat ipftq udpack tab");
475 softn->ipf_nat_udpacktq.ifq_next = &softn->ipf_nat_icmptq;
476
477 IPFTQ_INIT(&softn->ipf_nat_icmptq, softn->ipf_nat_deficmpage,
478 "nat icmp ipftq tab");
479 softn->ipf_nat_icmptq.ifq_next = &softn->ipf_nat_icmpacktq;
480
481 IPFTQ_INIT(&softn->ipf_nat_icmpacktq, softn->ipf_nat_defage,
482 "nat icmpack ipftq tab");
483 softn->ipf_nat_icmpacktq.ifq_next = &softn->ipf_nat_iptq;
484
485 IPFTQ_INIT(&softn->ipf_nat_iptq, softn->ipf_nat_defipage,
486 "nat ip ipftq tab");
487 softn->ipf_nat_iptq.ifq_next = &softn->ipf_nat_pending;
488
489 IPFTQ_INIT(&softn->ipf_nat_pending, 1, "nat pending ipftq tab");
490 softn->ipf_nat_pending.ifq_next = NULL;
491
492 for (i = 0, tq = softn->ipf_nat_tcptq; i < IPF_TCP_NSTATES; i++, tq++) {
493 if (tq->ifq_ttl < softn->ipf_nat_deficmpage)
494 tq->ifq_ttl = softn->ipf_nat_deficmpage;
495 else if (tq->ifq_ttl > softn->ipf_nat_defage && softc->ipf_large_nat)
496 tq->ifq_ttl = softn->ipf_nat_defage;
497 }
498
499 /*
500 * Increase this because we may have "keep state" following
501 * this too and packet storms can occur if this is removed
502 * too quickly.
503 */
504 softn->ipf_nat_tcptq[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcplastack;
505
506 MUTEX_INIT(&softn->ipf_nat_new, "ipf nat new mutex");
507 MUTEX_INIT(&softn->ipf_nat_io, "ipf nat io mutex");
508
509 softn->ipf_nat_inited = 1;
510
511 return (0);
512 }
513
514
515 /* ------------------------------------------------------------------------ */
516 /* Function: ipf_nat_soft_fini */
517 /* Returns: Nil */
518 /* Parameters: softc(I) - pointer to soft context main structure */
519 /* */
520 /* Free all memory used by NAT structures allocated at runtime. */
521 /* ------------------------------------------------------------------------ */
522 int
ipf_nat_soft_fini(ipf_main_softc_t * softc,void * arg)523 ipf_nat_soft_fini(ipf_main_softc_t *softc, void *arg)
524 {
525 ipf_nat_softc_t *softn = arg;
526 ipftq_t *ifq, *ifqnext;
527
528 (void) ipf_nat_clearlist(softc, softn);
529 (void) ipf_nat_flushtable(softc, softn);
530
531 /*
532 * Proxy timeout queues are not cleaned here because although they
533 * exist on the NAT list, ipf_proxy_unload is called after unload
534 * and the proxies actually are responsible for them being created.
535 * Should the proxy timeouts have their own list? There's no real
536 * justification as this is the only complication.
537 */
538 for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifqnext) {
539 ifqnext = ifq->ifq_next;
540 if (ipf_deletetimeoutqueue(ifq) == 0)
541 ipf_freetimeoutqueue(softc, ifq);
542 }
543
544 if (softn->ipf_nat_table[0] != NULL) {
545 KFREES(softn->ipf_nat_table[0],
546 sizeof(nat_t *) * softn->ipf_nat_table_sz);
547 softn->ipf_nat_table[0] = NULL;
548 }
549 if (softn->ipf_nat_table[1] != NULL) {
550 KFREES(softn->ipf_nat_table[1],
551 sizeof(nat_t *) * softn->ipf_nat_table_sz);
552 softn->ipf_nat_table[1] = NULL;
553 }
554 if (softn->ipf_nat_map_rules != NULL) {
555 KFREES(softn->ipf_nat_map_rules,
556 sizeof(ipnat_t *) * softn->ipf_nat_maprules_sz);
557 softn->ipf_nat_map_rules = NULL;
558 }
559 if (softn->ipf_nat_rdr_rules != NULL) {
560 KFREES(softn->ipf_nat_rdr_rules,
561 sizeof(ipnat_t *) * softn->ipf_nat_rdrrules_sz);
562 softn->ipf_nat_rdr_rules = NULL;
563 }
564 if (softn->ipf_hm_maptable != NULL) {
565 KFREES(softn->ipf_hm_maptable,
566 sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
567 softn->ipf_hm_maptable = NULL;
568 }
569 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen != NULL) {
570 KFREES(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
571 sizeof(u_int) * softn->ipf_nat_table_sz);
572 softn->ipf_nat_stats.ns_side[0].ns_bucketlen = NULL;
573 }
574 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen != NULL) {
575 KFREES(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
576 sizeof(u_int) * softn->ipf_nat_table_sz);
577 softn->ipf_nat_stats.ns_side[1].ns_bucketlen = NULL;
578 }
579
580 if (softn->ipf_nat_inited == 1) {
581 softn->ipf_nat_inited = 0;
582 ipf_sttab_destroy(softn->ipf_nat_tcptq);
583
584 MUTEX_DESTROY(&softn->ipf_nat_new);
585 MUTEX_DESTROY(&softn->ipf_nat_io);
586
587 MUTEX_DESTROY(&softn->ipf_nat_udptq.ifq_lock);
588 MUTEX_DESTROY(&softn->ipf_nat_udpacktq.ifq_lock);
589 MUTEX_DESTROY(&softn->ipf_nat_icmptq.ifq_lock);
590 MUTEX_DESTROY(&softn->ipf_nat_icmpacktq.ifq_lock);
591 MUTEX_DESTROY(&softn->ipf_nat_iptq.ifq_lock);
592 MUTEX_DESTROY(&softn->ipf_nat_pending.ifq_lock);
593 }
594
595 return (0);
596 }
597
598
599 /* ------------------------------------------------------------------------ */
600 /* Function: ipf_nat_setlock */
601 /* Returns: Nil */
602 /* Parameters: arg(I) - pointer to soft state information */
603 /* tmp(I) - new lock value */
604 /* */
605 /* Set the "lock status" of NAT to the value in tmp. */
606 /* ------------------------------------------------------------------------ */
607 void
ipf_nat_setlock(void * arg,int tmp)608 ipf_nat_setlock(void *arg, int tmp)
609 {
610 ipf_nat_softc_t *softn = arg;
611
612 softn->ipf_nat_lock = tmp;
613 }
614
615
616 /* ------------------------------------------------------------------------ */
617 /* Function: ipf_nat_addrdr */
618 /* Returns: Nil */
619 /* Parameters: n(I) - pointer to NAT rule to add */
620 /* */
621 /* Adds a redirect rule to the hash table of redirect rules and the list of */
622 /* loaded NAT rules. Updates the bitmask indicating which netmasks are in */
623 /* use by redirect rules. */
624 /* ------------------------------------------------------------------------ */
625 static void
ipf_nat_addrdr(ipf_nat_softc_t * softn,ipnat_t * n)626 ipf_nat_addrdr(ipf_nat_softc_t *softn, ipnat_t *n)
627 {
628 ipnat_t **np;
629 u_32_t j;
630 u_int hv;
631 u_int rhv;
632 int k;
633
634 if (n->in_odstatype == FRI_NORMAL) {
635 k = count4bits(n->in_odstmsk);
636 ipf_inet_mask_add(k, &softn->ipf_nat_rdr_mask);
637 j = (n->in_odstaddr & n->in_odstmsk);
638 rhv = NAT_HASH_FN(j, 0, 0xffffffff);
639 } else {
640 ipf_inet_mask_add(0, &softn->ipf_nat_rdr_mask);
641 j = 0;
642 rhv = 0;
643 }
644 hv = rhv % softn->ipf_nat_rdrrules_sz;
645 np = softn->ipf_nat_rdr_rules + hv;
646 while (*np != NULL)
647 np = &(*np)->in_rnext;
648 n->in_rnext = NULL;
649 n->in_prnext = np;
650 n->in_hv[0] = hv;
651 n->in_use++;
652 *np = n;
653 }
654
655
656 /* ------------------------------------------------------------------------ */
657 /* Function: ipf_nat_addmap */
658 /* Returns: Nil */
659 /* Parameters: n(I) - pointer to NAT rule to add */
660 /* */
661 /* Adds a NAT map rule to the hash table of rules and the list of loaded */
662 /* NAT rules. Updates the bitmask indicating which netmasks are in use by */
663 /* redirect rules. */
664 /* ------------------------------------------------------------------------ */
665 static void
ipf_nat_addmap(ipf_nat_softc_t * softn,ipnat_t * n)666 ipf_nat_addmap(ipf_nat_softc_t *softn, ipnat_t *n)
667 {
668 ipnat_t **np;
669 u_32_t j;
670 u_int hv;
671 u_int rhv;
672 int k;
673
674 if (n->in_osrcatype == FRI_NORMAL) {
675 k = count4bits(n->in_osrcmsk);
676 ipf_inet_mask_add(k, &softn->ipf_nat_map_mask);
677 j = (n->in_osrcaddr & n->in_osrcmsk);
678 rhv = NAT_HASH_FN(j, 0, 0xffffffff);
679 } else {
680 ipf_inet_mask_add(0, &softn->ipf_nat_map_mask);
681 j = 0;
682 rhv = 0;
683 }
684 hv = rhv % softn->ipf_nat_maprules_sz;
685 np = softn->ipf_nat_map_rules + hv;
686 while (*np != NULL)
687 np = &(*np)->in_mnext;
688 n->in_mnext = NULL;
689 n->in_pmnext = np;
690 n->in_hv[1] = rhv;
691 n->in_use++;
692 *np = n;
693 }
694
695
696 /* ------------------------------------------------------------------------ */
697 /* Function: ipf_nat_delrdr */
698 /* Returns: Nil */
699 /* Parameters: n(I) - pointer to NAT rule to delete */
700 /* */
701 /* Removes a redirect rule from the hash table of redirect rules. */
702 /* ------------------------------------------------------------------------ */
703 void
ipf_nat_delrdr(ipf_nat_softc_t * softn,ipnat_t * n)704 ipf_nat_delrdr(ipf_nat_softc_t *softn, ipnat_t *n)
705 {
706 if (n->in_odstatype == FRI_NORMAL) {
707 int k = count4bits(n->in_odstmsk);
708 ipf_inet_mask_del(k, &softn->ipf_nat_rdr_mask);
709 } else {
710 ipf_inet_mask_del(0, &softn->ipf_nat_rdr_mask);
711 }
712 if (n->in_rnext)
713 n->in_rnext->in_prnext = n->in_prnext;
714 *n->in_prnext = n->in_rnext;
715 n->in_use--;
716 }
717
718
719 /* ------------------------------------------------------------------------ */
720 /* Function: ipf_nat_delmap */
721 /* Returns: Nil */
722 /* Parameters: n(I) - pointer to NAT rule to delete */
723 /* */
724 /* Removes a NAT map rule from the hash table of NAT map rules. */
725 /* ------------------------------------------------------------------------ */
726 void
ipf_nat_delmap(ipf_nat_softc_t * softn,ipnat_t * n)727 ipf_nat_delmap(ipf_nat_softc_t *softn, ipnat_t *n)
728 {
729 if (n->in_osrcatype == FRI_NORMAL) {
730 int k = count4bits(n->in_osrcmsk);
731 ipf_inet_mask_del(k, &softn->ipf_nat_map_mask);
732 } else {
733 ipf_inet_mask_del(0, &softn->ipf_nat_map_mask);
734 }
735 if (n->in_mnext != NULL)
736 n->in_mnext->in_pmnext = n->in_pmnext;
737 *n->in_pmnext = n->in_mnext;
738 n->in_use--;
739 }
740
741
742 /* ------------------------------------------------------------------------ */
743 /* Function: ipf_nat_hostmap */
744 /* Returns: struct hostmap* - NULL if no hostmap could be created, */
745 /* else a pointer to the hostmapping to use */
746 /* Parameters: np(I) - pointer to NAT rule */
747 /* real(I) - real IP address */
748 /* map(I) - mapped IP address */
749 /* port(I) - destination port number */
750 /* Write Locks: ipf_nat */
751 /* */
752 /* Check if an ip address has already been allocated for a given mapping */
753 /* that is not doing port based translation. If is not yet allocated, then */
754 /* create a new entry if a non-NULL NAT rule pointer has been supplied. */
755 /* ------------------------------------------------------------------------ */
756 static struct hostmap *
ipf_nat_hostmap(ipf_nat_softc_t * softn,ipnat_t * np,struct in_addr src,struct in_addr dst,struct in_addr map,u_32_t port)757 ipf_nat_hostmap(ipf_nat_softc_t *softn, ipnat_t *np, struct in_addr src,
758 struct in_addr dst, struct in_addr map, u_32_t port)
759 {
760 hostmap_t *hm;
761 u_int hv, rhv;
762
763 hv = (src.s_addr ^ dst.s_addr);
764 hv += src.s_addr;
765 hv += dst.s_addr;
766 rhv = hv;
767 hv %= softn->ipf_nat_hostmap_sz;
768 for (hm = softn->ipf_hm_maptable[hv]; hm; hm = hm->hm_hnext)
769 if ((hm->hm_osrcip.s_addr == src.s_addr) &&
770 (hm->hm_odstip.s_addr == dst.s_addr) &&
771 ((np == NULL) || (np == hm->hm_ipnat)) &&
772 ((port == 0) || (port == hm->hm_port))) {
773 softn->ipf_nat_stats.ns_hm_addref++;
774 hm->hm_ref++;
775 return (hm);
776 }
777
778 if (np == NULL) {
779 softn->ipf_nat_stats.ns_hm_nullnp++;
780 return (NULL);
781 }
782
783 KMALLOC(hm, hostmap_t *);
784 if (hm) {
785 hm->hm_next = softn->ipf_hm_maplist;
786 hm->hm_pnext = &softn->ipf_hm_maplist;
787 if (softn->ipf_hm_maplist != NULL)
788 softn->ipf_hm_maplist->hm_pnext = &hm->hm_next;
789 softn->ipf_hm_maplist = hm;
790 hm->hm_hnext = softn->ipf_hm_maptable[hv];
791 hm->hm_phnext = softn->ipf_hm_maptable + hv;
792 if (softn->ipf_hm_maptable[hv] != NULL)
793 softn->ipf_hm_maptable[hv]->hm_phnext = &hm->hm_hnext;
794 softn->ipf_hm_maptable[hv] = hm;
795 hm->hm_ipnat = np;
796 np->in_use++;
797 hm->hm_osrcip = src;
798 hm->hm_odstip = dst;
799 hm->hm_nsrcip = map;
800 hm->hm_ndstip.s_addr = 0;
801 hm->hm_ref = 1;
802 hm->hm_port = port;
803 hm->hm_hv = rhv;
804 hm->hm_v = 4;
805 softn->ipf_nat_stats.ns_hm_new++;
806 } else {
807 softn->ipf_nat_stats.ns_hm_newfail++;
808 }
809 return (hm);
810 }
811
812
813 /* ------------------------------------------------------------------------ */
814 /* Function: ipf_nat_hostmapdel */
815 /* Returns: Nil */
816 /* Parameters: hmp(I) - pointer to hostmap structure pointer */
817 /* Write Locks: ipf_nat */
818 /* */
819 /* Decrement the references to this hostmap structure by one. If this */
820 /* reaches zero then remove it and free it. */
821 /* ------------------------------------------------------------------------ */
822 void
ipf_nat_hostmapdel(ipf_main_softc_t * softc,struct hostmap ** hmp)823 ipf_nat_hostmapdel(ipf_main_softc_t *softc, struct hostmap **hmp)
824 {
825 struct hostmap *hm;
826
827 hm = *hmp;
828 *hmp = NULL;
829
830 hm->hm_ref--;
831 if (hm->hm_ref == 0) {
832 ipf_nat_rule_deref(softc, &hm->hm_ipnat);
833 if (hm->hm_hnext)
834 hm->hm_hnext->hm_phnext = hm->hm_phnext;
835 *hm->hm_phnext = hm->hm_hnext;
836 if (hm->hm_next)
837 hm->hm_next->hm_pnext = hm->hm_pnext;
838 *hm->hm_pnext = hm->hm_next;
839 KFREE(hm);
840 }
841 }
842
843
844 /* ------------------------------------------------------------------------ */
845 /* Function: ipf_fix_outcksum */
846 /* Returns: Nil */
847 /* Parameters: cksum(I) - ipf_cksum_t, value of fin_cksum */
848 /* sp(I) - location of 16bit checksum to update */
849 /* n(I) - amount to adjust checksum by */
850 /* partial(I) - partial checksum */
851 /* */
852 /* Adjusts the 16bit checksum by "n" for packets going out. */
853 /* ------------------------------------------------------------------------ */
854 void
ipf_fix_outcksum(int cksum,u_short * sp,u_32_t n,u_32_t partial)855 ipf_fix_outcksum(int cksum, u_short *sp, u_32_t n, u_32_t partial)
856 {
857 u_short sumshort;
858 u_32_t sum1;
859
860 if (n == 0)
861 return;
862
863 if (cksum == 4) {
864 *sp = 0;
865 return;
866 }
867 if (cksum == 2) {
868 sum1 = partial;
869 sum1 = (sum1 & 0xffff) + (sum1 >> 16);
870 *sp = htons(sum1);
871 return;
872 }
873 sum1 = (~ntohs(*sp)) & 0xffff;
874 sum1 += (n);
875 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
876 /* Again */
877 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
878 sumshort = ~(u_short)sum1;
879 *(sp) = htons(sumshort);
880 }
881
882
883 /* ------------------------------------------------------------------------ */
884 /* Function: ipf_fix_incksum */
885 /* Returns: Nil */
886 /* Parameters: cksum(I) - ipf_cksum_t, value of fin_cksum */
887 /* sp(I) - location of 16bit checksum to update */
888 /* n(I) - amount to adjust checksum by */
889 /* partial(I) - partial checksum */
890 /* */
891 /* Adjusts the 16bit checksum by "n" for packets going in. */
892 /* ------------------------------------------------------------------------ */
893 void
ipf_fix_incksum(int cksum,u_short * sp,u_32_t n,u_32_t partial)894 ipf_fix_incksum(int cksum, u_short *sp, u_32_t n, u_32_t partial)
895 {
896 u_short sumshort;
897 u_32_t sum1;
898
899 if (n == 0)
900 return;
901
902 if (cksum == 4) {
903 *sp = 0;
904 return;
905 }
906 if (cksum == 2) {
907 sum1 = partial;
908 sum1 = (sum1 & 0xffff) + (sum1 >> 16);
909 *sp = htons(sum1);
910 return;
911 }
912
913 sum1 = (~ntohs(*sp)) & 0xffff;
914 sum1 += ~(n) & 0xffff;
915 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
916 /* Again */
917 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
918 sumshort = ~(u_short)sum1;
919 *(sp) = htons(sumshort);
920 }
921
922
923 /* ------------------------------------------------------------------------ */
924 /* Function: ipf_fix_datacksum */
925 /* Returns: Nil */
926 /* Parameters: sp(I) - location of 16bit checksum to update */
927 /* n(I) - amount to adjust checksum by */
928 /* */
929 /* Fix_datacksum is used *only* for the adjustments of checksums in the */
930 /* data section of an IP packet. */
931 /* */
932 /* The only situation in which you need to do this is when NAT'ing an */
933 /* ICMP error message. Such a message, contains in its body the IP header */
934 /* of the original IP packet, that causes the error. */
935 /* */
936 /* You can't use fix_incksum or fix_outcksum in that case, because for the */
937 /* kernel the data section of the ICMP error is just data, and no special */
938 /* processing like hardware cksum or ntohs processing have been done by the */
939 /* kernel on the data section. */
940 /* ------------------------------------------------------------------------ */
941 void
ipf_fix_datacksum(u_short * sp,u_32_t n)942 ipf_fix_datacksum(u_short *sp, u_32_t n)
943 {
944 u_short sumshort;
945 u_32_t sum1;
946
947 if (n == 0)
948 return;
949
950 sum1 = (~ntohs(*sp)) & 0xffff;
951 sum1 += (n);
952 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
953 /* Again */
954 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
955 sumshort = ~(u_short)sum1;
956 *(sp) = htons(sumshort);
957 }
958
959
960 /* ------------------------------------------------------------------------ */
961 /* Function: ipf_nat_ioctl */
962 /* Returns: int - 0 == success, != 0 == failure */
963 /* Parameters: softc(I) - pointer to soft context main structure */
964 /* data(I) - pointer to ioctl data */
965 /* cmd(I) - ioctl command integer */
966 /* mode(I) - file mode bits used with open */
967 /* uid(I) - uid of calling process */
968 /* ctx(I) - pointer used as key for finding context */
969 /* */
970 /* Processes an ioctl call made to operate on the IP Filter NAT device. */
971 /* ------------------------------------------------------------------------ */
972 int
ipf_nat_ioctl(ipf_main_softc_t * softc,caddr_t data,ioctlcmd_t cmd,int mode,int uid,void * ctx)973 ipf_nat_ioctl(ipf_main_softc_t *softc, caddr_t data, ioctlcmd_t cmd,
974 int mode, int uid, void *ctx)
975 {
976 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
977 int error = 0, ret, arg, getlock;
978 ipnat_t *nat, *nt, *n;
979 ipnat_t natd;
980 SPL_INT(s);
981
982 #if !SOLARIS && defined(_KERNEL)
983 # if NETBSD_GE_REV(399002000)
984 if ((mode & FWRITE) &&
985 kauth_authorize_network(curlwp->l_cred, KAUTH_NETWORK_FIREWALL,
986 KAUTH_REQ_NETWORK_FIREWALL_FW,
987 NULL, NULL, NULL))
988 # else
989 # if defined(__FreeBSD__)
990 if (securelevel_ge(curthread->td_ucred, 3) && (mode & FWRITE))
991 # else
992 if ((securelevel >= 3) && (mode & FWRITE))
993 # endif
994 # endif
995 {
996 IPFERROR(60001);
997 return (EPERM);
998 }
999 # if defined(__FreeBSD__)
1000 if (jailed_without_vnet(curthread->td_ucred)) {
1001 IPFERROR(60076);
1002 return (EOPNOTSUPP);
1003 }
1004 # endif
1005 #endif
1006
1007 getlock = (mode & NAT_LOCKHELD) ? 0 : 1;
1008
1009 n = NULL;
1010 nt = NULL;
1011 nat = NULL;
1012
1013 if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT) ||
1014 (cmd == (ioctlcmd_t)SIOCPURGENAT)) {
1015 if (mode & NAT_SYSSPACE) {
1016 bcopy(data, (char *)&natd, sizeof(natd));
1017 nat = &natd;
1018 error = 0;
1019 } else {
1020 bzero(&natd, sizeof(natd));
1021 error = ipf_inobj(softc, data, NULL, &natd,
1022 IPFOBJ_IPNAT);
1023 if (error != 0)
1024 goto done;
1025
1026 if (natd.in_size < sizeof(ipnat_t)) {
1027 error = EINVAL;
1028 goto done;
1029 }
1030 KMALLOCS(nt, ipnat_t *, natd.in_size);
1031 if (nt == NULL) {
1032 IPFERROR(60070);
1033 error = ENOMEM;
1034 goto done;
1035 }
1036 bzero(nt, natd.in_size);
1037 error = ipf_inobjsz(softc, data, nt, IPFOBJ_IPNAT,
1038 natd.in_size);
1039 if (error)
1040 goto done;
1041 nat = nt;
1042 }
1043
1044 /*
1045 * For add/delete, look to see if the NAT entry is
1046 * already present
1047 */
1048 nat->in_flags &= IPN_USERFLAGS;
1049 if ((nat->in_redir & NAT_MAPBLK) == 0) {
1050 if (nat->in_osrcatype == FRI_NORMAL ||
1051 nat->in_osrcatype == FRI_NONE)
1052 nat->in_osrcaddr &= nat->in_osrcmsk;
1053 if (nat->in_odstatype == FRI_NORMAL ||
1054 nat->in_odstatype == FRI_NONE)
1055 nat->in_odstaddr &= nat->in_odstmsk;
1056 if ((nat->in_flags & (IPN_SPLIT|IPN_SIPRANGE)) == 0) {
1057 if (nat->in_nsrcatype == FRI_NORMAL)
1058 nat->in_nsrcaddr &= nat->in_nsrcmsk;
1059 if (nat->in_ndstatype == FRI_NORMAL)
1060 nat->in_ndstaddr &= nat->in_ndstmsk;
1061 }
1062 }
1063
1064 error = ipf_nat_rule_init(softc, softn, nat);
1065 if (error != 0)
1066 goto done;
1067
1068 MUTEX_ENTER(&softn->ipf_nat_io);
1069 for (n = softn->ipf_nat_list; n != NULL; n = n->in_next)
1070 if (ipf_nat_cmp_rules(nat, n) == 0)
1071 break;
1072 }
1073
1074 switch (cmd)
1075 {
1076 #ifdef IPFILTER_LOG
1077 case SIOCIPFFB :
1078 {
1079 int tmp;
1080
1081 if (!(mode & FWRITE)) {
1082 IPFERROR(60002);
1083 error = EPERM;
1084 } else {
1085 tmp = ipf_log_clear(softc, IPL_LOGNAT);
1086 error = BCOPYOUT(&tmp, data, sizeof(tmp));
1087 if (error != 0) {
1088 IPFERROR(60057);
1089 error = EFAULT;
1090 }
1091 }
1092 break;
1093 }
1094
1095 case SIOCSETLG :
1096 if (!(mode & FWRITE)) {
1097 IPFERROR(60003);
1098 error = EPERM;
1099 } else {
1100 error = BCOPYIN(data, &softn->ipf_nat_logging,
1101 sizeof(softn->ipf_nat_logging));
1102 if (error != 0)
1103 error = EFAULT;
1104 }
1105 break;
1106
1107 case SIOCGETLG :
1108 error = BCOPYOUT(&softn->ipf_nat_logging, data,
1109 sizeof(softn->ipf_nat_logging));
1110 if (error != 0) {
1111 IPFERROR(60004);
1112 error = EFAULT;
1113 }
1114 break;
1115
1116 case FIONREAD :
1117 arg = ipf_log_bytesused(softc, IPL_LOGNAT);
1118 error = BCOPYOUT(&arg, data, sizeof(arg));
1119 if (error != 0) {
1120 IPFERROR(60005);
1121 error = EFAULT;
1122 }
1123 break;
1124 #endif
1125 case SIOCADNAT :
1126 if (!(mode & FWRITE)) {
1127 IPFERROR(60006);
1128 error = EPERM;
1129 } else if (n != NULL) {
1130 natd.in_flineno = n->in_flineno;
1131 (void) ipf_outobj(softc, data, &natd, IPFOBJ_IPNAT);
1132 IPFERROR(60007);
1133 error = EEXIST;
1134 } else if (nt == NULL) {
1135 IPFERROR(60008);
1136 error = ENOMEM;
1137 }
1138 if (error != 0) {
1139 MUTEX_EXIT(&softn->ipf_nat_io);
1140 break;
1141 }
1142 if (nat != nt)
1143 bcopy((char *)nat, (char *)nt, sizeof(*n));
1144 error = ipf_nat_siocaddnat(softc, softn, nt, getlock);
1145 MUTEX_EXIT(&softn->ipf_nat_io);
1146 if (error == 0) {
1147 nat = NULL;
1148 nt = NULL;
1149 }
1150 break;
1151
1152 case SIOCRMNAT :
1153 case SIOCPURGENAT :
1154 if (!(mode & FWRITE)) {
1155 IPFERROR(60009);
1156 error = EPERM;
1157 n = NULL;
1158 } else if (n == NULL) {
1159 IPFERROR(60010);
1160 error = ESRCH;
1161 }
1162
1163 if (error != 0) {
1164 MUTEX_EXIT(&softn->ipf_nat_io);
1165 break;
1166 }
1167 if (cmd == (ioctlcmd_t)SIOCPURGENAT) {
1168 error = ipf_outobjsz(softc, data, n, IPFOBJ_IPNAT,
1169 n->in_size);
1170 if (error) {
1171 MUTEX_EXIT(&softn->ipf_nat_io);
1172 goto done;
1173 }
1174 n->in_flags |= IPN_PURGE;
1175 }
1176 ipf_nat_siocdelnat(softc, softn, n, getlock);
1177
1178 MUTEX_EXIT(&softn->ipf_nat_io);
1179 n = NULL;
1180 break;
1181
1182 case SIOCGNATS :
1183 {
1184 natstat_t *nsp = &softn->ipf_nat_stats;
1185
1186 nsp->ns_side[0].ns_table = softn->ipf_nat_table[0];
1187 nsp->ns_side[1].ns_table = softn->ipf_nat_table[1];
1188 nsp->ns_list = softn->ipf_nat_list;
1189 nsp->ns_maptable = softn->ipf_hm_maptable;
1190 nsp->ns_maplist = softn->ipf_hm_maplist;
1191 nsp->ns_nattab_sz = softn->ipf_nat_table_sz;
1192 nsp->ns_nattab_max = softn->ipf_nat_table_max;
1193 nsp->ns_rultab_sz = softn->ipf_nat_maprules_sz;
1194 nsp->ns_rdrtab_sz = softn->ipf_nat_rdrrules_sz;
1195 nsp->ns_hostmap_sz = softn->ipf_nat_hostmap_sz;
1196 nsp->ns_instances = softn->ipf_nat_instances;
1197 nsp->ns_ticks = softc->ipf_ticks;
1198 #ifdef IPFILTER_LOGGING
1199 nsp->ns_log_ok = ipf_log_logok(softc, IPF_LOGNAT);
1200 nsp->ns_log_fail = ipf_log_failures(softc, IPF_LOGNAT);
1201 #else
1202 nsp->ns_log_ok = 0;
1203 nsp->ns_log_fail = 0;
1204 #endif
1205 error = ipf_outobj(softc, data, nsp, IPFOBJ_NATSTAT);
1206 break;
1207 }
1208
1209 case SIOCGNATL :
1210 {
1211 natlookup_t nl;
1212
1213 error = ipf_inobj(softc, data, NULL, &nl, IPFOBJ_NATLOOKUP);
1214 if (error == 0) {
1215 void *ptr;
1216
1217 if (getlock) {
1218 READ_ENTER(&softc->ipf_nat);
1219 }
1220
1221 switch (nl.nl_v)
1222 {
1223 case 4 :
1224 ptr = ipf_nat_lookupredir(&nl);
1225 break;
1226 #ifdef USE_INET6
1227 case 6 :
1228 ptr = ipf_nat6_lookupredir(&nl);
1229 break;
1230 #endif
1231 default:
1232 ptr = NULL;
1233 break;
1234 }
1235
1236 if (getlock) {
1237 RWLOCK_EXIT(&softc->ipf_nat);
1238 }
1239 if (ptr != NULL) {
1240 error = ipf_outobj(softc, data, &nl,
1241 IPFOBJ_NATLOOKUP);
1242 } else {
1243 IPFERROR(60011);
1244 error = ESRCH;
1245 }
1246 }
1247 break;
1248 }
1249
1250 case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */
1251 if (!(mode & FWRITE)) {
1252 IPFERROR(60012);
1253 error = EPERM;
1254 break;
1255 }
1256 if (getlock) {
1257 WRITE_ENTER(&softc->ipf_nat);
1258 }
1259
1260 error = BCOPYIN(data, &arg, sizeof(arg));
1261 if (error != 0) {
1262 IPFERROR(60013);
1263 error = EFAULT;
1264 } else {
1265 if (arg == 0)
1266 ret = ipf_nat_flushtable(softc, softn);
1267 else if (arg == 1)
1268 ret = ipf_nat_clearlist(softc, softn);
1269 else
1270 ret = ipf_nat_extraflush(softc, softn, arg);
1271 ipf_proxy_flush(softc->ipf_proxy_soft, arg);
1272 }
1273
1274 if (getlock) {
1275 RWLOCK_EXIT(&softc->ipf_nat);
1276 }
1277 if (error == 0) {
1278 error = BCOPYOUT(&ret, data, sizeof(ret));
1279 }
1280 break;
1281
1282 case SIOCMATCHFLUSH :
1283 if (!(mode & FWRITE)) {
1284 IPFERROR(60014);
1285 error = EPERM;
1286 break;
1287 }
1288 if (getlock) {
1289 WRITE_ENTER(&softc->ipf_nat);
1290 }
1291
1292 error = ipf_nat_matchflush(softc, softn, data);
1293
1294 if (getlock) {
1295 RWLOCK_EXIT(&softc->ipf_nat);
1296 }
1297 break;
1298
1299 case SIOCPROXY :
1300 error = ipf_proxy_ioctl(softc, data, cmd, mode, ctx);
1301 break;
1302
1303 case SIOCSTLCK :
1304 if (!(mode & FWRITE)) {
1305 IPFERROR(60015);
1306 error = EPERM;
1307 } else {
1308 error = ipf_lock(data, &softn->ipf_nat_lock);
1309 }
1310 break;
1311
1312 case SIOCSTPUT :
1313 if ((mode & FWRITE) != 0) {
1314 error = ipf_nat_putent(softc, data, getlock);
1315 } else {
1316 IPFERROR(60016);
1317 error = EACCES;
1318 }
1319 break;
1320
1321 case SIOCSTGSZ :
1322 if (softn->ipf_nat_lock) {
1323 error = ipf_nat_getsz(softc, data, getlock);
1324 } else {
1325 IPFERROR(60017);
1326 error = EACCES;
1327 }
1328 break;
1329
1330 case SIOCSTGET :
1331 if (softn->ipf_nat_lock) {
1332 error = ipf_nat_getent(softc, data, getlock);
1333 } else {
1334 IPFERROR(60018);
1335 error = EACCES;
1336 }
1337 break;
1338
1339 case SIOCGENITER :
1340 {
1341 ipfgeniter_t iter;
1342 ipftoken_t *token;
1343 ipfobj_t obj;
1344
1345 error = ipf_inobj(softc, data, &obj, &iter, IPFOBJ_GENITER);
1346 if (error != 0)
1347 break;
1348
1349 SPL_SCHED(s);
1350 token = ipf_token_find(softc, iter.igi_type, uid, ctx);
1351 if (token != NULL) {
1352 error = ipf_nat_iterator(softc, token, &iter, &obj);
1353 WRITE_ENTER(&softc->ipf_tokens);
1354 ipf_token_deref(softc, token);
1355 RWLOCK_EXIT(&softc->ipf_tokens);
1356 }
1357 SPL_X(s);
1358 break;
1359 }
1360
1361 case SIOCIPFDELTOK :
1362 error = BCOPYIN(data, &arg, sizeof(arg));
1363 if (error == 0) {
1364 SPL_SCHED(s);
1365 error = ipf_token_del(softc, arg, uid, ctx);
1366 SPL_X(s);
1367 } else {
1368 IPFERROR(60019);
1369 error = EFAULT;
1370 }
1371 break;
1372
1373 case SIOCGTQTAB :
1374 error = ipf_outobj(softc, data, softn->ipf_nat_tcptq,
1375 IPFOBJ_STATETQTAB);
1376 break;
1377
1378 case SIOCGTABL :
1379 error = ipf_nat_gettable(softc, softn, data);
1380 break;
1381
1382 default :
1383 IPFERROR(60020);
1384 error = EINVAL;
1385 break;
1386 }
1387 done:
1388 if (nat != NULL)
1389 ipf_nat_rule_fini(softc, nat);
1390 if (nt != NULL)
1391 KFREES(nt, nt->in_size);
1392 return (error);
1393 }
1394
1395
1396 /* ------------------------------------------------------------------------ */
1397 /* Function: ipf_nat_siocaddnat */
1398 /* Returns: int - 0 == success, != 0 == failure */
1399 /* Parameters: softc(I) - pointer to soft context main structure */
1400 /* softn(I) - pointer to NAT context structure */
1401 /* n(I) - pointer to new NAT rule */
1402 /* np(I) - pointer to where to insert new NAT rule */
1403 /* getlock(I) - flag indicating if lock on is held */
1404 /* Mutex Locks: ipf_nat_io */
1405 /* */
1406 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
1407 /* from information passed to the kernel, then add it to the appropriate */
1408 /* NAT rule table(s). */
1409 /* ------------------------------------------------------------------------ */
1410 static int
ipf_nat_siocaddnat(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * n,int getlock)1411 ipf_nat_siocaddnat(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, ipnat_t *n,
1412 int getlock)
1413 {
1414 int error = 0;
1415
1416 if (ipf_nat_resolverule(softc, n) != 0) {
1417 IPFERROR(60022);
1418 return (ENOENT);
1419 }
1420
1421 if ((n->in_age[0] == 0) && (n->in_age[1] != 0)) {
1422 IPFERROR(60023);
1423 return (EINVAL);
1424 }
1425
1426 if (n->in_redir == (NAT_DIVERTUDP|NAT_MAP)) {
1427 /*
1428 * Prerecord whether or not the destination of the divert
1429 * is local or not to the interface the packet is going
1430 * to be sent out.
1431 */
1432 n->in_dlocal = ipf_deliverlocal(softc, n->in_v[1],
1433 n->in_ifps[1], &n->in_ndstip6);
1434 }
1435
1436 if (getlock) {
1437 WRITE_ENTER(&softc->ipf_nat);
1438 }
1439 n->in_next = NULL;
1440 n->in_pnext = softn->ipf_nat_list_tail;
1441 *n->in_pnext = n;
1442 softn->ipf_nat_list_tail = &n->in_next;
1443 n->in_use++;
1444
1445 if (n->in_redir & NAT_REDIRECT) {
1446 n->in_flags &= ~IPN_NOTDST;
1447 switch (n->in_v[0])
1448 {
1449 case 4 :
1450 ipf_nat_addrdr(softn, n);
1451 break;
1452 #ifdef USE_INET6
1453 case 6 :
1454 ipf_nat6_addrdr(softn, n);
1455 break;
1456 #endif
1457 default :
1458 break;
1459 }
1460 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules_rdr);
1461 }
1462
1463 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
1464 n->in_flags &= ~IPN_NOTSRC;
1465 switch (n->in_v[0])
1466 {
1467 case 4 :
1468 ipf_nat_addmap(softn, n);
1469 break;
1470 #ifdef USE_INET6
1471 case 6 :
1472 ipf_nat6_addmap(softn, n);
1473 break;
1474 #endif
1475 default :
1476 break;
1477 }
1478 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules_map);
1479 }
1480
1481 if (n->in_age[0] != 0)
1482 n->in_tqehead[0] = ipf_addtimeoutqueue(softc,
1483 &softn->ipf_nat_utqe,
1484 n->in_age[0]);
1485
1486 if (n->in_age[1] != 0)
1487 n->in_tqehead[1] = ipf_addtimeoutqueue(softc,
1488 &softn->ipf_nat_utqe,
1489 n->in_age[1]);
1490
1491 MUTEX_INIT(&n->in_lock, "ipnat rule lock");
1492
1493 n = NULL;
1494 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules);
1495 #if SOLARIS && !defined(INSTANCES)
1496 pfil_delayed_copy = 0;
1497 #endif
1498 if (getlock) {
1499 RWLOCK_EXIT(&softc->ipf_nat); /* WRITE */
1500 }
1501
1502 return (error);
1503 }
1504
1505
1506 /* ------------------------------------------------------------------------ */
1507 /* Function: ipf_nat_ruleaddrinit */
1508 /* Parameters: softc(I) - pointer to soft context main structure */
1509 /* softn(I) - pointer to NAT context structure */
1510 /* n(I) - pointer to NAT rule */
1511 /* */
1512 /* Initialise all of the NAT address structures in a NAT rule. */
1513 /* ------------------------------------------------------------------------ */
1514 static int
ipf_nat_ruleaddrinit(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * n)1515 ipf_nat_ruleaddrinit(ipf_main_softc_t *softc, ipf_nat_softc_t *softn,
1516 ipnat_t *n)
1517 {
1518 int idx, error;
1519
1520 if ((n->in_ndst.na_atype == FRI_LOOKUP) &&
1521 (n->in_ndst.na_type != IPLT_DSTLIST)) {
1522 IPFERROR(60071);
1523 return (EINVAL);
1524 }
1525 if ((n->in_nsrc.na_atype == FRI_LOOKUP) &&
1526 (n->in_nsrc.na_type != IPLT_DSTLIST)) {
1527 IPFERROR(60069);
1528 return (EINVAL);
1529 }
1530
1531 if (n->in_redir == NAT_BIMAP) {
1532 n->in_ndstaddr = n->in_osrcaddr;
1533 n->in_ndstmsk = n->in_osrcmsk;
1534 n->in_odstaddr = n->in_nsrcaddr;
1535 n->in_odstmsk = n->in_nsrcmsk;
1536
1537 }
1538
1539 if (n->in_redir & NAT_REDIRECT)
1540 idx = 1;
1541 else
1542 idx = 0;
1543 /*
1544 * Initialise all of the address fields.
1545 */
1546 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_osrc, 1,
1547 n->in_ifps[idx]);
1548 if (error != 0)
1549 return (error);
1550
1551 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_odst, 1,
1552 n->in_ifps[idx]);
1553 if (error != 0)
1554 return (error);
1555
1556 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_nsrc, 1,
1557 n->in_ifps[idx]);
1558 if (error != 0)
1559 return (error);
1560
1561 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_ndst, 1,
1562 n->in_ifps[idx]);
1563 if (error != 0)
1564 return (error);
1565
1566 if (n->in_redir & NAT_DIVERTUDP)
1567 ipf_nat_builddivertmp(softn, n);
1568
1569 return (0);
1570 }
1571
1572
1573 /* ------------------------------------------------------------------------ */
1574 /* Function: ipf_nat_resolvrule */
1575 /* Returns: Nil */
1576 /* Parameters: softc(I) - pointer to soft context main structure */
1577 /* n(I) - pointer to NAT rule */
1578 /* */
1579 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
1580 /* from information passed to the kernel, then add it to the appropriate */
1581 /* NAT rule table(s). */
1582 /* ------------------------------------------------------------------------ */
1583 static int
ipf_nat_resolverule(ipf_main_softc_t * softc,ipnat_t * n)1584 ipf_nat_resolverule(ipf_main_softc_t *softc, ipnat_t *n)
1585 {
1586 char *base;
1587
1588 base = n->in_names;
1589
1590 n->in_ifps[0] = ipf_resolvenic(softc, base + n->in_ifnames[0],
1591 n->in_v[0]);
1592
1593 if (n->in_ifnames[1] == -1) {
1594 n->in_ifnames[1] = n->in_ifnames[0];
1595 n->in_ifps[1] = n->in_ifps[0];
1596 } else {
1597 n->in_ifps[1] = ipf_resolvenic(softc, base + n->in_ifnames[1],
1598 n->in_v[1]);
1599 }
1600
1601 if (n->in_plabel != -1) {
1602 if (n->in_redir & NAT_REDIRECT)
1603 n->in_apr = ipf_proxy_lookup(softc->ipf_proxy_soft,
1604 n->in_pr[0],
1605 base + n->in_plabel);
1606 else
1607 n->in_apr = ipf_proxy_lookup(softc->ipf_proxy_soft,
1608 n->in_pr[1],
1609 base + n->in_plabel);
1610 if (n->in_apr == NULL)
1611 return (-1);
1612 }
1613 return (0);
1614 }
1615
1616
1617 /* ------------------------------------------------------------------------ */
1618 /* Function: ipf_nat_siocdelnat */
1619 /* Returns: int - 0 == success, != 0 == failure */
1620 /* Parameters: softc(I) - pointer to soft context main structure */
1621 /* softn(I) - pointer to NAT context structure */
1622 /* n(I) - pointer to new NAT rule */
1623 /* getlock(I) - flag indicating if lock on is held */
1624 /* Mutex Locks: ipf_nat_io */
1625 /* */
1626 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
1627 /* from information passed to the kernel, then add it to the appropriate */
1628 /* NAT rule table(s). */
1629 /* ------------------------------------------------------------------------ */
1630 static void
ipf_nat_siocdelnat(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * n,int getlock)1631 ipf_nat_siocdelnat(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, ipnat_t *n,
1632 int getlock)
1633 {
1634 if (getlock) {
1635 WRITE_ENTER(&softc->ipf_nat);
1636 }
1637
1638 ipf_nat_delrule(softc, softn, n, 1);
1639
1640 if (getlock) {
1641 RWLOCK_EXIT(&softc->ipf_nat); /* READ/WRITE */
1642 }
1643 }
1644
1645
1646 /* ------------------------------------------------------------------------ */
1647 /* Function: ipf_nat_getsz */
1648 /* Returns: int - 0 == success, != 0 is the error value. */
1649 /* Parameters: softc(I) - pointer to soft context main structure */
1650 /* data(I) - pointer to natget structure with kernel */
1651 /* pointer get the size of. */
1652 /* getlock(I) - flag indicating whether or not the caller */
1653 /* holds a lock on ipf_nat */
1654 /* */
1655 /* Handle SIOCSTGSZ. */
1656 /* Return the size of the nat list entry to be copied back to user space. */
1657 /* The size of the entry is stored in the ng_sz field and the enture natget */
1658 /* structure is copied back to the user. */
1659 /* ------------------------------------------------------------------------ */
1660 static int
ipf_nat_getsz(ipf_main_softc_t * softc,caddr_t data,int getlock)1661 ipf_nat_getsz(ipf_main_softc_t *softc, caddr_t data, int getlock)
1662 {
1663 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1664 ap_session_t *aps;
1665 nat_t *nat, *n;
1666 natget_t ng;
1667 int error;
1668
1669 error = BCOPYIN(data, &ng, sizeof(ng));
1670 if (error != 0) {
1671 IPFERROR(60024);
1672 return (EFAULT);
1673 }
1674
1675 if (getlock) {
1676 READ_ENTER(&softc->ipf_nat);
1677 }
1678
1679 nat = ng.ng_ptr;
1680 if (!nat) {
1681 nat = softn->ipf_nat_instances;
1682 ng.ng_sz = 0;
1683 /*
1684 * Empty list so the size returned is 0. Simple.
1685 */
1686 if (nat == NULL) {
1687 if (getlock) {
1688 RWLOCK_EXIT(&softc->ipf_nat);
1689 }
1690 error = BCOPYOUT(&ng, data, sizeof(ng));
1691 if (error != 0) {
1692 IPFERROR(60025);
1693 return (EFAULT);
1694 }
1695 return (0);
1696 }
1697 } else {
1698 /*
1699 * Make sure the pointer we're copying from exists in the
1700 * current list of entries. Security precaution to prevent
1701 * copying of random kernel data.
1702 */
1703 for (n = softn->ipf_nat_instances; n; n = n->nat_next)
1704 if (n == nat)
1705 break;
1706 if (n == NULL) {
1707 if (getlock) {
1708 RWLOCK_EXIT(&softc->ipf_nat);
1709 }
1710 IPFERROR(60026);
1711 return (ESRCH);
1712 }
1713 }
1714
1715 /*
1716 * Include any space required for proxy data structures.
1717 */
1718 ng.ng_sz = sizeof(nat_save_t);
1719 aps = nat->nat_aps;
1720 if (aps != NULL) {
1721 ng.ng_sz += sizeof(ap_session_t) - 4;
1722 if (aps->aps_data != 0)
1723 ng.ng_sz += aps->aps_psiz;
1724 }
1725 if (getlock) {
1726 RWLOCK_EXIT(&softc->ipf_nat);
1727 }
1728
1729 error = BCOPYOUT(&ng, data, sizeof(ng));
1730 if (error != 0) {
1731 IPFERROR(60027);
1732 return (EFAULT);
1733 }
1734 return (0);
1735 }
1736
1737
1738 /* ------------------------------------------------------------------------ */
1739 /* Function: ipf_nat_getent */
1740 /* Returns: int - 0 == success, != 0 is the error value. */
1741 /* Parameters: softc(I) - pointer to soft context main structure */
1742 /* data(I) - pointer to natget structure with kernel pointer*/
1743 /* to NAT structure to copy out. */
1744 /* getlock(I) - flag indicating whether or not the caller */
1745 /* holds a lock on ipf_nat */
1746 /* */
1747 /* Handle SIOCSTGET. */
1748 /* Copies out NAT entry to user space. Any additional data held for a */
1749 /* proxy is also copied, as to is the NAT rule which was responsible for it */
1750 /* ------------------------------------------------------------------------ */
1751 static int
ipf_nat_getent(ipf_main_softc_t * softc,caddr_t data,int getlock)1752 ipf_nat_getent(ipf_main_softc_t *softc, caddr_t data, int getlock)
1753 {
1754 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1755 int error, outsize;
1756 ap_session_t *aps;
1757 nat_save_t *ipn, ipns;
1758 nat_t *n, *nat;
1759
1760 error = ipf_inobj(softc, data, NULL, &ipns, IPFOBJ_NATSAVE);
1761 if (error != 0)
1762 return (error);
1763
1764 if ((ipns.ipn_dsize < sizeof(ipns)) || (ipns.ipn_dsize > 81920)) {
1765 IPFERROR(60028);
1766 return (EINVAL);
1767 }
1768
1769 KMALLOCS(ipn, nat_save_t *, ipns.ipn_dsize);
1770 if (ipn == NULL) {
1771 IPFERROR(60029);
1772 return (ENOMEM);
1773 }
1774 bzero(ipn, ipns.ipn_dsize);
1775
1776 if (getlock) {
1777 READ_ENTER(&softc->ipf_nat);
1778 }
1779
1780 ipn->ipn_dsize = ipns.ipn_dsize;
1781 nat = ipns.ipn_next;
1782 if (nat == NULL) {
1783 nat = softn->ipf_nat_instances;
1784 if (nat == NULL) {
1785 if (softn->ipf_nat_instances == NULL) {
1786 IPFERROR(60030);
1787 error = ENOENT;
1788 }
1789 goto finished;
1790 }
1791 } else {
1792 /*
1793 * Make sure the pointer we're copying from exists in the
1794 * current list of entries. Security precaution to prevent
1795 * copying of random kernel data.
1796 */
1797 for (n = softn->ipf_nat_instances; n; n = n->nat_next)
1798 if (n == nat)
1799 break;
1800 if (n == NULL) {
1801 IPFERROR(60031);
1802 error = ESRCH;
1803 goto finished;
1804 }
1805 }
1806 ipn->ipn_next = nat->nat_next;
1807
1808 /*
1809 * Copy the NAT structure.
1810 */
1811 bcopy((char *)nat, &ipn->ipn_nat, sizeof(*nat));
1812
1813 /*
1814 * If we have a pointer to the NAT rule it belongs to, save that too.
1815 */
1816 if (nat->nat_ptr != NULL)
1817 bcopy((char *)nat->nat_ptr, (char *)&ipn->ipn_ipnat,
1818 sizeof(nat->nat_ptr));
1819
1820 /*
1821 * If we also know the NAT entry has an associated filter rule,
1822 * save that too.
1823 */
1824 if (nat->nat_fr != NULL)
1825 bcopy((char *)nat->nat_fr, (char *)&ipn->ipn_fr,
1826 sizeof(ipn->ipn_fr));
1827
1828 /*
1829 * Last but not least, if there is an application proxy session set
1830 * up for this NAT entry, then copy that out too, including any
1831 * private data saved along side it by the proxy.
1832 */
1833 aps = nat->nat_aps;
1834 outsize = ipn->ipn_dsize - sizeof(*ipn) + sizeof(ipn->ipn_data);
1835 if (aps != NULL) {
1836 char *s;
1837
1838 if (outsize < sizeof(*aps)) {
1839 IPFERROR(60032);
1840 error = ENOBUFS;
1841 goto finished;
1842 }
1843
1844 s = ipn->ipn_data;
1845 bcopy((char *)aps, s, sizeof(*aps));
1846 s += sizeof(*aps);
1847 outsize -= sizeof(*aps);
1848 if ((aps->aps_data != NULL) && (outsize >= aps->aps_psiz))
1849 bcopy(aps->aps_data, s, aps->aps_psiz);
1850 else {
1851 IPFERROR(60033);
1852 error = ENOBUFS;
1853 }
1854 }
1855 if (error == 0) {
1856 error = ipf_outobjsz(softc, data, ipn, IPFOBJ_NATSAVE,
1857 ipns.ipn_dsize);
1858 }
1859
1860 finished:
1861 if (ipn != NULL) {
1862 KFREES(ipn, ipns.ipn_dsize);
1863 }
1864 if (getlock) {
1865 RWLOCK_EXIT(&softc->ipf_nat);
1866 }
1867 return (error);
1868 }
1869
1870
1871 /* ------------------------------------------------------------------------ */
1872 /* Function: ipf_nat_putent */
1873 /* Returns: int - 0 == success, != 0 is the error value. */
1874 /* Parameters: softc(I) - pointer to soft context main structure */
1875 /* data(I) - pointer to natget structure with NAT */
1876 /* structure information to load into the kernel */
1877 /* getlock(I) - flag indicating whether or not a write lock */
1878 /* on is already held. */
1879 /* */
1880 /* Handle SIOCSTPUT. */
1881 /* Loads a NAT table entry from user space, including a NAT rule, proxy and */
1882 /* firewall rule data structures, if pointers to them indicate so. */
1883 /* ------------------------------------------------------------------------ */
1884 static int
ipf_nat_putent(ipf_main_softc_t * softc,caddr_t data,int getlock)1885 ipf_nat_putent(ipf_main_softc_t *softc, caddr_t data, int getlock)
1886 {
1887 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1888 nat_save_t ipn, *ipnn;
1889 ap_session_t *aps;
1890 nat_t *n, *nat;
1891 frentry_t *fr;
1892 fr_info_t fin;
1893 ipnat_t *in;
1894 int error;
1895
1896 error = ipf_inobj(softc, data, NULL, &ipn, IPFOBJ_NATSAVE);
1897 if (error != 0)
1898 return (error);
1899
1900 /*
1901 * Initialise early because of code at junkput label.
1902 */
1903 n = NULL;
1904 in = NULL;
1905 aps = NULL;
1906 nat = NULL;
1907 ipnn = NULL;
1908 fr = NULL;
1909
1910 /*
1911 * New entry, copy in the rest of the NAT entry if it's size is more
1912 * than just the nat_t structure.
1913 */
1914 if (ipn.ipn_dsize > sizeof(ipn)) {
1915 if (ipn.ipn_dsize > 81920) {
1916 IPFERROR(60034);
1917 error = ENOMEM;
1918 goto junkput;
1919 }
1920
1921 KMALLOCS(ipnn, nat_save_t *, ipn.ipn_dsize);
1922 if (ipnn == NULL) {
1923 IPFERROR(60035);
1924 return (ENOMEM);
1925 }
1926
1927 bzero(ipnn, ipn.ipn_dsize);
1928 error = ipf_inobjsz(softc, data, ipnn, IPFOBJ_NATSAVE,
1929 ipn.ipn_dsize);
1930 if (error != 0) {
1931 goto junkput;
1932 }
1933 } else
1934 ipnn = &ipn;
1935
1936 KMALLOC(nat, nat_t *);
1937 if (nat == NULL) {
1938 IPFERROR(60037);
1939 error = ENOMEM;
1940 goto junkput;
1941 }
1942
1943 bcopy((char *)&ipnn->ipn_nat, (char *)nat, sizeof(*nat));
1944
1945 switch (nat->nat_v[0])
1946 {
1947 case 4:
1948 #ifdef USE_INET6
1949 case 6 :
1950 #endif
1951 break;
1952 default :
1953 IPFERROR(60061);
1954 error = EPROTONOSUPPORT;
1955 goto junkput;
1956 /*NOTREACHED*/
1957 }
1958
1959 /*
1960 * Initialize all these so that ipf_nat_delete() doesn't cause a crash.
1961 */
1962 bzero((char *)nat, offsetof(struct nat, nat_tqe));
1963 nat->nat_tqe.tqe_pnext = NULL;
1964 nat->nat_tqe.tqe_next = NULL;
1965 nat->nat_tqe.tqe_ifq = NULL;
1966 nat->nat_tqe.tqe_parent = nat;
1967
1968 /*
1969 * Restore the rule associated with this nat session
1970 */
1971 in = ipnn->ipn_nat.nat_ptr;
1972 if (in != NULL) {
1973 KMALLOCS(in, ipnat_t *, ipnn->ipn_ipnat.in_size);
1974 nat->nat_ptr = in;
1975 if (in == NULL) {
1976 IPFERROR(60038);
1977 error = ENOMEM;
1978 goto junkput;
1979 }
1980 bcopy((char *)&ipnn->ipn_ipnat, (char *)in,
1981 ipnn->ipn_ipnat.in_size);
1982 in->in_use = 1;
1983 in->in_flags |= IPN_DELETE;
1984
1985 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules);
1986
1987 if (ipf_nat_resolverule(softc, in) != 0) {
1988 IPFERROR(60039);
1989 error = ESRCH;
1990 goto junkput;
1991 }
1992 }
1993
1994 /*
1995 * Check that the NAT entry doesn't already exist in the kernel.
1996 *
1997 * For NAT_OUTBOUND, we're lookup for a duplicate MAP entry. To do
1998 * this, we check to see if the inbound combination of addresses and
1999 * ports is already known. Similar logic is applied for NAT_INBOUND.
2000 *
2001 */
2002 bzero((char *)&fin, sizeof(fin));
2003 fin.fin_v = nat->nat_v[0];
2004 fin.fin_p = nat->nat_pr[0];
2005 fin.fin_rev = nat->nat_rev;
2006 fin.fin_ifp = nat->nat_ifps[0];
2007 fin.fin_data[0] = ntohs(nat->nat_ndport);
2008 fin.fin_data[1] = ntohs(nat->nat_nsport);
2009
2010 switch (nat->nat_dir)
2011 {
2012 case NAT_OUTBOUND :
2013 case NAT_DIVERTOUT :
2014 if (getlock) {
2015 READ_ENTER(&softc->ipf_nat);
2016 }
2017
2018 fin.fin_v = nat->nat_v[1];
2019 if (nat->nat_v[1] == 4) {
2020 n = ipf_nat_inlookup(&fin, nat->nat_flags, fin.fin_p,
2021 nat->nat_ndstip, nat->nat_nsrcip);
2022 #ifdef USE_INET6
2023 } else if (nat->nat_v[1] == 6) {
2024 n = ipf_nat6_inlookup(&fin, nat->nat_flags, fin.fin_p,
2025 &nat->nat_ndst6.in6,
2026 &nat->nat_nsrc6.in6);
2027 #endif
2028 }
2029
2030 if (getlock) {
2031 RWLOCK_EXIT(&softc->ipf_nat);
2032 }
2033 if (n != NULL) {
2034 IPFERROR(60040);
2035 error = EEXIST;
2036 goto junkput;
2037 }
2038 break;
2039
2040 case NAT_INBOUND :
2041 case NAT_DIVERTIN :
2042 if (getlock) {
2043 READ_ENTER(&softc->ipf_nat);
2044 }
2045
2046 if (fin.fin_v == 4) {
2047 n = ipf_nat_outlookup(&fin, nat->nat_flags, fin.fin_p,
2048 nat->nat_ndstip,
2049 nat->nat_nsrcip);
2050 #ifdef USE_INET6
2051 } else if (fin.fin_v == 6) {
2052 n = ipf_nat6_outlookup(&fin, nat->nat_flags, fin.fin_p,
2053 &nat->nat_ndst6.in6,
2054 &nat->nat_nsrc6.in6);
2055 #endif
2056 }
2057
2058 if (getlock) {
2059 RWLOCK_EXIT(&softc->ipf_nat);
2060 }
2061 if (n != NULL) {
2062 IPFERROR(60041);
2063 error = EEXIST;
2064 goto junkput;
2065 }
2066 break;
2067
2068 default :
2069 IPFERROR(60042);
2070 error = EINVAL;
2071 goto junkput;
2072 }
2073
2074 /*
2075 * Restore ap_session_t structure. Include the private data allocated
2076 * if it was there.
2077 */
2078 aps = nat->nat_aps;
2079 if (aps != NULL) {
2080 KMALLOC(aps, ap_session_t *);
2081 nat->nat_aps = aps;
2082 if (aps == NULL) {
2083 IPFERROR(60043);
2084 error = ENOMEM;
2085 goto junkput;
2086 }
2087 bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps));
2088 if (in != NULL)
2089 aps->aps_apr = in->in_apr;
2090 else
2091 aps->aps_apr = NULL;
2092 if (aps->aps_psiz != 0) {
2093 if (aps->aps_psiz > 81920) {
2094 IPFERROR(60044);
2095 error = ENOMEM;
2096 goto junkput;
2097 }
2098 KMALLOCS(aps->aps_data, void *, aps->aps_psiz);
2099 if (aps->aps_data == NULL) {
2100 IPFERROR(60045);
2101 error = ENOMEM;
2102 goto junkput;
2103 }
2104 bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data,
2105 aps->aps_psiz);
2106 } else {
2107 aps->aps_psiz = 0;
2108 aps->aps_data = NULL;
2109 }
2110 }
2111
2112 /*
2113 * If there was a filtering rule associated with this entry then
2114 * build up a new one.
2115 */
2116 fr = nat->nat_fr;
2117 if (fr != NULL) {
2118 if ((nat->nat_flags & SI_NEWFR) != 0) {
2119 KMALLOC(fr, frentry_t *);
2120 nat->nat_fr = fr;
2121 if (fr == NULL) {
2122 IPFERROR(60046);
2123 error = ENOMEM;
2124 goto junkput;
2125 }
2126 ipnn->ipn_nat.nat_fr = fr;
2127 fr->fr_ref = 1;
2128 (void) ipf_outobj(softc, data, ipnn, IPFOBJ_NATSAVE);
2129 bcopy((char *)&ipnn->ipn_fr, (char *)fr, sizeof(*fr));
2130
2131 fr->fr_ref = 1;
2132 fr->fr_dsize = 0;
2133 fr->fr_data = NULL;
2134 fr->fr_type = FR_T_NONE;
2135
2136 MUTEX_NUKE(&fr->fr_lock);
2137 MUTEX_INIT(&fr->fr_lock, "nat-filter rule lock");
2138 } else {
2139 if (getlock) {
2140 READ_ENTER(&softc->ipf_nat);
2141 }
2142 for (n = softn->ipf_nat_instances; n; n = n->nat_next)
2143 if (n->nat_fr == fr)
2144 break;
2145
2146 if (n != NULL) {
2147 MUTEX_ENTER(&fr->fr_lock);
2148 fr->fr_ref++;
2149 MUTEX_EXIT(&fr->fr_lock);
2150 }
2151 if (getlock) {
2152 RWLOCK_EXIT(&softc->ipf_nat);
2153 }
2154
2155 if (n == NULL) {
2156 IPFERROR(60047);
2157 error = ESRCH;
2158 goto junkput;
2159 }
2160 }
2161 }
2162
2163 if (ipnn != &ipn) {
2164 KFREES(ipnn, ipn.ipn_dsize);
2165 ipnn = NULL;
2166 }
2167
2168 if (getlock) {
2169 WRITE_ENTER(&softc->ipf_nat);
2170 }
2171
2172 if (fin.fin_v == 4)
2173 error = ipf_nat_finalise(&fin, nat);
2174 #ifdef USE_INET6
2175 else
2176 error = ipf_nat6_finalise(&fin, nat);
2177 #endif
2178
2179 if (getlock) {
2180 RWLOCK_EXIT(&softc->ipf_nat);
2181 }
2182
2183 if (error == 0)
2184 return (0);
2185
2186 IPFERROR(60048);
2187 error = ENOMEM;
2188
2189 junkput:
2190 if (fr != NULL) {
2191 (void) ipf_derefrule(softc, &fr);
2192 }
2193
2194 if ((ipnn != NULL) && (ipnn != &ipn)) {
2195 KFREES(ipnn, ipn.ipn_dsize);
2196 }
2197 if (nat != NULL) {
2198 if (aps != NULL) {
2199 if (aps->aps_data != NULL) {
2200 KFREES(aps->aps_data, aps->aps_psiz);
2201 }
2202 KFREE(aps);
2203 }
2204 if (in != NULL) {
2205 if (in->in_apr)
2206 ipf_proxy_deref(in->in_apr);
2207 KFREES(in, in->in_size);
2208 }
2209 KFREE(nat);
2210 }
2211 return (error);
2212 }
2213
2214
2215 /* ------------------------------------------------------------------------ */
2216 /* Function: ipf_nat_delete */
2217 /* Returns: Nil */
2218 /* Parameters: softc(I) - pointer to soft context main structure */
2219 /* nat(I) - pointer to NAT structure to delete */
2220 /* logtype(I) - type of LOG record to create before deleting */
2221 /* Write Lock: ipf_nat */
2222 /* */
2223 /* Delete a nat entry from the various lists and table. If NAT logging is */
2224 /* enabled then generate a NAT log record for this event. */
2225 /* ------------------------------------------------------------------------ */
2226 void
ipf_nat_delete(ipf_main_softc_t * softc,struct nat * nat,int logtype)2227 ipf_nat_delete(ipf_main_softc_t *softc, struct nat *nat, int logtype)
2228 {
2229 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2230 int madeorphan = 0, bkt, removed = 0;
2231 nat_stat_side_t *nss;
2232 struct ipnat *ipn;
2233
2234 if (logtype != 0 && softn->ipf_nat_logging != 0)
2235 ipf_nat_log(softc, softn, nat, logtype);
2236
2237 /*
2238 * Take it as a general indication that all the pointers are set if
2239 * nat_pnext is set.
2240 */
2241 if (nat->nat_pnext != NULL) {
2242 removed = 1;
2243
2244 bkt = nat->nat_hv[0] % softn->ipf_nat_table_sz;
2245 nss = &softn->ipf_nat_stats.ns_side[0];
2246 if (nss->ns_bucketlen[bkt] > 0)
2247 nss->ns_bucketlen[bkt]--;
2248 if (nss->ns_bucketlen[bkt] == 0) {
2249 nss->ns_inuse--;
2250 }
2251
2252 bkt = nat->nat_hv[1] % softn->ipf_nat_table_sz;
2253 nss = &softn->ipf_nat_stats.ns_side[1];
2254 if (nss->ns_bucketlen[bkt] > 0)
2255 nss->ns_bucketlen[bkt]--;
2256 if (nss->ns_bucketlen[bkt] == 0) {
2257 nss->ns_inuse--;
2258 }
2259
2260 *nat->nat_pnext = nat->nat_next;
2261 if (nat->nat_next != NULL) {
2262 nat->nat_next->nat_pnext = nat->nat_pnext;
2263 nat->nat_next = NULL;
2264 }
2265 nat->nat_pnext = NULL;
2266
2267 *nat->nat_phnext[0] = nat->nat_hnext[0];
2268 if (nat->nat_hnext[0] != NULL) {
2269 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
2270 nat->nat_hnext[0] = NULL;
2271 }
2272 nat->nat_phnext[0] = NULL;
2273
2274 *nat->nat_phnext[1] = nat->nat_hnext[1];
2275 if (nat->nat_hnext[1] != NULL) {
2276 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
2277 nat->nat_hnext[1] = NULL;
2278 }
2279 nat->nat_phnext[1] = NULL;
2280
2281 if ((nat->nat_flags & SI_WILDP) != 0) {
2282 ATOMIC_DEC32(softn->ipf_nat_stats.ns_wilds);
2283 }
2284 madeorphan = 1;
2285 }
2286
2287 if (nat->nat_me != NULL) {
2288 *nat->nat_me = NULL;
2289 nat->nat_me = NULL;
2290 nat->nat_ref--;
2291 ASSERT(nat->nat_ref >= 0);
2292 }
2293
2294 if (nat->nat_tqe.tqe_ifq != NULL) {
2295 /*
2296 * No call to ipf_freetimeoutqueue() is made here, they are
2297 * garbage collected in ipf_nat_expire().
2298 */
2299 (void) ipf_deletequeueentry(&nat->nat_tqe);
2300 }
2301
2302 if (nat->nat_sync) {
2303 ipf_sync_del_nat(softc->ipf_sync_soft, nat->nat_sync);
2304 nat->nat_sync = NULL;
2305 }
2306
2307 if (logtype == NL_EXPIRE)
2308 softn->ipf_nat_stats.ns_expire++;
2309
2310 MUTEX_ENTER(&nat->nat_lock);
2311 /*
2312 * NL_DESTROY should only be passed in when we've got nat_ref >= 2.
2313 * This happens when a nat'd packet is blocked and we want to throw
2314 * away the NAT session.
2315 */
2316 if (logtype == NL_DESTROY) {
2317 if (nat->nat_ref > 2) {
2318 nat->nat_ref -= 2;
2319 MUTEX_EXIT(&nat->nat_lock);
2320 if (removed)
2321 softn->ipf_nat_stats.ns_orphans++;
2322 return;
2323 }
2324 } else if (nat->nat_ref > 1) {
2325 nat->nat_ref--;
2326 MUTEX_EXIT(&nat->nat_lock);
2327 if (madeorphan == 1)
2328 softn->ipf_nat_stats.ns_orphans++;
2329 return;
2330 }
2331 ASSERT(nat->nat_ref >= 0);
2332 MUTEX_EXIT(&nat->nat_lock);
2333
2334 nat->nat_ref = 0;
2335
2336 if (madeorphan == 0)
2337 softn->ipf_nat_stats.ns_orphans--;
2338
2339 /*
2340 * At this point, nat_ref can be either 0 or -1
2341 */
2342 softn->ipf_nat_stats.ns_proto[nat->nat_pr[0]]--;
2343
2344 if (nat->nat_fr != NULL) {
2345 (void) ipf_derefrule(softc, &nat->nat_fr);
2346 }
2347
2348 if (nat->nat_hm != NULL) {
2349 ipf_nat_hostmapdel(softc, &nat->nat_hm);
2350 }
2351
2352 /*
2353 * If there is an active reference from the nat entry to its parent
2354 * rule, decrement the rule's reference count and free it too if no
2355 * longer being used.
2356 */
2357 ipn = nat->nat_ptr;
2358 nat->nat_ptr = NULL;
2359
2360 if (ipn != NULL) {
2361 ipn->in_space++;
2362 ipf_nat_rule_deref(softc, &ipn);
2363 }
2364
2365 if (nat->nat_aps != NULL) {
2366 ipf_proxy_free(softc, nat->nat_aps);
2367 nat->nat_aps = NULL;
2368 }
2369
2370 MUTEX_DESTROY(&nat->nat_lock);
2371
2372 softn->ipf_nat_stats.ns_active--;
2373
2374 /*
2375 * If there's a fragment table entry too for this nat entry, then
2376 * dereference that as well. This is after nat_lock is released
2377 * because of Tru64.
2378 */
2379 ipf_frag_natforget(softc, (void *)nat);
2380
2381 KFREE(nat);
2382 }
2383
2384
2385 /* ------------------------------------------------------------------------ */
2386 /* Function: ipf_nat_flushtable */
2387 /* Returns: int - number of NAT rules deleted */
2388 /* Parameters: softc(I) - pointer to soft context main structure */
2389 /* softn(I) - pointer to NAT context structure */
2390 /* Write Lock: ipf_nat */
2391 /* */
2392 /* Deletes all currently active NAT sessions. In deleting each NAT entry a */
2393 /* log record should be emitted in ipf_nat_delete() if NAT logging is */
2394 /* enabled. */
2395 /* ------------------------------------------------------------------------ */
2396 /*
2397 * nat_flushtable - clear the NAT table of all mapping entries.
2398 */
2399 static int
ipf_nat_flushtable(ipf_main_softc_t * softc,ipf_nat_softc_t * softn)2400 ipf_nat_flushtable(ipf_main_softc_t *softc, ipf_nat_softc_t *softn)
2401 {
2402 nat_t *nat;
2403 int j = 0;
2404
2405 /*
2406 * ALL NAT mappings deleted, so lets just make the deletions
2407 * quicker.
2408 */
2409 if (softn->ipf_nat_table[0] != NULL)
2410 bzero((char *)softn->ipf_nat_table[0],
2411 sizeof(softn->ipf_nat_table[0]) *
2412 softn->ipf_nat_table_sz);
2413 if (softn->ipf_nat_table[1] != NULL)
2414 bzero((char *)softn->ipf_nat_table[1],
2415 sizeof(softn->ipf_nat_table[1]) *
2416 softn->ipf_nat_table_sz);
2417
2418 while ((nat = softn->ipf_nat_instances) != NULL) {
2419 ipf_nat_delete(softc, nat, NL_FLUSH);
2420 j++;
2421 }
2422
2423 return (j);
2424 }
2425
2426
2427 /* ------------------------------------------------------------------------ */
2428 /* Function: ipf_nat_clearlist */
2429 /* Returns: int - number of NAT/RDR rules deleted */
2430 /* Parameters: softc(I) - pointer to soft context main structure */
2431 /* softn(I) - pointer to NAT context structure */
2432 /* */
2433 /* Delete all rules in the current list of rules. There is nothing elegant */
2434 /* about this cleanup: simply free all entries on the list of rules and */
2435 /* clear out the tables used for hashed NAT rule lookups. */
2436 /* ------------------------------------------------------------------------ */
2437 static int
ipf_nat_clearlist(ipf_main_softc_t * softc,ipf_nat_softc_t * softn)2438 ipf_nat_clearlist(ipf_main_softc_t *softc, ipf_nat_softc_t *softn)
2439 {
2440 ipnat_t *n;
2441 int i = 0;
2442
2443 if (softn->ipf_nat_map_rules != NULL) {
2444 bzero((char *)softn->ipf_nat_map_rules,
2445 sizeof(*softn->ipf_nat_map_rules) *
2446 softn->ipf_nat_maprules_sz);
2447 }
2448 if (softn->ipf_nat_rdr_rules != NULL) {
2449 bzero((char *)softn->ipf_nat_rdr_rules,
2450 sizeof(*softn->ipf_nat_rdr_rules) *
2451 softn->ipf_nat_rdrrules_sz);
2452 }
2453
2454 while ((n = softn->ipf_nat_list) != NULL) {
2455 ipf_nat_delrule(softc, softn, n, 0);
2456 i++;
2457 }
2458 #if SOLARIS && !defined(INSTANCES)
2459 pfil_delayed_copy = 1;
2460 #endif
2461 return (i);
2462 }
2463
2464
2465 /* ------------------------------------------------------------------------ */
2466 /* Function: ipf_nat_delrule */
2467 /* Returns: Nil */
2468 /* Parameters: softc(I) - pointer to soft context main structure */
2469 /* softn(I) - pointer to NAT context structure */
2470 /* np(I) - pointer to NAT rule to delete */
2471 /* purge(I) - 1 == allow purge, 0 == prevent purge */
2472 /* Locks: WRITE(ipf_nat) */
2473 /* */
2474 /* Preventing "purge" from occuring is allowed because when all of the NAT */
2475 /* rules are being removed, allowing the "purge" to walk through the list */
2476 /* of NAT sessions, possibly multiple times, would be a large performance */
2477 /* hit, on the order of O(N^2). */
2478 /* ------------------------------------------------------------------------ */
2479 static void
ipf_nat_delrule(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * np,int purge)2480 ipf_nat_delrule(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, ipnat_t *np,
2481 int purge)
2482 {
2483
2484 if (np->in_pnext != NULL) {
2485 *np->in_pnext = np->in_next;
2486 if (np->in_next != NULL)
2487 np->in_next->in_pnext = np->in_pnext;
2488 if (softn->ipf_nat_list_tail == &np->in_next)
2489 softn->ipf_nat_list_tail = np->in_pnext;
2490 }
2491
2492 if ((purge == 1) && ((np->in_flags & IPN_PURGE) != 0)) {
2493 nat_t *next;
2494 nat_t *nat;
2495
2496 for (next = softn->ipf_nat_instances; (nat = next) != NULL;) {
2497 next = nat->nat_next;
2498 if (nat->nat_ptr == np)
2499 ipf_nat_delete(softc, nat, NL_PURGE);
2500 }
2501 }
2502
2503 if ((np->in_flags & IPN_DELETE) == 0) {
2504 if (np->in_redir & NAT_REDIRECT) {
2505 switch (np->in_v[0])
2506 {
2507 case 4 :
2508 ipf_nat_delrdr(softn, np);
2509 break;
2510 #ifdef USE_INET6
2511 case 6 :
2512 ipf_nat6_delrdr(softn, np);
2513 break;
2514 #endif
2515 }
2516 }
2517 if (np->in_redir & (NAT_MAPBLK|NAT_MAP)) {
2518 switch (np->in_v[0])
2519 {
2520 case 4 :
2521 ipf_nat_delmap(softn, np);
2522 break;
2523 #ifdef USE_INET6
2524 case 6 :
2525 ipf_nat6_delmap(softn, np);
2526 break;
2527 #endif
2528 }
2529 }
2530 }
2531
2532 np->in_flags |= IPN_DELETE;
2533 ipf_nat_rule_deref(softc, &np);
2534 }
2535
2536
2537 /* ------------------------------------------------------------------------ */
2538 /* Function: ipf_nat_newmap */
2539 /* Returns: int - -1 == error, 0 == success */
2540 /* Parameters: fin(I) - pointer to packet information */
2541 /* nat(I) - pointer to NAT entry */
2542 /* ni(I) - pointer to structure with misc. information needed */
2543 /* to create new NAT entry. */
2544 /* */
2545 /* Given an empty NAT structure, populate it with new information about a */
2546 /* new NAT session, as defined by the matching NAT rule. */
2547 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
2548 /* to the new IP address for the translation. */
2549 /* ------------------------------------------------------------------------ */
2550 static int
ipf_nat_newmap(fr_info_t * fin,nat_t * nat,natinfo_t * ni)2551 ipf_nat_newmap(fr_info_t *fin, nat_t *nat, natinfo_t *ni)
2552 {
2553 ipf_main_softc_t *softc = fin->fin_main_soft;
2554 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2555 u_short st_port, dport, sport, port, sp, dp;
2556 struct in_addr in, inb;
2557 hostmap_t *hm;
2558 u_32_t flags;
2559 u_32_t st_ip;
2560 ipnat_t *np;
2561 nat_t *natl;
2562 int l;
2563
2564 /*
2565 * If it's an outbound packet which doesn't match any existing
2566 * record, then create a new port
2567 */
2568 l = 0;
2569 hm = NULL;
2570 np = ni->nai_np;
2571 st_ip = np->in_snip;
2572 st_port = np->in_spnext;
2573 flags = nat->nat_flags;
2574
2575 if (flags & IPN_ICMPQUERY) {
2576 sport = fin->fin_data[1];
2577 dport = 0;
2578 } else {
2579 sport = htons(fin->fin_data[0]);
2580 dport = htons(fin->fin_data[1]);
2581 }
2582
2583 /*
2584 * Do a loop until we either run out of entries to try or we find
2585 * a NAT mapping that isn't currently being used. This is done
2586 * because the change to the source is not (usually) being fixed.
2587 */
2588 do {
2589 port = 0;
2590 in.s_addr = htonl(np->in_snip);
2591 if (l == 0) {
2592 /*
2593 * Check to see if there is an existing NAT
2594 * setup for this IP address pair.
2595 */
2596 hm = ipf_nat_hostmap(softn, np, fin->fin_src,
2597 fin->fin_dst, in, 0);
2598 if (hm != NULL)
2599 in.s_addr = hm->hm_nsrcip.s_addr;
2600 } else if ((l == 1) && (hm != NULL)) {
2601 ipf_nat_hostmapdel(softc, &hm);
2602 }
2603 in.s_addr = ntohl(in.s_addr);
2604
2605 nat->nat_hm = hm;
2606
2607 if ((np->in_nsrcmsk == 0xffffffff) && (np->in_spnext == 0)) {
2608 if (l > 0) {
2609 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_1);
2610 DT4(ns_exhausted_1, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2611 return (-1);
2612 }
2613 }
2614
2615 if (np->in_redir == NAT_BIMAP &&
2616 np->in_osrcmsk == np->in_nsrcmsk) {
2617 /*
2618 * map the address block in a 1:1 fashion
2619 */
2620 in.s_addr = np->in_nsrcaddr;
2621 in.s_addr |= fin->fin_saddr & ~np->in_osrcmsk;
2622 in.s_addr = ntohl(in.s_addr);
2623
2624 } else if (np->in_redir & NAT_MAPBLK) {
2625 if ((l >= np->in_ppip) || ((l > 0) &&
2626 !(flags & IPN_TCPUDP))) {
2627 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_2);
2628 DT4(ns_exhausted_2, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2629 return (-1);
2630 }
2631 /*
2632 * map-block - Calculate destination address.
2633 */
2634 in.s_addr = ntohl(fin->fin_saddr);
2635 in.s_addr &= ntohl(~np->in_osrcmsk);
2636 inb.s_addr = in.s_addr;
2637 in.s_addr /= np->in_ippip;
2638 in.s_addr &= ntohl(~np->in_nsrcmsk);
2639 in.s_addr += ntohl(np->in_nsrcaddr);
2640 /*
2641 * Calculate destination port.
2642 */
2643 if ((flags & IPN_TCPUDP) &&
2644 (np->in_ppip != 0)) {
2645 port = ntohs(sport) + l;
2646 port %= np->in_ppip;
2647 port += np->in_ppip *
2648 (inb.s_addr % np->in_ippip);
2649 port += MAPBLK_MINPORT;
2650 port = htons(port);
2651 }
2652
2653 } else if ((np->in_nsrcaddr == 0) &&
2654 (np->in_nsrcmsk == 0xffffffff)) {
2655 i6addr_t in6;
2656
2657 /*
2658 * 0/32 - use the interface's IP address.
2659 */
2660 if ((l > 0) ||
2661 ipf_ifpaddr(softc, 4, FRI_NORMAL, fin->fin_ifp,
2662 &in6, NULL) == -1) {
2663 NBUMPSIDEX(1, ns_new_ifpaddr, ns_new_ifpaddr_1);
2664 DT4(ns_new_ifpaddr_1, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2665 return (-1);
2666 }
2667 in.s_addr = ntohl(in6.in4.s_addr);
2668
2669 } else if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0)) {
2670 /*
2671 * 0/0 - use the original source address/port.
2672 */
2673 if (l > 0) {
2674 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_3);
2675 DT4(ns_exhausted_3, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2676 return (-1);
2677 }
2678 in.s_addr = ntohl(fin->fin_saddr);
2679
2680 } else if ((np->in_nsrcmsk != 0xffffffff) &&
2681 (np->in_spnext == 0) && ((l > 0) || (hm == NULL)))
2682 np->in_snip++;
2683
2684 natl = NULL;
2685
2686 if ((flags & IPN_TCPUDP) &&
2687 ((np->in_redir & NAT_MAPBLK) == 0) &&
2688 (np->in_flags & IPN_AUTOPORTMAP)) {
2689 /*
2690 * "ports auto" (without map-block)
2691 */
2692 if ((l > 0) && (l % np->in_ppip == 0)) {
2693 if ((l > np->in_ppip) &&
2694 np->in_nsrcmsk != 0xffffffff)
2695 np->in_snip++;
2696 }
2697 if (np->in_ppip != 0) {
2698 port = ntohs(sport);
2699 port += (l % np->in_ppip);
2700 port %= np->in_ppip;
2701 port += np->in_ppip *
2702 (ntohl(fin->fin_saddr) %
2703 np->in_ippip);
2704 port += MAPBLK_MINPORT;
2705 port = htons(port);
2706 }
2707
2708 } else if (((np->in_redir & NAT_MAPBLK) == 0) &&
2709 (flags & IPN_TCPUDPICMP) && (np->in_spnext != 0)) {
2710 /*
2711 * Standard port translation. Select next port.
2712 */
2713 if (np->in_flags & IPN_SEQUENTIAL) {
2714 port = np->in_spnext;
2715 } else {
2716 port = ipf_random() % (np->in_spmax -
2717 np->in_spmin + 1);
2718 port += np->in_spmin;
2719 }
2720 port = htons(port);
2721 np->in_spnext++;
2722
2723 if (np->in_spnext > np->in_spmax) {
2724 np->in_spnext = np->in_spmin;
2725 if (np->in_nsrcmsk != 0xffffffff)
2726 np->in_snip++;
2727 }
2728 }
2729
2730 if (np->in_flags & IPN_SIPRANGE) {
2731 if (np->in_snip > ntohl(np->in_nsrcmsk))
2732 np->in_snip = ntohl(np->in_nsrcaddr);
2733 } else {
2734 if ((np->in_nsrcmsk != 0xffffffff) &&
2735 ((np->in_snip + 1) & ntohl(np->in_nsrcmsk)) >
2736 ntohl(np->in_nsrcaddr))
2737 np->in_snip = ntohl(np->in_nsrcaddr) + 1;
2738 }
2739
2740 if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY)))
2741 port = sport;
2742
2743 /*
2744 * Here we do a lookup of the connection as seen from
2745 * the outside. If an IP# pair already exists, try
2746 * again. So if you have A->B becomes C->B, you can
2747 * also have D->E become C->E but not D->B causing
2748 * another C->B. Also take protocol and ports into
2749 * account when determining whether a pre-existing
2750 * NAT setup will cause an external conflict where
2751 * this is appropriate.
2752 */
2753 inb.s_addr = htonl(in.s_addr);
2754 sp = fin->fin_data[0];
2755 dp = fin->fin_data[1];
2756 fin->fin_data[0] = fin->fin_data[1];
2757 fin->fin_data[1] = ntohs(port);
2758 natl = ipf_nat_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
2759 (u_int)fin->fin_p, fin->fin_dst, inb);
2760 fin->fin_data[0] = sp;
2761 fin->fin_data[1] = dp;
2762
2763 /*
2764 * Has the search wrapped around and come back to the
2765 * start ?
2766 */
2767 if ((natl != NULL) &&
2768 (np->in_spnext != 0) && (st_port == np->in_spnext) &&
2769 (np->in_snip != 0) && (st_ip == np->in_snip)) {
2770 NBUMPSIDED(1, ns_wrap);
2771 DT4(ns_wrap, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2772 return (-1);
2773 }
2774 l++;
2775 } while (natl != NULL);
2776
2777 /* Setup the NAT table */
2778 nat->nat_osrcip = fin->fin_src;
2779 nat->nat_nsrcaddr = htonl(in.s_addr);
2780 nat->nat_odstip = fin->fin_dst;
2781 nat->nat_ndstip = fin->fin_dst;
2782 if (nat->nat_hm == NULL)
2783 nat->nat_hm = ipf_nat_hostmap(softn, np, fin->fin_src,
2784 fin->fin_dst, nat->nat_nsrcip,
2785 0);
2786
2787 if (flags & IPN_TCPUDP) {
2788 nat->nat_osport = sport;
2789 nat->nat_nsport = port; /* sport */
2790 nat->nat_odport = dport;
2791 nat->nat_ndport = dport;
2792 ((tcphdr_t *)fin->fin_dp)->th_sport = port;
2793 } else if (flags & IPN_ICMPQUERY) {
2794 nat->nat_oicmpid = fin->fin_data[1];
2795 ((icmphdr_t *)fin->fin_dp)->icmp_id = port;
2796 nat->nat_nicmpid = port;
2797 }
2798 return (0);
2799 }
2800
2801
2802 /* ------------------------------------------------------------------------ */
2803 /* Function: ipf_nat_newrdr */
2804 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */
2805 /* allow rule to be moved if IPN_ROUNDR is set. */
2806 /* Parameters: fin(I) - pointer to packet information */
2807 /* nat(I) - pointer to NAT entry */
2808 /* ni(I) - pointer to structure with misc. information needed */
2809 /* to create new NAT entry. */
2810 /* */
2811 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
2812 /* to the new IP address for the translation. */
2813 /* ------------------------------------------------------------------------ */
2814 static int
ipf_nat_newrdr(fr_info_t * fin,nat_t * nat,natinfo_t * ni)2815 ipf_nat_newrdr(fr_info_t *fin, nat_t *nat, natinfo_t *ni)
2816 {
2817 ipf_main_softc_t *softc = fin->fin_main_soft;
2818 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2819 u_short nport, dport, sport;
2820 struct in_addr in, inb;
2821 u_short sp, dp;
2822 hostmap_t *hm;
2823 u_32_t flags;
2824 ipnat_t *np;
2825 nat_t *natl;
2826 int move;
2827
2828 move = 1;
2829 hm = NULL;
2830 in.s_addr = 0;
2831 np = ni->nai_np;
2832 flags = nat->nat_flags;
2833
2834 if (flags & IPN_ICMPQUERY) {
2835 dport = fin->fin_data[1];
2836 sport = 0;
2837 } else {
2838 sport = htons(fin->fin_data[0]);
2839 dport = htons(fin->fin_data[1]);
2840 }
2841
2842 /* TRACE sport, dport */
2843
2844
2845 /*
2846 * If the matching rule has IPN_STICKY set, then we want to have the
2847 * same rule kick in as before. Why would this happen? If you have
2848 * a collection of rdr rules with "round-robin sticky", the current
2849 * packet might match a different one to the previous connection but
2850 * we want the same destination to be used.
2851 */
2852 if (((np->in_flags & (IPN_ROUNDR|IPN_SPLIT)) != 0) &&
2853 ((np->in_flags & IPN_STICKY) != 0)) {
2854 hm = ipf_nat_hostmap(softn, NULL, fin->fin_src, fin->fin_dst,
2855 in, (u_32_t)dport);
2856 if (hm != NULL) {
2857 in.s_addr = ntohl(hm->hm_ndstip.s_addr);
2858 np = hm->hm_ipnat;
2859 ni->nai_np = np;
2860 move = 0;
2861 ipf_nat_hostmapdel(softc, &hm);
2862 }
2863 }
2864
2865 /*
2866 * Otherwise, it's an inbound packet. Most likely, we don't
2867 * want to rewrite source ports and source addresses. Instead,
2868 * we want to rewrite to a fixed internal address and fixed
2869 * internal port.
2870 */
2871 if (np->in_flags & IPN_SPLIT) {
2872 in.s_addr = np->in_dnip;
2873 inb.s_addr = htonl(in.s_addr);
2874
2875 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) {
2876 hm = ipf_nat_hostmap(softn, NULL, fin->fin_src,
2877 fin->fin_dst, inb, (u_32_t)dport);
2878 if (hm != NULL) {
2879 in.s_addr = hm->hm_ndstip.s_addr;
2880 move = 0;
2881 }
2882 }
2883
2884 if (hm == NULL || hm->hm_ref == 1) {
2885 if (np->in_ndstaddr == htonl(in.s_addr)) {
2886 np->in_dnip = ntohl(np->in_ndstmsk);
2887 move = 0;
2888 } else {
2889 np->in_dnip = ntohl(np->in_ndstaddr);
2890 }
2891 }
2892 if (hm != NULL)
2893 ipf_nat_hostmapdel(softc, &hm);
2894
2895 } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0xffffffff)) {
2896 i6addr_t in6;
2897
2898 /*
2899 * 0/32 - use the interface's IP address.
2900 */
2901 if (ipf_ifpaddr(softc, 4, FRI_NORMAL, fin->fin_ifp,
2902 &in6, NULL) == -1) {
2903 NBUMPSIDEX(0, ns_new_ifpaddr, ns_new_ifpaddr_2);
2904 DT3(ns_new_ifpaddr_2, fr_info_t *, fin, nat_t *, nat, natinfo_t, ni);
2905 return (-1);
2906 }
2907 in.s_addr = ntohl(in6.in4.s_addr);
2908
2909 } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk== 0)) {
2910 /*
2911 * 0/0 - use the original destination address/port.
2912 */
2913 in.s_addr = ntohl(fin->fin_daddr);
2914
2915 } else if (np->in_redir == NAT_BIMAP &&
2916 np->in_ndstmsk == np->in_odstmsk) {
2917 /*
2918 * map the address block in a 1:1 fashion
2919 */
2920 in.s_addr = np->in_ndstaddr;
2921 in.s_addr |= fin->fin_daddr & ~np->in_ndstmsk;
2922 in.s_addr = ntohl(in.s_addr);
2923 } else {
2924 in.s_addr = ntohl(np->in_ndstaddr);
2925 }
2926
2927 if ((np->in_dpnext == 0) || ((flags & NAT_NOTRULEPORT) != 0))
2928 nport = dport;
2929 else {
2930 /*
2931 * Whilst not optimized for the case where
2932 * pmin == pmax, the gain is not significant.
2933 */
2934 if (((np->in_flags & IPN_FIXEDDPORT) == 0) &&
2935 (np->in_odport != np->in_dtop)) {
2936 nport = ntohs(dport) - np->in_odport + np->in_dpmax;
2937 nport = htons(nport);
2938 } else {
2939 nport = htons(np->in_dpnext);
2940 np->in_dpnext++;
2941 if (np->in_dpnext > np->in_dpmax)
2942 np->in_dpnext = np->in_dpmin;
2943 }
2944 }
2945
2946 /*
2947 * When the redirect-to address is set to 0.0.0.0, just
2948 * assume a blank `forwarding' of the packet. We don't
2949 * setup any translation for this either.
2950 */
2951 if (in.s_addr == 0) {
2952 if (nport == dport) {
2953 NBUMPSIDED(0, ns_xlate_null);
2954 return (-1);
2955 }
2956 in.s_addr = ntohl(fin->fin_daddr);
2957 }
2958
2959 /*
2960 * Check to see if this redirect mapping already exists and if
2961 * it does, return "failure" (allowing it to be created will just
2962 * cause one or both of these "connections" to stop working.)
2963 */
2964 inb.s_addr = htonl(in.s_addr);
2965 sp = fin->fin_data[0];
2966 dp = fin->fin_data[1];
2967 fin->fin_data[1] = fin->fin_data[0];
2968 fin->fin_data[0] = ntohs(nport);
2969 natl = ipf_nat_outlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
2970 (u_int)fin->fin_p, inb, fin->fin_src);
2971 fin->fin_data[0] = sp;
2972 fin->fin_data[1] = dp;
2973 if (natl != NULL) {
2974 DT2(ns_new_xlate_exists, fr_info_t *, fin, nat_t *, natl);
2975 NBUMPSIDE(0, ns_xlate_exists);
2976 return (-1);
2977 }
2978
2979 inb.s_addr = htonl(in.s_addr);
2980 nat->nat_ndstaddr = htonl(in.s_addr);
2981 nat->nat_odstip = fin->fin_dst;
2982 nat->nat_nsrcip = fin->fin_src;
2983 nat->nat_osrcip = fin->fin_src;
2984 if ((nat->nat_hm == NULL) && ((np->in_flags & IPN_STICKY) != 0))
2985 nat->nat_hm = ipf_nat_hostmap(softn, np, fin->fin_src,
2986 fin->fin_dst, inb, (u_32_t)dport);
2987
2988 if (flags & IPN_TCPUDP) {
2989 nat->nat_odport = dport;
2990 nat->nat_ndport = nport;
2991 nat->nat_osport = sport;
2992 nat->nat_nsport = sport;
2993 ((tcphdr_t *)fin->fin_dp)->th_dport = nport;
2994 } else if (flags & IPN_ICMPQUERY) {
2995 nat->nat_oicmpid = fin->fin_data[1];
2996 ((icmphdr_t *)fin->fin_dp)->icmp_id = nport;
2997 nat->nat_nicmpid = nport;
2998 }
2999
3000 return (move);
3001 }
3002
3003 /* ------------------------------------------------------------------------ */
3004 /* Function: ipf_nat_add */
3005 /* Returns: nat_t* - NULL == failure to create new NAT structure, */
3006 /* else pointer to new NAT structure */
3007 /* Parameters: fin(I) - pointer to packet information */
3008 /* np(I) - pointer to NAT rule */
3009 /* natsave(I) - pointer to where to store NAT struct pointer */
3010 /* flags(I) - flags describing the current packet */
3011 /* direction(I) - direction of packet (in/out) */
3012 /* Write Lock: ipf_nat */
3013 /* */
3014 /* Attempts to create a new NAT entry. Does not actually change the packet */
3015 /* in any way. */
3016 /* */
3017 /* This function is in three main parts: (1) deal with creating a new NAT */
3018 /* structure for a "MAP" rule (outgoing NAT translation); (2) deal with */
3019 /* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */
3020 /* and (3) building that structure and putting it into the NAT table(s). */
3021 /* */
3022 /* NOTE: natsave should NOT be used to point back to an ipstate_t struct */
3023 /* as it can result in memory being corrupted. */
3024 /* ------------------------------------------------------------------------ */
3025 nat_t *
ipf_nat_add(fr_info_t * fin,ipnat_t * np,nat_t ** natsave,u_int flags,int direction)3026 ipf_nat_add(fr_info_t *fin, ipnat_t *np, nat_t **natsave, u_int flags,
3027 int direction)
3028 {
3029 ipf_main_softc_t *softc = fin->fin_main_soft;
3030 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3031 hostmap_t *hm = NULL;
3032 nat_t *nat, *natl;
3033 natstat_t *nsp;
3034 u_int nflags;
3035 natinfo_t ni;
3036 int move;
3037
3038 nsp = &softn->ipf_nat_stats;
3039
3040 if ((nsp->ns_active * 100 / softn->ipf_nat_table_max) >
3041 softn->ipf_nat_table_wm_high) {
3042 softn->ipf_nat_doflush = 1;
3043 }
3044
3045 if (nsp->ns_active >= softn->ipf_nat_table_max) {
3046 NBUMPSIDED(fin->fin_out, ns_table_max);
3047 DT2(ns_table_max, nat_stat_t *, nsp, ipf_nat_softc_t *, softn);
3048 return (NULL);
3049 }
3050
3051 move = 1;
3052 nflags = np->in_flags & flags;
3053 nflags &= NAT_FROMRULE;
3054
3055 ni.nai_np = np;
3056 ni.nai_dport = 0;
3057 ni.nai_sport = 0;
3058
3059 /* Give me a new nat */
3060 KMALLOC(nat, nat_t *);
3061 if (nat == NULL) {
3062 DT(ns_memfail);
3063 NBUMPSIDED(fin->fin_out, ns_memfail);
3064 /*
3065 * Try to automatically tune the max # of entries in the
3066 * table allowed to be less than what will cause kmem_alloc()
3067 * to fail and try to eliminate panics due to out of memory
3068 * conditions arising.
3069 */
3070 if ((softn->ipf_nat_table_max > softn->ipf_nat_table_sz) &&
3071 (nsp->ns_active > 100)) {
3072 softn->ipf_nat_table_max = nsp->ns_active - 100;
3073 printf("table_max reduced to %d\n",
3074 softn->ipf_nat_table_max);
3075 }
3076 return (NULL);
3077 }
3078
3079 if (flags & IPN_ICMPQUERY) {
3080 /*
3081 * In the ICMP query NAT code, we translate the ICMP id fields
3082 * to make them unique. This is indepedent of the ICMP type
3083 * (e.g. in the unlikely event that a host sends an echo and
3084 * an tstamp request with the same id, both packets will have
3085 * their ip address/id field changed in the same way).
3086 */
3087 /* The icmp_id field is used by the sender to identify the
3088 * process making the icmp request. (the receiver justs
3089 * copies it back in its response). So, it closely matches
3090 * the concept of source port. We overlay sport, so we can
3091 * maximally reuse the existing code.
3092 */
3093 ni.nai_sport = fin->fin_data[1];
3094 ni.nai_dport = 0;
3095 }
3096
3097 bzero((char *)nat, sizeof(*nat));
3098 nat->nat_flags = flags;
3099 nat->nat_redir = np->in_redir;
3100 nat->nat_dir = direction;
3101 nat->nat_pr[0] = fin->fin_p;
3102 nat->nat_pr[1] = fin->fin_p;
3103
3104 /*
3105 * Search the current table for a match and create a new mapping
3106 * if there is none found.
3107 */
3108 if (np->in_redir & NAT_DIVERTUDP) {
3109 move = ipf_nat_newdivert(fin, nat, &ni);
3110
3111 } else if (np->in_redir & NAT_REWRITE) {
3112 move = ipf_nat_newrewrite(fin, nat, &ni);
3113
3114 } else if (direction == NAT_OUTBOUND) {
3115 /*
3116 * We can now arrange to call this for the same connection
3117 * because ipf_nat_new doesn't protect the code path into
3118 * this function.
3119 */
3120 natl = ipf_nat_outlookup(fin, nflags, (u_int)fin->fin_p,
3121 fin->fin_src, fin->fin_dst);
3122 if (natl != NULL) {
3123 KFREE(nat);
3124 nat = natl;
3125 goto done;
3126 }
3127
3128 move = ipf_nat_newmap(fin, nat, &ni);
3129 } else {
3130 /*
3131 * NAT_INBOUND is used for redirects rules
3132 */
3133 natl = ipf_nat_inlookup(fin, nflags, (u_int)fin->fin_p,
3134 fin->fin_src, fin->fin_dst);
3135 if (natl != NULL) {
3136 KFREE(nat);
3137 nat = natl;
3138 goto done;
3139 }
3140
3141 move = ipf_nat_newrdr(fin, nat, &ni);
3142 }
3143 if (move == -1)
3144 goto badnat;
3145
3146 np = ni.nai_np;
3147
3148 nat->nat_mssclamp = np->in_mssclamp;
3149 nat->nat_me = natsave;
3150 nat->nat_fr = fin->fin_fr;
3151 nat->nat_rev = fin->fin_rev;
3152 nat->nat_ptr = np;
3153 nat->nat_dlocal = np->in_dlocal;
3154
3155 if ((np->in_apr != NULL) && ((nat->nat_flags & NAT_SLAVE) == 0)) {
3156 if (ipf_proxy_new(fin, nat) == -1) {
3157 NBUMPSIDED(fin->fin_out, ns_appr_fail);
3158 DT3(ns_appr_fail, fr_info_t *, fin, nat_t *, nat, ipnat_t *, np);
3159 goto badnat;
3160 }
3161 }
3162
3163 nat->nat_ifps[0] = np->in_ifps[0];
3164 if (np->in_ifps[0] != NULL) {
3165 COPYIFNAME(np->in_v[0], np->in_ifps[0], nat->nat_ifnames[0]);
3166 }
3167
3168 nat->nat_ifps[1] = np->in_ifps[1];
3169 if (np->in_ifps[1] != NULL) {
3170 COPYIFNAME(np->in_v[1], np->in_ifps[1], nat->nat_ifnames[1]);
3171 }
3172
3173 if (ipf_nat_finalise(fin, nat) == -1) {
3174 goto badnat;
3175 }
3176
3177 np->in_use++;
3178
3179 if ((move == 1) && (np->in_flags & IPN_ROUNDR)) {
3180 if ((np->in_redir & (NAT_REDIRECT|NAT_MAP)) == NAT_REDIRECT) {
3181 ipf_nat_delrdr(softn, np);
3182 ipf_nat_addrdr(softn, np);
3183 } else if ((np->in_redir & (NAT_REDIRECT|NAT_MAP)) == NAT_MAP) {
3184 ipf_nat_delmap(softn, np);
3185 ipf_nat_addmap(softn, np);
3186 }
3187 }
3188
3189 if (flags & SI_WILDP)
3190 nsp->ns_wilds++;
3191 nsp->ns_proto[nat->nat_pr[0]]++;
3192
3193 goto done;
3194 badnat:
3195 DT3(ns_badnatnew, fr_info_t *, fin, nat_t *, nat, ipnat_t *, np);
3196 NBUMPSIDE(fin->fin_out, ns_badnatnew);
3197 if ((hm = nat->nat_hm) != NULL)
3198 ipf_nat_hostmapdel(softc, &hm);
3199 KFREE(nat);
3200 nat = NULL;
3201 done:
3202 if (nat != NULL && np != NULL)
3203 np->in_hits++;
3204 if (natsave != NULL)
3205 *natsave = nat;
3206 return (nat);
3207 }
3208
3209
3210 /* ------------------------------------------------------------------------ */
3211 /* Function: ipf_nat_finalise */
3212 /* Returns: int - 0 == sucess, -1 == failure */
3213 /* Parameters: fin(I) - pointer to packet information */
3214 /* nat(I) - pointer to NAT entry */
3215 /* Write Lock: ipf_nat */
3216 /* */
3217 /* This is the tail end of constructing a new NAT entry and is the same */
3218 /* for both IPv4 and IPv6. */
3219 /* ------------------------------------------------------------------------ */
3220 /*ARGSUSED*/
3221 static int
ipf_nat_finalise(fr_info_t * fin,nat_t * nat)3222 ipf_nat_finalise(fr_info_t *fin, nat_t *nat)
3223 {
3224 ipf_main_softc_t *softc = fin->fin_main_soft;
3225 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3226 u_32_t sum1, sum2, sumd;
3227 frentry_t *fr;
3228 #if SOLARIS && defined(_KERNEL) && defined(ICK_M_CTL_MAGIC)
3229 qpktinfo_t *qpi = fin->fin_qpi;
3230 #endif
3231
3232 switch (nat->nat_pr[0])
3233 {
3234 case IPPROTO_ICMP :
3235 sum1 = LONG_SUM(ntohs(nat->nat_oicmpid));
3236 sum2 = LONG_SUM(ntohs(nat->nat_nicmpid));
3237 CALC_SUMD(sum1, sum2, sumd);
3238 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
3239
3240 break;
3241
3242 default :
3243 sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr) + \
3244 ntohs(nat->nat_osport));
3245 sum2 = LONG_SUM(ntohl(nat->nat_nsrcaddr) + \
3246 ntohs(nat->nat_nsport));
3247 CALC_SUMD(sum1, sum2, sumd);
3248 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
3249
3250 sum1 = LONG_SUM(ntohl(nat->nat_odstaddr) + \
3251 ntohs(nat->nat_odport));
3252 sum2 = LONG_SUM(ntohl(nat->nat_ndstaddr) + \
3253 ntohs(nat->nat_ndport));
3254 CALC_SUMD(sum1, sum2, sumd);
3255 nat->nat_sumd[0] += (sumd & 0xffff) + (sumd >> 16);
3256 break;
3257 }
3258
3259 /*
3260 * Compute the partial checksum, just in case.
3261 * This is only ever placed into outbound packets so care needs
3262 * to be taken over which pair of addresses are used.
3263 */
3264 if (nat->nat_dir == NAT_OUTBOUND) {
3265 sum1 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
3266 sum1 += LONG_SUM(ntohl(nat->nat_ndstaddr));
3267 } else {
3268 sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr));
3269 sum1 += LONG_SUM(ntohl(nat->nat_odstaddr));
3270 }
3271 sum1 += nat->nat_pr[1];
3272 nat->nat_sumd[1] = (sum1 & 0xffff) + (sum1 >> 16);
3273
3274 sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr));
3275 sum2 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
3276 CALC_SUMD(sum1, sum2, sumd);
3277 nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16);
3278
3279 sum1 = LONG_SUM(ntohl(nat->nat_odstaddr));
3280 sum2 = LONG_SUM(ntohl(nat->nat_ndstaddr));
3281 CALC_SUMD(sum1, sum2, sumd);
3282 nat->nat_ipsumd += (sumd & 0xffff) + (sumd >> 16);
3283
3284 nat->nat_v[0] = 4;
3285 nat->nat_v[1] = 4;
3286
3287 if ((nat->nat_ifps[0] != NULL) && (nat->nat_ifps[0] != (void *)-1)) {
3288 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
3289 }
3290
3291 if ((nat->nat_ifps[1] != NULL) && (nat->nat_ifps[1] != (void *)-1)) {
3292 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
3293 }
3294
3295 if ((nat->nat_flags & SI_CLONE) == 0)
3296 nat->nat_sync = ipf_sync_new(softc, SMC_NAT, fin, nat);
3297
3298 if (ipf_nat_insert(softc, softn, nat) == 0) {
3299 if (softn->ipf_nat_logging)
3300 ipf_nat_log(softc, softn, nat, NL_NEW);
3301 fr = nat->nat_fr;
3302 if (fr != NULL) {
3303 MUTEX_ENTER(&fr->fr_lock);
3304 fr->fr_ref++;
3305 MUTEX_EXIT(&fr->fr_lock);
3306 }
3307 return (0);
3308 }
3309
3310 NBUMPSIDED(fin->fin_out, ns_unfinalised);
3311 DT2(ns_unfinalised, fr_info_t *, fin, nat_t *, nat);
3312 /*
3313 * nat_insert failed, so cleanup time...
3314 */
3315 if (nat->nat_sync != NULL)
3316 ipf_sync_del_nat(softc->ipf_sync_soft, nat->nat_sync);
3317 return (-1);
3318 }
3319
3320
3321 /* ------------------------------------------------------------------------ */
3322 /* Function: ipf_nat_insert */
3323 /* Returns: int - 0 == sucess, -1 == failure */
3324 /* Parameters: softc(I) - pointer to soft context main structure */
3325 /* softn(I) - pointer to NAT context structure */
3326 /* nat(I) - pointer to NAT structure */
3327 /* Write Lock: ipf_nat */
3328 /* */
3329 /* Insert a NAT entry into the hash tables for searching and add it to the */
3330 /* list of active NAT entries. Adjust global counters when complete. */
3331 /* ------------------------------------------------------------------------ */
3332 int
ipf_nat_insert(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,nat_t * nat)3333 ipf_nat_insert(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, nat_t *nat)
3334 {
3335 u_int hv0, hv1;
3336 u_int sp, dp;
3337 ipnat_t *in;
3338 int ret;
3339
3340 /*
3341 * Try and return an error as early as possible, so calculate the hash
3342 * entry numbers first and then proceed.
3343 */
3344 if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) {
3345 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
3346 sp = nat->nat_osport;
3347 dp = nat->nat_odport;
3348 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
3349 sp = 0;
3350 dp = nat->nat_oicmpid;
3351 } else {
3352 sp = 0;
3353 dp = 0;
3354 }
3355 hv0 = NAT_HASH_FN(nat->nat_osrcaddr, sp, 0xffffffff);
3356 hv0 = NAT_HASH_FN(nat->nat_odstaddr, hv0 + dp, 0xffffffff);
3357 /*
3358 * TRACE nat_osrcaddr, nat_osport, nat_odstaddr,
3359 * nat_odport, hv0
3360 */
3361
3362 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
3363 sp = nat->nat_nsport;
3364 dp = nat->nat_ndport;
3365 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
3366 sp = 0;
3367 dp = nat->nat_nicmpid;
3368 } else {
3369 sp = 0;
3370 dp = 0;
3371 }
3372 hv1 = NAT_HASH_FN(nat->nat_nsrcaddr, sp, 0xffffffff);
3373 hv1 = NAT_HASH_FN(nat->nat_ndstaddr, hv1 + dp, 0xffffffff);
3374 /*
3375 * TRACE nat_nsrcaddr, nat_nsport, nat_ndstaddr,
3376 * nat_ndport, hv1
3377 */
3378 } else {
3379 hv0 = NAT_HASH_FN(nat->nat_osrcaddr, 0, 0xffffffff);
3380 hv0 = NAT_HASH_FN(nat->nat_odstaddr, hv0, 0xffffffff);
3381 /* TRACE nat_osrcaddr, nat_odstaddr, hv0 */
3382
3383 hv1 = NAT_HASH_FN(nat->nat_nsrcaddr, 0, 0xffffffff);
3384 hv1 = NAT_HASH_FN(nat->nat_ndstaddr, hv1, 0xffffffff);
3385 /* TRACE nat_nsrcaddr, nat_ndstaddr, hv1 */
3386 }
3387
3388 nat->nat_hv[0] = hv0;
3389 nat->nat_hv[1] = hv1;
3390
3391 MUTEX_INIT(&nat->nat_lock, "nat entry lock");
3392
3393 in = nat->nat_ptr;
3394 nat->nat_ref = nat->nat_me ? 2 : 1;
3395
3396 nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0';
3397 nat->nat_ifps[0] = ipf_resolvenic(softc, nat->nat_ifnames[0], 4);
3398
3399 if (nat->nat_ifnames[1][0] != '\0') {
3400 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
3401 nat->nat_ifps[1] = ipf_resolvenic(softc,
3402 nat->nat_ifnames[1], 4);
3403 } else if (in->in_ifnames[1] != -1) {
3404 char *name;
3405
3406 name = in->in_names + in->in_ifnames[1];
3407 if (name[1] != '\0' && name[0] != '-' && name[0] != '*') {
3408 (void) strncpy(nat->nat_ifnames[1],
3409 nat->nat_ifnames[0], LIFNAMSIZ);
3410 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
3411 nat->nat_ifps[1] = nat->nat_ifps[0];
3412 }
3413 }
3414 if ((nat->nat_ifps[0] != NULL) && (nat->nat_ifps[0] != (void *)-1)) {
3415 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
3416 }
3417 if ((nat->nat_ifps[1] != NULL) && (nat->nat_ifps[1] != (void *)-1)) {
3418 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
3419 }
3420
3421 ret = ipf_nat_hashtab_add(softc, softn, nat);
3422 if (ret == -1)
3423 MUTEX_DESTROY(&nat->nat_lock);
3424 return (ret);
3425 }
3426
3427
3428 /* ------------------------------------------------------------------------ */
3429 /* Function: ipf_nat_hashtab_add */
3430 /* Returns: int - 0 == sucess, -1 == failure */
3431 /* Parameters: softc(I) - pointer to soft context main structure */
3432 /* softn(I) - pointer to NAT context structure */
3433 /* nat(I) - pointer to NAT structure */
3434 /* */
3435 /* Handle the insertion of a NAT entry into the table/list. */
3436 /* ------------------------------------------------------------------------ */
3437 int
ipf_nat_hashtab_add(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,nat_t * nat)3438 ipf_nat_hashtab_add(ipf_main_softc_t *softc, ipf_nat_softc_t *softn,
3439 nat_t *nat)
3440 {
3441 nat_t **natp;
3442 u_int hv0;
3443 u_int hv1;
3444
3445 if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) {
3446 hv1 = nat->nat_hv[0] % softn->ipf_nat_table_sz;
3447 hv0 = nat->nat_hv[1] % softn->ipf_nat_table_sz;
3448 } else {
3449 hv0 = nat->nat_hv[0] % softn->ipf_nat_table_sz;
3450 hv1 = nat->nat_hv[1] % softn->ipf_nat_table_sz;
3451 }
3452
3453 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0] >=
3454 softn->ipf_nat_maxbucket) {
3455 DT1(ns_bucket_max_0, int,
3456 softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0]);
3457 NBUMPSIDE(0, ns_bucket_max);
3458 return (-1);
3459 }
3460
3461 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen[hv1] >=
3462 softn->ipf_nat_maxbucket) {
3463 DT1(ns_bucket_max_1, int,
3464 softn->ipf_nat_stats.ns_side[1].ns_bucketlen[hv1]);
3465 NBUMPSIDE(1, ns_bucket_max);
3466 return (-1);
3467 }
3468
3469 /*
3470 * The ordering of operations in the list and hash table insertion
3471 * is very important. The last operation for each task should be
3472 * to update the top of the list, after all the "nexts" have been
3473 * done so that walking the list while it is being done does not
3474 * find strange pointers.
3475 *
3476 * Global list of NAT instances
3477 */
3478 nat->nat_next = softn->ipf_nat_instances;
3479 nat->nat_pnext = &softn->ipf_nat_instances;
3480 if (softn->ipf_nat_instances)
3481 softn->ipf_nat_instances->nat_pnext = &nat->nat_next;
3482 softn->ipf_nat_instances = nat;
3483
3484 /*
3485 * Inbound hash table.
3486 */
3487 natp = &softn->ipf_nat_table[0][hv0];
3488 nat->nat_phnext[0] = natp;
3489 nat->nat_hnext[0] = *natp;
3490 if (*natp) {
3491 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
3492 } else {
3493 NBUMPSIDE(0, ns_inuse);
3494 }
3495 *natp = nat;
3496 NBUMPSIDE(0, ns_bucketlen[hv0]);
3497
3498 /*
3499 * Outbound hash table.
3500 */
3501 natp = &softn->ipf_nat_table[1][hv1];
3502 nat->nat_phnext[1] = natp;
3503 nat->nat_hnext[1] = *natp;
3504 if (*natp)
3505 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
3506 else {
3507 NBUMPSIDE(1, ns_inuse);
3508 }
3509 *natp = nat;
3510 NBUMPSIDE(1, ns_bucketlen[hv1]);
3511
3512 ipf_nat_setqueue(softc, softn, nat);
3513
3514 if (nat->nat_dir & NAT_OUTBOUND) {
3515 NBUMPSIDE(1, ns_added);
3516 } else {
3517 NBUMPSIDE(0, ns_added);
3518 }
3519 softn->ipf_nat_stats.ns_active++;
3520 return (0);
3521 }
3522
3523
3524 /* ------------------------------------------------------------------------ */
3525 /* Function: ipf_nat_icmperrorlookup */
3526 /* Returns: nat_t* - point to matching NAT structure */
3527 /* Parameters: fin(I) - pointer to packet information */
3528 /* dir(I) - direction of packet (in/out) */
3529 /* */
3530 /* Check if the ICMP error message is related to an existing TCP, UDP or */
3531 /* ICMP query nat entry. It is assumed that the packet is already of the */
3532 /* the required length. */
3533 /* ------------------------------------------------------------------------ */
3534 nat_t *
ipf_nat_icmperrorlookup(fr_info_t * fin,int dir)3535 ipf_nat_icmperrorlookup(fr_info_t *fin, int dir)
3536 {
3537 ipf_main_softc_t *softc = fin->fin_main_soft;
3538 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3539 int flags = 0, minlen;
3540 icmphdr_t *orgicmp;
3541 nat_stat_side_t *nside;
3542 tcphdr_t *tcp = NULL;
3543 u_short data[2];
3544 nat_t *nat;
3545 ip_t *oip;
3546 u_int p;
3547
3548 nside = &softn->ipf_nat_stats.ns_side[fin->fin_out];
3549 /*
3550 * Does it at least have the return (basic) IP header ?
3551 * Only a basic IP header (no options) should be with an ICMP error
3552 * header. Also, if it's not an error type, then return.
3553 */
3554 if ((fin->fin_hlen != sizeof(ip_t)) || !(fin->fin_flx & FI_ICMPERR)) {
3555 ATOMIC_INCL(nside->ns_icmp_basic);
3556 return (NULL);
3557 }
3558
3559 /*
3560 * Check packet size
3561 */
3562 oip = (ip_t *)((char *)fin->fin_dp + 8);
3563 minlen = IP_HL(oip) << 2;
3564 if ((minlen < sizeof(ip_t)) ||
3565 (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen)) {
3566 ATOMIC_INCL(nside->ns_icmp_size);
3567 return (NULL);
3568 }
3569
3570 /*
3571 * Is the buffer big enough for all of it ? It's the size of the IP
3572 * header claimed in the encapsulated part which is of concern. It
3573 * may be too big to be in this buffer but not so big that it's
3574 * outside the ICMP packet, leading to TCP deref's causing problems.
3575 * This is possible because we don't know how big oip_hl is when we
3576 * do the pullup early in ipf_check() and thus can't gaurantee it is
3577 * all here now.
3578 */
3579 #ifdef ipf_nat_KERNEL
3580 {
3581 mb_t *m;
3582
3583 m = fin->fin_m;
3584 # if SOLARIS
3585 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
3586 (char *)m->b_wptr) {
3587 ATOMIC_INCL(nside->ns_icmp_mbuf);
3588 return (NULL);
3589 }
3590 # else
3591 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
3592 (char *)fin->fin_ip + M_LEN(m)) {
3593 ATOMIC_INCL(nside->ns_icmp_mbuf);
3594 return (NULL);
3595 }
3596 # endif
3597 }
3598 #endif
3599
3600 if (fin->fin_daddr != oip->ip_src.s_addr) {
3601 ATOMIC_INCL(nside->ns_icmp_address);
3602 return (NULL);
3603 }
3604
3605 p = oip->ip_p;
3606 if (p == IPPROTO_TCP)
3607 flags = IPN_TCP;
3608 else if (p == IPPROTO_UDP)
3609 flags = IPN_UDP;
3610 else if (p == IPPROTO_ICMP) {
3611 orgicmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2));
3612
3613 /* see if this is related to an ICMP query */
3614 if (ipf_nat_icmpquerytype(orgicmp->icmp_type)) {
3615 data[0] = fin->fin_data[0];
3616 data[1] = fin->fin_data[1];
3617 fin->fin_data[0] = 0;
3618 fin->fin_data[1] = orgicmp->icmp_id;
3619
3620 flags = IPN_ICMPERR|IPN_ICMPQUERY;
3621 /*
3622 * NOTE : dir refers to the direction of the original
3623 * ip packet. By definition the icmp error
3624 * message flows in the opposite direction.
3625 */
3626 if (dir == NAT_INBOUND)
3627 nat = ipf_nat_inlookup(fin, flags, p,
3628 oip->ip_dst,
3629 oip->ip_src);
3630 else
3631 nat = ipf_nat_outlookup(fin, flags, p,
3632 oip->ip_dst,
3633 oip->ip_src);
3634 fin->fin_data[0] = data[0];
3635 fin->fin_data[1] = data[1];
3636 return (nat);
3637 }
3638 }
3639
3640 if (flags & IPN_TCPUDP) {
3641 minlen += 8; /* + 64bits of data to get ports */
3642 /* TRACE (fin,minlen) */
3643 if (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen) {
3644 ATOMIC_INCL(nside->ns_icmp_short);
3645 return (NULL);
3646 }
3647
3648 data[0] = fin->fin_data[0];
3649 data[1] = fin->fin_data[1];
3650 tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2));
3651 fin->fin_data[0] = ntohs(tcp->th_dport);
3652 fin->fin_data[1] = ntohs(tcp->th_sport);
3653
3654 if (dir == NAT_INBOUND) {
3655 nat = ipf_nat_inlookup(fin, flags, p, oip->ip_dst,
3656 oip->ip_src);
3657 } else {
3658 nat = ipf_nat_outlookup(fin, flags, p, oip->ip_dst,
3659 oip->ip_src);
3660 }
3661 fin->fin_data[0] = data[0];
3662 fin->fin_data[1] = data[1];
3663 return (nat);
3664 }
3665 if (dir == NAT_INBOUND)
3666 nat = ipf_nat_inlookup(fin, 0, p, oip->ip_dst, oip->ip_src);
3667 else
3668 nat = ipf_nat_outlookup(fin, 0, p, oip->ip_dst, oip->ip_src);
3669
3670 return (nat);
3671 }
3672
3673
3674 /* ------------------------------------------------------------------------ */
3675 /* Function: ipf_nat_icmperror */
3676 /* Returns: nat_t* - point to matching NAT structure */
3677 /* Parameters: fin(I) - pointer to packet information */
3678 /* nflags(I) - NAT flags for this packet */
3679 /* dir(I) - direction of packet (in/out) */
3680 /* */
3681 /* Fix up an ICMP packet which is an error message for an existing NAT */
3682 /* session. This will correct both packet header data and checksums. */
3683 /* */
3684 /* This should *ONLY* be used for incoming ICMP error packets to make sure */
3685 /* a NAT'd ICMP packet gets correctly recognised. */
3686 /* ------------------------------------------------------------------------ */
3687 nat_t *
ipf_nat_icmperror(fr_info_t * fin,u_int * nflags,int dir)3688 ipf_nat_icmperror(fr_info_t *fin, u_int *nflags, int dir)
3689 {
3690 ipf_main_softc_t *softc = fin->fin_main_soft;
3691 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3692 u_32_t sum1, sum2, sumd, sumd2;
3693 struct in_addr a1, a2, a3, a4;
3694 int flags, dlen, odst;
3695 icmphdr_t *icmp;
3696 u_short *csump;
3697 tcphdr_t *tcp;
3698 nat_t *nat;
3699 ip_t *oip;
3700 void *dp;
3701
3702 if ((fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) {
3703 NBUMPSIDED(fin->fin_out, ns_icmp_short);
3704 return (NULL);
3705 }
3706
3707 /*
3708 * ipf_nat_icmperrorlookup() will return NULL for `defective' packets.
3709 */
3710 if ((fin->fin_v != 4) || !(nat = ipf_nat_icmperrorlookup(fin, dir))) {
3711 NBUMPSIDED(fin->fin_out, ns_icmp_notfound);
3712 return (NULL);
3713 }
3714
3715 tcp = NULL;
3716 csump = NULL;
3717 flags = 0;
3718 sumd2 = 0;
3719 *nflags = IPN_ICMPERR;
3720 icmp = fin->fin_dp;
3721 oip = (ip_t *)&icmp->icmp_ip;
3722 dp = (((char *)oip) + (IP_HL(oip) << 2));
3723 if (oip->ip_p == IPPROTO_TCP) {
3724 tcp = (tcphdr_t *)dp;
3725 csump = (u_short *)&tcp->th_sum;
3726 flags = IPN_TCP;
3727 } else if (oip->ip_p == IPPROTO_UDP) {
3728 udphdr_t *udp;
3729
3730 udp = (udphdr_t *)dp;
3731 tcp = (tcphdr_t *)dp;
3732 csump = (u_short *)&udp->uh_sum;
3733 flags = IPN_UDP;
3734 } else if (oip->ip_p == IPPROTO_ICMP)
3735 flags = IPN_ICMPQUERY;
3736 dlen = fin->fin_plen - ((char *)dp - (char *)fin->fin_ip);
3737
3738 /*
3739 * Need to adjust ICMP header to include the real IP#'s and
3740 * port #'s. Only apply a checksum change relative to the
3741 * IP address change as it will be modified again in ipf_nat_checkout
3742 * for both address and port. Two checksum changes are
3743 * necessary for the two header address changes. Be careful
3744 * to only modify the checksum once for the port # and twice
3745 * for the IP#.
3746 */
3747
3748 /*
3749 * Step 1
3750 * Fix the IP addresses in the offending IP packet. You also need
3751 * to adjust the IP header checksum of that offending IP packet.
3752 *
3753 * Normally, you would expect that the ICMP checksum of the
3754 * ICMP error message needs to be adjusted as well for the
3755 * IP address change in oip.
3756 * However, this is a NOP, because the ICMP checksum is
3757 * calculated over the complete ICMP packet, which includes the
3758 * changed oip IP addresses and oip->ip_sum. However, these
3759 * two changes cancel each other out (if the delta for
3760 * the IP address is x, then the delta for ip_sum is minus x),
3761 * so no change in the icmp_cksum is necessary.
3762 *
3763 * Inbound ICMP
3764 * ------------
3765 * MAP rule, SRC=a,DST=b -> SRC=c,DST=b
3766 * - response to outgoing packet (a,b)=>(c,b) (OIP_SRC=c,OIP_DST=b)
3767 * - OIP_SRC(c)=nat_newsrcip, OIP_DST(b)=nat_newdstip
3768 *=> OIP_SRC(c)=nat_oldsrcip, OIP_DST(b)=nat_olddstip
3769 *
3770 * RDR rule, SRC=a,DST=b -> SRC=a,DST=c
3771 * - response to outgoing packet (c,a)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3772 * - OIP_SRC(b)=nat_olddstip, OIP_DST(a)=nat_oldsrcip
3773 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip
3774 *
3775 * REWRITE out rule, SRC=a,DST=b -> SRC=c,DST=d
3776 * - response to outgoing packet (a,b)=>(c,d) (OIP_SRC=c,OIP_DST=d)
3777 * - OIP_SRC(c)=nat_newsrcip, OIP_DST(d)=nat_newdstip
3778 *=> OIP_SRC(c)=nat_oldsrcip, OIP_DST(d)=nat_olddstip
3779 *
3780 * REWRITE in rule, SRC=a,DST=b -> SRC=c,DST=d
3781 * - response to outgoing packet (d,c)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3782 * - OIP_SRC(b)=nat_olddstip, OIP_DST(a)=nat_oldsrcip
3783 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip
3784 *
3785 * Outbound ICMP
3786 * -------------
3787 * MAP rule, SRC=a,DST=b -> SRC=c,DST=b
3788 * - response to incoming packet (b,c)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3789 * - OIP_SRC(b)=nat_olddstip, OIP_DST(a)=nat_oldsrcip
3790 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip
3791 *
3792 * RDR rule, SRC=a,DST=b -> SRC=a,DST=c
3793 * - response to incoming packet (a,b)=>(a,c) (OIP_SRC=a,OIP_DST=c)
3794 * - OIP_SRC(a)=nat_newsrcip, OIP_DST(c)=nat_newdstip
3795 *=> OIP_SRC(a)=nat_oldsrcip, OIP_DST(c)=nat_olddstip
3796 *
3797 * REWRITE out rule, SRC=a,DST=b -> SRC=c,DST=d
3798 * - response to incoming packet (d,c)=>(b,a) (OIP_SRC=c,OIP_DST=d)
3799 * - OIP_SRC(c)=nat_olddstip, OIP_DST(d)=nat_oldsrcip
3800 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip
3801 *
3802 * REWRITE in rule, SRC=a,DST=b -> SRC=c,DST=d
3803 * - response to incoming packet (a,b)=>(c,d) (OIP_SRC=b,OIP_DST=a)
3804 * - OIP_SRC(b)=nat_newsrcip, OIP_DST(a)=nat_newdstip
3805 *=> OIP_SRC(a)=nat_oldsrcip, OIP_DST(c)=nat_olddstip
3806 */
3807
3808 if (((fin->fin_out == 0) && ((nat->nat_redir & NAT_MAP) != 0)) ||
3809 ((fin->fin_out == 1) && ((nat->nat_redir & NAT_REDIRECT) != 0))) {
3810 a1.s_addr = ntohl(nat->nat_osrcaddr);
3811 a4.s_addr = ntohl(oip->ip_src.s_addr);
3812 a3.s_addr = ntohl(nat->nat_odstaddr);
3813 a2.s_addr = ntohl(oip->ip_dst.s_addr);
3814 oip->ip_src.s_addr = htonl(a1.s_addr);
3815 oip->ip_dst.s_addr = htonl(a3.s_addr);
3816 odst = 1;
3817 } else {
3818 a1.s_addr = ntohl(nat->nat_ndstaddr);
3819 a2.s_addr = ntohl(oip->ip_dst.s_addr);
3820 a3.s_addr = ntohl(nat->nat_nsrcaddr);
3821 a4.s_addr = ntohl(oip->ip_src.s_addr);
3822 oip->ip_dst.s_addr = htonl(a3.s_addr);
3823 oip->ip_src.s_addr = htonl(a1.s_addr);
3824 odst = 0;
3825 }
3826 sum1 = 0;
3827 sum2 = 0;
3828 sumd = 0;
3829 CALC_SUMD(a2.s_addr, a3.s_addr, sum1);
3830 CALC_SUMD(a4.s_addr, a1.s_addr, sum2);
3831 sumd = sum2 + sum1;
3832 if (sumd != 0)
3833 ipf_fix_datacksum(&oip->ip_sum, sumd);
3834
3835 sumd2 = sumd;
3836 sum1 = 0;
3837 sum2 = 0;
3838
3839 /*
3840 * Fix UDP pseudo header checksum to compensate for the
3841 * IP address change.
3842 */
3843 if (((flags & IPN_TCPUDP) != 0) && (dlen >= 4)) {
3844 u_32_t sum3, sum4, sumt;
3845
3846 /*
3847 * Step 2 :
3848 * For offending TCP/UDP IP packets, translate the ports as
3849 * well, based on the NAT specification. Of course such
3850 * a change may be reflected in the ICMP checksum as well.
3851 *
3852 * Since the port fields are part of the TCP/UDP checksum
3853 * of the offending IP packet, you need to adjust that checksum
3854 * as well... except that the change in the port numbers should
3855 * be offset by the checksum change. However, the TCP/UDP
3856 * checksum will also need to change if there has been an
3857 * IP address change.
3858 */
3859 if (odst == 1) {
3860 sum1 = ntohs(nat->nat_osport);
3861 sum4 = ntohs(tcp->th_sport);
3862 sum3 = ntohs(nat->nat_odport);
3863 sum2 = ntohs(tcp->th_dport);
3864
3865 tcp->th_sport = htons(sum1);
3866 tcp->th_dport = htons(sum3);
3867 } else {
3868 sum1 = ntohs(nat->nat_ndport);
3869 sum2 = ntohs(tcp->th_dport);
3870 sum3 = ntohs(nat->nat_nsport);
3871 sum4 = ntohs(tcp->th_sport);
3872
3873 tcp->th_dport = htons(sum3);
3874 tcp->th_sport = htons(sum1);
3875 }
3876 CALC_SUMD(sum4, sum1, sumt);
3877 sumd += sumt;
3878 CALC_SUMD(sum2, sum3, sumt);
3879 sumd += sumt;
3880
3881 if (sumd != 0 || sumd2 != 0) {
3882 /*
3883 * At this point, sumd is the delta to apply to the
3884 * TCP/UDP header, given the changes in both the IP
3885 * address and the ports and sumd2 is the delta to
3886 * apply to the ICMP header, given the IP address
3887 * change delta that may need to be applied to the
3888 * TCP/UDP checksum instead.
3889 *
3890 * If we will both the IP and TCP/UDP checksums
3891 * then the ICMP checksum changes by the address
3892 * delta applied to the TCP/UDP checksum. If we
3893 * do not change the TCP/UDP checksum them we
3894 * apply the delta in ports to the ICMP checksum.
3895 */
3896 if (oip->ip_p == IPPROTO_UDP) {
3897 if ((dlen >= 8) && (*csump != 0)) {
3898 ipf_fix_datacksum(csump, sumd);
3899 } else {
3900 CALC_SUMD(sum1, sum4, sumd2);
3901 CALC_SUMD(sum3, sum2, sumt);
3902 sumd2 += sumt;
3903 }
3904 } else if (oip->ip_p == IPPROTO_TCP) {
3905 if (dlen >= 18) {
3906 ipf_fix_datacksum(csump, sumd);
3907 } else {
3908 CALC_SUMD(sum1, sum4, sumd2);
3909 CALC_SUMD(sum3, sum2, sumt);
3910 sumd2 += sumt;
3911 }
3912 }
3913 if (sumd2 != 0) {
3914 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3915 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3916 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3917 ipf_fix_incksum(0, &icmp->icmp_cksum, sumd2, 0);
3918 }
3919 }
3920 } else if (((flags & IPN_ICMPQUERY) != 0) && (dlen >= 8)) {
3921 icmphdr_t *orgicmp;
3922
3923 /*
3924 * XXX - what if this is bogus hl and we go off the end ?
3925 * In this case, ipf_nat_icmperrorlookup() will have
3926 * returned NULL.
3927 */
3928 orgicmp = (icmphdr_t *)dp;
3929
3930 if (odst == 1) {
3931 if (orgicmp->icmp_id != nat->nat_osport) {
3932
3933 /*
3934 * Fix ICMP checksum (of the offening ICMP
3935 * query packet) to compensate the change
3936 * in the ICMP id of the offending ICMP
3937 * packet.
3938 *
3939 * Since you modify orgicmp->icmp_id with
3940 * a delta (say x) and you compensate that
3941 * in origicmp->icmp_cksum with a delta
3942 * minus x, you don't have to adjust the
3943 * overall icmp->icmp_cksum
3944 */
3945 sum1 = ntohs(orgicmp->icmp_id);
3946 sum2 = ntohs(nat->nat_oicmpid);
3947 CALC_SUMD(sum1, sum2, sumd);
3948 orgicmp->icmp_id = nat->nat_oicmpid;
3949 ipf_fix_datacksum(&orgicmp->icmp_cksum, sumd);
3950 }
3951 } /* nat_dir == NAT_INBOUND is impossible for icmp queries */
3952 }
3953 return (nat);
3954 }
3955
3956
3957 /*
3958 * MAP-IN MAP-OUT RDR-IN RDR-OUT
3959 * osrc X == src == src X
3960 * odst X == dst == dst X
3961 * nsrc == dst X X == dst
3962 * ndst == src X X == src
3963 * MAP = NAT_OUTBOUND, RDR = NAT_INBOUND
3964 */
3965 /*
3966 * NB: these lookups don't lock access to the list, it assumed that it has
3967 * already been done!
3968 */
3969 /* ------------------------------------------------------------------------ */
3970 /* Function: ipf_nat_inlookup */
3971 /* Returns: nat_t* - NULL == no match, */
3972 /* else pointer to matching NAT entry */
3973 /* Parameters: fin(I) - pointer to packet information */
3974 /* flags(I) - NAT flags for this packet */
3975 /* p(I) - protocol for this packet */
3976 /* src(I) - source IP address */
3977 /* mapdst(I) - destination IP address */
3978 /* */
3979 /* Lookup a nat entry based on the mapped destination ip address/port and */
3980 /* real source address/port. We use this lookup when receiving a packet, */
3981 /* we're looking for a table entry, based on the destination address. */
3982 /* */
3983 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */
3984 /* */
3985 /* NOTE: IT IS ASSUMED THAT IS ONLY HELD WITH A READ LOCK WHEN */
3986 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */
3987 /* */
3988 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */
3989 /* the packet is of said protocol */
3990 /* ------------------------------------------------------------------------ */
3991 nat_t *
ipf_nat_inlookup(fr_info_t * fin,u_int flags,u_int p,struct in_addr src,struct in_addr mapdst)3992 ipf_nat_inlookup(fr_info_t *fin, u_int flags, u_int p,
3993 struct in_addr src , struct in_addr mapdst)
3994 {
3995 ipf_main_softc_t *softc = fin->fin_main_soft;
3996 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3997 u_short sport, dport;
3998 ipnat_t *ipn;
3999 nat_t *nat;
4000 int nflags;
4001 u_32_t dst;
4002 void *ifp;
4003 u_int hv, rhv;
4004
4005 ifp = fin->fin_ifp;
4006 dst = mapdst.s_addr;
4007
4008 switch (p)
4009 {
4010 case IPPROTO_TCP :
4011 case IPPROTO_UDP :
4012 sport = htons(fin->fin_data[0]);
4013 dport = htons(fin->fin_data[1]);
4014 break;
4015 case IPPROTO_ICMP :
4016 sport = 0;
4017 dport = fin->fin_data[1];
4018 break;
4019 default :
4020 sport = 0;
4021 dport = 0;
4022 break;
4023 }
4024
4025
4026 if ((flags & SI_WILDP) != 0)
4027 goto find_in_wild_ports;
4028
4029 rhv = NAT_HASH_FN(dst, dport, 0xffffffff);
4030 rhv = NAT_HASH_FN(src.s_addr, rhv + sport, 0xffffffff);
4031 hv = rhv % softn->ipf_nat_table_sz;
4032 nat = softn->ipf_nat_table[1][hv];
4033 /* TRACE dst, dport, src, sport, hv, nat */
4034
4035 for (; nat; nat = nat->nat_hnext[1]) {
4036 if (nat->nat_ifps[0] != NULL) {
4037 if ((ifp != NULL) && (ifp != nat->nat_ifps[0]))
4038 continue;
4039 }
4040
4041 if (nat->nat_pr[0] != p)
4042 continue;
4043
4044 switch (nat->nat_dir)
4045 {
4046 case NAT_INBOUND :
4047 case NAT_DIVERTIN :
4048 if (nat->nat_v[0] != 4)
4049 continue;
4050 if (nat->nat_osrcaddr != src.s_addr ||
4051 nat->nat_odstaddr != dst)
4052 continue;
4053 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4054 if (nat->nat_osport != sport)
4055 continue;
4056 if (nat->nat_odport != dport)
4057 continue;
4058
4059 } else if (p == IPPROTO_ICMP) {
4060 if (nat->nat_osport != dport) {
4061 continue;
4062 }
4063 }
4064 break;
4065 case NAT_DIVERTOUT :
4066 if (nat->nat_dlocal)
4067 continue;
4068 case NAT_OUTBOUND :
4069 if (nat->nat_v[1] != 4)
4070 continue;
4071 if (nat->nat_dlocal)
4072 continue;
4073 if (nat->nat_dlocal)
4074 continue;
4075 if (nat->nat_ndstaddr != src.s_addr ||
4076 nat->nat_nsrcaddr != dst)
4077 continue;
4078 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4079 if (nat->nat_ndport != sport)
4080 continue;
4081 if (nat->nat_nsport != dport)
4082 continue;
4083
4084 } else if (p == IPPROTO_ICMP) {
4085 if (nat->nat_osport != dport) {
4086 continue;
4087 }
4088 }
4089 break;
4090 }
4091
4092
4093 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4094 ipn = nat->nat_ptr;
4095 if ((ipn != NULL) && (nat->nat_aps != NULL))
4096 if (ipf_proxy_match(fin, nat) != 0)
4097 continue;
4098 }
4099 if ((nat->nat_ifps[0] == NULL) && (ifp != NULL)) {
4100 nat->nat_ifps[0] = ifp;
4101 nat->nat_mtu[0] = GETIFMTU_4(ifp);
4102 }
4103 return (nat);
4104 }
4105
4106 /*
4107 * So if we didn't find it but there are wildcard members in the hash
4108 * table, go back and look for them. We do this search and update here
4109 * because it is modifying the NAT table and we want to do this only
4110 * for the first packet that matches. The exception, of course, is
4111 * for "dummy" (FI_IGNORE) lookups.
4112 */
4113 find_in_wild_ports:
4114 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) {
4115 NBUMPSIDEX(0, ns_lookup_miss, ns_lookup_miss_0);
4116 return (NULL);
4117 }
4118 if (softn->ipf_nat_stats.ns_wilds == 0 || (fin->fin_flx & FI_NOWILD)) {
4119 NBUMPSIDEX(0, ns_lookup_nowild, ns_lookup_nowild_0);
4120 return (NULL);
4121 }
4122
4123 RWLOCK_EXIT(&softc->ipf_nat);
4124
4125 hv = NAT_HASH_FN(dst, 0, 0xffffffff);
4126 hv = NAT_HASH_FN(src.s_addr, hv, softn->ipf_nat_table_sz);
4127 WRITE_ENTER(&softc->ipf_nat);
4128
4129 nat = softn->ipf_nat_table[1][hv];
4130 /* TRACE dst, src, hv, nat */
4131 for (; nat; nat = nat->nat_hnext[1]) {
4132 if (nat->nat_ifps[0] != NULL) {
4133 if ((ifp != NULL) && (ifp != nat->nat_ifps[0]))
4134 continue;
4135 }
4136
4137 if (nat->nat_pr[0] != fin->fin_p)
4138 continue;
4139
4140 switch (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND))
4141 {
4142 case NAT_INBOUND :
4143 if (nat->nat_v[0] != 4)
4144 continue;
4145 if (nat->nat_osrcaddr != src.s_addr ||
4146 nat->nat_odstaddr != dst)
4147 continue;
4148 break;
4149 case NAT_OUTBOUND :
4150 if (nat->nat_v[1] != 4)
4151 continue;
4152 if (nat->nat_ndstaddr != src.s_addr ||
4153 nat->nat_nsrcaddr != dst)
4154 continue;
4155 break;
4156 }
4157
4158 nflags = nat->nat_flags;
4159 if (!(nflags & (NAT_TCPUDP|SI_WILDP)))
4160 continue;
4161
4162 if (ipf_nat_wildok(nat, (int)sport, (int)dport, nflags,
4163 NAT_INBOUND) == 1) {
4164 if ((fin->fin_flx & FI_IGNORE) != 0)
4165 break;
4166 if ((nflags & SI_CLONE) != 0) {
4167 nat = ipf_nat_clone(fin, nat);
4168 if (nat == NULL)
4169 break;
4170 } else {
4171 MUTEX_ENTER(&softn->ipf_nat_new);
4172 softn->ipf_nat_stats.ns_wilds--;
4173 MUTEX_EXIT(&softn->ipf_nat_new);
4174 }
4175
4176 if (nat->nat_dir == NAT_INBOUND) {
4177 if (nat->nat_osport == 0) {
4178 nat->nat_osport = sport;
4179 nat->nat_nsport = sport;
4180 }
4181 if (nat->nat_odport == 0) {
4182 nat->nat_odport = dport;
4183 nat->nat_ndport = dport;
4184 }
4185 } else if (nat->nat_dir == NAT_OUTBOUND) {
4186 if (nat->nat_osport == 0) {
4187 nat->nat_osport = dport;
4188 nat->nat_nsport = dport;
4189 }
4190 if (nat->nat_odport == 0) {
4191 nat->nat_odport = sport;
4192 nat->nat_ndport = sport;
4193 }
4194 }
4195 if ((nat->nat_ifps[0] == NULL) && (ifp != NULL)) {
4196 nat->nat_ifps[0] = ifp;
4197 nat->nat_mtu[0] = GETIFMTU_4(ifp);
4198 }
4199 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT);
4200 ipf_nat_tabmove(softn, nat);
4201 break;
4202 }
4203 }
4204
4205 MUTEX_DOWNGRADE(&softc->ipf_nat);
4206
4207 if (nat == NULL) {
4208 NBUMPSIDE(0, ns_lookup_miss);
4209 }
4210 return (nat);
4211 }
4212
4213
4214 /* ------------------------------------------------------------------------ */
4215 /* Function: ipf_nat_tabmove */
4216 /* Returns: Nil */
4217 /* Parameters: softn(I) - pointer to NAT context structure */
4218 /* nat(I) - pointer to NAT structure */
4219 /* Write Lock: ipf_nat */
4220 /* */
4221 /* This function is only called for TCP/UDP NAT table entries where the */
4222 /* original was placed in the table without hashing on the ports and we now */
4223 /* want to include hashing on port numbers. */
4224 /* ------------------------------------------------------------------------ */
4225 static void
ipf_nat_tabmove(ipf_nat_softc_t * softn,nat_t * nat)4226 ipf_nat_tabmove(ipf_nat_softc_t *softn, nat_t *nat)
4227 {
4228 u_int hv0, hv1, rhv0, rhv1;
4229 natstat_t *nsp;
4230 nat_t **natp;
4231
4232 if (nat->nat_flags & SI_CLONE)
4233 return;
4234
4235 nsp = &softn->ipf_nat_stats;
4236 /*
4237 * Remove the NAT entry from the old location
4238 */
4239 if (nat->nat_hnext[0])
4240 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
4241 *nat->nat_phnext[0] = nat->nat_hnext[0];
4242 nsp->ns_side[0].ns_bucketlen[nat->nat_hv[0] %
4243 softn->ipf_nat_table_sz]--;
4244
4245 if (nat->nat_hnext[1])
4246 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
4247 *nat->nat_phnext[1] = nat->nat_hnext[1];
4248 nsp->ns_side[1].ns_bucketlen[nat->nat_hv[1] %
4249 softn->ipf_nat_table_sz]--;
4250
4251 /*
4252 * Add into the NAT table in the new position
4253 */
4254 rhv0 = NAT_HASH_FN(nat->nat_osrcaddr, nat->nat_osport, 0xffffffff);
4255 rhv0 = NAT_HASH_FN(nat->nat_odstaddr, rhv0 + nat->nat_odport,
4256 0xffffffff);
4257 rhv1 = NAT_HASH_FN(nat->nat_nsrcaddr, nat->nat_nsport, 0xffffffff);
4258 rhv1 = NAT_HASH_FN(nat->nat_ndstaddr, rhv1 + nat->nat_ndport,
4259 0xffffffff);
4260
4261 hv0 = rhv0 % softn->ipf_nat_table_sz;
4262 hv1 = rhv1 % softn->ipf_nat_table_sz;
4263
4264 if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) {
4265 u_int swap;
4266
4267 swap = hv0;
4268 hv0 = hv1;
4269 hv1 = swap;
4270 }
4271
4272 /* TRACE nat_osrcaddr, nat_osport, nat_odstaddr, nat_odport, hv0 */
4273 /* TRACE nat_nsrcaddr, nat_nsport, nat_ndstaddr, nat_ndport, hv1 */
4274
4275 nat->nat_hv[0] = rhv0;
4276 natp = &softn->ipf_nat_table[0][hv0];
4277 if (*natp)
4278 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
4279 nat->nat_phnext[0] = natp;
4280 nat->nat_hnext[0] = *natp;
4281 *natp = nat;
4282 nsp->ns_side[0].ns_bucketlen[hv0]++;
4283
4284 nat->nat_hv[1] = rhv1;
4285 natp = &softn->ipf_nat_table[1][hv1];
4286 if (*natp)
4287 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
4288 nat->nat_phnext[1] = natp;
4289 nat->nat_hnext[1] = *natp;
4290 *natp = nat;
4291 nsp->ns_side[1].ns_bucketlen[hv1]++;
4292 }
4293
4294
4295 /* ------------------------------------------------------------------------ */
4296 /* Function: ipf_nat_outlookup */
4297 /* Returns: nat_t* - NULL == no match, */
4298 /* else pointer to matching NAT entry */
4299 /* Parameters: fin(I) - pointer to packet information */
4300 /* flags(I) - NAT flags for this packet */
4301 /* p(I) - protocol for this packet */
4302 /* src(I) - source IP address */
4303 /* dst(I) - destination IP address */
4304 /* rw(I) - 1 == write lock on held, 0 == read lock. */
4305 /* */
4306 /* Lookup a nat entry based on the source 'real' ip address/port and */
4307 /* destination address/port. We use this lookup when sending a packet out, */
4308 /* we're looking for a table entry, based on the source address. */
4309 /* */
4310 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */
4311 /* */
4312 /* NOTE: IT IS ASSUMED THAT IS ONLY HELD WITH A READ LOCK WHEN */
4313 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */
4314 /* */
4315 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */
4316 /* the packet is of said protocol */
4317 /* ------------------------------------------------------------------------ */
4318 nat_t *
ipf_nat_outlookup(fr_info_t * fin,u_int flags,u_int p,struct in_addr src,struct in_addr dst)4319 ipf_nat_outlookup(fr_info_t *fin, u_int flags, u_int p,
4320 struct in_addr src , struct in_addr dst)
4321 {
4322 ipf_main_softc_t *softc = fin->fin_main_soft;
4323 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4324 u_short sport, dport;
4325 ipnat_t *ipn;
4326 nat_t *nat;
4327 void *ifp;
4328 u_int hv;
4329
4330 ifp = fin->fin_ifp;
4331
4332 switch (p)
4333 {
4334 case IPPROTO_TCP :
4335 case IPPROTO_UDP :
4336 sport = htons(fin->fin_data[0]);
4337 dport = htons(fin->fin_data[1]);
4338 break;
4339 case IPPROTO_ICMP :
4340 sport = 0;
4341 dport = fin->fin_data[1];
4342 break;
4343 default :
4344 sport = 0;
4345 dport = 0;
4346 break;
4347 }
4348
4349 if ((flags & SI_WILDP) != 0)
4350 goto find_out_wild_ports;
4351
4352 hv = NAT_HASH_FN(src.s_addr, sport, 0xffffffff);
4353 hv = NAT_HASH_FN(dst.s_addr, hv + dport, softn->ipf_nat_table_sz);
4354 nat = softn->ipf_nat_table[0][hv];
4355
4356 /* TRACE src, sport, dst, dport, hv, nat */
4357
4358 for (; nat; nat = nat->nat_hnext[0]) {
4359 if (nat->nat_ifps[1] != NULL) {
4360 if ((ifp != NULL) && (ifp != nat->nat_ifps[1]))
4361 continue;
4362 }
4363
4364 if (nat->nat_pr[1] != p)
4365 continue;
4366
4367 switch (nat->nat_dir)
4368 {
4369 case NAT_INBOUND :
4370 case NAT_DIVERTIN :
4371 if (nat->nat_v[1] != 4)
4372 continue;
4373 if (nat->nat_ndstaddr != src.s_addr ||
4374 nat->nat_nsrcaddr != dst.s_addr)
4375 continue;
4376
4377 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4378 if (nat->nat_ndport != sport)
4379 continue;
4380 if (nat->nat_nsport != dport)
4381 continue;
4382
4383 } else if (p == IPPROTO_ICMP) {
4384 if (nat->nat_osport != dport) {
4385 continue;
4386 }
4387 }
4388 break;
4389 case NAT_OUTBOUND :
4390 case NAT_DIVERTOUT :
4391 if (nat->nat_v[0] != 4)
4392 continue;
4393 if (nat->nat_osrcaddr != src.s_addr ||
4394 nat->nat_odstaddr != dst.s_addr)
4395 continue;
4396
4397 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4398 if (nat->nat_odport != dport)
4399 continue;
4400 if (nat->nat_osport != sport)
4401 continue;
4402
4403 } else if (p == IPPROTO_ICMP) {
4404 if (nat->nat_osport != dport) {
4405 continue;
4406 }
4407 }
4408 break;
4409 }
4410
4411 ipn = nat->nat_ptr;
4412 if ((ipn != NULL) && (nat->nat_aps != NULL))
4413 if (ipf_proxy_match(fin, nat) != 0)
4414 continue;
4415
4416 if ((nat->nat_ifps[1] == NULL) && (ifp != NULL)) {
4417 nat->nat_ifps[1] = ifp;
4418 nat->nat_mtu[1] = GETIFMTU_4(ifp);
4419 }
4420 return (nat);
4421 }
4422
4423 /*
4424 * So if we didn't find it but there are wildcard members in the hash
4425 * table, go back and look for them. We do this search and update here
4426 * because it is modifying the NAT table and we want to do this only
4427 * for the first packet that matches. The exception, of course, is
4428 * for "dummy" (FI_IGNORE) lookups.
4429 */
4430 find_out_wild_ports:
4431 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) {
4432 NBUMPSIDEX(1, ns_lookup_miss, ns_lookup_miss_1);
4433 return (NULL);
4434 }
4435 if (softn->ipf_nat_stats.ns_wilds == 0 || (fin->fin_flx & FI_NOWILD)) {
4436 NBUMPSIDEX(1, ns_lookup_nowild, ns_lookup_nowild_1);
4437 return (NULL);
4438 }
4439
4440 RWLOCK_EXIT(&softc->ipf_nat);
4441
4442 hv = NAT_HASH_FN(src.s_addr, 0, 0xffffffff);
4443 hv = NAT_HASH_FN(dst.s_addr, hv, softn->ipf_nat_table_sz);
4444
4445 WRITE_ENTER(&softc->ipf_nat);
4446
4447 nat = softn->ipf_nat_table[0][hv];
4448 for (; nat; nat = nat->nat_hnext[0]) {
4449 if (nat->nat_ifps[1] != NULL) {
4450 if ((ifp != NULL) && (ifp != nat->nat_ifps[1]))
4451 continue;
4452 }
4453
4454 if (nat->nat_pr[1] != fin->fin_p)
4455 continue;
4456
4457 switch (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND))
4458 {
4459 case NAT_INBOUND :
4460 if (nat->nat_v[1] != 4)
4461 continue;
4462 if (nat->nat_ndstaddr != src.s_addr ||
4463 nat->nat_nsrcaddr != dst.s_addr)
4464 continue;
4465 break;
4466 case NAT_OUTBOUND :
4467 if (nat->nat_v[0] != 4)
4468 continue;
4469 if (nat->nat_osrcaddr != src.s_addr ||
4470 nat->nat_odstaddr != dst.s_addr)
4471 continue;
4472 break;
4473 }
4474
4475 if (!(nat->nat_flags & (NAT_TCPUDP|SI_WILDP)))
4476 continue;
4477
4478 if (ipf_nat_wildok(nat, (int)sport, (int)dport, nat->nat_flags,
4479 NAT_OUTBOUND) == 1) {
4480 if ((fin->fin_flx & FI_IGNORE) != 0)
4481 break;
4482 if ((nat->nat_flags & SI_CLONE) != 0) {
4483 nat = ipf_nat_clone(fin, nat);
4484 if (nat == NULL)
4485 break;
4486 } else {
4487 MUTEX_ENTER(&softn->ipf_nat_new);
4488 softn->ipf_nat_stats.ns_wilds--;
4489 MUTEX_EXIT(&softn->ipf_nat_new);
4490 }
4491
4492 if (nat->nat_dir == NAT_OUTBOUND) {
4493 if (nat->nat_osport == 0) {
4494 nat->nat_osport = sport;
4495 nat->nat_nsport = sport;
4496 }
4497 if (nat->nat_odport == 0) {
4498 nat->nat_odport = dport;
4499 nat->nat_ndport = dport;
4500 }
4501 } else if (nat->nat_dir == NAT_INBOUND) {
4502 if (nat->nat_osport == 0) {
4503 nat->nat_osport = dport;
4504 nat->nat_nsport = dport;
4505 }
4506 if (nat->nat_odport == 0) {
4507 nat->nat_odport = sport;
4508 nat->nat_ndport = sport;
4509 }
4510 }
4511 if ((nat->nat_ifps[1] == NULL) && (ifp != NULL)) {
4512 nat->nat_ifps[1] = ifp;
4513 nat->nat_mtu[1] = GETIFMTU_4(ifp);
4514 }
4515 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT);
4516 ipf_nat_tabmove(softn, nat);
4517 break;
4518 }
4519 }
4520
4521 MUTEX_DOWNGRADE(&softc->ipf_nat);
4522
4523 if (nat == NULL) {
4524 NBUMPSIDE(1, ns_lookup_miss);
4525 }
4526 return (nat);
4527 }
4528
4529
4530 /* ------------------------------------------------------------------------ */
4531 /* Function: ipf_nat_lookupredir */
4532 /* Returns: nat_t* - NULL == no match, */
4533 /* else pointer to matching NAT entry */
4534 /* Parameters: np(I) - pointer to description of packet to find NAT table */
4535 /* entry for. */
4536 /* */
4537 /* Lookup the NAT tables to search for a matching redirect */
4538 /* The contents of natlookup_t should imitate those found in a packet that */
4539 /* would be translated - ie a packet coming in for RDR or going out for MAP.*/
4540 /* We can do the lookup in one of two ways, imitating an inbound or */
4541 /* outbound packet. By default we assume outbound, unless IPN_IN is set. */
4542 /* For IN, the fields are set as follows: */
4543 /* nl_real* = source information */
4544 /* nl_out* = destination information (translated) */
4545 /* For an out packet, the fields are set like this: */
4546 /* nl_in* = source information (untranslated) */
4547 /* nl_out* = destination information (translated) */
4548 /* ------------------------------------------------------------------------ */
4549 nat_t *
ipf_nat_lookupredir(natlookup_t * np)4550 ipf_nat_lookupredir(natlookup_t *np)
4551 {
4552 fr_info_t fi;
4553 nat_t *nat;
4554
4555 bzero((char *)&fi, sizeof(fi));
4556 if (np->nl_flags & IPN_IN) {
4557 fi.fin_data[0] = ntohs(np->nl_realport);
4558 fi.fin_data[1] = ntohs(np->nl_outport);
4559 } else {
4560 fi.fin_data[0] = ntohs(np->nl_inport);
4561 fi.fin_data[1] = ntohs(np->nl_outport);
4562 }
4563 if (np->nl_flags & IPN_TCP)
4564 fi.fin_p = IPPROTO_TCP;
4565 else if (np->nl_flags & IPN_UDP)
4566 fi.fin_p = IPPROTO_UDP;
4567 else if (np->nl_flags & (IPN_ICMPERR|IPN_ICMPQUERY))
4568 fi.fin_p = IPPROTO_ICMP;
4569
4570 /*
4571 * We can do two sorts of lookups:
4572 * - IPN_IN: we have the `real' and `out' address, look for `in'.
4573 * - default: we have the `in' and `out' address, look for `real'.
4574 */
4575 if (np->nl_flags & IPN_IN) {
4576 if ((nat = ipf_nat_inlookup(&fi, np->nl_flags, fi.fin_p,
4577 np->nl_realip, np->nl_outip))) {
4578 np->nl_inip = nat->nat_odstip;
4579 np->nl_inport = nat->nat_odport;
4580 }
4581 } else {
4582 /*
4583 * If nl_inip is non null, this is a lookup based on the real
4584 * ip address. Else, we use the fake.
4585 */
4586 if ((nat = ipf_nat_outlookup(&fi, np->nl_flags, fi.fin_p,
4587 np->nl_inip, np->nl_outip))) {
4588
4589 if ((np->nl_flags & IPN_FINDFORWARD) != 0) {
4590 fr_info_t fin;
4591 bzero((char *)&fin, sizeof(fin));
4592 fin.fin_p = nat->nat_pr[0];
4593 fin.fin_data[0] = ntohs(nat->nat_ndport);
4594 fin.fin_data[1] = ntohs(nat->nat_nsport);
4595 if (ipf_nat_inlookup(&fin, np->nl_flags,
4596 fin.fin_p, nat->nat_ndstip,
4597 nat->nat_nsrcip) != NULL) {
4598 np->nl_flags &= ~IPN_FINDFORWARD;
4599 }
4600 }
4601
4602 np->nl_realip = nat->nat_odstip;
4603 np->nl_realport = nat->nat_odport;
4604 }
4605 }
4606
4607 return (nat);
4608 }
4609
4610
4611 /* ------------------------------------------------------------------------ */
4612 /* Function: ipf_nat_match */
4613 /* Returns: int - 0 == no match, 1 == match */
4614 /* Parameters: fin(I) - pointer to packet information */
4615 /* np(I) - pointer to NAT rule */
4616 /* */
4617 /* Pull the matching of a packet against a NAT rule out of that complex */
4618 /* loop inside ipf_nat_checkin() and lay it out properly in its own function. */
4619 /* ------------------------------------------------------------------------ */
4620 static int
ipf_nat_match(fr_info_t * fin,ipnat_t * np)4621 ipf_nat_match(fr_info_t *fin, ipnat_t *np)
4622 {
4623 ipf_main_softc_t *softc = fin->fin_main_soft;
4624 frtuc_t *ft;
4625 int match;
4626
4627 match = 0;
4628 switch (np->in_osrcatype)
4629 {
4630 case FRI_NORMAL :
4631 match = ((fin->fin_saddr & np->in_osrcmsk) != np->in_osrcaddr);
4632 break;
4633 case FRI_LOOKUP :
4634 match = (*np->in_osrcfunc)(softc, np->in_osrcptr,
4635 4, &fin->fin_saddr, fin->fin_plen);
4636 break;
4637 }
4638 match ^= ((np->in_flags & IPN_NOTSRC) != 0);
4639 if (match)
4640 return (0);
4641
4642 match = 0;
4643 switch (np->in_odstatype)
4644 {
4645 case FRI_NORMAL :
4646 match = ((fin->fin_daddr & np->in_odstmsk) != np->in_odstaddr);
4647 break;
4648 case FRI_LOOKUP :
4649 match = (*np->in_odstfunc)(softc, np->in_odstptr,
4650 4, &fin->fin_daddr, fin->fin_plen);
4651 break;
4652 }
4653
4654 match ^= ((np->in_flags & IPN_NOTDST) != 0);
4655 if (match)
4656 return (0);
4657
4658 ft = &np->in_tuc;
4659 if (!(fin->fin_flx & FI_TCPUDP) ||
4660 (fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) {
4661 if (ft->ftu_scmp || ft->ftu_dcmp)
4662 return (0);
4663 return (1);
4664 }
4665
4666 return (ipf_tcpudpchk(&fin->fin_fi, ft));
4667 }
4668
4669
4670 /* ------------------------------------------------------------------------ */
4671 /* Function: ipf_nat_update */
4672 /* Returns: Nil */
4673 /* Parameters: fin(I) - pointer to packet information */
4674 /* nat(I) - pointer to NAT structure */
4675 /* */
4676 /* Updates the lifetime of a NAT table entry for non-TCP packets. Must be */
4677 /* called with fin_rev updated - i.e. after calling ipf_nat_proto(). */
4678 /* */
4679 /* This *MUST* be called after ipf_nat_proto() as it expects fin_rev to */
4680 /* already be set. */
4681 /* ------------------------------------------------------------------------ */
4682 void
ipf_nat_update(fr_info_t * fin,nat_t * nat)4683 ipf_nat_update(fr_info_t *fin, nat_t *nat)
4684 {
4685 ipf_main_softc_t *softc = fin->fin_main_soft;
4686 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4687 ipftq_t *ifq, *ifq2;
4688 ipftqent_t *tqe;
4689 ipnat_t *np = nat->nat_ptr;
4690
4691 tqe = &nat->nat_tqe;
4692 ifq = tqe->tqe_ifq;
4693
4694 /*
4695 * We allow over-riding of NAT timeouts from NAT rules, even for
4696 * TCP, however, if it is TCP and there is no rule timeout set,
4697 * then do not update the timeout here.
4698 */
4699 if (np != NULL) {
4700 np->in_bytes[fin->fin_rev] += fin->fin_plen;
4701 ifq2 = np->in_tqehead[fin->fin_rev];
4702 } else {
4703 ifq2 = NULL;
4704 }
4705
4706 if (nat->nat_pr[0] == IPPROTO_TCP && ifq2 == NULL) {
4707 (void) ipf_tcp_age(&nat->nat_tqe, fin, softn->ipf_nat_tcptq,
4708 0, 2);
4709 } else {
4710 if (ifq2 == NULL) {
4711 if (nat->nat_pr[0] == IPPROTO_UDP)
4712 ifq2 = fin->fin_rev ? &softn->ipf_nat_udpacktq :
4713 &softn->ipf_nat_udptq;
4714 else if (nat->nat_pr[0] == IPPROTO_ICMP ||
4715 nat->nat_pr[0] == IPPROTO_ICMPV6)
4716 ifq2 = fin->fin_rev ? &softn->ipf_nat_icmpacktq:
4717 &softn->ipf_nat_icmptq;
4718 else
4719 ifq2 = &softn->ipf_nat_iptq;
4720 }
4721
4722 ipf_movequeue(softc->ipf_ticks, tqe, ifq, ifq2);
4723 }
4724 }
4725
4726
4727 /* ------------------------------------------------------------------------ */
4728 /* Function: ipf_nat_checkout */
4729 /* Returns: int - -1 == packet failed NAT checks so block it, */
4730 /* 0 == no packet translation occurred, */
4731 /* 1 == packet was successfully translated. */
4732 /* Parameters: fin(I) - pointer to packet information */
4733 /* passp(I) - pointer to filtering result flags */
4734 /* */
4735 /* Check to see if an outcoming packet should be changed. ICMP packets are */
4736 /* first checked to see if they match an existing entry (if an error), */
4737 /* otherwise a search of the current NAT table is made. If neither results */
4738 /* in a match then a search for a matching NAT rule is made. Create a new */
4739 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */
4740 /* packet header(s) as required. */
4741 /* ------------------------------------------------------------------------ */
4742 int
ipf_nat_checkout(fr_info_t * fin,u_32_t * passp)4743 ipf_nat_checkout(fr_info_t *fin, u_32_t *passp)
4744 {
4745 ipnat_t *np = NULL, *npnext;
4746 struct ifnet *ifp, *sifp;
4747 ipf_main_softc_t *softc;
4748 ipf_nat_softc_t *softn;
4749 tcphdr_t *tcp = NULL;
4750 int rval, natfailed;
4751 u_int nflags = 0;
4752 u_32_t ipa, iph;
4753 int natadd = 1;
4754 frentry_t *fr;
4755 nat_t *nat;
4756
4757 if (fin->fin_v == 6) {
4758 #ifdef USE_INET6
4759 return (ipf_nat6_checkout(fin, passp));
4760 #else
4761 return (0);
4762 #endif
4763 }
4764
4765 softc = fin->fin_main_soft;
4766 softn = softc->ipf_nat_soft;
4767
4768 if (softn->ipf_nat_lock != 0)
4769 return (0);
4770 if (softn->ipf_nat_stats.ns_rules == 0 &&
4771 softn->ipf_nat_instances == NULL)
4772 return (0);
4773
4774 natfailed = 0;
4775 fr = fin->fin_fr;
4776 sifp = fin->fin_ifp;
4777 if (fr != NULL) {
4778 ifp = fr->fr_tifs[fin->fin_rev].fd_ptr;
4779 if ((ifp != NULL) && (ifp != (void *)-1))
4780 fin->fin_ifp = ifp;
4781 }
4782 ifp = fin->fin_ifp;
4783
4784 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
4785 switch (fin->fin_p)
4786 {
4787 case IPPROTO_TCP :
4788 nflags = IPN_TCP;
4789 break;
4790 case IPPROTO_UDP :
4791 nflags = IPN_UDP;
4792 break;
4793 case IPPROTO_ICMP :
4794 /*
4795 * This is an incoming packet, so the destination is
4796 * the icmp_id and the source port equals 0
4797 */
4798 if ((fin->fin_flx & FI_ICMPQUERY) != 0)
4799 nflags = IPN_ICMPQUERY;
4800 break;
4801 default :
4802 break;
4803 }
4804
4805 if ((nflags & IPN_TCPUDP))
4806 tcp = fin->fin_dp;
4807 }
4808
4809 ipa = fin->fin_saddr;
4810
4811 READ_ENTER(&softc->ipf_nat);
4812
4813 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
4814 (nat = ipf_nat_icmperror(fin, &nflags, NAT_OUTBOUND)))
4815 /*EMPTY*/;
4816 else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin)))
4817 natadd = 0;
4818 else if ((nat = ipf_nat_outlookup(fin, nflags|NAT_SEARCH,
4819 (u_int)fin->fin_p, fin->fin_src,
4820 fin->fin_dst))) {
4821 nflags = nat->nat_flags;
4822 } else if (fin->fin_off == 0) {
4823 u_32_t hv, msk, nmsk = 0;
4824
4825 /*
4826 * If there is no current entry in the nat table for this IP#,
4827 * create one for it (if there is a matching rule).
4828 */
4829 maskloop:
4830 msk = softn->ipf_nat_map_active_masks[nmsk];
4831 iph = ipa & msk;
4832 hv = NAT_HASH_FN(iph, 0, softn->ipf_nat_maprules_sz);
4833 retry_roundrobin:
4834 for (np = softn->ipf_nat_map_rules[hv]; np; np = npnext) {
4835 npnext = np->in_mnext;
4836 if ((np->in_ifps[1] && (np->in_ifps[1] != ifp)))
4837 continue;
4838 if (np->in_v[0] != 4)
4839 continue;
4840 if (np->in_pr[1] && (np->in_pr[1] != fin->fin_p))
4841 continue;
4842 if ((np->in_flags & IPN_RF) &&
4843 !(np->in_flags & nflags))
4844 continue;
4845 if (np->in_flags & IPN_FILTER) {
4846 switch (ipf_nat_match(fin, np))
4847 {
4848 case 0 :
4849 continue;
4850 case -1 :
4851 rval = -3;
4852 goto outmatchfail;
4853 case 1 :
4854 default :
4855 break;
4856 }
4857 } else if ((ipa & np->in_osrcmsk) != np->in_osrcaddr)
4858 continue;
4859
4860 if ((fr != NULL) &&
4861 !ipf_matchtag(&np->in_tag, &fr->fr_nattag))
4862 continue;
4863
4864 if (np->in_plabel != -1) {
4865 if (((np->in_flags & IPN_FILTER) == 0) &&
4866 (np->in_odport != fin->fin_data[1]))
4867 continue;
4868 if (ipf_proxy_ok(fin, tcp, np) == 0)
4869 continue;
4870 }
4871
4872 if (np->in_flags & IPN_NO) {
4873 np->in_hits++;
4874 break;
4875 }
4876 MUTEX_ENTER(&softn->ipf_nat_new);
4877 /*
4878 * If we've matched a round-robin rule but it has
4879 * moved in the list since we got it, start over as
4880 * this is now no longer correct.
4881 */
4882 if (npnext != np->in_mnext) {
4883 if ((np->in_flags & IPN_ROUNDR) != 0) {
4884 MUTEX_EXIT(&softn->ipf_nat_new);
4885 goto retry_roundrobin;
4886 }
4887 npnext = np->in_mnext;
4888 }
4889
4890 nat = ipf_nat_add(fin, np, NULL, nflags, NAT_OUTBOUND);
4891 MUTEX_EXIT(&softn->ipf_nat_new);
4892 if (nat != NULL) {
4893 natfailed = 0;
4894 break;
4895 }
4896 natfailed = -2;
4897 }
4898 if ((np == NULL) && (nmsk < softn->ipf_nat_map_max)) {
4899 nmsk++;
4900 goto maskloop;
4901 }
4902 }
4903
4904 if (nat != NULL) {
4905 rval = ipf_nat_out(fin, nat, natadd, nflags);
4906 if (rval == 1) {
4907 MUTEX_ENTER(&nat->nat_lock);
4908 ipf_nat_update(fin, nat);
4909 nat->nat_bytes[1] += fin->fin_plen;
4910 nat->nat_pkts[1]++;
4911 fin->fin_pktnum = nat->nat_pkts[1];
4912 MUTEX_EXIT(&nat->nat_lock);
4913 }
4914 } else
4915 rval = natfailed;
4916 outmatchfail:
4917 RWLOCK_EXIT(&softc->ipf_nat);
4918
4919 switch (rval)
4920 {
4921 case -3 :
4922 /* ipf_nat_match() failure */
4923 /* FALLTHROUGH */
4924 case -2 :
4925 /* retry_roundrobin loop failure */
4926 /* FALLTHROUGH */
4927 case -1 :
4928 /* proxy failure detected by ipf_nat_out() */
4929 if (passp != NULL) {
4930 DT2(frb_natv4out, fr_info_t *, fin, int, rval);
4931 NBUMPSIDED(1, ns_drop);
4932 *passp = FR_BLOCK;
4933 fin->fin_reason = FRB_NATV4;
4934 }
4935 fin->fin_flx |= FI_BADNAT;
4936 NBUMPSIDED(1, ns_badnat);
4937 rval = -1; /* We only return -1 on error. */
4938 break;
4939 case 0 :
4940 NBUMPSIDE(1, ns_ignored);
4941 break;
4942 case 1 :
4943 NBUMPSIDE(1, ns_translated);
4944 break;
4945 }
4946 fin->fin_ifp = sifp;
4947 return (rval);
4948 }
4949
4950 /* ------------------------------------------------------------------------ */
4951 /* Function: ipf_nat_out */
4952 /* Returns: int - -1 == packet failed NAT checks so block it, */
4953 /* 1 == packet was successfully translated. */
4954 /* Parameters: fin(I) - pointer to packet information */
4955 /* nat(I) - pointer to NAT structure */
4956 /* natadd(I) - flag indicating if it is safe to add frag cache */
4957 /* nflags(I) - NAT flags set for this packet */
4958 /* */
4959 /* Translate a packet coming "out" on an interface. */
4960 /* ------------------------------------------------------------------------ */
4961 int
ipf_nat_out(fr_info_t * fin,nat_t * nat,int natadd,u_32_t nflags)4962 ipf_nat_out(fr_info_t *fin, nat_t *nat, int natadd, u_32_t nflags)
4963 {
4964 ipf_main_softc_t *softc = fin->fin_main_soft;
4965 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4966 icmphdr_t *icmp;
4967 tcphdr_t *tcp;
4968 ipnat_t *np;
4969 int skip;
4970 int i;
4971
4972 tcp = NULL;
4973 icmp = NULL;
4974 np = nat->nat_ptr;
4975
4976 if ((natadd != 0) && (fin->fin_flx & FI_FRAG) && (np != NULL))
4977 (void) ipf_frag_natnew(softc, fin, 0, nat);
4978
4979 /*
4980 * Fix up checksums, not by recalculating them, but
4981 * simply computing adjustments.
4982 * This is only done for STREAMS based IP implementations where the
4983 * checksum has already been calculated by IP. In all other cases,
4984 * IPFilter is called before the checksum needs calculating so there
4985 * is no call to modify whatever is in the header now.
4986 */
4987 if (nflags == IPN_ICMPERR) {
4988 u_32_t s1, s2, sumd, msumd;
4989
4990 s1 = LONG_SUM(ntohl(fin->fin_saddr));
4991 if (nat->nat_dir == NAT_OUTBOUND) {
4992 s2 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
4993 } else {
4994 s2 = LONG_SUM(ntohl(nat->nat_odstaddr));
4995 }
4996 CALC_SUMD(s1, s2, sumd);
4997 msumd = sumd;
4998
4999 s1 = LONG_SUM(ntohl(fin->fin_daddr));
5000 if (nat->nat_dir == NAT_OUTBOUND) {
5001 s2 = LONG_SUM(ntohl(nat->nat_ndstaddr));
5002 } else {
5003 s2 = LONG_SUM(ntohl(nat->nat_osrcaddr));
5004 }
5005 CALC_SUMD(s1, s2, sumd);
5006 msumd += sumd;
5007
5008 ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, msumd, 0);
5009 }
5010 #if !defined(_KERNEL) || SOLARIS || \
5011 defined(BRIDGE_IPF) || defined(__FreeBSD__)
5012 else {
5013 /*
5014 * We always do this on FreeBSD because this code doesn't
5015 * exist in fastforward.
5016 */
5017 switch (nat->nat_dir)
5018 {
5019 case NAT_OUTBOUND :
5020 ipf_fix_outcksum(fin->fin_cksum & FI_CK_L4PART,
5021 &fin->fin_ip->ip_sum,
5022 nat->nat_ipsumd, 0);
5023 break;
5024
5025 case NAT_INBOUND :
5026 ipf_fix_incksum(fin->fin_cksum & FI_CK_L4PART,
5027 &fin->fin_ip->ip_sum,
5028 nat->nat_ipsumd, 0);
5029 break;
5030
5031 default :
5032 break;
5033 }
5034 }
5035 #endif
5036
5037 /*
5038 * Address assignment is after the checksum modification because
5039 * we are using the address in the packet for determining the
5040 * correct checksum offset (the ICMP error could be coming from
5041 * anyone...)
5042 */
5043 switch (nat->nat_dir)
5044 {
5045 case NAT_OUTBOUND :
5046 fin->fin_ip->ip_src = nat->nat_nsrcip;
5047 fin->fin_saddr = nat->nat_nsrcaddr;
5048 fin->fin_ip->ip_dst = nat->nat_ndstip;
5049 fin->fin_daddr = nat->nat_ndstaddr;
5050 break;
5051
5052 case NAT_INBOUND :
5053 fin->fin_ip->ip_src = nat->nat_odstip;
5054 fin->fin_saddr = nat->nat_ndstaddr;
5055 fin->fin_ip->ip_dst = nat->nat_osrcip;
5056 fin->fin_daddr = nat->nat_nsrcaddr;
5057 break;
5058
5059 case NAT_DIVERTIN :
5060 {
5061 mb_t *m;
5062
5063 skip = ipf_nat_decap(fin, nat);
5064 if (skip <= 0) {
5065 NBUMPSIDED(1, ns_decap_fail);
5066 return (-1);
5067 }
5068
5069 m = fin->fin_m;
5070
5071 #if SOLARIS && defined(_KERNEL)
5072 m->b_rptr += skip;
5073 #else
5074 m->m_data += skip;
5075 m->m_len -= skip;
5076
5077 # ifdef M_PKTHDR
5078 if (m->m_flags & M_PKTHDR)
5079 m->m_pkthdr.len -= skip;
5080 # endif
5081 #endif
5082
5083 MUTEX_ENTER(&nat->nat_lock);
5084 ipf_nat_update(fin, nat);
5085 MUTEX_EXIT(&nat->nat_lock);
5086 fin->fin_flx |= FI_NATED;
5087 if (np != NULL && np->in_tag.ipt_num[0] != 0)
5088 fin->fin_nattag = &np->in_tag;
5089 return (1);
5090 /* NOTREACHED */
5091 }
5092
5093 case NAT_DIVERTOUT :
5094 {
5095 u_32_t s1, s2, sumd;
5096 udphdr_t *uh;
5097 ip_t *ip;
5098 mb_t *m;
5099
5100 m = M_DUP(np->in_divmp);
5101 if (m == NULL) {
5102 NBUMPSIDED(1, ns_divert_dup);
5103 return (-1);
5104 }
5105
5106 ip = MTOD(m, ip_t *);
5107 ip_fillid(ip, V_ip_random_id);
5108 s2 = ntohs(ip->ip_id);
5109
5110 s1 = ip->ip_len;
5111 ip->ip_len = ntohs(ip->ip_len);
5112 ip->ip_len += fin->fin_plen;
5113 ip->ip_len = htons(ip->ip_len);
5114 s2 += ntohs(ip->ip_len);
5115 CALC_SUMD(s1, s2, sumd);
5116
5117 uh = (udphdr_t *)(ip + 1);
5118 uh->uh_ulen += fin->fin_plen;
5119 uh->uh_ulen = htons(uh->uh_ulen);
5120 #if !defined(_KERNEL) || SOLARIS || \
5121 defined(BRIDGE_IPF) || defined(__FreeBSD__)
5122 ipf_fix_outcksum(0, &ip->ip_sum, sumd, 0);
5123 #endif
5124
5125 PREP_MB_T(fin, m);
5126
5127 fin->fin_src = ip->ip_src;
5128 fin->fin_dst = ip->ip_dst;
5129 fin->fin_ip = ip;
5130 fin->fin_plen += sizeof(ip_t) + 8; /* UDP + IPv4 hdr */
5131 fin->fin_dlen += sizeof(ip_t) + 8; /* UDP + IPv4 hdr */
5132
5133 nflags &= ~IPN_TCPUDPICMP;
5134
5135 break;
5136 }
5137
5138 default :
5139 break;
5140 }
5141
5142 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5143 u_short *csump;
5144
5145 if ((nat->nat_nsport != 0) && (nflags & IPN_TCPUDP)) {
5146 tcp = fin->fin_dp;
5147
5148 switch (nat->nat_dir)
5149 {
5150 case NAT_OUTBOUND :
5151 tcp->th_sport = nat->nat_nsport;
5152 fin->fin_data[0] = ntohs(nat->nat_nsport);
5153 tcp->th_dport = nat->nat_ndport;
5154 fin->fin_data[1] = ntohs(nat->nat_ndport);
5155 break;
5156
5157 case NAT_INBOUND :
5158 tcp->th_sport = nat->nat_odport;
5159 fin->fin_data[0] = ntohs(nat->nat_odport);
5160 tcp->th_dport = nat->nat_osport;
5161 fin->fin_data[1] = ntohs(nat->nat_osport);
5162 break;
5163 }
5164 }
5165
5166 if ((nat->nat_nsport != 0) && (nflags & IPN_ICMPQUERY)) {
5167 icmp = fin->fin_dp;
5168 icmp->icmp_id = nat->nat_nicmpid;
5169 }
5170
5171 csump = ipf_nat_proto(fin, nat, nflags);
5172
5173 /*
5174 * The above comments do not hold for layer 4 (or higher)
5175 * checksums...
5176 */
5177 if (csump != NULL) {
5178 if (nat->nat_dir == NAT_OUTBOUND)
5179 ipf_fix_outcksum(fin->fin_cksum, csump,
5180 nat->nat_sumd[0],
5181 nat->nat_sumd[1] +
5182 fin->fin_dlen);
5183 else
5184 ipf_fix_incksum(fin->fin_cksum, csump,
5185 nat->nat_sumd[0],
5186 nat->nat_sumd[1] +
5187 fin->fin_dlen);
5188 }
5189 }
5190
5191 ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync);
5192 /* ------------------------------------------------------------- */
5193 /* A few quick notes: */
5194 /* Following are test conditions prior to calling the */
5195 /* ipf_proxy_check routine. */
5196 /* */
5197 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */
5198 /* with a redirect rule, we attempt to match the packet's */
5199 /* source port against in_dport, otherwise we'd compare the */
5200 /* packet's destination. */
5201 /* ------------------------------------------------------------- */
5202 if ((np != NULL) && (np->in_apr != NULL)) {
5203 i = ipf_proxy_check(fin, nat);
5204 if (i == -1) {
5205 NBUMPSIDED(1, ns_ipf_proxy_fail);
5206 }
5207 } else {
5208 i = 1;
5209 }
5210 fin->fin_flx |= FI_NATED;
5211 return (i);
5212 }
5213
5214
5215 /* ------------------------------------------------------------------------ */
5216 /* Function: ipf_nat_checkin */
5217 /* Returns: int - -1 == packet failed NAT checks so block it, */
5218 /* 0 == no packet translation occurred, */
5219 /* 1 == packet was successfully translated. */
5220 /* Parameters: fin(I) - pointer to packet information */
5221 /* passp(I) - pointer to filtering result flags */
5222 /* */
5223 /* Check to see if an incoming packet should be changed. ICMP packets are */
5224 /* first checked to see if they match an existing entry (if an error), */
5225 /* otherwise a search of the current NAT table is made. If neither results */
5226 /* in a match then a search for a matching NAT rule is made. Create a new */
5227 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */
5228 /* packet header(s) as required. */
5229 /* ------------------------------------------------------------------------ */
5230 int
ipf_nat_checkin(fr_info_t * fin,u_32_t * passp)5231 ipf_nat_checkin(fr_info_t *fin, u_32_t *passp)
5232 {
5233 ipf_main_softc_t *softc;
5234 ipf_nat_softc_t *softn;
5235 u_int nflags, natadd;
5236 ipnat_t *np, *npnext;
5237 int rval, natfailed;
5238 struct ifnet *ifp;
5239 struct in_addr in;
5240 icmphdr_t *icmp;
5241 tcphdr_t *tcp;
5242 u_short dport;
5243 nat_t *nat;
5244 u_32_t iph;
5245
5246 softc = fin->fin_main_soft;
5247 softn = softc->ipf_nat_soft;
5248
5249 if (softn->ipf_nat_lock != 0)
5250 return (0);
5251 if (softn->ipf_nat_stats.ns_rules == 0 &&
5252 softn->ipf_nat_instances == NULL)
5253 return (0);
5254
5255 tcp = NULL;
5256 icmp = NULL;
5257 dport = 0;
5258 natadd = 1;
5259 nflags = 0;
5260 natfailed = 0;
5261 ifp = fin->fin_ifp;
5262
5263 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5264 switch (fin->fin_p)
5265 {
5266 case IPPROTO_TCP :
5267 nflags = IPN_TCP;
5268 break;
5269 case IPPROTO_UDP :
5270 nflags = IPN_UDP;
5271 break;
5272 case IPPROTO_ICMP :
5273 icmp = fin->fin_dp;
5274
5275 /*
5276 * This is an incoming packet, so the destination is
5277 * the icmp_id and the source port equals 0
5278 */
5279 if ((fin->fin_flx & FI_ICMPQUERY) != 0) {
5280 nflags = IPN_ICMPQUERY;
5281 dport = icmp->icmp_id;
5282 } break;
5283 default :
5284 break;
5285 }
5286
5287 if ((nflags & IPN_TCPUDP)) {
5288 tcp = fin->fin_dp;
5289 dport = fin->fin_data[1];
5290 }
5291 }
5292
5293 in = fin->fin_dst;
5294
5295 READ_ENTER(&softc->ipf_nat);
5296
5297 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
5298 (nat = ipf_nat_icmperror(fin, &nflags, NAT_INBOUND)))
5299 /*EMPTY*/;
5300 else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin)))
5301 natadd = 0;
5302 else if ((nat = ipf_nat_inlookup(fin, nflags|NAT_SEARCH,
5303 (u_int)fin->fin_p,
5304 fin->fin_src, in))) {
5305 nflags = nat->nat_flags;
5306 } else if (fin->fin_off == 0) {
5307 u_32_t hv, msk, rmsk = 0;
5308
5309 /*
5310 * If there is no current entry in the nat table for this IP#,
5311 * create one for it (if there is a matching rule).
5312 */
5313 maskloop:
5314 msk = softn->ipf_nat_rdr_active_masks[rmsk];
5315 iph = in.s_addr & msk;
5316 hv = NAT_HASH_FN(iph, 0, softn->ipf_nat_rdrrules_sz);
5317 retry_roundrobin:
5318 /* TRACE (iph,msk,rmsk,hv,softn->ipf_nat_rdrrules_sz) */
5319 for (np = softn->ipf_nat_rdr_rules[hv]; np; np = npnext) {
5320 npnext = np->in_rnext;
5321 if (np->in_ifps[0] && (np->in_ifps[0] != ifp))
5322 continue;
5323 if (np->in_v[0] != 4)
5324 continue;
5325 if (np->in_pr[0] && (np->in_pr[0] != fin->fin_p))
5326 continue;
5327 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags))
5328 continue;
5329 if (np->in_flags & IPN_FILTER) {
5330 switch (ipf_nat_match(fin, np))
5331 {
5332 case 0 :
5333 continue;
5334 case -1 :
5335 rval = -3;
5336 goto inmatchfail;
5337 case 1 :
5338 default :
5339 break;
5340 }
5341 } else {
5342 if ((in.s_addr & np->in_odstmsk) !=
5343 np->in_odstaddr)
5344 continue;
5345 if (np->in_odport &&
5346 ((np->in_dtop < dport) ||
5347 (dport < np->in_odport)))
5348 continue;
5349 }
5350
5351 if (np->in_plabel != -1) {
5352 if (!ipf_proxy_ok(fin, tcp, np)) {
5353 continue;
5354 }
5355 }
5356
5357 if (np->in_flags & IPN_NO) {
5358 np->in_hits++;
5359 break;
5360 }
5361
5362 MUTEX_ENTER(&softn->ipf_nat_new);
5363 /*
5364 * If we've matched a round-robin rule but it has
5365 * moved in the list since we got it, start over as
5366 * this is now no longer correct.
5367 */
5368 if (npnext != np->in_rnext) {
5369 if ((np->in_flags & IPN_ROUNDR) != 0) {
5370 MUTEX_EXIT(&softn->ipf_nat_new);
5371 goto retry_roundrobin;
5372 }
5373 npnext = np->in_rnext;
5374 }
5375
5376 nat = ipf_nat_add(fin, np, NULL, nflags, NAT_INBOUND);
5377 MUTEX_EXIT(&softn->ipf_nat_new);
5378 if (nat != NULL) {
5379 natfailed = 0;
5380 break;
5381 }
5382 natfailed = -2;
5383 }
5384 if ((np == NULL) && (rmsk < softn->ipf_nat_rdr_max)) {
5385 rmsk++;
5386 goto maskloop;
5387 }
5388 }
5389
5390 if (nat != NULL) {
5391 rval = ipf_nat_in(fin, nat, natadd, nflags);
5392 if (rval == 1) {
5393 MUTEX_ENTER(&nat->nat_lock);
5394 ipf_nat_update(fin, nat);
5395 nat->nat_bytes[0] += fin->fin_plen;
5396 nat->nat_pkts[0]++;
5397 fin->fin_pktnum = nat->nat_pkts[0];
5398 MUTEX_EXIT(&nat->nat_lock);
5399 }
5400 } else
5401 rval = natfailed;
5402 inmatchfail:
5403 RWLOCK_EXIT(&softc->ipf_nat);
5404
5405 DT2(frb_natv4in, fr_info_t *, fin, int, rval);
5406 switch (rval)
5407 {
5408 case -3 :
5409 /* ipf_nat_match() failure */
5410 /* FALLTHROUGH */
5411 case -2 :
5412 /* retry_roundrobin loop failure */
5413 /* FALLTHROUGH */
5414 case -1 :
5415 /* proxy failure detected by ipf_nat_in() */
5416 if (passp != NULL) {
5417 NBUMPSIDED(0, ns_drop);
5418 *passp = FR_BLOCK;
5419 fin->fin_reason = FRB_NATV4;
5420 }
5421 fin->fin_flx |= FI_BADNAT;
5422 NBUMPSIDED(0, ns_badnat);
5423 rval = -1; /* We only return -1 on error. */
5424 break;
5425 case 0 :
5426 NBUMPSIDE(0, ns_ignored);
5427 break;
5428 case 1 :
5429 NBUMPSIDE(0, ns_translated);
5430 break;
5431 }
5432 return (rval);
5433 }
5434
5435
5436 /* ------------------------------------------------------------------------ */
5437 /* Function: ipf_nat_in */
5438 /* Returns: int - -1 == packet failed NAT checks so block it, */
5439 /* 1 == packet was successfully translated. */
5440 /* Parameters: fin(I) - pointer to packet information */
5441 /* nat(I) - pointer to NAT structure */
5442 /* natadd(I) - flag indicating if it is safe to add frag cache */
5443 /* nflags(I) - NAT flags set for this packet */
5444 /* Locks Held: ipf_nat(READ) */
5445 /* */
5446 /* Translate a packet coming "in" on an interface. */
5447 /* ------------------------------------------------------------------------ */
5448 int
ipf_nat_in(fr_info_t * fin,nat_t * nat,int natadd,u_32_t nflags)5449 ipf_nat_in(fr_info_t *fin, nat_t *nat, int natadd, u_32_t nflags)
5450 {
5451 ipf_main_softc_t *softc = fin->fin_main_soft;
5452 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5453 u_32_t sumd, sum1, sum2;
5454 #if !defined(_KERNEL) || SOLARIS
5455 u_32_t ipsumd;
5456 #endif
5457 icmphdr_t *icmp;
5458 tcphdr_t *tcp;
5459 ipnat_t *np;
5460 int skip;
5461 int i;
5462
5463 tcp = NULL;
5464 np = nat->nat_ptr;
5465 fin->fin_fr = nat->nat_fr;
5466
5467 if (np != NULL) {
5468 if ((natadd != 0) && (fin->fin_flx & FI_FRAG))
5469 (void) ipf_frag_natnew(softc, fin, 0, nat);
5470
5471 /* ------------------------------------------------------------- */
5472 /* A few quick notes: */
5473 /* Following are test conditions prior to calling the */
5474 /* ipf_proxy_check routine. */
5475 /* */
5476 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */
5477 /* with a map rule, we attempt to match the packet's */
5478 /* source port against in_dport, otherwise we'd compare the */
5479 /* packet's destination. */
5480 /* ------------------------------------------------------------- */
5481 if (np->in_apr != NULL) {
5482 i = ipf_proxy_check(fin, nat);
5483 if (i == -1) {
5484 NBUMPSIDED(0, ns_ipf_proxy_fail);
5485 return (-1);
5486 }
5487 }
5488 }
5489
5490 ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync);
5491
5492 #if !defined(_KERNEL) || SOLARIS
5493 ipsumd = nat->nat_ipsumd;
5494 #endif
5495 /*
5496 * Fix up checksums, not by recalculating them, but
5497 * simply computing adjustments.
5498 * Why only do this for some platforms on inbound packets ?
5499 * Because for those that it is done, IP processing is yet to happen
5500 * and so the IPv4 header checksum has not yet been evaluated.
5501 * Perhaps it should always be done for the benefit of things like
5502 * fast forwarding (so that it doesn't need to be recomputed) but with
5503 * header checksum offloading, perhaps it is a moot point.
5504 */
5505
5506 switch (nat->nat_dir)
5507 {
5508 case NAT_INBOUND :
5509 if ((fin->fin_flx & FI_ICMPERR) == 0) {
5510 fin->fin_ip->ip_src = nat->nat_nsrcip;
5511 fin->fin_saddr = nat->nat_nsrcaddr;
5512 } else {
5513 sum1 = nat->nat_osrcaddr;
5514 sum2 = nat->nat_nsrcaddr;
5515 CALC_SUMD(sum1, sum2, sumd);
5516 #if !defined(_KERNEL) || SOLARIS
5517 ipsumd -= sumd;
5518 #endif
5519 }
5520 fin->fin_ip->ip_dst = nat->nat_ndstip;
5521 fin->fin_daddr = nat->nat_ndstaddr;
5522 #if !defined(_KERNEL) || SOLARIS
5523 ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, ipsumd, 0);
5524 #endif
5525 break;
5526
5527 case NAT_OUTBOUND :
5528 if ((fin->fin_flx & FI_ICMPERR) == 0) {
5529 fin->fin_ip->ip_src = nat->nat_odstip;
5530 fin->fin_saddr = nat->nat_odstaddr;
5531 } else {
5532 sum1 = nat->nat_odstaddr;
5533 sum2 = nat->nat_ndstaddr;
5534 CALC_SUMD(sum1, sum2, sumd);
5535 #if !defined(_KERNEL) || SOLARIS
5536 ipsumd -= sumd;
5537 #endif
5538 }
5539 fin->fin_ip->ip_dst = nat->nat_osrcip;
5540 fin->fin_daddr = nat->nat_osrcaddr;
5541 #if !defined(_KERNEL) || SOLARIS
5542 ipf_fix_incksum(0, &fin->fin_ip->ip_sum, ipsumd, 0);
5543 #endif
5544 break;
5545
5546 case NAT_DIVERTIN :
5547 {
5548 udphdr_t *uh;
5549 ip_t *ip;
5550 mb_t *m;
5551
5552 m = M_DUP(np->in_divmp);
5553 if (m == NULL) {
5554 NBUMPSIDED(0, ns_divert_dup);
5555 return (-1);
5556 }
5557
5558 ip = MTOD(m, ip_t *);
5559 ip_fillid(ip, V_ip_random_id);
5560 sum1 = ntohs(ip->ip_len);
5561 ip->ip_len = ntohs(ip->ip_len);
5562 ip->ip_len += fin->fin_plen;
5563 ip->ip_len = htons(ip->ip_len);
5564
5565 uh = (udphdr_t *)(ip + 1);
5566 uh->uh_ulen += fin->fin_plen;
5567 uh->uh_ulen = htons(uh->uh_ulen);
5568
5569 sum2 = ntohs(ip->ip_id) + ntohs(ip->ip_len);
5570 sum2 += ntohs(ip->ip_off) & IP_DF;
5571 CALC_SUMD(sum1, sum2, sumd);
5572
5573 #if !defined(_KERNEL) || SOLARIS
5574 ipf_fix_outcksum(0, &ip->ip_sum, sumd, 0);
5575 #endif
5576 PREP_MB_T(fin, m);
5577
5578 fin->fin_ip = ip;
5579 fin->fin_plen += sizeof(ip_t) + 8; /* UDP + new IPv4 hdr */
5580 fin->fin_dlen += sizeof(ip_t) + 8; /* UDP + old IPv4 hdr */
5581
5582 nflags &= ~IPN_TCPUDPICMP;
5583
5584 break;
5585 }
5586
5587 case NAT_DIVERTOUT :
5588 {
5589 mb_t *m;
5590
5591 skip = ipf_nat_decap(fin, nat);
5592 if (skip <= 0) {
5593 NBUMPSIDED(0, ns_decap_fail);
5594 return (-1);
5595 }
5596
5597 m = fin->fin_m;
5598
5599 #if SOLARIS && defined(_KERNEL)
5600 m->b_rptr += skip;
5601 #else
5602 m->m_data += skip;
5603 m->m_len -= skip;
5604
5605 # ifdef M_PKTHDR
5606 if (m->m_flags & M_PKTHDR)
5607 m->m_pkthdr.len -= skip;
5608 # endif
5609 #endif
5610
5611 ipf_nat_update(fin, nat);
5612 nflags &= ~IPN_TCPUDPICMP;
5613 fin->fin_flx |= FI_NATED;
5614 if (np != NULL && np->in_tag.ipt_num[0] != 0)
5615 fin->fin_nattag = &np->in_tag;
5616 return (1);
5617 /* NOTREACHED */
5618 }
5619 }
5620 if (nflags & IPN_TCPUDP)
5621 tcp = fin->fin_dp;
5622
5623 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5624 u_short *csump;
5625
5626 if ((nat->nat_odport != 0) && (nflags & IPN_TCPUDP)) {
5627 switch (nat->nat_dir)
5628 {
5629 case NAT_INBOUND :
5630 tcp->th_sport = nat->nat_nsport;
5631 fin->fin_data[0] = ntohs(nat->nat_nsport);
5632 tcp->th_dport = nat->nat_ndport;
5633 fin->fin_data[1] = ntohs(nat->nat_ndport);
5634 break;
5635
5636 case NAT_OUTBOUND :
5637 tcp->th_sport = nat->nat_odport;
5638 fin->fin_data[0] = ntohs(nat->nat_odport);
5639 tcp->th_dport = nat->nat_osport;
5640 fin->fin_data[1] = ntohs(nat->nat_osport);
5641 break;
5642 }
5643 }
5644
5645
5646 if ((nat->nat_odport != 0) && (nflags & IPN_ICMPQUERY)) {
5647 icmp = fin->fin_dp;
5648
5649 icmp->icmp_id = nat->nat_nicmpid;
5650 }
5651
5652 csump = ipf_nat_proto(fin, nat, nflags);
5653
5654 /*
5655 * The above comments do not hold for layer 4 (or higher)
5656 * checksums...
5657 */
5658 if (csump != NULL) {
5659 if (nat->nat_dir == NAT_OUTBOUND)
5660 ipf_fix_incksum(0, csump, nat->nat_sumd[0], 0);
5661 else
5662 ipf_fix_outcksum(0, csump, nat->nat_sumd[0], 0);
5663 }
5664 }
5665
5666 fin->fin_flx |= FI_NATED;
5667 if (np != NULL && np->in_tag.ipt_num[0] != 0)
5668 fin->fin_nattag = &np->in_tag;
5669 return (1);
5670 }
5671
5672
5673 /* ------------------------------------------------------------------------ */
5674 /* Function: ipf_nat_proto */
5675 /* Returns: u_short* - pointer to transport header checksum to update, */
5676 /* NULL if the transport protocol is not recognised */
5677 /* as needing a checksum update. */
5678 /* Parameters: fin(I) - pointer to packet information */
5679 /* nat(I) - pointer to NAT structure */
5680 /* nflags(I) - NAT flags set for this packet */
5681 /* */
5682 /* Return the pointer to the checksum field for each protocol so understood.*/
5683 /* If support for making other changes to a protocol header is required, */
5684 /* that is not strictly 'address' translation, such as clamping the MSS in */
5685 /* TCP down to a specific value, then do it from here. */
5686 /* ------------------------------------------------------------------------ */
5687 u_short *
ipf_nat_proto(fr_info_t * fin,nat_t * nat,u_int nflags)5688 ipf_nat_proto(fr_info_t *fin, nat_t *nat, u_int nflags)
5689 {
5690 icmphdr_t *icmp;
5691 u_short *csump;
5692 tcphdr_t *tcp;
5693 udphdr_t *udp;
5694
5695 csump = NULL;
5696 if (fin->fin_out == 0) {
5697 fin->fin_rev = (nat->nat_dir & NAT_OUTBOUND);
5698 } else {
5699 fin->fin_rev = ((nat->nat_dir & NAT_OUTBOUND) == 0);
5700 }
5701
5702 switch (fin->fin_p)
5703 {
5704 case IPPROTO_TCP :
5705 tcp = fin->fin_dp;
5706
5707 if ((nflags & IPN_TCP) != 0)
5708 csump = &tcp->th_sum;
5709
5710 /*
5711 * Do a MSS CLAMPING on a SYN packet,
5712 * only deal IPv4 for now.
5713 */
5714 if ((nat->nat_mssclamp != 0) && (tcp_get_flags(tcp) & TH_SYN) != 0)
5715 ipf_nat_mssclamp(tcp, nat->nat_mssclamp, fin, csump);
5716
5717 break;
5718
5719 case IPPROTO_UDP :
5720 udp = fin->fin_dp;
5721
5722 if ((nflags & IPN_UDP) != 0) {
5723 if (udp->uh_sum != 0)
5724 csump = &udp->uh_sum;
5725 }
5726 break;
5727
5728 case IPPROTO_ICMP :
5729 icmp = fin->fin_dp;
5730
5731 if ((nflags & IPN_ICMPQUERY) != 0) {
5732 if (icmp->icmp_cksum != 0)
5733 csump = &icmp->icmp_cksum;
5734 }
5735 break;
5736
5737 #ifdef USE_INET6
5738 case IPPROTO_ICMPV6 :
5739 {
5740 struct icmp6_hdr *icmp6 = (struct icmp6_hdr *)fin->fin_dp;
5741
5742 icmp6 = fin->fin_dp;
5743
5744 if ((nflags & IPN_ICMPQUERY) != 0) {
5745 if (icmp6->icmp6_cksum != 0)
5746 csump = &icmp6->icmp6_cksum;
5747 }
5748 break;
5749 }
5750 #endif
5751 }
5752 return (csump);
5753 }
5754
5755
5756 /* ------------------------------------------------------------------------ */
5757 /* Function: ipf_nat_expire */
5758 /* Returns: Nil */
5759 /* Parameters: softc(I) - pointer to soft context main structure */
5760 /* */
5761 /* Check all of the timeout queues for entries at the top which need to be */
5762 /* expired. */
5763 /* ------------------------------------------------------------------------ */
5764 void
ipf_nat_expire(ipf_main_softc_t * softc)5765 ipf_nat_expire(ipf_main_softc_t *softc)
5766 {
5767 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5768 ipftq_t *ifq, *ifqnext;
5769 ipftqent_t *tqe, *tqn;
5770 int i;
5771 SPL_INT(s);
5772
5773 SPL_NET(s);
5774 WRITE_ENTER(&softc->ipf_nat);
5775 for (ifq = softn->ipf_nat_tcptq, i = 0; ifq != NULL;
5776 ifq = ifq->ifq_next) {
5777 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
5778 if (tqe->tqe_die > softc->ipf_ticks)
5779 break;
5780 tqn = tqe->tqe_next;
5781 ipf_nat_delete(softc, tqe->tqe_parent, NL_EXPIRE);
5782 }
5783 }
5784
5785 for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifq->ifq_next) {
5786 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
5787 if (tqe->tqe_die > softc->ipf_ticks)
5788 break;
5789 tqn = tqe->tqe_next;
5790 ipf_nat_delete(softc, tqe->tqe_parent, NL_EXPIRE);
5791 }
5792 }
5793
5794 for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifqnext) {
5795 ifqnext = ifq->ifq_next;
5796
5797 if (((ifq->ifq_flags & IFQF_DELETE) != 0) &&
5798 (ifq->ifq_ref == 0)) {
5799 ipf_freetimeoutqueue(softc, ifq);
5800 }
5801 }
5802
5803 if (softn->ipf_nat_doflush != 0) {
5804 ipf_nat_extraflush(softc, softn, 2);
5805 softn->ipf_nat_doflush = 0;
5806 }
5807
5808 RWLOCK_EXIT(&softc->ipf_nat);
5809 SPL_X(s);
5810 }
5811
5812
5813 /* ------------------------------------------------------------------------ */
5814 /* Function: ipf_nat_sync */
5815 /* Returns: Nil */
5816 /* Parameters: softc(I) - pointer to soft context main structure */
5817 /* ifp(I) - pointer to network interface */
5818 /* */
5819 /* Walk through all of the currently active NAT sessions, looking for those */
5820 /* which need to have their translated address updated. */
5821 /* ------------------------------------------------------------------------ */
5822 void
ipf_nat_sync(ipf_main_softc_t * softc,void * ifp)5823 ipf_nat_sync(ipf_main_softc_t *softc, void *ifp)
5824 {
5825 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5826 u_32_t sum1, sum2, sumd;
5827 i6addr_t in;
5828 ipnat_t *n;
5829 nat_t *nat;
5830 void *ifp2;
5831 int idx;
5832 SPL_INT(s);
5833
5834 if (softc->ipf_running <= 0)
5835 return;
5836
5837 /*
5838 * Change IP addresses for NAT sessions for any protocol except TCP
5839 * since it will break the TCP connection anyway. The only rules
5840 * which will get changed are those which are "map ... -> 0/32",
5841 * where the rule specifies the address is taken from the interface.
5842 */
5843 SPL_NET(s);
5844 WRITE_ENTER(&softc->ipf_nat);
5845
5846 if (softc->ipf_running <= 0) {
5847 RWLOCK_EXIT(&softc->ipf_nat);
5848 return;
5849 }
5850
5851 for (nat = softn->ipf_nat_instances; nat; nat = nat->nat_next) {
5852 if ((nat->nat_flags & IPN_TCP) != 0)
5853 continue;
5854
5855 n = nat->nat_ptr;
5856 if (n != NULL) {
5857 if (n->in_v[1] == 4) {
5858 if (n->in_redir & NAT_MAP) {
5859 if ((n->in_nsrcaddr != 0) ||
5860 (n->in_nsrcmsk != 0xffffffff))
5861 continue;
5862 } else if (n->in_redir & NAT_REDIRECT) {
5863 if ((n->in_ndstaddr != 0) ||
5864 (n->in_ndstmsk != 0xffffffff))
5865 continue;
5866 }
5867 }
5868 #ifdef USE_INET6
5869 if (n->in_v[1] == 4) {
5870 if (n->in_redir & NAT_MAP) {
5871 if (!IP6_ISZERO(&n->in_nsrcaddr) ||
5872 !IP6_ISONES(&n->in_nsrcmsk))
5873 continue;
5874 } else if (n->in_redir & NAT_REDIRECT) {
5875 if (!IP6_ISZERO(&n->in_ndstaddr) ||
5876 !IP6_ISONES(&n->in_ndstmsk))
5877 continue;
5878 }
5879 }
5880 #endif
5881 }
5882
5883 if (((ifp == NULL) || (ifp == nat->nat_ifps[0]) ||
5884 (ifp == nat->nat_ifps[1]))) {
5885 nat->nat_ifps[0] = GETIFP(nat->nat_ifnames[0],
5886 nat->nat_v[0]);
5887 if ((nat->nat_ifps[0] != NULL) &&
5888 (nat->nat_ifps[0] != (void *)-1)) {
5889 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
5890 }
5891 if (nat->nat_ifnames[1][0] != '\0') {
5892 nat->nat_ifps[1] = GETIFP(nat->nat_ifnames[1],
5893 nat->nat_v[1]);
5894 } else {
5895 nat->nat_ifps[1] = nat->nat_ifps[0];
5896 }
5897 if ((nat->nat_ifps[1] != NULL) &&
5898 (nat->nat_ifps[1] != (void *)-1)) {
5899 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
5900 }
5901 ifp2 = nat->nat_ifps[0];
5902 if (ifp2 == NULL)
5903 continue;
5904
5905 /*
5906 * Change the map-to address to be the same as the
5907 * new one.
5908 */
5909 sum1 = NATFSUM(nat, nat->nat_v[1], nat_nsrc6);
5910 if (ipf_ifpaddr(softc, nat->nat_v[0], FRI_NORMAL, ifp2,
5911 &in, NULL) != -1) {
5912 if (nat->nat_v[0] == 4)
5913 nat->nat_nsrcip = in.in4;
5914 }
5915 sum2 = NATFSUM(nat, nat->nat_v[1], nat_nsrc6);
5916
5917 if (sum1 == sum2)
5918 continue;
5919 /*
5920 * Readjust the checksum adjustment to take into
5921 * account the new IP#.
5922 */
5923 CALC_SUMD(sum1, sum2, sumd);
5924 /* XXX - dont change for TCP when solaris does
5925 * hardware checksumming.
5926 */
5927 sumd += nat->nat_sumd[0];
5928 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
5929 nat->nat_sumd[1] = nat->nat_sumd[0];
5930 }
5931 }
5932
5933 for (n = softn->ipf_nat_list; (n != NULL); n = n->in_next) {
5934 char *base = n->in_names;
5935
5936 if ((ifp == NULL) || (n->in_ifps[0] == ifp))
5937 n->in_ifps[0] = ipf_resolvenic(softc,
5938 base + n->in_ifnames[0],
5939 n->in_v[0]);
5940 if ((ifp == NULL) || (n->in_ifps[1] == ifp))
5941 n->in_ifps[1] = ipf_resolvenic(softc,
5942 base + n->in_ifnames[1],
5943 n->in_v[1]);
5944
5945 if (n->in_redir & NAT_REDIRECT)
5946 idx = 1;
5947 else
5948 idx = 0;
5949
5950 if (((ifp == NULL) || (n->in_ifps[idx] == ifp)) &&
5951 (n->in_ifps[idx] != NULL &&
5952 n->in_ifps[idx] != (void *)-1)) {
5953
5954 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_osrc,
5955 0, n->in_ifps[idx]);
5956 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_odst,
5957 0, n->in_ifps[idx]);
5958 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_nsrc,
5959 0, n->in_ifps[idx]);
5960 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_ndst,
5961 0, n->in_ifps[idx]);
5962 }
5963 }
5964 RWLOCK_EXIT(&softc->ipf_nat);
5965 SPL_X(s);
5966 }
5967
5968
5969 /* ------------------------------------------------------------------------ */
5970 /* Function: ipf_nat_icmpquerytype */
5971 /* Returns: int - 1 == success, 0 == failure */
5972 /* Parameters: icmptype(I) - ICMP type number */
5973 /* */
5974 /* Tests to see if the ICMP type number passed is a query/response type or */
5975 /* not. */
5976 /* ------------------------------------------------------------------------ */
5977 static int
ipf_nat_icmpquerytype(int icmptype)5978 ipf_nat_icmpquerytype(int icmptype)
5979 {
5980
5981 /*
5982 * For the ICMP query NAT code, it is essential that both the query
5983 * and the reply match on the NAT rule. Because the NAT structure
5984 * does not keep track of the icmptype, and a single NAT structure
5985 * is used for all icmp types with the same src, dest and id, we
5986 * simply define the replies as queries as well. The funny thing is,
5987 * altough it seems silly to call a reply a query, this is exactly
5988 * as it is defined in the IPv4 specification
5989 */
5990 switch (icmptype)
5991 {
5992 case ICMP_ECHOREPLY:
5993 case ICMP_ECHO:
5994 /* route advertisement/solicitation is currently unsupported: */
5995 /* it would require rewriting the ICMP data section */
5996 case ICMP_TSTAMP:
5997 case ICMP_TSTAMPREPLY:
5998 case ICMP_IREQ:
5999 case ICMP_IREQREPLY:
6000 case ICMP_MASKREQ:
6001 case ICMP_MASKREPLY:
6002 return (1);
6003 default:
6004 return (0);
6005 }
6006 }
6007
6008
6009 /* ------------------------------------------------------------------------ */
6010 /* Function: nat_log */
6011 /* Returns: Nil */
6012 /* Parameters: softc(I) - pointer to soft context main structure */
6013 /* softn(I) - pointer to NAT context structure */
6014 /* nat(I) - pointer to NAT structure */
6015 /* action(I) - action related to NAT structure being performed */
6016 /* */
6017 /* Creates a NAT log entry. */
6018 /* ------------------------------------------------------------------------ */
6019 void
ipf_nat_log(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,struct nat * nat,u_int action)6020 ipf_nat_log(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, struct nat *nat,
6021 u_int action)
6022 {
6023 #ifdef IPFILTER_LOG
6024 struct ipnat *np;
6025 int rulen;
6026 struct natlog natl;
6027 void *items[1];
6028 size_t sizes[1];
6029 int types[1];
6030
6031 bcopy((char *)&nat->nat_osrc6, (char *)&natl.nl_osrcip,
6032 sizeof(natl.nl_osrcip));
6033 bcopy((char *)&nat->nat_nsrc6, (char *)&natl.nl_nsrcip,
6034 sizeof(natl.nl_nsrcip));
6035 bcopy((char *)&nat->nat_odst6, (char *)&natl.nl_odstip,
6036 sizeof(natl.nl_odstip));
6037 bcopy((char *)&nat->nat_ndst6, (char *)&natl.nl_ndstip,
6038 sizeof(natl.nl_ndstip));
6039
6040 natl.nl_bytes[0] = nat->nat_bytes[0];
6041 natl.nl_bytes[1] = nat->nat_bytes[1];
6042 natl.nl_pkts[0] = nat->nat_pkts[0];
6043 natl.nl_pkts[1] = nat->nat_pkts[1];
6044 natl.nl_odstport = nat->nat_odport;
6045 natl.nl_osrcport = nat->nat_osport;
6046 natl.nl_nsrcport = nat->nat_nsport;
6047 natl.nl_ndstport = nat->nat_ndport;
6048 natl.nl_p[0] = nat->nat_pr[0];
6049 natl.nl_p[1] = nat->nat_pr[1];
6050 natl.nl_v[0] = nat->nat_v[0];
6051 natl.nl_v[1] = nat->nat_v[1];
6052 natl.nl_type = nat->nat_redir;
6053 natl.nl_action = action;
6054 natl.nl_rule = -1;
6055
6056 bcopy(nat->nat_ifnames[0], natl.nl_ifnames[0],
6057 sizeof(nat->nat_ifnames[0]));
6058 bcopy(nat->nat_ifnames[1], natl.nl_ifnames[1],
6059 sizeof(nat->nat_ifnames[1]));
6060
6061 if (softc->ipf_large_nat && nat->nat_ptr != NULL) {
6062 for (rulen = 0, np = softn->ipf_nat_list; np != NULL;
6063 np = np->in_next, rulen++)
6064 if (np == nat->nat_ptr) {
6065 natl.nl_rule = rulen;
6066 break;
6067 }
6068 }
6069 items[0] = &natl;
6070 sizes[0] = sizeof(natl);
6071 types[0] = 0;
6072
6073 (void) ipf_log_items(softc, IPL_LOGNAT, NULL, items, sizes, types, 1);
6074 #endif
6075 }
6076
6077
6078
6079
6080 /* ------------------------------------------------------------------------ */
6081 /* Function: ipf_nat_rule_deref */
6082 /* Returns: Nil */
6083 /* Parameters: softc(I) - pointer to soft context main structure */
6084 /* inp(I) - pointer to pointer to NAT rule */
6085 /* Write Locks: ipf_nat */
6086 /* */
6087 /* Dropping the refernce count for a rule means that whatever held the */
6088 /* pointer to this rule (*inp) is no longer interested in it and when the */
6089 /* reference count drops to zero, any resources allocated for the rule can */
6090 /* be released and the rule itself free'd. */
6091 /* ------------------------------------------------------------------------ */
6092 void
ipf_nat_rule_deref(ipf_main_softc_t * softc,ipnat_t ** inp)6093 ipf_nat_rule_deref(ipf_main_softc_t *softc, ipnat_t **inp)
6094 {
6095 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6096 ipnat_t *n;
6097
6098 n = *inp;
6099 *inp = NULL;
6100 n->in_use--;
6101 if (n->in_use > 0)
6102 return;
6103
6104 if (n->in_apr != NULL)
6105 ipf_proxy_deref(n->in_apr);
6106
6107 ipf_nat_rule_fini(softc, n);
6108
6109 if (n->in_redir & NAT_REDIRECT) {
6110 if ((n->in_flags & IPN_PROXYRULE) == 0) {
6111 ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules_rdr);
6112 }
6113 }
6114 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
6115 if ((n->in_flags & IPN_PROXYRULE) == 0) {
6116 ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules_map);
6117 }
6118 }
6119
6120 if (n->in_tqehead[0] != NULL) {
6121 if (ipf_deletetimeoutqueue(n->in_tqehead[0]) == 0) {
6122 ipf_freetimeoutqueue(softc, n->in_tqehead[0]);
6123 }
6124 }
6125
6126 if (n->in_tqehead[1] != NULL) {
6127 if (ipf_deletetimeoutqueue(n->in_tqehead[1]) == 0) {
6128 ipf_freetimeoutqueue(softc, n->in_tqehead[1]);
6129 }
6130 }
6131
6132 if ((n->in_flags & IPN_PROXYRULE) == 0) {
6133 ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules);
6134 }
6135
6136 MUTEX_DESTROY(&n->in_lock);
6137
6138 KFREES(n, n->in_size);
6139
6140 #if SOLARIS && !defined(INSTANCES)
6141 if (softn->ipf_nat_stats.ns_rules == 0)
6142 pfil_delayed_copy = 1;
6143 #endif
6144 }
6145
6146
6147 /* ------------------------------------------------------------------------ */
6148 /* Function: ipf_nat_deref */
6149 /* Returns: Nil */
6150 /* Parameters: softc(I) - pointer to soft context main structure */
6151 /* natp(I) - pointer to pointer to NAT table entry */
6152 /* */
6153 /* Decrement the reference counter for this NAT table entry and free it if */
6154 /* there are no more things using it. */
6155 /* */
6156 /* IF nat_ref == 1 when this function is called, then we have an orphan nat */
6157 /* structure *because* it only gets called on paths _after_ nat_ref has been*/
6158 /* incremented. If nat_ref == 1 then we shouldn't decrement it here */
6159 /* because nat_delete() will do that and send nat_ref to -1. */
6160 /* */
6161 /* Holding the lock on nat_lock is required to serialise nat_delete() being */
6162 /* called from a NAT flush ioctl with a deref happening because of a packet.*/
6163 /* ------------------------------------------------------------------------ */
6164 void
ipf_nat_deref(ipf_main_softc_t * softc,nat_t ** natp)6165 ipf_nat_deref(ipf_main_softc_t *softc, nat_t **natp)
6166 {
6167 nat_t *nat;
6168
6169 nat = *natp;
6170 *natp = NULL;
6171
6172 MUTEX_ENTER(&nat->nat_lock);
6173 if (nat->nat_ref > 1) {
6174 nat->nat_ref--;
6175 ASSERT(nat->nat_ref >= 0);
6176 MUTEX_EXIT(&nat->nat_lock);
6177 return;
6178 }
6179 MUTEX_EXIT(&nat->nat_lock);
6180
6181 WRITE_ENTER(&softc->ipf_nat);
6182 ipf_nat_delete(softc, nat, NL_EXPIRE);
6183 RWLOCK_EXIT(&softc->ipf_nat);
6184 }
6185
6186
6187 /* ------------------------------------------------------------------------ */
6188 /* Function: ipf_nat_clone */
6189 /* Returns: ipstate_t* - NULL == cloning failed, */
6190 /* else pointer to new state structure */
6191 /* Parameters: fin(I) - pointer to packet information */
6192 /* is(I) - pointer to master state structure */
6193 /* Write Lock: ipf_nat */
6194 /* */
6195 /* Create a "duplcate" state table entry from the master. */
6196 /* ------------------------------------------------------------------------ */
6197 nat_t *
ipf_nat_clone(fr_info_t * fin,nat_t * nat)6198 ipf_nat_clone(fr_info_t *fin, nat_t *nat)
6199 {
6200 ipf_main_softc_t *softc = fin->fin_main_soft;
6201 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6202 frentry_t *fr;
6203 nat_t *clone;
6204 ipnat_t *np;
6205
6206 KMALLOC(clone, nat_t *);
6207 if (clone == NULL) {
6208 NBUMPSIDED(fin->fin_out, ns_clone_nomem);
6209 return (NULL);
6210 }
6211 bcopy((char *)nat, (char *)clone, sizeof(*clone));
6212
6213 MUTEX_NUKE(&clone->nat_lock);
6214
6215 clone->nat_rev = fin->fin_rev;
6216 clone->nat_aps = NULL;
6217 /*
6218 * Initialize all these so that ipf_nat_delete() doesn't cause a crash.
6219 */
6220 clone->nat_tqe.tqe_pnext = NULL;
6221 clone->nat_tqe.tqe_next = NULL;
6222 clone->nat_tqe.tqe_ifq = NULL;
6223 clone->nat_tqe.tqe_parent = clone;
6224
6225 clone->nat_flags &= ~SI_CLONE;
6226 clone->nat_flags |= SI_CLONED;
6227
6228 if (clone->nat_hm)
6229 clone->nat_hm->hm_ref++;
6230
6231 if (ipf_nat_insert(softc, softn, clone) == -1) {
6232 KFREE(clone);
6233 NBUMPSIDED(fin->fin_out, ns_insert_fail);
6234 return (NULL);
6235 }
6236
6237 np = clone->nat_ptr;
6238 if (np != NULL) {
6239 if (softn->ipf_nat_logging)
6240 ipf_nat_log(softc, softn, clone, NL_CLONE);
6241 np->in_use++;
6242 }
6243 fr = clone->nat_fr;
6244 if (fr != NULL) {
6245 MUTEX_ENTER(&fr->fr_lock);
6246 fr->fr_ref++;
6247 MUTEX_EXIT(&fr->fr_lock);
6248 }
6249
6250
6251 /*
6252 * Because the clone is created outside the normal loop of things and
6253 * TCP has special needs in terms of state, initialise the timeout
6254 * state of the new NAT from here.
6255 */
6256 if (clone->nat_pr[0] == IPPROTO_TCP) {
6257 (void) ipf_tcp_age(&clone->nat_tqe, fin, softn->ipf_nat_tcptq,
6258 clone->nat_flags, 2);
6259 }
6260 clone->nat_sync = ipf_sync_new(softc, SMC_NAT, fin, clone);
6261 if (softn->ipf_nat_logging)
6262 ipf_nat_log(softc, softn, clone, NL_CLONE);
6263 return (clone);
6264 }
6265
6266
6267 /* ------------------------------------------------------------------------ */
6268 /* Function: ipf_nat_wildok */
6269 /* Returns: int - 1 == packet's ports match wildcards */
6270 /* 0 == packet's ports don't match wildcards */
6271 /* Parameters: nat(I) - NAT entry */
6272 /* sport(I) - source port */
6273 /* dport(I) - destination port */
6274 /* flags(I) - wildcard flags */
6275 /* dir(I) - packet direction */
6276 /* */
6277 /* Use NAT entry and packet direction to determine which combination of */
6278 /* wildcard flags should be used. */
6279 /* ------------------------------------------------------------------------ */
6280 int
ipf_nat_wildok(nat_t * nat,int sport,int dport,int flags,int dir)6281 ipf_nat_wildok(nat_t *nat, int sport, int dport, int flags, int dir)
6282 {
6283 /*
6284 * When called by dir is set to
6285 * nat_inlookup NAT_INBOUND (0)
6286 * nat_outlookup NAT_OUTBOUND (1)
6287 *
6288 * We simply combine the packet's direction in dir with the original
6289 * "intended" direction of that NAT entry in nat->nat_dir to decide
6290 * which combination of wildcard flags to allow.
6291 */
6292 switch ((dir << 1) | (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND)))
6293 {
6294 case 3: /* outbound packet / outbound entry */
6295 if (((nat->nat_osport == sport) ||
6296 (flags & SI_W_SPORT)) &&
6297 ((nat->nat_odport == dport) ||
6298 (flags & SI_W_DPORT)))
6299 return (1);
6300 break;
6301 case 2: /* outbound packet / inbound entry */
6302 if (((nat->nat_osport == dport) ||
6303 (flags & SI_W_SPORT)) &&
6304 ((nat->nat_odport == sport) ||
6305 (flags & SI_W_DPORT)))
6306 return (1);
6307 break;
6308 case 1: /* inbound packet / outbound entry */
6309 if (((nat->nat_osport == dport) ||
6310 (flags & SI_W_SPORT)) &&
6311 ((nat->nat_odport == sport) ||
6312 (flags & SI_W_DPORT)))
6313 return (1);
6314 break;
6315 case 0: /* inbound packet / inbound entry */
6316 if (((nat->nat_osport == sport) ||
6317 (flags & SI_W_SPORT)) &&
6318 ((nat->nat_odport == dport) ||
6319 (flags & SI_W_DPORT)))
6320 return (1);
6321 break;
6322 default:
6323 break;
6324 }
6325
6326 return (0);
6327 }
6328
6329
6330 /* ------------------------------------------------------------------------ */
6331 /* Function: nat_mssclamp */
6332 /* Returns: Nil */
6333 /* Parameters: tcp(I) - pointer to TCP header */
6334 /* maxmss(I) - value to clamp the TCP MSS to */
6335 /* fin(I) - pointer to packet information */
6336 /* csump(I) - pointer to TCP checksum */
6337 /* */
6338 /* Check for MSS option and clamp it if necessary. If found and changed, */
6339 /* then the TCP header checksum will be updated to reflect the change in */
6340 /* the MSS. */
6341 /* ------------------------------------------------------------------------ */
6342 static void
ipf_nat_mssclamp(tcphdr_t * tcp,u_32_t maxmss,fr_info_t * fin,u_short * csump)6343 ipf_nat_mssclamp(tcphdr_t *tcp, u_32_t maxmss, fr_info_t *fin, u_short *csump)
6344 {
6345 u_char *cp, *ep, opt;
6346 int hlen, advance;
6347 u_32_t mss, sumd;
6348
6349 hlen = TCP_OFF(tcp) << 2;
6350 if (hlen > sizeof(*tcp)) {
6351 cp = (u_char *)tcp + sizeof(*tcp);
6352 ep = (u_char *)tcp + hlen;
6353
6354 while (cp < ep) {
6355 opt = cp[0];
6356 if (opt == TCPOPT_EOL)
6357 break;
6358 else if (opt == TCPOPT_NOP) {
6359 cp++;
6360 continue;
6361 }
6362
6363 if (cp + 1 >= ep)
6364 break;
6365 advance = cp[1];
6366 if ((cp + advance > ep) || (advance <= 0))
6367 break;
6368 switch (opt)
6369 {
6370 case TCPOPT_MAXSEG:
6371 if (advance != 4)
6372 break;
6373 mss = cp[2] * 256 + cp[3];
6374 if (mss > maxmss) {
6375 cp[2] = maxmss / 256;
6376 cp[3] = maxmss & 0xff;
6377 CALC_SUMD(mss, maxmss, sumd);
6378 ipf_fix_outcksum(0, csump, sumd, 0);
6379 }
6380 break;
6381 default:
6382 /* ignore unknown options */
6383 break;
6384 }
6385
6386 cp += advance;
6387 }
6388 }
6389 }
6390
6391
6392 /* ------------------------------------------------------------------------ */
6393 /* Function: ipf_nat_setqueue */
6394 /* Returns: Nil */
6395 /* Parameters: softc(I) - pointer to soft context main structure */
6396 /* softn(I) - pointer to NAT context structure */
6397 /* nat(I)- pointer to NAT structure */
6398 /* Locks: ipf_nat (read or write) */
6399 /* */
6400 /* Put the NAT entry on its default queue entry, using rev as a helped in */
6401 /* determining which queue it should be placed on. */
6402 /* ------------------------------------------------------------------------ */
6403 void
ipf_nat_setqueue(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,nat_t * nat)6404 ipf_nat_setqueue(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, nat_t *nat)
6405 {
6406 ipftq_t *oifq, *nifq;
6407 int rev = nat->nat_rev;
6408
6409 if (nat->nat_ptr != NULL)
6410 nifq = nat->nat_ptr->in_tqehead[rev];
6411 else
6412 nifq = NULL;
6413
6414 if (nifq == NULL) {
6415 switch (nat->nat_pr[0])
6416 {
6417 case IPPROTO_UDP :
6418 nifq = &softn->ipf_nat_udptq;
6419 break;
6420 case IPPROTO_ICMP :
6421 nifq = &softn->ipf_nat_icmptq;
6422 break;
6423 case IPPROTO_TCP :
6424 nifq = softn->ipf_nat_tcptq +
6425 nat->nat_tqe.tqe_state[rev];
6426 break;
6427 default :
6428 nifq = &softn->ipf_nat_iptq;
6429 break;
6430 }
6431 }
6432
6433 oifq = nat->nat_tqe.tqe_ifq;
6434 /*
6435 * If it's currently on a timeout queue, move it from one queue to
6436 * another, else put it on the end of the newly determined queue.
6437 */
6438 if (oifq != NULL)
6439 ipf_movequeue(softc->ipf_ticks, &nat->nat_tqe, oifq, nifq);
6440 else
6441 ipf_queueappend(softc->ipf_ticks, &nat->nat_tqe, nifq, nat);
6442 return;
6443 }
6444
6445
6446 /* ------------------------------------------------------------------------ */
6447 /* Function: nat_getnext */
6448 /* Returns: int - 0 == ok, else error */
6449 /* Parameters: softc(I) - pointer to soft context main structure */
6450 /* t(I) - pointer to ipftoken structure */
6451 /* itp(I) - pointer to ipfgeniter_t structure */
6452 /* */
6453 /* Fetch the next nat/ipnat structure pointer from the linked list and */
6454 /* copy it out to the storage space pointed to by itp_data. The next item */
6455 /* in the list to look at is put back in the ipftoken struture. */
6456 /* ------------------------------------------------------------------------ */
6457 static int
ipf_nat_getnext(ipf_main_softc_t * softc,ipftoken_t * t,ipfgeniter_t * itp,ipfobj_t * objp)6458 ipf_nat_getnext(ipf_main_softc_t *softc, ipftoken_t *t, ipfgeniter_t *itp,
6459 ipfobj_t *objp)
6460 {
6461 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6462 hostmap_t *hm, *nexthm = NULL, zerohm;
6463 ipnat_t *ipn, *nextipnat = NULL, zeroipn;
6464 nat_t *nat, *nextnat = NULL, zeronat;
6465 int error = 0;
6466 void *nnext;
6467
6468 if (itp->igi_nitems != 1) {
6469 IPFERROR(60075);
6470 return (ENOSPC);
6471 }
6472
6473 READ_ENTER(&softc->ipf_nat);
6474
6475 switch (itp->igi_type)
6476 {
6477 case IPFGENITER_HOSTMAP :
6478 hm = t->ipt_data;
6479 if (hm == NULL) {
6480 nexthm = softn->ipf_hm_maplist;
6481 } else {
6482 nexthm = hm->hm_next;
6483 }
6484 if (nexthm != NULL) {
6485 ATOMIC_INC32(nexthm->hm_ref);
6486 t->ipt_data = nexthm;
6487 } else {
6488 bzero(&zerohm, sizeof(zerohm));
6489 nexthm = &zerohm;
6490 t->ipt_data = NULL;
6491 }
6492 nnext = nexthm->hm_next;
6493 break;
6494
6495 case IPFGENITER_IPNAT :
6496 ipn = t->ipt_data;
6497 if (ipn == NULL) {
6498 nextipnat = softn->ipf_nat_list;
6499 } else {
6500 nextipnat = ipn->in_next;
6501 }
6502 if (nextipnat != NULL) {
6503 ATOMIC_INC32(nextipnat->in_use);
6504 t->ipt_data = nextipnat;
6505 } else {
6506 bzero(&zeroipn, sizeof(zeroipn));
6507 nextipnat = &zeroipn;
6508 t->ipt_data = NULL;
6509 }
6510 nnext = nextipnat->in_next;
6511 break;
6512
6513 case IPFGENITER_NAT :
6514 nat = t->ipt_data;
6515 if (nat == NULL) {
6516 nextnat = softn->ipf_nat_instances;
6517 } else {
6518 nextnat = nat->nat_next;
6519 }
6520 if (nextnat != NULL) {
6521 MUTEX_ENTER(&nextnat->nat_lock);
6522 nextnat->nat_ref++;
6523 MUTEX_EXIT(&nextnat->nat_lock);
6524 t->ipt_data = nextnat;
6525 } else {
6526 bzero(&zeronat, sizeof(zeronat));
6527 nextnat = &zeronat;
6528 t->ipt_data = NULL;
6529 }
6530 nnext = nextnat->nat_next;
6531 break;
6532
6533 default :
6534 RWLOCK_EXIT(&softc->ipf_nat);
6535 IPFERROR(60055);
6536 return (EINVAL);
6537 }
6538
6539 RWLOCK_EXIT(&softc->ipf_nat);
6540
6541 objp->ipfo_ptr = itp->igi_data;
6542
6543 switch (itp->igi_type)
6544 {
6545 case IPFGENITER_HOSTMAP :
6546 error = COPYOUT(nexthm, objp->ipfo_ptr, sizeof(*nexthm));
6547 if (error != 0) {
6548 IPFERROR(60049);
6549 error = EFAULT;
6550 }
6551 if (hm != NULL) {
6552 WRITE_ENTER(&softc->ipf_nat);
6553 ipf_nat_hostmapdel(softc, &hm);
6554 RWLOCK_EXIT(&softc->ipf_nat);
6555 }
6556 break;
6557
6558 case IPFGENITER_IPNAT :
6559 objp->ipfo_size = nextipnat->in_size;
6560 objp->ipfo_type = IPFOBJ_IPNAT;
6561 error = ipf_outobjk(softc, objp, nextipnat);
6562 if (ipn != NULL) {
6563 WRITE_ENTER(&softc->ipf_nat);
6564 ipf_nat_rule_deref(softc, &ipn);
6565 RWLOCK_EXIT(&softc->ipf_nat);
6566 }
6567 break;
6568
6569 case IPFGENITER_NAT :
6570 objp->ipfo_size = sizeof(nat_t);
6571 objp->ipfo_type = IPFOBJ_NAT;
6572 error = ipf_outobjk(softc, objp, nextnat);
6573 if (nat != NULL)
6574 ipf_nat_deref(softc, &nat);
6575
6576 break;
6577 }
6578
6579 if (nnext == NULL)
6580 ipf_token_mark_complete(t);
6581
6582 return (error);
6583 }
6584
6585
6586 /* ------------------------------------------------------------------------ */
6587 /* Function: nat_extraflush */
6588 /* Returns: int - 0 == success, -1 == failure */
6589 /* Parameters: softc(I) - pointer to soft context main structure */
6590 /* softn(I) - pointer to NAT context structure */
6591 /* which(I) - how to flush the active NAT table */
6592 /* Write Locks: ipf_nat */
6593 /* */
6594 /* Flush nat tables. Three actions currently defined: */
6595 /* which == 0 : flush all nat table entries */
6596 /* which == 1 : flush TCP connections which have started to close but are */
6597 /* stuck for some reason. */
6598 /* which == 2 : flush TCP connections which have been idle for a long time, */
6599 /* starting at > 4 days idle and working back in successive half-*/
6600 /* days to at most 12 hours old. If this fails to free enough */
6601 /* slots then work backwards in half hour slots to 30 minutes. */
6602 /* If that too fails, then work backwards in 30 second intervals */
6603 /* for the last 30 minutes to at worst 30 seconds idle. */
6604 /* ------------------------------------------------------------------------ */
6605 static int
ipf_nat_extraflush(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,int which)6606 ipf_nat_extraflush(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, int which)
6607 {
6608 nat_t *nat, **natp;
6609 ipftqent_t *tqn;
6610 ipftq_t *ifq;
6611 int removed;
6612 SPL_INT(s);
6613
6614 removed = 0;
6615
6616 SPL_NET(s);
6617 switch (which)
6618 {
6619 case 0 :
6620 softn->ipf_nat_stats.ns_flush_all++;
6621 /*
6622 * Style 0 flush removes everything...
6623 */
6624 for (natp = &softn->ipf_nat_instances;
6625 ((nat = *natp) != NULL); ) {
6626 ipf_nat_delete(softc, nat, NL_FLUSH);
6627 removed++;
6628 }
6629 break;
6630
6631 case 1 :
6632 softn->ipf_nat_stats.ns_flush_closing++;
6633 /*
6634 * Since we're only interested in things that are closing,
6635 * we can start with the appropriate timeout queue.
6636 */
6637 for (ifq = softn->ipf_nat_tcptq + IPF_TCPS_CLOSE_WAIT;
6638 ifq != NULL; ifq = ifq->ifq_next) {
6639
6640 for (tqn = ifq->ifq_head; tqn != NULL; ) {
6641 nat = tqn->tqe_parent;
6642 tqn = tqn->tqe_next;
6643 if (nat->nat_pr[0] != IPPROTO_TCP ||
6644 nat->nat_pr[1] != IPPROTO_TCP)
6645 break;
6646 ipf_nat_delete(softc, nat, NL_EXPIRE);
6647 removed++;
6648 }
6649 }
6650
6651 /*
6652 * Also need to look through the user defined queues.
6653 */
6654 for (ifq = softn->ipf_nat_utqe; ifq != NULL;
6655 ifq = ifq->ifq_next) {
6656 for (tqn = ifq->ifq_head; tqn != NULL; ) {
6657 nat = tqn->tqe_parent;
6658 tqn = tqn->tqe_next;
6659 if (nat->nat_pr[0] != IPPROTO_TCP ||
6660 nat->nat_pr[1] != IPPROTO_TCP)
6661 continue;
6662
6663 if ((nat->nat_tcpstate[0] >
6664 IPF_TCPS_ESTABLISHED) &&
6665 (nat->nat_tcpstate[1] >
6666 IPF_TCPS_ESTABLISHED)) {
6667 ipf_nat_delete(softc, nat, NL_EXPIRE);
6668 removed++;
6669 }
6670 }
6671 }
6672 break;
6673
6674 /*
6675 * Args 5-11 correspond to flushing those particular states
6676 * for TCP connections.
6677 */
6678 case IPF_TCPS_CLOSE_WAIT :
6679 case IPF_TCPS_FIN_WAIT_1 :
6680 case IPF_TCPS_CLOSING :
6681 case IPF_TCPS_LAST_ACK :
6682 case IPF_TCPS_FIN_WAIT_2 :
6683 case IPF_TCPS_TIME_WAIT :
6684 case IPF_TCPS_CLOSED :
6685 softn->ipf_nat_stats.ns_flush_state++;
6686 tqn = softn->ipf_nat_tcptq[which].ifq_head;
6687 while (tqn != NULL) {
6688 nat = tqn->tqe_parent;
6689 tqn = tqn->tqe_next;
6690 ipf_nat_delete(softc, nat, NL_FLUSH);
6691 removed++;
6692 }
6693 break;
6694
6695 default :
6696 if (which < 30)
6697 break;
6698
6699 softn->ipf_nat_stats.ns_flush_timeout++;
6700 /*
6701 * Take a large arbitrary number to mean the number of seconds
6702 * for which which consider to be the maximum value we'll allow
6703 * the expiration to be.
6704 */
6705 which = IPF_TTLVAL(which);
6706 for (natp = &softn->ipf_nat_instances;
6707 ((nat = *natp) != NULL); ) {
6708 if (softc->ipf_ticks - nat->nat_touched > which) {
6709 ipf_nat_delete(softc, nat, NL_FLUSH);
6710 removed++;
6711 } else
6712 natp = &nat->nat_next;
6713 }
6714 break;
6715 }
6716
6717 if (which != 2) {
6718 SPL_X(s);
6719 return (removed);
6720 }
6721
6722 softn->ipf_nat_stats.ns_flush_queue++;
6723
6724 /*
6725 * Asked to remove inactive entries because the table is full, try
6726 * again, 3 times, if first attempt failed with a different criteria
6727 * each time. The order tried in must be in decreasing age.
6728 * Another alternative is to implement random drop and drop N entries
6729 * at random until N have been freed up.
6730 */
6731 if (softc->ipf_ticks - softn->ipf_nat_last_force_flush >
6732 IPF_TTLVAL(5)) {
6733 softn->ipf_nat_last_force_flush = softc->ipf_ticks;
6734
6735 removed = ipf_queueflush(softc, ipf_nat_flush_entry,
6736 softn->ipf_nat_tcptq,
6737 softn->ipf_nat_utqe,
6738 &softn->ipf_nat_stats.ns_active,
6739 softn->ipf_nat_table_sz,
6740 softn->ipf_nat_table_wm_low);
6741 }
6742
6743 SPL_X(s);
6744 return (removed);
6745 }
6746
6747
6748 /* ------------------------------------------------------------------------ */
6749 /* Function: ipf_nat_flush_entry */
6750 /* Returns: 0 - always succeeds */
6751 /* Parameters: softc(I) - pointer to soft context main structure */
6752 /* entry(I) - pointer to NAT entry */
6753 /* Write Locks: ipf_nat */
6754 /* */
6755 /* This function is a stepping stone between ipf_queueflush() and */
6756 /* nat_dlete(). It is used so we can provide a uniform interface via the */
6757 /* ipf_queueflush() function. Since the nat_delete() function returns void */
6758 /* we translate that to mean it always succeeds in deleting something. */
6759 /* ------------------------------------------------------------------------ */
6760 static int
ipf_nat_flush_entry(ipf_main_softc_t * softc,void * entry)6761 ipf_nat_flush_entry(ipf_main_softc_t *softc, void *entry)
6762 {
6763 ipf_nat_delete(softc, entry, NL_FLUSH);
6764 return (0);
6765 }
6766
6767
6768 /* ------------------------------------------------------------------------ */
6769 /* Function: ipf_nat_iterator */
6770 /* Returns: int - 0 == ok, else error */
6771 /* Parameters: softc(I) - pointer to soft context main structure */
6772 /* token(I) - pointer to ipftoken structure */
6773 /* itp(I) - pointer to ipfgeniter_t structure */
6774 /* obj(I) - pointer to data description structure */
6775 /* */
6776 /* This function acts as a handler for the SIOCGENITER ioctls that use a */
6777 /* generic structure to iterate through a list. There are three different */
6778 /* linked lists of NAT related information to go through: NAT rules, active */
6779 /* NAT mappings and the NAT fragment cache. */
6780 /* ------------------------------------------------------------------------ */
6781 static int
ipf_nat_iterator(ipf_main_softc_t * softc,ipftoken_t * token,ipfgeniter_t * itp,ipfobj_t * obj)6782 ipf_nat_iterator(ipf_main_softc_t *softc, ipftoken_t *token, ipfgeniter_t *itp,
6783 ipfobj_t *obj)
6784 {
6785 int error;
6786
6787 if (itp->igi_data == NULL) {
6788 IPFERROR(60052);
6789 return (EFAULT);
6790 }
6791
6792 switch (itp->igi_type)
6793 {
6794 case IPFGENITER_HOSTMAP :
6795 case IPFGENITER_IPNAT :
6796 case IPFGENITER_NAT :
6797 error = ipf_nat_getnext(softc, token, itp, obj);
6798 break;
6799
6800 case IPFGENITER_NATFRAG :
6801 error = ipf_frag_nat_next(softc, token, itp);
6802 break;
6803 default :
6804 IPFERROR(60053);
6805 error = EINVAL;
6806 break;
6807 }
6808
6809 return (error);
6810 }
6811
6812
6813 /* ------------------------------------------------------------------------ */
6814 /* Function: ipf_nat_setpending */
6815 /* Returns: Nil */
6816 /* Parameters: softc(I) - pointer to soft context main structure */
6817 /* nat(I) - pointer to NAT structure */
6818 /* Locks: ipf_nat (read or write) */
6819 /* */
6820 /* Put the NAT entry on to the pending queue - this queue has a very short */
6821 /* lifetime where items are put that can't be deleted straight away because */
6822 /* of locking issues but we want to delete them ASAP, anyway. In calling */
6823 /* this function, it is assumed that the owner (if there is one, as shown */
6824 /* by nat_me) is no longer interested in it. */
6825 /* ------------------------------------------------------------------------ */
6826 void
ipf_nat_setpending(ipf_main_softc_t * softc,nat_t * nat)6827 ipf_nat_setpending(ipf_main_softc_t *softc, nat_t *nat)
6828 {
6829 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6830 ipftq_t *oifq;
6831
6832 oifq = nat->nat_tqe.tqe_ifq;
6833 if (oifq != NULL)
6834 ipf_movequeue(softc->ipf_ticks, &nat->nat_tqe, oifq,
6835 &softn->ipf_nat_pending);
6836 else
6837 ipf_queueappend(softc->ipf_ticks, &nat->nat_tqe,
6838 &softn->ipf_nat_pending, nat);
6839
6840 if (nat->nat_me != NULL) {
6841 *nat->nat_me = NULL;
6842 nat->nat_me = NULL;
6843 nat->nat_ref--;
6844 ASSERT(nat->nat_ref >= 0);
6845 }
6846 }
6847
6848
6849 /* ------------------------------------------------------------------------ */
6850 /* Function: nat_newrewrite */
6851 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */
6852 /* allow rule to be moved if IPN_ROUNDR is set. */
6853 /* Parameters: fin(I) - pointer to packet information */
6854 /* nat(I) - pointer to NAT entry */
6855 /* ni(I) - pointer to structure with misc. information needed */
6856 /* to create new NAT entry. */
6857 /* Write Lock: ipf_nat */
6858 /* */
6859 /* This function is responsible for setting up an active NAT session where */
6860 /* we are changing both the source and destination parameters at the same */
6861 /* time. The loop in here works differently to elsewhere - each iteration */
6862 /* is responsible for changing a single parameter that can be incremented. */
6863 /* So one pass may increase the source IP#, next source port, next dest. IP#*/
6864 /* and the last destination port for a total of 4 iterations to try each. */
6865 /* This is done to try and exhaustively use the translation space available.*/
6866 /* ------------------------------------------------------------------------ */
6867 static int
ipf_nat_newrewrite(fr_info_t * fin,nat_t * nat,natinfo_t * nai)6868 ipf_nat_newrewrite(fr_info_t *fin, nat_t *nat, natinfo_t *nai)
6869 {
6870 int src_search = 1;
6871 int dst_search = 1;
6872 fr_info_t frnat;
6873 u_32_t flags;
6874 u_short swap;
6875 ipnat_t *np;
6876 nat_t *natl;
6877 int l = 0;
6878 int changed;
6879
6880 natl = NULL;
6881 changed = -1;
6882 np = nai->nai_np;
6883 flags = nat->nat_flags;
6884 bcopy((char *)fin, (char *)&frnat, sizeof(*fin));
6885
6886 nat->nat_hm = NULL;
6887
6888 do {
6889 changed = -1;
6890 /* TRACE (l, src_search, dst_search, np) */
6891 DT4(ipf_nat_rewrite_1, int, l, int, src_search, int, dst_search, ipnat_t *, np);
6892
6893 if ((src_search == 0) && (np->in_spnext == 0) &&
6894 (dst_search == 0) && (np->in_dpnext == 0)) {
6895 if (l > 0)
6896 return (-1);
6897 }
6898
6899 /*
6900 * Find a new source address
6901 */
6902 if (ipf_nat_nextaddr(fin, &np->in_nsrc, &frnat.fin_saddr,
6903 &frnat.fin_saddr) == -1) {
6904 return (-1);
6905 }
6906
6907 if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0xffffffff)) {
6908 src_search = 0;
6909 if (np->in_stepnext == 0)
6910 np->in_stepnext = 1;
6911
6912 } else if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0)) {
6913 src_search = 0;
6914 if (np->in_stepnext == 0)
6915 np->in_stepnext = 1;
6916
6917 } else if (np->in_nsrcmsk == 0xffffffff) {
6918 src_search = 0;
6919 if (np->in_stepnext == 0)
6920 np->in_stepnext = 1;
6921
6922 } else if (np->in_nsrcmsk != 0xffffffff) {
6923 if (np->in_stepnext == 0 && changed == -1) {
6924 np->in_snip++;
6925 np->in_stepnext++;
6926 changed = 0;
6927 }
6928 }
6929
6930 if ((flags & IPN_TCPUDPICMP) != 0) {
6931 if (np->in_spnext != 0)
6932 frnat.fin_data[0] = np->in_spnext;
6933
6934 /*
6935 * Standard port translation. Select next port.
6936 */
6937 if ((flags & IPN_FIXEDSPORT) != 0) {
6938 np->in_stepnext = 2;
6939 } else if ((np->in_stepnext == 1) &&
6940 (changed == -1) && (natl != NULL)) {
6941 np->in_spnext++;
6942 np->in_stepnext++;
6943 changed = 1;
6944 if (np->in_spnext > np->in_spmax)
6945 np->in_spnext = np->in_spmin;
6946 }
6947 } else {
6948 np->in_stepnext = 2;
6949 }
6950 np->in_stepnext &= 0x3;
6951
6952 /*
6953 * Find a new destination address
6954 */
6955 /* TRACE (fin, np, l, frnat) */
6956 DT4(ipf_nat_rewrite_2, frinfo_t *, fin, ipnat_t *, np, int, l, frinfo_t *, &frnat);
6957
6958 if (ipf_nat_nextaddr(fin, &np->in_ndst, &frnat.fin_daddr,
6959 &frnat.fin_daddr) == -1)
6960 return (-1);
6961 if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0xffffffff)) {
6962 dst_search = 0;
6963 if (np->in_stepnext == 2)
6964 np->in_stepnext = 3;
6965
6966 } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0)) {
6967 dst_search = 0;
6968 if (np->in_stepnext == 2)
6969 np->in_stepnext = 3;
6970
6971 } else if (np->in_ndstmsk == 0xffffffff) {
6972 dst_search = 0;
6973 if (np->in_stepnext == 2)
6974 np->in_stepnext = 3;
6975
6976 } else if (np->in_ndstmsk != 0xffffffff) {
6977 if ((np->in_stepnext == 2) && (changed == -1) &&
6978 (natl != NULL)) {
6979 changed = 2;
6980 np->in_stepnext++;
6981 np->in_dnip++;
6982 }
6983 }
6984
6985 if ((flags & IPN_TCPUDPICMP) != 0) {
6986 if (np->in_dpnext != 0)
6987 frnat.fin_data[1] = np->in_dpnext;
6988
6989 /*
6990 * Standard port translation. Select next port.
6991 */
6992 if ((flags & IPN_FIXEDDPORT) != 0) {
6993 np->in_stepnext = 0;
6994 } else if (np->in_stepnext == 3 && changed == -1) {
6995 np->in_dpnext++;
6996 np->in_stepnext++;
6997 changed = 3;
6998 if (np->in_dpnext > np->in_dpmax)
6999 np->in_dpnext = np->in_dpmin;
7000 }
7001 } else {
7002 if (np->in_stepnext == 3)
7003 np->in_stepnext = 0;
7004 }
7005
7006 /* TRACE (frnat) */
7007 DT1(ipf_nat_rewrite_3, frinfo_t *, &frnat);
7008
7009 /*
7010 * Here we do a lookup of the connection as seen from
7011 * the outside. If an IP# pair already exists, try
7012 * again. So if you have A->B becomes C->B, you can
7013 * also have D->E become C->E but not D->B causing
7014 * another C->B. Also take protocol and ports into
7015 * account when determining whether a pre-existing
7016 * NAT setup will cause an external conflict where
7017 * this is appropriate.
7018 *
7019 * fin_data[] is swapped around because we are doing a
7020 * lookup of the packet is if it were moving in the opposite
7021 * direction of the one we are working with now.
7022 */
7023 if (flags & IPN_TCPUDP) {
7024 swap = frnat.fin_data[0];
7025 frnat.fin_data[0] = frnat.fin_data[1];
7026 frnat.fin_data[1] = swap;
7027 }
7028 if (fin->fin_out == 1) {
7029 natl = ipf_nat_inlookup(&frnat,
7030 flags & ~(SI_WILDP|NAT_SEARCH),
7031 (u_int)frnat.fin_p,
7032 frnat.fin_dst, frnat.fin_src);
7033
7034 } else {
7035 natl = ipf_nat_outlookup(&frnat,
7036 flags & ~(SI_WILDP|NAT_SEARCH),
7037 (u_int)frnat.fin_p,
7038 frnat.fin_dst, frnat.fin_src);
7039 }
7040 if (flags & IPN_TCPUDP) {
7041 swap = frnat.fin_data[0];
7042 frnat.fin_data[0] = frnat.fin_data[1];
7043 frnat.fin_data[1] = swap;
7044 }
7045
7046 /* TRACE natl, in_stepnext, l */
7047 DT3(ipf_nat_rewrite_2, nat_t *, natl, ipnat_t *, np , int, l);
7048
7049 if ((natl != NULL) && (l > 8)) /* XXX 8 is arbitrary */
7050 return (-1);
7051
7052 np->in_stepnext &= 0x3;
7053
7054 l++;
7055 changed = -1;
7056 } while (natl != NULL);
7057
7058 nat->nat_osrcip = fin->fin_src;
7059 nat->nat_odstip = fin->fin_dst;
7060 nat->nat_nsrcip = frnat.fin_src;
7061 nat->nat_ndstip = frnat.fin_dst;
7062
7063 if ((flags & IPN_TCPUDP) != 0) {
7064 nat->nat_osport = htons(fin->fin_data[0]);
7065 nat->nat_odport = htons(fin->fin_data[1]);
7066 nat->nat_nsport = htons(frnat.fin_data[0]);
7067 nat->nat_ndport = htons(frnat.fin_data[1]);
7068 } else if ((flags & IPN_ICMPQUERY) != 0) {
7069 nat->nat_oicmpid = fin->fin_data[1];
7070 nat->nat_nicmpid = frnat.fin_data[1];
7071 }
7072
7073 return (0);
7074 }
7075
7076
7077 /* ------------------------------------------------------------------------ */
7078 /* Function: nat_newdivert */
7079 /* Returns: int - -1 == error, 0 == success */
7080 /* Parameters: fin(I) - pointer to packet information */
7081 /* nat(I) - pointer to NAT entry */
7082 /* ni(I) - pointer to structure with misc. information needed */
7083 /* to create new NAT entry. */
7084 /* Write Lock: ipf_nat */
7085 /* */
7086 /* Create a new NAT divert session as defined by the NAT rule. This is */
7087 /* somewhat different to other NAT session creation routines because we */
7088 /* do not iterate through either port numbers or IP addresses, searching */
7089 /* for a unique mapping, however, a complimentary duplicate check is made. */
7090 /* ------------------------------------------------------------------------ */
7091 static int
ipf_nat_newdivert(fr_info_t * fin,nat_t * nat,natinfo_t * nai)7092 ipf_nat_newdivert(fr_info_t *fin, nat_t *nat, natinfo_t *nai)
7093 {
7094 ipf_main_softc_t *softc = fin->fin_main_soft;
7095 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7096 fr_info_t frnat;
7097 ipnat_t *np;
7098 nat_t *natl;
7099 int p;
7100
7101 np = nai->nai_np;
7102 bcopy((char *)fin, (char *)&frnat, sizeof(*fin));
7103
7104 nat->nat_pr[0] = 0;
7105 nat->nat_osrcaddr = fin->fin_saddr;
7106 nat->nat_odstaddr = fin->fin_daddr;
7107 frnat.fin_saddr = htonl(np->in_snip);
7108 frnat.fin_daddr = htonl(np->in_dnip);
7109 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
7110 nat->nat_osport = htons(fin->fin_data[0]);
7111 nat->nat_odport = htons(fin->fin_data[1]);
7112 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
7113 nat->nat_oicmpid = fin->fin_data[1];
7114 }
7115
7116 if (np->in_redir & NAT_DIVERTUDP) {
7117 frnat.fin_data[0] = np->in_spnext;
7118 frnat.fin_data[1] = np->in_dpnext;
7119 frnat.fin_flx |= FI_TCPUDP;
7120 p = IPPROTO_UDP;
7121 } else {
7122 frnat.fin_flx &= ~FI_TCPUDP;
7123 p = IPPROTO_IPIP;
7124 }
7125
7126 if (fin->fin_out == 1) {
7127 natl = ipf_nat_inlookup(&frnat, 0, p,
7128 frnat.fin_dst, frnat.fin_src);
7129
7130 } else {
7131 natl = ipf_nat_outlookup(&frnat, 0, p,
7132 frnat.fin_dst, frnat.fin_src);
7133 }
7134
7135 if (natl != NULL) {
7136 NBUMPSIDED(fin->fin_out, ns_divert_exist);
7137 DT3(ns_divert_exist, fr_info_t *, fin, nat_t *, nat, natinfo_t, nai);
7138 return (-1);
7139 }
7140
7141 nat->nat_nsrcaddr = frnat.fin_saddr;
7142 nat->nat_ndstaddr = frnat.fin_daddr;
7143 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
7144 nat->nat_nsport = htons(frnat.fin_data[0]);
7145 nat->nat_ndport = htons(frnat.fin_data[1]);
7146 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
7147 nat->nat_nicmpid = frnat.fin_data[1];
7148 }
7149
7150 nat->nat_pr[fin->fin_out] = fin->fin_p;
7151 nat->nat_pr[1 - fin->fin_out] = p;
7152
7153 if (np->in_redir & NAT_REDIRECT)
7154 nat->nat_dir = NAT_DIVERTIN;
7155 else
7156 nat->nat_dir = NAT_DIVERTOUT;
7157
7158 return (0);
7159 }
7160
7161
7162 /* ------------------------------------------------------------------------ */
7163 /* Function: nat_builddivertmp */
7164 /* Returns: int - -1 == error, 0 == success */
7165 /* Parameters: softn(I) - pointer to NAT context structure */
7166 /* np(I) - pointer to a NAT rule */
7167 /* */
7168 /* For divert rules, a skeleton packet representing what will be prepended */
7169 /* to the real packet is created. Even though we don't have the full */
7170 /* packet here, a checksum is calculated that we update later when we */
7171 /* fill in the final details. At present a 0 checksum for UDP is being set */
7172 /* here because it is expected that divert will be used for localhost. */
7173 /* ------------------------------------------------------------------------ */
7174 static int
ipf_nat_builddivertmp(ipf_nat_softc_t * softn,ipnat_t * np)7175 ipf_nat_builddivertmp(ipf_nat_softc_t *softn, ipnat_t *np)
7176 {
7177 udphdr_t *uh;
7178 size_t len;
7179 ip_t *ip;
7180
7181 if ((np->in_redir & NAT_DIVERTUDP) != 0)
7182 len = sizeof(ip_t) + sizeof(udphdr_t);
7183 else
7184 len = sizeof(ip_t);
7185
7186 ALLOC_MB_T(np->in_divmp, len);
7187 if (np->in_divmp == NULL) {
7188 NBUMPD(ipf_nat_stats, ns_divert_build);
7189 return (-1);
7190 }
7191
7192 /*
7193 * First, the header to get the packet diverted to the new destination
7194 */
7195 ip = MTOD(np->in_divmp, ip_t *);
7196 IP_V_A(ip, 4);
7197 IP_HL_A(ip, 5);
7198 ip->ip_tos = 0;
7199 if ((np->in_redir & NAT_DIVERTUDP) != 0)
7200 ip->ip_p = IPPROTO_UDP;
7201 else
7202 ip->ip_p = IPPROTO_IPIP;
7203 ip->ip_ttl = 255;
7204 ip->ip_off = 0;
7205 ip->ip_sum = 0;
7206 ip->ip_len = htons(len);
7207 ip->ip_id = 0;
7208 ip->ip_src.s_addr = htonl(np->in_snip);
7209 ip->ip_dst.s_addr = htonl(np->in_dnip);
7210 ip->ip_sum = ipf_cksum((u_short *)ip, sizeof(*ip));
7211
7212 if (np->in_redir & NAT_DIVERTUDP) {
7213 uh = (udphdr_t *)(ip + 1);
7214 uh->uh_sum = 0;
7215 uh->uh_ulen = 8;
7216 uh->uh_sport = htons(np->in_spnext);
7217 uh->uh_dport = htons(np->in_dpnext);
7218 }
7219
7220 return (0);
7221 }
7222
7223
7224 #define MINDECAP (sizeof(ip_t) + sizeof(udphdr_t) + sizeof(ip_t))
7225
7226 /* ------------------------------------------------------------------------ */
7227 /* Function: nat_decap */
7228 /* Returns: int - -1 == error, 0 == success */
7229 /* Parameters: fin(I) - pointer to packet information */
7230 /* nat(I) - pointer to current NAT session */
7231 /* */
7232 /* This function is responsible for undoing a packet's encapsulation in the */
7233 /* reverse of an encap/divert rule. After removing the outer encapsulation */
7234 /* it is necessary to call ipf_makefrip() again so that the contents of 'fin'*/
7235 /* match the "new" packet as it may still be used by IPFilter elsewhere. */
7236 /* We use "dir" here as the basis for some of the expectations about the */
7237 /* outer header. If we return an error, the goal is to leave the original */
7238 /* packet information undisturbed - this falls short at the end where we'd */
7239 /* need to back a backup copy of "fin" - expensive. */
7240 /* ------------------------------------------------------------------------ */
7241 static int
ipf_nat_decap(fr_info_t * fin,nat_t * nat)7242 ipf_nat_decap(fr_info_t *fin, nat_t *nat)
7243 {
7244 ipf_main_softc_t *softc = fin->fin_main_soft;
7245 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7246 char *hdr;
7247 int hlen;
7248 int skip;
7249 mb_t *m;
7250
7251 if ((fin->fin_flx & FI_ICMPERR) != 0) {
7252 /*
7253 * ICMP packets don't get decapsulated, instead what we need
7254 * to do is change the ICMP reply from including (in the data
7255 * portion for errors) the encapsulated packet that we sent
7256 * out to something that resembles the original packet prior
7257 * to encapsulation. This isn't done here - all we're doing
7258 * here is changing the outer address to ensure that it gets
7259 * targetted back to the correct system.
7260 */
7261
7262 if (nat->nat_dir & NAT_OUTBOUND) {
7263 u_32_t sum1, sum2, sumd;
7264
7265 sum1 = ntohl(fin->fin_daddr);
7266 sum2 = ntohl(nat->nat_osrcaddr);
7267 CALC_SUMD(sum1, sum2, sumd);
7268 fin->fin_ip->ip_dst = nat->nat_osrcip;
7269 fin->fin_daddr = nat->nat_osrcaddr;
7270 #if !defined(_KERNEL) || SOLARIS
7271 ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, sumd, 0);
7272 #endif
7273 }
7274 return (0);
7275 }
7276
7277 m = fin->fin_m;
7278 skip = fin->fin_hlen;
7279
7280 switch (nat->nat_dir)
7281 {
7282 case NAT_DIVERTIN :
7283 case NAT_DIVERTOUT :
7284 if (fin->fin_plen < MINDECAP)
7285 return (-1);
7286 skip += sizeof(udphdr_t);
7287 break;
7288
7289 case NAT_ENCAPIN :
7290 case NAT_ENCAPOUT :
7291 if (fin->fin_plen < (skip + sizeof(ip_t)))
7292 return (-1);
7293 break;
7294 default :
7295 return (-1);
7296 /* NOTREACHED */
7297 }
7298
7299 /*
7300 * The aim here is to keep the original packet details in "fin" for
7301 * as long as possible so that returning with an error is for the
7302 * original packet and there is little undoing work to do.
7303 */
7304 if (M_LEN(m) < skip + sizeof(ip_t)) {
7305 if (ipf_pr_pullup(fin, skip + sizeof(ip_t)) == -1)
7306 return (-1);
7307 }
7308
7309 hdr = MTOD(fin->fin_m, char *);
7310 fin->fin_ip = (ip_t *)(hdr + skip);
7311 hlen = IP_HL(fin->fin_ip) << 2;
7312
7313 if (ipf_pr_pullup(fin, skip + hlen) == -1) {
7314 NBUMPSIDED(fin->fin_out, ns_decap_pullup);
7315 return (-1);
7316 }
7317
7318 fin->fin_hlen = hlen;
7319 fin->fin_dlen -= skip;
7320 fin->fin_plen -= skip;
7321 fin->fin_ipoff += skip;
7322
7323 if (ipf_makefrip(hlen, (ip_t *)hdr, fin) == -1) {
7324 NBUMPSIDED(fin->fin_out, ns_decap_bad);
7325 return (-1);
7326 }
7327
7328 return (skip);
7329 }
7330
7331
7332 /* ------------------------------------------------------------------------ */
7333 /* Function: nat_nextaddr */
7334 /* Returns: int - -1 == bad input (no new address), */
7335 /* 0 == success and dst has new address */
7336 /* Parameters: fin(I) - pointer to packet information */
7337 /* na(I) - how to generate new address */
7338 /* old(I) - original address being replaced */
7339 /* dst(O) - where to put the new address */
7340 /* Write Lock: ipf_nat */
7341 /* */
7342 /* This function uses the contents of the "na" structure, in combination */
7343 /* with "old" to produce a new address to store in "dst". Not all of the */
7344 /* possible uses of "na" will result in a new address. */
7345 /* ------------------------------------------------------------------------ */
7346 static int
ipf_nat_nextaddr(fr_info_t * fin,nat_addr_t * na,u_32_t * old,u_32_t * dst)7347 ipf_nat_nextaddr(fr_info_t *fin, nat_addr_t *na, u_32_t *old, u_32_t *dst)
7348 {
7349 ipf_main_softc_t *softc = fin->fin_main_soft;
7350 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7351 u_32_t new;
7352 i6addr_t newip;
7353 int error;
7354
7355 new = 0;
7356
7357 switch (na->na_atype)
7358 {
7359 case FRI_RANGE :
7360 case FRI_NETMASKED :
7361 case FRI_DYNAMIC :
7362 case FRI_NORMAL :
7363 case FRI_LOOKUP :
7364 break;
7365
7366 case FRI_BROADCAST :
7367 case FRI_PEERADDR :
7368 case FRI_NETWORK :
7369 default :
7370 DT4(ns_na_atype, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7371 return (-1);
7372 }
7373
7374 error = -1;
7375
7376 if (na->na_atype == FRI_LOOKUP) {
7377 if (na->na_type == IPLT_DSTLIST) {
7378 error = ipf_dstlist_select_node(fin, na->na_ptr, dst,
7379 NULL);
7380 } else {
7381 NBUMPSIDE(fin->fin_out, ns_badnextaddr);
7382 DT4(ns_badnextaddr_1, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7383 }
7384
7385 } else if (na->na_atype == IPLT_NONE) {
7386 /*
7387 * 0/0 as the new address means leave it alone.
7388 */
7389 if (na->na_addr[0].in4.s_addr == 0 &&
7390 na->na_addr[1].in4.s_addr == 0) {
7391 new = *old;
7392
7393 /*
7394 * 0/32 means get the interface's address
7395 */
7396 } else if (na->na_addr[0].in4.s_addr == 0 &&
7397 na->na_addr[1].in4.s_addr == 0xffffffff) {
7398 if (ipf_ifpaddr(softc, 4, na->na_atype,
7399 fin->fin_ifp, &newip, NULL) == -1) {
7400 NBUMPSIDED(fin->fin_out, ns_ifpaddrfail);
7401 DT4(ns_ifpaddrfail, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7402 return (-1);
7403 }
7404 new = newip.in4.s_addr;
7405 } else {
7406 new = htonl(na->na_nextip);
7407 }
7408 *dst = new;
7409 error = 0;
7410
7411 } else {
7412 NBUMPSIDE(fin->fin_out, ns_badnextaddr);
7413 DT4(ns_badnextaddr_2, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7414 }
7415
7416 return (error);
7417 }
7418
7419
7420 /* ------------------------------------------------------------------------ */
7421 /* Function: nat_nextaddrinit */
7422 /* Returns: int - 0 == success, else error number */
7423 /* Parameters: softc(I) - pointer to soft context main structure */
7424 /* na(I) - NAT address information for generating new addr*/
7425 /* initial(I) - flag indicating if it is the first call for */
7426 /* this "na" structure. */
7427 /* ifp(I) - network interface to derive address */
7428 /* information from. */
7429 /* */
7430 /* This function is expected to be called in two scenarious: when a new NAT */
7431 /* rule is loaded into the kernel and when the list of NAT rules is sync'd */
7432 /* up with the valid network interfaces (possibly due to them changing.) */
7433 /* To distinguish between these, the "initial" parameter is used. If it is */
7434 /* 1 then this indicates the rule has just been reloaded and 0 for when we */
7435 /* are updating information. This difference is important because in */
7436 /* instances where we are not updating address information associated with */
7437 /* a network interface, we don't want to disturb what the "next" address to */
7438 /* come out of ipf_nat_nextaddr() will be. */
7439 /* ------------------------------------------------------------------------ */
7440 static int
ipf_nat_nextaddrinit(ipf_main_softc_t * softc,char * base,nat_addr_t * na,int initial,void * ifp)7441 ipf_nat_nextaddrinit(ipf_main_softc_t *softc, char *base, nat_addr_t *na,
7442 int initial, void *ifp)
7443 {
7444
7445 switch (na->na_atype)
7446 {
7447 case FRI_LOOKUP :
7448 if (na->na_subtype == 0) {
7449 na->na_ptr = ipf_lookup_res_num(softc, IPL_LOGNAT,
7450 na->na_type,
7451 na->na_num,
7452 &na->na_func);
7453 } else if (na->na_subtype == 1) {
7454 na->na_ptr = ipf_lookup_res_name(softc, IPL_LOGNAT,
7455 na->na_type,
7456 base + na->na_num,
7457 &na->na_func);
7458 }
7459 if (na->na_func == NULL) {
7460 IPFERROR(60060);
7461 return (ESRCH);
7462 }
7463 if (na->na_ptr == NULL) {
7464 IPFERROR(60056);
7465 return (ESRCH);
7466 }
7467 break;
7468
7469 case FRI_DYNAMIC :
7470 case FRI_BROADCAST :
7471 case FRI_NETWORK :
7472 case FRI_NETMASKED :
7473 case FRI_PEERADDR :
7474 if (ifp != NULL)
7475 (void )ipf_ifpaddr(softc, 4, na->na_atype, ifp,
7476 &na->na_addr[0], &na->na_addr[1]);
7477 break;
7478
7479 case FRI_SPLIT :
7480 case FRI_RANGE :
7481 if (initial)
7482 na->na_nextip = ntohl(na->na_addr[0].in4.s_addr);
7483 break;
7484
7485 case FRI_NONE :
7486 na->na_addr[0].in4.s_addr &= na->na_addr[1].in4.s_addr;
7487 return (0);
7488
7489 case FRI_NORMAL :
7490 na->na_addr[0].in4.s_addr &= na->na_addr[1].in4.s_addr;
7491 break;
7492
7493 default :
7494 IPFERROR(60054);
7495 return (EINVAL);
7496 }
7497
7498 if (initial && (na->na_atype == FRI_NORMAL)) {
7499 if (na->na_addr[0].in4.s_addr == 0) {
7500 if ((na->na_addr[1].in4.s_addr == 0xffffffff) ||
7501 (na->na_addr[1].in4.s_addr == 0)) {
7502 return (0);
7503 }
7504 }
7505
7506 if (na->na_addr[1].in4.s_addr == 0xffffffff) {
7507 na->na_nextip = ntohl(na->na_addr[0].in4.s_addr);
7508 } else {
7509 na->na_nextip = ntohl(na->na_addr[0].in4.s_addr) + 1;
7510 }
7511 }
7512
7513 return (0);
7514 }
7515
7516
7517 /* ------------------------------------------------------------------------ */
7518 /* Function: ipf_nat_matchflush */
7519 /* Returns: int - -1 == error, 0 == success */
7520 /* Parameters: softc(I) - pointer to soft context main structure */
7521 /* softn(I) - pointer to NAT context structure */
7522 /* nat(I) - pointer to current NAT session */
7523 /* */
7524 /* ------------------------------------------------------------------------ */
7525 static int
ipf_nat_matchflush(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,caddr_t data)7526 ipf_nat_matchflush(ipf_main_softc_t *softc, ipf_nat_softc_t *softn,
7527 caddr_t data)
7528 {
7529 int *array, flushed, error;
7530 nat_t *nat, *natnext;
7531 ipfobj_t obj;
7532
7533 error = ipf_matcharray_load(softc, data, &obj, &array);
7534 if (error != 0)
7535 return (error);
7536
7537 flushed = 0;
7538
7539 for (nat = softn->ipf_nat_instances; nat != NULL; nat = natnext) {
7540 natnext = nat->nat_next;
7541 if (ipf_nat_matcharray(nat, array, softc->ipf_ticks) == 0) {
7542 ipf_nat_delete(softc, nat, NL_FLUSH);
7543 flushed++;
7544 }
7545 }
7546
7547 obj.ipfo_retval = flushed;
7548 error = BCOPYOUT(&obj, data, sizeof(obj));
7549
7550 KFREES(array, array[0] * sizeof(*array));
7551
7552 return (error);
7553 }
7554
7555
7556 /* ------------------------------------------------------------------------ */
7557 /* Function: ipf_nat_matcharray */
7558 /* Returns: int - -1 == error, 0 == success */
7559 /* Parameters: fin(I) - pointer to packet information */
7560 /* nat(I) - pointer to current NAT session */
7561 /* */
7562 /* ------------------------------------------------------------------------ */
7563 static int
ipf_nat_matcharray(nat_t * nat,int * array,u_long ticks)7564 ipf_nat_matcharray(nat_t *nat, int *array, u_long ticks)
7565 {
7566 int i, n, *x, e, p;
7567
7568 e = 0;
7569 n = array[0];
7570 x = array + 1;
7571
7572 for (; n > 0; x += 3 + x[2]) {
7573 if (x[0] == IPF_EXP_END)
7574 break;
7575 e = 0;
7576
7577 n -= x[2] + 3;
7578 if (n < 0)
7579 break;
7580
7581 p = x[0] >> 16;
7582 if (p != 0 && p != nat->nat_pr[1])
7583 break;
7584
7585 switch (x[0])
7586 {
7587 case IPF_EXP_IP_PR :
7588 for (i = 0; !e && i < x[2]; i++) {
7589 e |= (nat->nat_pr[1] == x[i + 3]);
7590 }
7591 break;
7592
7593 case IPF_EXP_IP_SRCADDR :
7594 if (nat->nat_v[0] == 4) {
7595 for (i = 0; !e && i < x[2]; i++) {
7596 e |= ((nat->nat_osrcaddr & x[i + 4]) ==
7597 x[i + 3]);
7598 }
7599 }
7600 if (nat->nat_v[1] == 4) {
7601 for (i = 0; !e && i < x[2]; i++) {
7602 e |= ((nat->nat_nsrcaddr & x[i + 4]) ==
7603 x[i + 3]);
7604 }
7605 }
7606 break;
7607
7608 case IPF_EXP_IP_DSTADDR :
7609 if (nat->nat_v[0] == 4) {
7610 for (i = 0; !e && i < x[2]; i++) {
7611 e |= ((nat->nat_odstaddr & x[i + 4]) ==
7612 x[i + 3]);
7613 }
7614 }
7615 if (nat->nat_v[1] == 4) {
7616 for (i = 0; !e && i < x[2]; i++) {
7617 e |= ((nat->nat_ndstaddr & x[i + 4]) ==
7618 x[i + 3]);
7619 }
7620 }
7621 break;
7622
7623 case IPF_EXP_IP_ADDR :
7624 for (i = 0; !e && i < x[2]; i++) {
7625 if (nat->nat_v[0] == 4) {
7626 e |= ((nat->nat_osrcaddr & x[i + 4]) ==
7627 x[i + 3]);
7628 }
7629 if (nat->nat_v[1] == 4) {
7630 e |= ((nat->nat_nsrcaddr & x[i + 4]) ==
7631 x[i + 3]);
7632 }
7633 if (nat->nat_v[0] == 4) {
7634 e |= ((nat->nat_odstaddr & x[i + 4]) ==
7635 x[i + 3]);
7636 }
7637 if (nat->nat_v[1] == 4) {
7638 e |= ((nat->nat_ndstaddr & x[i + 4]) ==
7639 x[i + 3]);
7640 }
7641 }
7642 break;
7643
7644 #ifdef USE_INET6
7645 case IPF_EXP_IP6_SRCADDR :
7646 if (nat->nat_v[0] == 6) {
7647 for (i = 0; !e && i < x[3]; i++) {
7648 e |= IP6_MASKEQ(&nat->nat_osrc6,
7649 x + i + 7, x + i + 3);
7650 }
7651 }
7652 if (nat->nat_v[1] == 6) {
7653 for (i = 0; !e && i < x[3]; i++) {
7654 e |= IP6_MASKEQ(&nat->nat_nsrc6,
7655 x + i + 7, x + i + 3);
7656 }
7657 }
7658 break;
7659
7660 case IPF_EXP_IP6_DSTADDR :
7661 if (nat->nat_v[0] == 6) {
7662 for (i = 0; !e && i < x[3]; i++) {
7663 e |= IP6_MASKEQ(&nat->nat_odst6,
7664 x + i + 7,
7665 x + i + 3);
7666 }
7667 }
7668 if (nat->nat_v[1] == 6) {
7669 for (i = 0; !e && i < x[3]; i++) {
7670 e |= IP6_MASKEQ(&nat->nat_ndst6,
7671 x + i + 7,
7672 x + i + 3);
7673 }
7674 }
7675 break;
7676
7677 case IPF_EXP_IP6_ADDR :
7678 for (i = 0; !e && i < x[3]; i++) {
7679 if (nat->nat_v[0] == 6) {
7680 e |= IP6_MASKEQ(&nat->nat_osrc6,
7681 x + i + 7,
7682 x + i + 3);
7683 }
7684 if (nat->nat_v[0] == 6) {
7685 e |= IP6_MASKEQ(&nat->nat_odst6,
7686 x + i + 7,
7687 x + i + 3);
7688 }
7689 if (nat->nat_v[1] == 6) {
7690 e |= IP6_MASKEQ(&nat->nat_nsrc6,
7691 x + i + 7,
7692 x + i + 3);
7693 }
7694 if (nat->nat_v[1] == 6) {
7695 e |= IP6_MASKEQ(&nat->nat_ndst6,
7696 x + i + 7,
7697 x + i + 3);
7698 }
7699 }
7700 break;
7701 #endif
7702
7703 case IPF_EXP_UDP_PORT :
7704 case IPF_EXP_TCP_PORT :
7705 for (i = 0; !e && i < x[2]; i++) {
7706 e |= (nat->nat_nsport == x[i + 3]) ||
7707 (nat->nat_ndport == x[i + 3]);
7708 }
7709 break;
7710
7711 case IPF_EXP_UDP_SPORT :
7712 case IPF_EXP_TCP_SPORT :
7713 for (i = 0; !e && i < x[2]; i++) {
7714 e |= (nat->nat_nsport == x[i + 3]);
7715 }
7716 break;
7717
7718 case IPF_EXP_UDP_DPORT :
7719 case IPF_EXP_TCP_DPORT :
7720 for (i = 0; !e && i < x[2]; i++) {
7721 e |= (nat->nat_ndport == x[i + 3]);
7722 }
7723 break;
7724
7725 case IPF_EXP_TCP_STATE :
7726 for (i = 0; !e && i < x[2]; i++) {
7727 e |= (nat->nat_tcpstate[0] == x[i + 3]) ||
7728 (nat->nat_tcpstate[1] == x[i + 3]);
7729 }
7730 break;
7731
7732 case IPF_EXP_IDLE_GT :
7733 e |= (ticks - nat->nat_touched > x[3]);
7734 break;
7735 }
7736 e ^= x[1];
7737
7738 if (!e)
7739 break;
7740 }
7741
7742 return (e);
7743 }
7744
7745
7746 /* ------------------------------------------------------------------------ */
7747 /* Function: ipf_nat_gettable */
7748 /* Returns: int - 0 = success, else error */
7749 /* Parameters: softc(I) - pointer to soft context main structure */
7750 /* softn(I) - pointer to NAT context structure */
7751 /* data(I) - pointer to ioctl data */
7752 /* */
7753 /* This function handles ioctl requests for tables of nat information. */
7754 /* At present the only table it deals with is the hash bucket statistics. */
7755 /* ------------------------------------------------------------------------ */
7756 static int
ipf_nat_gettable(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,char * data)7757 ipf_nat_gettable(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, char *data)
7758 {
7759 ipftable_t table;
7760 int error;
7761
7762 error = ipf_inobj(softc, data, NULL, &table, IPFOBJ_GTABLE);
7763 if (error != 0)
7764 return (error);
7765
7766 switch (table.ita_type)
7767 {
7768 case IPFTABLE_BUCKETS_NATIN :
7769 error = COPYOUT(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
7770 table.ita_table,
7771 softn->ipf_nat_table_sz * sizeof(u_int));
7772 break;
7773
7774 case IPFTABLE_BUCKETS_NATOUT :
7775 error = COPYOUT(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
7776 table.ita_table,
7777 softn->ipf_nat_table_sz * sizeof(u_int));
7778 break;
7779
7780 default :
7781 IPFERROR(60058);
7782 return (EINVAL);
7783 }
7784
7785 if (error != 0) {
7786 IPFERROR(60059);
7787 error = EFAULT;
7788 }
7789 return (error);
7790 }
7791
7792
7793 /* ------------------------------------------------------------------------ */
7794 /* Function: ipf_nat_settimeout */
7795 /* Returns: int - 0 = success, else failure */
7796 /* Parameters: softc(I) - pointer to soft context main structure */
7797 /* t(I) - pointer to tunable */
7798 /* p(I) - pointer to new tuning data */
7799 /* */
7800 /* Apply the timeout change to the NAT timeout queues. */
7801 /* ------------------------------------------------------------------------ */
7802 int
ipf_nat_settimeout(struct ipf_main_softc_s * softc,ipftuneable_t * t,ipftuneval_t * p)7803 ipf_nat_settimeout(struct ipf_main_softc_s *softc, ipftuneable_t *t,
7804 ipftuneval_t *p)
7805 {
7806 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7807
7808 if (!strncmp(t->ipft_name, "tcp_", 4))
7809 return (ipf_settimeout_tcp(t, p, softn->ipf_nat_tcptq));
7810
7811 if (!strcmp(t->ipft_name, "udp_timeout")) {
7812 ipf_apply_timeout(&softn->ipf_nat_udptq, p->ipftu_int);
7813 } else if (!strcmp(t->ipft_name, "udp_ack_timeout")) {
7814 ipf_apply_timeout(&softn->ipf_nat_udpacktq, p->ipftu_int);
7815 } else if (!strcmp(t->ipft_name, "icmp_timeout")) {
7816 ipf_apply_timeout(&softn->ipf_nat_icmptq, p->ipftu_int);
7817 } else if (!strcmp(t->ipft_name, "icmp_ack_timeout")) {
7818 ipf_apply_timeout(&softn->ipf_nat_icmpacktq, p->ipftu_int);
7819 } else if (!strcmp(t->ipft_name, "ip_timeout")) {
7820 ipf_apply_timeout(&softn->ipf_nat_iptq, p->ipftu_int);
7821 } else {
7822 IPFERROR(60062);
7823 return (ESRCH);
7824 }
7825 return (0);
7826 }
7827
7828
7829 /* ------------------------------------------------------------------------ */
7830 /* Function: ipf_nat_rehash */
7831 /* Returns: int - 0 = success, else failure */
7832 /* Parameters: softc(I) - pointer to soft context main structure */
7833 /* t(I) - pointer to tunable */
7834 /* p(I) - pointer to new tuning data */
7835 /* */
7836 /* To change the size of the basic NAT table, we need to first allocate the */
7837 /* new tables (lest it fails and we've got nowhere to store all of the NAT */
7838 /* sessions currently active) and then walk through the entire list and */
7839 /* insert them into the table. There are two tables here: an inbound one */
7840 /* and an outbound one. Each NAT entry goes into each table once. */
7841 /* ------------------------------------------------------------------------ */
7842 int
ipf_nat_rehash(ipf_main_softc_t * softc,ipftuneable_t * t,ipftuneval_t * p)7843 ipf_nat_rehash(ipf_main_softc_t *softc, ipftuneable_t *t, ipftuneval_t *p)
7844 {
7845 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7846 nat_t **newtab[2], *nat, **natp;
7847 u_int *bucketlens[2];
7848 u_int maxbucket;
7849 u_int newsize;
7850 int error;
7851 u_int hv;
7852 int i;
7853
7854 newsize = p->ipftu_int;
7855 /*
7856 * In case there is nothing to do...
7857 */
7858 if (newsize == softn->ipf_nat_table_sz)
7859 return (0);
7860
7861 newtab[0] = NULL;
7862 newtab[1] = NULL;
7863 bucketlens[0] = NULL;
7864 bucketlens[1] = NULL;
7865 /*
7866 * 4 tables depend on the NAT table size: the inbound looking table,
7867 * the outbound lookup table and the hash chain length for each.
7868 */
7869 KMALLOCS(newtab[0], nat_t **, newsize * sizeof(nat_t *));
7870 if (newtab[0] == NULL) {
7871 error = 60063;
7872 goto badrehash;
7873 }
7874
7875 KMALLOCS(newtab[1], nat_t **, newsize * sizeof(nat_t *));
7876 if (newtab[1] == NULL) {
7877 error = 60064;
7878 goto badrehash;
7879 }
7880
7881 KMALLOCS(bucketlens[0], u_int *, newsize * sizeof(u_int));
7882 if (bucketlens[0] == NULL) {
7883 error = 60065;
7884 goto badrehash;
7885 }
7886
7887 KMALLOCS(bucketlens[1], u_int *, newsize * sizeof(u_int));
7888 if (bucketlens[1] == NULL) {
7889 error = 60066;
7890 goto badrehash;
7891 }
7892
7893 /*
7894 * Recalculate the maximum length based on the new size.
7895 */
7896 for (maxbucket = 0, i = newsize; i > 0; i >>= 1)
7897 maxbucket++;
7898 maxbucket *= 2;
7899
7900 bzero((char *)newtab[0], newsize * sizeof(nat_t *));
7901 bzero((char *)newtab[1], newsize * sizeof(nat_t *));
7902 bzero((char *)bucketlens[0], newsize * sizeof(u_int));
7903 bzero((char *)bucketlens[1], newsize * sizeof(u_int));
7904
7905 WRITE_ENTER(&softc->ipf_nat);
7906
7907 if (softn->ipf_nat_table[0] != NULL) {
7908 KFREES(softn->ipf_nat_table[0],
7909 softn->ipf_nat_table_sz *
7910 sizeof(*softn->ipf_nat_table[0]));
7911 }
7912 softn->ipf_nat_table[0] = newtab[0];
7913
7914 if (softn->ipf_nat_table[1] != NULL) {
7915 KFREES(softn->ipf_nat_table[1],
7916 softn->ipf_nat_table_sz *
7917 sizeof(*softn->ipf_nat_table[1]));
7918 }
7919 softn->ipf_nat_table[1] = newtab[1];
7920
7921 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen != NULL) {
7922 KFREES(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
7923 softn->ipf_nat_table_sz * sizeof(u_int));
7924 }
7925 softn->ipf_nat_stats.ns_side[0].ns_bucketlen = bucketlens[0];
7926
7927 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen != NULL) {
7928 KFREES(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
7929 softn->ipf_nat_table_sz * sizeof(u_int));
7930 }
7931 softn->ipf_nat_stats.ns_side[1].ns_bucketlen = bucketlens[1];
7932
7933 #ifdef USE_INET6
7934 if (softn->ipf_nat_stats.ns_side6[0].ns_bucketlen != NULL) {
7935 KFREES(softn->ipf_nat_stats.ns_side6[0].ns_bucketlen,
7936 softn->ipf_nat_table_sz * sizeof(u_int));
7937 }
7938 softn->ipf_nat_stats.ns_side6[0].ns_bucketlen = bucketlens[0];
7939
7940 if (softn->ipf_nat_stats.ns_side6[1].ns_bucketlen != NULL) {
7941 KFREES(softn->ipf_nat_stats.ns_side6[1].ns_bucketlen,
7942 softn->ipf_nat_table_sz * sizeof(u_int));
7943 }
7944 softn->ipf_nat_stats.ns_side6[1].ns_bucketlen = bucketlens[1];
7945 #endif
7946
7947 softn->ipf_nat_maxbucket = maxbucket;
7948 softn->ipf_nat_table_sz = newsize;
7949 /*
7950 * Walk through the entire list of NAT table entries and put them
7951 * in the new NAT table, somewhere. Because we have a new table,
7952 * we need to restart the counter of how many chains are in use.
7953 */
7954 softn->ipf_nat_stats.ns_side[0].ns_inuse = 0;
7955 softn->ipf_nat_stats.ns_side[1].ns_inuse = 0;
7956 #ifdef USE_INET6
7957 softn->ipf_nat_stats.ns_side6[0].ns_inuse = 0;
7958 softn->ipf_nat_stats.ns_side6[1].ns_inuse = 0;
7959 #endif
7960
7961 for (nat = softn->ipf_nat_instances; nat != NULL; nat = nat->nat_next) {
7962 nat->nat_hnext[0] = NULL;
7963 nat->nat_phnext[0] = NULL;
7964 hv = nat->nat_hv[0] % softn->ipf_nat_table_sz;
7965
7966 natp = &softn->ipf_nat_table[0][hv];
7967 if (*natp) {
7968 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
7969 } else {
7970 NBUMPSIDE(0, ns_inuse);
7971 }
7972 nat->nat_phnext[0] = natp;
7973 nat->nat_hnext[0] = *natp;
7974 *natp = nat;
7975 NBUMPSIDE(0, ns_bucketlen[hv]);
7976
7977 nat->nat_hnext[1] = NULL;
7978 nat->nat_phnext[1] = NULL;
7979 hv = nat->nat_hv[1] % softn->ipf_nat_table_sz;
7980
7981 natp = &softn->ipf_nat_table[1][hv];
7982 if (*natp) {
7983 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
7984 } else {
7985 NBUMPSIDE(1, ns_inuse);
7986 }
7987 nat->nat_phnext[1] = natp;
7988 nat->nat_hnext[1] = *natp;
7989 *natp = nat;
7990 NBUMPSIDE(1, ns_bucketlen[hv]);
7991 }
7992 RWLOCK_EXIT(&softc->ipf_nat);
7993
7994 return (0);
7995
7996 badrehash:
7997 if (bucketlens[1] != NULL) {
7998 KFREES(bucketlens[0], newsize * sizeof(u_int));
7999 }
8000 if (bucketlens[0] != NULL) {
8001 KFREES(bucketlens[0], newsize * sizeof(u_int));
8002 }
8003 if (newtab[0] != NULL) {
8004 KFREES(newtab[0], newsize * sizeof(nat_t *));
8005 }
8006 if (newtab[1] != NULL) {
8007 KFREES(newtab[1], newsize * sizeof(nat_t *));
8008 }
8009 IPFERROR(error);
8010 return (ENOMEM);
8011 }
8012
8013
8014 /* ------------------------------------------------------------------------ */
8015 /* Function: ipf_nat_rehash_rules */
8016 /* Returns: int - 0 = success, else failure */
8017 /* Parameters: softc(I) - pointer to soft context main structure */
8018 /* t(I) - pointer to tunable */
8019 /* p(I) - pointer to new tuning data */
8020 /* */
8021 /* All of the NAT rules hang off of a hash table that is searched with a */
8022 /* hash on address after the netmask is applied. There is a different table*/
8023 /* for both inbound rules (rdr) and outbound (map.) The resizing will only */
8024 /* affect one of these two tables. */
8025 /* ------------------------------------------------------------------------ */
8026 int
ipf_nat_rehash_rules(ipf_main_softc_t * softc,ipftuneable_t * t,ipftuneval_t * p)8027 ipf_nat_rehash_rules(ipf_main_softc_t *softc, ipftuneable_t *t,
8028 ipftuneval_t *p)
8029 {
8030 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8031 ipnat_t **newtab, *np, ***old, **npp;
8032 u_int newsize;
8033 u_int mask;
8034 u_int hv;
8035
8036 newsize = p->ipftu_int;
8037 /*
8038 * In case there is nothing to do...
8039 */
8040 if (newsize == *t->ipft_pint)
8041 return (0);
8042
8043 /*
8044 * All inbound rules have the NAT_REDIRECT bit set in in_redir and
8045 * all outbound rules have either NAT_MAP or MAT_MAPBLK set.
8046 * This if statement allows for some more generic code to be below,
8047 * rather than two huge gobs of code that almost do the same thing.
8048 */
8049 if (t->ipft_pint == &softn->ipf_nat_rdrrules_sz) {
8050 old = &softn->ipf_nat_rdr_rules;
8051 mask = NAT_REDIRECT;
8052 } else {
8053 old = &softn->ipf_nat_map_rules;
8054 mask = NAT_MAP|NAT_MAPBLK;
8055 }
8056
8057 KMALLOCS(newtab, ipnat_t **, newsize * sizeof(ipnat_t *));
8058 if (newtab == NULL) {
8059 IPFERROR(60067);
8060 return (ENOMEM);
8061 }
8062
8063 bzero((char *)newtab, newsize * sizeof(ipnat_t *));
8064
8065 WRITE_ENTER(&softc->ipf_nat);
8066
8067 if (*old != NULL) {
8068 KFREES(*old, *t->ipft_pint * sizeof(ipnat_t **));
8069 }
8070 *old = newtab;
8071 *t->ipft_pint = newsize;
8072
8073 for (np = softn->ipf_nat_list; np != NULL; np = np->in_next) {
8074 if ((np->in_redir & mask) == 0)
8075 continue;
8076
8077 if (np->in_redir & NAT_REDIRECT) {
8078 np->in_rnext = NULL;
8079 hv = np->in_hv[0] % newsize;
8080 for (npp = newtab + hv; *npp != NULL; )
8081 npp = &(*npp)->in_rnext;
8082 np->in_prnext = npp;
8083 *npp = np;
8084 }
8085 if (np->in_redir & NAT_MAP) {
8086 np->in_mnext = NULL;
8087 hv = np->in_hv[1] % newsize;
8088 for (npp = newtab + hv; *npp != NULL; )
8089 npp = &(*npp)->in_mnext;
8090 np->in_pmnext = npp;
8091 *npp = np;
8092 }
8093
8094 }
8095 RWLOCK_EXIT(&softc->ipf_nat);
8096
8097 return (0);
8098 }
8099
8100
8101 /* ------------------------------------------------------------------------ */
8102 /* Function: ipf_nat_hostmap_rehash */
8103 /* Returns: int - 0 = success, else failure */
8104 /* Parameters: softc(I) - pointer to soft context main structure */
8105 /* t(I) - pointer to tunable */
8106 /* p(I) - pointer to new tuning data */
8107 /* */
8108 /* Allocate and populate a new hash table that will contain a reference to */
8109 /* all of the active IP# translations currently in place. */
8110 /* ------------------------------------------------------------------------ */
8111 int
ipf_nat_hostmap_rehash(ipf_main_softc_t * softc,ipftuneable_t * t,ipftuneval_t * p)8112 ipf_nat_hostmap_rehash(ipf_main_softc_t *softc, ipftuneable_t *t,
8113 ipftuneval_t *p)
8114 {
8115 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8116 hostmap_t *hm, **newtab;
8117 u_int newsize;
8118 u_int hv;
8119
8120 newsize = p->ipftu_int;
8121 /*
8122 * In case there is nothing to do...
8123 */
8124 if (newsize == *t->ipft_pint)
8125 return (0);
8126
8127 KMALLOCS(newtab, hostmap_t **, newsize * sizeof(hostmap_t *));
8128 if (newtab == NULL) {
8129 IPFERROR(60068);
8130 return (ENOMEM);
8131 }
8132
8133 bzero((char *)newtab, newsize * sizeof(hostmap_t *));
8134
8135 WRITE_ENTER(&softc->ipf_nat);
8136 if (softn->ipf_hm_maptable != NULL) {
8137 KFREES(softn->ipf_hm_maptable,
8138 softn->ipf_nat_hostmap_sz * sizeof(hostmap_t *));
8139 }
8140 softn->ipf_hm_maptable = newtab;
8141 softn->ipf_nat_hostmap_sz = newsize;
8142
8143 for (hm = softn->ipf_hm_maplist; hm != NULL; hm = hm->hm_next) {
8144 hv = hm->hm_hv % softn->ipf_nat_hostmap_sz;
8145 hm->hm_hnext = softn->ipf_hm_maptable[hv];
8146 hm->hm_phnext = softn->ipf_hm_maptable + hv;
8147 if (softn->ipf_hm_maptable[hv] != NULL)
8148 softn->ipf_hm_maptable[hv]->hm_phnext = &hm->hm_hnext;
8149 softn->ipf_hm_maptable[hv] = hm;
8150 }
8151 RWLOCK_EXIT(&softc->ipf_nat);
8152
8153 return (0);
8154 }
8155
8156
8157 /* ------------------------------------------------------------------------ */
8158 /* Function: ipf_nat_add_tq */
8159 /* Parameters: softc(I) - pointer to soft context main structure */
8160 /* */
8161 /* ------------------------------------------------------------------------ */
8162 ipftq_t *
ipf_nat_add_tq(ipf_main_softc_t * softc,int ttl)8163 ipf_nat_add_tq(ipf_main_softc_t *softc, int ttl)
8164 {
8165 ipf_nat_softc_t *softs = softc->ipf_nat_soft;
8166
8167 return (ipf_addtimeoutqueue(softc, &softs->ipf_nat_utqe, ttl));
8168 }
8169
8170 /* ------------------------------------------------------------------------ */
8171 /* Function: ipf_nat_uncreate */
8172 /* Returns: Nil */
8173 /* Parameters: fin(I) - pointer to packet information */
8174 /* */
8175 /* This function is used to remove a NAT entry from the NAT table when we */
8176 /* decide that the create was actually in error. It is thus assumed that */
8177 /* fin_flx will have both FI_NATED and FI_NATNEW set. Because we're dealing */
8178 /* with the translated packet (not the original), we have to reverse the */
8179 /* lookup. Although doing the lookup is expensive (relatively speaking), it */
8180 /* is not anticipated that this will be a frequent occurance for normal */
8181 /* traffic patterns. */
8182 /* ------------------------------------------------------------------------ */
8183 void
ipf_nat_uncreate(fr_info_t * fin)8184 ipf_nat_uncreate(fr_info_t *fin)
8185 {
8186 ipf_main_softc_t *softc = fin->fin_main_soft;
8187 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8188 int nflags;
8189 nat_t *nat;
8190
8191 switch (fin->fin_p)
8192 {
8193 case IPPROTO_TCP :
8194 nflags = IPN_TCP;
8195 break;
8196 case IPPROTO_UDP :
8197 nflags = IPN_UDP;
8198 break;
8199 default :
8200 nflags = 0;
8201 break;
8202 }
8203
8204 WRITE_ENTER(&softc->ipf_nat);
8205
8206 if (fin->fin_out == 0) {
8207 nat = ipf_nat_outlookup(fin, nflags, (u_int)fin->fin_p,
8208 fin->fin_dst, fin->fin_src);
8209 } else {
8210 nat = ipf_nat_inlookup(fin, nflags, (u_int)fin->fin_p,
8211 fin->fin_src, fin->fin_dst);
8212 }
8213
8214 if (nat != NULL) {
8215 NBUMPSIDE(fin->fin_out, ns_uncreate[0]);
8216 ipf_nat_delete(softc, nat, NL_DESTROY);
8217 } else {
8218 NBUMPSIDE(fin->fin_out, ns_uncreate[1]);
8219 }
8220
8221 RWLOCK_EXIT(&softc->ipf_nat);
8222 }
8223
8224
8225 /* ------------------------------------------------------------------------ */
8226 /* Function: ipf_nat_cmp_rules */
8227 /* Returns: int - 0 == success, else rules do not match. */
8228 /* Parameters: n1(I) - first rule to compare */
8229 /* n2(I) - first rule to compare */
8230 /* */
8231 /* Compare two rules using pointers to each rule. A straight bcmp will not */
8232 /* work as some fields (such as in_dst, in_pkts) actually do change once */
8233 /* the rule has been loaded into the kernel. Whilst this function returns */
8234 /* various non-zero returns, they're strictly to aid in debugging. Use of */
8235 /* this function should simply care if the result is zero or not. */
8236 /* ------------------------------------------------------------------------ */
8237 static int
ipf_nat_cmp_rules(ipnat_t * n1,ipnat_t * n2)8238 ipf_nat_cmp_rules(ipnat_t *n1, ipnat_t *n2)
8239 {
8240 if (n1->in_size != n2->in_size)
8241 return (1);
8242
8243 if (bcmp((char *)&n1->in_v, (char *)&n2->in_v,
8244 offsetof(ipnat_t, in_ndst) - offsetof(ipnat_t, in_v)) != 0)
8245 return (2);
8246
8247 if (bcmp((char *)&n1->in_tuc, (char *)&n2->in_tuc,
8248 n1->in_size - offsetof(ipnat_t, in_tuc)) != 0)
8249 return (3);
8250 if (n1->in_ndst.na_atype != n2->in_ndst.na_atype)
8251 return (5);
8252 if (n1->in_ndst.na_function != n2->in_ndst.na_function)
8253 return (6);
8254 if (bcmp((char *)&n1->in_ndst.na_addr, (char *)&n2->in_ndst.na_addr,
8255 sizeof(n1->in_ndst.na_addr)))
8256 return (7);
8257 if (n1->in_nsrc.na_atype != n2->in_nsrc.na_atype)
8258 return (8);
8259 if (n1->in_nsrc.na_function != n2->in_nsrc.na_function)
8260 return (9);
8261 if (bcmp((char *)&n1->in_nsrc.na_addr, (char *)&n2->in_nsrc.na_addr,
8262 sizeof(n1->in_nsrc.na_addr)))
8263 return (10);
8264 if (n1->in_odst.na_atype != n2->in_odst.na_atype)
8265 return (11);
8266 if (n1->in_odst.na_function != n2->in_odst.na_function)
8267 return (12);
8268 if (bcmp((char *)&n1->in_odst.na_addr, (char *)&n2->in_odst.na_addr,
8269 sizeof(n1->in_odst.na_addr)))
8270 return (13);
8271 if (n1->in_osrc.na_atype != n2->in_osrc.na_atype)
8272 return (14);
8273 if (n1->in_osrc.na_function != n2->in_osrc.na_function)
8274 return (15);
8275 if (bcmp((char *)&n1->in_osrc.na_addr, (char *)&n2->in_osrc.na_addr,
8276 sizeof(n1->in_osrc.na_addr)))
8277 return (16);
8278 return (0);
8279 }
8280
8281
8282 /* ------------------------------------------------------------------------ */
8283 /* Function: ipf_nat_rule_init */
8284 /* Returns: int - 0 == success, else rules do not match. */
8285 /* Parameters: softc(I) - pointer to soft context main structure */
8286 /* softn(I) - pointer to NAT context structure */
8287 /* n(I) - first rule to compare */
8288 /* */
8289 /* ------------------------------------------------------------------------ */
8290 static int
ipf_nat_rule_init(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * n)8291 ipf_nat_rule_init(ipf_main_softc_t *softc, ipf_nat_softc_t *softn,
8292 ipnat_t *n)
8293 {
8294 int error = 0;
8295
8296 if ((n->in_flags & IPN_SIPRANGE) != 0)
8297 n->in_nsrcatype = FRI_RANGE;
8298
8299 if ((n->in_flags & IPN_DIPRANGE) != 0)
8300 n->in_ndstatype = FRI_RANGE;
8301
8302 if ((n->in_flags & IPN_SPLIT) != 0)
8303 n->in_ndstatype = FRI_SPLIT;
8304
8305 if ((n->in_redir & (NAT_MAP|NAT_REWRITE|NAT_DIVERTUDP)) != 0)
8306 n->in_spnext = n->in_spmin;
8307
8308 if ((n->in_redir & (NAT_REWRITE|NAT_DIVERTUDP)) != 0) {
8309 n->in_dpnext = n->in_dpmin;
8310 } else if (n->in_redir == NAT_REDIRECT) {
8311 n->in_dpnext = n->in_dpmin;
8312 }
8313
8314 n->in_stepnext = 0;
8315
8316 switch (n->in_v[0])
8317 {
8318 case 4 :
8319 error = ipf_nat_ruleaddrinit(softc, softn, n);
8320 if (error != 0)
8321 return (error);
8322 break;
8323 #ifdef USE_INET6
8324 case 6 :
8325 error = ipf_nat6_ruleaddrinit(softc, softn, n);
8326 if (error != 0)
8327 return (error);
8328 break;
8329 #endif
8330 default :
8331 break;
8332 }
8333
8334 if (n->in_redir == (NAT_DIVERTUDP|NAT_MAP)) {
8335 /*
8336 * Prerecord whether or not the destination of the divert
8337 * is local or not to the interface the packet is going
8338 * to be sent out.
8339 */
8340 n->in_dlocal = ipf_deliverlocal(softc, n->in_v[1],
8341 n->in_ifps[1], &n->in_ndstip6);
8342 }
8343
8344 return (error);
8345 }
8346
8347
8348 /* ------------------------------------------------------------------------ */
8349 /* Function: ipf_nat_rule_fini */
8350 /* Returns: int - 0 == success, else rules do not match. */
8351 /* Parameters: softc(I) - pointer to soft context main structure */
8352 /* n(I) - rule to work on */
8353 /* */
8354 /* This function is used to release any objects that were referenced during */
8355 /* the rule initialisation. This is useful both when free'ing the rule and */
8356 /* when handling ioctls that need to initialise these fields but not */
8357 /* actually use them after the ioctl processing has finished. */
8358 /* ------------------------------------------------------------------------ */
8359 static void
ipf_nat_rule_fini(ipf_main_softc_t * softc,ipnat_t * n)8360 ipf_nat_rule_fini(ipf_main_softc_t *softc, ipnat_t *n)
8361 {
8362 if (n->in_odst.na_atype == FRI_LOOKUP && n->in_odst.na_ptr != NULL)
8363 ipf_lookup_deref(softc, n->in_odst.na_type, n->in_odst.na_ptr);
8364
8365 if (n->in_osrc.na_atype == FRI_LOOKUP && n->in_osrc.na_ptr != NULL)
8366 ipf_lookup_deref(softc, n->in_osrc.na_type, n->in_osrc.na_ptr);
8367
8368 if (n->in_ndst.na_atype == FRI_LOOKUP && n->in_ndst.na_ptr != NULL)
8369 ipf_lookup_deref(softc, n->in_ndst.na_type, n->in_ndst.na_ptr);
8370
8371 if (n->in_nsrc.na_atype == FRI_LOOKUP && n->in_nsrc.na_ptr != NULL)
8372 ipf_lookup_deref(softc, n->in_nsrc.na_type, n->in_nsrc.na_ptr);
8373
8374 if (n->in_divmp != NULL)
8375 FREE_MB_T(n->in_divmp);
8376 }
8377