1 /*
2 * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
3 * Use is subject to license terms.
4 */
5
6 #if defined(KERNEL) || defined(_KERNEL)
7 # undef KERNEL
8 # undef _KERNEL
9 # define KERNEL 1
10 # define _KERNEL 1
11 #endif
12 #include <sys/errno.h>
13 #include <sys/types.h>
14 #include <sys/param.h>
15 #include <sys/time.h>
16 #if defined(__NetBSD__)
17 # if (NetBSD >= 199905) && !defined(IPFILTER_LKM) && defined(_KERNEL)
18 # include "opt_ipfilter_log.h"
19 # endif
20 #endif
21 #if defined(_KERNEL) && defined(__FreeBSD_version) && \
22 (__FreeBSD_version >= 220000)
23 # if (__FreeBSD_version >= 400000)
24 # if !defined(IPFILTER_LKM)
25 # include "opt_inet6.h"
26 # endif
27 # if (__FreeBSD_version == 400019)
28 # define CSUM_DELAY_DATA
29 # endif
30 # endif
31 # include <sys/filio.h>
32 #else
33 # include <sys/ioctl.h>
34 #endif
35 #if !defined(_AIX51)
36 # include <sys/fcntl.h>
37 #endif
38 #if defined(_KERNEL)
39 # include <sys/systm.h>
40 # include <sys/file.h>
41 #else
42 # include <stdio.h>
43 # include <string.h>
44 # include <stdlib.h>
45 # include <stddef.h>
46 # include <sys/file.h>
47 # define _KERNEL
48 # ifdef __OpenBSD__
49 struct file;
50 # endif
51 # include <sys/uio.h>
52 # undef _KERNEL
53 #endif
54 #if !defined(__SVR4) && !defined(__svr4__) && !defined(__hpux) && \
55 !defined(linux)
56 # include <sys/mbuf.h>
57 #else
58 # if !defined(linux)
59 # include <sys/byteorder.h>
60 # endif
61 # if (SOLARIS2 < 5) && defined(sun)
62 # include <sys/dditypes.h>
63 # endif
64 #endif
65 #ifdef __hpux
66 # define _NET_ROUTE_INCLUDED
67 #endif
68 #if !defined(linux)
69 # include <sys/protosw.h>
70 #endif
71 #include <sys/socket.h>
72 #include <net/if.h>
73 #ifdef sun
74 # include <net/af.h>
75 #endif
76 #if !defined(_KERNEL) && defined(__FreeBSD__)
77 # include "radix_ipf.h"
78 #endif
79 #include <net/route.h>
80 #include <netinet/in.h>
81 #include <netinet/in_systm.h>
82 #include <netinet/ip.h>
83 #if !defined(linux)
84 # include <netinet/ip_var.h>
85 #endif
86 #if defined(__sgi) && defined(IFF_DRVRLOCK) /* IRIX 6 */
87 # include <sys/hashing.h>
88 # include <netinet/in_var.h>
89 #endif
90 #include <netinet/tcp.h>
91 #if (!defined(__sgi) && !defined(AIX)) || defined(_KERNEL)
92 # include <netinet/udp.h>
93 # include <netinet/ip_icmp.h>
94 #endif
95 #ifdef __hpux
96 # undef _NET_ROUTE_INCLUDED
97 #endif
98 #include "netinet/ip_compat.h"
99 #ifdef USE_INET6
100 # include <netinet/icmp6.h>
101 # if !defined(SOLARIS) && defined(_KERNEL) && !defined(__osf__) && \
102 !defined(__hpux)
103 # include <netinet6/in6_var.h>
104 # endif
105 #endif
106 #include <netinet/tcpip.h>
107 #include "netinet/ip_fil.h"
108 #include "netinet/ip_nat.h"
109 #include "netinet/ip_frag.h"
110 #include "netinet/ip_state.h"
111 #include "netinet/ip_proxy.h"
112 #include "netinet/ip_auth.h"
113 #include "netinet/ipf_stack.h"
114 #ifdef IPFILTER_SCAN
115 # include "netinet/ip_scan.h"
116 #endif
117 #ifdef IPFILTER_SYNC
118 # include "netinet/ip_sync.h"
119 #endif
120 #include "netinet/ip_pool.h"
121 #include "netinet/ip_htable.h"
122 #ifdef IPFILTER_COMPILED
123 # include "netinet/ip_rules.h"
124 #endif
125 #if defined(IPFILTER_BPF) && defined(_KERNEL)
126 # include <net/bpf.h>
127 #endif
128 #if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000)
129 # include <sys/malloc.h>
130 # if defined(_KERNEL) && !defined(IPFILTER_LKM)
131 # include "opt_ipfilter.h"
132 # endif
133 #endif
134 #include "netinet/ipl.h"
135 /* END OF INCLUDES */
136
137 #ifdef IPFILTER_COMPAT
138
139 # define IPFILTER_VERSION_4010900 4010900
140
141 struct nat_4010900 {
142 ipfmutex_t nat_lock;
143 struct nat *nat_next;
144 struct nat **nat_pnext;
145 struct nat *nat_hnext[2];
146 struct nat **nat_phnext[2];
147 struct hostmap *nat_hm;
148 void *nat_data;
149 struct nat **nat_me;
150 struct ipstate *nat_state;
151 struct ap_session *nat_aps; /* proxy session */
152 frentry_t *nat_fr; /* filter rule ptr if appropriate */
153 struct ipnat *nat_ptr; /* pointer back to the rule */
154 void *nat_ifps[2];
155 void *nat_sync;
156 ipftqent_t nat_tqe;
157 u_32_t nat_flags;
158 u_32_t nat_sumd[2]; /* ip checksum delta for data segment */
159 u_32_t nat_ipsumd; /* ip checksum delta for ip header */
160 u_32_t nat_mssclamp; /* if != zero clamp MSS to this */
161 i6addr_t nat_inip6;
162 i6addr_t nat_outip6;
163 i6addr_t nat_oip6; /* other ip */
164 U_QUAD_T nat_pkts[2];
165 U_QUAD_T nat_bytes[2];
166 union {
167 udpinfo_t nat_unu;
168 tcpinfo_t nat_unt;
169 icmpinfo_t nat_uni;
170 greinfo_t nat_ugre;
171 } nat_un;
172 u_short nat_oport; /* other port */
173 u_short nat_use;
174 u_char nat_p; /* protocol for NAT */
175 int nat_dir;
176 int nat_ref; /* reference count */
177 int nat_hv[2];
178 char nat_ifnames[2][LIFNAMSIZ];
179 int nat_rev; /* 0 = forward, 1 = reverse */
180 int nat_redir;
181 };
182
183 struct nat_save_4010900 {
184 void *ipn_next;
185 struct nat_4010900 ipn_nat;
186 struct ipnat ipn_ipnat;
187 struct frentry ipn_fr;
188 int ipn_dsize;
189 char ipn_data[4];
190 };
191
192 struct natlookup_4010900 {
193 struct in_addr nlc_inip;
194 struct in_addr nlc_outip;
195 struct in_addr nlc_realip;
196 int nlc_flags;
197 u_short nlc_inport;
198 u_short nlc_outport;
199 u_short nlc_realport;
200 };
201
202
203 /* ------------------------------------------------------------------------ */
204 /* Function: fr_incomptrans */
205 /* Returns: int - 0 = success, else failure */
206 /* Parameters: obj(I) - pointer to ioctl data */
207 /* ptr(I) - pointer to store real data in */
208 /* */
209 /* Translate the copied in ipfobj_t to new for backward compatibility at */
210 /* the ABI for user land. */
211 /* ------------------------------------------------------------------------ */
fr_incomptrans(obj,ptr)212 int fr_incomptrans(obj, ptr)
213 ipfobj_t *obj;
214 void *ptr;
215 {
216 int error;
217 natlookup_t *nlp;
218 nat_save_t *nsp;
219 struct nat_save_4010900 nsc;
220 struct natlookup_4010900 nlc;
221
222 switch (obj->ipfo_type)
223 {
224 case IPFOBJ_NATLOOKUP :
225 if ((obj->ipfo_rev != IPFILTER_VERSION_4010900) ||
226 (obj->ipfo_size != sizeof (nlc)))
227 return EINVAL;
228 error = COPYIN((caddr_t)obj->ipfo_ptr, (caddr_t)&nlc,
229 obj->ipfo_size);
230 if (!error) {
231 nlp = (natlookup_t *)ptr;
232 bzero((char *)nlp, sizeof (*nlp));
233 nlp->nl_inip = nlc.nlc_inip;
234 nlp->nl_outip = nlc.nlc_outip;
235 nlp->nl_inport = nlc.nlc_inport;
236 nlp->nl_outport = nlc.nlc_outport;
237 nlp->nl_flags = nlc.nlc_flags;
238 nlp->nl_v = 4;
239 }
240 break;
241 case IPFOBJ_NATSAVE :
242 if ((obj->ipfo_rev != IPFILTER_VERSION_4010900) ||
243 (obj->ipfo_size != sizeof (nsc)))
244 return EINVAL;
245 error = COPYIN((caddr_t)obj->ipfo_ptr, (caddr_t)&nsc,
246 obj->ipfo_size);
247 if (!error) {
248 nsp = (nat_save_t *)ptr;
249 bzero((char *)nsp, sizeof (*nsp));
250 nsp->ipn_next = nsc.ipn_next;
251 nsp->ipn_dsize = nsc.ipn_dsize;
252 nsp->ipn_nat.nat_inip = nsc.ipn_nat.nat_inip;
253 nsp->ipn_nat.nat_outip = nsc.ipn_nat.nat_outip;
254 nsp->ipn_nat.nat_oip = nsc.ipn_nat.nat_oip;
255 nsp->ipn_nat.nat_inport = nsc.ipn_nat.nat_inport;
256 nsp->ipn_nat.nat_outport = nsc.ipn_nat.nat_outport;
257 nsp->ipn_nat.nat_oport = nsc.ipn_nat.nat_oport;
258 nsp->ipn_nat.nat_flags = nsc.ipn_nat.nat_flags;
259 nsp->ipn_nat.nat_v = 4;
260 }
261 break;
262 default :
263 return EINVAL;
264 }
265 return error;
266 }
267
268 /* ------------------------------------------------------------------------ */
269 /* Function: fr_outcomptrans */
270 /* Returns: int - 0 = success, else failure */
271 /* Parameters: obj(I) - pointer to ioctl data */
272 /* ptr(I) - pointer to store real data in */
273 /* */
274 /* Translate the copied out ipfobj_t to new definition for backward */
275 /* compatibility at the ABI for user land. */
276 /* ------------------------------------------------------------------------ */
fr_outcomptrans(obj,ptr)277 int fr_outcomptrans(obj, ptr)
278 ipfobj_t *obj;
279 void *ptr;
280 {
281 int error;
282 natlookup_t *nlp;
283 struct natlookup_4010900 nlc;
284
285 switch (obj->ipfo_type)
286 {
287 case IPFOBJ_NATLOOKUP :
288 if ((obj->ipfo_rev != IPFILTER_VERSION_4010900) ||
289 (obj->ipfo_size != sizeof (nlc)))
290 return EINVAL;
291 bzero((char *)&nlc, sizeof (nlc));
292 nlp = (natlookup_t *)ptr;
293 nlc.nlc_inip = nlp->nl_inip;
294 nlc.nlc_outip = nlp->nl_outip;
295 nlc.nlc_realip = nlp->nl_realip;
296 nlc.nlc_inport = nlp->nl_inport;
297 nlc.nlc_outport = nlp->nl_outport;
298 nlc.nlc_realport = nlp->nl_realport;
299 nlc.nlc_flags = nlp->nl_flags;
300 error = COPYOUT((caddr_t)&nlc, (caddr_t)obj->ipfo_ptr,
301 obj->ipfo_size);
302 break;
303 default :
304 return EINVAL;
305 }
306 return error;
307 }
308
309 #endif /* IPFILTER_COMPAT */
310