xref: /freebsd/sys/netgraph/ng_nat.c (revision 4543ef516683042d46f3bd3bb8a4f3f746e00499)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright 2005, Gleb Smirnoff <glebius@FreeBSD.org>
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <sys/param.h>
30 #include <sys/systm.h>
31 #include <sys/kernel.h>
32 #include <sys/mbuf.h>
33 #include <sys/malloc.h>
34 #include <sys/ctype.h>
35 #include <sys/errno.h>
36 #include <sys/syslog.h>
37 
38 #include <netinet/in_systm.h>
39 #include <netinet/in.h>
40 #include <netinet/ip.h>
41 #include <netinet/ip_var.h>
42 #include <netinet/tcp.h>
43 #include <machine/in_cksum.h>
44 
45 #include <net/dlt.h>
46 #include <net/ethernet.h>
47 
48 #include <netinet/libalias/alias.h>
49 #include <netinet/libalias/alias_local.h>
50 
51 #include <netgraph/ng_message.h>
52 #include <netgraph/ng_parse.h>
53 #include <netgraph/ng_nat.h>
54 #include <netgraph/netgraph.h>
55 
56 static ng_constructor_t	ng_nat_constructor;
57 static ng_rcvmsg_t	ng_nat_rcvmsg;
58 static ng_shutdown_t	ng_nat_shutdown;
59 static ng_newhook_t	ng_nat_newhook;
60 static ng_rcvdata_t	ng_nat_rcvdata;
61 static ng_disconnect_t	ng_nat_disconnect;
62 
63 static unsigned int	ng_nat_translate_flags(unsigned int x);
64 
65 /* Parse type for struct ng_nat_mode. */
66 static const struct ng_parse_struct_field ng_nat_mode_fields[]
67 	= NG_NAT_MODE_INFO;
68 static const struct ng_parse_type ng_nat_mode_type = {
69 	&ng_parse_struct_type,
70 	&ng_nat_mode_fields
71 };
72 
73 /* Parse type for 'description' field in structs. */
74 static const struct ng_parse_fixedstring_info ng_nat_description_info
75 	= { NG_NAT_DESC_LENGTH };
76 static const struct ng_parse_type ng_nat_description_type = {
77 	&ng_parse_fixedstring_type,
78 	&ng_nat_description_info
79 };
80 
81 /* Parse type for struct ng_nat_redirect_port. */
82 static const struct ng_parse_struct_field ng_nat_redirect_port_fields[]
83 	= NG_NAT_REDIRECT_PORT_TYPE_INFO(&ng_nat_description_type);
84 static const struct ng_parse_type ng_nat_redirect_port_type = {
85 	&ng_parse_struct_type,
86 	&ng_nat_redirect_port_fields
87 };
88 
89 /* Parse type for struct ng_nat_redirect_addr. */
90 static const struct ng_parse_struct_field ng_nat_redirect_addr_fields[]
91 	= NG_NAT_REDIRECT_ADDR_TYPE_INFO(&ng_nat_description_type);
92 static const struct ng_parse_type ng_nat_redirect_addr_type = {
93 	&ng_parse_struct_type,
94 	&ng_nat_redirect_addr_fields
95 };
96 
97 /* Parse type for struct ng_nat_redirect_proto. */
98 static const struct ng_parse_struct_field ng_nat_redirect_proto_fields[]
99 	= NG_NAT_REDIRECT_PROTO_TYPE_INFO(&ng_nat_description_type);
100 static const struct ng_parse_type ng_nat_redirect_proto_type = {
101 	&ng_parse_struct_type,
102 	&ng_nat_redirect_proto_fields
103 };
104 
105 /* Parse type for struct ng_nat_add_server. */
106 static const struct ng_parse_struct_field ng_nat_add_server_fields[]
107 	= NG_NAT_ADD_SERVER_TYPE_INFO;
108 static const struct ng_parse_type ng_nat_add_server_type = {
109 	&ng_parse_struct_type,
110 	&ng_nat_add_server_fields
111 };
112 
113 /* Parse type for one struct ng_nat_listrdrs_entry. */
114 static const struct ng_parse_struct_field ng_nat_listrdrs_entry_fields[]
115 	= NG_NAT_LISTRDRS_ENTRY_TYPE_INFO(&ng_nat_description_type);
116 static const struct ng_parse_type ng_nat_listrdrs_entry_type = {
117 	&ng_parse_struct_type,
118 	&ng_nat_listrdrs_entry_fields
119 };
120 
121 /* Parse type for 'redirects' array in struct ng_nat_list_redirects. */
122 static int
123 ng_nat_listrdrs_ary_getLength(const struct ng_parse_type *type,
124 	const u_char *start, const u_char *buf)
125 {
126 	const struct ng_nat_list_redirects *lr;
127 
128 	lr = (const struct ng_nat_list_redirects *)
129 	    (buf - offsetof(struct ng_nat_list_redirects, redirects));
130 	return lr->total_count;
131 }
132 
133 static const struct ng_parse_array_info ng_nat_listrdrs_ary_info = {
134 	&ng_nat_listrdrs_entry_type,
135 	&ng_nat_listrdrs_ary_getLength,
136 	NULL
137 };
138 static const struct ng_parse_type ng_nat_listrdrs_ary_type = {
139 	&ng_parse_array_type,
140 	&ng_nat_listrdrs_ary_info
141 };
142 
143 /* Parse type for struct ng_nat_list_redirects. */
144 static const struct ng_parse_struct_field ng_nat_list_redirects_fields[]
145 	= NG_NAT_LIST_REDIRECTS_TYPE_INFO(&ng_nat_listrdrs_ary_type);
146 static const struct ng_parse_type ng_nat_list_redirects_type = {
147 	&ng_parse_struct_type,
148 	&ng_nat_list_redirects_fields
149 };
150 
151 /* Parse type for struct ng_nat_libalias_info. */
152 static const struct ng_parse_struct_field ng_nat_libalias_info_fields[]
153 	= NG_NAT_LIBALIAS_INFO;
154 static const struct ng_parse_type ng_nat_libalias_info_type = {
155 	&ng_parse_struct_type,
156 	&ng_nat_libalias_info_fields
157 };
158 
159 /* List of commands and how to convert arguments to/from ASCII. */
160 static const struct ng_cmdlist ng_nat_cmdlist[] = {
161 	{
162 	  NGM_NAT_COOKIE,
163 	  NGM_NAT_SET_IPADDR,
164 	  "setaliasaddr",
165 	  &ng_parse_ipaddr_type,
166 	  NULL
167 	},
168 	{
169 	  NGM_NAT_COOKIE,
170 	  NGM_NAT_SET_MODE,
171 	  "setmode",
172 	  &ng_nat_mode_type,
173 	  NULL
174 	},
175 	{
176 	  NGM_NAT_COOKIE,
177 	  NGM_NAT_SET_TARGET,
178 	  "settarget",
179 	  &ng_parse_ipaddr_type,
180 	  NULL
181 	},
182 	{
183 	  NGM_NAT_COOKIE,
184 	  NGM_NAT_REDIRECT_PORT,
185 	  "redirectport",
186 	  &ng_nat_redirect_port_type,
187 	  &ng_parse_uint32_type
188 	},
189 	{
190 	  NGM_NAT_COOKIE,
191 	  NGM_NAT_REDIRECT_ADDR,
192 	  "redirectaddr",
193 	  &ng_nat_redirect_addr_type,
194 	  &ng_parse_uint32_type
195 	},
196 	{
197 	  NGM_NAT_COOKIE,
198 	  NGM_NAT_REDIRECT_PROTO,
199 	  "redirectproto",
200 	  &ng_nat_redirect_proto_type,
201 	  &ng_parse_uint32_type
202 	},
203 	{
204 	  NGM_NAT_COOKIE,
205 	  NGM_NAT_REDIRECT_DYNAMIC,
206 	  "redirectdynamic",
207 	  &ng_parse_uint32_type,
208 	  NULL
209 	},
210 	{
211 	  NGM_NAT_COOKIE,
212 	  NGM_NAT_REDIRECT_DELETE,
213 	  "redirectdelete",
214 	  &ng_parse_uint32_type,
215 	  NULL
216 	},
217 	{
218 	  NGM_NAT_COOKIE,
219 	  NGM_NAT_ADD_SERVER,
220 	  "addserver",
221 	  &ng_nat_add_server_type,
222 	  NULL
223 	},
224 	{
225 	  NGM_NAT_COOKIE,
226 	  NGM_NAT_LIST_REDIRECTS,
227 	  "listredirects",
228 	  NULL,
229 	  &ng_nat_list_redirects_type
230 	},
231 	{
232 	  NGM_NAT_COOKIE,
233 	  NGM_NAT_PROXY_RULE,
234 	  "proxyrule",
235 	  &ng_parse_string_type,
236 	  NULL
237 	},
238 	{
239 	  NGM_NAT_COOKIE,
240 	  NGM_NAT_LIBALIAS_INFO,
241 	  "libaliasinfo",
242 	  NULL,
243 	  &ng_nat_libalias_info_type
244 	},
245 	{
246 	  NGM_NAT_COOKIE,
247 	  NGM_NAT_SET_DLT,
248 	  "setdlt",
249 	  &ng_parse_uint8_type,
250 	  NULL
251 	},
252 	{
253 	  NGM_NAT_COOKIE,
254 	  NGM_NAT_GET_DLT,
255 	  "getdlt",
256 	  NULL,
257 	  &ng_parse_uint8_type
258 	},
259 	{ 0 }
260 };
261 
262 /* Netgraph node type descriptor. */
263 static struct ng_type typestruct = {
264 	.version =	NG_ABI_VERSION,
265 	.name =		NG_NAT_NODE_TYPE,
266 	.constructor =	ng_nat_constructor,
267 	.rcvmsg =	ng_nat_rcvmsg,
268 	.shutdown =	ng_nat_shutdown,
269 	.newhook =	ng_nat_newhook,
270 	.rcvdata =	ng_nat_rcvdata,
271 	.disconnect =	ng_nat_disconnect,
272 	.cmdlist =	ng_nat_cmdlist,
273 };
274 NETGRAPH_INIT(nat, &typestruct);
275 MODULE_DEPEND(ng_nat, libalias, 1, 1, 1);
276 
277 /* Element for list of redirects. */
278 struct ng_nat_rdr_lst {
279 	STAILQ_ENTRY(ng_nat_rdr_lst) entries;
280 	struct alias_link	*lnk;
281 	struct ng_nat_listrdrs_entry rdr;
282 };
283 STAILQ_HEAD(rdrhead, ng_nat_rdr_lst);
284 
285 /* Information we store for each node. */
286 struct ng_nat_priv {
287 	node_p		node;		/* back pointer to node */
288 	hook_p		in;		/* hook for demasquerading */
289 	hook_p		out;		/* hook for masquerading */
290 	struct libalias	*lib;		/* libalias handler */
291 	uint32_t	flags;		/* status flags */
292 	uint32_t	rdrcount;	/* number or redirects in list */
293 	uint32_t	nextid;		/* for next in turn in list */
294 	struct rdrhead	redirhead;	/* redirect list header */
295 	uint8_t		dlt;		/* DLT_XXX from bpf.h */
296 };
297 typedef struct ng_nat_priv *priv_p;
298 
299 /* Values of flags */
300 #define	NGNAT_CONNECTED		0x1	/* We have both hooks connected */
301 #define	NGNAT_ADDR_DEFINED	0x2	/* NGM_NAT_SET_IPADDR happened */
302 
303 static int
304 ng_nat_constructor(node_p node)
305 {
306 	priv_p priv;
307 
308 	/* Initialize private descriptor. */
309 	priv = malloc(sizeof(*priv), M_NETGRAPH, M_WAITOK | M_ZERO);
310 
311 	/* Init aliasing engine. */
312 	priv->lib = LibAliasInit(NULL);
313 
314 	/* Set same ports on. */
315 	(void )LibAliasSetMode(priv->lib, PKT_ALIAS_SAME_PORTS,
316 	    PKT_ALIAS_SAME_PORTS);
317 
318 	/* Init redirects housekeeping. */
319 	priv->rdrcount = 0;
320 	priv->nextid = 1;
321 	priv->dlt = DLT_RAW;
322 	STAILQ_INIT(&priv->redirhead);
323 
324 	/* Link structs together. */
325 	NG_NODE_SET_PRIVATE(node, priv);
326 	priv->node = node;
327 
328 	/*
329 	 * libalias is not thread safe, so our node
330 	 * must be single threaded.
331 	 */
332 	NG_NODE_FORCE_WRITER(node);
333 
334 	return (0);
335 }
336 
337 static int
338 ng_nat_newhook(node_p node, hook_p hook, const char *name)
339 {
340 	const priv_p priv = NG_NODE_PRIVATE(node);
341 
342 	if (strcmp(name, NG_NAT_HOOK_IN) == 0) {
343 		priv->in = hook;
344 	} else if (strcmp(name, NG_NAT_HOOK_OUT) == 0) {
345 		priv->out = hook;
346 	} else
347 		return (EINVAL);
348 
349 	if (priv->out != NULL &&
350 	    priv->in != NULL)
351 		priv->flags |= NGNAT_CONNECTED;
352 
353 	return(0);
354 }
355 
356 static int
357 ng_nat_rcvmsg(node_p node, item_p item, hook_p lasthook)
358 {
359 	const priv_p priv = NG_NODE_PRIVATE(node);
360 	struct ng_mesg *resp = NULL;
361 	struct ng_mesg *msg;
362 	int error = 0;
363 
364 	NGI_GET_MSG(item, msg);
365 
366 	switch (msg->header.typecookie) {
367 	case NGM_NAT_COOKIE:
368 		switch (msg->header.cmd) {
369 		case NGM_NAT_SET_IPADDR:
370 		    {
371 			struct in_addr *const ia = (struct in_addr *)msg->data;
372 
373 			if (msg->header.arglen < sizeof(*ia)) {
374 				error = EINVAL;
375 				break;
376 			}
377 
378 			LibAliasSetAddress(priv->lib, *ia);
379 
380 			priv->flags |= NGNAT_ADDR_DEFINED;
381 		    }
382 			break;
383 		case NGM_NAT_SET_MODE:
384 		    {
385 			struct ng_nat_mode *const mode =
386 			    (struct ng_nat_mode *)msg->data;
387 
388 			if (msg->header.arglen < sizeof(*mode)) {
389 				error = EINVAL;
390 				break;
391 			}
392 
393 			if (LibAliasSetMode(priv->lib,
394 			    ng_nat_translate_flags(mode->flags),
395 			    ng_nat_translate_flags(mode->mask)) < 0) {
396 				error = ENOMEM;
397 				break;
398 			}
399 		    }
400 			break;
401 		case NGM_NAT_SET_TARGET:
402 		    {
403 			struct in_addr *const ia = (struct in_addr *)msg->data;
404 
405 			if (msg->header.arglen < sizeof(*ia)) {
406 				error = EINVAL;
407 				break;
408 			}
409 
410 			LibAliasSetTarget(priv->lib, *ia);
411 		    }
412 			break;
413 		case NGM_NAT_REDIRECT_PORT:
414 		    {
415 			struct ng_nat_rdr_lst *entry;
416 			struct ng_nat_redirect_port *const rp =
417 			    (struct ng_nat_redirect_port *)msg->data;
418 
419 			if (msg->header.arglen < sizeof(*rp)) {
420 				error = EINVAL;
421 				break;
422 			}
423 
424 			if ((entry = malloc(sizeof(struct ng_nat_rdr_lst),
425 			    M_NETGRAPH, M_NOWAIT | M_ZERO)) == NULL) {
426 				error = ENOMEM;
427 				break;
428 			}
429 
430 			/* Try actual redirect. */
431 			entry->lnk = LibAliasRedirectPort(priv->lib,
432 				rp->local_addr, htons(rp->local_port),
433 				rp->remote_addr, htons(rp->remote_port),
434 				rp->alias_addr, htons(rp->alias_port),
435 				rp->proto);
436 
437 			if (entry->lnk == NULL) {
438 				error = ENOMEM;
439 				free(entry, M_NETGRAPH);
440 				break;
441 			}
442 
443 			/* Successful, save info in our internal list. */
444 			entry->rdr.local_addr = rp->local_addr;
445 			entry->rdr.alias_addr = rp->alias_addr;
446 			entry->rdr.remote_addr = rp->remote_addr;
447 			entry->rdr.local_port = rp->local_port;
448 			entry->rdr.alias_port = rp->alias_port;
449 			entry->rdr.remote_port = rp->remote_port;
450 			entry->rdr.proto = rp->proto;
451 			bcopy(rp->description, entry->rdr.description,
452 			    NG_NAT_DESC_LENGTH);
453 
454 			/* Safety precaution. */
455 			entry->rdr.description[NG_NAT_DESC_LENGTH-1] = '\0';
456 
457 			entry->rdr.id = priv->nextid++;
458 			priv->rdrcount++;
459 
460 			/* Link to list of redirects. */
461 			STAILQ_INSERT_TAIL(&priv->redirhead, entry, entries);
462 
463 			/* Response with id of newly added entry. */
464 			NG_MKRESPONSE(resp, msg, sizeof(entry->rdr.id), M_NOWAIT);
465 			if (resp == NULL) {
466 				error = ENOMEM;
467 				break;
468 			}
469 			bcopy(&entry->rdr.id, resp->data, sizeof(entry->rdr.id));
470 		    }
471 			break;
472 		case NGM_NAT_REDIRECT_ADDR:
473 		    {
474 			struct ng_nat_rdr_lst *entry;
475 			struct ng_nat_redirect_addr *const ra =
476 			    (struct ng_nat_redirect_addr *)msg->data;
477 
478 			if (msg->header.arglen < sizeof(*ra)) {
479 				error = EINVAL;
480 				break;
481 			}
482 
483 			if ((entry = malloc(sizeof(struct ng_nat_rdr_lst),
484 			    M_NETGRAPH, M_NOWAIT | M_ZERO)) == NULL) {
485 				error = ENOMEM;
486 				break;
487 			}
488 
489 			/* Try actual redirect. */
490 			entry->lnk = LibAliasRedirectAddr(priv->lib,
491 				ra->local_addr, ra->alias_addr);
492 
493 			if (entry->lnk == NULL) {
494 				error = ENOMEM;
495 				free(entry, M_NETGRAPH);
496 				break;
497 			}
498 
499 			/* Successful, save info in our internal list. */
500 			entry->rdr.local_addr = ra->local_addr;
501 			entry->rdr.alias_addr = ra->alias_addr;
502 			entry->rdr.proto = NG_NAT_REDIRPROTO_ADDR;
503 			bcopy(ra->description, entry->rdr.description,
504 			    NG_NAT_DESC_LENGTH);
505 
506 			/* Safety precaution. */
507 			entry->rdr.description[NG_NAT_DESC_LENGTH-1] = '\0';
508 
509 			entry->rdr.id = priv->nextid++;
510 			priv->rdrcount++;
511 
512 			/* Link to list of redirects. */
513 			STAILQ_INSERT_TAIL(&priv->redirhead, entry, entries);
514 
515 			/* Response with id of newly added entry. */
516 			NG_MKRESPONSE(resp, msg, sizeof(entry->rdr.id), M_NOWAIT);
517 			if (resp == NULL) {
518 				error = ENOMEM;
519 				break;
520 			}
521 			bcopy(&entry->rdr.id, resp->data, sizeof(entry->rdr.id));
522 		    }
523 			break;
524 		case NGM_NAT_REDIRECT_PROTO:
525 		    {
526 			struct ng_nat_rdr_lst *entry;
527 			struct ng_nat_redirect_proto *const rp =
528 			    (struct ng_nat_redirect_proto *)msg->data;
529 
530 			if (msg->header.arglen < sizeof(*rp)) {
531 				error = EINVAL;
532 				break;
533 			}
534 
535 			if ((entry = malloc(sizeof(struct ng_nat_rdr_lst),
536 			    M_NETGRAPH, M_NOWAIT | M_ZERO)) == NULL) {
537 				error = ENOMEM;
538 				break;
539 			}
540 
541 			/* Try actual redirect. */
542 			entry->lnk = LibAliasRedirectProto(priv->lib,
543 				rp->local_addr, rp->remote_addr,
544 				rp->alias_addr, rp->proto);
545 
546 			if (entry->lnk == NULL) {
547 				error = ENOMEM;
548 				free(entry, M_NETGRAPH);
549 				break;
550 			}
551 
552 			/* Successful, save info in our internal list. */
553 			entry->rdr.local_addr = rp->local_addr;
554 			entry->rdr.alias_addr = rp->alias_addr;
555 			entry->rdr.remote_addr = rp->remote_addr;
556 			entry->rdr.proto = rp->proto;
557 			bcopy(rp->description, entry->rdr.description,
558 			    NG_NAT_DESC_LENGTH);
559 
560 			/* Safety precaution. */
561 			entry->rdr.description[NG_NAT_DESC_LENGTH-1] = '\0';
562 
563 			entry->rdr.id = priv->nextid++;
564 			priv->rdrcount++;
565 
566 			/* Link to list of redirects. */
567 			STAILQ_INSERT_TAIL(&priv->redirhead, entry, entries);
568 
569 			/* Response with id of newly added entry. */
570 			NG_MKRESPONSE(resp, msg, sizeof(entry->rdr.id), M_NOWAIT);
571 			if (resp == NULL) {
572 				error = ENOMEM;
573 				break;
574 			}
575 			bcopy(&entry->rdr.id, resp->data, sizeof(entry->rdr.id));
576 		    }
577 			break;
578 		case NGM_NAT_REDIRECT_DYNAMIC:
579 		case NGM_NAT_REDIRECT_DELETE:
580 		    {
581 			struct ng_nat_rdr_lst *entry;
582 			uint32_t *const id = (uint32_t *)msg->data;
583 
584 			if (msg->header.arglen < sizeof(*id)) {
585 				error = EINVAL;
586 				break;
587 			}
588 
589 			/* Find entry with supplied id. */
590 			STAILQ_FOREACH(entry, &priv->redirhead, entries) {
591 				if (entry->rdr.id == *id)
592 					break;
593 			}
594 
595 			/* Not found. */
596 			if (entry == NULL) {
597 				error = ENOENT;
598 				break;
599 			}
600 
601 			if (msg->header.cmd == NGM_NAT_REDIRECT_DYNAMIC) {
602 				if (LibAliasRedirectDynamic(priv->lib,
603 				    entry->lnk) == -1) {
604 					error = ENOTTY;	/* XXX Something better? */
605 					break;
606 				}
607 			} else {	/* NGM_NAT_REDIRECT_DELETE */
608 				LibAliasRedirectDelete(priv->lib, entry->lnk);
609 			}
610 
611 			/* Delete entry from our internal list. */
612 			priv->rdrcount--;
613 			STAILQ_REMOVE(&priv->redirhead, entry, ng_nat_rdr_lst, entries);
614 			free(entry, M_NETGRAPH);
615 		    }
616 			break;
617 		case NGM_NAT_ADD_SERVER:
618 		    {
619 			struct ng_nat_rdr_lst *entry;
620 			struct ng_nat_add_server *const as =
621 			    (struct ng_nat_add_server *)msg->data;
622 
623 			if (msg->header.arglen < sizeof(*as)) {
624 				error = EINVAL;
625 				break;
626 			}
627 
628 			/* Find entry with supplied id. */
629 			STAILQ_FOREACH(entry, &priv->redirhead, entries) {
630 				if (entry->rdr.id == as->id)
631 					break;
632 			}
633 
634 			/* Not found. */
635 			if (entry == NULL) {
636 				error = ENOENT;
637 				break;
638 			}
639 
640 			if (LibAliasAddServer(priv->lib, entry->lnk,
641 			    as->addr, htons(as->port)) == -1) {
642 				error = ENOMEM;
643 				break;
644 			}
645 
646 			entry->rdr.lsnat++;
647 		    }
648 			break;
649 		case NGM_NAT_LIST_REDIRECTS:
650 		    {
651 			struct ng_nat_rdr_lst *entry;
652 			struct ng_nat_list_redirects *ary;
653 			int i = 0;
654 
655 			NG_MKRESPONSE(resp, msg, sizeof(*ary) +
656 			    (priv->rdrcount) * sizeof(*entry), M_NOWAIT);
657 			if (resp == NULL) {
658 				error = ENOMEM;
659 				break;
660 			}
661 
662 			ary = (struct ng_nat_list_redirects *)resp->data;
663 			ary->total_count = priv->rdrcount;
664 
665 			STAILQ_FOREACH(entry, &priv->redirhead, entries) {
666 				bcopy(&entry->rdr, &ary->redirects[i++],
667 				    sizeof(struct ng_nat_listrdrs_entry));
668 			}
669 		    }
670 			break;
671 		case NGM_NAT_PROXY_RULE:
672 		    {
673 			char *cmd = (char *)msg->data;
674 
675 			if (msg->header.arglen < 6) {
676 				error = EINVAL;
677 				break;
678 			}
679 
680 			if (LibAliasProxyRule(priv->lib, cmd) != 0)
681 				error = ENOMEM;
682 		    }
683 			break;
684 		case NGM_NAT_LIBALIAS_INFO:
685 		    {
686 			struct ng_nat_libalias_info *i;
687 
688 			NG_MKRESPONSE(resp, msg,
689 			    sizeof(struct ng_nat_libalias_info), M_NOWAIT);
690 			if (resp == NULL) {
691 				error = ENOMEM;
692 				break;
693 			}
694 			i = (struct ng_nat_libalias_info *)resp->data;
695 #define	COPY(F)	do {						\
696 	if (priv->lib->F >= 0 && priv->lib->F < UINT32_MAX)	\
697 		i->F = priv->lib->F;				\
698 	else							\
699 		i->F = UINT32_MAX;				\
700 } while (0)
701 
702 			COPY(icmpLinkCount);
703 			COPY(udpLinkCount);
704 			COPY(tcpLinkCount);
705 			COPY(pptpLinkCount);
706 			COPY(sctpLinkCount);
707 			COPY(protoLinkCount);
708 			COPY(fragmentIdLinkCount);
709 			COPY(fragmentPtrLinkCount);
710 			COPY(sockCount);
711 #undef COPY
712 		    }
713 			break;
714 		case NGM_NAT_SET_DLT:
715 			if (msg->header.arglen != sizeof(uint8_t)) {
716 				error = EINVAL;
717 				break;
718 			}
719 			switch (*(uint8_t *) msg->data) {
720 			case DLT_EN10MB:
721 			case DLT_RAW:
722 				priv->dlt = *(uint8_t *) msg->data;
723 				break;
724 			default:
725 				error = EINVAL;
726 				break;
727 			}
728 			break;
729 		default:
730 			error = EINVAL;		/* unknown command */
731 			break;
732 		}
733 		break;
734 		case NGM_NAT_GET_DLT:
735 			NG_MKRESPONSE(resp, msg, sizeof(uint8_t), M_WAITOK);
736                         if (resp == NULL) {
737                                 error = ENOMEM;
738 				break;
739 			}
740 			*((uint8_t *) resp->data) = priv->dlt;
741 			break;
742 	default:
743 		error = EINVAL;			/* unknown cookie type */
744 		break;
745 	}
746 
747 	NG_RESPOND_MSG(error, node, item, resp);
748 	NG_FREE_MSG(msg);
749 	return (error);
750 }
751 
752 static int
753 ng_nat_rcvdata(hook_p hook, item_p item )
754 {
755 	const priv_p priv = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
756 	struct mbuf	*m;
757 	struct ip	*ip;
758 	int rval, ipofs, error = 0;
759 	char *c;
760 
761 	/* We have no required hooks. */
762 	if (!(priv->flags & NGNAT_CONNECTED)) {
763 		NG_FREE_ITEM(item);
764 		return (ENXIO);
765 	}
766 
767 	/* We have no alias address yet to do anything. */
768 	if (!(priv->flags & NGNAT_ADDR_DEFINED))
769 		goto send;
770 
771 	m = NGI_M(item);
772 
773 	if ((m = m_megapullup(m, m->m_pkthdr.len)) == NULL) {
774 		NGI_M(item) = NULL;	/* avoid double free */
775 		NG_FREE_ITEM(item);
776 		return (ENOBUFS);
777 	}
778 
779 	NGI_M(item) = m;
780 
781 	switch (priv->dlt) {
782 	case DLT_RAW:
783 		ipofs = 0;
784 		break;
785 	case DLT_EN10MB:
786 	    {
787 		struct ether_header *eh;
788 
789 		if (m->m_pkthdr.len < sizeof(struct ether_header)) {
790 			NG_FREE_ITEM(item);
791 			return (ENXIO);
792 		}
793 		eh = mtod(m, struct ether_header *);
794 		switch (ntohs(eh->ether_type)) {
795 		case ETHERTYPE_IP:
796 			ipofs = sizeof(struct ether_header);
797 			break;
798 		default:
799 			goto send;
800 		}
801 		break;
802 	    }
803 	default:
804 		panic("Corrupted priv->dlt: %u", priv->dlt);
805 	}
806 
807 	if (m->m_pkthdr.len < ipofs + sizeof(struct ip))
808 		goto send;		/* packet too short to hold IP */
809 
810 	c = (char *)mtodo(m, ipofs);
811 	ip = (struct ip *)mtodo(m, ipofs);
812 
813 	if (ip->ip_v != IPVERSION)
814 		goto send;		/* other IP version, let it pass */
815 	if (m->m_pkthdr.len < ipofs + ntohs(ip->ip_len))
816 		goto send;		/* packet too short (i.e. fragmented or broken) */
817 
818 	/*
819 	 * We drop packet when:
820 	 * 1. libalias returns PKT_ALIAS_ERROR;
821 	 * 2. For incoming packets:
822 	 *	a) for unresolved fragments;
823 	 *	b) libalias returns PKT_ALIAS_IGNORED and
824 	 *		PKT_ALIAS_DENY_INCOMING flag is set.
825 	 */
826 	if (hook == priv->in) {
827 		rval = LibAliasIn(priv->lib, c, m->m_len - ipofs +
828 		    M_TRAILINGSPACE(m));
829 		if (rval == PKT_ALIAS_ERROR ||
830 		    rval == PKT_ALIAS_UNRESOLVED_FRAGMENT ||
831 		    (rval == PKT_ALIAS_IGNORED &&
832 		     (priv->lib->packetAliasMode &
833 		      PKT_ALIAS_DENY_INCOMING) != 0)) {
834 			NG_FREE_ITEM(item);
835 			return (EINVAL);
836 		}
837 	} else if (hook == priv->out) {
838 		rval = LibAliasOut(priv->lib, c, m->m_len - ipofs +
839 		    M_TRAILINGSPACE(m));
840 		if (rval == PKT_ALIAS_ERROR) {
841 			NG_FREE_ITEM(item);
842 			return (EINVAL);
843 		}
844 	} else
845 		panic("ng_nat: unknown hook!\n");
846 
847 	if (rval == PKT_ALIAS_RESPOND)
848 		m->m_flags |= M_SKIP_FIREWALL;
849 	m->m_pkthdr.len = m->m_len = ntohs(ip->ip_len) + ipofs;
850 
851 	if ((ip->ip_off & htons(IP_OFFMASK)) == 0 &&
852 	    ip->ip_p == IPPROTO_TCP) {
853 		struct tcphdr *th = (struct tcphdr *)((caddr_t)ip +
854 		    (ip->ip_hl << 2));
855 
856 		/*
857 		 * Here is our terrible HACK.
858 		 *
859 		 * Sometimes LibAlias edits contents of TCP packet.
860 		 * In this case it needs to recompute full TCP
861 		 * checksum. However, the problem is that LibAlias
862 		 * doesn't have any idea about checksum offloading
863 		 * in kernel. To workaround this, we do not do
864 		 * checksumming in LibAlias, but only mark the
865 		 * packets with TH_RES1 in the th_x2 field. If we
866 		 * receive a marked packet, we calculate correct
867 		 * checksum for it aware of offloading.
868 		 *
869 		 * Why do I do such a terrible hack instead of
870 		 * recalculating checksum for each packet?
871 		 * Because the previous checksum was not checked!
872 		 * Recalculating checksums for EVERY packet will
873 		 * hide ALL transmission errors. Yes, marked packets
874 		 * still suffer from this problem. But, sigh, natd(8)
875 		 * has this problem, too.
876 		 */
877 
878 		if (tcp_get_flags(th) & TH_RES1) {
879 			uint16_t ip_len = ntohs(ip->ip_len);
880 
881 			tcp_set_flags(th, tcp_get_flags(th) & ~TH_RES1);
882 			th->th_sum = in_pseudo(ip->ip_src.s_addr,
883 			    ip->ip_dst.s_addr, htons(IPPROTO_TCP +
884 			    ip_len - (ip->ip_hl << 2)));
885 
886 			if ((m->m_pkthdr.csum_flags & CSUM_TCP) == 0) {
887 				m->m_pkthdr.csum_data = offsetof(struct tcphdr,
888 				    th_sum);
889 				in_delayed_cksum(m);
890 			}
891 		}
892 	}
893 
894 send:
895 	if (hook == priv->in)
896 		NG_FWD_ITEM_HOOK(error, item, priv->out);
897 	else
898 		NG_FWD_ITEM_HOOK(error, item, priv->in);
899 
900 	return (error);
901 }
902 
903 static int
904 ng_nat_shutdown(node_p node)
905 {
906 	const priv_p priv = NG_NODE_PRIVATE(node);
907 
908 	NG_NODE_SET_PRIVATE(node, NULL);
909 	NG_NODE_UNREF(node);
910 
911 	/* Free redirects list. */
912 	while (!STAILQ_EMPTY(&priv->redirhead)) {
913 		struct ng_nat_rdr_lst *entry = STAILQ_FIRST(&priv->redirhead);
914 		STAILQ_REMOVE_HEAD(&priv->redirhead, entries);
915 		free(entry, M_NETGRAPH);
916 	}
917 
918 	/* Final free. */
919 	LibAliasUninit(priv->lib);
920 	free(priv, M_NETGRAPH);
921 
922 	return (0);
923 }
924 
925 static int
926 ng_nat_disconnect(hook_p hook)
927 {
928 	const priv_p priv = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
929 
930 	priv->flags &= ~NGNAT_CONNECTED;
931 
932 	if (hook == priv->out)
933 		priv->out = NULL;
934 	if (hook == priv->in)
935 		priv->in = NULL;
936 
937 	if (priv->out == NULL && priv->in == NULL)
938 		ng_rmnode_self(NG_HOOK_NODE(hook));
939 
940 	return (0);
941 }
942 
943 static unsigned int
944 ng_nat_translate_flags(unsigned int x)
945 {
946 	unsigned int	res = 0;
947 
948 	if (x & NG_NAT_LOG)
949 		res |= PKT_ALIAS_LOG;
950 	if (x & NG_NAT_DENY_INCOMING)
951 		res |= PKT_ALIAS_DENY_INCOMING;
952 	if (x & NG_NAT_SAME_PORTS)
953 		res |= PKT_ALIAS_SAME_PORTS;
954 	if (x & NG_NAT_UNREGISTERED_ONLY)
955 		res |= PKT_ALIAS_UNREGISTERED_ONLY;
956 	if (x & NG_NAT_RESET_ON_ADDR_CHANGE)
957 		res |= PKT_ALIAS_RESET_ON_ADDR_CHANGE;
958 	if (x & NG_NAT_PROXY_ONLY)
959 		res |= PKT_ALIAS_PROXY_ONLY;
960 	if (x & NG_NAT_REVERSE)
961 		res |= PKT_ALIAS_REVERSE;
962 	if (x & NG_NAT_UNREGISTERED_CGN)
963 		res |= PKT_ALIAS_UNREGISTERED_CGN;
964 
965 	return (res);
966 }
967