1ab25eeb5Syz155240 /* 2ab25eeb5Syz155240 * Copyright (C) 1995-2003 by Darren Reed. 3ab25eeb5Syz155240 * 4ab25eeb5Syz155240 * See the IPFILTER.LICENCE file for details on licencing. 5ab25eeb5Syz155240 * 6f4b3ec61Sdh155122 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 7ab25eeb5Syz155240 * Use is subject to license terms. 8ab25eeb5Syz155240 */ 9ab25eeb5Syz155240 10dcf3e898Sjojemann #pragma ident "%Z%%M% %I% %E% SMI"$ 11ab25eeb5Syz155240 12ab25eeb5Syz155240 #if defined(KERNEL) || defined(_KERNEL) 13ab25eeb5Syz155240 # undef KERNEL 14ab25eeb5Syz155240 # undef _KERNEL 15ab25eeb5Syz155240 # define KERNEL 1 16ab25eeb5Syz155240 # define _KERNEL 1 17ab25eeb5Syz155240 #endif 18ab25eeb5Syz155240 #include <sys/errno.h> 19ab25eeb5Syz155240 #include <sys/types.h> 20ab25eeb5Syz155240 #include <sys/param.h> 21ab25eeb5Syz155240 #include <sys/time.h> 22ab25eeb5Syz155240 #include <sys/file.h> 23ab25eeb5Syz155240 #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \ 24ab25eeb5Syz155240 defined(_KERNEL) 25ab25eeb5Syz155240 # include "opt_ipfilter_log.h" 26ab25eeb5Syz155240 #endif 27ab25eeb5Syz155240 #if !defined(_KERNEL) 28ab25eeb5Syz155240 # include <stdio.h> 29ab25eeb5Syz155240 # include <string.h> 30ab25eeb5Syz155240 # include <stdlib.h> 31ab25eeb5Syz155240 # define _KERNEL 32ab25eeb5Syz155240 # ifdef __OpenBSD__ 33ab25eeb5Syz155240 struct file; 34ab25eeb5Syz155240 # endif 35ab25eeb5Syz155240 # include <sys/uio.h> 36ab25eeb5Syz155240 # undef _KERNEL 37ab25eeb5Syz155240 #endif 38ab25eeb5Syz155240 #if defined(_KERNEL) && (__FreeBSD_version >= 220000) 39ab25eeb5Syz155240 # include <sys/filio.h> 40ab25eeb5Syz155240 # include <sys/fcntl.h> 41ab25eeb5Syz155240 #else 42ab25eeb5Syz155240 # include <sys/ioctl.h> 43ab25eeb5Syz155240 #endif 44ab25eeb5Syz155240 #if !defined(AIX) 45ab25eeb5Syz155240 # include <sys/fcntl.h> 46ab25eeb5Syz155240 #endif 47ab25eeb5Syz155240 #if !defined(linux) 48ab25eeb5Syz155240 # include <sys/protosw.h> 49ab25eeb5Syz155240 #endif 50ab25eeb5Syz155240 #include <sys/socket.h> 51ab25eeb5Syz155240 #if defined(_KERNEL) 52ab25eeb5Syz155240 # include <sys/systm.h> 53ab25eeb5Syz155240 # if !defined(__SVR4) && !defined(__svr4__) 54ab25eeb5Syz155240 # include <sys/mbuf.h> 55ab25eeb5Syz155240 # endif 56ab25eeb5Syz155240 #endif 57ab25eeb5Syz155240 #if defined(__SVR4) || defined(__svr4__) 58ab25eeb5Syz155240 # include <sys/filio.h> 59ab25eeb5Syz155240 # include <sys/byteorder.h> 60ab25eeb5Syz155240 # ifdef _KERNEL 61ab25eeb5Syz155240 # include <sys/dditypes.h> 62ab25eeb5Syz155240 # endif 63ab25eeb5Syz155240 # include <sys/stream.h> 64ab25eeb5Syz155240 # include <sys/kmem.h> 65ab25eeb5Syz155240 #endif 66ab25eeb5Syz155240 #if __FreeBSD_version >= 300000 67ab25eeb5Syz155240 # include <sys/queue.h> 68ab25eeb5Syz155240 #endif 69ab25eeb5Syz155240 #include <net/if.h> 70ab25eeb5Syz155240 #if __FreeBSD_version >= 300000 71ab25eeb5Syz155240 # include <net/if_var.h> 72ab25eeb5Syz155240 # if defined(_KERNEL) && !defined(IPFILTER_LKM) 73ab25eeb5Syz155240 # include "opt_ipfilter.h" 74ab25eeb5Syz155240 # endif 75ab25eeb5Syz155240 #endif 76ab25eeb5Syz155240 #ifdef sun 77ab25eeb5Syz155240 # include <net/af.h> 78ab25eeb5Syz155240 #endif 79ab25eeb5Syz155240 #include <net/route.h> 80ab25eeb5Syz155240 #include <netinet/in.h> 81ab25eeb5Syz155240 #include <netinet/in_systm.h> 82ab25eeb5Syz155240 #include <netinet/ip.h> 83ab25eeb5Syz155240 84ab25eeb5Syz155240 #ifdef RFC1825 85ab25eeb5Syz155240 # include <vpn/md5.h> 86ab25eeb5Syz155240 # include <vpn/ipsec.h> 87ab25eeb5Syz155240 extern struct ifnet vpnif; 88ab25eeb5Syz155240 #endif 89ab25eeb5Syz155240 90ab25eeb5Syz155240 #if !defined(linux) 91ab25eeb5Syz155240 # include <netinet/ip_var.h> 92ab25eeb5Syz155240 #endif 93ab25eeb5Syz155240 #include <netinet/tcp.h> 94ab25eeb5Syz155240 #include <netinet/udp.h> 95ab25eeb5Syz155240 #include <netinet/ip_icmp.h> 96ab25eeb5Syz155240 #include "netinet/ip_compat.h" 97ab25eeb5Syz155240 #include <netinet/tcpip.h> 98ab25eeb5Syz155240 #include "netinet/ip_fil.h" 99ab25eeb5Syz155240 #include "netinet/ip_nat.h" 100ab25eeb5Syz155240 #include "netinet/ip_frag.h" 101ab25eeb5Syz155240 #include "netinet/ip_state.h" 102ab25eeb5Syz155240 #include "netinet/ip_proxy.h" 103f4b3ec61Sdh155122 #include "netinet/ipf_stack.h" 104ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 105ab25eeb5Syz155240 #include "netinet/ip_sync.h" 106ab25eeb5Syz155240 #endif 107ab25eeb5Syz155240 #if (__FreeBSD_version >= 300000) 108ab25eeb5Syz155240 # include <sys/malloc.h> 109ab25eeb5Syz155240 #endif 110ab25eeb5Syz155240 /* END OF INCLUDES */ 111ab25eeb5Syz155240 112ab25eeb5Syz155240 #undef SOCKADDR_IN 113ab25eeb5Syz155240 #define SOCKADDR_IN struct sockaddr_in 114ab25eeb5Syz155240 115ab25eeb5Syz155240 #if !defined(lint) 116ab25eeb5Syz155240 static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed"; 117ab25eeb5Syz155240 static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.195.2.42 2005/08/11 19:51:36 darrenr Exp $"; 118ab25eeb5Syz155240 #endif 119ab25eeb5Syz155240 120ab25eeb5Syz155240 121ab25eeb5Syz155240 /* ======================================================================== */ 122ab25eeb5Syz155240 /* How the NAT is organised and works. */ 123ab25eeb5Syz155240 /* */ 124ab25eeb5Syz155240 /* Inside (interface y) NAT Outside (interface x) */ 125ab25eeb5Syz155240 /* -------------------- -+- ------------------------------------- */ 126ab25eeb5Syz155240 /* Packet going | out, processsed by fr_checknatout() for x */ 127ab25eeb5Syz155240 /* ------------> | ------------> */ 128ab25eeb5Syz155240 /* src=10.1.1.1 | src=192.1.1.1 */ 129ab25eeb5Syz155240 /* | */ 130ab25eeb5Syz155240 /* | in, processed by fr_checknatin() for x */ 131ab25eeb5Syz155240 /* <------------ | <------------ */ 132ab25eeb5Syz155240 /* dst=10.1.1.1 | dst=192.1.1.1 */ 133ab25eeb5Syz155240 /* -------------------- -+- ------------------------------------- */ 134ab25eeb5Syz155240 /* fr_checknatout() - changes ip_src and if required, sport */ 135ab25eeb5Syz155240 /* - creates a new mapping, if required. */ 136ab25eeb5Syz155240 /* fr_checknatin() - changes ip_dst and if required, dport */ 137ab25eeb5Syz155240 /* */ 138ab25eeb5Syz155240 /* In the NAT table, internal source is recorded as "in" and externally */ 139ab25eeb5Syz155240 /* seen as "out". */ 140ab25eeb5Syz155240 /* ======================================================================== */ 141ab25eeb5Syz155240 142ab25eeb5Syz155240 143f4b3ec61Sdh155122 static int nat_flushtable __P((ipf_stack_t *)); 144f4b3ec61Sdh155122 static int nat_clearlist __P((ipf_stack_t *)); 145f4b3ec61Sdh155122 static void nat_addnat __P((struct ipnat *, ipf_stack_t *)); 146f4b3ec61Sdh155122 static void nat_addrdr __P((struct ipnat *, ipf_stack_t *)); 147f4b3ec61Sdh155122 static void nat_delete __P((struct nat *, int, ipf_stack_t *)); 148ab25eeb5Syz155240 static void nat_delrdr __P((struct ipnat *)); 149ab25eeb5Syz155240 static void nat_delnat __P((struct ipnat *)); 150f4b3ec61Sdh155122 static int fr_natgetent __P((caddr_t, ipf_stack_t *)); 151f4b3ec61Sdh155122 static int fr_natgetsz __P((caddr_t, ipf_stack_t *)); 152f4b3ec61Sdh155122 static int fr_natputent __P((caddr_t, int, ipf_stack_t *)); 153f4b3ec61Sdh155122 static void nat_tabmove __P((nat_t *, ipf_stack_t *)); 154ab25eeb5Syz155240 static int nat_match __P((fr_info_t *, ipnat_t *)); 155ab25eeb5Syz155240 static INLINE int nat_newmap __P((fr_info_t *, nat_t *, natinfo_t *)); 156ab25eeb5Syz155240 static INLINE int nat_newrdr __P((fr_info_t *, nat_t *, natinfo_t *)); 157ab25eeb5Syz155240 static hostmap_t *nat_hostmap __P((ipnat_t *, struct in_addr, 158f4b3ec61Sdh155122 struct in_addr, struct in_addr, u_32_t, 159f4b3ec61Sdh155122 ipf_stack_t *)); 160ab25eeb5Syz155240 static void nat_hostmapdel __P((struct hostmap *)); 161ab25eeb5Syz155240 static INLINE int nat_icmpquerytype4 __P((int)); 162f4b3ec61Sdh155122 static int nat_siocaddnat __P((ipnat_t *, ipnat_t **, int, 163f4b3ec61Sdh155122 ipf_stack_t *)); 164f4b3ec61Sdh155122 static void nat_siocdelnat __P((ipnat_t *, ipnat_t **, int, 165f4b3ec61Sdh155122 ipf_stack_t *)); 166f4b3ec61Sdh155122 static INLINE int nat_icmperrortype4 __P((int)); 167ab25eeb5Syz155240 static INLINE int nat_finalise __P((fr_info_t *, nat_t *, natinfo_t *, 168ab25eeb5Syz155240 tcphdr_t *, nat_t **, int)); 169dcf3e898Sjojemann static INLINE int nat_resolverule __P((ipnat_t *, ipf_stack_t *)); 170ab25eeb5Syz155240 static nat_t *fr_natclone __P((fr_info_t *, nat_t *)); 171381a2a9aSdr146992 static void nat_mssclamp __P((tcphdr_t *, u_32_t, u_short *)); 172ab25eeb5Syz155240 static INLINE int nat_wildok __P((nat_t *, int, int, int, int)); 173f4b3ec61Sdh155122 static int nat_getnext __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *)); 174f4b3ec61Sdh155122 static int nat_iterator __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *)); 1753805c50fSan207044 static int nat_extraflush __P((int, ipf_stack_t *)); 1763805c50fSan207044 static int nat_earlydrop __P((ipftq_t *, int, ipf_stack_t *)); 1773805c50fSan207044 static int nat_flushclosing __P((int, ipf_stack_t *)); 1783805c50fSan207044 1793805c50fSan207044 1803805c50fSan207044 /* 1813805c50fSan207044 * Below we declare a list of constants used only in the nat_extraflush() 1823805c50fSan207044 * routine. We are placing it here, instead of in nat_extraflush() itself, 1833805c50fSan207044 * because we want to make it visible to tools such as mdb, nm etc., so the 1843805c50fSan207044 * values can easily be altered during debugging. 1853805c50fSan207044 */ 1863805c50fSan207044 static const int idletime_tab[] = { 1873805c50fSan207044 IPF_TTLVAL(30), /* 30 seconds */ 1883805c50fSan207044 IPF_TTLVAL(1800), /* 30 minutes */ 1893805c50fSan207044 IPF_TTLVAL(43200), /* 12 hours */ 1903805c50fSan207044 IPF_TTLVAL(345600), /* 4 days */ 1913805c50fSan207044 }; 192ab25eeb5Syz155240 193ab25eeb5Syz155240 194ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 195ab25eeb5Syz155240 /* Function: fr_natinit */ 196ab25eeb5Syz155240 /* Returns: int - 0 == success, -1 == failure */ 197ab25eeb5Syz155240 /* Parameters: Nil */ 198ab25eeb5Syz155240 /* */ 199ab25eeb5Syz155240 /* Initialise all of the NAT locks, tables and other structures. */ 200ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 201f4b3ec61Sdh155122 int fr_natinit(ifs) 202f4b3ec61Sdh155122 ipf_stack_t *ifs; 203ab25eeb5Syz155240 { 204ab25eeb5Syz155240 int i; 205ab25eeb5Syz155240 206f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_table[0], nat_t **, 207f4b3ec61Sdh155122 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 208f4b3ec61Sdh155122 if (ifs->ifs_nat_table[0] != NULL) 209f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_table[0], 210f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(nat_t *)); 211ab25eeb5Syz155240 else 212ab25eeb5Syz155240 return -1; 213ab25eeb5Syz155240 214f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_table[1], nat_t **, 215f4b3ec61Sdh155122 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 216f4b3ec61Sdh155122 if (ifs->ifs_nat_table[1] != NULL) 217f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_table[1], 218f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(nat_t *)); 219ab25eeb5Syz155240 else 220ab25eeb5Syz155240 return -2; 221ab25eeb5Syz155240 222f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_rules, ipnat_t **, 223f4b3ec61Sdh155122 sizeof(ipnat_t *) * ifs->ifs_ipf_natrules_sz); 224f4b3ec61Sdh155122 if (ifs->ifs_nat_rules != NULL) 225f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_rules, 226f4b3ec61Sdh155122 ifs->ifs_ipf_natrules_sz * sizeof(ipnat_t *)); 227ab25eeb5Syz155240 else 228ab25eeb5Syz155240 return -3; 229ab25eeb5Syz155240 230f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_rdr_rules, ipnat_t **, 231f4b3ec61Sdh155122 sizeof(ipnat_t *) * ifs->ifs_ipf_rdrrules_sz); 232f4b3ec61Sdh155122 if (ifs->ifs_rdr_rules != NULL) 233f4b3ec61Sdh155122 bzero((char *)ifs->ifs_rdr_rules, 234f4b3ec61Sdh155122 ifs->ifs_ipf_rdrrules_sz * sizeof(ipnat_t *)); 235ab25eeb5Syz155240 else 236ab25eeb5Syz155240 return -4; 237ab25eeb5Syz155240 238f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_maptable, hostmap_t **, 239f4b3ec61Sdh155122 sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz); 240f4b3ec61Sdh155122 if (ifs->ifs_maptable != NULL) 241f4b3ec61Sdh155122 bzero((char *)ifs->ifs_maptable, 242f4b3ec61Sdh155122 sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz); 243ab25eeb5Syz155240 else 244ab25eeb5Syz155240 return -5; 245ab25eeb5Syz155240 246f4b3ec61Sdh155122 ifs->ifs_ipf_hm_maplist = NULL; 247ab25eeb5Syz155240 248f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_stats.ns_bucketlen[0], u_long *, 249f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 250f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[0] == NULL) 251f4b3ec61Sdh155122 return -1; 252f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_stats.ns_bucketlen[0], 253f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 254ab25eeb5Syz155240 255f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_stats.ns_bucketlen[1], u_long *, 256f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 257f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[1] == NULL) 258f4b3ec61Sdh155122 return -1; 259f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_stats.ns_bucketlen[1], 260f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 261ab25eeb5Syz155240 262f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_maxbucket == 0) { 263f4b3ec61Sdh155122 for (i = ifs->ifs_ipf_nattable_sz; i > 0; i >>= 1) 264f4b3ec61Sdh155122 ifs->ifs_fr_nat_maxbucket++; 265f4b3ec61Sdh155122 ifs->ifs_fr_nat_maxbucket *= 2; 266ab25eeb5Syz155240 } 267ab25eeb5Syz155240 268f4b3ec61Sdh155122 fr_sttab_init(ifs->ifs_nat_tqb, ifs); 269ab25eeb5Syz155240 /* 270ab25eeb5Syz155240 * Increase this because we may have "keep state" following this too 271ab25eeb5Syz155240 * and packet storms can occur if this is removed too quickly. 272ab25eeb5Syz155240 */ 273f4b3ec61Sdh155122 ifs->ifs_nat_tqb[IPF_TCPS_CLOSED].ifq_ttl = ifs->ifs_fr_tcplastack; 274f4b3ec61Sdh155122 ifs->ifs_nat_tqb[IPF_TCP_NSTATES - 1].ifq_next = &ifs->ifs_nat_udptq; 275f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_ttl = ifs->ifs_fr_defnatage; 276f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_ref = 1; 277f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_head = NULL; 278f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_tail = &ifs->ifs_nat_udptq.ifq_head; 279f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_nat_udptq.ifq_lock, "nat ipftq udp tab"); 280f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_next = &ifs->ifs_nat_icmptq; 281f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_ttl = ifs->ifs_fr_defnaticmpage; 282f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_ref = 1; 283f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_head = NULL; 284f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_tail = &ifs->ifs_nat_icmptq.ifq_head; 285f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_nat_icmptq.ifq_lock, "nat icmp ipftq tab"); 286f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_next = &ifs->ifs_nat_iptq; 287f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_ttl = ifs->ifs_fr_defnatipage; 288f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_ref = 1; 289f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_head = NULL; 290f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_tail = &ifs->ifs_nat_iptq.ifq_head; 291f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_nat_iptq.ifq_lock, "nat ip ipftq tab"); 292f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_next = NULL; 293ab25eeb5Syz155240 294ab25eeb5Syz155240 for (i = 0; i < IPF_TCP_NSTATES; i++) { 295f4b3ec61Sdh155122 if (ifs->ifs_nat_tqb[i].ifq_ttl < ifs->ifs_fr_defnaticmpage) 296f4b3ec61Sdh155122 ifs->ifs_nat_tqb[i].ifq_ttl = ifs->ifs_fr_defnaticmpage; 297ab25eeb5Syz155240 #ifdef LARGE_NAT 298f4b3ec61Sdh155122 else if (ifs->ifs_nat_tqb[i].ifq_ttl > ifs->ifs_fr_defnatage) 299f4b3ec61Sdh155122 ifs->ifs_nat_tqb[i].ifq_ttl = ifs->ifs_fr_defnatage; 300ab25eeb5Syz155240 #endif 301ab25eeb5Syz155240 } 302ab25eeb5Syz155240 303ab25eeb5Syz155240 /* 304ab25eeb5Syz155240 * Increase this because we may have "keep state" following 305ab25eeb5Syz155240 * this too and packet storms can occur if this is removed 306ab25eeb5Syz155240 * too quickly. 307ab25eeb5Syz155240 */ 308f4b3ec61Sdh155122 ifs->ifs_nat_tqb[IPF_TCPS_CLOSED].ifq_ttl = 309f4b3ec61Sdh155122 ifs->ifs_nat_tqb[IPF_TCPS_LAST_ACK].ifq_ttl; 310ab25eeb5Syz155240 311f4b3ec61Sdh155122 RWLOCK_INIT(&ifs->ifs_ipf_nat, "ipf IP NAT rwlock"); 312f4b3ec61Sdh155122 RWLOCK_INIT(&ifs->ifs_ipf_natfrag, "ipf IP NAT-Frag rwlock"); 313f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ipf_nat_new, "ipf nat new mutex"); 314f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ipf_natio, "ipf nat io mutex"); 315ab25eeb5Syz155240 316f4b3ec61Sdh155122 ifs->ifs_fr_nat_init = 1; 317ab25eeb5Syz155240 318ab25eeb5Syz155240 return 0; 319ab25eeb5Syz155240 } 320ab25eeb5Syz155240 321ab25eeb5Syz155240 322ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 323ab25eeb5Syz155240 /* Function: nat_addrdr */ 324ab25eeb5Syz155240 /* Returns: Nil */ 325ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule to add */ 326ab25eeb5Syz155240 /* */ 327ab25eeb5Syz155240 /* Adds a redirect rule to the hash table of redirect rules and the list of */ 328ab25eeb5Syz155240 /* loaded NAT rules. Updates the bitmask indicating which netmasks are in */ 329ab25eeb5Syz155240 /* use by redirect rules. */ 330ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 331f4b3ec61Sdh155122 static void nat_addrdr(n, ifs) 332ab25eeb5Syz155240 ipnat_t *n; 333f4b3ec61Sdh155122 ipf_stack_t *ifs; 334ab25eeb5Syz155240 { 335ab25eeb5Syz155240 ipnat_t **np; 336ab25eeb5Syz155240 u_32_t j; 337ab25eeb5Syz155240 u_int hv; 338ab25eeb5Syz155240 int k; 339ab25eeb5Syz155240 340ab25eeb5Syz155240 k = count4bits(n->in_outmsk); 341ab25eeb5Syz155240 if ((k >= 0) && (k != 32)) 342f4b3ec61Sdh155122 ifs->ifs_rdr_masks |= 1 << k; 343ab25eeb5Syz155240 j = (n->in_outip & n->in_outmsk); 344f4b3ec61Sdh155122 hv = NAT_HASH_FN(j, 0, ifs->ifs_ipf_rdrrules_sz); 345f4b3ec61Sdh155122 np = ifs->ifs_rdr_rules + hv; 346ab25eeb5Syz155240 while (*np != NULL) 347ab25eeb5Syz155240 np = &(*np)->in_rnext; 348ab25eeb5Syz155240 n->in_rnext = NULL; 349ab25eeb5Syz155240 n->in_prnext = np; 350ab25eeb5Syz155240 n->in_hv = hv; 351ab25eeb5Syz155240 *np = n; 352ab25eeb5Syz155240 } 353ab25eeb5Syz155240 354ab25eeb5Syz155240 355ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 356ab25eeb5Syz155240 /* Function: nat_addnat */ 357ab25eeb5Syz155240 /* Returns: Nil */ 358ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule to add */ 359ab25eeb5Syz155240 /* */ 360ab25eeb5Syz155240 /* Adds a NAT map rule to the hash table of rules and the list of loaded */ 361ab25eeb5Syz155240 /* NAT rules. Updates the bitmask indicating which netmasks are in use by */ 362ab25eeb5Syz155240 /* redirect rules. */ 363ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 364f4b3ec61Sdh155122 static void nat_addnat(n, ifs) 365ab25eeb5Syz155240 ipnat_t *n; 366f4b3ec61Sdh155122 ipf_stack_t *ifs; 367ab25eeb5Syz155240 { 368ab25eeb5Syz155240 ipnat_t **np; 369ab25eeb5Syz155240 u_32_t j; 370ab25eeb5Syz155240 u_int hv; 371ab25eeb5Syz155240 int k; 372ab25eeb5Syz155240 373ab25eeb5Syz155240 k = count4bits(n->in_inmsk); 374ab25eeb5Syz155240 if ((k >= 0) && (k != 32)) 375f4b3ec61Sdh155122 ifs->ifs_nat_masks |= 1 << k; 376ab25eeb5Syz155240 j = (n->in_inip & n->in_inmsk); 377f4b3ec61Sdh155122 hv = NAT_HASH_FN(j, 0, ifs->ifs_ipf_natrules_sz); 378f4b3ec61Sdh155122 np = ifs->ifs_nat_rules + hv; 379ab25eeb5Syz155240 while (*np != NULL) 380ab25eeb5Syz155240 np = &(*np)->in_mnext; 381ab25eeb5Syz155240 n->in_mnext = NULL; 382ab25eeb5Syz155240 n->in_pmnext = np; 383ab25eeb5Syz155240 n->in_hv = hv; 384ab25eeb5Syz155240 *np = n; 385ab25eeb5Syz155240 } 386ab25eeb5Syz155240 387ab25eeb5Syz155240 388ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 389ab25eeb5Syz155240 /* Function: nat_delrdr */ 390ab25eeb5Syz155240 /* Returns: Nil */ 391ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule to delete */ 392ab25eeb5Syz155240 /* */ 393ab25eeb5Syz155240 /* Removes a redirect rule from the hash table of redirect rules. */ 394ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 395ab25eeb5Syz155240 static void nat_delrdr(n) 396ab25eeb5Syz155240 ipnat_t *n; 397ab25eeb5Syz155240 { 398ab25eeb5Syz155240 if (n->in_rnext) 399ab25eeb5Syz155240 n->in_rnext->in_prnext = n->in_prnext; 400ab25eeb5Syz155240 *n->in_prnext = n->in_rnext; 401ab25eeb5Syz155240 } 402ab25eeb5Syz155240 403ab25eeb5Syz155240 404ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 405ab25eeb5Syz155240 /* Function: nat_delnat */ 406ab25eeb5Syz155240 /* Returns: Nil */ 407ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule to delete */ 408ab25eeb5Syz155240 /* */ 409ab25eeb5Syz155240 /* Removes a NAT map rule from the hash table of NAT map rules. */ 410ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 411ab25eeb5Syz155240 static void nat_delnat(n) 412ab25eeb5Syz155240 ipnat_t *n; 413ab25eeb5Syz155240 { 414ab25eeb5Syz155240 if (n->in_mnext != NULL) 415ab25eeb5Syz155240 n->in_mnext->in_pmnext = n->in_pmnext; 416ab25eeb5Syz155240 *n->in_pmnext = n->in_mnext; 417ab25eeb5Syz155240 } 418ab25eeb5Syz155240 419ab25eeb5Syz155240 420ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 421ab25eeb5Syz155240 /* Function: nat_hostmap */ 422ab25eeb5Syz155240 /* Returns: struct hostmap* - NULL if no hostmap could be created, */ 423ab25eeb5Syz155240 /* else a pointer to the hostmapping to use */ 424ab25eeb5Syz155240 /* Parameters: np(I) - pointer to NAT rule */ 425ab25eeb5Syz155240 /* real(I) - real IP address */ 426ab25eeb5Syz155240 /* map(I) - mapped IP address */ 427ab25eeb5Syz155240 /* port(I) - destination port number */ 428ab25eeb5Syz155240 /* Write Locks: ipf_nat */ 429ab25eeb5Syz155240 /* */ 430ab25eeb5Syz155240 /* Check if an ip address has already been allocated for a given mapping */ 431ab25eeb5Syz155240 /* that is not doing port based translation. If is not yet allocated, then */ 432ab25eeb5Syz155240 /* create a new entry if a non-NULL NAT rule pointer has been supplied. */ 433ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 434f4b3ec61Sdh155122 static struct hostmap *nat_hostmap(np, src, dst, map, port, ifs) 435ab25eeb5Syz155240 ipnat_t *np; 436ab25eeb5Syz155240 struct in_addr src; 437ab25eeb5Syz155240 struct in_addr dst; 438ab25eeb5Syz155240 struct in_addr map; 439ab25eeb5Syz155240 u_32_t port; 440f4b3ec61Sdh155122 ipf_stack_t *ifs; 441ab25eeb5Syz155240 { 442ab25eeb5Syz155240 hostmap_t *hm; 443ab25eeb5Syz155240 u_int hv; 444ab25eeb5Syz155240 445ab25eeb5Syz155240 hv = (src.s_addr ^ dst.s_addr); 446ab25eeb5Syz155240 hv += src.s_addr; 447ab25eeb5Syz155240 hv += dst.s_addr; 448ab25eeb5Syz155240 hv %= HOSTMAP_SIZE; 449f4b3ec61Sdh155122 for (hm = ifs->ifs_maptable[hv]; hm; hm = hm->hm_next) 450ab25eeb5Syz155240 if ((hm->hm_srcip.s_addr == src.s_addr) && 451ab25eeb5Syz155240 (hm->hm_dstip.s_addr == dst.s_addr) && 452ab25eeb5Syz155240 ((np == NULL) || (np == hm->hm_ipnat)) && 453ab25eeb5Syz155240 ((port == 0) || (port == hm->hm_port))) { 454ab25eeb5Syz155240 hm->hm_ref++; 455ab25eeb5Syz155240 return hm; 456ab25eeb5Syz155240 } 457ab25eeb5Syz155240 458ab25eeb5Syz155240 if (np == NULL) 459ab25eeb5Syz155240 return NULL; 460ab25eeb5Syz155240 461ab25eeb5Syz155240 KMALLOC(hm, hostmap_t *); 462ab25eeb5Syz155240 if (hm) { 463f4b3ec61Sdh155122 hm->hm_hnext = ifs->ifs_ipf_hm_maplist; 464f4b3ec61Sdh155122 hm->hm_phnext = &ifs->ifs_ipf_hm_maplist; 465f4b3ec61Sdh155122 if (ifs->ifs_ipf_hm_maplist != NULL) 466f4b3ec61Sdh155122 ifs->ifs_ipf_hm_maplist->hm_phnext = &hm->hm_hnext; 467f4b3ec61Sdh155122 ifs->ifs_ipf_hm_maplist = hm; 468f4b3ec61Sdh155122 469f4b3ec61Sdh155122 hm->hm_next = ifs->ifs_maptable[hv]; 470f4b3ec61Sdh155122 hm->hm_pnext = ifs->ifs_maptable + hv; 471f4b3ec61Sdh155122 if (ifs->ifs_maptable[hv] != NULL) 472f4b3ec61Sdh155122 ifs->ifs_maptable[hv]->hm_pnext = &hm->hm_next; 473f4b3ec61Sdh155122 ifs->ifs_maptable[hv] = hm; 474ab25eeb5Syz155240 hm->hm_ipnat = np; 475ab25eeb5Syz155240 hm->hm_srcip = src; 476ab25eeb5Syz155240 hm->hm_dstip = dst; 477ab25eeb5Syz155240 hm->hm_mapip = map; 478ab25eeb5Syz155240 hm->hm_ref = 1; 479ab25eeb5Syz155240 hm->hm_port = port; 480ab25eeb5Syz155240 } 481ab25eeb5Syz155240 return hm; 482ab25eeb5Syz155240 } 483ab25eeb5Syz155240 484ab25eeb5Syz155240 485ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 486ab25eeb5Syz155240 /* Function: nat_hostmapdel */ 487ab25eeb5Syz155240 /* Returns: Nil */ 488ab25eeb5Syz155240 /* Parameters: hm(I) - pointer to hostmap structure */ 489ab25eeb5Syz155240 /* Write Locks: ipf_nat */ 490ab25eeb5Syz155240 /* */ 491ab25eeb5Syz155240 /* Decrement the references to this hostmap structure by one. If this */ 492ab25eeb5Syz155240 /* reaches zero then remove it and free it. */ 493ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 494ab25eeb5Syz155240 static void nat_hostmapdel(hm) 495ab25eeb5Syz155240 struct hostmap *hm; 496ab25eeb5Syz155240 { 497ab25eeb5Syz155240 hm->hm_ref--; 498ab25eeb5Syz155240 if (hm->hm_ref == 0) { 499ab25eeb5Syz155240 if (hm->hm_next) 500ab25eeb5Syz155240 hm->hm_next->hm_pnext = hm->hm_pnext; 501ab25eeb5Syz155240 *hm->hm_pnext = hm->hm_next; 502f4b3ec61Sdh155122 if (hm->hm_hnext) 503f4b3ec61Sdh155122 hm->hm_hnext->hm_phnext = hm->hm_phnext; 504f4b3ec61Sdh155122 *hm->hm_phnext = hm->hm_hnext; 505ab25eeb5Syz155240 KFREE(hm); 506ab25eeb5Syz155240 } 507ab25eeb5Syz155240 } 508ab25eeb5Syz155240 509f4b3ec61Sdh155122 void fr_hostmapderef(hmp) 510f4b3ec61Sdh155122 struct hostmap **hmp; 511f4b3ec61Sdh155122 { 512f4b3ec61Sdh155122 struct hostmap *hm; 513f4b3ec61Sdh155122 514f4b3ec61Sdh155122 hm = *hmp; 515f4b3ec61Sdh155122 *hmp = NULL; 516f4b3ec61Sdh155122 hm->hm_ref--; 517f4b3ec61Sdh155122 if (hm->hm_ref == 0) 518f4b3ec61Sdh155122 nat_hostmapdel(hm); 519f4b3ec61Sdh155122 } 520f4b3ec61Sdh155122 521ab25eeb5Syz155240 522ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 523ab25eeb5Syz155240 /* Function: fix_outcksum */ 524ab25eeb5Syz155240 /* Returns: Nil */ 525381a2a9aSdr146992 /* Parameters: sp(I) - location of 16bit checksum to update */ 526ab25eeb5Syz155240 /* n((I) - amount to adjust checksum by */ 527ab25eeb5Syz155240 /* */ 528ab25eeb5Syz155240 /* Adjusts the 16bit checksum by "n" for packets going out. */ 529ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 530381a2a9aSdr146992 void fix_outcksum(sp, n) 531ab25eeb5Syz155240 u_short *sp; 532ab25eeb5Syz155240 u_32_t n; 533ab25eeb5Syz155240 { 534ab25eeb5Syz155240 u_short sumshort; 535ab25eeb5Syz155240 u_32_t sum1; 536ab25eeb5Syz155240 537ab25eeb5Syz155240 if (n == 0) 538ab25eeb5Syz155240 return; 539ab25eeb5Syz155240 540ab25eeb5Syz155240 sum1 = (~ntohs(*sp)) & 0xffff; 541ab25eeb5Syz155240 sum1 += (n); 542ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 543ab25eeb5Syz155240 /* Again */ 544ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 545ab25eeb5Syz155240 sumshort = ~(u_short)sum1; 546ab25eeb5Syz155240 *(sp) = htons(sumshort); 547ab25eeb5Syz155240 } 548ab25eeb5Syz155240 549ab25eeb5Syz155240 550ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 551ab25eeb5Syz155240 /* Function: fix_incksum */ 552ab25eeb5Syz155240 /* Returns: Nil */ 553381a2a9aSdr146992 /* Parameters: sp(I) - location of 16bit checksum to update */ 554ab25eeb5Syz155240 /* n((I) - amount to adjust checksum by */ 555ab25eeb5Syz155240 /* */ 556ab25eeb5Syz155240 /* Adjusts the 16bit checksum by "n" for packets going in. */ 557ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 558381a2a9aSdr146992 void fix_incksum(sp, n) 559ab25eeb5Syz155240 u_short *sp; 560ab25eeb5Syz155240 u_32_t n; 561ab25eeb5Syz155240 { 562ab25eeb5Syz155240 u_short sumshort; 563ab25eeb5Syz155240 u_32_t sum1; 564ab25eeb5Syz155240 565ab25eeb5Syz155240 if (n == 0) 566ab25eeb5Syz155240 return; 567ab25eeb5Syz155240 568ab25eeb5Syz155240 sum1 = (~ntohs(*sp)) & 0xffff; 569ab25eeb5Syz155240 sum1 += ~(n) & 0xffff; 570ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 571ab25eeb5Syz155240 /* Again */ 572ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 573ab25eeb5Syz155240 sumshort = ~(u_short)sum1; 574ab25eeb5Syz155240 *(sp) = htons(sumshort); 575ab25eeb5Syz155240 } 576ab25eeb5Syz155240 577ab25eeb5Syz155240 578ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 579ab25eeb5Syz155240 /* Function: fix_datacksum */ 580ab25eeb5Syz155240 /* Returns: Nil */ 581ab25eeb5Syz155240 /* Parameters: sp(I) - location of 16bit checksum to update */ 582ab25eeb5Syz155240 /* n((I) - amount to adjust checksum by */ 583ab25eeb5Syz155240 /* */ 584ab25eeb5Syz155240 /* Fix_datacksum is used *only* for the adjustments of checksums in the */ 585ab25eeb5Syz155240 /* data section of an IP packet. */ 586ab25eeb5Syz155240 /* */ 587ab25eeb5Syz155240 /* The only situation in which you need to do this is when NAT'ing an */ 588ab25eeb5Syz155240 /* ICMP error message. Such a message, contains in its body the IP header */ 589ab25eeb5Syz155240 /* of the original IP packet, that causes the error. */ 590ab25eeb5Syz155240 /* */ 591ab25eeb5Syz155240 /* You can't use fix_incksum or fix_outcksum in that case, because for the */ 592ab25eeb5Syz155240 /* kernel the data section of the ICMP error is just data, and no special */ 593ab25eeb5Syz155240 /* processing like hardware cksum or ntohs processing have been done by the */ 594ab25eeb5Syz155240 /* kernel on the data section. */ 595ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 596ab25eeb5Syz155240 void fix_datacksum(sp, n) 597ab25eeb5Syz155240 u_short *sp; 598ab25eeb5Syz155240 u_32_t n; 599ab25eeb5Syz155240 { 600ab25eeb5Syz155240 u_short sumshort; 601ab25eeb5Syz155240 u_32_t sum1; 602ab25eeb5Syz155240 603ab25eeb5Syz155240 if (n == 0) 604ab25eeb5Syz155240 return; 605ab25eeb5Syz155240 606ab25eeb5Syz155240 sum1 = (~ntohs(*sp)) & 0xffff; 607ab25eeb5Syz155240 sum1 += (n); 608ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 609ab25eeb5Syz155240 /* Again */ 610ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 611ab25eeb5Syz155240 sumshort = ~(u_short)sum1; 612ab25eeb5Syz155240 *(sp) = htons(sumshort); 613ab25eeb5Syz155240 } 614ab25eeb5Syz155240 615ab25eeb5Syz155240 616ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 617ab25eeb5Syz155240 /* Function: fr_nat_ioctl */ 618ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 619ab25eeb5Syz155240 /* Parameters: data(I) - pointer to ioctl data */ 620ab25eeb5Syz155240 /* cmd(I) - ioctl command integer */ 621ab25eeb5Syz155240 /* mode(I) - file mode bits used with open */ 622ab25eeb5Syz155240 /* */ 623ab25eeb5Syz155240 /* Processes an ioctl call made to operate on the IP Filter NAT device. */ 624ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 625f4b3ec61Sdh155122 int fr_nat_ioctl(data, cmd, mode, uid, ctx, ifs) 626ab25eeb5Syz155240 ioctlcmd_t cmd; 627ab25eeb5Syz155240 caddr_t data; 628f4b3ec61Sdh155122 int mode, uid; 629f4b3ec61Sdh155122 void *ctx; 630f4b3ec61Sdh155122 ipf_stack_t *ifs; 631ab25eeb5Syz155240 { 632ab25eeb5Syz155240 ipnat_t *nat, *nt, *n = NULL, **np = NULL; 633ab25eeb5Syz155240 int error = 0, ret, arg, getlock; 634ab25eeb5Syz155240 ipnat_t natd; 635ab25eeb5Syz155240 636ab25eeb5Syz155240 #if (BSD >= 199306) && defined(_KERNEL) 637ab25eeb5Syz155240 if ((securelevel >= 2) && (mode & FWRITE)) 638ab25eeb5Syz155240 return EPERM; 639ab25eeb5Syz155240 #endif 640ab25eeb5Syz155240 641ab25eeb5Syz155240 #if defined(__osf__) && defined(_KERNEL) 642ab25eeb5Syz155240 getlock = 0; 643ab25eeb5Syz155240 #else 644ab25eeb5Syz155240 getlock = (mode & NAT_LOCKHELD) ? 0 : 1; 645ab25eeb5Syz155240 #endif 646ab25eeb5Syz155240 647ab25eeb5Syz155240 nat = NULL; /* XXX gcc -Wuninitialized */ 648ab25eeb5Syz155240 if (cmd == (ioctlcmd_t)SIOCADNAT) { 649ab25eeb5Syz155240 KMALLOC(nt, ipnat_t *); 650ab25eeb5Syz155240 } else { 651ab25eeb5Syz155240 nt = NULL; 652ab25eeb5Syz155240 } 653ab25eeb5Syz155240 654ab25eeb5Syz155240 if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) { 655ab25eeb5Syz155240 if (mode & NAT_SYSSPACE) { 656ab25eeb5Syz155240 bcopy(data, (char *)&natd, sizeof(natd)); 657ab25eeb5Syz155240 error = 0; 658ab25eeb5Syz155240 } else { 659ab25eeb5Syz155240 error = fr_inobj(data, &natd, IPFOBJ_IPNAT); 660ab25eeb5Syz155240 } 661ab25eeb5Syz155240 662ab25eeb5Syz155240 } else if (cmd == (ioctlcmd_t)SIOCIPFFL) { /* SIOCFLNAT & SIOCCNATL */ 663ab25eeb5Syz155240 BCOPYIN(data, &arg, sizeof(arg)); 664ab25eeb5Syz155240 } 665ab25eeb5Syz155240 666ab25eeb5Syz155240 if (error != 0) 667ab25eeb5Syz155240 goto done; 668ab25eeb5Syz155240 669ab25eeb5Syz155240 /* 670ab25eeb5Syz155240 * For add/delete, look to see if the NAT entry is already present 671ab25eeb5Syz155240 */ 672ab25eeb5Syz155240 if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) { 673ab25eeb5Syz155240 nat = &natd; 674ab25eeb5Syz155240 if (nat->in_v == 0) /* For backward compat. */ 675ab25eeb5Syz155240 nat->in_v = 4; 676ab25eeb5Syz155240 nat->in_flags &= IPN_USERFLAGS; 677ab25eeb5Syz155240 if ((nat->in_redir & NAT_MAPBLK) == 0) { 678ab25eeb5Syz155240 if ((nat->in_flags & IPN_SPLIT) == 0) 679ab25eeb5Syz155240 nat->in_inip &= nat->in_inmsk; 680ab25eeb5Syz155240 if ((nat->in_flags & IPN_IPRANGE) == 0) 681ab25eeb5Syz155240 nat->in_outip &= nat->in_outmsk; 682ab25eeb5Syz155240 } 683f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_natio); 684f4b3ec61Sdh155122 for (np = &ifs->ifs_nat_list; ((n = *np) != NULL); 685f4b3ec61Sdh155122 np = &n->in_next) 686ab25eeb5Syz155240 if (!bcmp((char *)&nat->in_flags, (char *)&n->in_flags, 687ab25eeb5Syz155240 IPN_CMPSIZ)) 688ab25eeb5Syz155240 break; 689ab25eeb5Syz155240 } 690ab25eeb5Syz155240 691ab25eeb5Syz155240 switch (cmd) 692ab25eeb5Syz155240 { 693f4b3ec61Sdh155122 case SIOCGENITER : 694f4b3ec61Sdh155122 { 695f4b3ec61Sdh155122 ipfgeniter_t iter; 696f4b3ec61Sdh155122 ipftoken_t *token; 697f4b3ec61Sdh155122 698f4b3ec61Sdh155122 error = fr_inobj(data, &iter, IPFOBJ_GENITER); 699f4b3ec61Sdh155122 if (error != 0) 700f4b3ec61Sdh155122 break; 701f4b3ec61Sdh155122 702f4b3ec61Sdh155122 token = ipf_findtoken(iter.igi_type, uid, ctx, ifs); 703f4b3ec61Sdh155122 if (token != NULL) 704f4b3ec61Sdh155122 error = nat_iterator(token, &iter, ifs); 705f4b3ec61Sdh155122 else 706f4b3ec61Sdh155122 error = ESRCH; 707f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_tokens); 708f4b3ec61Sdh155122 break; 709f4b3ec61Sdh155122 } 710ab25eeb5Syz155240 #ifdef IPFILTER_LOG 711ab25eeb5Syz155240 case SIOCIPFFB : 712ab25eeb5Syz155240 { 713ab25eeb5Syz155240 int tmp; 714ab25eeb5Syz155240 715ab25eeb5Syz155240 if (!(mode & FWRITE)) 716ab25eeb5Syz155240 error = EPERM; 717ab25eeb5Syz155240 else { 718f4b3ec61Sdh155122 tmp = ipflog_clear(IPL_LOGNAT, ifs); 719ab25eeb5Syz155240 BCOPYOUT((char *)&tmp, (char *)data, sizeof(tmp)); 720ab25eeb5Syz155240 } 721ab25eeb5Syz155240 break; 722ab25eeb5Syz155240 } 723ab25eeb5Syz155240 case SIOCSETLG : 724ab25eeb5Syz155240 if (!(mode & FWRITE)) 725ab25eeb5Syz155240 error = EPERM; 726ab25eeb5Syz155240 else { 727f4b3ec61Sdh155122 BCOPYIN((char *)data, 728f4b3ec61Sdh155122 (char *)&ifs->ifs_nat_logging, 729f4b3ec61Sdh155122 sizeof(ifs->ifs_nat_logging)); 730ab25eeb5Syz155240 } 731ab25eeb5Syz155240 break; 732ab25eeb5Syz155240 case SIOCGETLG : 733f4b3ec61Sdh155122 BCOPYOUT((char *)&ifs->ifs_nat_logging, (char *)data, 734f4b3ec61Sdh155122 sizeof(ifs->ifs_nat_logging)); 735ab25eeb5Syz155240 break; 736ab25eeb5Syz155240 case FIONREAD : 737f4b3ec61Sdh155122 arg = ifs->ifs_iplused[IPL_LOGNAT]; 738ab25eeb5Syz155240 BCOPYOUT(&arg, data, sizeof(arg)); 739ab25eeb5Syz155240 break; 740ab25eeb5Syz155240 #endif 741ab25eeb5Syz155240 case SIOCADNAT : 742ab25eeb5Syz155240 if (!(mode & FWRITE)) { 743ab25eeb5Syz155240 error = EPERM; 744ab25eeb5Syz155240 } else if (n != NULL) { 745ab25eeb5Syz155240 error = EEXIST; 746ab25eeb5Syz155240 } else if (nt == NULL) { 747ab25eeb5Syz155240 error = ENOMEM; 748ab25eeb5Syz155240 } 749ab25eeb5Syz155240 if (error != 0) { 750f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_natio); 751ab25eeb5Syz155240 break; 752ab25eeb5Syz155240 } 753ab25eeb5Syz155240 bcopy((char *)nat, (char *)nt, sizeof(*n)); 754f4b3ec61Sdh155122 error = nat_siocaddnat(nt, np, getlock, ifs); 755f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_natio); 756ab25eeb5Syz155240 if (error == 0) 757ab25eeb5Syz155240 nt = NULL; 758ab25eeb5Syz155240 break; 759ab25eeb5Syz155240 case SIOCRMNAT : 760ab25eeb5Syz155240 if (!(mode & FWRITE)) { 761ab25eeb5Syz155240 error = EPERM; 762ab25eeb5Syz155240 n = NULL; 763ab25eeb5Syz155240 } else if (n == NULL) { 764ab25eeb5Syz155240 error = ESRCH; 765ab25eeb5Syz155240 } 766ab25eeb5Syz155240 767ab25eeb5Syz155240 if (error != 0) { 768f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_natio); 769ab25eeb5Syz155240 break; 770ab25eeb5Syz155240 } 771f4b3ec61Sdh155122 nat_siocdelnat(n, np, getlock, ifs); 772ab25eeb5Syz155240 773f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_natio); 774ab25eeb5Syz155240 n = NULL; 775ab25eeb5Syz155240 break; 776ab25eeb5Syz155240 case SIOCGNATS : 777f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_table[0] = ifs->ifs_nat_table[0]; 778f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_table[1] = ifs->ifs_nat_table[1]; 779f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_list = ifs->ifs_nat_list; 780f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_maptable = ifs->ifs_maptable; 781f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_maplist = ifs->ifs_ipf_hm_maplist; 782f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_nattab_max = ifs->ifs_ipf_nattable_max; 783f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_nattab_sz = ifs->ifs_ipf_nattable_sz; 784f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rultab_sz = ifs->ifs_ipf_natrules_sz; 785f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rdrtab_sz = ifs->ifs_ipf_rdrrules_sz; 786f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_hostmap_sz = ifs->ifs_ipf_hostmap_sz; 787f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_instances = ifs->ifs_nat_instances; 788f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_apslist = ifs->ifs_ap_sess_list; 789f4b3ec61Sdh155122 error = fr_outobj(data, &ifs->ifs_nat_stats, IPFOBJ_NATSTAT); 790ab25eeb5Syz155240 break; 791ab25eeb5Syz155240 case SIOCGNATL : 792ab25eeb5Syz155240 { 793ab25eeb5Syz155240 natlookup_t nl; 794ab25eeb5Syz155240 795ab25eeb5Syz155240 if (getlock) { 796f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 797ab25eeb5Syz155240 } 798ab25eeb5Syz155240 error = fr_inobj(data, &nl, IPFOBJ_NATLOOKUP); 799ab25eeb5Syz155240 if (error == 0) { 800f4b3ec61Sdh155122 if (nat_lookupredir(&nl, ifs) != NULL) { 801ab25eeb5Syz155240 error = fr_outobj(data, &nl, IPFOBJ_NATLOOKUP); 802ab25eeb5Syz155240 } else { 803ab25eeb5Syz155240 error = ESRCH; 804ab25eeb5Syz155240 } 805ab25eeb5Syz155240 } 806ab25eeb5Syz155240 if (getlock) { 807f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 808ab25eeb5Syz155240 } 809ab25eeb5Syz155240 break; 810ab25eeb5Syz155240 } 811ab25eeb5Syz155240 case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */ 812ab25eeb5Syz155240 if (!(mode & FWRITE)) { 813ab25eeb5Syz155240 error = EPERM; 814ab25eeb5Syz155240 break; 815ab25eeb5Syz155240 } 816ab25eeb5Syz155240 if (getlock) { 817f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 818ab25eeb5Syz155240 } 819ab25eeb5Syz155240 error = 0; 820ab25eeb5Syz155240 if (arg == 0) 821f4b3ec61Sdh155122 ret = nat_flushtable(ifs); 822ab25eeb5Syz155240 else if (arg == 1) 823f4b3ec61Sdh155122 ret = nat_clearlist(ifs); 8243805c50fSan207044 else if (arg >= 2 && arg <= 4) 8253805c50fSan207044 ret = nat_extraflush(arg - 2, ifs); 826ab25eeb5Syz155240 else 827ab25eeb5Syz155240 error = EINVAL; 828ab25eeb5Syz155240 if (getlock) { 829f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 830ab25eeb5Syz155240 } 831ab25eeb5Syz155240 if (error == 0) { 832ab25eeb5Syz155240 BCOPYOUT(&ret, data, sizeof(ret)); 833ab25eeb5Syz155240 } 834ab25eeb5Syz155240 break; 835ab25eeb5Syz155240 case SIOCPROXY : 836f4b3ec61Sdh155122 error = appr_ioctl(data, cmd, mode, ifs); 837ab25eeb5Syz155240 break; 838ab25eeb5Syz155240 case SIOCSTLCK : 839ab25eeb5Syz155240 if (!(mode & FWRITE)) { 840ab25eeb5Syz155240 error = EPERM; 841ab25eeb5Syz155240 } else { 842f4b3ec61Sdh155122 fr_lock(data, &ifs->ifs_fr_nat_lock); 843ab25eeb5Syz155240 } 844ab25eeb5Syz155240 break; 845ab25eeb5Syz155240 case SIOCSTPUT : 8463c3c3491Sjojemann if ((mode & FWRITE) != 0) { 847f4b3ec61Sdh155122 error = fr_natputent(data, getlock, ifs); 848ab25eeb5Syz155240 } else { 849ab25eeb5Syz155240 error = EACCES; 850ab25eeb5Syz155240 } 851ab25eeb5Syz155240 break; 852ab25eeb5Syz155240 case SIOCSTGSZ : 853f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_lock) { 854ab25eeb5Syz155240 if (getlock) { 855f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 856ab25eeb5Syz155240 } 857f4b3ec61Sdh155122 error = fr_natgetsz(data, ifs); 858ab25eeb5Syz155240 if (getlock) { 859f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 860ab25eeb5Syz155240 } 861ab25eeb5Syz155240 } else 862ab25eeb5Syz155240 error = EACCES; 863ab25eeb5Syz155240 break; 864ab25eeb5Syz155240 case SIOCSTGET : 865f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_lock) { 866ab25eeb5Syz155240 if (getlock) { 867f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 868ab25eeb5Syz155240 } 869f4b3ec61Sdh155122 error = fr_natgetent(data, ifs); 870ab25eeb5Syz155240 if (getlock) { 871f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 872ab25eeb5Syz155240 } 873ab25eeb5Syz155240 } else 874ab25eeb5Syz155240 error = EACCES; 875ab25eeb5Syz155240 break; 876f4b3ec61Sdh155122 case SIOCIPFDELTOK : 877f4b3ec61Sdh155122 (void) BCOPYIN((caddr_t)data, (caddr_t)&arg, sizeof(arg)); 878f4b3ec61Sdh155122 error = ipf_deltoken(arg, uid, ctx, ifs); 879f4b3ec61Sdh155122 break; 880ab25eeb5Syz155240 default : 881ab25eeb5Syz155240 error = EINVAL; 882ab25eeb5Syz155240 break; 883ab25eeb5Syz155240 } 884ab25eeb5Syz155240 done: 885ab25eeb5Syz155240 if (nt) 886ab25eeb5Syz155240 KFREE(nt); 887ab25eeb5Syz155240 return error; 888ab25eeb5Syz155240 } 889ab25eeb5Syz155240 890ab25eeb5Syz155240 891ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 892ab25eeb5Syz155240 /* Function: nat_siocaddnat */ 893ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 894ab25eeb5Syz155240 /* Parameters: n(I) - pointer to new NAT rule */ 895ab25eeb5Syz155240 /* np(I) - pointer to where to insert new NAT rule */ 896ab25eeb5Syz155240 /* getlock(I) - flag indicating if lock on ipf_nat is held */ 897ab25eeb5Syz155240 /* Mutex Locks: ipf_natio */ 898ab25eeb5Syz155240 /* */ 899ab25eeb5Syz155240 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */ 900ab25eeb5Syz155240 /* from information passed to the kernel, then add it to the appropriate */ 901ab25eeb5Syz155240 /* NAT rule table(s). */ 902ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 903f4b3ec61Sdh155122 static int nat_siocaddnat(n, np, getlock, ifs) 904ab25eeb5Syz155240 ipnat_t *n, **np; 905ab25eeb5Syz155240 int getlock; 906f4b3ec61Sdh155122 ipf_stack_t *ifs; 907ab25eeb5Syz155240 { 908ab25eeb5Syz155240 int error = 0, i, j; 909ab25eeb5Syz155240 910dcf3e898Sjojemann if (nat_resolverule(n, ifs) != 0) 911ab25eeb5Syz155240 return ENOENT; 912ab25eeb5Syz155240 913ab25eeb5Syz155240 if ((n->in_age[0] == 0) && (n->in_age[1] != 0)) 914ab25eeb5Syz155240 return EINVAL; 915ab25eeb5Syz155240 916ab25eeb5Syz155240 n->in_use = 0; 917ab25eeb5Syz155240 if (n->in_redir & NAT_MAPBLK) 918ab25eeb5Syz155240 n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk); 919ab25eeb5Syz155240 else if (n->in_flags & IPN_AUTOPORTMAP) 920ab25eeb5Syz155240 n->in_space = USABLE_PORTS * ~ntohl(n->in_inmsk); 921ab25eeb5Syz155240 else if (n->in_flags & IPN_IPRANGE) 922ab25eeb5Syz155240 n->in_space = ntohl(n->in_outmsk) - ntohl(n->in_outip); 923ab25eeb5Syz155240 else if (n->in_flags & IPN_SPLIT) 924ab25eeb5Syz155240 n->in_space = 2; 925ab25eeb5Syz155240 else if (n->in_outmsk != 0) 926ab25eeb5Syz155240 n->in_space = ~ntohl(n->in_outmsk); 927ab25eeb5Syz155240 else 928ab25eeb5Syz155240 n->in_space = 1; 929ab25eeb5Syz155240 930ab25eeb5Syz155240 /* 931ab25eeb5Syz155240 * Calculate the number of valid IP addresses in the output 932ab25eeb5Syz155240 * mapping range. In all cases, the range is inclusive of 933ab25eeb5Syz155240 * the start and ending IP addresses. 934ab25eeb5Syz155240 * If to a CIDR address, lose 2: broadcast + network address 935ab25eeb5Syz155240 * (so subtract 1) 936ab25eeb5Syz155240 * If to a range, add one. 937ab25eeb5Syz155240 * If to a single IP address, set to 1. 938ab25eeb5Syz155240 */ 939ab25eeb5Syz155240 if (n->in_space) { 940ab25eeb5Syz155240 if ((n->in_flags & IPN_IPRANGE) != 0) 941ab25eeb5Syz155240 n->in_space += 1; 942ab25eeb5Syz155240 else 943ab25eeb5Syz155240 n->in_space -= 1; 944ab25eeb5Syz155240 } else 945ab25eeb5Syz155240 n->in_space = 1; 946ab25eeb5Syz155240 947ab25eeb5Syz155240 if ((n->in_outmsk != 0xffffffff) && (n->in_outmsk != 0) && 948ab25eeb5Syz155240 ((n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0)) 949ab25eeb5Syz155240 n->in_nip = ntohl(n->in_outip) + 1; 950ab25eeb5Syz155240 else if ((n->in_flags & IPN_SPLIT) && 951ab25eeb5Syz155240 (n->in_redir & NAT_REDIRECT)) 952ab25eeb5Syz155240 n->in_nip = ntohl(n->in_inip); 953ab25eeb5Syz155240 else 954ab25eeb5Syz155240 n->in_nip = ntohl(n->in_outip); 955ab25eeb5Syz155240 if (n->in_redir & NAT_MAP) { 956ab25eeb5Syz155240 n->in_pnext = ntohs(n->in_pmin); 957ab25eeb5Syz155240 /* 958ab25eeb5Syz155240 * Multiply by the number of ports made available. 959ab25eeb5Syz155240 */ 960ab25eeb5Syz155240 if (ntohs(n->in_pmax) >= ntohs(n->in_pmin)) { 961ab25eeb5Syz155240 n->in_space *= (ntohs(n->in_pmax) - 962ab25eeb5Syz155240 ntohs(n->in_pmin) + 1); 963ab25eeb5Syz155240 /* 964ab25eeb5Syz155240 * Because two different sources can map to 965ab25eeb5Syz155240 * different destinations but use the same 966ab25eeb5Syz155240 * local IP#/port #. 967ab25eeb5Syz155240 * If the result is smaller than in_space, then 968ab25eeb5Syz155240 * we may have wrapped around 32bits. 969ab25eeb5Syz155240 */ 970ab25eeb5Syz155240 i = n->in_inmsk; 971ab25eeb5Syz155240 if ((i != 0) && (i != 0xffffffff)) { 972ab25eeb5Syz155240 j = n->in_space * (~ntohl(i) + 1); 973ab25eeb5Syz155240 if (j >= n->in_space) 974ab25eeb5Syz155240 n->in_space = j; 975ab25eeb5Syz155240 else 976ab25eeb5Syz155240 n->in_space = 0xffffffff; 977ab25eeb5Syz155240 } 978ab25eeb5Syz155240 } 979ab25eeb5Syz155240 /* 980ab25eeb5Syz155240 * If no protocol is specified, multiple by 256 to allow for 981ab25eeb5Syz155240 * at least one IP:IP mapping per protocol. 982ab25eeb5Syz155240 */ 983ab25eeb5Syz155240 if ((n->in_flags & IPN_TCPUDPICMP) == 0) { 984ab25eeb5Syz155240 j = n->in_space * 256; 985ab25eeb5Syz155240 if (j >= n->in_space) 986ab25eeb5Syz155240 n->in_space = j; 987ab25eeb5Syz155240 else 988ab25eeb5Syz155240 n->in_space = 0xffffffff; 989ab25eeb5Syz155240 } 990ab25eeb5Syz155240 } 991ab25eeb5Syz155240 992ab25eeb5Syz155240 /* Otherwise, these fields are preset */ 993ab25eeb5Syz155240 994ab25eeb5Syz155240 if (getlock) { 995f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 996ab25eeb5Syz155240 } 997ab25eeb5Syz155240 n->in_next = NULL; 998ab25eeb5Syz155240 *np = n; 999ab25eeb5Syz155240 1000ab25eeb5Syz155240 if (n->in_age[0] != 0) 1001f4b3ec61Sdh155122 n->in_tqehead[0] = fr_addtimeoutqueue(&ifs->ifs_nat_utqe, 1002f4b3ec61Sdh155122 n->in_age[0], ifs); 1003ab25eeb5Syz155240 1004ab25eeb5Syz155240 if (n->in_age[1] != 0) 1005f4b3ec61Sdh155122 n->in_tqehead[1] = fr_addtimeoutqueue(&ifs->ifs_nat_utqe, 1006f4b3ec61Sdh155122 n->in_age[1], ifs); 1007ab25eeb5Syz155240 1008ab25eeb5Syz155240 if (n->in_redir & NAT_REDIRECT) { 1009ab25eeb5Syz155240 n->in_flags &= ~IPN_NOTDST; 1010f4b3ec61Sdh155122 nat_addrdr(n, ifs); 1011ab25eeb5Syz155240 } 1012ab25eeb5Syz155240 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) { 1013ab25eeb5Syz155240 n->in_flags &= ~IPN_NOTSRC; 1014f4b3ec61Sdh155122 nat_addnat(n, ifs); 1015ab25eeb5Syz155240 } 1016ab25eeb5Syz155240 n = NULL; 1017f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules++; 1018ab25eeb5Syz155240 if (getlock) { 1019f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); /* WRITE */ 1020ab25eeb5Syz155240 } 1021ab25eeb5Syz155240 1022ab25eeb5Syz155240 return error; 1023ab25eeb5Syz155240 } 1024ab25eeb5Syz155240 1025ab25eeb5Syz155240 1026ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1027ab25eeb5Syz155240 /* Function: nat_resolvrule */ 1028dcf3e898Sjojemann /* Returns: int - 0 == success, -1 == failure */ 1029ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule */ 1030ab25eeb5Syz155240 /* */ 1031dcf3e898Sjojemann /* Resolve some of the details inside the NAT rule. Includes resolving */ 1032dcf3e898Sjojemann /* any specified interfaces and proxy labels, and determines whether or not */ 1033dcf3e898Sjojemann /* all proxy labels are correctly specified. */ 1034dcf3e898Sjojemann /* */ 1035dcf3e898Sjojemann /* Called by nat_siocaddnat() (SIOCADNAT) and fr_natputent (SIOCSTPUT). */ 1036ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1037dcf3e898Sjojemann static int nat_resolverule(n, ifs) 1038ab25eeb5Syz155240 ipnat_t *n; 1039f4b3ec61Sdh155122 ipf_stack_t *ifs; 1040ab25eeb5Syz155240 { 1041ab25eeb5Syz155240 n->in_ifnames[0][LIFNAMSIZ - 1] = '\0'; 1042f4b3ec61Sdh155122 n->in_ifps[0] = fr_resolvenic(n->in_ifnames[0], 4, ifs); 1043ab25eeb5Syz155240 1044ab25eeb5Syz155240 n->in_ifnames[1][LIFNAMSIZ - 1] = '\0'; 1045ab25eeb5Syz155240 if (n->in_ifnames[1][0] == '\0') { 1046ab25eeb5Syz155240 (void) strncpy(n->in_ifnames[1], n->in_ifnames[0], LIFNAMSIZ); 1047ab25eeb5Syz155240 n->in_ifps[1] = n->in_ifps[0]; 1048ab25eeb5Syz155240 } else { 1049d3675867Sjojemann n->in_ifps[1] = fr_resolvenic(n->in_ifnames[1], 4, ifs); 1050ab25eeb5Syz155240 } 1051ab25eeb5Syz155240 1052ab25eeb5Syz155240 if (n->in_plabel[0] != '\0') { 1053f4b3ec61Sdh155122 n->in_apr = appr_lookup(n->in_p, n->in_plabel, ifs); 1054dcf3e898Sjojemann if (n->in_apr == NULL) 1055dcf3e898Sjojemann return -1; 1056ab25eeb5Syz155240 } 1057dcf3e898Sjojemann return 0; 1058ab25eeb5Syz155240 } 1059ab25eeb5Syz155240 1060ab25eeb5Syz155240 1061ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1062ab25eeb5Syz155240 /* Function: nat_siocdelnat */ 1063ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 1064ab25eeb5Syz155240 /* Parameters: n(I) - pointer to new NAT rule */ 1065ab25eeb5Syz155240 /* np(I) - pointer to where to insert new NAT rule */ 1066ab25eeb5Syz155240 /* getlock(I) - flag indicating if lock on ipf_nat is held */ 1067ab25eeb5Syz155240 /* Mutex Locks: ipf_natio */ 1068ab25eeb5Syz155240 /* */ 1069ab25eeb5Syz155240 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */ 1070ab25eeb5Syz155240 /* from information passed to the kernel, then add it to the appropriate */ 1071ab25eeb5Syz155240 /* NAT rule table(s). */ 1072ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1073f4b3ec61Sdh155122 static void nat_siocdelnat(n, np, getlock, ifs) 1074ab25eeb5Syz155240 ipnat_t *n, **np; 1075ab25eeb5Syz155240 int getlock; 1076f4b3ec61Sdh155122 ipf_stack_t *ifs; 1077ab25eeb5Syz155240 { 1078ab25eeb5Syz155240 if (getlock) { 1079f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 1080ab25eeb5Syz155240 } 1081ab25eeb5Syz155240 if (n->in_redir & NAT_REDIRECT) 1082ab25eeb5Syz155240 nat_delrdr(n); 1083ab25eeb5Syz155240 if (n->in_redir & (NAT_MAPBLK|NAT_MAP)) 1084ab25eeb5Syz155240 nat_delnat(n); 1085f4b3ec61Sdh155122 if (ifs->ifs_nat_list == NULL) { 1086f4b3ec61Sdh155122 ifs->ifs_nat_masks = 0; 1087f4b3ec61Sdh155122 ifs->ifs_rdr_masks = 0; 1088ab25eeb5Syz155240 } 1089ab25eeb5Syz155240 1090ab25eeb5Syz155240 if (n->in_tqehead[0] != NULL) { 1091ab25eeb5Syz155240 if (fr_deletetimeoutqueue(n->in_tqehead[0]) == 0) { 10923805c50fSan207044 fr_freetimeoutqueue(n->in_tqehead[0], ifs); 1093ab25eeb5Syz155240 } 1094ab25eeb5Syz155240 } 1095ab25eeb5Syz155240 1096ab25eeb5Syz155240 if (n->in_tqehead[1] != NULL) { 1097ab25eeb5Syz155240 if (fr_deletetimeoutqueue(n->in_tqehead[1]) == 0) { 1098f4b3ec61Sdh155122 fr_freetimeoutqueue(n->in_tqehead[1], ifs); 1099ab25eeb5Syz155240 } 1100ab25eeb5Syz155240 } 1101ab25eeb5Syz155240 1102ab25eeb5Syz155240 *np = n->in_next; 1103ab25eeb5Syz155240 1104ab25eeb5Syz155240 if (n->in_use == 0) { 1105ab25eeb5Syz155240 if (n->in_apr) 1106ab25eeb5Syz155240 appr_free(n->in_apr); 1107ab25eeb5Syz155240 KFREE(n); 1108f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules--; 1109ab25eeb5Syz155240 } else { 1110ab25eeb5Syz155240 n->in_flags |= IPN_DELETE; 1111ab25eeb5Syz155240 n->in_next = NULL; 1112ab25eeb5Syz155240 } 1113ab25eeb5Syz155240 if (getlock) { 1114f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); /* READ/WRITE */ 1115ab25eeb5Syz155240 } 1116ab25eeb5Syz155240 } 1117ab25eeb5Syz155240 1118ab25eeb5Syz155240 1119ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1120ab25eeb5Syz155240 /* Function: fr_natgetsz */ 1121ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 is the error value. */ 1122ab25eeb5Syz155240 /* Parameters: data(I) - pointer to natget structure with kernel pointer */ 1123ab25eeb5Syz155240 /* get the size of. */ 1124ab25eeb5Syz155240 /* */ 1125ab25eeb5Syz155240 /* Handle SIOCSTGSZ. */ 1126ab25eeb5Syz155240 /* Return the size of the nat list entry to be copied back to user space. */ 1127ab25eeb5Syz155240 /* The size of the entry is stored in the ng_sz field and the enture natget */ 1128ab25eeb5Syz155240 /* structure is copied back to the user. */ 1129ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1130f4b3ec61Sdh155122 static int fr_natgetsz(data, ifs) 1131ab25eeb5Syz155240 caddr_t data; 1132f4b3ec61Sdh155122 ipf_stack_t *ifs; 1133ab25eeb5Syz155240 { 1134ab25eeb5Syz155240 ap_session_t *aps; 1135ab25eeb5Syz155240 nat_t *nat, *n; 1136ab25eeb5Syz155240 natget_t ng; 1137ab25eeb5Syz155240 1138ab25eeb5Syz155240 BCOPYIN(data, &ng, sizeof(ng)); 1139ab25eeb5Syz155240 1140ab25eeb5Syz155240 nat = ng.ng_ptr; 1141ab25eeb5Syz155240 if (!nat) { 1142f4b3ec61Sdh155122 nat = ifs->ifs_nat_instances; 1143ab25eeb5Syz155240 ng.ng_sz = 0; 1144ab25eeb5Syz155240 /* 1145ab25eeb5Syz155240 * Empty list so the size returned is 0. Simple. 1146ab25eeb5Syz155240 */ 1147ab25eeb5Syz155240 if (nat == NULL) { 1148ab25eeb5Syz155240 BCOPYOUT(&ng, data, sizeof(ng)); 1149ab25eeb5Syz155240 return 0; 1150ab25eeb5Syz155240 } 1151ab25eeb5Syz155240 } else { 1152ab25eeb5Syz155240 /* 1153ab25eeb5Syz155240 * Make sure the pointer we're copying from exists in the 1154ab25eeb5Syz155240 * current list of entries. Security precaution to prevent 1155ab25eeb5Syz155240 * copying of random kernel data. 1156ab25eeb5Syz155240 */ 1157f4b3ec61Sdh155122 for (n = ifs->ifs_nat_instances; n; n = n->nat_next) 1158ab25eeb5Syz155240 if (n == nat) 1159ab25eeb5Syz155240 break; 1160ab25eeb5Syz155240 if (!n) 1161ab25eeb5Syz155240 return ESRCH; 1162ab25eeb5Syz155240 } 1163ab25eeb5Syz155240 1164ab25eeb5Syz155240 /* 1165ab25eeb5Syz155240 * Incluse any space required for proxy data structures. 1166ab25eeb5Syz155240 */ 1167ab25eeb5Syz155240 ng.ng_sz = sizeof(nat_save_t); 1168ab25eeb5Syz155240 aps = nat->nat_aps; 1169ab25eeb5Syz155240 if (aps != NULL) { 1170ab25eeb5Syz155240 ng.ng_sz += sizeof(ap_session_t) - 4; 1171ab25eeb5Syz155240 if (aps->aps_data != 0) 1172ab25eeb5Syz155240 ng.ng_sz += aps->aps_psiz; 1173ab25eeb5Syz155240 } 1174ab25eeb5Syz155240 1175ab25eeb5Syz155240 BCOPYOUT(&ng, data, sizeof(ng)); 1176ab25eeb5Syz155240 return 0; 1177ab25eeb5Syz155240 } 1178ab25eeb5Syz155240 1179ab25eeb5Syz155240 1180ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1181ab25eeb5Syz155240 /* Function: fr_natgetent */ 1182ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 is the error value. */ 1183ab25eeb5Syz155240 /* Parameters: data(I) - pointer to natget structure with kernel pointer */ 1184ab25eeb5Syz155240 /* to NAT structure to copy out. */ 1185ab25eeb5Syz155240 /* */ 1186ab25eeb5Syz155240 /* Handle SIOCSTGET. */ 1187ab25eeb5Syz155240 /* Copies out NAT entry to user space. Any additional data held for a */ 1188ab25eeb5Syz155240 /* proxy is also copied, as to is the NAT rule which was responsible for it */ 1189ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1190f4b3ec61Sdh155122 static int fr_natgetent(data, ifs) 1191ab25eeb5Syz155240 caddr_t data; 1192f4b3ec61Sdh155122 ipf_stack_t *ifs; 1193ab25eeb5Syz155240 { 1194ab25eeb5Syz155240 int error, outsize; 1195ab25eeb5Syz155240 ap_session_t *aps; 1196ab25eeb5Syz155240 nat_save_t *ipn, ipns; 1197ab25eeb5Syz155240 nat_t *n, *nat; 1198ab25eeb5Syz155240 1199ab25eeb5Syz155240 error = fr_inobj(data, &ipns, IPFOBJ_NATSAVE); 1200ab25eeb5Syz155240 if (error != 0) 1201ab25eeb5Syz155240 return error; 1202ab25eeb5Syz155240 1203ab25eeb5Syz155240 if ((ipns.ipn_dsize < sizeof(ipns)) || (ipns.ipn_dsize > 81920)) 1204ab25eeb5Syz155240 return EINVAL; 1205ab25eeb5Syz155240 1206ab25eeb5Syz155240 KMALLOCS(ipn, nat_save_t *, ipns.ipn_dsize); 1207ab25eeb5Syz155240 if (ipn == NULL) 1208ab25eeb5Syz155240 return ENOMEM; 1209ab25eeb5Syz155240 1210ab25eeb5Syz155240 ipn->ipn_dsize = ipns.ipn_dsize; 1211ab25eeb5Syz155240 nat = ipns.ipn_next; 1212ab25eeb5Syz155240 if (nat == NULL) { 1213f4b3ec61Sdh155122 nat = ifs->ifs_nat_instances; 1214ab25eeb5Syz155240 if (nat == NULL) { 1215f4b3ec61Sdh155122 if (ifs->ifs_nat_instances == NULL) 1216ab25eeb5Syz155240 error = ENOENT; 1217ab25eeb5Syz155240 goto finished; 1218ab25eeb5Syz155240 } 1219ab25eeb5Syz155240 } else { 1220ab25eeb5Syz155240 /* 1221ab25eeb5Syz155240 * Make sure the pointer we're copying from exists in the 1222ab25eeb5Syz155240 * current list of entries. Security precaution to prevent 1223ab25eeb5Syz155240 * copying of random kernel data. 1224ab25eeb5Syz155240 */ 1225f4b3ec61Sdh155122 for (n = ifs->ifs_nat_instances; n; n = n->nat_next) 1226ab25eeb5Syz155240 if (n == nat) 1227ab25eeb5Syz155240 break; 1228ab25eeb5Syz155240 if (n == NULL) { 1229ab25eeb5Syz155240 error = ESRCH; 1230ab25eeb5Syz155240 goto finished; 1231ab25eeb5Syz155240 } 1232ab25eeb5Syz155240 } 1233ab25eeb5Syz155240 ipn->ipn_next = nat->nat_next; 1234ab25eeb5Syz155240 1235ab25eeb5Syz155240 /* 1236ab25eeb5Syz155240 * Copy the NAT structure. 1237ab25eeb5Syz155240 */ 1238ab25eeb5Syz155240 bcopy((char *)nat, &ipn->ipn_nat, sizeof(*nat)); 1239ab25eeb5Syz155240 1240ab25eeb5Syz155240 /* 1241ab25eeb5Syz155240 * If we have a pointer to the NAT rule it belongs to, save that too. 1242ab25eeb5Syz155240 */ 1243ab25eeb5Syz155240 if (nat->nat_ptr != NULL) 1244ab25eeb5Syz155240 bcopy((char *)nat->nat_ptr, (char *)&ipn->ipn_ipnat, 1245ab25eeb5Syz155240 sizeof(ipn->ipn_ipnat)); 1246ab25eeb5Syz155240 1247ab25eeb5Syz155240 /* 1248ab25eeb5Syz155240 * If we also know the NAT entry has an associated filter rule, 1249ab25eeb5Syz155240 * save that too. 1250ab25eeb5Syz155240 */ 1251ab25eeb5Syz155240 if (nat->nat_fr != NULL) 1252ab25eeb5Syz155240 bcopy((char *)nat->nat_fr, (char *)&ipn->ipn_fr, 1253ab25eeb5Syz155240 sizeof(ipn->ipn_fr)); 1254ab25eeb5Syz155240 1255ab25eeb5Syz155240 /* 1256ab25eeb5Syz155240 * Last but not least, if there is an application proxy session set 1257ab25eeb5Syz155240 * up for this NAT entry, then copy that out too, including any 1258ab25eeb5Syz155240 * private data saved along side it by the proxy. 1259ab25eeb5Syz155240 */ 1260ab25eeb5Syz155240 aps = nat->nat_aps; 1261ab25eeb5Syz155240 outsize = ipn->ipn_dsize - sizeof(*ipn) + sizeof(ipn->ipn_data); 1262ab25eeb5Syz155240 if (aps != NULL) { 1263ab25eeb5Syz155240 char *s; 1264ab25eeb5Syz155240 1265ab25eeb5Syz155240 if (outsize < sizeof(*aps)) { 1266ab25eeb5Syz155240 error = ENOBUFS; 1267ab25eeb5Syz155240 goto finished; 1268ab25eeb5Syz155240 } 1269ab25eeb5Syz155240 1270ab25eeb5Syz155240 s = ipn->ipn_data; 1271ab25eeb5Syz155240 bcopy((char *)aps, s, sizeof(*aps)); 1272ab25eeb5Syz155240 s += sizeof(*aps); 1273ab25eeb5Syz155240 outsize -= sizeof(*aps); 1274ab25eeb5Syz155240 if ((aps->aps_data != NULL) && (outsize >= aps->aps_psiz)) 1275ab25eeb5Syz155240 bcopy(aps->aps_data, s, aps->aps_psiz); 1276ab25eeb5Syz155240 else 1277ab25eeb5Syz155240 error = ENOBUFS; 1278ab25eeb5Syz155240 } 1279ab25eeb5Syz155240 if (error == 0) { 1280ab25eeb5Syz155240 error = fr_outobjsz(data, ipn, IPFOBJ_NATSAVE, ipns.ipn_dsize); 1281ab25eeb5Syz155240 } 1282ab25eeb5Syz155240 1283ab25eeb5Syz155240 finished: 1284ab25eeb5Syz155240 if (ipn != NULL) { 1285ab25eeb5Syz155240 KFREES(ipn, ipns.ipn_dsize); 1286ab25eeb5Syz155240 } 1287ab25eeb5Syz155240 return error; 1288ab25eeb5Syz155240 } 1289ab25eeb5Syz155240 1290ab25eeb5Syz155240 1291ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1292ab25eeb5Syz155240 /* Function: fr_natputent */ 1293ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 is the error value. */ 1294ab25eeb5Syz155240 /* Parameters: data(I) - pointer to natget structure with NAT */ 1295ab25eeb5Syz155240 /* structure information to load into the kernel */ 1296ab25eeb5Syz155240 /* getlock(I) - flag indicating whether or not a write lock */ 1297ab25eeb5Syz155240 /* on ipf_nat is already held. */ 1298ab25eeb5Syz155240 /* */ 1299ab25eeb5Syz155240 /* Handle SIOCSTPUT. */ 1300ab25eeb5Syz155240 /* Loads a NAT table entry from user space, including a NAT rule, proxy and */ 1301ab25eeb5Syz155240 /* firewall rule data structures, if pointers to them indicate so. */ 1302ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1303f4b3ec61Sdh155122 static int fr_natputent(data, getlock, ifs) 1304ab25eeb5Syz155240 caddr_t data; 1305ab25eeb5Syz155240 int getlock; 1306f4b3ec61Sdh155122 ipf_stack_t *ifs; 1307ab25eeb5Syz155240 { 1308ab25eeb5Syz155240 nat_save_t ipn, *ipnn; 1309ab25eeb5Syz155240 ap_session_t *aps; 1310ab25eeb5Syz155240 nat_t *n, *nat; 1311ab25eeb5Syz155240 frentry_t *fr; 1312ab25eeb5Syz155240 fr_info_t fin; 1313ab25eeb5Syz155240 ipnat_t *in; 1314ab25eeb5Syz155240 int error; 1315ab25eeb5Syz155240 1316ab25eeb5Syz155240 error = fr_inobj(data, &ipn, IPFOBJ_NATSAVE); 1317ab25eeb5Syz155240 if (error != 0) 1318ab25eeb5Syz155240 return error; 1319ab25eeb5Syz155240 1320ab25eeb5Syz155240 /* 13213805c50fSan207044 * Trigger automatic call to nat_extraflush() if the 13223805c50fSan207044 * table has reached capcity specified by hi watermark. 13233805c50fSan207044 */ 13243805c50fSan207044 if (NAT_TAB_WATER_LEVEL(ifs) > ifs->ifs_nat_flush_lvl_hi) 13253805c50fSan207044 ifs->ifs_nat_doflush = 1; 13263805c50fSan207044 13273805c50fSan207044 /* 1328ab25eeb5Syz155240 * Initialise early because of code at junkput label. 1329ab25eeb5Syz155240 */ 1330ab25eeb5Syz155240 in = NULL; 1331ab25eeb5Syz155240 aps = NULL; 1332ab25eeb5Syz155240 nat = NULL; 1333ab25eeb5Syz155240 ipnn = NULL; 1334ab25eeb5Syz155240 1335ab25eeb5Syz155240 /* 1336ab25eeb5Syz155240 * New entry, copy in the rest of the NAT entry if it's size is more 1337ab25eeb5Syz155240 * than just the nat_t structure. 1338ab25eeb5Syz155240 */ 1339ab25eeb5Syz155240 fr = NULL; 1340ab25eeb5Syz155240 if (ipn.ipn_dsize > sizeof(ipn)) { 1341ab25eeb5Syz155240 if (ipn.ipn_dsize > 81920) { 1342ab25eeb5Syz155240 error = ENOMEM; 1343ab25eeb5Syz155240 goto junkput; 1344ab25eeb5Syz155240 } 1345ab25eeb5Syz155240 1346ab25eeb5Syz155240 KMALLOCS(ipnn, nat_save_t *, ipn.ipn_dsize); 1347ab25eeb5Syz155240 if (ipnn == NULL) 1348ab25eeb5Syz155240 return ENOMEM; 1349ab25eeb5Syz155240 1350ab25eeb5Syz155240 error = fr_inobjsz(data, ipnn, IPFOBJ_NATSAVE, ipn.ipn_dsize); 1351ab25eeb5Syz155240 if (error != 0) { 1352ab25eeb5Syz155240 error = EFAULT; 1353ab25eeb5Syz155240 goto junkput; 1354ab25eeb5Syz155240 } 1355ab25eeb5Syz155240 } else 1356ab25eeb5Syz155240 ipnn = &ipn; 1357ab25eeb5Syz155240 1358ab25eeb5Syz155240 KMALLOC(nat, nat_t *); 1359ab25eeb5Syz155240 if (nat == NULL) { 1360ab25eeb5Syz155240 error = ENOMEM; 1361ab25eeb5Syz155240 goto junkput; 1362ab25eeb5Syz155240 } 1363ab25eeb5Syz155240 1364ab25eeb5Syz155240 bcopy((char *)&ipnn->ipn_nat, (char *)nat, sizeof(*nat)); 1365ab25eeb5Syz155240 /* 1366ab25eeb5Syz155240 * Initialize all these so that nat_delete() doesn't cause a crash. 1367ab25eeb5Syz155240 */ 1368ab25eeb5Syz155240 bzero((char *)nat, offsetof(struct nat, nat_tqe)); 1369ab25eeb5Syz155240 nat->nat_tqe.tqe_pnext = NULL; 1370ab25eeb5Syz155240 nat->nat_tqe.tqe_next = NULL; 1371ab25eeb5Syz155240 nat->nat_tqe.tqe_ifq = NULL; 1372ab25eeb5Syz155240 nat->nat_tqe.tqe_parent = nat; 1373ab25eeb5Syz155240 1374ab25eeb5Syz155240 /* 1375ab25eeb5Syz155240 * Restore the rule associated with this nat session 1376ab25eeb5Syz155240 */ 1377ab25eeb5Syz155240 in = ipnn->ipn_nat.nat_ptr; 1378ab25eeb5Syz155240 if (in != NULL) { 1379ab25eeb5Syz155240 KMALLOC(in, ipnat_t *); 1380ab25eeb5Syz155240 nat->nat_ptr = in; 1381ab25eeb5Syz155240 if (in == NULL) { 1382ab25eeb5Syz155240 error = ENOMEM; 1383ab25eeb5Syz155240 goto junkput; 1384ab25eeb5Syz155240 } 1385ab25eeb5Syz155240 bzero((char *)in, offsetof(struct ipnat, in_next6)); 1386ab25eeb5Syz155240 bcopy((char *)&ipnn->ipn_ipnat, (char *)in, sizeof(*in)); 1387ab25eeb5Syz155240 in->in_use = 1; 1388ab25eeb5Syz155240 in->in_flags |= IPN_DELETE; 1389ab25eeb5Syz155240 1390f4b3ec61Sdh155122 ATOMIC_INC(ifs->ifs_nat_stats.ns_rules); 1391ab25eeb5Syz155240 1392dcf3e898Sjojemann if (nat_resolverule(in, ifs) != 0) { 1393dcf3e898Sjojemann error = ESRCH; 1394dcf3e898Sjojemann goto junkput; 1395dcf3e898Sjojemann } 1396ab25eeb5Syz155240 } 1397ab25eeb5Syz155240 1398ab25eeb5Syz155240 /* 1399ab25eeb5Syz155240 * Check that the NAT entry doesn't already exist in the kernel. 1400ab25eeb5Syz155240 */ 1401ab25eeb5Syz155240 bzero((char *)&fin, sizeof(fin)); 1402ab25eeb5Syz155240 fin.fin_p = nat->nat_p; 140375c9105fSjojemann fin.fin_ifs = ifs; 1404ab25eeb5Syz155240 if (nat->nat_dir == NAT_OUTBOUND) { 1405ab25eeb5Syz155240 fin.fin_data[0] = ntohs(nat->nat_oport); 1406ab25eeb5Syz155240 fin.fin_data[1] = ntohs(nat->nat_outport); 1407e6c6c1faSyz155240 fin.fin_ifp = nat->nat_ifps[0]; 1408ab25eeb5Syz155240 if (getlock) { 1409f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 1410ab25eeb5Syz155240 } 1411ab25eeb5Syz155240 n = nat_inlookup(&fin, nat->nat_flags, fin.fin_p, 1412ab25eeb5Syz155240 nat->nat_oip, nat->nat_outip); 1413ab25eeb5Syz155240 if (getlock) { 1414f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1415ab25eeb5Syz155240 } 1416ab25eeb5Syz155240 if (n != NULL) { 1417ab25eeb5Syz155240 error = EEXIST; 1418ab25eeb5Syz155240 goto junkput; 1419ab25eeb5Syz155240 } 1420ab25eeb5Syz155240 } else if (nat->nat_dir == NAT_INBOUND) { 1421ab25eeb5Syz155240 fin.fin_data[0] = ntohs(nat->nat_inport); 1422ab25eeb5Syz155240 fin.fin_data[1] = ntohs(nat->nat_oport); 1423e6c6c1faSyz155240 fin.fin_ifp = nat->nat_ifps[1]; 1424ab25eeb5Syz155240 if (getlock) { 1425f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 1426ab25eeb5Syz155240 } 1427ab25eeb5Syz155240 n = nat_outlookup(&fin, nat->nat_flags, fin.fin_p, 1428e6c6c1faSyz155240 nat->nat_inip, nat->nat_oip); 1429ab25eeb5Syz155240 if (getlock) { 1430f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1431ab25eeb5Syz155240 } 1432ab25eeb5Syz155240 if (n != NULL) { 1433ab25eeb5Syz155240 error = EEXIST; 1434ab25eeb5Syz155240 goto junkput; 1435ab25eeb5Syz155240 } 1436ab25eeb5Syz155240 } else { 1437ab25eeb5Syz155240 error = EINVAL; 1438ab25eeb5Syz155240 goto junkput; 1439ab25eeb5Syz155240 } 1440ab25eeb5Syz155240 1441ab25eeb5Syz155240 /* 1442ab25eeb5Syz155240 * Restore ap_session_t structure. Include the private data allocated 1443ab25eeb5Syz155240 * if it was there. 1444ab25eeb5Syz155240 */ 1445ab25eeb5Syz155240 aps = nat->nat_aps; 1446ab25eeb5Syz155240 if (aps != NULL) { 1447ab25eeb5Syz155240 KMALLOC(aps, ap_session_t *); 1448ab25eeb5Syz155240 nat->nat_aps = aps; 1449ab25eeb5Syz155240 if (aps == NULL) { 1450ab25eeb5Syz155240 error = ENOMEM; 1451ab25eeb5Syz155240 goto junkput; 1452ab25eeb5Syz155240 } 1453ab25eeb5Syz155240 bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps)); 1454ab25eeb5Syz155240 if (in != NULL) 1455ab25eeb5Syz155240 aps->aps_apr = in->in_apr; 1456ab25eeb5Syz155240 else 1457ab25eeb5Syz155240 aps->aps_apr = NULL; 1458ab25eeb5Syz155240 if (aps->aps_psiz != 0) { 1459ab25eeb5Syz155240 if (aps->aps_psiz > 81920) { 1460ab25eeb5Syz155240 error = ENOMEM; 1461ab25eeb5Syz155240 goto junkput; 1462ab25eeb5Syz155240 } 1463ab25eeb5Syz155240 KMALLOCS(aps->aps_data, void *, aps->aps_psiz); 1464ab25eeb5Syz155240 if (aps->aps_data == NULL) { 1465ab25eeb5Syz155240 error = ENOMEM; 1466ab25eeb5Syz155240 goto junkput; 1467ab25eeb5Syz155240 } 1468ab25eeb5Syz155240 bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data, 1469ab25eeb5Syz155240 aps->aps_psiz); 1470ab25eeb5Syz155240 } else { 1471ab25eeb5Syz155240 aps->aps_psiz = 0; 1472ab25eeb5Syz155240 aps->aps_data = NULL; 1473ab25eeb5Syz155240 } 1474ab25eeb5Syz155240 } 1475ab25eeb5Syz155240 1476ab25eeb5Syz155240 /* 1477ab25eeb5Syz155240 * If there was a filtering rule associated with this entry then 1478ab25eeb5Syz155240 * build up a new one. 1479ab25eeb5Syz155240 */ 1480ab25eeb5Syz155240 fr = nat->nat_fr; 1481ab25eeb5Syz155240 if (fr != NULL) { 1482ab25eeb5Syz155240 if ((nat->nat_flags & SI_NEWFR) != 0) { 1483ab25eeb5Syz155240 KMALLOC(fr, frentry_t *); 1484ab25eeb5Syz155240 nat->nat_fr = fr; 1485ab25eeb5Syz155240 if (fr == NULL) { 1486ab25eeb5Syz155240 error = ENOMEM; 1487ab25eeb5Syz155240 goto junkput; 1488ab25eeb5Syz155240 } 1489ab25eeb5Syz155240 ipnn->ipn_nat.nat_fr = fr; 1490ab25eeb5Syz155240 (void) fr_outobj(data, ipnn, IPFOBJ_NATSAVE); 1491ab25eeb5Syz155240 bcopy((char *)&ipnn->ipn_fr, (char *)fr, sizeof(*fr)); 1492dcf3e898Sjojemann 1493dcf3e898Sjojemann fr->fr_ref = 1; 1494dcf3e898Sjojemann fr->fr_dsize = 0; 1495dcf3e898Sjojemann fr->fr_data = NULL; 1496dcf3e898Sjojemann fr->fr_type = FR_T_NONE; 1497dcf3e898Sjojemann 1498ab25eeb5Syz155240 MUTEX_NUKE(&fr->fr_lock); 1499ab25eeb5Syz155240 MUTEX_INIT(&fr->fr_lock, "nat-filter rule lock"); 1500ab25eeb5Syz155240 } else { 1501dcf3e898Sjojemann if (getlock) { 1502f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 1503dcf3e898Sjojemann } 1504f4b3ec61Sdh155122 for (n = ifs->ifs_nat_instances; n; n = n->nat_next) 1505ab25eeb5Syz155240 if (n->nat_fr == fr) 1506ab25eeb5Syz155240 break; 1507ab25eeb5Syz155240 1508ab25eeb5Syz155240 if (n != NULL) { 1509ab25eeb5Syz155240 MUTEX_ENTER(&fr->fr_lock); 1510ab25eeb5Syz155240 fr->fr_ref++; 1511ab25eeb5Syz155240 MUTEX_EXIT(&fr->fr_lock); 1512ab25eeb5Syz155240 } 1513dcf3e898Sjojemann if (getlock) { 1514f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1515dcf3e898Sjojemann } 1516ab25eeb5Syz155240 if (!n) { 1517ab25eeb5Syz155240 error = ESRCH; 1518ab25eeb5Syz155240 goto junkput; 1519ab25eeb5Syz155240 } 1520ab25eeb5Syz155240 } 1521ab25eeb5Syz155240 } 1522ab25eeb5Syz155240 1523ab25eeb5Syz155240 if (ipnn != &ipn) { 1524ab25eeb5Syz155240 KFREES(ipnn, ipn.ipn_dsize); 1525ab25eeb5Syz155240 ipnn = NULL; 1526ab25eeb5Syz155240 } 1527ab25eeb5Syz155240 1528ab25eeb5Syz155240 if (getlock) { 1529f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 1530ab25eeb5Syz155240 } 1531f4b3ec61Sdh155122 error = nat_insert(nat, nat->nat_rev, ifs); 1532ab25eeb5Syz155240 if ((error == 0) && (aps != NULL)) { 1533f4b3ec61Sdh155122 aps->aps_next = ifs->ifs_ap_sess_list; 1534f4b3ec61Sdh155122 ifs->ifs_ap_sess_list = aps; 1535ab25eeb5Syz155240 } 1536ab25eeb5Syz155240 if (getlock) { 1537f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1538ab25eeb5Syz155240 } 1539ab25eeb5Syz155240 1540ab25eeb5Syz155240 if (error == 0) 1541ab25eeb5Syz155240 return 0; 1542ab25eeb5Syz155240 1543ab25eeb5Syz155240 error = ENOMEM; 1544ab25eeb5Syz155240 1545ab25eeb5Syz155240 junkput: 1546ab25eeb5Syz155240 if (fr != NULL) 1547f4b3ec61Sdh155122 (void) fr_derefrule(&fr, ifs); 1548ab25eeb5Syz155240 1549ab25eeb5Syz155240 if ((ipnn != NULL) && (ipnn != &ipn)) { 1550ab25eeb5Syz155240 KFREES(ipnn, ipn.ipn_dsize); 1551ab25eeb5Syz155240 } 1552ab25eeb5Syz155240 if (nat != NULL) { 1553ab25eeb5Syz155240 if (aps != NULL) { 1554ab25eeb5Syz155240 if (aps->aps_data != NULL) { 1555ab25eeb5Syz155240 KFREES(aps->aps_data, aps->aps_psiz); 1556ab25eeb5Syz155240 } 1557ab25eeb5Syz155240 KFREE(aps); 1558ab25eeb5Syz155240 } 1559ab25eeb5Syz155240 if (in != NULL) { 1560ab25eeb5Syz155240 if (in->in_apr) 1561ab25eeb5Syz155240 appr_free(in->in_apr); 1562ab25eeb5Syz155240 KFREE(in); 1563ab25eeb5Syz155240 } 1564ab25eeb5Syz155240 KFREE(nat); 1565ab25eeb5Syz155240 } 1566ab25eeb5Syz155240 return error; 1567ab25eeb5Syz155240 } 1568ab25eeb5Syz155240 1569ab25eeb5Syz155240 1570ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1571ab25eeb5Syz155240 /* Function: nat_delete */ 1572ab25eeb5Syz155240 /* Returns: Nil */ 1573ab25eeb5Syz155240 /* Parameters: natd(I) - pointer to NAT structure to delete */ 1574ab25eeb5Syz155240 /* logtype(I) - type of LOG record to create before deleting */ 1575ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 1576ab25eeb5Syz155240 /* */ 1577ab25eeb5Syz155240 /* Delete a nat entry from the various lists and table. If NAT logging is */ 1578ab25eeb5Syz155240 /* enabled then generate a NAT log record for this event. */ 1579ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1580f4b3ec61Sdh155122 static void nat_delete(nat, logtype, ifs) 1581ab25eeb5Syz155240 struct nat *nat; 1582ab25eeb5Syz155240 int logtype; 1583f4b3ec61Sdh155122 ipf_stack_t *ifs; 1584ab25eeb5Syz155240 { 1585ab25eeb5Syz155240 struct ipnat *ipn; 1586ab25eeb5Syz155240 1587f4b3ec61Sdh155122 if (logtype != 0 && ifs->ifs_nat_logging != 0) 1588f4b3ec61Sdh155122 nat_log(nat, logtype, ifs); 1589ab25eeb5Syz155240 1590ab25eeb5Syz155240 /* 1591ab25eeb5Syz155240 * Take it as a general indication that all the pointers are set if 1592ab25eeb5Syz155240 * nat_pnext is set. 1593ab25eeb5Syz155240 */ 1594ab25eeb5Syz155240 if (nat->nat_pnext != NULL) { 1595f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0][nat->nat_hv[0]]--; 1596f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][nat->nat_hv[1]]--; 1597ab25eeb5Syz155240 1598ab25eeb5Syz155240 *nat->nat_pnext = nat->nat_next; 1599ab25eeb5Syz155240 if (nat->nat_next != NULL) { 1600ab25eeb5Syz155240 nat->nat_next->nat_pnext = nat->nat_pnext; 1601ab25eeb5Syz155240 nat->nat_next = NULL; 1602ab25eeb5Syz155240 } 1603ab25eeb5Syz155240 nat->nat_pnext = NULL; 1604ab25eeb5Syz155240 1605ab25eeb5Syz155240 *nat->nat_phnext[0] = nat->nat_hnext[0]; 1606ab25eeb5Syz155240 if (nat->nat_hnext[0] != NULL) { 1607ab25eeb5Syz155240 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; 1608ab25eeb5Syz155240 nat->nat_hnext[0] = NULL; 1609ab25eeb5Syz155240 } 1610ab25eeb5Syz155240 nat->nat_phnext[0] = NULL; 1611ab25eeb5Syz155240 1612ab25eeb5Syz155240 *nat->nat_phnext[1] = nat->nat_hnext[1]; 1613ab25eeb5Syz155240 if (nat->nat_hnext[1] != NULL) { 1614ab25eeb5Syz155240 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; 1615ab25eeb5Syz155240 nat->nat_hnext[1] = NULL; 1616ab25eeb5Syz155240 } 1617ab25eeb5Syz155240 nat->nat_phnext[1] = NULL; 1618ab25eeb5Syz155240 1619ab25eeb5Syz155240 if ((nat->nat_flags & SI_WILDP) != 0) 1620f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_wilds--; 1621ab25eeb5Syz155240 } 1622ab25eeb5Syz155240 1623ab25eeb5Syz155240 if (nat->nat_me != NULL) { 1624ab25eeb5Syz155240 *nat->nat_me = NULL; 1625ab25eeb5Syz155240 nat->nat_me = NULL; 1626ab25eeb5Syz155240 } 1627ab25eeb5Syz155240 1628ab25eeb5Syz155240 fr_deletequeueentry(&nat->nat_tqe); 1629ab25eeb5Syz155240 1630*0e01ff8bSdr146992 MUTEX_ENTER(&nat->nat_lock); 1631*0e01ff8bSdr146992 if (nat->nat_ref > 1) { 1632ab25eeb5Syz155240 nat->nat_ref--; 1633*0e01ff8bSdr146992 MUTEX_EXIT(&nat->nat_lock); 1634ab25eeb5Syz155240 return; 1635ab25eeb5Syz155240 } 1636*0e01ff8bSdr146992 MUTEX_EXIT(&nat->nat_lock); 1637*0e01ff8bSdr146992 1638*0e01ff8bSdr146992 /* 1639*0e01ff8bSdr146992 * At this point, nat_ref is 1, doing "--" would make it 0.. 1640*0e01ff8bSdr146992 */ 1641*0e01ff8bSdr146992 nat->nat_ref = 0; 1642ab25eeb5Syz155240 1643ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 1644ab25eeb5Syz155240 if (nat->nat_sync) 1645ab25eeb5Syz155240 ipfsync_del(nat->nat_sync); 1646ab25eeb5Syz155240 #endif 1647ab25eeb5Syz155240 1648ab25eeb5Syz155240 if (nat->nat_fr != NULL) 1649f4b3ec61Sdh155122 (void)fr_derefrule(&nat->nat_fr, ifs); 1650ab25eeb5Syz155240 1651ab25eeb5Syz155240 if (nat->nat_hm != NULL) 1652ab25eeb5Syz155240 nat_hostmapdel(nat->nat_hm); 1653ab25eeb5Syz155240 1654ab25eeb5Syz155240 /* 1655ab25eeb5Syz155240 * If there is an active reference from the nat entry to its parent 1656ab25eeb5Syz155240 * rule, decrement the rule's reference count and free it too if no 1657ab25eeb5Syz155240 * longer being used. 1658ab25eeb5Syz155240 */ 1659ab25eeb5Syz155240 ipn = nat->nat_ptr; 1660ab25eeb5Syz155240 if (ipn != NULL) { 1661ab25eeb5Syz155240 ipn->in_space++; 1662ab25eeb5Syz155240 ipn->in_use--; 1663ab25eeb5Syz155240 if (ipn->in_use == 0 && (ipn->in_flags & IPN_DELETE)) { 1664ab25eeb5Syz155240 if (ipn->in_apr) 1665ab25eeb5Syz155240 appr_free(ipn->in_apr); 1666ab25eeb5Syz155240 KFREE(ipn); 1667f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules--; 1668ab25eeb5Syz155240 } 1669ab25eeb5Syz155240 } 1670ab25eeb5Syz155240 1671ab25eeb5Syz155240 MUTEX_DESTROY(&nat->nat_lock); 1672ab25eeb5Syz155240 1673f4b3ec61Sdh155122 aps_free(nat->nat_aps, ifs); 1674f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_inuse--; 1675ab25eeb5Syz155240 1676ab25eeb5Syz155240 /* 1677ab25eeb5Syz155240 * If there's a fragment table entry too for this nat entry, then 1678ab25eeb5Syz155240 * dereference that as well. This is after nat_lock is released 1679ab25eeb5Syz155240 * because of Tru64. 1680ab25eeb5Syz155240 */ 1681f4b3ec61Sdh155122 fr_forgetnat((void *)nat, ifs); 1682ab25eeb5Syz155240 1683ab25eeb5Syz155240 KFREE(nat); 1684ab25eeb5Syz155240 } 1685ab25eeb5Syz155240 1686ab25eeb5Syz155240 1687ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1688ab25eeb5Syz155240 /* Function: nat_flushtable */ 1689ab25eeb5Syz155240 /* Returns: int - number of NAT rules deleted */ 1690ab25eeb5Syz155240 /* Parameters: Nil */ 1691ab25eeb5Syz155240 /* */ 1692ab25eeb5Syz155240 /* Deletes all currently active NAT sessions. In deleting each NAT entry a */ 1693ab25eeb5Syz155240 /* log record should be emitted in nat_delete() if NAT logging is enabled. */ 1694ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1695ab25eeb5Syz155240 /* 1696ab25eeb5Syz155240 * nat_flushtable - clear the NAT table of all mapping entries. 1697ab25eeb5Syz155240 */ 1698f4b3ec61Sdh155122 static int nat_flushtable(ifs) 1699f4b3ec61Sdh155122 ipf_stack_t *ifs; 1700ab25eeb5Syz155240 { 1701ab25eeb5Syz155240 nat_t *nat; 1702ab25eeb5Syz155240 int j = 0; 1703ab25eeb5Syz155240 1704ab25eeb5Syz155240 /* 1705ab25eeb5Syz155240 * ALL NAT mappings deleted, so lets just make the deletions 1706ab25eeb5Syz155240 * quicker. 1707ab25eeb5Syz155240 */ 1708f4b3ec61Sdh155122 if (ifs->ifs_nat_table[0] != NULL) 1709f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_table[0], 1710f4b3ec61Sdh155122 sizeof(ifs->ifs_nat_table[0]) * ifs->ifs_ipf_nattable_sz); 1711f4b3ec61Sdh155122 if (ifs->ifs_nat_table[1] != NULL) 1712f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_table[1], 1713f4b3ec61Sdh155122 sizeof(ifs->ifs_nat_table[1]) * ifs->ifs_ipf_nattable_sz); 1714ab25eeb5Syz155240 1715f4b3ec61Sdh155122 while ((nat = ifs->ifs_nat_instances) != NULL) { 1716f4b3ec61Sdh155122 nat_delete(nat, NL_FLUSH, ifs); 1717ab25eeb5Syz155240 j++; 1718ab25eeb5Syz155240 } 1719ab25eeb5Syz155240 1720f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_inuse = 0; 1721ab25eeb5Syz155240 return j; 1722ab25eeb5Syz155240 } 1723ab25eeb5Syz155240 1724ab25eeb5Syz155240 1725ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1726ab25eeb5Syz155240 /* Function: nat_clearlist */ 1727ab25eeb5Syz155240 /* Returns: int - number of NAT/RDR rules deleted */ 1728ab25eeb5Syz155240 /* Parameters: Nil */ 1729ab25eeb5Syz155240 /* */ 1730ab25eeb5Syz155240 /* Delete all rules in the current list of rules. There is nothing elegant */ 1731ab25eeb5Syz155240 /* about this cleanup: simply free all entries on the list of rules and */ 1732ab25eeb5Syz155240 /* clear out the tables used for hashed NAT rule lookups. */ 1733ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1734f4b3ec61Sdh155122 static int nat_clearlist(ifs) 1735f4b3ec61Sdh155122 ipf_stack_t *ifs; 1736ab25eeb5Syz155240 { 1737f4b3ec61Sdh155122 ipnat_t *n, **np = &ifs->ifs_nat_list; 1738ab25eeb5Syz155240 int i = 0; 1739ab25eeb5Syz155240 1740f4b3ec61Sdh155122 if (ifs->ifs_nat_rules != NULL) 1741f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_rules, 1742f4b3ec61Sdh155122 sizeof(*ifs->ifs_nat_rules) * ifs->ifs_ipf_natrules_sz); 1743f4b3ec61Sdh155122 if (ifs->ifs_rdr_rules != NULL) 1744f4b3ec61Sdh155122 bzero((char *)ifs->ifs_rdr_rules, 1745f4b3ec61Sdh155122 sizeof(*ifs->ifs_rdr_rules) * ifs->ifs_ipf_rdrrules_sz); 1746ab25eeb5Syz155240 1747ab25eeb5Syz155240 while ((n = *np) != NULL) { 1748ab25eeb5Syz155240 *np = n->in_next; 1749ab25eeb5Syz155240 if (n->in_use == 0) { 1750ab25eeb5Syz155240 if (n->in_apr != NULL) 1751ab25eeb5Syz155240 appr_free(n->in_apr); 1752ab25eeb5Syz155240 KFREE(n); 1753f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules--; 1754ab25eeb5Syz155240 } else { 1755ab25eeb5Syz155240 n->in_flags |= IPN_DELETE; 1756ab25eeb5Syz155240 n->in_next = NULL; 1757ab25eeb5Syz155240 } 1758ab25eeb5Syz155240 i++; 1759ab25eeb5Syz155240 } 1760f4b3ec61Sdh155122 ifs->ifs_nat_masks = 0; 1761f4b3ec61Sdh155122 ifs->ifs_rdr_masks = 0; 1762ab25eeb5Syz155240 return i; 1763ab25eeb5Syz155240 } 1764ab25eeb5Syz155240 1765ab25eeb5Syz155240 1766ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1767ab25eeb5Syz155240 /* Function: nat_newmap */ 1768ab25eeb5Syz155240 /* Returns: int - -1 == error, 0 == success */ 1769ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 1770ab25eeb5Syz155240 /* nat(I) - pointer to NAT entry */ 1771ab25eeb5Syz155240 /* ni(I) - pointer to structure with misc. information needed */ 1772ab25eeb5Syz155240 /* to create new NAT entry. */ 1773ab25eeb5Syz155240 /* */ 1774ab25eeb5Syz155240 /* Given an empty NAT structure, populate it with new information about a */ 1775ab25eeb5Syz155240 /* new NAT session, as defined by the matching NAT rule. */ 1776ab25eeb5Syz155240 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/ 1777ab25eeb5Syz155240 /* to the new IP address for the translation. */ 1778ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1779ab25eeb5Syz155240 static INLINE int nat_newmap(fin, nat, ni) 1780ab25eeb5Syz155240 fr_info_t *fin; 1781ab25eeb5Syz155240 nat_t *nat; 1782ab25eeb5Syz155240 natinfo_t *ni; 1783ab25eeb5Syz155240 { 1784ab25eeb5Syz155240 u_short st_port, dport, sport, port, sp, dp; 1785ab25eeb5Syz155240 struct in_addr in, inb; 1786ab25eeb5Syz155240 hostmap_t *hm; 1787ab25eeb5Syz155240 u_32_t flags; 1788ab25eeb5Syz155240 u_32_t st_ip; 1789ab25eeb5Syz155240 ipnat_t *np; 1790ab25eeb5Syz155240 nat_t *natl; 1791ab25eeb5Syz155240 int l; 1792f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 1793ab25eeb5Syz155240 1794ab25eeb5Syz155240 /* 1795ab25eeb5Syz155240 * If it's an outbound packet which doesn't match any existing 1796ab25eeb5Syz155240 * record, then create a new port 1797ab25eeb5Syz155240 */ 1798ab25eeb5Syz155240 l = 0; 1799ab25eeb5Syz155240 hm = NULL; 1800ab25eeb5Syz155240 np = ni->nai_np; 1801ab25eeb5Syz155240 st_ip = np->in_nip; 1802ab25eeb5Syz155240 st_port = np->in_pnext; 1803ab25eeb5Syz155240 flags = ni->nai_flags; 1804ab25eeb5Syz155240 sport = ni->nai_sport; 1805ab25eeb5Syz155240 dport = ni->nai_dport; 1806ab25eeb5Syz155240 1807ab25eeb5Syz155240 /* 1808ab25eeb5Syz155240 * Do a loop until we either run out of entries to try or we find 1809ab25eeb5Syz155240 * a NAT mapping that isn't currently being used. This is done 1810ab25eeb5Syz155240 * because the change to the source is not (usually) being fixed. 1811ab25eeb5Syz155240 */ 1812ab25eeb5Syz155240 do { 1813ab25eeb5Syz155240 port = 0; 1814ab25eeb5Syz155240 in.s_addr = htonl(np->in_nip); 1815ab25eeb5Syz155240 if (l == 0) { 1816ab25eeb5Syz155240 /* 1817ab25eeb5Syz155240 * Check to see if there is an existing NAT 1818ab25eeb5Syz155240 * setup for this IP address pair. 1819ab25eeb5Syz155240 */ 1820ab25eeb5Syz155240 hm = nat_hostmap(np, fin->fin_src, fin->fin_dst, 1821f4b3ec61Sdh155122 in, 0, ifs); 1822ab25eeb5Syz155240 if (hm != NULL) 1823ab25eeb5Syz155240 in.s_addr = hm->hm_mapip.s_addr; 1824ab25eeb5Syz155240 } else if ((l == 1) && (hm != NULL)) { 1825ab25eeb5Syz155240 nat_hostmapdel(hm); 1826ab25eeb5Syz155240 hm = NULL; 1827ab25eeb5Syz155240 } 1828ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 1829ab25eeb5Syz155240 1830ab25eeb5Syz155240 nat->nat_hm = hm; 1831ab25eeb5Syz155240 1832ab25eeb5Syz155240 if ((np->in_outmsk == 0xffffffff) && (np->in_pnext == 0)) { 1833ab25eeb5Syz155240 if (l > 0) 1834ab25eeb5Syz155240 return -1; 1835ab25eeb5Syz155240 } 1836ab25eeb5Syz155240 1837ab25eeb5Syz155240 if (np->in_redir == NAT_BIMAP && 1838ab25eeb5Syz155240 np->in_inmsk == np->in_outmsk) { 1839ab25eeb5Syz155240 /* 1840ab25eeb5Syz155240 * map the address block in a 1:1 fashion 1841ab25eeb5Syz155240 */ 1842ab25eeb5Syz155240 in.s_addr = np->in_outip; 1843ab25eeb5Syz155240 in.s_addr |= fin->fin_saddr & ~np->in_inmsk; 1844ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 1845ab25eeb5Syz155240 1846ab25eeb5Syz155240 } else if (np->in_redir & NAT_MAPBLK) { 1847ab25eeb5Syz155240 if ((l >= np->in_ppip) || ((l > 0) && 1848ab25eeb5Syz155240 !(flags & IPN_TCPUDP))) 1849ab25eeb5Syz155240 return -1; 1850ab25eeb5Syz155240 /* 1851ab25eeb5Syz155240 * map-block - Calculate destination address. 1852ab25eeb5Syz155240 */ 1853ab25eeb5Syz155240 in.s_addr = ntohl(fin->fin_saddr); 1854ab25eeb5Syz155240 in.s_addr &= ntohl(~np->in_inmsk); 1855ab25eeb5Syz155240 inb.s_addr = in.s_addr; 1856ab25eeb5Syz155240 in.s_addr /= np->in_ippip; 1857ab25eeb5Syz155240 in.s_addr &= ntohl(~np->in_outmsk); 1858ab25eeb5Syz155240 in.s_addr += ntohl(np->in_outip); 1859ab25eeb5Syz155240 /* 1860ab25eeb5Syz155240 * Calculate destination port. 1861ab25eeb5Syz155240 */ 1862ab25eeb5Syz155240 if ((flags & IPN_TCPUDP) && 1863ab25eeb5Syz155240 (np->in_ppip != 0)) { 1864ab25eeb5Syz155240 port = ntohs(sport) + l; 1865ab25eeb5Syz155240 port %= np->in_ppip; 1866ab25eeb5Syz155240 port += np->in_ppip * 1867ab25eeb5Syz155240 (inb.s_addr % np->in_ippip); 1868ab25eeb5Syz155240 port += MAPBLK_MINPORT; 1869ab25eeb5Syz155240 port = htons(port); 1870ab25eeb5Syz155240 } 1871ab25eeb5Syz155240 1872ab25eeb5Syz155240 } else if ((np->in_outip == 0) && 1873ab25eeb5Syz155240 (np->in_outmsk == 0xffffffff)) { 1874ab25eeb5Syz155240 /* 1875ab25eeb5Syz155240 * 0/32 - use the interface's IP address. 1876ab25eeb5Syz155240 */ 1877ab25eeb5Syz155240 if ((l > 0) || 1878ab25eeb5Syz155240 fr_ifpaddr(4, FRI_NORMAL, fin->fin_ifp, 1879f4b3ec61Sdh155122 &in, NULL, fin->fin_ifs) == -1) 1880ab25eeb5Syz155240 return -1; 1881ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 1882ab25eeb5Syz155240 1883ab25eeb5Syz155240 } else if ((np->in_outip == 0) && (np->in_outmsk == 0)) { 1884ab25eeb5Syz155240 /* 1885ab25eeb5Syz155240 * 0/0 - use the original source address/port. 1886ab25eeb5Syz155240 */ 1887ab25eeb5Syz155240 if (l > 0) 1888ab25eeb5Syz155240 return -1; 1889ab25eeb5Syz155240 in.s_addr = ntohl(fin->fin_saddr); 1890ab25eeb5Syz155240 1891ab25eeb5Syz155240 } else if ((np->in_outmsk != 0xffffffff) && 1892ab25eeb5Syz155240 (np->in_pnext == 0) && ((l > 0) || (hm == NULL))) 1893ab25eeb5Syz155240 np->in_nip++; 1894ab25eeb5Syz155240 1895ab25eeb5Syz155240 natl = NULL; 1896ab25eeb5Syz155240 1897ab25eeb5Syz155240 if ((flags & IPN_TCPUDP) && 1898ab25eeb5Syz155240 ((np->in_redir & NAT_MAPBLK) == 0) && 1899ab25eeb5Syz155240 (np->in_flags & IPN_AUTOPORTMAP)) { 1900ab25eeb5Syz155240 /* 1901ab25eeb5Syz155240 * "ports auto" (without map-block) 1902ab25eeb5Syz155240 */ 1903ab25eeb5Syz155240 if ((l > 0) && (l % np->in_ppip == 0)) { 1904ab25eeb5Syz155240 if (l > np->in_space) { 1905ab25eeb5Syz155240 return -1; 1906ab25eeb5Syz155240 } else if ((l > np->in_ppip) && 1907ab25eeb5Syz155240 np->in_outmsk != 0xffffffff) 1908ab25eeb5Syz155240 np->in_nip++; 1909ab25eeb5Syz155240 } 1910ab25eeb5Syz155240 if (np->in_ppip != 0) { 1911ab25eeb5Syz155240 port = ntohs(sport); 1912ab25eeb5Syz155240 port += (l % np->in_ppip); 1913ab25eeb5Syz155240 port %= np->in_ppip; 1914ab25eeb5Syz155240 port += np->in_ppip * 1915ab25eeb5Syz155240 (ntohl(fin->fin_saddr) % 1916ab25eeb5Syz155240 np->in_ippip); 1917ab25eeb5Syz155240 port += MAPBLK_MINPORT; 1918ab25eeb5Syz155240 port = htons(port); 1919ab25eeb5Syz155240 } 1920ab25eeb5Syz155240 1921ab25eeb5Syz155240 } else if (((np->in_redir & NAT_MAPBLK) == 0) && 1922ab25eeb5Syz155240 (flags & IPN_TCPUDPICMP) && (np->in_pnext != 0)) { 1923ab25eeb5Syz155240 /* 1924ab25eeb5Syz155240 * Standard port translation. Select next port. 1925ab25eeb5Syz155240 */ 1926ab25eeb5Syz155240 port = htons(np->in_pnext++); 1927ab25eeb5Syz155240 1928ab25eeb5Syz155240 if (np->in_pnext > ntohs(np->in_pmax)) { 1929ab25eeb5Syz155240 np->in_pnext = ntohs(np->in_pmin); 1930ab25eeb5Syz155240 if (np->in_outmsk != 0xffffffff) 1931ab25eeb5Syz155240 np->in_nip++; 1932ab25eeb5Syz155240 } 1933ab25eeb5Syz155240 } 1934ab25eeb5Syz155240 1935ab25eeb5Syz155240 if (np->in_flags & IPN_IPRANGE) { 1936ab25eeb5Syz155240 if (np->in_nip > ntohl(np->in_outmsk)) 1937ab25eeb5Syz155240 np->in_nip = ntohl(np->in_outip); 1938ab25eeb5Syz155240 } else { 1939ab25eeb5Syz155240 if ((np->in_outmsk != 0xffffffff) && 1940ab25eeb5Syz155240 ((np->in_nip + 1) & ntohl(np->in_outmsk)) > 1941ab25eeb5Syz155240 ntohl(np->in_outip)) 1942ab25eeb5Syz155240 np->in_nip = ntohl(np->in_outip) + 1; 1943ab25eeb5Syz155240 } 1944ab25eeb5Syz155240 1945ab25eeb5Syz155240 if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY))) 1946ab25eeb5Syz155240 port = sport; 1947ab25eeb5Syz155240 1948ab25eeb5Syz155240 /* 1949ab25eeb5Syz155240 * Here we do a lookup of the connection as seen from 1950ab25eeb5Syz155240 * the outside. If an IP# pair already exists, try 1951ab25eeb5Syz155240 * again. So if you have A->B becomes C->B, you can 1952ab25eeb5Syz155240 * also have D->E become C->E but not D->B causing 1953ab25eeb5Syz155240 * another C->B. Also take protocol and ports into 1954ab25eeb5Syz155240 * account when determining whether a pre-existing 1955ab25eeb5Syz155240 * NAT setup will cause an external conflict where 1956ab25eeb5Syz155240 * this is appropriate. 1957ab25eeb5Syz155240 */ 1958ab25eeb5Syz155240 inb.s_addr = htonl(in.s_addr); 1959ab25eeb5Syz155240 sp = fin->fin_data[0]; 1960ab25eeb5Syz155240 dp = fin->fin_data[1]; 1961ab25eeb5Syz155240 fin->fin_data[0] = fin->fin_data[1]; 1962ab25eeb5Syz155240 fin->fin_data[1] = htons(port); 1963ab25eeb5Syz155240 natl = nat_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH), 1964ab25eeb5Syz155240 (u_int)fin->fin_p, fin->fin_dst, inb); 1965ab25eeb5Syz155240 fin->fin_data[0] = sp; 1966ab25eeb5Syz155240 fin->fin_data[1] = dp; 1967ab25eeb5Syz155240 1968ab25eeb5Syz155240 /* 1969ab25eeb5Syz155240 * Has the search wrapped around and come back to the 1970ab25eeb5Syz155240 * start ? 1971ab25eeb5Syz155240 */ 1972ab25eeb5Syz155240 if ((natl != NULL) && 1973ab25eeb5Syz155240 (np->in_pnext != 0) && (st_port == np->in_pnext) && 1974ab25eeb5Syz155240 (np->in_nip != 0) && (st_ip == np->in_nip)) 1975ab25eeb5Syz155240 return -1; 1976ab25eeb5Syz155240 l++; 1977ab25eeb5Syz155240 } while (natl != NULL); 1978ab25eeb5Syz155240 1979ab25eeb5Syz155240 if (np->in_space > 0) 1980ab25eeb5Syz155240 np->in_space--; 1981ab25eeb5Syz155240 1982ab25eeb5Syz155240 /* Setup the NAT table */ 1983ab25eeb5Syz155240 nat->nat_inip = fin->fin_src; 1984ab25eeb5Syz155240 nat->nat_outip.s_addr = htonl(in.s_addr); 1985ab25eeb5Syz155240 nat->nat_oip = fin->fin_dst; 1986ab25eeb5Syz155240 if (nat->nat_hm == NULL) 1987ab25eeb5Syz155240 nat->nat_hm = nat_hostmap(np, fin->fin_src, fin->fin_dst, 1988f4b3ec61Sdh155122 nat->nat_outip, 0, ifs); 1989ab25eeb5Syz155240 1990ab25eeb5Syz155240 /* 1991ab25eeb5Syz155240 * The ICMP checksum does not have a pseudo header containing 1992ab25eeb5Syz155240 * the IP addresses 1993ab25eeb5Syz155240 */ 1994ab25eeb5Syz155240 ni->nai_sum1 = LONG_SUM(ntohl(fin->fin_saddr)); 1995ab25eeb5Syz155240 ni->nai_sum2 = LONG_SUM(in.s_addr); 1996ab25eeb5Syz155240 if ((flags & IPN_TCPUDP)) { 1997ab25eeb5Syz155240 ni->nai_sum1 += ntohs(sport); 1998ab25eeb5Syz155240 ni->nai_sum2 += ntohs(port); 1999ab25eeb5Syz155240 } 2000ab25eeb5Syz155240 2001ab25eeb5Syz155240 if (flags & IPN_TCPUDP) { 2002ab25eeb5Syz155240 nat->nat_inport = sport; 2003ab25eeb5Syz155240 nat->nat_outport = port; /* sport */ 2004ab25eeb5Syz155240 nat->nat_oport = dport; 2005ab25eeb5Syz155240 ((tcphdr_t *)fin->fin_dp)->th_sport = port; 2006ab25eeb5Syz155240 } else if (flags & IPN_ICMPQUERY) { 2007ab25eeb5Syz155240 ((icmphdr_t *)fin->fin_dp)->icmp_id = port; 2008ab25eeb5Syz155240 nat->nat_inport = port; 2009ab25eeb5Syz155240 nat->nat_outport = port; 2010ab25eeb5Syz155240 } 2011ab25eeb5Syz155240 2012ab25eeb5Syz155240 ni->nai_ip.s_addr = in.s_addr; 2013ab25eeb5Syz155240 ni->nai_port = port; 2014ab25eeb5Syz155240 ni->nai_nport = dport; 2015ab25eeb5Syz155240 return 0; 2016ab25eeb5Syz155240 } 2017ab25eeb5Syz155240 2018ab25eeb5Syz155240 2019ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2020ab25eeb5Syz155240 /* Function: nat_newrdr */ 2021ab25eeb5Syz155240 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */ 2022ab25eeb5Syz155240 /* allow rule to be moved if IPN_ROUNDR is set. */ 2023ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2024ab25eeb5Syz155240 /* nat(I) - pointer to NAT entry */ 2025ab25eeb5Syz155240 /* ni(I) - pointer to structure with misc. information needed */ 2026ab25eeb5Syz155240 /* to create new NAT entry. */ 2027ab25eeb5Syz155240 /* */ 2028ab25eeb5Syz155240 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/ 2029ab25eeb5Syz155240 /* to the new IP address for the translation. */ 2030ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2031ab25eeb5Syz155240 static INLINE int nat_newrdr(fin, nat, ni) 2032ab25eeb5Syz155240 fr_info_t *fin; 2033ab25eeb5Syz155240 nat_t *nat; 2034ab25eeb5Syz155240 natinfo_t *ni; 2035ab25eeb5Syz155240 { 2036ab25eeb5Syz155240 u_short nport, dport, sport; 2037ab25eeb5Syz155240 struct in_addr in; 2038ab25eeb5Syz155240 hostmap_t *hm; 2039ab25eeb5Syz155240 u_32_t flags; 2040ab25eeb5Syz155240 ipnat_t *np; 2041ab25eeb5Syz155240 int move; 2042f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 2043ab25eeb5Syz155240 2044ab25eeb5Syz155240 move = 1; 2045ab25eeb5Syz155240 hm = NULL; 2046ab25eeb5Syz155240 in.s_addr = 0; 2047ab25eeb5Syz155240 np = ni->nai_np; 2048ab25eeb5Syz155240 flags = ni->nai_flags; 2049ab25eeb5Syz155240 sport = ni->nai_sport; 2050ab25eeb5Syz155240 dport = ni->nai_dport; 2051ab25eeb5Syz155240 2052ab25eeb5Syz155240 /* 2053ab25eeb5Syz155240 * If the matching rule has IPN_STICKY set, then we want to have the 2054ab25eeb5Syz155240 * same rule kick in as before. Why would this happen? If you have 2055ab25eeb5Syz155240 * a collection of rdr rules with "round-robin sticky", the current 2056ab25eeb5Syz155240 * packet might match a different one to the previous connection but 2057ab25eeb5Syz155240 * we want the same destination to be used. 2058ab25eeb5Syz155240 */ 2059ab25eeb5Syz155240 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == 2060ab25eeb5Syz155240 (IPN_ROUNDR|IPN_STICKY)) { 2061ab25eeb5Syz155240 hm = nat_hostmap(NULL, fin->fin_src, fin->fin_dst, in, 2062f4b3ec61Sdh155122 (u_32_t)dport, ifs); 2063ab25eeb5Syz155240 if (hm != NULL) { 2064ab25eeb5Syz155240 in.s_addr = ntohl(hm->hm_mapip.s_addr); 2065ab25eeb5Syz155240 np = hm->hm_ipnat; 2066ab25eeb5Syz155240 ni->nai_np = np; 2067ab25eeb5Syz155240 move = 0; 2068ab25eeb5Syz155240 } 2069ab25eeb5Syz155240 } 2070ab25eeb5Syz155240 2071ab25eeb5Syz155240 /* 2072ab25eeb5Syz155240 * Otherwise, it's an inbound packet. Most likely, we don't 2073ab25eeb5Syz155240 * want to rewrite source ports and source addresses. Instead, 2074ab25eeb5Syz155240 * we want to rewrite to a fixed internal address and fixed 2075ab25eeb5Syz155240 * internal port. 2076ab25eeb5Syz155240 */ 2077ab25eeb5Syz155240 if (np->in_flags & IPN_SPLIT) { 2078ab25eeb5Syz155240 in.s_addr = np->in_nip; 2079ab25eeb5Syz155240 2080ab25eeb5Syz155240 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) { 2081ab25eeb5Syz155240 hm = nat_hostmap(np, fin->fin_src, fin->fin_dst, 2082f4b3ec61Sdh155122 in, (u_32_t)dport, ifs); 2083ab25eeb5Syz155240 if (hm != NULL) { 2084ab25eeb5Syz155240 in.s_addr = hm->hm_mapip.s_addr; 2085ab25eeb5Syz155240 move = 0; 2086ab25eeb5Syz155240 } 2087ab25eeb5Syz155240 } 2088ab25eeb5Syz155240 2089ab25eeb5Syz155240 if (hm == NULL || hm->hm_ref == 1) { 2090ab25eeb5Syz155240 if (np->in_inip == htonl(in.s_addr)) { 2091ab25eeb5Syz155240 np->in_nip = ntohl(np->in_inmsk); 2092ab25eeb5Syz155240 move = 0; 2093ab25eeb5Syz155240 } else { 2094ab25eeb5Syz155240 np->in_nip = ntohl(np->in_inip); 2095ab25eeb5Syz155240 } 2096ab25eeb5Syz155240 } 2097ab25eeb5Syz155240 2098ab25eeb5Syz155240 } else if ((np->in_inip == 0) && (np->in_inmsk == 0xffffffff)) { 2099ab25eeb5Syz155240 /* 2100ab25eeb5Syz155240 * 0/32 - use the interface's IP address. 2101ab25eeb5Syz155240 */ 2102f4b3ec61Sdh155122 if (fr_ifpaddr(4, FRI_NORMAL, fin->fin_ifp, &in, NULL, 2103f4b3ec61Sdh155122 fin->fin_ifs) == -1) 2104ab25eeb5Syz155240 return -1; 2105ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 2106ab25eeb5Syz155240 2107ab25eeb5Syz155240 } else if ((np->in_inip == 0) && (np->in_inmsk== 0)) { 2108ab25eeb5Syz155240 /* 2109ab25eeb5Syz155240 * 0/0 - use the original destination address/port. 2110ab25eeb5Syz155240 */ 2111ab25eeb5Syz155240 in.s_addr = ntohl(fin->fin_daddr); 2112ab25eeb5Syz155240 2113ab25eeb5Syz155240 } else if (np->in_redir == NAT_BIMAP && 2114ab25eeb5Syz155240 np->in_inmsk == np->in_outmsk) { 2115ab25eeb5Syz155240 /* 2116ab25eeb5Syz155240 * map the address block in a 1:1 fashion 2117ab25eeb5Syz155240 */ 2118ab25eeb5Syz155240 in.s_addr = np->in_inip; 2119ab25eeb5Syz155240 in.s_addr |= fin->fin_daddr & ~np->in_inmsk; 2120ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 2121ab25eeb5Syz155240 } else { 2122ab25eeb5Syz155240 in.s_addr = ntohl(np->in_inip); 2123ab25eeb5Syz155240 } 2124ab25eeb5Syz155240 2125ab25eeb5Syz155240 if ((np->in_pnext == 0) || ((flags & NAT_NOTRULEPORT) != 0)) 2126ab25eeb5Syz155240 nport = dport; 2127ab25eeb5Syz155240 else { 2128ab25eeb5Syz155240 /* 2129ab25eeb5Syz155240 * Whilst not optimized for the case where 2130ab25eeb5Syz155240 * pmin == pmax, the gain is not significant. 2131ab25eeb5Syz155240 */ 2132ab25eeb5Syz155240 if (((np->in_flags & IPN_FIXEDDPORT) == 0) && 2133ab25eeb5Syz155240 (np->in_pmin != np->in_pmax)) { 2134ab25eeb5Syz155240 nport = ntohs(dport) - ntohs(np->in_pmin) + 2135ab25eeb5Syz155240 ntohs(np->in_pnext); 2136ab25eeb5Syz155240 nport = htons(nport); 2137ab25eeb5Syz155240 } else 2138ab25eeb5Syz155240 nport = np->in_pnext; 2139ab25eeb5Syz155240 } 2140ab25eeb5Syz155240 2141ab25eeb5Syz155240 /* 2142ab25eeb5Syz155240 * When the redirect-to address is set to 0.0.0.0, just 2143ab25eeb5Syz155240 * assume a blank `forwarding' of the packet. We don't 2144ab25eeb5Syz155240 * setup any translation for this either. 2145ab25eeb5Syz155240 */ 2146ab25eeb5Syz155240 if (in.s_addr == 0) { 2147ab25eeb5Syz155240 if (nport == dport) 2148ab25eeb5Syz155240 return -1; 2149ab25eeb5Syz155240 in.s_addr = ntohl(fin->fin_daddr); 2150ab25eeb5Syz155240 } 2151ab25eeb5Syz155240 2152ab25eeb5Syz155240 nat->nat_inip.s_addr = htonl(in.s_addr); 2153ab25eeb5Syz155240 nat->nat_outip = fin->fin_dst; 2154ab25eeb5Syz155240 nat->nat_oip = fin->fin_src; 2155ab25eeb5Syz155240 2156ab25eeb5Syz155240 ni->nai_sum1 = LONG_SUM(ntohl(fin->fin_daddr)) + ntohs(dport); 2157ab25eeb5Syz155240 ni->nai_sum2 = LONG_SUM(in.s_addr) + ntohs(nport); 2158ab25eeb5Syz155240 2159ab25eeb5Syz155240 ni->nai_ip.s_addr = in.s_addr; 2160ab25eeb5Syz155240 ni->nai_nport = nport; 2161ab25eeb5Syz155240 ni->nai_port = sport; 2162ab25eeb5Syz155240 2163ab25eeb5Syz155240 if (flags & IPN_TCPUDP) { 2164ab25eeb5Syz155240 nat->nat_inport = nport; 2165ab25eeb5Syz155240 nat->nat_outport = dport; 2166ab25eeb5Syz155240 nat->nat_oport = sport; 2167ab25eeb5Syz155240 ((tcphdr_t *)fin->fin_dp)->th_dport = nport; 2168ab25eeb5Syz155240 } else if (flags & IPN_ICMPQUERY) { 2169ab25eeb5Syz155240 ((icmphdr_t *)fin->fin_dp)->icmp_id = nport; 2170ab25eeb5Syz155240 nat->nat_inport = nport; 2171ab25eeb5Syz155240 nat->nat_outport = nport; 2172ab25eeb5Syz155240 } 2173ab25eeb5Syz155240 2174ab25eeb5Syz155240 return move; 2175ab25eeb5Syz155240 } 2176ab25eeb5Syz155240 2177ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2178ab25eeb5Syz155240 /* Function: nat_new */ 2179ab25eeb5Syz155240 /* Returns: nat_t* - NULL == failure to create new NAT structure, */ 2180ab25eeb5Syz155240 /* else pointer to new NAT structure */ 2181ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2182ab25eeb5Syz155240 /* np(I) - pointer to NAT rule */ 2183ab25eeb5Syz155240 /* natsave(I) - pointer to where to store NAT struct pointer */ 2184ab25eeb5Syz155240 /* flags(I) - flags describing the current packet */ 2185ab25eeb5Syz155240 /* direction(I) - direction of packet (in/out) */ 2186ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 2187ab25eeb5Syz155240 /* */ 2188ab25eeb5Syz155240 /* Attempts to create a new NAT entry. Does not actually change the packet */ 2189ab25eeb5Syz155240 /* in any way. */ 2190ab25eeb5Syz155240 /* */ 2191ab25eeb5Syz155240 /* This fucntion is in three main parts: (1) deal with creating a new NAT */ 2192ab25eeb5Syz155240 /* structure for a "MAP" rule (outgoing NAT translation); (2) deal with */ 2193ab25eeb5Syz155240 /* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */ 2194ab25eeb5Syz155240 /* and (3) building that structure and putting it into the NAT table(s). */ 2195ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2196ab25eeb5Syz155240 nat_t *nat_new(fin, np, natsave, flags, direction) 2197ab25eeb5Syz155240 fr_info_t *fin; 2198ab25eeb5Syz155240 ipnat_t *np; 2199ab25eeb5Syz155240 nat_t **natsave; 2200ab25eeb5Syz155240 u_int flags; 2201ab25eeb5Syz155240 int direction; 2202ab25eeb5Syz155240 { 2203ab25eeb5Syz155240 u_short port = 0, sport = 0, dport = 0, nport = 0; 2204ab25eeb5Syz155240 tcphdr_t *tcp = NULL; 2205ab25eeb5Syz155240 hostmap_t *hm = NULL; 2206ab25eeb5Syz155240 struct in_addr in; 2207ab25eeb5Syz155240 nat_t *nat, *natl; 2208ab25eeb5Syz155240 u_int nflags; 2209ab25eeb5Syz155240 natinfo_t ni; 2210ab25eeb5Syz155240 u_32_t sumd; 2211ab25eeb5Syz155240 int move; 2212f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 2213ab25eeb5Syz155240 22143805c50fSan207044 /* 22153805c50fSan207044 * Trigger automatic call to nat_extraflush() if the 22163805c50fSan207044 * table has reached capcity specified by hi watermark. 22173805c50fSan207044 */ 22183805c50fSan207044 if (NAT_TAB_WATER_LEVEL(ifs) > ifs->ifs_nat_flush_lvl_hi) 22193805c50fSan207044 ifs->ifs_nat_doflush = 1; 22203805c50fSan207044 2221f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_inuse >= ifs->ifs_ipf_nattable_max) { 2222f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_memfail++; 2223ab25eeb5Syz155240 return NULL; 2224ab25eeb5Syz155240 } 2225ab25eeb5Syz155240 2226ab25eeb5Syz155240 move = 1; 2227ab25eeb5Syz155240 nflags = np->in_flags & flags; 2228ab25eeb5Syz155240 nflags &= NAT_FROMRULE; 2229ab25eeb5Syz155240 2230ab25eeb5Syz155240 ni.nai_np = np; 2231ab25eeb5Syz155240 ni.nai_nflags = nflags; 2232ab25eeb5Syz155240 ni.nai_flags = flags; 2233ab25eeb5Syz155240 2234ab25eeb5Syz155240 /* Give me a new nat */ 2235ab25eeb5Syz155240 KMALLOC(nat, nat_t *); 2236ab25eeb5Syz155240 if (nat == NULL) { 2237f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_memfail++; 2238ab25eeb5Syz155240 /* 2239ab25eeb5Syz155240 * Try to automatically tune the max # of entries in the 2240ab25eeb5Syz155240 * table allowed to be less than what will cause kmem_alloc() 2241ab25eeb5Syz155240 * to fail and try to eliminate panics due to out of memory 2242ab25eeb5Syz155240 * conditions arising. 2243ab25eeb5Syz155240 */ 2244f4b3ec61Sdh155122 if (ifs->ifs_ipf_nattable_max > ifs->ifs_ipf_nattable_sz) { 2245f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_max = ifs->ifs_nat_stats.ns_inuse - 100; 2246ab25eeb5Syz155240 printf("ipf_nattable_max reduced to %d\n", 2247f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_max); 2248ab25eeb5Syz155240 } 2249ab25eeb5Syz155240 return NULL; 2250ab25eeb5Syz155240 } 2251ab25eeb5Syz155240 2252ab25eeb5Syz155240 if (flags & IPN_TCPUDP) { 2253ab25eeb5Syz155240 tcp = fin->fin_dp; 2254ab25eeb5Syz155240 ni.nai_sport = htons(fin->fin_sport); 2255ab25eeb5Syz155240 ni.nai_dport = htons(fin->fin_dport); 2256ab25eeb5Syz155240 } else if (flags & IPN_ICMPQUERY) { 2257ab25eeb5Syz155240 /* 2258ab25eeb5Syz155240 * In the ICMP query NAT code, we translate the ICMP id fields 2259ab25eeb5Syz155240 * to make them unique. This is indepedent of the ICMP type 2260ab25eeb5Syz155240 * (e.g. in the unlikely event that a host sends an echo and 2261ab25eeb5Syz155240 * an tstamp request with the same id, both packets will have 2262ab25eeb5Syz155240 * their ip address/id field changed in the same way). 2263ab25eeb5Syz155240 */ 2264ab25eeb5Syz155240 /* The icmp_id field is used by the sender to identify the 2265ab25eeb5Syz155240 * process making the icmp request. (the receiver justs 2266ab25eeb5Syz155240 * copies it back in its response). So, it closely matches 2267ab25eeb5Syz155240 * the concept of source port. We overlay sport, so we can 2268ab25eeb5Syz155240 * maximally reuse the existing code. 2269ab25eeb5Syz155240 */ 2270ab25eeb5Syz155240 ni.nai_sport = ((icmphdr_t *)fin->fin_dp)->icmp_id; 2271ab25eeb5Syz155240 ni.nai_dport = ni.nai_sport; 2272ab25eeb5Syz155240 } 2273ab25eeb5Syz155240 2274ab25eeb5Syz155240 bzero((char *)nat, sizeof(*nat)); 2275ab25eeb5Syz155240 nat->nat_flags = flags; 2276f4b3ec61Sdh155122 nat->nat_redir = np->in_redir; 2277ab25eeb5Syz155240 2278ab25eeb5Syz155240 if ((flags & NAT_SLAVE) == 0) { 2279f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 2280ab25eeb5Syz155240 } 2281ab25eeb5Syz155240 2282ab25eeb5Syz155240 /* 2283ab25eeb5Syz155240 * Search the current table for a match. 2284ab25eeb5Syz155240 */ 2285ab25eeb5Syz155240 if (direction == NAT_OUTBOUND) { 2286ab25eeb5Syz155240 /* 2287ab25eeb5Syz155240 * We can now arrange to call this for the same connection 2288ab25eeb5Syz155240 * because ipf_nat_new doesn't protect the code path into 2289ab25eeb5Syz155240 * this function. 2290ab25eeb5Syz155240 */ 2291ab25eeb5Syz155240 natl = nat_outlookup(fin, nflags, (u_int)fin->fin_p, 2292ab25eeb5Syz155240 fin->fin_src, fin->fin_dst); 2293ab25eeb5Syz155240 if (natl != NULL) { 2294dcf3e898Sjojemann KFREE(nat); 2295ab25eeb5Syz155240 nat = natl; 2296ab25eeb5Syz155240 goto done; 2297ab25eeb5Syz155240 } 2298ab25eeb5Syz155240 2299ab25eeb5Syz155240 move = nat_newmap(fin, nat, &ni); 2300ab25eeb5Syz155240 if (move == -1) 2301ab25eeb5Syz155240 goto badnat; 2302ab25eeb5Syz155240 2303ab25eeb5Syz155240 np = ni.nai_np; 2304ab25eeb5Syz155240 in = ni.nai_ip; 2305ab25eeb5Syz155240 } else { 2306ab25eeb5Syz155240 /* 2307ab25eeb5Syz155240 * NAT_INBOUND is used only for redirects rules 2308ab25eeb5Syz155240 */ 2309ab25eeb5Syz155240 natl = nat_inlookup(fin, nflags, (u_int)fin->fin_p, 2310ab25eeb5Syz155240 fin->fin_src, fin->fin_dst); 2311ab25eeb5Syz155240 if (natl != NULL) { 2312dcf3e898Sjojemann KFREE(nat); 2313ab25eeb5Syz155240 nat = natl; 2314ab25eeb5Syz155240 goto done; 2315ab25eeb5Syz155240 } 2316ab25eeb5Syz155240 2317ab25eeb5Syz155240 move = nat_newrdr(fin, nat, &ni); 2318ab25eeb5Syz155240 if (move == -1) 2319ab25eeb5Syz155240 goto badnat; 2320ab25eeb5Syz155240 2321ab25eeb5Syz155240 np = ni.nai_np; 2322ab25eeb5Syz155240 in = ni.nai_ip; 2323ab25eeb5Syz155240 } 2324ab25eeb5Syz155240 port = ni.nai_port; 2325ab25eeb5Syz155240 nport = ni.nai_nport; 2326ab25eeb5Syz155240 2327ab25eeb5Syz155240 if ((move == 1) && (np->in_flags & IPN_ROUNDR)) { 2328ab25eeb5Syz155240 if (np->in_redir == NAT_REDIRECT) { 2329ab25eeb5Syz155240 nat_delrdr(np); 2330f4b3ec61Sdh155122 nat_addrdr(np, ifs); 2331ab25eeb5Syz155240 } else if (np->in_redir == NAT_MAP) { 2332ab25eeb5Syz155240 nat_delnat(np); 2333f4b3ec61Sdh155122 nat_addnat(np, ifs); 2334ab25eeb5Syz155240 } 2335ab25eeb5Syz155240 } 2336ab25eeb5Syz155240 2337ab25eeb5Syz155240 if (flags & IPN_TCPUDP) { 2338ab25eeb5Syz155240 sport = ni.nai_sport; 2339ab25eeb5Syz155240 dport = ni.nai_dport; 2340ab25eeb5Syz155240 } else if (flags & IPN_ICMPQUERY) { 2341ab25eeb5Syz155240 sport = ni.nai_sport; 2342ab25eeb5Syz155240 dport = 0; 2343ab25eeb5Syz155240 } 2344ab25eeb5Syz155240 2345381a2a9aSdr146992 /* 2346381a2a9aSdr146992 * nat_sumd[0] stores adjustment value including both IP address and 2347381a2a9aSdr146992 * port number changes. nat_sumd[1] stores adjustment value only for 2348381a2a9aSdr146992 * IP address changes, to be used for pseudo header adjustment, in 2349381a2a9aSdr146992 * case hardware partial checksum offload is offered. 2350381a2a9aSdr146992 */ 2351ab25eeb5Syz155240 CALC_SUMD(ni.nai_sum1, ni.nai_sum2, sumd); 2352ab25eeb5Syz155240 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 2353381a2a9aSdr146992 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) 2354381a2a9aSdr146992 if (flags & IPN_TCPUDP) { 2355ab25eeb5Syz155240 ni.nai_sum1 = LONG_SUM(in.s_addr); 2356381a2a9aSdr146992 if (direction == NAT_OUTBOUND) 2357381a2a9aSdr146992 ni.nai_sum2 = LONG_SUM(ntohl(fin->fin_saddr)); 2358ab25eeb5Syz155240 else 2359381a2a9aSdr146992 ni.nai_sum2 = LONG_SUM(ntohl(fin->fin_daddr)); 2360381a2a9aSdr146992 2361381a2a9aSdr146992 CALC_SUMD(ni.nai_sum1, ni.nai_sum2, sumd); 2362381a2a9aSdr146992 nat->nat_sumd[1] = (sumd & 0xffff) + (sumd >> 16); 2363ab25eeb5Syz155240 } else 2364ab25eeb5Syz155240 #endif 2365ab25eeb5Syz155240 nat->nat_sumd[1] = nat->nat_sumd[0]; 2366ab25eeb5Syz155240 2367ab25eeb5Syz155240 if ((flags & IPN_TCPUDPICMP) && ((sport != port) || (dport != nport))) { 2368ab25eeb5Syz155240 if (direction == NAT_OUTBOUND) 2369ab25eeb5Syz155240 ni.nai_sum1 = LONG_SUM(ntohl(fin->fin_saddr)); 2370ab25eeb5Syz155240 else 2371ab25eeb5Syz155240 ni.nai_sum1 = LONG_SUM(ntohl(fin->fin_daddr)); 2372ab25eeb5Syz155240 2373ab25eeb5Syz155240 ni.nai_sum2 = LONG_SUM(in.s_addr); 2374ab25eeb5Syz155240 2375ab25eeb5Syz155240 CALC_SUMD(ni.nai_sum1, ni.nai_sum2, sumd); 2376ab25eeb5Syz155240 nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16); 2377ab25eeb5Syz155240 } else { 2378ab25eeb5Syz155240 nat->nat_ipsumd = nat->nat_sumd[0]; 2379ab25eeb5Syz155240 if (!(flags & IPN_TCPUDPICMP)) { 2380ab25eeb5Syz155240 nat->nat_sumd[0] = 0; 2381ab25eeb5Syz155240 nat->nat_sumd[1] = 0; 2382ab25eeb5Syz155240 } 2383ab25eeb5Syz155240 } 2384ab25eeb5Syz155240 2385ab25eeb5Syz155240 if (nat_finalise(fin, nat, &ni, tcp, natsave, direction) == -1) { 2386ab25eeb5Syz155240 goto badnat; 2387ab25eeb5Syz155240 } 2388ab25eeb5Syz155240 if (flags & SI_WILDP) 2389f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_wilds++; 2390ab25eeb5Syz155240 goto done; 2391ab25eeb5Syz155240 badnat: 2392f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_badnat++; 2393ab25eeb5Syz155240 if ((hm = nat->nat_hm) != NULL) 2394ab25eeb5Syz155240 nat_hostmapdel(hm); 2395ab25eeb5Syz155240 KFREE(nat); 2396ab25eeb5Syz155240 nat = NULL; 2397ab25eeb5Syz155240 done: 2398ab25eeb5Syz155240 if ((flags & NAT_SLAVE) == 0) { 2399f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 2400ab25eeb5Syz155240 } 2401ab25eeb5Syz155240 return nat; 2402ab25eeb5Syz155240 } 2403ab25eeb5Syz155240 2404ab25eeb5Syz155240 2405ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2406ab25eeb5Syz155240 /* Function: nat_finalise */ 2407ab25eeb5Syz155240 /* Returns: int - 0 == sucess, -1 == failure */ 2408ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2409ab25eeb5Syz155240 /* nat(I) - pointer to NAT entry */ 2410ab25eeb5Syz155240 /* ni(I) - pointer to structure with misc. information needed */ 2411ab25eeb5Syz155240 /* to create new NAT entry. */ 2412ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 2413ab25eeb5Syz155240 /* */ 2414ab25eeb5Syz155240 /* This is the tail end of constructing a new NAT entry and is the same */ 2415ab25eeb5Syz155240 /* for both IPv4 and IPv6. */ 2416ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2417ab25eeb5Syz155240 /*ARGSUSED*/ 2418ab25eeb5Syz155240 static INLINE int nat_finalise(fin, nat, ni, tcp, natsave, direction) 2419ab25eeb5Syz155240 fr_info_t *fin; 2420ab25eeb5Syz155240 nat_t *nat; 2421ab25eeb5Syz155240 natinfo_t *ni; 2422ab25eeb5Syz155240 tcphdr_t *tcp; 2423ab25eeb5Syz155240 nat_t **natsave; 2424ab25eeb5Syz155240 int direction; 2425ab25eeb5Syz155240 { 2426ab25eeb5Syz155240 frentry_t *fr; 2427ab25eeb5Syz155240 ipnat_t *np; 2428f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 2429ab25eeb5Syz155240 2430ab25eeb5Syz155240 np = ni->nai_np; 2431ab25eeb5Syz155240 2432381a2a9aSdr146992 COPYIFNAME(fin->fin_ifp, nat->nat_ifnames[0], fin->fin_v); 2433381a2a9aSdr146992 2434ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 2435ab25eeb5Syz155240 if ((nat->nat_flags & SI_CLONE) == 0) 2436ab25eeb5Syz155240 nat->nat_sync = ipfsync_new(SMC_NAT, fin, nat); 2437ab25eeb5Syz155240 #endif 2438ab25eeb5Syz155240 2439ab25eeb5Syz155240 nat->nat_me = natsave; 2440ab25eeb5Syz155240 nat->nat_dir = direction; 2441e6c6c1faSyz155240 nat->nat_ifps[0] = np->in_ifps[0]; 2442e6c6c1faSyz155240 nat->nat_ifps[1] = np->in_ifps[1]; 2443ab25eeb5Syz155240 nat->nat_ptr = np; 2444ab25eeb5Syz155240 nat->nat_p = fin->fin_p; 2445ab25eeb5Syz155240 nat->nat_mssclamp = np->in_mssclamp; 2446ab25eeb5Syz155240 fr = fin->fin_fr; 2447ab25eeb5Syz155240 nat->nat_fr = fr; 2448ab25eeb5Syz155240 2449ab25eeb5Syz155240 if ((np->in_apr != NULL) && ((ni->nai_flags & NAT_SLAVE) == 0)) 2450ab25eeb5Syz155240 if (appr_new(fin, nat) == -1) 2451ab25eeb5Syz155240 return -1; 2452ab25eeb5Syz155240 2453f4b3ec61Sdh155122 if (nat_insert(nat, fin->fin_rev, ifs) == 0) { 2454f4b3ec61Sdh155122 if (ifs->ifs_nat_logging) 2455f4b3ec61Sdh155122 nat_log(nat, (u_int)np->in_redir, ifs); 2456ab25eeb5Syz155240 np->in_use++; 2457ab25eeb5Syz155240 if (fr != NULL) { 2458ab25eeb5Syz155240 MUTEX_ENTER(&fr->fr_lock); 2459ab25eeb5Syz155240 fr->fr_ref++; 2460ab25eeb5Syz155240 MUTEX_EXIT(&fr->fr_lock); 2461ab25eeb5Syz155240 } 2462ab25eeb5Syz155240 return 0; 2463ab25eeb5Syz155240 } 2464ab25eeb5Syz155240 2465ab25eeb5Syz155240 /* 2466ab25eeb5Syz155240 * nat_insert failed, so cleanup time... 2467ab25eeb5Syz155240 */ 2468ab25eeb5Syz155240 return -1; 2469ab25eeb5Syz155240 } 2470ab25eeb5Syz155240 2471ab25eeb5Syz155240 2472ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2473ab25eeb5Syz155240 /* Function: nat_insert */ 2474ab25eeb5Syz155240 /* Returns: int - 0 == sucess, -1 == failure */ 2475ab25eeb5Syz155240 /* Parameters: nat(I) - pointer to NAT structure */ 2476ab25eeb5Syz155240 /* rev(I) - flag indicating forward/reverse direction of packet */ 2477ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 2478ab25eeb5Syz155240 /* */ 2479ab25eeb5Syz155240 /* Insert a NAT entry into the hash tables for searching and add it to the */ 2480ab25eeb5Syz155240 /* list of active NAT entries. Adjust global counters when complete. */ 2481ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2482f4b3ec61Sdh155122 int nat_insert(nat, rev, ifs) 2483ab25eeb5Syz155240 nat_t *nat; 2484ab25eeb5Syz155240 int rev; 2485f4b3ec61Sdh155122 ipf_stack_t *ifs; 2486ab25eeb5Syz155240 { 2487ab25eeb5Syz155240 u_int hv1, hv2; 2488ab25eeb5Syz155240 nat_t **natp; 2489ab25eeb5Syz155240 2490ab25eeb5Syz155240 /* 2491ab25eeb5Syz155240 * Try and return an error as early as possible, so calculate the hash 2492ab25eeb5Syz155240 * entry numbers first and then proceed. 2493ab25eeb5Syz155240 */ 2494ab25eeb5Syz155240 if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) { 2495ab25eeb5Syz155240 hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport, 2496ab25eeb5Syz155240 0xffffffff); 2497ab25eeb5Syz155240 hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1 + nat->nat_oport, 2498f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 2499ab25eeb5Syz155240 hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport, 2500ab25eeb5Syz155240 0xffffffff); 2501ab25eeb5Syz155240 hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2 + nat->nat_oport, 2502f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 2503ab25eeb5Syz155240 } else { 2504ab25eeb5Syz155240 hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, 0, 0xffffffff); 2505f4b3ec61Sdh155122 hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1, 2506f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 2507ab25eeb5Syz155240 hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, 0, 0xffffffff); 2508f4b3ec61Sdh155122 hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2, 2509f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 2510ab25eeb5Syz155240 } 2511ab25eeb5Syz155240 2512f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[0][hv1] >= ifs->ifs_fr_nat_maxbucket || 2513f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][hv2] >= ifs->ifs_fr_nat_maxbucket) { 2514ab25eeb5Syz155240 return -1; 2515ab25eeb5Syz155240 } 2516ab25eeb5Syz155240 2517ab25eeb5Syz155240 nat->nat_hv[0] = hv1; 2518ab25eeb5Syz155240 nat->nat_hv[1] = hv2; 2519ab25eeb5Syz155240 2520ab25eeb5Syz155240 MUTEX_INIT(&nat->nat_lock, "nat entry lock"); 2521ab25eeb5Syz155240 2522ab25eeb5Syz155240 nat->nat_rev = rev; 2523ab25eeb5Syz155240 nat->nat_ref = 1; 2524ab25eeb5Syz155240 nat->nat_bytes[0] = 0; 2525ab25eeb5Syz155240 nat->nat_pkts[0] = 0; 2526ab25eeb5Syz155240 nat->nat_bytes[1] = 0; 2527ab25eeb5Syz155240 nat->nat_pkts[1] = 0; 2528ab25eeb5Syz155240 2529ab25eeb5Syz155240 nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0'; 2530f4b3ec61Sdh155122 nat->nat_ifps[0] = fr_resolvenic(nat->nat_ifnames[0], 4, ifs); 2531ab25eeb5Syz155240 2532ab25eeb5Syz155240 if (nat->nat_ifnames[1][0] !='\0') { 2533ab25eeb5Syz155240 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0'; 2534f4b3ec61Sdh155122 nat->nat_ifps[1] = fr_resolvenic(nat->nat_ifnames[1], 4, ifs); 2535ab25eeb5Syz155240 } else { 2536ab25eeb5Syz155240 (void) strncpy(nat->nat_ifnames[1], nat->nat_ifnames[0], 2537ab25eeb5Syz155240 LIFNAMSIZ); 2538ab25eeb5Syz155240 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0'; 2539ab25eeb5Syz155240 nat->nat_ifps[1] = nat->nat_ifps[0]; 2540ab25eeb5Syz155240 } 2541ab25eeb5Syz155240 2542f4b3ec61Sdh155122 nat->nat_next = ifs->ifs_nat_instances; 2543f4b3ec61Sdh155122 nat->nat_pnext = &ifs->ifs_nat_instances; 2544f4b3ec61Sdh155122 if (ifs->ifs_nat_instances) 2545f4b3ec61Sdh155122 ifs->ifs_nat_instances->nat_pnext = &nat->nat_next; 2546f4b3ec61Sdh155122 ifs->ifs_nat_instances = nat; 2547ab25eeb5Syz155240 2548f4b3ec61Sdh155122 natp = &ifs->ifs_nat_table[0][hv1]; 2549ab25eeb5Syz155240 if (*natp) 2550ab25eeb5Syz155240 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 2551ab25eeb5Syz155240 nat->nat_phnext[0] = natp; 2552ab25eeb5Syz155240 nat->nat_hnext[0] = *natp; 2553ab25eeb5Syz155240 *natp = nat; 2554f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0][hv1]++; 2555ab25eeb5Syz155240 2556f4b3ec61Sdh155122 natp = &ifs->ifs_nat_table[1][hv2]; 2557ab25eeb5Syz155240 if (*natp) 2558ab25eeb5Syz155240 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 2559ab25eeb5Syz155240 nat->nat_phnext[1] = natp; 2560ab25eeb5Syz155240 nat->nat_hnext[1] = *natp; 2561ab25eeb5Syz155240 *natp = nat; 2562f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][hv2]++; 2563ab25eeb5Syz155240 2564f4b3ec61Sdh155122 fr_setnatqueue(nat, rev, ifs); 2565ab25eeb5Syz155240 2566f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_added++; 2567f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_inuse++; 2568ab25eeb5Syz155240 return 0; 2569ab25eeb5Syz155240 } 2570ab25eeb5Syz155240 2571ab25eeb5Syz155240 2572ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2573ab25eeb5Syz155240 /* Function: nat_icmperrorlookup */ 2574ab25eeb5Syz155240 /* Returns: nat_t* - point to matching NAT structure */ 2575ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2576ab25eeb5Syz155240 /* dir(I) - direction of packet (in/out) */ 2577ab25eeb5Syz155240 /* */ 2578ab25eeb5Syz155240 /* Check if the ICMP error message is related to an existing TCP, UDP or */ 2579ab25eeb5Syz155240 /* ICMP query nat entry. It is assumed that the packet is already of the */ 2580ab25eeb5Syz155240 /* the required length. */ 2581ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2582ab25eeb5Syz155240 nat_t *nat_icmperrorlookup(fin, dir) 2583ab25eeb5Syz155240 fr_info_t *fin; 2584ab25eeb5Syz155240 int dir; 2585ab25eeb5Syz155240 { 2586ab25eeb5Syz155240 int flags = 0, minlen; 2587ab25eeb5Syz155240 icmphdr_t *orgicmp; 2588ab25eeb5Syz155240 tcphdr_t *tcp = NULL; 2589ab25eeb5Syz155240 u_short data[2]; 2590ab25eeb5Syz155240 nat_t *nat; 2591ab25eeb5Syz155240 ip_t *oip; 2592ab25eeb5Syz155240 u_int p; 2593ab25eeb5Syz155240 2594ab25eeb5Syz155240 /* 2595ab25eeb5Syz155240 * Does it at least have the return (basic) IP header ? 2596ab25eeb5Syz155240 * Only a basic IP header (no options) should be with an ICMP error 2597ab25eeb5Syz155240 * header. Also, if it's not an error type, then return. 2598ab25eeb5Syz155240 */ 2599ab25eeb5Syz155240 if ((fin->fin_hlen != sizeof(ip_t)) || !(fin->fin_flx & FI_ICMPERR)) 2600ab25eeb5Syz155240 return NULL; 2601ab25eeb5Syz155240 2602ab25eeb5Syz155240 /* 2603ab25eeb5Syz155240 * Check packet size 2604ab25eeb5Syz155240 */ 2605ab25eeb5Syz155240 oip = (ip_t *)((char *)fin->fin_dp + 8); 2606ab25eeb5Syz155240 minlen = IP_HL(oip) << 2; 2607ab25eeb5Syz155240 if ((minlen < sizeof(ip_t)) || 2608ab25eeb5Syz155240 (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen)) 2609ab25eeb5Syz155240 return NULL; 2610ab25eeb5Syz155240 /* 2611ab25eeb5Syz155240 * Is the buffer big enough for all of it ? It's the size of the IP 2612ab25eeb5Syz155240 * header claimed in the encapsulated part which is of concern. It 2613ab25eeb5Syz155240 * may be too big to be in this buffer but not so big that it's 2614ab25eeb5Syz155240 * outside the ICMP packet, leading to TCP deref's causing problems. 2615ab25eeb5Syz155240 * This is possible because we don't know how big oip_hl is when we 2616ab25eeb5Syz155240 * do the pullup early in fr_check() and thus can't gaurantee it is 2617ab25eeb5Syz155240 * all here now. 2618ab25eeb5Syz155240 */ 2619ab25eeb5Syz155240 #ifdef _KERNEL 2620ab25eeb5Syz155240 { 2621ab25eeb5Syz155240 mb_t *m; 2622ab25eeb5Syz155240 2623ab25eeb5Syz155240 m = fin->fin_m; 2624ab25eeb5Syz155240 # if defined(MENTAT) 2625ab25eeb5Syz155240 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > (char *)m->b_wptr) 2626ab25eeb5Syz155240 return NULL; 2627ab25eeb5Syz155240 # else 2628ab25eeb5Syz155240 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > 2629ab25eeb5Syz155240 (char *)fin->fin_ip + M_LEN(m)) 2630ab25eeb5Syz155240 return NULL; 2631ab25eeb5Syz155240 # endif 2632ab25eeb5Syz155240 } 2633ab25eeb5Syz155240 #endif 2634ab25eeb5Syz155240 2635ab25eeb5Syz155240 if (fin->fin_daddr != oip->ip_src.s_addr) 2636ab25eeb5Syz155240 return NULL; 2637ab25eeb5Syz155240 2638ab25eeb5Syz155240 p = oip->ip_p; 2639ab25eeb5Syz155240 if (p == IPPROTO_TCP) 2640ab25eeb5Syz155240 flags = IPN_TCP; 2641ab25eeb5Syz155240 else if (p == IPPROTO_UDP) 2642ab25eeb5Syz155240 flags = IPN_UDP; 2643ab25eeb5Syz155240 else if (p == IPPROTO_ICMP) { 2644ab25eeb5Syz155240 orgicmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 2645ab25eeb5Syz155240 2646ab25eeb5Syz155240 /* see if this is related to an ICMP query */ 2647ab25eeb5Syz155240 if (nat_icmpquerytype4(orgicmp->icmp_type)) { 2648ab25eeb5Syz155240 data[0] = fin->fin_data[0]; 2649ab25eeb5Syz155240 data[1] = fin->fin_data[1]; 2650ab25eeb5Syz155240 fin->fin_data[0] = 0; 2651ab25eeb5Syz155240 fin->fin_data[1] = orgicmp->icmp_id; 2652ab25eeb5Syz155240 2653ab25eeb5Syz155240 flags = IPN_ICMPERR|IPN_ICMPQUERY; 2654ab25eeb5Syz155240 /* 2655ab25eeb5Syz155240 * NOTE : dir refers to the direction of the original 2656ab25eeb5Syz155240 * ip packet. By definition the icmp error 2657ab25eeb5Syz155240 * message flows in the opposite direction. 2658ab25eeb5Syz155240 */ 2659ab25eeb5Syz155240 if (dir == NAT_INBOUND) 2660ab25eeb5Syz155240 nat = nat_inlookup(fin, flags, p, oip->ip_dst, 2661ab25eeb5Syz155240 oip->ip_src); 2662ab25eeb5Syz155240 else 2663ab25eeb5Syz155240 nat = nat_outlookup(fin, flags, p, oip->ip_dst, 2664ab25eeb5Syz155240 oip->ip_src); 2665ab25eeb5Syz155240 fin->fin_data[0] = data[0]; 2666ab25eeb5Syz155240 fin->fin_data[1] = data[1]; 2667ab25eeb5Syz155240 return nat; 2668ab25eeb5Syz155240 } 2669ab25eeb5Syz155240 } 2670ab25eeb5Syz155240 2671ab25eeb5Syz155240 if (flags & IPN_TCPUDP) { 2672ab25eeb5Syz155240 minlen += 8; /* + 64bits of data to get ports */ 2673ab25eeb5Syz155240 if (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen) 2674ab25eeb5Syz155240 return NULL; 2675ab25eeb5Syz155240 2676ab25eeb5Syz155240 data[0] = fin->fin_data[0]; 2677ab25eeb5Syz155240 data[1] = fin->fin_data[1]; 2678ab25eeb5Syz155240 tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 2679ab25eeb5Syz155240 fin->fin_data[0] = ntohs(tcp->th_dport); 2680ab25eeb5Syz155240 fin->fin_data[1] = ntohs(tcp->th_sport); 2681ab25eeb5Syz155240 2682ab25eeb5Syz155240 if (dir == NAT_INBOUND) { 2683ab25eeb5Syz155240 nat = nat_inlookup(fin, flags, p, oip->ip_dst, 2684ab25eeb5Syz155240 oip->ip_src); 2685ab25eeb5Syz155240 } else { 2686ab25eeb5Syz155240 nat = nat_outlookup(fin, flags, p, oip->ip_dst, 2687ab25eeb5Syz155240 oip->ip_src); 2688ab25eeb5Syz155240 } 2689ab25eeb5Syz155240 fin->fin_data[0] = data[0]; 2690ab25eeb5Syz155240 fin->fin_data[1] = data[1]; 2691ab25eeb5Syz155240 return nat; 2692ab25eeb5Syz155240 } 2693ab25eeb5Syz155240 if (dir == NAT_INBOUND) 2694ab25eeb5Syz155240 return nat_inlookup(fin, 0, p, oip->ip_dst, oip->ip_src); 2695ab25eeb5Syz155240 else 2696ab25eeb5Syz155240 return nat_outlookup(fin, 0, p, oip->ip_dst, oip->ip_src); 2697ab25eeb5Syz155240 } 2698ab25eeb5Syz155240 2699ab25eeb5Syz155240 2700ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2701ab25eeb5Syz155240 /* Function: nat_icmperror */ 2702ab25eeb5Syz155240 /* Returns: nat_t* - point to matching NAT structure */ 2703ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2704ab25eeb5Syz155240 /* nflags(I) - NAT flags for this packet */ 2705ab25eeb5Syz155240 /* dir(I) - direction of packet (in/out) */ 2706ab25eeb5Syz155240 /* */ 2707ab25eeb5Syz155240 /* Fix up an ICMP packet which is an error message for an existing NAT */ 2708ab25eeb5Syz155240 /* session. This will correct both packet header data and checksums. */ 2709ab25eeb5Syz155240 /* */ 2710ab25eeb5Syz155240 /* This should *ONLY* be used for incoming ICMP error packets to make sure */ 2711ab25eeb5Syz155240 /* a NAT'd ICMP packet gets correctly recognised. */ 2712ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2713ab25eeb5Syz155240 nat_t *nat_icmperror(fin, nflags, dir) 2714ab25eeb5Syz155240 fr_info_t *fin; 2715ab25eeb5Syz155240 u_int *nflags; 2716ab25eeb5Syz155240 int dir; 2717ab25eeb5Syz155240 { 27185142ed1fSjojemann u_32_t sum1, sum2, sumd, psum1, psum2, psumd, sumd2; 2719ab25eeb5Syz155240 struct in_addr in; 27205142ed1fSjojemann icmphdr_t *icmp, *orgicmp; 27215142ed1fSjojemann int dlen; 27225142ed1fSjojemann udphdr_t *udp; 2723ab25eeb5Syz155240 tcphdr_t *tcp; 2724ab25eeb5Syz155240 nat_t *nat; 2725ab25eeb5Syz155240 ip_t *oip; 2726ab25eeb5Syz155240 if ((fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) 2727ab25eeb5Syz155240 return NULL; 27285142ed1fSjojemann 2729ab25eeb5Syz155240 /* 27305142ed1fSjojemann * nat_icmperrorlookup() looks up nat entry associated with the 27315142ed1fSjojemann * offending IP packet and returns pointer to the entry, or NULL 27325142ed1fSjojemann * if packet wasn't natted or for `defective' packets. 2733ab25eeb5Syz155240 */ 27345142ed1fSjojemann 2735ab25eeb5Syz155240 if ((fin->fin_v != 4) || !(nat = nat_icmperrorlookup(fin, dir))) 2736ab25eeb5Syz155240 return NULL; 2737ab25eeb5Syz155240 2738ab25eeb5Syz155240 sumd2 = 0; 2739ab25eeb5Syz155240 *nflags = IPN_ICMPERR; 2740ab25eeb5Syz155240 icmp = fin->fin_dp; 2741ab25eeb5Syz155240 oip = (ip_t *)&icmp->icmp_ip; 27425142ed1fSjojemann udp = (udphdr_t *)((((char *)oip) + (IP_HL(oip) << 2))); 27435142ed1fSjojemann tcp = (tcphdr_t *)udp; 27445142ed1fSjojemann dlen = fin->fin_plen - ((char *)udp - (char *)fin->fin_ip); 2745ab25eeb5Syz155240 2746ab25eeb5Syz155240 /* 2747ab25eeb5Syz155240 * Need to adjust ICMP header to include the real IP#'s and 27485142ed1fSjojemann * port #'s. There are three steps required. 2749ab25eeb5Syz155240 * 27505142ed1fSjojemann * Step 1 27515142ed1fSjojemann * Fix the IP addresses in the offending IP packet and update 27525142ed1fSjojemann * ip header checksum to compensate for the change. 27535142ed1fSjojemann * 27545142ed1fSjojemann * No update needed here for icmp_cksum because the ICMP checksum 27555142ed1fSjojemann * is calculated over the complete ICMP packet, which includes the 27565142ed1fSjojemann * changed oip IP addresses and oip->ip_sum. These two changes 27575142ed1fSjojemann * cancel each other out (if the delta for the IP address is x, 27585142ed1fSjojemann * then the delta for ip_sum is minus x). 2759ab25eeb5Syz155240 */ 2760ab25eeb5Syz155240 2761ab25eeb5Syz155240 if (oip->ip_dst.s_addr == nat->nat_oip.s_addr) { 2762ab25eeb5Syz155240 sum1 = LONG_SUM(ntohl(oip->ip_src.s_addr)); 2763ab25eeb5Syz155240 in = nat->nat_inip; 2764ab25eeb5Syz155240 oip->ip_src = in; 2765ab25eeb5Syz155240 } else { 2766ab25eeb5Syz155240 sum1 = LONG_SUM(ntohl(oip->ip_dst.s_addr)); 2767ab25eeb5Syz155240 in = nat->nat_outip; 2768ab25eeb5Syz155240 oip->ip_dst = in; 2769ab25eeb5Syz155240 } 2770ab25eeb5Syz155240 2771ab25eeb5Syz155240 sum2 = LONG_SUM(ntohl(in.s_addr)); 2772ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 2773ab25eeb5Syz155240 fix_datacksum(&oip->ip_sum, sumd); 2774ab25eeb5Syz155240 2775ab25eeb5Syz155240 /* 27765142ed1fSjojemann * Step 2 27775142ed1fSjojemann * Perform other adjustments based on protocol of offending packet. 2778ab25eeb5Syz155240 */ 27795142ed1fSjojemann 27805142ed1fSjojemann switch (oip->ip_p) { 27815142ed1fSjojemann case IPPROTO_TCP : 27825142ed1fSjojemann case IPPROTO_UDP : 2783ab25eeb5Syz155240 2784ab25eeb5Syz155240 /* 27855142ed1fSjojemann * For offending TCP/UDP IP packets, translate the ports 27865142ed1fSjojemann * based on the NAT specification. 2787ab25eeb5Syz155240 * 2788ab25eeb5Syz155240 * Advance notice : Now it becomes complicated :-) 2789ab25eeb5Syz155240 * 27905142ed1fSjojemann * Since the port and IP addresse fields are both part 27915142ed1fSjojemann * of the TCP/UDP checksum of the offending IP packet, 27925142ed1fSjojemann * we need to adjust that checksum as well. 2793ab25eeb5Syz155240 * 27945142ed1fSjojemann * To further complicate things, the TCP/UDP checksum 27955142ed1fSjojemann * may not be present. We must check to see if the 27965142ed1fSjojemann * length of the data portion is big enough to hold 27975142ed1fSjojemann * the checksum. In the UDP case, a test to determine 27985142ed1fSjojemann * if the checksum is even set is also required. 27995142ed1fSjojemann * 28005142ed1fSjojemann * Any changes to an IP address, port or checksum within 28015142ed1fSjojemann * the ICMP packet requires a change to icmp_cksum. 28025142ed1fSjojemann * 28035142ed1fSjojemann * Be extremely careful here ... The change is dependent 28045142ed1fSjojemann * upon whether or not the TCP/UPD checksum is present. 28055142ed1fSjojemann * 28065142ed1fSjojemann * If TCP/UPD checksum is present, the icmp_cksum must 28075142ed1fSjojemann * compensate for checksum modification resulting from 28085142ed1fSjojemann * IP address change only. Port change and resulting 28095142ed1fSjojemann * data checksum adjustments cancel each other out. 28105142ed1fSjojemann * 28115142ed1fSjojemann * If TCP/UDP checksum is not present, icmp_cksum must 28125142ed1fSjojemann * compensate for port change only. The IP address 28135142ed1fSjojemann * change does not modify anything else in this case. 2814ab25eeb5Syz155240 */ 2815ab25eeb5Syz155240 28165142ed1fSjojemann psum1 = 0; 28175142ed1fSjojemann psum2 = 0; 28185142ed1fSjojemann psumd = 0; 28195142ed1fSjojemann 28205142ed1fSjojemann if ((tcp->th_dport == nat->nat_oport) && 28215142ed1fSjojemann (tcp->th_sport != nat->nat_inport)) { 28225142ed1fSjojemann 28235142ed1fSjojemann /* 28245142ed1fSjojemann * Translate the source port. 28255142ed1fSjojemann */ 28265142ed1fSjojemann 28275142ed1fSjojemann psum1 = ntohs(tcp->th_sport); 28285142ed1fSjojemann psum2 = ntohs(nat->nat_inport); 28295142ed1fSjojemann tcp->th_sport = nat->nat_inport; 28305142ed1fSjojemann 28315142ed1fSjojemann } else if ((tcp->th_sport == nat->nat_oport) && 28325142ed1fSjojemann (tcp->th_dport != nat->nat_outport)) { 28335142ed1fSjojemann 28345142ed1fSjojemann /* 28355142ed1fSjojemann * Translate the destination port. 28365142ed1fSjojemann */ 28375142ed1fSjojemann 28385142ed1fSjojemann psum1 = ntohs(tcp->th_dport); 28395142ed1fSjojemann psum2 = ntohs(nat->nat_outport); 28405142ed1fSjojemann tcp->th_dport = nat->nat_outport; 2841ab25eeb5Syz155240 } 2842ab25eeb5Syz155240 28435142ed1fSjojemann if ((oip->ip_p == IPPROTO_TCP) && (dlen >= 18)) { 2844ab25eeb5Syz155240 2845ab25eeb5Syz155240 /* 28465142ed1fSjojemann * TCP checksum present. 2847ab25eeb5Syz155240 * 28485142ed1fSjojemann * Adjust data checksum and icmp checksum to 28495142ed1fSjojemann * compensate for any IP address change. 2850ab25eeb5Syz155240 */ 2851ab25eeb5Syz155240 28525142ed1fSjojemann sum1 = ntohs(tcp->th_sum); 28535142ed1fSjojemann fix_datacksum(&tcp->th_sum, sumd); 28545142ed1fSjojemann sum2 = ntohs(tcp->th_sum); 28555142ed1fSjojemann sumd2 = sumd << 1; 2856ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 2857ab25eeb5Syz155240 sumd2 += sumd; 28585142ed1fSjojemann 28595142ed1fSjojemann /* 28605142ed1fSjojemann * Also make data checksum adjustment to 28615142ed1fSjojemann * compensate for any port change. 28625142ed1fSjojemann */ 28635142ed1fSjojemann 28645142ed1fSjojemann if (psum1 != psum2) { 28655142ed1fSjojemann CALC_SUMD(psum1, psum2, psumd); 28665142ed1fSjojemann fix_datacksum(&tcp->th_sum, psumd); 2867ab25eeb5Syz155240 } 2868ab25eeb5Syz155240 28695142ed1fSjojemann } else if ((oip->ip_p == IPPROTO_UDP) && 28705142ed1fSjojemann (dlen >= 8) && (udp->uh_sum != 0)) { 2871ab25eeb5Syz155240 2872ab25eeb5Syz155240 /* 28735142ed1fSjojemann * The UDP checksum is present and set. 28745142ed1fSjojemann * 28755142ed1fSjojemann * Adjust data checksum and icmp checksum to 28765142ed1fSjojemann * compensate for any IP address change. 2877ab25eeb5Syz155240 */ 28785142ed1fSjojemann 28795142ed1fSjojemann sum1 = ntohs(udp->uh_sum); 28805142ed1fSjojemann fix_datacksum(&udp->uh_sum, sumd); 28815142ed1fSjojemann sum2 = ntohs(udp->uh_sum); 28825142ed1fSjojemann sumd2 = sumd << 1; 2883ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 2884ab25eeb5Syz155240 sumd2 += sumd; 28855142ed1fSjojemann 28865142ed1fSjojemann /* 28875142ed1fSjojemann * Also make data checksum adjustment to 28885142ed1fSjojemann * compensate for any port change. 28895142ed1fSjojemann */ 28905142ed1fSjojemann 28915142ed1fSjojemann if (psum1 != psum2) { 28925142ed1fSjojemann CALC_SUMD(psum1, psum2, psumd); 28935142ed1fSjojemann fix_datacksum(&udp->uh_sum, psumd); 28945142ed1fSjojemann } 28955142ed1fSjojemann 2896ab25eeb5Syz155240 } else { 2897ab25eeb5Syz155240 2898ab25eeb5Syz155240 /* 28995142ed1fSjojemann * Data checksum was not present. 2900ab25eeb5Syz155240 * 29015142ed1fSjojemann * Compensate for any port change. 2902ab25eeb5Syz155240 */ 2903ab25eeb5Syz155240 29045142ed1fSjojemann CALC_SUMD(psum2, psum1, psumd); 29055142ed1fSjojemann sumd2 += psumd; 2906ab25eeb5Syz155240 } 29075142ed1fSjojemann break; 2908ab25eeb5Syz155240 29095142ed1fSjojemann case IPPROTO_ICMP : 2910ab25eeb5Syz155240 29115142ed1fSjojemann orgicmp = (icmphdr_t *)udp; 2912ab25eeb5Syz155240 29135142ed1fSjojemann if ((nat->nat_dir == NAT_OUTBOUND) && 29145142ed1fSjojemann (orgicmp->icmp_id != nat->nat_inport) && 29155142ed1fSjojemann (dlen >= 8)) { 2916ab25eeb5Syz155240 2917ab25eeb5Syz155240 /* 2918ab25eeb5Syz155240 * Fix ICMP checksum (of the offening ICMP 2919ab25eeb5Syz155240 * query packet) to compensate the change 2920ab25eeb5Syz155240 * in the ICMP id of the offending ICMP 2921ab25eeb5Syz155240 * packet. 2922ab25eeb5Syz155240 * 2923ab25eeb5Syz155240 * Since you modify orgicmp->icmp_id with 2924ab25eeb5Syz155240 * a delta (say x) and you compensate that 2925ab25eeb5Syz155240 * in origicmp->icmp_cksum with a delta 2926ab25eeb5Syz155240 * minus x, you don't have to adjust the 2927ab25eeb5Syz155240 * overall icmp->icmp_cksum 2928ab25eeb5Syz155240 */ 29295142ed1fSjojemann 2930ab25eeb5Syz155240 sum1 = ntohs(orgicmp->icmp_id); 2931ab25eeb5Syz155240 sum2 = ntohs(nat->nat_inport); 2932ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 2933ab25eeb5Syz155240 orgicmp->icmp_id = nat->nat_inport; 2934ab25eeb5Syz155240 fix_datacksum(&orgicmp->icmp_cksum, sumd); 29355142ed1fSjojemann 29365142ed1fSjojemann } /* nat_dir can't be NAT_INBOUND for icmp queries */ 29375142ed1fSjojemann 29385142ed1fSjojemann break; 29395142ed1fSjojemann 29405142ed1fSjojemann default : 29415142ed1fSjojemann 29425142ed1fSjojemann break; 29435142ed1fSjojemann 29445142ed1fSjojemann } /* switch (oip->ip_p) */ 29455142ed1fSjojemann 29465142ed1fSjojemann /* 29475142ed1fSjojemann * Step 3 29485142ed1fSjojemann * Make the adjustments to icmp checksum. 29495142ed1fSjojemann */ 29505142ed1fSjojemann 29515142ed1fSjojemann if (sumd2 != 0) { 29525142ed1fSjojemann sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 29535142ed1fSjojemann sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 2954381a2a9aSdr146992 fix_incksum(&icmp->icmp_cksum, sumd2); 2955ab25eeb5Syz155240 } 2956ab25eeb5Syz155240 return nat; 2957ab25eeb5Syz155240 } 2958ab25eeb5Syz155240 2959ab25eeb5Syz155240 2960ab25eeb5Syz155240 /* 2961ab25eeb5Syz155240 * NB: these lookups don't lock access to the list, it assumed that it has 2962ab25eeb5Syz155240 * already been done! 2963ab25eeb5Syz155240 */ 2964ab25eeb5Syz155240 2965ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2966ab25eeb5Syz155240 /* Function: nat_inlookup */ 2967ab25eeb5Syz155240 /* Returns: nat_t* - NULL == no match, */ 2968ab25eeb5Syz155240 /* else pointer to matching NAT entry */ 2969ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2970ab25eeb5Syz155240 /* flags(I) - NAT flags for this packet */ 2971ab25eeb5Syz155240 /* p(I) - protocol for this packet */ 2972ab25eeb5Syz155240 /* src(I) - source IP address */ 2973ab25eeb5Syz155240 /* mapdst(I) - destination IP address */ 2974ab25eeb5Syz155240 /* */ 2975ab25eeb5Syz155240 /* Lookup a nat entry based on the mapped destination ip address/port and */ 2976ab25eeb5Syz155240 /* real source address/port. We use this lookup when receiving a packet, */ 2977ab25eeb5Syz155240 /* we're looking for a table entry, based on the destination address. */ 2978ab25eeb5Syz155240 /* */ 2979ab25eeb5Syz155240 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */ 2980ab25eeb5Syz155240 /* */ 2981ab25eeb5Syz155240 /* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN */ 2982ab25eeb5Syz155240 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */ 2983ab25eeb5Syz155240 /* */ 2984ab25eeb5Syz155240 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */ 2985ab25eeb5Syz155240 /* the packet is of said protocol */ 2986ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2987ab25eeb5Syz155240 nat_t *nat_inlookup(fin, flags, p, src, mapdst) 2988ab25eeb5Syz155240 fr_info_t *fin; 2989ab25eeb5Syz155240 u_int flags, p; 2990ab25eeb5Syz155240 struct in_addr src , mapdst; 2991ab25eeb5Syz155240 { 2992ab25eeb5Syz155240 u_short sport, dport; 2993ab25eeb5Syz155240 ipnat_t *ipn; 2994ab25eeb5Syz155240 u_int sflags; 2995ab25eeb5Syz155240 nat_t *nat; 2996ab25eeb5Syz155240 int nflags; 2997ab25eeb5Syz155240 u_32_t dst; 2998ab25eeb5Syz155240 void *ifp; 2999ab25eeb5Syz155240 u_int hv; 3000f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3001ab25eeb5Syz155240 3002ab25eeb5Syz155240 if (fin != NULL) 3003ab25eeb5Syz155240 ifp = fin->fin_ifp; 3004ab25eeb5Syz155240 else 3005ab25eeb5Syz155240 ifp = NULL; 3006ab25eeb5Syz155240 sport = 0; 3007ab25eeb5Syz155240 dport = 0; 3008ab25eeb5Syz155240 dst = mapdst.s_addr; 3009ab25eeb5Syz155240 sflags = flags & NAT_TCPUDPICMP; 3010ab25eeb5Syz155240 3011ab25eeb5Syz155240 switch (p) 3012ab25eeb5Syz155240 { 3013ab25eeb5Syz155240 case IPPROTO_TCP : 3014ab25eeb5Syz155240 case IPPROTO_UDP : 3015ab25eeb5Syz155240 sport = htons(fin->fin_data[0]); 3016ab25eeb5Syz155240 dport = htons(fin->fin_data[1]); 3017ab25eeb5Syz155240 break; 3018ab25eeb5Syz155240 case IPPROTO_ICMP : 3019ab25eeb5Syz155240 if (flags & IPN_ICMPERR) 3020ab25eeb5Syz155240 sport = fin->fin_data[1]; 3021ab25eeb5Syz155240 else 3022ab25eeb5Syz155240 dport = fin->fin_data[1]; 3023ab25eeb5Syz155240 break; 3024ab25eeb5Syz155240 default : 3025ab25eeb5Syz155240 break; 3026ab25eeb5Syz155240 } 3027ab25eeb5Syz155240 3028ab25eeb5Syz155240 3029ab25eeb5Syz155240 if ((flags & SI_WILDP) != 0) 3030ab25eeb5Syz155240 goto find_in_wild_ports; 3031ab25eeb5Syz155240 3032ab25eeb5Syz155240 hv = NAT_HASH_FN(dst, dport, 0xffffffff); 3033f4b3ec61Sdh155122 hv = NAT_HASH_FN(src.s_addr, hv + sport, ifs->ifs_ipf_nattable_sz); 3034f4b3ec61Sdh155122 nat = ifs->ifs_nat_table[1][hv]; 3035ab25eeb5Syz155240 for (; nat; nat = nat->nat_hnext[1]) { 3036e6c6c1faSyz155240 if (nat->nat_ifps[0] != NULL) { 3037e6c6c1faSyz155240 if ((ifp != NULL) && (ifp != nat->nat_ifps[0])) 3038e6c6c1faSyz155240 continue; 3039e6c6c1faSyz155240 } else if (ifp != NULL) 3040e6c6c1faSyz155240 nat->nat_ifps[0] = ifp; 3041ab25eeb5Syz155240 3042e6c6c1faSyz155240 nflags = nat->nat_flags; 3043ab25eeb5Syz155240 3044ab25eeb5Syz155240 if (nat->nat_oip.s_addr == src.s_addr && 3045ab25eeb5Syz155240 nat->nat_outip.s_addr == dst && 3046ab25eeb5Syz155240 (((p == 0) && 3047ab25eeb5Syz155240 (sflags == (nat->nat_flags & IPN_TCPUDPICMP))) 3048ab25eeb5Syz155240 || (p == nat->nat_p))) { 3049ab25eeb5Syz155240 switch (p) 3050ab25eeb5Syz155240 { 3051ab25eeb5Syz155240 #if 0 3052ab25eeb5Syz155240 case IPPROTO_GRE : 3053ab25eeb5Syz155240 if (nat->nat_call[1] != fin->fin_data[0]) 3054ab25eeb5Syz155240 continue; 3055ab25eeb5Syz155240 break; 3056ab25eeb5Syz155240 #endif 3057ab25eeb5Syz155240 case IPPROTO_ICMP : 3058ab25eeb5Syz155240 if ((flags & IPN_ICMPERR) != 0) { 3059ab25eeb5Syz155240 if (nat->nat_outport != sport) 3060ab25eeb5Syz155240 continue; 3061ab25eeb5Syz155240 } else { 3062ab25eeb5Syz155240 if (nat->nat_outport != dport) 3063ab25eeb5Syz155240 continue; 3064ab25eeb5Syz155240 } 3065ab25eeb5Syz155240 break; 3066ab25eeb5Syz155240 case IPPROTO_TCP : 3067ab25eeb5Syz155240 case IPPROTO_UDP : 3068ab25eeb5Syz155240 if (nat->nat_oport != sport) 3069ab25eeb5Syz155240 continue; 3070ab25eeb5Syz155240 if (nat->nat_outport != dport) 3071ab25eeb5Syz155240 continue; 3072ab25eeb5Syz155240 break; 3073ab25eeb5Syz155240 default : 3074ab25eeb5Syz155240 break; 3075ab25eeb5Syz155240 } 3076ab25eeb5Syz155240 3077ab25eeb5Syz155240 ipn = nat->nat_ptr; 3078ab25eeb5Syz155240 if ((ipn != NULL) && (nat->nat_aps != NULL)) 3079ab25eeb5Syz155240 if (appr_match(fin, nat) != 0) 3080ab25eeb5Syz155240 continue; 3081ab25eeb5Syz155240 return nat; 3082ab25eeb5Syz155240 } 3083ab25eeb5Syz155240 } 3084ab25eeb5Syz155240 3085ab25eeb5Syz155240 /* 3086ab25eeb5Syz155240 * So if we didn't find it but there are wildcard members in the hash 3087ab25eeb5Syz155240 * table, go back and look for them. We do this search and update here 3088ab25eeb5Syz155240 * because it is modifying the NAT table and we want to do this only 3089ab25eeb5Syz155240 * for the first packet that matches. The exception, of course, is 3090ab25eeb5Syz155240 * for "dummy" (FI_IGNORE) lookups. 3091ab25eeb5Syz155240 */ 3092ab25eeb5Syz155240 find_in_wild_ports: 3093ab25eeb5Syz155240 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) 3094ab25eeb5Syz155240 return NULL; 3095f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_wilds == 0) 3096ab25eeb5Syz155240 return NULL; 3097ab25eeb5Syz155240 3098f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3099ab25eeb5Syz155240 3100ab25eeb5Syz155240 hv = NAT_HASH_FN(dst, 0, 0xffffffff); 3101f4b3ec61Sdh155122 hv = NAT_HASH_FN(src.s_addr, hv, ifs->ifs_ipf_nattable_sz); 3102ab25eeb5Syz155240 3103f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 3104ab25eeb5Syz155240 3105f4b3ec61Sdh155122 nat = ifs->ifs_nat_table[1][hv]; 3106ab25eeb5Syz155240 for (; nat; nat = nat->nat_hnext[1]) { 3107e6c6c1faSyz155240 if (nat->nat_ifps[0] != NULL) { 3108e6c6c1faSyz155240 if ((ifp != NULL) && (ifp != nat->nat_ifps[0])) 3109ab25eeb5Syz155240 continue; 3110e6c6c1faSyz155240 } else if (ifp != NULL) 3111e6c6c1faSyz155240 nat->nat_ifps[0] = ifp; 3112ab25eeb5Syz155240 3113ab25eeb5Syz155240 if (nat->nat_p != fin->fin_p) 3114ab25eeb5Syz155240 continue; 3115ab25eeb5Syz155240 if (nat->nat_oip.s_addr != src.s_addr || 3116ab25eeb5Syz155240 nat->nat_outip.s_addr != dst) 3117ab25eeb5Syz155240 continue; 3118ab25eeb5Syz155240 3119ab25eeb5Syz155240 nflags = nat->nat_flags; 3120ab25eeb5Syz155240 if (!(nflags & (NAT_TCPUDP|SI_WILDP))) 3121ab25eeb5Syz155240 continue; 3122ab25eeb5Syz155240 3123ab25eeb5Syz155240 if (nat_wildok(nat, (int)sport, (int)dport, nflags, 3124ab25eeb5Syz155240 NAT_INBOUND) == 1) { 3125ab25eeb5Syz155240 if ((fin->fin_flx & FI_IGNORE) != 0) 3126ab25eeb5Syz155240 break; 3127ab25eeb5Syz155240 if ((nflags & SI_CLONE) != 0) { 3128ab25eeb5Syz155240 nat = fr_natclone(fin, nat); 3129ab25eeb5Syz155240 if (nat == NULL) 3130ab25eeb5Syz155240 break; 3131ab25eeb5Syz155240 } else { 3132f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 3133f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_wilds--; 3134f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 3135ab25eeb5Syz155240 } 3136ab25eeb5Syz155240 nat->nat_oport = sport; 3137ab25eeb5Syz155240 nat->nat_outport = dport; 3138ab25eeb5Syz155240 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT); 3139f4b3ec61Sdh155122 nat_tabmove(nat, ifs); 3140ab25eeb5Syz155240 break; 3141ab25eeb5Syz155240 } 3142ab25eeb5Syz155240 } 3143ab25eeb5Syz155240 3144f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 3145ab25eeb5Syz155240 3146ab25eeb5Syz155240 return nat; 3147ab25eeb5Syz155240 } 3148ab25eeb5Syz155240 3149ab25eeb5Syz155240 3150ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3151ab25eeb5Syz155240 /* Function: nat_tabmove */ 3152ab25eeb5Syz155240 /* Returns: Nil */ 3153ab25eeb5Syz155240 /* Parameters: nat(I) - pointer to NAT structure */ 3154ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 3155ab25eeb5Syz155240 /* */ 3156ab25eeb5Syz155240 /* This function is only called for TCP/UDP NAT table entries where the */ 3157ab25eeb5Syz155240 /* original was placed in the table without hashing on the ports and we now */ 3158ab25eeb5Syz155240 /* want to include hashing on port numbers. */ 3159ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3160f4b3ec61Sdh155122 static void nat_tabmove(nat, ifs) 3161ab25eeb5Syz155240 nat_t *nat; 3162f4b3ec61Sdh155122 ipf_stack_t *ifs; 3163ab25eeb5Syz155240 { 3164ab25eeb5Syz155240 nat_t **natp; 3165ab25eeb5Syz155240 u_int hv; 3166ab25eeb5Syz155240 3167ab25eeb5Syz155240 if (nat->nat_flags & SI_CLONE) 3168ab25eeb5Syz155240 return; 3169ab25eeb5Syz155240 3170ab25eeb5Syz155240 /* 3171ab25eeb5Syz155240 * Remove the NAT entry from the old location 3172ab25eeb5Syz155240 */ 3173ab25eeb5Syz155240 if (nat->nat_hnext[0]) 3174ab25eeb5Syz155240 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; 3175ab25eeb5Syz155240 *nat->nat_phnext[0] = nat->nat_hnext[0]; 3176f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0][nat->nat_hv[0]]--; 3177ab25eeb5Syz155240 3178ab25eeb5Syz155240 if (nat->nat_hnext[1]) 3179ab25eeb5Syz155240 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; 3180ab25eeb5Syz155240 *nat->nat_phnext[1] = nat->nat_hnext[1]; 3181f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][nat->nat_hv[1]]--; 3182ab25eeb5Syz155240 3183ab25eeb5Syz155240 /* 3184ab25eeb5Syz155240 * Add into the NAT table in the new position 3185ab25eeb5Syz155240 */ 3186ab25eeb5Syz155240 hv = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport, 0xffffffff); 3187ab25eeb5Syz155240 hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + nat->nat_oport, 3188f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 3189ab25eeb5Syz155240 nat->nat_hv[0] = hv; 3190f4b3ec61Sdh155122 natp = &ifs->ifs_nat_table[0][hv]; 3191ab25eeb5Syz155240 if (*natp) 3192ab25eeb5Syz155240 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 3193ab25eeb5Syz155240 nat->nat_phnext[0] = natp; 3194ab25eeb5Syz155240 nat->nat_hnext[0] = *natp; 3195ab25eeb5Syz155240 *natp = nat; 3196f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0][hv]++; 3197ab25eeb5Syz155240 3198ab25eeb5Syz155240 hv = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport, 0xffffffff); 3199ab25eeb5Syz155240 hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + nat->nat_oport, 3200f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 3201ab25eeb5Syz155240 nat->nat_hv[1] = hv; 3202f4b3ec61Sdh155122 natp = &ifs->ifs_nat_table[1][hv]; 3203ab25eeb5Syz155240 if (*natp) 3204ab25eeb5Syz155240 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 3205ab25eeb5Syz155240 nat->nat_phnext[1] = natp; 3206ab25eeb5Syz155240 nat->nat_hnext[1] = *natp; 3207ab25eeb5Syz155240 *natp = nat; 3208f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][hv]++; 3209ab25eeb5Syz155240 } 3210ab25eeb5Syz155240 3211ab25eeb5Syz155240 3212ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3213ab25eeb5Syz155240 /* Function: nat_outlookup */ 3214ab25eeb5Syz155240 /* Returns: nat_t* - NULL == no match, */ 3215ab25eeb5Syz155240 /* else pointer to matching NAT entry */ 3216ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3217ab25eeb5Syz155240 /* flags(I) - NAT flags for this packet */ 3218ab25eeb5Syz155240 /* p(I) - protocol for this packet */ 3219ab25eeb5Syz155240 /* src(I) - source IP address */ 3220ab25eeb5Syz155240 /* dst(I) - destination IP address */ 3221ab25eeb5Syz155240 /* rw(I) - 1 == write lock on ipf_nat held, 0 == read lock. */ 3222ab25eeb5Syz155240 /* */ 3223ab25eeb5Syz155240 /* Lookup a nat entry based on the source 'real' ip address/port and */ 3224ab25eeb5Syz155240 /* destination address/port. We use this lookup when sending a packet out, */ 3225ab25eeb5Syz155240 /* we're looking for a table entry, based on the source address. */ 3226ab25eeb5Syz155240 /* */ 3227ab25eeb5Syz155240 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */ 3228ab25eeb5Syz155240 /* */ 3229ab25eeb5Syz155240 /* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN */ 3230ab25eeb5Syz155240 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */ 3231ab25eeb5Syz155240 /* */ 3232ab25eeb5Syz155240 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */ 3233ab25eeb5Syz155240 /* the packet is of said protocol */ 3234ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3235ab25eeb5Syz155240 nat_t *nat_outlookup(fin, flags, p, src, dst) 3236ab25eeb5Syz155240 fr_info_t *fin; 3237ab25eeb5Syz155240 u_int flags, p; 3238ab25eeb5Syz155240 struct in_addr src , dst; 3239ab25eeb5Syz155240 { 3240ab25eeb5Syz155240 u_short sport, dport; 3241ab25eeb5Syz155240 u_int sflags; 3242ab25eeb5Syz155240 ipnat_t *ipn; 3243ab25eeb5Syz155240 u_32_t srcip; 3244ab25eeb5Syz155240 nat_t *nat; 3245ab25eeb5Syz155240 int nflags; 3246ab25eeb5Syz155240 void *ifp; 3247ab25eeb5Syz155240 u_int hv; 3248f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3249ab25eeb5Syz155240 3250ab25eeb5Syz155240 ifp = fin->fin_ifp; 3251e6c6c1faSyz155240 3252ab25eeb5Syz155240 srcip = src.s_addr; 3253ab25eeb5Syz155240 sflags = flags & IPN_TCPUDPICMP; 3254ab25eeb5Syz155240 sport = 0; 3255ab25eeb5Syz155240 dport = 0; 3256ab25eeb5Syz155240 3257ab25eeb5Syz155240 switch (p) 3258ab25eeb5Syz155240 { 3259ab25eeb5Syz155240 case IPPROTO_TCP : 3260ab25eeb5Syz155240 case IPPROTO_UDP : 3261ab25eeb5Syz155240 sport = htons(fin->fin_data[0]); 3262ab25eeb5Syz155240 dport = htons(fin->fin_data[1]); 3263ab25eeb5Syz155240 break; 3264ab25eeb5Syz155240 case IPPROTO_ICMP : 3265ab25eeb5Syz155240 if (flags & IPN_ICMPERR) 3266ab25eeb5Syz155240 sport = fin->fin_data[1]; 3267ab25eeb5Syz155240 else 3268ab25eeb5Syz155240 dport = fin->fin_data[1]; 3269ab25eeb5Syz155240 break; 3270ab25eeb5Syz155240 default : 3271ab25eeb5Syz155240 break; 3272ab25eeb5Syz155240 } 3273ab25eeb5Syz155240 3274ab25eeb5Syz155240 if ((flags & SI_WILDP) != 0) 3275ab25eeb5Syz155240 goto find_out_wild_ports; 3276ab25eeb5Syz155240 3277ab25eeb5Syz155240 hv = NAT_HASH_FN(srcip, sport, 0xffffffff); 3278f4b3ec61Sdh155122 hv = NAT_HASH_FN(dst.s_addr, hv + dport, ifs->ifs_ipf_nattable_sz); 3279f4b3ec61Sdh155122 nat = ifs->ifs_nat_table[0][hv]; 3280ab25eeb5Syz155240 for (; nat; nat = nat->nat_hnext[0]) { 3281e6c6c1faSyz155240 if (nat->nat_ifps[1] != NULL) { 3282e6c6c1faSyz155240 if ((ifp != NULL) && (ifp != nat->nat_ifps[1])) 3283e6c6c1faSyz155240 continue; 3284e6c6c1faSyz155240 } else if (ifp != NULL) 3285e6c6c1faSyz155240 nat->nat_ifps[1] = ifp; 3286ab25eeb5Syz155240 3287e6c6c1faSyz155240 nflags = nat->nat_flags; 3288ab25eeb5Syz155240 3289ab25eeb5Syz155240 if (nat->nat_inip.s_addr == srcip && 3290ab25eeb5Syz155240 nat->nat_oip.s_addr == dst.s_addr && 3291ab25eeb5Syz155240 (((p == 0) && (sflags == (nflags & NAT_TCPUDPICMP))) 3292ab25eeb5Syz155240 || (p == nat->nat_p))) { 3293ab25eeb5Syz155240 switch (p) 3294ab25eeb5Syz155240 { 3295ab25eeb5Syz155240 #if 0 3296ab25eeb5Syz155240 case IPPROTO_GRE : 3297ab25eeb5Syz155240 if (nat->nat_call[1] != fin->fin_data[0]) 3298ab25eeb5Syz155240 continue; 3299ab25eeb5Syz155240 break; 3300ab25eeb5Syz155240 #endif 3301ab25eeb5Syz155240 case IPPROTO_TCP : 3302ab25eeb5Syz155240 case IPPROTO_UDP : 3303ab25eeb5Syz155240 if (nat->nat_oport != dport) 3304ab25eeb5Syz155240 continue; 3305ab25eeb5Syz155240 if (nat->nat_inport != sport) 3306ab25eeb5Syz155240 continue; 3307ab25eeb5Syz155240 break; 3308ab25eeb5Syz155240 default : 3309ab25eeb5Syz155240 break; 3310ab25eeb5Syz155240 } 3311ab25eeb5Syz155240 3312ab25eeb5Syz155240 ipn = nat->nat_ptr; 3313ab25eeb5Syz155240 if ((ipn != NULL) && (nat->nat_aps != NULL)) 3314ab25eeb5Syz155240 if (appr_match(fin, nat) != 0) 3315ab25eeb5Syz155240 continue; 3316ab25eeb5Syz155240 return nat; 3317ab25eeb5Syz155240 } 3318ab25eeb5Syz155240 } 3319ab25eeb5Syz155240 3320ab25eeb5Syz155240 /* 3321ab25eeb5Syz155240 * So if we didn't find it but there are wildcard members in the hash 3322ab25eeb5Syz155240 * table, go back and look for them. We do this search and update here 3323ab25eeb5Syz155240 * because it is modifying the NAT table and we want to do this only 3324ab25eeb5Syz155240 * for the first packet that matches. The exception, of course, is 3325ab25eeb5Syz155240 * for "dummy" (FI_IGNORE) lookups. 3326ab25eeb5Syz155240 */ 3327ab25eeb5Syz155240 find_out_wild_ports: 3328ab25eeb5Syz155240 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) 3329ab25eeb5Syz155240 return NULL; 3330f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_wilds == 0) 3331ab25eeb5Syz155240 return NULL; 3332ab25eeb5Syz155240 3333f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3334ab25eeb5Syz155240 3335ab25eeb5Syz155240 hv = NAT_HASH_FN(srcip, 0, 0xffffffff); 3336f4b3ec61Sdh155122 hv = NAT_HASH_FN(dst.s_addr, hv, ifs->ifs_ipf_nattable_sz); 3337ab25eeb5Syz155240 3338f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 3339ab25eeb5Syz155240 3340f4b3ec61Sdh155122 nat = ifs->ifs_nat_table[0][hv]; 3341ab25eeb5Syz155240 for (; nat; nat = nat->nat_hnext[0]) { 3342e6c6c1faSyz155240 if (nat->nat_ifps[1] != NULL) { 3343e6c6c1faSyz155240 if ((ifp != NULL) && (ifp != nat->nat_ifps[1])) 3344ab25eeb5Syz155240 continue; 3345e6c6c1faSyz155240 } else if (ifp != NULL) 3346e6c6c1faSyz155240 nat->nat_ifps[1] = ifp; 3347ab25eeb5Syz155240 3348ab25eeb5Syz155240 if (nat->nat_p != fin->fin_p) 3349ab25eeb5Syz155240 continue; 3350ab25eeb5Syz155240 if ((nat->nat_inip.s_addr != srcip) || 3351ab25eeb5Syz155240 (nat->nat_oip.s_addr != dst.s_addr)) 3352ab25eeb5Syz155240 continue; 3353ab25eeb5Syz155240 3354ab25eeb5Syz155240 nflags = nat->nat_flags; 3355ab25eeb5Syz155240 if (!(nflags & (NAT_TCPUDP|SI_WILDP))) 3356ab25eeb5Syz155240 continue; 3357ab25eeb5Syz155240 3358ab25eeb5Syz155240 if (nat_wildok(nat, (int)sport, (int)dport, nflags, 3359ab25eeb5Syz155240 NAT_OUTBOUND) == 1) { 3360ab25eeb5Syz155240 if ((fin->fin_flx & FI_IGNORE) != 0) 3361ab25eeb5Syz155240 break; 3362ab25eeb5Syz155240 if ((nflags & SI_CLONE) != 0) { 3363ab25eeb5Syz155240 nat = fr_natclone(fin, nat); 3364ab25eeb5Syz155240 if (nat == NULL) 3365ab25eeb5Syz155240 break; 3366ab25eeb5Syz155240 } else { 3367f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 3368f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_wilds--; 3369f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 3370ab25eeb5Syz155240 } 3371ab25eeb5Syz155240 nat->nat_inport = sport; 3372ab25eeb5Syz155240 nat->nat_oport = dport; 3373ab25eeb5Syz155240 if (nat->nat_outport == 0) 3374ab25eeb5Syz155240 nat->nat_outport = sport; 3375ab25eeb5Syz155240 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT); 3376f4b3ec61Sdh155122 nat_tabmove(nat, ifs); 3377ab25eeb5Syz155240 break; 3378ab25eeb5Syz155240 } 3379ab25eeb5Syz155240 } 3380ab25eeb5Syz155240 3381f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 3382ab25eeb5Syz155240 3383ab25eeb5Syz155240 return nat; 3384ab25eeb5Syz155240 } 3385ab25eeb5Syz155240 3386ab25eeb5Syz155240 3387ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3388ab25eeb5Syz155240 /* Function: nat_lookupredir */ 3389ab25eeb5Syz155240 /* Returns: nat_t* - NULL == no match, */ 3390ab25eeb5Syz155240 /* else pointer to matching NAT entry */ 3391ab25eeb5Syz155240 /* Parameters: np(I) - pointer to description of packet to find NAT table */ 3392ab25eeb5Syz155240 /* entry for. */ 3393ab25eeb5Syz155240 /* */ 3394ab25eeb5Syz155240 /* Lookup the NAT tables to search for a matching redirect */ 3395ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3396f4b3ec61Sdh155122 nat_t *nat_lookupredir(np, ifs) 3397ab25eeb5Syz155240 natlookup_t *np; 3398f4b3ec61Sdh155122 ipf_stack_t *ifs; 3399ab25eeb5Syz155240 { 3400ab25eeb5Syz155240 fr_info_t fi; 3401ab25eeb5Syz155240 nat_t *nat; 3402ab25eeb5Syz155240 3403ab25eeb5Syz155240 bzero((char *)&fi, sizeof(fi)); 3404ab25eeb5Syz155240 if (np->nl_flags & IPN_IN) { 3405ab25eeb5Syz155240 fi.fin_data[0] = ntohs(np->nl_realport); 3406ab25eeb5Syz155240 fi.fin_data[1] = ntohs(np->nl_outport); 3407ab25eeb5Syz155240 } else { 3408ab25eeb5Syz155240 fi.fin_data[0] = ntohs(np->nl_inport); 3409ab25eeb5Syz155240 fi.fin_data[1] = ntohs(np->nl_outport); 3410ab25eeb5Syz155240 } 3411ab25eeb5Syz155240 if (np->nl_flags & IPN_TCP) 3412ab25eeb5Syz155240 fi.fin_p = IPPROTO_TCP; 3413ab25eeb5Syz155240 else if (np->nl_flags & IPN_UDP) 3414ab25eeb5Syz155240 fi.fin_p = IPPROTO_UDP; 3415ab25eeb5Syz155240 else if (np->nl_flags & (IPN_ICMPERR|IPN_ICMPQUERY)) 3416ab25eeb5Syz155240 fi.fin_p = IPPROTO_ICMP; 3417ab25eeb5Syz155240 3418f4b3ec61Sdh155122 fi.fin_ifs = ifs; 3419ab25eeb5Syz155240 /* 3420ab25eeb5Syz155240 * We can do two sorts of lookups: 3421ab25eeb5Syz155240 * - IPN_IN: we have the `real' and `out' address, look for `in'. 3422ab25eeb5Syz155240 * - default: we have the `in' and `out' address, look for `real'. 3423ab25eeb5Syz155240 */ 3424ab25eeb5Syz155240 if (np->nl_flags & IPN_IN) { 3425ab25eeb5Syz155240 if ((nat = nat_inlookup(&fi, np->nl_flags, fi.fin_p, 3426ab25eeb5Syz155240 np->nl_realip, np->nl_outip))) { 3427ab25eeb5Syz155240 np->nl_inip = nat->nat_inip; 3428ab25eeb5Syz155240 np->nl_inport = nat->nat_inport; 3429ab25eeb5Syz155240 } 3430ab25eeb5Syz155240 } else { 3431ab25eeb5Syz155240 /* 3432ab25eeb5Syz155240 * If nl_inip is non null, this is a lookup based on the real 3433ab25eeb5Syz155240 * ip address. Else, we use the fake. 3434ab25eeb5Syz155240 */ 3435ab25eeb5Syz155240 if ((nat = nat_outlookup(&fi, np->nl_flags, fi.fin_p, 3436ab25eeb5Syz155240 np->nl_inip, np->nl_outip))) { 3437ab25eeb5Syz155240 3438ab25eeb5Syz155240 if ((np->nl_flags & IPN_FINDFORWARD) != 0) { 3439ab25eeb5Syz155240 fr_info_t fin; 3440ab25eeb5Syz155240 bzero((char *)&fin, sizeof(fin)); 3441ab25eeb5Syz155240 fin.fin_p = nat->nat_p; 3442ab25eeb5Syz155240 fin.fin_data[0] = ntohs(nat->nat_outport); 3443ab25eeb5Syz155240 fin.fin_data[1] = ntohs(nat->nat_oport); 3444f4b3ec61Sdh155122 fin.fin_ifs = ifs; 3445ab25eeb5Syz155240 if (nat_inlookup(&fin, np->nl_flags, fin.fin_p, 3446ab25eeb5Syz155240 nat->nat_outip, 3447ab25eeb5Syz155240 nat->nat_oip) != NULL) { 3448ab25eeb5Syz155240 np->nl_flags &= ~IPN_FINDFORWARD; 3449ab25eeb5Syz155240 } 3450ab25eeb5Syz155240 } 3451ab25eeb5Syz155240 3452ab25eeb5Syz155240 np->nl_realip = nat->nat_outip; 3453ab25eeb5Syz155240 np->nl_realport = nat->nat_outport; 3454ab25eeb5Syz155240 } 3455ab25eeb5Syz155240 } 3456ab25eeb5Syz155240 3457ab25eeb5Syz155240 return nat; 3458ab25eeb5Syz155240 } 3459ab25eeb5Syz155240 3460ab25eeb5Syz155240 3461ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3462ab25eeb5Syz155240 /* Function: nat_match */ 3463ab25eeb5Syz155240 /* Returns: int - 0 == no match, 1 == match */ 3464ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3465ab25eeb5Syz155240 /* np(I) - pointer to NAT rule */ 3466ab25eeb5Syz155240 /* */ 3467ab25eeb5Syz155240 /* Pull the matching of a packet against a NAT rule out of that complex */ 3468ab25eeb5Syz155240 /* loop inside fr_checknatin() and lay it out properly in its own function. */ 3469ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3470ab25eeb5Syz155240 static int nat_match(fin, np) 3471ab25eeb5Syz155240 fr_info_t *fin; 3472ab25eeb5Syz155240 ipnat_t *np; 3473ab25eeb5Syz155240 { 3474ab25eeb5Syz155240 frtuc_t *ft; 3475ab25eeb5Syz155240 3476ab25eeb5Syz155240 if (fin->fin_v != 4) 3477ab25eeb5Syz155240 return 0; 3478ab25eeb5Syz155240 3479ab25eeb5Syz155240 if (np->in_p && fin->fin_p != np->in_p) 3480ab25eeb5Syz155240 return 0; 3481ab25eeb5Syz155240 3482ab25eeb5Syz155240 if (fin->fin_out) { 3483ab25eeb5Syz155240 if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK))) 3484ab25eeb5Syz155240 return 0; 3485ab25eeb5Syz155240 if (((fin->fin_fi.fi_saddr & np->in_inmsk) != np->in_inip) 3486ab25eeb5Syz155240 ^ ((np->in_flags & IPN_NOTSRC) != 0)) 3487ab25eeb5Syz155240 return 0; 3488ab25eeb5Syz155240 if (((fin->fin_fi.fi_daddr & np->in_srcmsk) != np->in_srcip) 3489ab25eeb5Syz155240 ^ ((np->in_flags & IPN_NOTDST) != 0)) 3490ab25eeb5Syz155240 return 0; 3491ab25eeb5Syz155240 } else { 3492ab25eeb5Syz155240 if (!(np->in_redir & NAT_REDIRECT)) 3493ab25eeb5Syz155240 return 0; 3494ab25eeb5Syz155240 if (((fin->fin_fi.fi_saddr & np->in_srcmsk) != np->in_srcip) 3495ab25eeb5Syz155240 ^ ((np->in_flags & IPN_NOTSRC) != 0)) 3496ab25eeb5Syz155240 return 0; 3497ab25eeb5Syz155240 if (((fin->fin_fi.fi_daddr & np->in_outmsk) != np->in_outip) 3498ab25eeb5Syz155240 ^ ((np->in_flags & IPN_NOTDST) != 0)) 3499ab25eeb5Syz155240 return 0; 3500ab25eeb5Syz155240 } 3501ab25eeb5Syz155240 3502ab25eeb5Syz155240 ft = &np->in_tuc; 3503ab25eeb5Syz155240 if (!(fin->fin_flx & FI_TCPUDP) || 3504ab25eeb5Syz155240 (fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) { 3505ab25eeb5Syz155240 if (ft->ftu_scmp || ft->ftu_dcmp) 3506ab25eeb5Syz155240 return 0; 3507ab25eeb5Syz155240 return 1; 3508ab25eeb5Syz155240 } 3509ab25eeb5Syz155240 3510ab25eeb5Syz155240 return fr_tcpudpchk(fin, ft); 3511ab25eeb5Syz155240 } 3512ab25eeb5Syz155240 3513ab25eeb5Syz155240 3514ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3515ab25eeb5Syz155240 /* Function: nat_update */ 3516ab25eeb5Syz155240 /* Returns: Nil */ 3517ab25eeb5Syz155240 /* Parameters: nat(I) - pointer to NAT structure */ 3518ab25eeb5Syz155240 /* np(I) - pointer to NAT rule */ 3519ab25eeb5Syz155240 /* */ 3520ab25eeb5Syz155240 /* Updates the lifetime of a NAT table entry for non-TCP packets. Must be */ 3521ab25eeb5Syz155240 /* called with fin_rev updated - i.e. after calling nat_proto(). */ 3522ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3523ab25eeb5Syz155240 void nat_update(fin, nat, np) 3524ab25eeb5Syz155240 fr_info_t *fin; 3525ab25eeb5Syz155240 nat_t *nat; 3526ab25eeb5Syz155240 ipnat_t *np; 3527ab25eeb5Syz155240 { 3528ab25eeb5Syz155240 ipftq_t *ifq, *ifq2; 3529ab25eeb5Syz155240 ipftqent_t *tqe; 3530f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3531ab25eeb5Syz155240 3532ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 3533ab25eeb5Syz155240 tqe = &nat->nat_tqe; 3534ab25eeb5Syz155240 ifq = tqe->tqe_ifq; 3535ab25eeb5Syz155240 3536ab25eeb5Syz155240 /* 3537ab25eeb5Syz155240 * We allow over-riding of NAT timeouts from NAT rules, even for 3538ab25eeb5Syz155240 * TCP, however, if it is TCP and there is no rule timeout set, 3539ab25eeb5Syz155240 * then do not update the timeout here. 3540ab25eeb5Syz155240 */ 3541ab25eeb5Syz155240 if (np != NULL) 3542ab25eeb5Syz155240 ifq2 = np->in_tqehead[fin->fin_rev]; 3543ab25eeb5Syz155240 else 3544ab25eeb5Syz155240 ifq2 = NULL; 3545ab25eeb5Syz155240 3546ab25eeb5Syz155240 if (nat->nat_p == IPPROTO_TCP && ifq2 == NULL) { 3547f4b3ec61Sdh155122 (void) fr_tcp_age(&nat->nat_tqe, fin, ifs->ifs_nat_tqb, 0); 3548ab25eeb5Syz155240 } else { 3549ab25eeb5Syz155240 if (ifq2 == NULL) { 3550ab25eeb5Syz155240 if (nat->nat_p == IPPROTO_UDP) 3551f4b3ec61Sdh155122 ifq2 = &ifs->ifs_nat_udptq; 3552ab25eeb5Syz155240 else if (nat->nat_p == IPPROTO_ICMP) 3553f4b3ec61Sdh155122 ifq2 = &ifs->ifs_nat_icmptq; 3554ab25eeb5Syz155240 else 3555f4b3ec61Sdh155122 ifq2 = &ifs->ifs_nat_iptq; 3556ab25eeb5Syz155240 } 3557ab25eeb5Syz155240 3558f4b3ec61Sdh155122 fr_movequeue(tqe, ifq, ifq2, ifs); 3559ab25eeb5Syz155240 } 3560ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 3561ab25eeb5Syz155240 } 3562ab25eeb5Syz155240 3563ab25eeb5Syz155240 3564ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3565ab25eeb5Syz155240 /* Function: fr_checknatout */ 3566ab25eeb5Syz155240 /* Returns: int - -1 == packet failed NAT checks so block it, */ 3567ab25eeb5Syz155240 /* 0 == no packet translation occurred, */ 3568ab25eeb5Syz155240 /* 1 == packet was successfully translated. */ 3569ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3570ab25eeb5Syz155240 /* passp(I) - pointer to filtering result flags */ 3571ab25eeb5Syz155240 /* */ 3572ab25eeb5Syz155240 /* Check to see if an outcoming packet should be changed. ICMP packets are */ 3573ab25eeb5Syz155240 /* first checked to see if they match an existing entry (if an error), */ 3574ab25eeb5Syz155240 /* otherwise a search of the current NAT table is made. If neither results */ 3575ab25eeb5Syz155240 /* in a match then a search for a matching NAT rule is made. Create a new */ 3576ab25eeb5Syz155240 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */ 3577ab25eeb5Syz155240 /* packet header(s) as required. */ 3578ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3579ab25eeb5Syz155240 int fr_checknatout(fin, passp) 3580ab25eeb5Syz155240 fr_info_t *fin; 3581ab25eeb5Syz155240 u_32_t *passp; 3582ab25eeb5Syz155240 { 3583ab25eeb5Syz155240 struct ifnet *ifp, *sifp; 3584ab25eeb5Syz155240 icmphdr_t *icmp = NULL; 3585ab25eeb5Syz155240 tcphdr_t *tcp = NULL; 3586ab25eeb5Syz155240 int rval, natfailed; 3587ab25eeb5Syz155240 ipnat_t *np = NULL; 3588ab25eeb5Syz155240 u_int nflags = 0; 3589ab25eeb5Syz155240 u_32_t ipa, iph; 3590ab25eeb5Syz155240 int natadd = 1; 3591ab25eeb5Syz155240 frentry_t *fr; 3592ab25eeb5Syz155240 nat_t *nat; 3593f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3594ab25eeb5Syz155240 3595f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_rules == 0 || ifs->ifs_fr_nat_lock != 0) 3596ab25eeb5Syz155240 return 0; 3597ab25eeb5Syz155240 3598ab25eeb5Syz155240 natfailed = 0; 3599ab25eeb5Syz155240 fr = fin->fin_fr; 3600ab25eeb5Syz155240 sifp = fin->fin_ifp; 3601ab25eeb5Syz155240 if ((fr != NULL) && !(fr->fr_flags & FR_DUP) && 3602d3675867Sjojemann fr->fr_tifs[fin->fin_rev].fd_ifp && 3603d3675867Sjojemann fr->fr_tifs[fin->fin_rev].fd_ifp != (void *)-1) 3604d3675867Sjojemann fin->fin_ifp = fr->fr_tifs[fin->fin_rev].fd_ifp; 3605ab25eeb5Syz155240 ifp = fin->fin_ifp; 3606ab25eeb5Syz155240 3607ab25eeb5Syz155240 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 3608ab25eeb5Syz155240 switch (fin->fin_p) 3609ab25eeb5Syz155240 { 3610ab25eeb5Syz155240 case IPPROTO_TCP : 3611ab25eeb5Syz155240 nflags = IPN_TCP; 3612ab25eeb5Syz155240 break; 3613ab25eeb5Syz155240 case IPPROTO_UDP : 3614ab25eeb5Syz155240 nflags = IPN_UDP; 3615ab25eeb5Syz155240 break; 3616ab25eeb5Syz155240 case IPPROTO_ICMP : 3617ab25eeb5Syz155240 icmp = fin->fin_dp; 3618ab25eeb5Syz155240 3619ab25eeb5Syz155240 /* 3620ab25eeb5Syz155240 * This is an incoming packet, so the destination is 3621ab25eeb5Syz155240 * the icmp_id and the source port equals 0 3622ab25eeb5Syz155240 */ 3623ab25eeb5Syz155240 if (nat_icmpquerytype4(icmp->icmp_type)) 3624ab25eeb5Syz155240 nflags = IPN_ICMPQUERY; 3625ab25eeb5Syz155240 break; 3626ab25eeb5Syz155240 default : 3627ab25eeb5Syz155240 break; 3628ab25eeb5Syz155240 } 3629ab25eeb5Syz155240 3630ab25eeb5Syz155240 if ((nflags & IPN_TCPUDP)) 3631ab25eeb5Syz155240 tcp = fin->fin_dp; 3632ab25eeb5Syz155240 } 3633ab25eeb5Syz155240 3634ab25eeb5Syz155240 ipa = fin->fin_saddr; 3635ab25eeb5Syz155240 3636f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 3637ab25eeb5Syz155240 3638ab25eeb5Syz155240 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) && 3639ab25eeb5Syz155240 (nat = nat_icmperror(fin, &nflags, NAT_OUTBOUND))) 3640ab25eeb5Syz155240 /*EMPTY*/; 3641ab25eeb5Syz155240 else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin))) 3642ab25eeb5Syz155240 natadd = 0; 3643ab25eeb5Syz155240 else if ((nat = nat_outlookup(fin, nflags|NAT_SEARCH, (u_int)fin->fin_p, 3644ab25eeb5Syz155240 fin->fin_src, fin->fin_dst))) { 3645ab25eeb5Syz155240 nflags = nat->nat_flags; 3646ab25eeb5Syz155240 } else { 3647ab25eeb5Syz155240 u_32_t hv, msk, nmsk; 3648ab25eeb5Syz155240 3649ab25eeb5Syz155240 /* 3650ab25eeb5Syz155240 * If there is no current entry in the nat table for this IP#, 3651ab25eeb5Syz155240 * create one for it (if there is a matching rule). 3652ab25eeb5Syz155240 */ 3653f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3654ab25eeb5Syz155240 msk = 0xffffffff; 3655f4b3ec61Sdh155122 nmsk = ifs->ifs_nat_masks; 3656f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 3657ab25eeb5Syz155240 maskloop: 3658ab25eeb5Syz155240 iph = ipa & htonl(msk); 3659f4b3ec61Sdh155122 hv = NAT_HASH_FN(iph, 0, ifs->ifs_ipf_natrules_sz); 3660f4b3ec61Sdh155122 for (np = ifs->ifs_nat_rules[hv]; np; np = np->in_mnext) 3661ab25eeb5Syz155240 { 3662e6c6c1faSyz155240 if ((np->in_ifps[1] && (np->in_ifps[1] != ifp))) 3663ab25eeb5Syz155240 continue; 3664ab25eeb5Syz155240 if (np->in_v != fin->fin_v) 3665ab25eeb5Syz155240 continue; 3666ab25eeb5Syz155240 if (np->in_p && (np->in_p != fin->fin_p)) 3667ab25eeb5Syz155240 continue; 3668ab25eeb5Syz155240 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags)) 3669ab25eeb5Syz155240 continue; 3670ab25eeb5Syz155240 if (np->in_flags & IPN_FILTER) { 3671ab25eeb5Syz155240 if (!nat_match(fin, np)) 3672ab25eeb5Syz155240 continue; 3673ab25eeb5Syz155240 } else if ((ipa & np->in_inmsk) != np->in_inip) 3674ab25eeb5Syz155240 continue; 3675ab25eeb5Syz155240 3676ab25eeb5Syz155240 if ((fr != NULL) && 3677ab25eeb5Syz155240 !fr_matchtag(&np->in_tag, &fr->fr_nattag)) 3678ab25eeb5Syz155240 continue; 3679ab25eeb5Syz155240 3680ab25eeb5Syz155240 if (*np->in_plabel != '\0') { 3681ab25eeb5Syz155240 if (((np->in_flags & IPN_FILTER) == 0) && 3682ab25eeb5Syz155240 (np->in_dport != tcp->th_dport)) 3683ab25eeb5Syz155240 continue; 3684ab25eeb5Syz155240 if (appr_ok(fin, tcp, np) == 0) 3685ab25eeb5Syz155240 continue; 3686ab25eeb5Syz155240 } 3687ab25eeb5Syz155240 3688ab25eeb5Syz155240 if ((nat = nat_new(fin, np, NULL, nflags, 3689ab25eeb5Syz155240 NAT_OUTBOUND))) { 3690ab25eeb5Syz155240 np->in_hits++; 3691ab25eeb5Syz155240 break; 3692ab25eeb5Syz155240 } else 3693ab25eeb5Syz155240 natfailed = -1; 3694ab25eeb5Syz155240 } 3695ab25eeb5Syz155240 if ((np == NULL) && (nmsk != 0)) { 3696ab25eeb5Syz155240 while (nmsk) { 3697ab25eeb5Syz155240 msk <<= 1; 3698ab25eeb5Syz155240 if (nmsk & 0x80000000) 3699ab25eeb5Syz155240 break; 3700ab25eeb5Syz155240 nmsk <<= 1; 3701ab25eeb5Syz155240 } 3702ab25eeb5Syz155240 if (nmsk != 0) { 3703ab25eeb5Syz155240 nmsk <<= 1; 3704ab25eeb5Syz155240 goto maskloop; 3705ab25eeb5Syz155240 } 3706ab25eeb5Syz155240 } 3707f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 3708ab25eeb5Syz155240 } 3709ab25eeb5Syz155240 3710ab25eeb5Syz155240 if (nat != NULL) { 3711ab25eeb5Syz155240 rval = fr_natout(fin, nat, natadd, nflags); 3712ab25eeb5Syz155240 if (rval == 1) { 3713ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 3714ab25eeb5Syz155240 nat->nat_ref++; 3715ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 37163805c50fSan207044 nat->nat_touched = ifs->ifs_fr_ticks; 3717ab25eeb5Syz155240 fin->fin_nat = nat; 3718ab25eeb5Syz155240 } 3719ab25eeb5Syz155240 } else 3720ab25eeb5Syz155240 rval = natfailed; 3721f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3722ab25eeb5Syz155240 3723ab25eeb5Syz155240 if (rval == -1) { 3724ab25eeb5Syz155240 if (passp != NULL) 3725ab25eeb5Syz155240 *passp = FR_BLOCK; 3726ab25eeb5Syz155240 fin->fin_flx |= FI_BADNAT; 3727ab25eeb5Syz155240 } 3728ab25eeb5Syz155240 fin->fin_ifp = sifp; 3729ab25eeb5Syz155240 return rval; 3730ab25eeb5Syz155240 } 3731ab25eeb5Syz155240 3732ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3733ab25eeb5Syz155240 /* Function: fr_natout */ 3734ab25eeb5Syz155240 /* Returns: int - -1 == packet failed NAT checks so block it, */ 3735ab25eeb5Syz155240 /* 1 == packet was successfully translated. */ 3736ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3737ab25eeb5Syz155240 /* nat(I) - pointer to NAT structure */ 3738ab25eeb5Syz155240 /* natadd(I) - flag indicating if it is safe to add frag cache */ 3739ab25eeb5Syz155240 /* nflags(I) - NAT flags set for this packet */ 3740ab25eeb5Syz155240 /* */ 3741ab25eeb5Syz155240 /* Translate a packet coming "out" on an interface. */ 3742ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3743ab25eeb5Syz155240 int fr_natout(fin, nat, natadd, nflags) 3744ab25eeb5Syz155240 fr_info_t *fin; 3745ab25eeb5Syz155240 nat_t *nat; 3746ab25eeb5Syz155240 int natadd; 3747ab25eeb5Syz155240 u_32_t nflags; 3748ab25eeb5Syz155240 { 3749ab25eeb5Syz155240 icmphdr_t *icmp; 3750ab25eeb5Syz155240 u_short *csump; 3751381a2a9aSdr146992 u_32_t sumd; 3752ab25eeb5Syz155240 tcphdr_t *tcp; 3753ab25eeb5Syz155240 ipnat_t *np; 3754ab25eeb5Syz155240 int i; 3755f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3756ab25eeb5Syz155240 3757381a2a9aSdr146992 #if SOLARIS && defined(_KERNEL) 3758381a2a9aSdr146992 net_data_t net_data_p; 3759381a2a9aSdr146992 if (fin->fin_v == 4) 3760f4b3ec61Sdh155122 net_data_p = ifs->ifs_ipf_ipv4; 3761381a2a9aSdr146992 else 3762f4b3ec61Sdh155122 net_data_p = ifs->ifs_ipf_ipv6; 3763381a2a9aSdr146992 #endif 3764381a2a9aSdr146992 3765ab25eeb5Syz155240 tcp = NULL; 3766ab25eeb5Syz155240 icmp = NULL; 3767ab25eeb5Syz155240 csump = NULL; 3768ab25eeb5Syz155240 np = nat->nat_ptr; 3769ab25eeb5Syz155240 377015013d88Szf203873 if ((natadd != 0) && (fin->fin_flx & FI_FRAG)) 3771ab25eeb5Syz155240 (void) fr_nat_newfrag(fin, 0, nat); 3772ab25eeb5Syz155240 3773ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 3774ab25eeb5Syz155240 nat->nat_bytes[1] += fin->fin_plen; 3775ab25eeb5Syz155240 nat->nat_pkts[1]++; 3776ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 3777ab25eeb5Syz155240 3778ab25eeb5Syz155240 /* 3779ab25eeb5Syz155240 * Fix up checksums, not by recalculating them, but 3780ab25eeb5Syz155240 * simply computing adjustments. 3781ab25eeb5Syz155240 * This is only done for STREAMS based IP implementations where the 3782ab25eeb5Syz155240 * checksum has already been calculated by IP. In all other cases, 3783ab25eeb5Syz155240 * IPFilter is called before the checksum needs calculating so there 3784ab25eeb5Syz155240 * is no call to modify whatever is in the header now. 3785ab25eeb5Syz155240 */ 3786381a2a9aSdr146992 ASSERT(fin->fin_m != NULL); 3787381a2a9aSdr146992 if (fin->fin_v == 4 && !NET_IS_HCK_L3_FULL(net_data_p, fin->fin_m)) { 3788ab25eeb5Syz155240 if (nflags == IPN_ICMPERR) { 3789381a2a9aSdr146992 u_32_t s1, s2; 3790ab25eeb5Syz155240 3791ab25eeb5Syz155240 s1 = LONG_SUM(ntohl(fin->fin_saddr)); 3792ab25eeb5Syz155240 s2 = LONG_SUM(ntohl(nat->nat_outip.s_addr)); 3793ab25eeb5Syz155240 CALC_SUMD(s1, s2, sumd); 3794381a2a9aSdr146992 3795381a2a9aSdr146992 fix_outcksum(&fin->fin_ip->ip_sum, sumd); 3796ab25eeb5Syz155240 } 3797ab25eeb5Syz155240 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 3798ab25eeb5Syz155240 defined(linux) || defined(BRIDGE_IPF) 3799ab25eeb5Syz155240 else { 3800ab25eeb5Syz155240 /* 3801ab25eeb5Syz155240 * Strictly speaking, this isn't necessary on BSD 3802ab25eeb5Syz155240 * kernels because they do checksum calculation after 3803ab25eeb5Syz155240 * this code has run BUT if ipfilter is being used 3804ab25eeb5Syz155240 * to do NAT as a bridge, that code doesn't exist. 3805ab25eeb5Syz155240 */ 3806ab25eeb5Syz155240 if (nat->nat_dir == NAT_OUTBOUND) 3807381a2a9aSdr146992 fix_outcksum(&fin->fin_ip->ip_sum, 3808ab25eeb5Syz155240 nat->nat_ipsumd); 3809ab25eeb5Syz155240 else 3810381a2a9aSdr146992 fix_incksum(&fin->fin_ip->ip_sum, 3811ab25eeb5Syz155240 nat->nat_ipsumd); 3812ab25eeb5Syz155240 } 3813ab25eeb5Syz155240 #endif 3814ab25eeb5Syz155240 } 3815ab25eeb5Syz155240 3816ab25eeb5Syz155240 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 3817ab25eeb5Syz155240 if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) { 3818ab25eeb5Syz155240 tcp = fin->fin_dp; 3819ab25eeb5Syz155240 3820ab25eeb5Syz155240 tcp->th_sport = nat->nat_outport; 3821ab25eeb5Syz155240 fin->fin_data[0] = ntohs(nat->nat_outport); 3822ab25eeb5Syz155240 } 3823ab25eeb5Syz155240 3824ab25eeb5Syz155240 if ((nat->nat_outport != 0) && (nflags & IPN_ICMPQUERY)) { 3825ab25eeb5Syz155240 icmp = fin->fin_dp; 3826ab25eeb5Syz155240 icmp->icmp_id = nat->nat_outport; 3827ab25eeb5Syz155240 } 3828ab25eeb5Syz155240 3829ab25eeb5Syz155240 csump = nat_proto(fin, nat, nflags); 3830ab25eeb5Syz155240 } 3831ab25eeb5Syz155240 3832ab25eeb5Syz155240 fin->fin_ip->ip_src = nat->nat_outip; 3833ab25eeb5Syz155240 3834ab25eeb5Syz155240 nat_update(fin, nat, np); 3835ab25eeb5Syz155240 3836ab25eeb5Syz155240 /* 3837ab25eeb5Syz155240 * The above comments do not hold for layer 4 (or higher) checksums... 3838ab25eeb5Syz155240 */ 3839381a2a9aSdr146992 if (csump != NULL && !NET_IS_HCK_L4_FULL(net_data_p, fin->fin_m)) { 3840381a2a9aSdr146992 if (nflags & IPN_TCPUDP && 3841381a2a9aSdr146992 NET_IS_HCK_L4_PART(net_data_p, fin->fin_m)) 3842381a2a9aSdr146992 sumd = nat->nat_sumd[1]; 3843ab25eeb5Syz155240 else 3844381a2a9aSdr146992 sumd = nat->nat_sumd[0]; 3845381a2a9aSdr146992 3846381a2a9aSdr146992 if (nat->nat_dir == NAT_OUTBOUND) 3847381a2a9aSdr146992 fix_outcksum(csump, sumd); 3848381a2a9aSdr146992 else 3849381a2a9aSdr146992 fix_incksum(csump, sumd); 3850ab25eeb5Syz155240 } 3851ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 3852ab25eeb5Syz155240 ipfsync_update(SMC_NAT, fin, nat->nat_sync); 3853ab25eeb5Syz155240 #endif 3854ab25eeb5Syz155240 /* ------------------------------------------------------------- */ 3855ab25eeb5Syz155240 /* A few quick notes: */ 3856ab25eeb5Syz155240 /* Following are test conditions prior to calling the */ 3857ab25eeb5Syz155240 /* appr_check routine. */ 3858ab25eeb5Syz155240 /* */ 3859ab25eeb5Syz155240 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ 3860ab25eeb5Syz155240 /* with a redirect rule, we attempt to match the packet's */ 3861ab25eeb5Syz155240 /* source port against in_dport, otherwise we'd compare the */ 3862ab25eeb5Syz155240 /* packet's destination. */ 3863ab25eeb5Syz155240 /* ------------------------------------------------------------- */ 3864ab25eeb5Syz155240 if ((np != NULL) && (np->in_apr != NULL)) { 3865ab25eeb5Syz155240 i = appr_check(fin, nat); 3866ab25eeb5Syz155240 if (i == 0) 3867ab25eeb5Syz155240 i = 1; 3868ab25eeb5Syz155240 } else 3869ab25eeb5Syz155240 i = 1; 3870f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_nat_stats.ns_mapped[1]); 3871ab25eeb5Syz155240 fin->fin_flx |= FI_NATED; 3872ab25eeb5Syz155240 return i; 3873ab25eeb5Syz155240 } 3874ab25eeb5Syz155240 3875ab25eeb5Syz155240 3876ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3877ab25eeb5Syz155240 /* Function: fr_checknatin */ 3878ab25eeb5Syz155240 /* Returns: int - -1 == packet failed NAT checks so block it, */ 3879ab25eeb5Syz155240 /* 0 == no packet translation occurred, */ 3880ab25eeb5Syz155240 /* 1 == packet was successfully translated. */ 3881ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3882ab25eeb5Syz155240 /* passp(I) - pointer to filtering result flags */ 3883ab25eeb5Syz155240 /* */ 3884ab25eeb5Syz155240 /* Check to see if an incoming packet should be changed. ICMP packets are */ 3885ab25eeb5Syz155240 /* first checked to see if they match an existing entry (if an error), */ 3886ab25eeb5Syz155240 /* otherwise a search of the current NAT table is made. If neither results */ 3887ab25eeb5Syz155240 /* in a match then a search for a matching NAT rule is made. Create a new */ 3888ab25eeb5Syz155240 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */ 3889ab25eeb5Syz155240 /* packet header(s) as required. */ 3890ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3891ab25eeb5Syz155240 int fr_checknatin(fin, passp) 3892ab25eeb5Syz155240 fr_info_t *fin; 3893ab25eeb5Syz155240 u_32_t *passp; 3894ab25eeb5Syz155240 { 3895ab25eeb5Syz155240 u_int nflags, natadd; 3896ab25eeb5Syz155240 int rval, natfailed; 3897ab25eeb5Syz155240 struct ifnet *ifp; 3898ab25eeb5Syz155240 struct in_addr in; 3899ab25eeb5Syz155240 icmphdr_t *icmp; 3900ab25eeb5Syz155240 tcphdr_t *tcp; 3901ab25eeb5Syz155240 u_short dport; 3902ab25eeb5Syz155240 ipnat_t *np; 3903ab25eeb5Syz155240 nat_t *nat; 3904ab25eeb5Syz155240 u_32_t iph; 3905f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3906ab25eeb5Syz155240 3907f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_rules == 0 || ifs->ifs_fr_nat_lock != 0) 3908ab25eeb5Syz155240 return 0; 3909ab25eeb5Syz155240 3910ab25eeb5Syz155240 tcp = NULL; 3911ab25eeb5Syz155240 icmp = NULL; 3912ab25eeb5Syz155240 dport = 0; 3913ab25eeb5Syz155240 natadd = 1; 3914ab25eeb5Syz155240 nflags = 0; 3915ab25eeb5Syz155240 natfailed = 0; 3916ab25eeb5Syz155240 ifp = fin->fin_ifp; 3917ab25eeb5Syz155240 3918ab25eeb5Syz155240 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 3919ab25eeb5Syz155240 switch (fin->fin_p) 3920ab25eeb5Syz155240 { 3921ab25eeb5Syz155240 case IPPROTO_TCP : 3922ab25eeb5Syz155240 nflags = IPN_TCP; 3923ab25eeb5Syz155240 break; 3924ab25eeb5Syz155240 case IPPROTO_UDP : 3925ab25eeb5Syz155240 nflags = IPN_UDP; 3926ab25eeb5Syz155240 break; 3927ab25eeb5Syz155240 case IPPROTO_ICMP : 3928ab25eeb5Syz155240 icmp = fin->fin_dp; 3929ab25eeb5Syz155240 3930ab25eeb5Syz155240 /* 3931ab25eeb5Syz155240 * This is an incoming packet, so the destination is 3932ab25eeb5Syz155240 * the icmp_id and the source port equals 0 3933ab25eeb5Syz155240 */ 3934ab25eeb5Syz155240 if (nat_icmpquerytype4(icmp->icmp_type)) { 3935ab25eeb5Syz155240 nflags = IPN_ICMPQUERY; 3936ab25eeb5Syz155240 dport = icmp->icmp_id; 3937ab25eeb5Syz155240 } break; 3938ab25eeb5Syz155240 default : 3939ab25eeb5Syz155240 break; 3940ab25eeb5Syz155240 } 3941ab25eeb5Syz155240 3942ab25eeb5Syz155240 if ((nflags & IPN_TCPUDP)) { 3943ab25eeb5Syz155240 tcp = fin->fin_dp; 3944ab25eeb5Syz155240 dport = tcp->th_dport; 3945ab25eeb5Syz155240 } 3946ab25eeb5Syz155240 } 3947ab25eeb5Syz155240 3948ab25eeb5Syz155240 in = fin->fin_dst; 3949ab25eeb5Syz155240 3950f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 3951ab25eeb5Syz155240 3952ab25eeb5Syz155240 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) && 3953ab25eeb5Syz155240 (nat = nat_icmperror(fin, &nflags, NAT_INBOUND))) 3954ab25eeb5Syz155240 /*EMPTY*/; 3955ab25eeb5Syz155240 else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin))) 3956ab25eeb5Syz155240 natadd = 0; 3957ab25eeb5Syz155240 else if ((nat = nat_inlookup(fin, nflags|NAT_SEARCH, (u_int)fin->fin_p, 3958ab25eeb5Syz155240 fin->fin_src, in))) { 3959ab25eeb5Syz155240 nflags = nat->nat_flags; 3960ab25eeb5Syz155240 } else { 3961ab25eeb5Syz155240 u_32_t hv, msk, rmsk; 3962ab25eeb5Syz155240 3963f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3964f4b3ec61Sdh155122 rmsk = ifs->ifs_rdr_masks; 3965ab25eeb5Syz155240 msk = 0xffffffff; 3966f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 3967ab25eeb5Syz155240 /* 3968ab25eeb5Syz155240 * If there is no current entry in the nat table for this IP#, 3969ab25eeb5Syz155240 * create one for it (if there is a matching rule). 3970ab25eeb5Syz155240 */ 3971ab25eeb5Syz155240 maskloop: 3972ab25eeb5Syz155240 iph = in.s_addr & htonl(msk); 3973f4b3ec61Sdh155122 hv = NAT_HASH_FN(iph, 0, ifs->ifs_ipf_rdrrules_sz); 3974f4b3ec61Sdh155122 for (np = ifs->ifs_rdr_rules[hv]; np; np = np->in_rnext) { 3975ab25eeb5Syz155240 if (np->in_ifps[0] && (np->in_ifps[0] != ifp)) 3976ab25eeb5Syz155240 continue; 3977ab25eeb5Syz155240 if (np->in_v != fin->fin_v) 3978ab25eeb5Syz155240 continue; 3979ab25eeb5Syz155240 if (np->in_p && (np->in_p != fin->fin_p)) 3980ab25eeb5Syz155240 continue; 3981ab25eeb5Syz155240 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags)) 3982ab25eeb5Syz155240 continue; 3983ab25eeb5Syz155240 if (np->in_flags & IPN_FILTER) { 3984ab25eeb5Syz155240 if (!nat_match(fin, np)) 3985ab25eeb5Syz155240 continue; 3986ab25eeb5Syz155240 } else { 3987ab25eeb5Syz155240 if ((in.s_addr & np->in_outmsk) != np->in_outip) 3988ab25eeb5Syz155240 continue; 3989ab25eeb5Syz155240 if (np->in_pmin && 3990ab25eeb5Syz155240 ((ntohs(np->in_pmax) < ntohs(dport)) || 3991ab25eeb5Syz155240 (ntohs(dport) < ntohs(np->in_pmin)))) 3992ab25eeb5Syz155240 continue; 3993ab25eeb5Syz155240 } 3994ab25eeb5Syz155240 3995ab25eeb5Syz155240 if (*np->in_plabel != '\0') { 3996ab25eeb5Syz155240 if (!appr_ok(fin, tcp, np)) { 3997ab25eeb5Syz155240 continue; 3998ab25eeb5Syz155240 } 3999ab25eeb5Syz155240 } 4000ab25eeb5Syz155240 4001ab25eeb5Syz155240 nat = nat_new(fin, np, NULL, nflags, NAT_INBOUND); 4002ab25eeb5Syz155240 if (nat != NULL) { 4003ab25eeb5Syz155240 np->in_hits++; 4004ab25eeb5Syz155240 break; 4005ab25eeb5Syz155240 } else 4006ab25eeb5Syz155240 natfailed = -1; 4007ab25eeb5Syz155240 } 4008ab25eeb5Syz155240 4009ab25eeb5Syz155240 if ((np == NULL) && (rmsk != 0)) { 4010ab25eeb5Syz155240 while (rmsk) { 4011ab25eeb5Syz155240 msk <<= 1; 4012ab25eeb5Syz155240 if (rmsk & 0x80000000) 4013ab25eeb5Syz155240 break; 4014ab25eeb5Syz155240 rmsk <<= 1; 4015ab25eeb5Syz155240 } 4016ab25eeb5Syz155240 if (rmsk != 0) { 4017ab25eeb5Syz155240 rmsk <<= 1; 4018ab25eeb5Syz155240 goto maskloop; 4019ab25eeb5Syz155240 } 4020ab25eeb5Syz155240 } 4021f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 4022ab25eeb5Syz155240 } 4023ab25eeb5Syz155240 if (nat != NULL) { 4024ab25eeb5Syz155240 rval = fr_natin(fin, nat, natadd, nflags); 4025ab25eeb5Syz155240 if (rval == 1) { 4026ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 4027ab25eeb5Syz155240 nat->nat_ref++; 4028ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 40293805c50fSan207044 nat->nat_touched = ifs->ifs_fr_ticks; 4030ab25eeb5Syz155240 fin->fin_nat = nat; 4031ab25eeb5Syz155240 fin->fin_state = nat->nat_state; 4032ab25eeb5Syz155240 } 4033ab25eeb5Syz155240 } else 4034ab25eeb5Syz155240 rval = natfailed; 4035f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4036ab25eeb5Syz155240 4037ab25eeb5Syz155240 if (rval == -1) { 4038ab25eeb5Syz155240 if (passp != NULL) 4039ab25eeb5Syz155240 *passp = FR_BLOCK; 4040ab25eeb5Syz155240 fin->fin_flx |= FI_BADNAT; 4041ab25eeb5Syz155240 } 4042ab25eeb5Syz155240 return rval; 4043ab25eeb5Syz155240 } 4044ab25eeb5Syz155240 4045ab25eeb5Syz155240 4046ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4047ab25eeb5Syz155240 /* Function: fr_natin */ 4048ab25eeb5Syz155240 /* Returns: int - -1 == packet failed NAT checks so block it, */ 4049ab25eeb5Syz155240 /* 1 == packet was successfully translated. */ 4050ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 4051ab25eeb5Syz155240 /* nat(I) - pointer to NAT structure */ 4052ab25eeb5Syz155240 /* natadd(I) - flag indicating if it is safe to add frag cache */ 4053ab25eeb5Syz155240 /* nflags(I) - NAT flags set for this packet */ 4054ab25eeb5Syz155240 /* Locks Held: ipf_nat (READ) */ 4055ab25eeb5Syz155240 /* */ 4056ab25eeb5Syz155240 /* Translate a packet coming "in" on an interface. */ 4057ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4058ab25eeb5Syz155240 int fr_natin(fin, nat, natadd, nflags) 4059ab25eeb5Syz155240 fr_info_t *fin; 4060ab25eeb5Syz155240 nat_t *nat; 4061ab25eeb5Syz155240 int natadd; 4062ab25eeb5Syz155240 u_32_t nflags; 4063ab25eeb5Syz155240 { 4064ab25eeb5Syz155240 icmphdr_t *icmp; 4065381a2a9aSdr146992 u_short *csump, *csump1; 4066381a2a9aSdr146992 u_32_t sumd; 4067ab25eeb5Syz155240 tcphdr_t *tcp; 4068ab25eeb5Syz155240 ipnat_t *np; 4069ab25eeb5Syz155240 int i; 4070f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 4071ab25eeb5Syz155240 4072381a2a9aSdr146992 #if SOLARIS && defined(_KERNEL) 4073381a2a9aSdr146992 net_data_t net_data_p; 4074381a2a9aSdr146992 if (fin->fin_v == 4) 4075f4b3ec61Sdh155122 net_data_p = ifs->ifs_ipf_ipv4; 4076381a2a9aSdr146992 else 4077f4b3ec61Sdh155122 net_data_p = ifs->ifs_ipf_ipv6; 4078381a2a9aSdr146992 #endif 4079381a2a9aSdr146992 4080ab25eeb5Syz155240 tcp = NULL; 4081ab25eeb5Syz155240 csump = NULL; 4082ab25eeb5Syz155240 np = nat->nat_ptr; 4083ab25eeb5Syz155240 fin->fin_fr = nat->nat_fr; 4084ab25eeb5Syz155240 4085ab25eeb5Syz155240 if ((natadd != 0) && (fin->fin_flx & FI_FRAG)) 4086ab25eeb5Syz155240 (void) fr_nat_newfrag(fin, 0, nat); 4087ab25eeb5Syz155240 408815013d88Szf203873 if (np != NULL) { 408915013d88Szf203873 4090ab25eeb5Syz155240 /* ------------------------------------------------------------- */ 4091ab25eeb5Syz155240 /* A few quick notes: */ 4092ab25eeb5Syz155240 /* Following are test conditions prior to calling the */ 4093ab25eeb5Syz155240 /* appr_check routine. */ 4094ab25eeb5Syz155240 /* */ 4095ab25eeb5Syz155240 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ 4096ab25eeb5Syz155240 /* with a map rule, we attempt to match the packet's */ 4097ab25eeb5Syz155240 /* source port against in_dport, otherwise we'd compare the */ 4098ab25eeb5Syz155240 /* packet's destination. */ 4099ab25eeb5Syz155240 /* ------------------------------------------------------------- */ 4100ab25eeb5Syz155240 if (np->in_apr != NULL) { 4101ab25eeb5Syz155240 i = appr_check(fin, nat); 4102ab25eeb5Syz155240 if (i == -1) { 4103ab25eeb5Syz155240 return -1; 4104ab25eeb5Syz155240 } 4105ab25eeb5Syz155240 } 4106ab25eeb5Syz155240 } 4107ab25eeb5Syz155240 4108ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 4109ab25eeb5Syz155240 ipfsync_update(SMC_NAT, fin, nat->nat_sync); 4110ab25eeb5Syz155240 #endif 4111ab25eeb5Syz155240 4112ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 4113ab25eeb5Syz155240 nat->nat_bytes[0] += fin->fin_plen; 4114ab25eeb5Syz155240 nat->nat_pkts[0]++; 4115ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 4116ab25eeb5Syz155240 4117ab25eeb5Syz155240 fin->fin_ip->ip_dst = nat->nat_inip; 4118ab25eeb5Syz155240 fin->fin_fi.fi_daddr = nat->nat_inip.s_addr; 4119ab25eeb5Syz155240 if (nflags & IPN_TCPUDP) 4120ab25eeb5Syz155240 tcp = fin->fin_dp; 4121ab25eeb5Syz155240 4122ab25eeb5Syz155240 /* 4123ab25eeb5Syz155240 * Fix up checksums, not by recalculating them, but 4124ab25eeb5Syz155240 * simply computing adjustments. 4125ab25eeb5Syz155240 * Why only do this for some platforms on inbound packets ? 4126ab25eeb5Syz155240 * Because for those that it is done, IP processing is yet to happen 4127ab25eeb5Syz155240 * and so the IPv4 header checksum has not yet been evaluated. 4128ab25eeb5Syz155240 * Perhaps it should always be done for the benefit of things like 4129ab25eeb5Syz155240 * fast forwarding (so that it doesn't need to be recomputed) but with 4130ab25eeb5Syz155240 * header checksum offloading, perhaps it is a moot point. 4131ab25eeb5Syz155240 */ 4132ab25eeb5Syz155240 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 4133ab25eeb5Syz155240 defined(__osf__) || defined(linux) 4134ab25eeb5Syz155240 if (nat->nat_dir == NAT_OUTBOUND) 4135381a2a9aSdr146992 fix_incksum(&fin->fin_ip->ip_sum, nat->nat_ipsumd); 4136ab25eeb5Syz155240 else 4137381a2a9aSdr146992 fix_outcksum(&fin->fin_ip->ip_sum, nat->nat_ipsumd); 4138ab25eeb5Syz155240 #endif 4139ab25eeb5Syz155240 4140ab25eeb5Syz155240 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 4141ab25eeb5Syz155240 if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) { 4142ab25eeb5Syz155240 tcp->th_dport = nat->nat_inport; 4143ab25eeb5Syz155240 fin->fin_data[1] = ntohs(nat->nat_inport); 4144ab25eeb5Syz155240 } 4145ab25eeb5Syz155240 4146ab25eeb5Syz155240 4147ab25eeb5Syz155240 if ((nat->nat_inport != 0) && (nflags & IPN_ICMPQUERY)) { 4148ab25eeb5Syz155240 icmp = fin->fin_dp; 4149ab25eeb5Syz155240 4150ab25eeb5Syz155240 icmp->icmp_id = nat->nat_inport; 4151ab25eeb5Syz155240 } 4152ab25eeb5Syz155240 4153ab25eeb5Syz155240 csump = nat_proto(fin, nat, nflags); 4154ab25eeb5Syz155240 } 4155ab25eeb5Syz155240 4156ab25eeb5Syz155240 nat_update(fin, nat, np); 4157ab25eeb5Syz155240 4158381a2a9aSdr146992 #if SOLARIS && defined(_KERNEL) 4159381a2a9aSdr146992 if (nflags & IPN_TCPUDP && 4160381a2a9aSdr146992 NET_IS_HCK_L4_PART(net_data_p, fin->fin_m)) { 4161381a2a9aSdr146992 sumd = nat->nat_sumd[1]; 4162381a2a9aSdr146992 csump1 = &(fin->fin_m->b_datap->db_struioun.cksum.cksum_val.u16); 4163381a2a9aSdr146992 if (csump1 != NULL) { 4164381a2a9aSdr146992 if (nat->nat_dir == NAT_OUTBOUND) 4165381a2a9aSdr146992 fix_incksum(csump1, sumd); 4166381a2a9aSdr146992 else 4167381a2a9aSdr146992 fix_outcksum(csump1, sumd); 4168381a2a9aSdr146992 } 4169381a2a9aSdr146992 } else 4170381a2a9aSdr146992 #endif 4171381a2a9aSdr146992 sumd = nat->nat_sumd[0]; 4172381a2a9aSdr146992 4173ab25eeb5Syz155240 /* 4174381a2a9aSdr146992 * Inbound packets always need to have their address adjusted in case 4175381a2a9aSdr146992 * code following this validates it. 4176ab25eeb5Syz155240 */ 4177ab25eeb5Syz155240 if (csump != NULL) { 4178ab25eeb5Syz155240 if (nat->nat_dir == NAT_OUTBOUND) 4179381a2a9aSdr146992 fix_incksum(csump, sumd); 4180ab25eeb5Syz155240 else 4181381a2a9aSdr146992 fix_outcksum(csump, sumd); 4182ab25eeb5Syz155240 } 4183f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_nat_stats.ns_mapped[0]); 4184ab25eeb5Syz155240 fin->fin_flx |= FI_NATED; 4185ab25eeb5Syz155240 if (np != NULL && np->in_tag.ipt_num[0] != 0) 4186ab25eeb5Syz155240 fin->fin_nattag = &np->in_tag; 4187ab25eeb5Syz155240 return 1; 4188ab25eeb5Syz155240 } 4189ab25eeb5Syz155240 4190ab25eeb5Syz155240 4191ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4192ab25eeb5Syz155240 /* Function: nat_proto */ 4193ab25eeb5Syz155240 /* Returns: u_short* - pointer to transport header checksum to update, */ 4194ab25eeb5Syz155240 /* NULL if the transport protocol is not recognised */ 4195ab25eeb5Syz155240 /* as needing a checksum update. */ 4196ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 4197ab25eeb5Syz155240 /* nat(I) - pointer to NAT structure */ 4198ab25eeb5Syz155240 /* nflags(I) - NAT flags set for this packet */ 4199ab25eeb5Syz155240 /* */ 4200ab25eeb5Syz155240 /* Return the pointer to the checksum field for each protocol so understood.*/ 4201ab25eeb5Syz155240 /* If support for making other changes to a protocol header is required, */ 4202ab25eeb5Syz155240 /* that is not strictly 'address' translation, such as clamping the MSS in */ 4203ab25eeb5Syz155240 /* TCP down to a specific value, then do it from here. */ 4204ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4205ab25eeb5Syz155240 u_short *nat_proto(fin, nat, nflags) 4206ab25eeb5Syz155240 fr_info_t *fin; 4207ab25eeb5Syz155240 nat_t *nat; 4208ab25eeb5Syz155240 u_int nflags; 4209ab25eeb5Syz155240 { 4210ab25eeb5Syz155240 icmphdr_t *icmp; 4211ab25eeb5Syz155240 u_short *csump; 4212ab25eeb5Syz155240 tcphdr_t *tcp; 4213ab25eeb5Syz155240 udphdr_t *udp; 4214ab25eeb5Syz155240 4215ab25eeb5Syz155240 csump = NULL; 4216ab25eeb5Syz155240 if (fin->fin_out == 0) { 4217ab25eeb5Syz155240 fin->fin_rev = (nat->nat_dir == NAT_OUTBOUND); 4218ab25eeb5Syz155240 } else { 4219ab25eeb5Syz155240 fin->fin_rev = (nat->nat_dir == NAT_INBOUND); 4220ab25eeb5Syz155240 } 4221ab25eeb5Syz155240 4222ab25eeb5Syz155240 switch (fin->fin_p) 4223ab25eeb5Syz155240 { 4224ab25eeb5Syz155240 case IPPROTO_TCP : 4225ab25eeb5Syz155240 tcp = fin->fin_dp; 4226ab25eeb5Syz155240 4227ab25eeb5Syz155240 csump = &tcp->th_sum; 4228ab25eeb5Syz155240 4229ab25eeb5Syz155240 /* 4230ab25eeb5Syz155240 * Do a MSS CLAMPING on a SYN packet, 4231ab25eeb5Syz155240 * only deal IPv4 for now. 4232ab25eeb5Syz155240 */ 4233ab25eeb5Syz155240 if ((nat->nat_mssclamp != 0) && (tcp->th_flags & TH_SYN) != 0) 4234381a2a9aSdr146992 nat_mssclamp(tcp, nat->nat_mssclamp, csump); 4235ab25eeb5Syz155240 4236ab25eeb5Syz155240 break; 4237ab25eeb5Syz155240 4238ab25eeb5Syz155240 case IPPROTO_UDP : 4239ab25eeb5Syz155240 udp = fin->fin_dp; 4240ab25eeb5Syz155240 4241ab25eeb5Syz155240 if (udp->uh_sum) 4242ab25eeb5Syz155240 csump = &udp->uh_sum; 4243ab25eeb5Syz155240 break; 4244ab25eeb5Syz155240 4245ab25eeb5Syz155240 case IPPROTO_ICMP : 4246ab25eeb5Syz155240 icmp = fin->fin_dp; 4247ab25eeb5Syz155240 4248ab25eeb5Syz155240 if ((nflags & IPN_ICMPQUERY) != 0) { 4249ab25eeb5Syz155240 if (icmp->icmp_cksum != 0) 4250ab25eeb5Syz155240 csump = &icmp->icmp_cksum; 4251ab25eeb5Syz155240 } 4252ab25eeb5Syz155240 break; 4253ab25eeb5Syz155240 } 4254ab25eeb5Syz155240 return csump; 4255ab25eeb5Syz155240 } 4256ab25eeb5Syz155240 4257ab25eeb5Syz155240 4258ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4259ab25eeb5Syz155240 /* Function: fr_natunload */ 4260ab25eeb5Syz155240 /* Returns: Nil */ 4261ab25eeb5Syz155240 /* Parameters: Nil */ 4262ab25eeb5Syz155240 /* */ 4263ab25eeb5Syz155240 /* Free all memory used by NAT structures allocated at runtime. */ 4264ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4265f4b3ec61Sdh155122 void fr_natunload(ifs) 4266f4b3ec61Sdh155122 ipf_stack_t *ifs; 4267ab25eeb5Syz155240 { 4268ab25eeb5Syz155240 ipftq_t *ifq, *ifqnext; 4269ab25eeb5Syz155240 4270f4b3ec61Sdh155122 (void) nat_clearlist(ifs); 4271f4b3ec61Sdh155122 (void) nat_flushtable(ifs); 4272ab25eeb5Syz155240 4273ab25eeb5Syz155240 /* 4274ab25eeb5Syz155240 * Proxy timeout queues are not cleaned here because although they 4275ab25eeb5Syz155240 * exist on the NAT list, appr_unload is called after fr_natunload 4276ab25eeb5Syz155240 * and the proxies actually are responsible for them being created. 4277ab25eeb5Syz155240 * Should the proxy timeouts have their own list? There's no real 4278ab25eeb5Syz155240 * justification as this is the only complication. 4279ab25eeb5Syz155240 */ 4280f4b3ec61Sdh155122 for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) { 4281ab25eeb5Syz155240 ifqnext = ifq->ifq_next; 4282ab25eeb5Syz155240 if (((ifq->ifq_flags & IFQF_PROXY) == 0) && 4283ab25eeb5Syz155240 (fr_deletetimeoutqueue(ifq) == 0)) 4284f4b3ec61Sdh155122 fr_freetimeoutqueue(ifq, ifs); 4285ab25eeb5Syz155240 } 4286ab25eeb5Syz155240 4287f4b3ec61Sdh155122 if (ifs->ifs_nat_table[0] != NULL) { 4288f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_table[0], 4289f4b3ec61Sdh155122 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 4290f4b3ec61Sdh155122 ifs->ifs_nat_table[0] = NULL; 4291ab25eeb5Syz155240 } 4292f4b3ec61Sdh155122 if (ifs->ifs_nat_table[1] != NULL) { 4293f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_table[1], 4294f4b3ec61Sdh155122 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 4295f4b3ec61Sdh155122 ifs->ifs_nat_table[1] = NULL; 4296ab25eeb5Syz155240 } 4297f4b3ec61Sdh155122 if (ifs->ifs_nat_rules != NULL) { 4298f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_rules, 4299f4b3ec61Sdh155122 sizeof(ipnat_t *) * ifs->ifs_ipf_natrules_sz); 4300f4b3ec61Sdh155122 ifs->ifs_nat_rules = NULL; 4301ab25eeb5Syz155240 } 4302f4b3ec61Sdh155122 if (ifs->ifs_rdr_rules != NULL) { 4303f4b3ec61Sdh155122 KFREES(ifs->ifs_rdr_rules, 4304f4b3ec61Sdh155122 sizeof(ipnat_t *) * ifs->ifs_ipf_rdrrules_sz); 4305f4b3ec61Sdh155122 ifs->ifs_rdr_rules = NULL; 4306ab25eeb5Syz155240 } 4307f4b3ec61Sdh155122 if (ifs->ifs_maptable != NULL) { 4308f4b3ec61Sdh155122 KFREES(ifs->ifs_maptable, 4309f4b3ec61Sdh155122 sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz); 4310f4b3ec61Sdh155122 ifs->ifs_maptable = NULL; 4311ab25eeb5Syz155240 } 4312f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[0] != NULL) { 4313f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_stats.ns_bucketlen[0], 4314f4b3ec61Sdh155122 sizeof(u_long *) * ifs->ifs_ipf_nattable_sz); 4315f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0] = NULL; 4316ab25eeb5Syz155240 } 4317f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[1] != NULL) { 4318f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_stats.ns_bucketlen[1], 4319f4b3ec61Sdh155122 sizeof(u_long *) * ifs->ifs_ipf_nattable_sz); 4320f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1] = NULL; 4321ab25eeb5Syz155240 } 4322ab25eeb5Syz155240 4323f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_maxbucket_reset == 1) 4324f4b3ec61Sdh155122 ifs->ifs_fr_nat_maxbucket = 0; 4325ab25eeb5Syz155240 4326f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_init == 1) { 4327f4b3ec61Sdh155122 ifs->ifs_fr_nat_init = 0; 4328f4b3ec61Sdh155122 fr_sttab_destroy(ifs->ifs_nat_tqb); 4329ab25eeb5Syz155240 4330f4b3ec61Sdh155122 RW_DESTROY(&ifs->ifs_ipf_natfrag); 4331f4b3ec61Sdh155122 RW_DESTROY(&ifs->ifs_ipf_nat); 4332ab25eeb5Syz155240 4333f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ipf_nat_new); 4334f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ipf_natio); 4335ab25eeb5Syz155240 4336f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_nat_udptq.ifq_lock); 4337f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_nat_icmptq.ifq_lock); 4338f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_nat_iptq.ifq_lock); 4339ab25eeb5Syz155240 } 4340ab25eeb5Syz155240 } 4341ab25eeb5Syz155240 4342ab25eeb5Syz155240 4343ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4344ab25eeb5Syz155240 /* Function: fr_natexpire */ 4345ab25eeb5Syz155240 /* Returns: Nil */ 4346ab25eeb5Syz155240 /* Parameters: Nil */ 4347ab25eeb5Syz155240 /* */ 4348ab25eeb5Syz155240 /* Check all of the timeout queues for entries at the top which need to be */ 4349ab25eeb5Syz155240 /* expired. */ 4350ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4351f4b3ec61Sdh155122 void fr_natexpire(ifs) 4352f4b3ec61Sdh155122 ipf_stack_t *ifs; 4353ab25eeb5Syz155240 { 4354ab25eeb5Syz155240 ipftq_t *ifq, *ifqnext; 4355ab25eeb5Syz155240 ipftqent_t *tqe, *tqn; 4356ab25eeb5Syz155240 int i; 4357ab25eeb5Syz155240 SPL_INT(s); 4358ab25eeb5Syz155240 4359ab25eeb5Syz155240 SPL_NET(s); 4360f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 4361f4b3ec61Sdh155122 for (ifq = ifs->ifs_nat_tqb, i = 0; ifq != NULL; ifq = ifq->ifq_next) { 4362ab25eeb5Syz155240 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) { 4363f4b3ec61Sdh155122 if (tqe->tqe_die > ifs->ifs_fr_ticks) 4364ab25eeb5Syz155240 break; 4365ab25eeb5Syz155240 tqn = tqe->tqe_next; 4366f4b3ec61Sdh155122 nat_delete(tqe->tqe_parent, NL_EXPIRE, ifs); 4367ab25eeb5Syz155240 } 4368ab25eeb5Syz155240 } 4369ab25eeb5Syz155240 4370f4b3ec61Sdh155122 for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) { 4371ab25eeb5Syz155240 ifqnext = ifq->ifq_next; 4372ab25eeb5Syz155240 4373ab25eeb5Syz155240 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) { 4374f4b3ec61Sdh155122 if (tqe->tqe_die > ifs->ifs_fr_ticks) 4375ab25eeb5Syz155240 break; 4376ab25eeb5Syz155240 tqn = tqe->tqe_next; 4377f4b3ec61Sdh155122 nat_delete(tqe->tqe_parent, NL_EXPIRE, ifs); 4378ab25eeb5Syz155240 } 4379ab25eeb5Syz155240 } 4380ab25eeb5Syz155240 4381f4b3ec61Sdh155122 for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) { 4382ab25eeb5Syz155240 ifqnext = ifq->ifq_next; 4383ab25eeb5Syz155240 4384ab25eeb5Syz155240 if (((ifq->ifq_flags & IFQF_DELETE) != 0) && 4385ab25eeb5Syz155240 (ifq->ifq_ref == 0)) { 4386f4b3ec61Sdh155122 fr_freetimeoutqueue(ifq, ifs); 4387ab25eeb5Syz155240 } 4388ab25eeb5Syz155240 } 4389ab25eeb5Syz155240 43903805c50fSan207044 if (ifs->ifs_nat_doflush != 0) { 43913805c50fSan207044 (void) nat_extraflush(2, ifs); 43923805c50fSan207044 ifs->ifs_nat_doflush = 0; 43933805c50fSan207044 } 43943805c50fSan207044 4395f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4396ab25eeb5Syz155240 SPL_X(s); 4397ab25eeb5Syz155240 } 4398ab25eeb5Syz155240 4399ab25eeb5Syz155240 4400ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4401381a2a9aSdr146992 /* Function: fr_nataddrsync */ 4402ab25eeb5Syz155240 /* Returns: Nil */ 4403ab25eeb5Syz155240 /* Parameters: ifp(I) - pointer to network interface */ 4404381a2a9aSdr146992 /* addr(I) - pointer to new network address */ 4405ab25eeb5Syz155240 /* */ 4406ab25eeb5Syz155240 /* Walk through all of the currently active NAT sessions, looking for those */ 4407381a2a9aSdr146992 /* which need to have their translated address updated (where the interface */ 4408381a2a9aSdr146992 /* matches the one passed in) and change it, recalculating the checksum sum */ 4409381a2a9aSdr146992 /* difference too. */ 4410ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4411f4b3ec61Sdh155122 void fr_nataddrsync(ifp, addr, ifs) 4412ab25eeb5Syz155240 void *ifp; 4413381a2a9aSdr146992 struct in_addr *addr; 4414f4b3ec61Sdh155122 ipf_stack_t *ifs; 4415ab25eeb5Syz155240 { 4416ab25eeb5Syz155240 u_32_t sum1, sum2, sumd; 4417ab25eeb5Syz155240 nat_t *nat; 4418381a2a9aSdr146992 ipnat_t *np; 4419ab25eeb5Syz155240 SPL_INT(s); 4420ab25eeb5Syz155240 4421f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) 4422ab25eeb5Syz155240 return; 4423ab25eeb5Syz155240 4424ab25eeb5Syz155240 SPL_NET(s); 4425f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 4426ab25eeb5Syz155240 4427f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) { 4428f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4429ab25eeb5Syz155240 return; 4430ab25eeb5Syz155240 } 4431ab25eeb5Syz155240 4432381a2a9aSdr146992 /* 4433381a2a9aSdr146992 * Change IP addresses for NAT sessions for any protocol except TCP 4434381a2a9aSdr146992 * since it will break the TCP connection anyway. The only rules 4435381a2a9aSdr146992 * which will get changed are those which are "map ... -> 0/32", 4436381a2a9aSdr146992 * where the rule specifies the address is taken from the interface. 4437381a2a9aSdr146992 */ 4438f4b3ec61Sdh155122 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4439381a2a9aSdr146992 if (addr != NULL) { 4440381a2a9aSdr146992 if (((ifp != NULL) && ifp != (nat->nat_ifps[0])) || 4441381a2a9aSdr146992 ((nat->nat_flags & IPN_TCP) != 0)) 4442ab25eeb5Syz155240 continue; 4443381a2a9aSdr146992 if (((np = nat->nat_ptr) == NULL) || 4444381a2a9aSdr146992 (np->in_nip || (np->in_outmsk != 0xffffffff))) 4445ab25eeb5Syz155240 continue; 4446ab25eeb5Syz155240 4447ab25eeb5Syz155240 /* 4448ab25eeb5Syz155240 * Change the map-to address to be the same as the 4449ab25eeb5Syz155240 * new one. 4450ab25eeb5Syz155240 */ 4451ab25eeb5Syz155240 sum1 = nat->nat_outip.s_addr; 4452381a2a9aSdr146992 nat->nat_outip = *addr; 4453381a2a9aSdr146992 sum2 = nat->nat_outip.s_addr; 4454381a2a9aSdr146992 4455381a2a9aSdr146992 } else if (((ifp == NULL) || (ifp == nat->nat_ifps[0])) && 4456381a2a9aSdr146992 !(nat->nat_flags & IPN_TCP) && (np = nat->nat_ptr) && 4457381a2a9aSdr146992 (np->in_outmsk == 0xffffffff) && !np->in_nip) { 4458381a2a9aSdr146992 struct in_addr in; 4459381a2a9aSdr146992 4460381a2a9aSdr146992 /* 4461381a2a9aSdr146992 * Change the map-to address to be the same as the 4462381a2a9aSdr146992 * new one. 4463381a2a9aSdr146992 */ 4464381a2a9aSdr146992 sum1 = nat->nat_outip.s_addr; 4465381a2a9aSdr146992 if (fr_ifpaddr(4, FRI_NORMAL, nat->nat_ifps[0], 4466f4b3ec61Sdh155122 &in, NULL, ifs) != -1) 4467ab25eeb5Syz155240 nat->nat_outip = in; 4468ab25eeb5Syz155240 sum2 = nat->nat_outip.s_addr; 4469381a2a9aSdr146992 } else { 4470381a2a9aSdr146992 continue; 4471381a2a9aSdr146992 } 4472ab25eeb5Syz155240 4473ab25eeb5Syz155240 if (sum1 == sum2) 4474ab25eeb5Syz155240 continue; 4475ab25eeb5Syz155240 /* 4476ab25eeb5Syz155240 * Readjust the checksum adjustment to take into 4477ab25eeb5Syz155240 * account the new IP#. 4478ab25eeb5Syz155240 */ 4479ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 4480ab25eeb5Syz155240 /* XXX - dont change for TCP when solaris does 4481ab25eeb5Syz155240 * hardware checksumming. 4482ab25eeb5Syz155240 */ 4483ab25eeb5Syz155240 sumd += nat->nat_sumd[0]; 4484ab25eeb5Syz155240 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 4485ab25eeb5Syz155240 nat->nat_sumd[1] = nat->nat_sumd[0]; 4486ab25eeb5Syz155240 } 4487381a2a9aSdr146992 4488f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4489381a2a9aSdr146992 SPL_X(s); 4490381a2a9aSdr146992 } 4491381a2a9aSdr146992 4492381a2a9aSdr146992 4493381a2a9aSdr146992 /* ------------------------------------------------------------------------ */ 4494381a2a9aSdr146992 /* Function: fr_natifpsync */ 4495381a2a9aSdr146992 /* Returns: Nil */ 4496381a2a9aSdr146992 /* Parameters: action(I) - how we are syncing */ 4497381a2a9aSdr146992 /* ifp(I) - pointer to network interface */ 4498381a2a9aSdr146992 /* name(I) - name of interface to sync to */ 4499381a2a9aSdr146992 /* */ 4500381a2a9aSdr146992 /* This function is used to resync the mapping of interface names and their */ 4501381a2a9aSdr146992 /* respective 'pointers'. For "action == IPFSYNC_RESYNC", resync all */ 4502381a2a9aSdr146992 /* interfaces by doing a new lookup of name to 'pointer'. For "action == */ 4503381a2a9aSdr146992 /* IPFSYNC_NEWIFP", treat ifp as the new pointer value associated with */ 4504381a2a9aSdr146992 /* "name" and for "action == IPFSYNC_OLDIFP", ifp is a pointer for which */ 4505381a2a9aSdr146992 /* there is no longer any interface associated with it. */ 4506381a2a9aSdr146992 /* ------------------------------------------------------------------------ */ 4507f4b3ec61Sdh155122 void fr_natifpsync(action, ifp, name, ifs) 4508381a2a9aSdr146992 int action; 4509381a2a9aSdr146992 void *ifp; 4510381a2a9aSdr146992 char *name; 4511f4b3ec61Sdh155122 ipf_stack_t *ifs; 4512381a2a9aSdr146992 { 4513381a2a9aSdr146992 #if defined(_KERNEL) && !defined(MENTAT) && defined(USE_SPL) 4514381a2a9aSdr146992 int s; 4515381a2a9aSdr146992 #endif 4516381a2a9aSdr146992 nat_t *nat; 4517381a2a9aSdr146992 ipnat_t *n; 4518381a2a9aSdr146992 4519f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) 4520381a2a9aSdr146992 return; 4521381a2a9aSdr146992 4522381a2a9aSdr146992 SPL_NET(s); 4523f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 4524381a2a9aSdr146992 4525f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) { 4526f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4527381a2a9aSdr146992 return; 4528381a2a9aSdr146992 } 4529381a2a9aSdr146992 4530381a2a9aSdr146992 switch (action) 4531381a2a9aSdr146992 { 4532381a2a9aSdr146992 case IPFSYNC_RESYNC : 4533f4b3ec61Sdh155122 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4534381a2a9aSdr146992 if ((ifp == nat->nat_ifps[0]) || 4535381a2a9aSdr146992 (nat->nat_ifps[0] == (void *)-1)) { 4536381a2a9aSdr146992 nat->nat_ifps[0] = 4537f4b3ec61Sdh155122 fr_resolvenic(nat->nat_ifnames[0], 4, ifs); 4538381a2a9aSdr146992 } 4539381a2a9aSdr146992 4540381a2a9aSdr146992 if ((ifp == nat->nat_ifps[1]) || 4541381a2a9aSdr146992 (nat->nat_ifps[1] == (void *)-1)) { 4542381a2a9aSdr146992 nat->nat_ifps[1] = 4543f4b3ec61Sdh155122 fr_resolvenic(nat->nat_ifnames[1], 4, ifs); 4544381a2a9aSdr146992 } 4545ab25eeb5Syz155240 } 4546ab25eeb5Syz155240 4547f4b3ec61Sdh155122 for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) { 4548381a2a9aSdr146992 if (n->in_ifps[0] == ifp || 4549381a2a9aSdr146992 n->in_ifps[0] == (void *)-1) { 4550381a2a9aSdr146992 n->in_ifps[0] = 4551f4b3ec61Sdh155122 fr_resolvenic(n->in_ifnames[0], 4, ifs); 4552381a2a9aSdr146992 } 4553381a2a9aSdr146992 if (n->in_ifps[1] == ifp || 4554381a2a9aSdr146992 n->in_ifps[1] == (void *)-1) { 4555381a2a9aSdr146992 n->in_ifps[1] = 4556f4b3ec61Sdh155122 fr_resolvenic(n->in_ifnames[1], 4, ifs); 4557381a2a9aSdr146992 } 4558381a2a9aSdr146992 } 4559381a2a9aSdr146992 break; 4560381a2a9aSdr146992 case IPFSYNC_NEWIFP : 4561f4b3ec61Sdh155122 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4562381a2a9aSdr146992 if (!strncmp(name, nat->nat_ifnames[0], 4563381a2a9aSdr146992 sizeof(nat->nat_ifnames[0]))) 4564381a2a9aSdr146992 nat->nat_ifps[0] = ifp; 4565381a2a9aSdr146992 if (!strncmp(name, nat->nat_ifnames[1], 4566381a2a9aSdr146992 sizeof(nat->nat_ifnames[1]))) 4567381a2a9aSdr146992 nat->nat_ifps[1] = ifp; 4568381a2a9aSdr146992 } 4569f4b3ec61Sdh155122 for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) { 4570381a2a9aSdr146992 if (!strncmp(name, n->in_ifnames[0], 4571381a2a9aSdr146992 sizeof(n->in_ifnames[0]))) 4572381a2a9aSdr146992 n->in_ifps[0] = ifp; 4573381a2a9aSdr146992 if (!strncmp(name, n->in_ifnames[1], 4574381a2a9aSdr146992 sizeof(n->in_ifnames[1]))) 4575381a2a9aSdr146992 n->in_ifps[1] = ifp; 4576381a2a9aSdr146992 } 4577381a2a9aSdr146992 break; 4578381a2a9aSdr146992 case IPFSYNC_OLDIFP : 4579f4b3ec61Sdh155122 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4580381a2a9aSdr146992 if (ifp == nat->nat_ifps[0]) 4581381a2a9aSdr146992 nat->nat_ifps[0] = (void *)-1; 4582381a2a9aSdr146992 if (ifp == nat->nat_ifps[1]) 4583381a2a9aSdr146992 nat->nat_ifps[1] = (void *)-1; 4584381a2a9aSdr146992 } 4585f4b3ec61Sdh155122 for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) { 4586381a2a9aSdr146992 if (n->in_ifps[0] == ifp) 4587381a2a9aSdr146992 n->in_ifps[0] = (void *)-1; 4588381a2a9aSdr146992 if (n->in_ifps[1] == ifp) 4589381a2a9aSdr146992 n->in_ifps[1] = (void *)-1; 4590381a2a9aSdr146992 } 4591381a2a9aSdr146992 break; 4592ab25eeb5Syz155240 } 4593f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4594ab25eeb5Syz155240 SPL_X(s); 4595ab25eeb5Syz155240 } 4596ab25eeb5Syz155240 4597ab25eeb5Syz155240 4598ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4599ab25eeb5Syz155240 /* Function: nat_icmpquerytype4 */ 4600ab25eeb5Syz155240 /* Returns: int - 1 == success, 0 == failure */ 4601ab25eeb5Syz155240 /* Parameters: icmptype(I) - ICMP type number */ 4602ab25eeb5Syz155240 /* */ 4603ab25eeb5Syz155240 /* Tests to see if the ICMP type number passed is a query/response type or */ 4604ab25eeb5Syz155240 /* not. */ 4605ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4606ab25eeb5Syz155240 static INLINE int nat_icmpquerytype4(icmptype) 4607ab25eeb5Syz155240 int icmptype; 4608ab25eeb5Syz155240 { 4609ab25eeb5Syz155240 4610ab25eeb5Syz155240 /* 4611ab25eeb5Syz155240 * For the ICMP query NAT code, it is essential that both the query 4612ab25eeb5Syz155240 * and the reply match on the NAT rule. Because the NAT structure 4613ab25eeb5Syz155240 * does not keep track of the icmptype, and a single NAT structure 4614ab25eeb5Syz155240 * is used for all icmp types with the same src, dest and id, we 4615ab25eeb5Syz155240 * simply define the replies as queries as well. The funny thing is, 4616ab25eeb5Syz155240 * altough it seems silly to call a reply a query, this is exactly 4617ab25eeb5Syz155240 * as it is defined in the IPv4 specification 4618ab25eeb5Syz155240 */ 4619ab25eeb5Syz155240 4620ab25eeb5Syz155240 switch (icmptype) 4621ab25eeb5Syz155240 { 4622ab25eeb5Syz155240 4623ab25eeb5Syz155240 case ICMP_ECHOREPLY: 4624ab25eeb5Syz155240 case ICMP_ECHO: 4625ab25eeb5Syz155240 /* route aedvertisement/solliciation is currently unsupported: */ 4626ab25eeb5Syz155240 /* it would require rewriting the ICMP data section */ 4627ab25eeb5Syz155240 case ICMP_TSTAMP: 4628ab25eeb5Syz155240 case ICMP_TSTAMPREPLY: 4629ab25eeb5Syz155240 case ICMP_IREQ: 4630ab25eeb5Syz155240 case ICMP_IREQREPLY: 4631ab25eeb5Syz155240 case ICMP_MASKREQ: 4632ab25eeb5Syz155240 case ICMP_MASKREPLY: 4633ab25eeb5Syz155240 return 1; 4634ab25eeb5Syz155240 default: 4635ab25eeb5Syz155240 return 0; 4636ab25eeb5Syz155240 } 4637ab25eeb5Syz155240 } 4638ab25eeb5Syz155240 4639ab25eeb5Syz155240 4640ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4641ab25eeb5Syz155240 /* Function: nat_log */ 4642ab25eeb5Syz155240 /* Returns: Nil */ 4643ab25eeb5Syz155240 /* Parameters: nat(I) - pointer to NAT structure */ 4644ab25eeb5Syz155240 /* type(I) - type of log entry to create */ 4645ab25eeb5Syz155240 /* */ 4646ab25eeb5Syz155240 /* Creates a NAT log entry. */ 4647ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4648f4b3ec61Sdh155122 void nat_log(nat, type, ifs) 4649ab25eeb5Syz155240 struct nat *nat; 4650ab25eeb5Syz155240 u_int type; 4651f4b3ec61Sdh155122 ipf_stack_t *ifs; 4652ab25eeb5Syz155240 { 4653ab25eeb5Syz155240 #ifdef IPFILTER_LOG 4654ab25eeb5Syz155240 # ifndef LARGE_NAT 4655ab25eeb5Syz155240 struct ipnat *np; 4656ab25eeb5Syz155240 int rulen; 4657ab25eeb5Syz155240 # endif 4658ab25eeb5Syz155240 struct natlog natl; 4659ab25eeb5Syz155240 void *items[1]; 4660ab25eeb5Syz155240 size_t sizes[1]; 4661ab25eeb5Syz155240 int types[1]; 4662ab25eeb5Syz155240 4663ab25eeb5Syz155240 natl.nl_inip = nat->nat_inip; 4664ab25eeb5Syz155240 natl.nl_outip = nat->nat_outip; 4665ab25eeb5Syz155240 natl.nl_origip = nat->nat_oip; 4666ab25eeb5Syz155240 natl.nl_bytes[0] = nat->nat_bytes[0]; 4667ab25eeb5Syz155240 natl.nl_bytes[1] = nat->nat_bytes[1]; 4668ab25eeb5Syz155240 natl.nl_pkts[0] = nat->nat_pkts[0]; 4669ab25eeb5Syz155240 natl.nl_pkts[1] = nat->nat_pkts[1]; 4670ab25eeb5Syz155240 natl.nl_origport = nat->nat_oport; 4671ab25eeb5Syz155240 natl.nl_inport = nat->nat_inport; 4672ab25eeb5Syz155240 natl.nl_outport = nat->nat_outport; 4673ab25eeb5Syz155240 natl.nl_p = nat->nat_p; 4674ab25eeb5Syz155240 natl.nl_type = type; 4675ab25eeb5Syz155240 natl.nl_rule = -1; 4676ab25eeb5Syz155240 # ifndef LARGE_NAT 4677ab25eeb5Syz155240 if (nat->nat_ptr != NULL) { 4678f4b3ec61Sdh155122 for (rulen = 0, np = ifs->ifs_nat_list; np; 4679f4b3ec61Sdh155122 np = np->in_next, rulen++) 4680ab25eeb5Syz155240 if (np == nat->nat_ptr) { 4681ab25eeb5Syz155240 natl.nl_rule = rulen; 4682ab25eeb5Syz155240 break; 4683ab25eeb5Syz155240 } 4684ab25eeb5Syz155240 } 4685ab25eeb5Syz155240 # endif 4686ab25eeb5Syz155240 items[0] = &natl; 4687ab25eeb5Syz155240 sizes[0] = sizeof(natl); 4688ab25eeb5Syz155240 types[0] = 0; 4689ab25eeb5Syz155240 4690f4b3ec61Sdh155122 (void) ipllog(IPL_LOGNAT, NULL, items, sizes, types, 1, ifs); 4691ab25eeb5Syz155240 #endif 4692ab25eeb5Syz155240 } 4693ab25eeb5Syz155240 4694ab25eeb5Syz155240 4695ab25eeb5Syz155240 #if defined(__OpenBSD__) 4696ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4697ab25eeb5Syz155240 /* Function: nat_ifdetach */ 4698ab25eeb5Syz155240 /* Returns: Nil */ 4699ab25eeb5Syz155240 /* Parameters: ifp(I) - pointer to network interface */ 4700ab25eeb5Syz155240 /* */ 4701ab25eeb5Syz155240 /* Compatibility interface for OpenBSD to trigger the correct updating of */ 4702ab25eeb5Syz155240 /* interface references within IPFilter. */ 4703ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4704f4b3ec61Sdh155122 void nat_ifdetach(ifp, ifs) 4705ab25eeb5Syz155240 void *ifp; 4706f4b3ec61Sdh155122 ipf_stack_t *ifs; 4707ab25eeb5Syz155240 { 4708f4b3ec61Sdh155122 frsync(ifp, ifs); 4709ab25eeb5Syz155240 return; 4710ab25eeb5Syz155240 } 4711ab25eeb5Syz155240 #endif 4712ab25eeb5Syz155240 4713ab25eeb5Syz155240 4714ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4715f4b3ec61Sdh155122 /* Function: fr_ipnatderef */ 4716f4b3ec61Sdh155122 /* Returns: Nil */ 4717f4b3ec61Sdh155122 /* Parameters: isp(I) - pointer to pointer to NAT rule */ 4718f4b3ec61Sdh155122 /* Write Locks: ipf_nat */ 4719f4b3ec61Sdh155122 /* */ 4720f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 4721f4b3ec61Sdh155122 void fr_ipnatderef(inp, ifs) 4722f4b3ec61Sdh155122 ipnat_t **inp; 4723f4b3ec61Sdh155122 ipf_stack_t *ifs; 4724f4b3ec61Sdh155122 { 4725f4b3ec61Sdh155122 ipnat_t *in; 4726f4b3ec61Sdh155122 4727f4b3ec61Sdh155122 in = *inp; 4728f4b3ec61Sdh155122 *inp = NULL; 4729f4b3ec61Sdh155122 in->in_space++; 4730f4b3ec61Sdh155122 in->in_use--; 4731f4b3ec61Sdh155122 if (in->in_use == 0 && (in->in_flags & IPN_DELETE)) { 4732f4b3ec61Sdh155122 if (in->in_apr) 4733f4b3ec61Sdh155122 appr_free(in->in_apr); 4734f4b3ec61Sdh155122 KFREE(in); 4735f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules--; 4736f4b3ec61Sdh155122 #ifdef notdef 4737f4b3ec61Sdh155122 #if SOLARIS 4738f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_rules == 0) 4739f4b3ec61Sdh155122 ifs->ifs_pfil_delayed_copy = 1; 4740f4b3ec61Sdh155122 #endif 4741f4b3ec61Sdh155122 #endif 4742f4b3ec61Sdh155122 } 4743f4b3ec61Sdh155122 } 4744f4b3ec61Sdh155122 4745f4b3ec61Sdh155122 4746f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 4747ab25eeb5Syz155240 /* Function: fr_natderef */ 4748ab25eeb5Syz155240 /* Returns: Nil */ 4749ab25eeb5Syz155240 /* Parameters: isp(I) - pointer to pointer to NAT table entry */ 4750ab25eeb5Syz155240 /* */ 4751ab25eeb5Syz155240 /* Decrement the reference counter for this NAT table entry and free it if */ 4752ab25eeb5Syz155240 /* there are no more things using it. */ 4753*0e01ff8bSdr146992 /* */ 4754*0e01ff8bSdr146992 /* IF nat_ref == 1 when this function is called, then we have an orphan nat */ 4755*0e01ff8bSdr146992 /* structure *because* it only gets called on paths _after_ nat_ref has been*/ 4756*0e01ff8bSdr146992 /* incremented. If nat_ref == 1 then we shouldn't decrement it here */ 4757*0e01ff8bSdr146992 /* because nat_delete() will do that and send nat_ref to -1. */ 4758*0e01ff8bSdr146992 /* */ 4759*0e01ff8bSdr146992 /* Holding the lock on nat_lock is required to serialise nat_delete() being */ 4760*0e01ff8bSdr146992 /* called from a NAT flush ioctl with a deref happening because of a packet.*/ 4761ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4762f4b3ec61Sdh155122 void fr_natderef(natp, ifs) 4763ab25eeb5Syz155240 nat_t **natp; 4764f4b3ec61Sdh155122 ipf_stack_t *ifs; 4765ab25eeb5Syz155240 { 4766ab25eeb5Syz155240 nat_t *nat; 4767ab25eeb5Syz155240 4768ab25eeb5Syz155240 nat = *natp; 4769ab25eeb5Syz155240 *natp = NULL; 4770*0e01ff8bSdr146992 4771*0e01ff8bSdr146992 MUTEX_ENTER(&nat->nat_lock); 4772*0e01ff8bSdr146992 if (nat->nat_ref > 1) { 4773ab25eeb5Syz155240 nat->nat_ref--; 4774*0e01ff8bSdr146992 MUTEX_EXIT(&nat->nat_lock); 4775*0e01ff8bSdr146992 return; 4776*0e01ff8bSdr146992 } 4777*0e01ff8bSdr146992 MUTEX_EXIT(&nat->nat_lock); 4778*0e01ff8bSdr146992 4779*0e01ff8bSdr146992 WRITE_ENTER(&ifs->ifs_ipf_nat); 4780f4b3ec61Sdh155122 nat_delete(nat, NL_EXPIRE, ifs); 4781f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4782ab25eeb5Syz155240 } 4783ab25eeb5Syz155240 4784ab25eeb5Syz155240 4785ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4786ab25eeb5Syz155240 /* Function: fr_natclone */ 4787ab25eeb5Syz155240 /* Returns: ipstate_t* - NULL == cloning failed, */ 4788ab25eeb5Syz155240 /* else pointer to new state structure */ 4789ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 4790ab25eeb5Syz155240 /* is(I) - pointer to master state structure */ 4791ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 4792ab25eeb5Syz155240 /* */ 4793ab25eeb5Syz155240 /* Create a "duplcate" state table entry from the master. */ 4794ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4795ab25eeb5Syz155240 static nat_t *fr_natclone(fin, nat) 4796ab25eeb5Syz155240 fr_info_t *fin; 4797ab25eeb5Syz155240 nat_t *nat; 4798ab25eeb5Syz155240 { 4799ab25eeb5Syz155240 frentry_t *fr; 4800ab25eeb5Syz155240 nat_t *clone; 4801ab25eeb5Syz155240 ipnat_t *np; 4802f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 4803ab25eeb5Syz155240 4804ab25eeb5Syz155240 KMALLOC(clone, nat_t *); 4805ab25eeb5Syz155240 if (clone == NULL) 4806ab25eeb5Syz155240 return NULL; 4807ab25eeb5Syz155240 bcopy((char *)nat, (char *)clone, sizeof(*clone)); 4808ab25eeb5Syz155240 4809ab25eeb5Syz155240 MUTEX_NUKE(&clone->nat_lock); 4810ab25eeb5Syz155240 4811ab25eeb5Syz155240 clone->nat_aps = NULL; 4812ab25eeb5Syz155240 /* 4813ab25eeb5Syz155240 * Initialize all these so that nat_delete() doesn't cause a crash. 4814ab25eeb5Syz155240 */ 4815ab25eeb5Syz155240 clone->nat_tqe.tqe_pnext = NULL; 4816ab25eeb5Syz155240 clone->nat_tqe.tqe_next = NULL; 4817ab25eeb5Syz155240 clone->nat_tqe.tqe_ifq = NULL; 4818ab25eeb5Syz155240 clone->nat_tqe.tqe_parent = clone; 4819ab25eeb5Syz155240 4820ab25eeb5Syz155240 clone->nat_flags &= ~SI_CLONE; 4821ab25eeb5Syz155240 clone->nat_flags |= SI_CLONED; 4822ab25eeb5Syz155240 4823ab25eeb5Syz155240 if (clone->nat_hm) 4824ab25eeb5Syz155240 clone->nat_hm->hm_ref++; 4825ab25eeb5Syz155240 4826f4b3ec61Sdh155122 if (nat_insert(clone, fin->fin_rev, ifs) == -1) { 4827ab25eeb5Syz155240 KFREE(clone); 4828ab25eeb5Syz155240 return NULL; 4829ab25eeb5Syz155240 } 4830ab25eeb5Syz155240 np = clone->nat_ptr; 4831ab25eeb5Syz155240 if (np != NULL) { 4832f4b3ec61Sdh155122 if (ifs->ifs_nat_logging) 4833f4b3ec61Sdh155122 nat_log(clone, (u_int)np->in_redir, ifs); 4834ab25eeb5Syz155240 np->in_use++; 4835ab25eeb5Syz155240 } 4836ab25eeb5Syz155240 fr = clone->nat_fr; 4837ab25eeb5Syz155240 if (fr != NULL) { 4838ab25eeb5Syz155240 MUTEX_ENTER(&fr->fr_lock); 4839ab25eeb5Syz155240 fr->fr_ref++; 4840ab25eeb5Syz155240 MUTEX_EXIT(&fr->fr_lock); 4841ab25eeb5Syz155240 } 4842ab25eeb5Syz155240 4843ab25eeb5Syz155240 /* 4844ab25eeb5Syz155240 * Because the clone is created outside the normal loop of things and 4845ab25eeb5Syz155240 * TCP has special needs in terms of state, initialise the timeout 4846ab25eeb5Syz155240 * state of the new NAT from here. 4847ab25eeb5Syz155240 */ 4848ab25eeb5Syz155240 if (clone->nat_p == IPPROTO_TCP) { 4849f4b3ec61Sdh155122 (void) fr_tcp_age(&clone->nat_tqe, fin, ifs->ifs_nat_tqb, 4850ab25eeb5Syz155240 clone->nat_flags); 4851ab25eeb5Syz155240 } 4852ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 4853ab25eeb5Syz155240 clone->nat_sync = ipfsync_new(SMC_NAT, fin, clone); 4854ab25eeb5Syz155240 #endif 4855f4b3ec61Sdh155122 if (ifs->ifs_nat_logging) 4856f4b3ec61Sdh155122 nat_log(clone, NL_CLONE, ifs); 4857ab25eeb5Syz155240 return clone; 4858ab25eeb5Syz155240 } 4859ab25eeb5Syz155240 4860ab25eeb5Syz155240 4861ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4862ab25eeb5Syz155240 /* Function: nat_wildok */ 4863ab25eeb5Syz155240 /* Returns: int - 1 == packet's ports match wildcards */ 4864ab25eeb5Syz155240 /* 0 == packet's ports don't match wildcards */ 4865ab25eeb5Syz155240 /* Parameters: nat(I) - NAT entry */ 4866ab25eeb5Syz155240 /* sport(I) - source port */ 4867ab25eeb5Syz155240 /* dport(I) - destination port */ 4868ab25eeb5Syz155240 /* flags(I) - wildcard flags */ 4869ab25eeb5Syz155240 /* dir(I) - packet direction */ 4870ab25eeb5Syz155240 /* */ 4871ab25eeb5Syz155240 /* Use NAT entry and packet direction to determine which combination of */ 4872ab25eeb5Syz155240 /* wildcard flags should be used. */ 4873ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4874ab25eeb5Syz155240 static INLINE int nat_wildok(nat, sport, dport, flags, dir) 4875ab25eeb5Syz155240 nat_t *nat; 4876ab25eeb5Syz155240 int sport; 4877ab25eeb5Syz155240 int dport; 4878ab25eeb5Syz155240 int flags; 4879ab25eeb5Syz155240 int dir; 4880ab25eeb5Syz155240 { 4881ab25eeb5Syz155240 /* 4882ab25eeb5Syz155240 * When called by dir is set to 4883ab25eeb5Syz155240 * nat_inlookup NAT_INBOUND (0) 4884ab25eeb5Syz155240 * nat_outlookup NAT_OUTBOUND (1) 4885ab25eeb5Syz155240 * 4886ab25eeb5Syz155240 * We simply combine the packet's direction in dir with the original 4887ab25eeb5Syz155240 * "intended" direction of that NAT entry in nat->nat_dir to decide 4888ab25eeb5Syz155240 * which combination of wildcard flags to allow. 4889ab25eeb5Syz155240 */ 4890ab25eeb5Syz155240 4891ab25eeb5Syz155240 switch ((dir << 1) | nat->nat_dir) 4892ab25eeb5Syz155240 { 4893ab25eeb5Syz155240 case 3: /* outbound packet / outbound entry */ 4894ab25eeb5Syz155240 if (((nat->nat_inport == sport) || 4895ab25eeb5Syz155240 (flags & SI_W_SPORT)) && 4896ab25eeb5Syz155240 ((nat->nat_oport == dport) || 4897ab25eeb5Syz155240 (flags & SI_W_DPORT))) 4898ab25eeb5Syz155240 return 1; 4899ab25eeb5Syz155240 break; 4900ab25eeb5Syz155240 case 2: /* outbound packet / inbound entry */ 4901ab25eeb5Syz155240 if (((nat->nat_outport == sport) || 4902ab25eeb5Syz155240 (flags & SI_W_DPORT)) && 4903ab25eeb5Syz155240 ((nat->nat_oport == dport) || 4904ab25eeb5Syz155240 (flags & SI_W_SPORT))) 4905ab25eeb5Syz155240 return 1; 4906ab25eeb5Syz155240 break; 4907ab25eeb5Syz155240 case 1: /* inbound packet / outbound entry */ 4908ab25eeb5Syz155240 if (((nat->nat_oport == sport) || 4909ab25eeb5Syz155240 (flags & SI_W_DPORT)) && 4910ab25eeb5Syz155240 ((nat->nat_outport == dport) || 4911ab25eeb5Syz155240 (flags & SI_W_SPORT))) 4912ab25eeb5Syz155240 return 1; 4913ab25eeb5Syz155240 break; 4914ab25eeb5Syz155240 case 0: /* inbound packet / inbound entry */ 4915ab25eeb5Syz155240 if (((nat->nat_oport == sport) || 4916ab25eeb5Syz155240 (flags & SI_W_SPORT)) && 4917ab25eeb5Syz155240 ((nat->nat_outport == dport) || 4918ab25eeb5Syz155240 (flags & SI_W_DPORT))) 4919ab25eeb5Syz155240 return 1; 4920ab25eeb5Syz155240 break; 4921ab25eeb5Syz155240 default: 4922ab25eeb5Syz155240 break; 4923ab25eeb5Syz155240 } 4924ab25eeb5Syz155240 4925ab25eeb5Syz155240 return(0); 4926ab25eeb5Syz155240 } 4927ab25eeb5Syz155240 4928ab25eeb5Syz155240 4929ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4930ab25eeb5Syz155240 /* Function: nat_mssclamp */ 4931ab25eeb5Syz155240 /* Returns: Nil */ 4932ab25eeb5Syz155240 /* Parameters: tcp(I) - pointer to TCP header */ 4933ab25eeb5Syz155240 /* maxmss(I) - value to clamp the TCP MSS to */ 4934ab25eeb5Syz155240 /* csump(I) - pointer to TCP checksum */ 4935ab25eeb5Syz155240 /* */ 4936ab25eeb5Syz155240 /* Check for MSS option and clamp it if necessary. If found and changed, */ 4937ab25eeb5Syz155240 /* then the TCP header checksum will be updated to reflect the change in */ 4938ab25eeb5Syz155240 /* the MSS. */ 4939ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4940381a2a9aSdr146992 static void nat_mssclamp(tcp, maxmss, csump) 4941ab25eeb5Syz155240 tcphdr_t *tcp; 4942ab25eeb5Syz155240 u_32_t maxmss; 4943ab25eeb5Syz155240 u_short *csump; 4944ab25eeb5Syz155240 { 4945ab25eeb5Syz155240 u_char *cp, *ep, opt; 4946ab25eeb5Syz155240 int hlen, advance; 4947ab25eeb5Syz155240 u_32_t mss, sumd; 4948ab25eeb5Syz155240 4949ab25eeb5Syz155240 hlen = TCP_OFF(tcp) << 2; 4950ab25eeb5Syz155240 if (hlen > sizeof(*tcp)) { 4951ab25eeb5Syz155240 cp = (u_char *)tcp + sizeof(*tcp); 4952ab25eeb5Syz155240 ep = (u_char *)tcp + hlen; 4953ab25eeb5Syz155240 4954ab25eeb5Syz155240 while (cp < ep) { 4955ab25eeb5Syz155240 opt = cp[0]; 4956ab25eeb5Syz155240 if (opt == TCPOPT_EOL) 4957ab25eeb5Syz155240 break; 4958ab25eeb5Syz155240 else if (opt == TCPOPT_NOP) { 4959ab25eeb5Syz155240 cp++; 4960ab25eeb5Syz155240 continue; 4961ab25eeb5Syz155240 } 4962ab25eeb5Syz155240 4963ab25eeb5Syz155240 if (cp + 1 >= ep) 4964ab25eeb5Syz155240 break; 4965ab25eeb5Syz155240 advance = cp[1]; 4966ab25eeb5Syz155240 if ((cp + advance > ep) || (advance <= 0)) 4967ab25eeb5Syz155240 break; 4968ab25eeb5Syz155240 switch (opt) 4969ab25eeb5Syz155240 { 4970ab25eeb5Syz155240 case TCPOPT_MAXSEG: 4971ab25eeb5Syz155240 if (advance != 4) 4972ab25eeb5Syz155240 break; 4973ab25eeb5Syz155240 mss = cp[2] * 256 + cp[3]; 4974ab25eeb5Syz155240 if (mss > maxmss) { 4975ab25eeb5Syz155240 cp[2] = maxmss / 256; 4976ab25eeb5Syz155240 cp[3] = maxmss & 0xff; 4977ab25eeb5Syz155240 CALC_SUMD(mss, maxmss, sumd); 4978381a2a9aSdr146992 fix_outcksum(csump, sumd); 4979ab25eeb5Syz155240 } 4980ab25eeb5Syz155240 break; 4981ab25eeb5Syz155240 default: 4982ab25eeb5Syz155240 /* ignore unknown options */ 4983ab25eeb5Syz155240 break; 4984ab25eeb5Syz155240 } 4985ab25eeb5Syz155240 4986ab25eeb5Syz155240 cp += advance; 4987ab25eeb5Syz155240 } 4988ab25eeb5Syz155240 } 4989ab25eeb5Syz155240 } 4990ab25eeb5Syz155240 4991ab25eeb5Syz155240 4992ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4993ab25eeb5Syz155240 /* Function: fr_setnatqueue */ 4994ab25eeb5Syz155240 /* Returns: Nil */ 4995ab25eeb5Syz155240 /* Parameters: nat(I)- pointer to NAT structure */ 4996ab25eeb5Syz155240 /* rev(I) - forward(0) or reverse(1) direction */ 4997ab25eeb5Syz155240 /* Locks: ipf_nat (read or write) */ 4998ab25eeb5Syz155240 /* */ 4999ab25eeb5Syz155240 /* Put the NAT entry on its default queue entry, using rev as a helped in */ 5000ab25eeb5Syz155240 /* determining which queue it should be placed on. */ 5001ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 5002f4b3ec61Sdh155122 void fr_setnatqueue(nat, rev, ifs) 5003ab25eeb5Syz155240 nat_t *nat; 5004ab25eeb5Syz155240 int rev; 5005f4b3ec61Sdh155122 ipf_stack_t *ifs; 5006ab25eeb5Syz155240 { 5007ab25eeb5Syz155240 ipftq_t *oifq, *nifq; 5008ab25eeb5Syz155240 5009ab25eeb5Syz155240 if (nat->nat_ptr != NULL) 5010ab25eeb5Syz155240 nifq = nat->nat_ptr->in_tqehead[rev]; 5011ab25eeb5Syz155240 else 5012ab25eeb5Syz155240 nifq = NULL; 5013ab25eeb5Syz155240 5014ab25eeb5Syz155240 if (nifq == NULL) { 5015ab25eeb5Syz155240 switch (nat->nat_p) 5016ab25eeb5Syz155240 { 5017ab25eeb5Syz155240 case IPPROTO_UDP : 5018f4b3ec61Sdh155122 nifq = &ifs->ifs_nat_udptq; 5019ab25eeb5Syz155240 break; 5020ab25eeb5Syz155240 case IPPROTO_ICMP : 5021f4b3ec61Sdh155122 nifq = &ifs->ifs_nat_icmptq; 5022ab25eeb5Syz155240 break; 5023ab25eeb5Syz155240 case IPPROTO_TCP : 5024f4b3ec61Sdh155122 nifq = ifs->ifs_nat_tqb + nat->nat_tqe.tqe_state[rev]; 5025ab25eeb5Syz155240 break; 5026ab25eeb5Syz155240 default : 5027f4b3ec61Sdh155122 nifq = &ifs->ifs_nat_iptq; 5028ab25eeb5Syz155240 break; 5029ab25eeb5Syz155240 } 5030ab25eeb5Syz155240 } 5031ab25eeb5Syz155240 5032ab25eeb5Syz155240 oifq = nat->nat_tqe.tqe_ifq; 5033ab25eeb5Syz155240 /* 5034ab25eeb5Syz155240 * If it's currently on a timeout queue, move it from one queue to 5035ab25eeb5Syz155240 * another, else put it on the end of the newly determined queue. 5036ab25eeb5Syz155240 */ 5037ab25eeb5Syz155240 if (oifq != NULL) 5038f4b3ec61Sdh155122 fr_movequeue(&nat->nat_tqe, oifq, nifq, ifs); 5039ab25eeb5Syz155240 else 5040f4b3ec61Sdh155122 fr_queueappend(&nat->nat_tqe, nifq, nat, ifs); 5041ab25eeb5Syz155240 return; 5042ab25eeb5Syz155240 } 5043f4b3ec61Sdh155122 5044f4b3ec61Sdh155122 /* Function: nat_getnext */ 5045f4b3ec61Sdh155122 /* Returns: int - 0 == ok, else error */ 5046f4b3ec61Sdh155122 /* Parameters: t(I) - pointer to ipftoken structure */ 5047f4b3ec61Sdh155122 /* itp(I) - pointer to ipfgeniter_t structure */ 5048f4b3ec61Sdh155122 /* */ 5049f4b3ec61Sdh155122 /* Fetch the next nat/ipnat structure pointer from the linked list and */ 5050f4b3ec61Sdh155122 /* copy it out to the storage space pointed to by itp_data. The next item */ 5051f4b3ec61Sdh155122 /* in the list to look at is put back in the ipftoken struture. */ 5052f4b3ec61Sdh155122 /* If we call ipf_freetoken, the accompanying pointer is set to NULL because*/ 5053f4b3ec61Sdh155122 /* ipf_freetoken will call a deref function for us and we dont want to call */ 5054f4b3ec61Sdh155122 /* that twice (second time would be in the second switch statement below. */ 5055f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 5056f4b3ec61Sdh155122 static int nat_getnext(t, itp, ifs) 5057f4b3ec61Sdh155122 ipftoken_t *t; 5058f4b3ec61Sdh155122 ipfgeniter_t *itp; 5059f4b3ec61Sdh155122 ipf_stack_t *ifs; 5060f4b3ec61Sdh155122 { 5061f4b3ec61Sdh155122 hostmap_t *hm, *nexthm = NULL, zerohm; 5062f4b3ec61Sdh155122 ipnat_t *ipn, *nextipnat = NULL, zeroipn; 5063f4b3ec61Sdh155122 nat_t *nat, *nextnat = NULL, zeronat; 5064f4b3ec61Sdh155122 int error = 0; 5065f4b3ec61Sdh155122 5066f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 5067f4b3ec61Sdh155122 switch (itp->igi_type) 5068f4b3ec61Sdh155122 { 5069f4b3ec61Sdh155122 case IPFGENITER_HOSTMAP : 5070f4b3ec61Sdh155122 hm = t->ipt_data; 5071f4b3ec61Sdh155122 if (hm == NULL) { 5072f4b3ec61Sdh155122 nexthm = ifs->ifs_ipf_hm_maplist; 5073f4b3ec61Sdh155122 } else { 5074f4b3ec61Sdh155122 nexthm = hm->hm_hnext; 5075f4b3ec61Sdh155122 } 5076f4b3ec61Sdh155122 if (nexthm != NULL) { 5077f4b3ec61Sdh155122 if (nexthm->hm_hnext == NULL) { 5078f4b3ec61Sdh155122 t->ipt_alive = 0; 5079966f126dSzf203873 ipf_unlinktoken(t, ifs); 5080966f126dSzf203873 KFREE(t); 5081f4b3ec61Sdh155122 } else { 5082f4b3ec61Sdh155122 /*MUTEX_ENTER(&nexthm->hm_lock);*/ 5083f4b3ec61Sdh155122 nexthm->hm_ref++; 5084f4b3ec61Sdh155122 /*MUTEX_EXIT(&nextipnat->hm_lock);*/ 5085f4b3ec61Sdh155122 } 5086f4b3ec61Sdh155122 5087f4b3ec61Sdh155122 } else { 5088f4b3ec61Sdh155122 bzero(&zerohm, sizeof(zerohm)); 5089f4b3ec61Sdh155122 nexthm = &zerohm; 5090966f126dSzf203873 ipf_freetoken(t, ifs); 5091f4b3ec61Sdh155122 } 5092f4b3ec61Sdh155122 break; 5093f4b3ec61Sdh155122 5094f4b3ec61Sdh155122 case IPFGENITER_IPNAT : 5095f4b3ec61Sdh155122 ipn = t->ipt_data; 5096f4b3ec61Sdh155122 if (ipn == NULL) { 5097f4b3ec61Sdh155122 nextipnat = ifs->ifs_nat_list; 5098f4b3ec61Sdh155122 } else { 5099f4b3ec61Sdh155122 nextipnat = ipn->in_next; 5100f4b3ec61Sdh155122 } 5101f4b3ec61Sdh155122 if (nextipnat != NULL) { 5102f4b3ec61Sdh155122 if (nextipnat->in_next == NULL) { 5103f4b3ec61Sdh155122 t->ipt_alive = 0; 5104966f126dSzf203873 ipf_unlinktoken(t, ifs); 5105966f126dSzf203873 KFREE(t); 5106f4b3ec61Sdh155122 } else { 5107f4b3ec61Sdh155122 /* MUTEX_ENTER(&nextipnat->in_lock); */ 5108f4b3ec61Sdh155122 nextipnat->in_use++; 5109f4b3ec61Sdh155122 /* MUTEX_EXIT(&nextipnat->in_lock); */ 5110f4b3ec61Sdh155122 } 5111f4b3ec61Sdh155122 } else { 5112f4b3ec61Sdh155122 bzero(&zeroipn, sizeof(zeroipn)); 5113f4b3ec61Sdh155122 nextipnat = &zeroipn; 5114966f126dSzf203873 ipf_freetoken(t, ifs); 5115f4b3ec61Sdh155122 } 5116f4b3ec61Sdh155122 break; 5117f4b3ec61Sdh155122 5118f4b3ec61Sdh155122 case IPFGENITER_NAT : 5119f4b3ec61Sdh155122 nat = t->ipt_data; 5120f4b3ec61Sdh155122 if (nat == NULL) { 5121f4b3ec61Sdh155122 nextnat = ifs->ifs_nat_instances; 5122f4b3ec61Sdh155122 } else { 5123f4b3ec61Sdh155122 nextnat = nat->nat_next; 5124f4b3ec61Sdh155122 } 5125f4b3ec61Sdh155122 if (nextnat != NULL) { 5126f4b3ec61Sdh155122 if (nextnat->nat_next == NULL) { 5127f4b3ec61Sdh155122 t->ipt_alive = 0; 5128966f126dSzf203873 ipf_unlinktoken(t, ifs); 5129966f126dSzf203873 KFREE(t); 5130f4b3ec61Sdh155122 } else { 5131f4b3ec61Sdh155122 MUTEX_ENTER(&nextnat->nat_lock); 5132f4b3ec61Sdh155122 nextnat->nat_ref++; 5133f4b3ec61Sdh155122 MUTEX_EXIT(&nextnat->nat_lock); 5134f4b3ec61Sdh155122 } 5135f4b3ec61Sdh155122 } else { 5136f4b3ec61Sdh155122 bzero(&zeronat, sizeof(zeronat)); 5137f4b3ec61Sdh155122 nextnat = &zeronat; 5138966f126dSzf203873 ipf_freetoken(t, ifs); 5139f4b3ec61Sdh155122 } 5140f4b3ec61Sdh155122 break; 5141f4b3ec61Sdh155122 } 5142f4b3ec61Sdh155122 5143f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 5144f4b3ec61Sdh155122 5145f4b3ec61Sdh155122 switch (itp->igi_type) 5146f4b3ec61Sdh155122 { 5147f4b3ec61Sdh155122 case IPFGENITER_HOSTMAP : 5148f4b3ec61Sdh155122 if (hm != NULL) { 5149f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 5150f4b3ec61Sdh155122 fr_hostmapderef(&hm); 5151f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 5152f4b3ec61Sdh155122 } 5153966f126dSzf203873 if (nexthm->hm_hnext != NULL) 5154f4b3ec61Sdh155122 t->ipt_data = nexthm; 5155f4b3ec61Sdh155122 error = COPYOUT(nexthm, itp->igi_data, sizeof(*nexthm)); 5156f4b3ec61Sdh155122 if (error != 0) 5157f4b3ec61Sdh155122 error = EFAULT; 5158f4b3ec61Sdh155122 break; 5159f4b3ec61Sdh155122 5160f4b3ec61Sdh155122 case IPFGENITER_IPNAT : 5161f4b3ec61Sdh155122 if (ipn != NULL) 5162f4b3ec61Sdh155122 fr_ipnatderef(&ipn, ifs); 5163966f126dSzf203873 if (nextipnat->in_next != NULL) 5164f4b3ec61Sdh155122 t->ipt_data = nextipnat; 5165f4b3ec61Sdh155122 error = COPYOUT(nextipnat, itp->igi_data, sizeof(*nextipnat)); 5166f4b3ec61Sdh155122 if (error != 0) 5167f4b3ec61Sdh155122 error = EFAULT; 5168f4b3ec61Sdh155122 break; 5169f4b3ec61Sdh155122 5170f4b3ec61Sdh155122 case IPFGENITER_NAT : 5171f4b3ec61Sdh155122 if (nat != NULL) 5172f4b3ec61Sdh155122 fr_natderef(&nat, ifs); 5173966f126dSzf203873 if (nextnat->nat_next != NULL) 5174f4b3ec61Sdh155122 t->ipt_data = nextnat; 5175f4b3ec61Sdh155122 error = COPYOUT(nextnat, itp->igi_data, sizeof(*nextnat)); 5176f4b3ec61Sdh155122 if (error != 0) 5177f4b3ec61Sdh155122 error = EFAULT; 5178f4b3ec61Sdh155122 break; 5179f4b3ec61Sdh155122 } 5180f4b3ec61Sdh155122 5181f4b3ec61Sdh155122 return error; 5182f4b3ec61Sdh155122 } 5183f4b3ec61Sdh155122 5184f4b3ec61Sdh155122 5185f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 5186f4b3ec61Sdh155122 /* Function: nat_iterator */ 5187f4b3ec61Sdh155122 /* Returns: int - 0 == ok, else error */ 5188f4b3ec61Sdh155122 /* Parameters: token(I) - pointer to ipftoken structure */ 5189f4b3ec61Sdh155122 /* itp(I) - pointer to ipfgeniter_t structure */ 5190f4b3ec61Sdh155122 /* */ 5191f4b3ec61Sdh155122 /* This function acts as a handler for the SIOCGENITER ioctls that use a */ 5192f4b3ec61Sdh155122 /* generic structure to iterate through a list. There are three different */ 5193f4b3ec61Sdh155122 /* linked lists of NAT related information to go through: NAT rules, active */ 5194f4b3ec61Sdh155122 /* NAT mappings and the NAT fragment cache. */ 5195f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 5196f4b3ec61Sdh155122 static int nat_iterator(token, itp, ifs) 5197f4b3ec61Sdh155122 ipftoken_t *token; 5198f4b3ec61Sdh155122 ipfgeniter_t *itp; 5199f4b3ec61Sdh155122 ipf_stack_t *ifs; 5200f4b3ec61Sdh155122 { 5201f4b3ec61Sdh155122 int error; 5202f4b3ec61Sdh155122 5203f4b3ec61Sdh155122 if (itp->igi_data == NULL) 5204f4b3ec61Sdh155122 return EFAULT; 5205f4b3ec61Sdh155122 5206f4b3ec61Sdh155122 token->ipt_subtype = itp->igi_type; 5207f4b3ec61Sdh155122 5208f4b3ec61Sdh155122 switch (itp->igi_type) 5209f4b3ec61Sdh155122 { 5210f4b3ec61Sdh155122 case IPFGENITER_HOSTMAP : 5211f4b3ec61Sdh155122 case IPFGENITER_IPNAT : 5212f4b3ec61Sdh155122 case IPFGENITER_NAT : 5213f4b3ec61Sdh155122 error = nat_getnext(token, itp, ifs); 5214f4b3ec61Sdh155122 break; 5215f4b3ec61Sdh155122 case IPFGENITER_NATFRAG : 5216f4b3ec61Sdh155122 error = fr_nextfrag(token, itp, &ifs->ifs_ipfr_natlist, 5217f4b3ec61Sdh155122 &ifs->ifs_ipfr_nattail, 5218f4b3ec61Sdh155122 &ifs->ifs_ipf_natfrag, ifs); 5219f4b3ec61Sdh155122 break; 5220f4b3ec61Sdh155122 default : 5221f4b3ec61Sdh155122 error = EINVAL; 5222f4b3ec61Sdh155122 break; 5223f4b3ec61Sdh155122 } 5224f4b3ec61Sdh155122 5225f4b3ec61Sdh155122 return error; 5226f4b3ec61Sdh155122 } 52273805c50fSan207044 52283805c50fSan207044 52293805c50fSan207044 /* -------------------------------------------------------------------- */ 52303805c50fSan207044 /* Function: nat_earlydrop */ 52313805c50fSan207044 /* Returns: number of dropped/removed entries from the queue */ 52323805c50fSan207044 /* Parameters: ifq - pointer to queue with entries to be processed */ 52333805c50fSan207044 /* maxidle - entry must be idle this long to be dropped */ 52343805c50fSan207044 /* ifs - ipf stack instance */ 52353805c50fSan207044 /* */ 52363805c50fSan207044 /* Function is invoked from nat_extraflush() only. Removes entries */ 52373805c50fSan207044 /* form specified timeout queue, based on how long they've sat idle, */ 52383805c50fSan207044 /* without waiting for it to happen on its own. */ 52393805c50fSan207044 /* -------------------------------------------------------------------- */ 52403805c50fSan207044 static int nat_earlydrop(ifq, maxidle, ifs) 52413805c50fSan207044 ipftq_t *ifq; 52423805c50fSan207044 int maxidle; 52433805c50fSan207044 ipf_stack_t *ifs; 52443805c50fSan207044 { 52453805c50fSan207044 ipftqent_t *tqe, *tqn; 52463805c50fSan207044 nat_t *nat; 52473805c50fSan207044 unsigned int dropped; 52483805c50fSan207044 int droptick; 52493805c50fSan207044 52503805c50fSan207044 if (ifq == NULL) 52513805c50fSan207044 return (0); 52523805c50fSan207044 52533805c50fSan207044 dropped = 0; 52543805c50fSan207044 52553805c50fSan207044 /* 52563805c50fSan207044 * Determine the tick representing the idle time we're interested 52573805c50fSan207044 * in. If an entry exists in the queue, and it was touched before 52583805c50fSan207044 * that tick, then it's been idle longer than maxidle ... remove it. 52593805c50fSan207044 */ 52603805c50fSan207044 droptick = ifs->ifs_fr_ticks - maxidle; 52613805c50fSan207044 tqn = ifq->ifq_head; 52623805c50fSan207044 while ((tqe = tqn) != NULL && tqe->tqe_touched < droptick) { 52633805c50fSan207044 tqn = tqe->tqe_next; 52643805c50fSan207044 nat = tqe->tqe_parent; 52653805c50fSan207044 nat_delete(nat, ISL_EXPIRE, ifs); 52663805c50fSan207044 dropped++; 52673805c50fSan207044 } 52683805c50fSan207044 return (dropped); 52693805c50fSan207044 } 52703805c50fSan207044 52713805c50fSan207044 52723805c50fSan207044 /* --------------------------------------------------------------------- */ 52733805c50fSan207044 /* Function: nat_flushclosing */ 52743805c50fSan207044 /* Returns: int - number of NAT entries deleted */ 52753805c50fSan207044 /* Parameters: stateval(I) - State at which to start removing entries */ 52763805c50fSan207044 /* ifs - ipf stack instance */ 52773805c50fSan207044 /* */ 52783805c50fSan207044 /* Remove nat table entries for TCP connections which are in the process */ 52793805c50fSan207044 /* of closing, and are in (or "beyond") state specified by 'stateval'. */ 52803805c50fSan207044 /* --------------------------------------------------------------------- */ 52813805c50fSan207044 static int nat_flushclosing(stateval, ifs) 52823805c50fSan207044 int stateval; 52833805c50fSan207044 ipf_stack_t *ifs; 52843805c50fSan207044 { 52853805c50fSan207044 ipftq_t *ifq, *ifqn; 52863805c50fSan207044 ipftqent_t *tqe, *tqn; 52873805c50fSan207044 nat_t *nat; 52883805c50fSan207044 int dropped; 52893805c50fSan207044 52903805c50fSan207044 dropped = 0; 52913805c50fSan207044 52923805c50fSan207044 /* 52933805c50fSan207044 * Start by deleting any entries in specific timeout queues. 52943805c50fSan207044 */ 52953805c50fSan207044 ifqn = &ifs->ifs_nat_tqb[stateval]; 52963805c50fSan207044 while ((ifq = ifqn) != NULL) { 52973805c50fSan207044 ifqn = ifq->ifq_next; 52983805c50fSan207044 dropped += nat_earlydrop(ifq, (int)0, ifs); 52993805c50fSan207044 } 53003805c50fSan207044 53013805c50fSan207044 /* 53023805c50fSan207044 * Next, look through user defined queues for closing entries. 53033805c50fSan207044 */ 53043805c50fSan207044 ifqn = ifs->ifs_nat_utqe; 53053805c50fSan207044 while ((ifq = ifqn) != NULL) { 53063805c50fSan207044 ifqn = ifq->ifq_next; 53073805c50fSan207044 tqn = ifq->ifq_head; 53083805c50fSan207044 while ((tqe = tqn) != NULL) { 53093805c50fSan207044 tqn = tqe->tqe_next; 53103805c50fSan207044 nat = tqe->tqe_parent; 53113805c50fSan207044 if (nat->nat_p != IPPROTO_TCP) 53123805c50fSan207044 continue; 53133805c50fSan207044 if ((nat->nat_tcpstate[0] >= stateval) && 53143805c50fSan207044 (nat->nat_tcpstate[1] >= stateval)) { 53153805c50fSan207044 nat_delete(nat, NL_EXPIRE, ifs); 53163805c50fSan207044 dropped++; 53173805c50fSan207044 } 53183805c50fSan207044 } 53193805c50fSan207044 } 53203805c50fSan207044 return (dropped); 53213805c50fSan207044 } 53223805c50fSan207044 53233805c50fSan207044 53243805c50fSan207044 /* --------------------------------------------------------------------- */ 53253805c50fSan207044 /* Function: nat_extraflush */ 53263805c50fSan207044 /* Returns: int - number of NAT entries deleted */ 53273805c50fSan207044 /* Parameters: which(I) - how to flush the active NAT table */ 53283805c50fSan207044 /* ifs - ipf stack instance */ 53293805c50fSan207044 /* Write Locks: ipf_nat */ 53303805c50fSan207044 /* */ 53313805c50fSan207044 /* Flush nat tables. Three actions currently defined: */ 53323805c50fSan207044 /* */ 53333805c50fSan207044 /* which == 0 : Flush all nat table entries. */ 53343805c50fSan207044 /* */ 53353805c50fSan207044 /* which == 1 : Flush entries with TCP connections which have started */ 53363805c50fSan207044 /* to close on both ends. */ 53373805c50fSan207044 /* */ 53383805c50fSan207044 /* which == 2 : First, flush entries which are "almost" closed. If that */ 53393805c50fSan207044 /* does not take us below specified threshold in the table, */ 53403805c50fSan207044 /* we want to flush entries with TCP connections which have */ 53413805c50fSan207044 /* been idle for a long time. Start with connections idle */ 53423805c50fSan207044 /* over 12 hours, and then work backwards in half hour */ 53433805c50fSan207044 /* increments to at most 30 minutes idle, and finally work */ 53443805c50fSan207044 /* back in 30 second increments to at most 30 seconds. */ 53453805c50fSan207044 /* --------------------------------------------------------------------- */ 53463805c50fSan207044 static int nat_extraflush(which, ifs) 53473805c50fSan207044 int which; 53483805c50fSan207044 ipf_stack_t *ifs; 53493805c50fSan207044 { 53503805c50fSan207044 ipftq_t *ifq, *ifqn; 53513805c50fSan207044 nat_t *nat, **natp; 53523805c50fSan207044 int idletime, removed, idle_idx; 53533805c50fSan207044 SPL_INT(s); 53543805c50fSan207044 53553805c50fSan207044 removed = 0; 53563805c50fSan207044 53573805c50fSan207044 SPL_NET(s); 53583805c50fSan207044 switch (which) 53593805c50fSan207044 { 53603805c50fSan207044 case 0: 53613805c50fSan207044 natp = &ifs->ifs_nat_instances; 53623805c50fSan207044 while ((nat = *natp) != NULL) { 53633805c50fSan207044 natp = &nat->nat_next; 53643805c50fSan207044 nat_delete(nat, ISL_FLUSH, ifs); 53653805c50fSan207044 removed++; 53663805c50fSan207044 } 53673805c50fSan207044 break; 53683805c50fSan207044 53693805c50fSan207044 case 1: 53703805c50fSan207044 removed = nat_flushclosing(IPF_TCPS_CLOSE_WAIT, ifs); 53713805c50fSan207044 break; 53723805c50fSan207044 53733805c50fSan207044 case 2: 53743805c50fSan207044 removed = nat_flushclosing(IPF_TCPS_FIN_WAIT_2, ifs); 53753805c50fSan207044 53763805c50fSan207044 /* 53773805c50fSan207044 * Be sure we haven't done this in the last 10 seconds. 53783805c50fSan207044 */ 53793805c50fSan207044 if (ifs->ifs_fr_ticks - ifs->ifs_nat_last_force_flush < 53803805c50fSan207044 IPF_TTLVAL(10)) 53813805c50fSan207044 break; 53823805c50fSan207044 ifs->ifs_nat_last_force_flush = ifs->ifs_fr_ticks; 53833805c50fSan207044 53843805c50fSan207044 /* 53853805c50fSan207044 * Determine initial threshold for minimum idle time based on 53863805c50fSan207044 * how long ipfilter has been running. Ipfilter needs to have 53873805c50fSan207044 * been up as long as the smallest interval to continue on. 53883805c50fSan207044 * 53893805c50fSan207044 * Minimum idle times stored in idletime_tab and indexed by 53903805c50fSan207044 * idle_idx. Start at upper end of array and work backwards. 53913805c50fSan207044 * 53923805c50fSan207044 * Once the index is found, set the initial idle time to the 53933805c50fSan207044 * first interval before the current ipfilter run time. 53943805c50fSan207044 */ 53953805c50fSan207044 if (ifs->ifs_fr_ticks < idletime_tab[0]) 53963805c50fSan207044 break; /* switch */ 53973805c50fSan207044 idle_idx = (sizeof (idletime_tab) / sizeof (int)) - 1; 53983805c50fSan207044 if (ifs->ifs_fr_ticks > idletime_tab[idle_idx]) { 53993805c50fSan207044 idletime = idletime_tab[idle_idx]; 54003805c50fSan207044 } else { 54013805c50fSan207044 while ((idle_idx > 0) && 54023805c50fSan207044 (ifs->ifs_fr_ticks < idletime_tab[idle_idx])) 54033805c50fSan207044 idle_idx--; 54043805c50fSan207044 idletime = (ifs->ifs_fr_ticks / 54053805c50fSan207044 idletime_tab[idle_idx]) * 54063805c50fSan207044 idletime_tab[idle_idx]; 54073805c50fSan207044 } 54083805c50fSan207044 54093805c50fSan207044 while ((idle_idx >= 0) && 54103805c50fSan207044 (NAT_TAB_WATER_LEVEL(ifs) > ifs->ifs_nat_flush_lvl_lo)) { 54113805c50fSan207044 /* 54123805c50fSan207044 * Start with appropriate timeout queue. 54133805c50fSan207044 */ 54143805c50fSan207044 removed += nat_earlydrop( 54153805c50fSan207044 &ifs->ifs_nat_tqb[IPF_TCPS_ESTABLISHED], 54163805c50fSan207044 idletime, ifs); 54173805c50fSan207044 54183805c50fSan207044 /* 54193805c50fSan207044 * Make sure we haven't already deleted enough 54203805c50fSan207044 * entries before checking the user defined queues. 54213805c50fSan207044 */ 54223805c50fSan207044 if (NAT_TAB_WATER_LEVEL(ifs) <= 54233805c50fSan207044 ifs->ifs_nat_flush_lvl_lo) 54243805c50fSan207044 break; 54253805c50fSan207044 54263805c50fSan207044 /* 54273805c50fSan207044 * Next, look through the user defined queues. 54283805c50fSan207044 */ 54293805c50fSan207044 ifqn = ifs->ifs_nat_utqe; 54303805c50fSan207044 while ((ifq = ifqn) != NULL) { 54313805c50fSan207044 ifqn = ifq->ifq_next; 54323805c50fSan207044 removed += nat_earlydrop(ifq, idletime, ifs); 54333805c50fSan207044 } 54343805c50fSan207044 54353805c50fSan207044 /* 54363805c50fSan207044 * Adjust the granularity of idle time. 54373805c50fSan207044 * 54383805c50fSan207044 * If we reach an interval boundary, we need to 54393805c50fSan207044 * either adjust the idle time accordingly or exit 54403805c50fSan207044 * the loop altogether (if this is very last check). 54413805c50fSan207044 */ 54423805c50fSan207044 idletime -= idletime_tab[idle_idx]; 54433805c50fSan207044 if (idletime < idletime_tab[idle_idx]) { 54443805c50fSan207044 if (idle_idx != 0) { 54453805c50fSan207044 idletime = idletime_tab[idle_idx] - 54463805c50fSan207044 idletime_tab[idle_idx - 1]; 54473805c50fSan207044 idle_idx--; 54483805c50fSan207044 } else { 54493805c50fSan207044 break; /* while */ 54503805c50fSan207044 } 54513805c50fSan207044 } 54523805c50fSan207044 } 54533805c50fSan207044 break; 54543805c50fSan207044 default: 54553805c50fSan207044 break; 54563805c50fSan207044 } 54573805c50fSan207044 54583805c50fSan207044 SPL_X(s); 54593805c50fSan207044 return (removed); 54603805c50fSan207044 } 5461