1ab25eeb5Syz155240 /* 2ab25eeb5Syz155240 * Copyright (C) 1995-2003 by Darren Reed. 3ab25eeb5Syz155240 * 4ab25eeb5Syz155240 * See the IPFILTER.LICENCE file for details on licencing. 5ab25eeb5Syz155240 * 6f4b3ec61Sdh155122 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 7ab25eeb5Syz155240 * Use is subject to license terms. 8ab25eeb5Syz155240 */ 9ab25eeb5Syz155240 10dcf3e898Sjojemann #pragma ident "%Z%%M% %I% %E% SMI"$ 11ab25eeb5Syz155240 12ab25eeb5Syz155240 #if defined(KERNEL) || defined(_KERNEL) 13ab25eeb5Syz155240 # undef KERNEL 14ab25eeb5Syz155240 # undef _KERNEL 15ab25eeb5Syz155240 # define KERNEL 1 16ab25eeb5Syz155240 # define _KERNEL 1 17ab25eeb5Syz155240 #endif 18ab25eeb5Syz155240 #include <sys/errno.h> 19ab25eeb5Syz155240 #include <sys/types.h> 20ab25eeb5Syz155240 #include <sys/param.h> 21ab25eeb5Syz155240 #include <sys/time.h> 22ab25eeb5Syz155240 #include <sys/file.h> 23ab25eeb5Syz155240 #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \ 24ab25eeb5Syz155240 defined(_KERNEL) 25ab25eeb5Syz155240 # include "opt_ipfilter_log.h" 26ab25eeb5Syz155240 #endif 27ab25eeb5Syz155240 #if !defined(_KERNEL) 28ab25eeb5Syz155240 # include <stdio.h> 29ab25eeb5Syz155240 # include <string.h> 30ab25eeb5Syz155240 # include <stdlib.h> 31ab25eeb5Syz155240 # define _KERNEL 32ab25eeb5Syz155240 # ifdef __OpenBSD__ 33ab25eeb5Syz155240 struct file; 34ab25eeb5Syz155240 # endif 35ab25eeb5Syz155240 # include <sys/uio.h> 36ab25eeb5Syz155240 # undef _KERNEL 37ab25eeb5Syz155240 #endif 38ab25eeb5Syz155240 #if defined(_KERNEL) && (__FreeBSD_version >= 220000) 39ab25eeb5Syz155240 # include <sys/filio.h> 40ab25eeb5Syz155240 # include <sys/fcntl.h> 41ab25eeb5Syz155240 #else 42ab25eeb5Syz155240 # include <sys/ioctl.h> 43ab25eeb5Syz155240 #endif 44ab25eeb5Syz155240 #if !defined(AIX) 45ab25eeb5Syz155240 # include <sys/fcntl.h> 46ab25eeb5Syz155240 #endif 47ab25eeb5Syz155240 #if !defined(linux) 48ab25eeb5Syz155240 # include <sys/protosw.h> 49ab25eeb5Syz155240 #endif 50ab25eeb5Syz155240 #include <sys/socket.h> 51ab25eeb5Syz155240 #if defined(_KERNEL) 52ab25eeb5Syz155240 # include <sys/systm.h> 53ab25eeb5Syz155240 # if !defined(__SVR4) && !defined(__svr4__) 54ab25eeb5Syz155240 # include <sys/mbuf.h> 55ab25eeb5Syz155240 # endif 56ab25eeb5Syz155240 #endif 57ab25eeb5Syz155240 #if defined(__SVR4) || defined(__svr4__) 58ab25eeb5Syz155240 # include <sys/filio.h> 59ab25eeb5Syz155240 # include <sys/byteorder.h> 60ab25eeb5Syz155240 # ifdef _KERNEL 61ab25eeb5Syz155240 # include <sys/dditypes.h> 62ab25eeb5Syz155240 # endif 63ab25eeb5Syz155240 # include <sys/stream.h> 64ab25eeb5Syz155240 # include <sys/kmem.h> 65ab25eeb5Syz155240 #endif 66ab25eeb5Syz155240 #if __FreeBSD_version >= 300000 67ab25eeb5Syz155240 # include <sys/queue.h> 68ab25eeb5Syz155240 #endif 69ab25eeb5Syz155240 #include <net/if.h> 70ab25eeb5Syz155240 #if __FreeBSD_version >= 300000 71ab25eeb5Syz155240 # include <net/if_var.h> 72ab25eeb5Syz155240 # if defined(_KERNEL) && !defined(IPFILTER_LKM) 73ab25eeb5Syz155240 # include "opt_ipfilter.h" 74ab25eeb5Syz155240 # endif 75ab25eeb5Syz155240 #endif 76ab25eeb5Syz155240 #ifdef sun 77ab25eeb5Syz155240 # include <net/af.h> 78ab25eeb5Syz155240 #endif 79ab25eeb5Syz155240 #include <net/route.h> 80ab25eeb5Syz155240 #include <netinet/in.h> 81ab25eeb5Syz155240 #include <netinet/in_systm.h> 82ab25eeb5Syz155240 #include <netinet/ip.h> 83ab25eeb5Syz155240 84ab25eeb5Syz155240 #ifdef RFC1825 85ab25eeb5Syz155240 # include <vpn/md5.h> 86ab25eeb5Syz155240 # include <vpn/ipsec.h> 87ab25eeb5Syz155240 extern struct ifnet vpnif; 88ab25eeb5Syz155240 #endif 89ab25eeb5Syz155240 90ab25eeb5Syz155240 #if !defined(linux) 91ab25eeb5Syz155240 # include <netinet/ip_var.h> 92ab25eeb5Syz155240 #endif 93ab25eeb5Syz155240 #include <netinet/tcp.h> 94ab25eeb5Syz155240 #include <netinet/udp.h> 95ab25eeb5Syz155240 #include <netinet/ip_icmp.h> 96ab25eeb5Syz155240 #include "netinet/ip_compat.h" 97ab25eeb5Syz155240 #include <netinet/tcpip.h> 98ab25eeb5Syz155240 #include "netinet/ip_fil.h" 99ab25eeb5Syz155240 #include "netinet/ip_nat.h" 100ab25eeb5Syz155240 #include "netinet/ip_frag.h" 101ab25eeb5Syz155240 #include "netinet/ip_state.h" 102ab25eeb5Syz155240 #include "netinet/ip_proxy.h" 103f4b3ec61Sdh155122 #include "netinet/ipf_stack.h" 104ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 105ab25eeb5Syz155240 #include "netinet/ip_sync.h" 106ab25eeb5Syz155240 #endif 107ab25eeb5Syz155240 #if (__FreeBSD_version >= 300000) 108ab25eeb5Syz155240 # include <sys/malloc.h> 109ab25eeb5Syz155240 #endif 110ab25eeb5Syz155240 /* END OF INCLUDES */ 111ab25eeb5Syz155240 112ab25eeb5Syz155240 #undef SOCKADDR_IN 113ab25eeb5Syz155240 #define SOCKADDR_IN struct sockaddr_in 114ab25eeb5Syz155240 115ab25eeb5Syz155240 #if !defined(lint) 116ab25eeb5Syz155240 static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed"; 117ab25eeb5Syz155240 static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.195.2.42 2005/08/11 19:51:36 darrenr Exp $"; 118ab25eeb5Syz155240 #endif 119ab25eeb5Syz155240 120ab25eeb5Syz155240 121ab25eeb5Syz155240 /* ======================================================================== */ 122ab25eeb5Syz155240 /* How the NAT is organised and works. */ 123ab25eeb5Syz155240 /* */ 124ab25eeb5Syz155240 /* Inside (interface y) NAT Outside (interface x) */ 125ab25eeb5Syz155240 /* -------------------- -+- ------------------------------------- */ 126ab25eeb5Syz155240 /* Packet going | out, processsed by fr_checknatout() for x */ 127ab25eeb5Syz155240 /* ------------> | ------------> */ 128ab25eeb5Syz155240 /* src=10.1.1.1 | src=192.1.1.1 */ 129ab25eeb5Syz155240 /* | */ 130ab25eeb5Syz155240 /* | in, processed by fr_checknatin() for x */ 131ab25eeb5Syz155240 /* <------------ | <------------ */ 132ab25eeb5Syz155240 /* dst=10.1.1.1 | dst=192.1.1.1 */ 133ab25eeb5Syz155240 /* -------------------- -+- ------------------------------------- */ 134ab25eeb5Syz155240 /* fr_checknatout() - changes ip_src and if required, sport */ 135ab25eeb5Syz155240 /* - creates a new mapping, if required. */ 136ab25eeb5Syz155240 /* fr_checknatin() - changes ip_dst and if required, dport */ 137ab25eeb5Syz155240 /* */ 138ab25eeb5Syz155240 /* In the NAT table, internal source is recorded as "in" and externally */ 139ab25eeb5Syz155240 /* seen as "out". */ 140ab25eeb5Syz155240 /* ======================================================================== */ 141ab25eeb5Syz155240 142ab25eeb5Syz155240 143ab25eeb5Syz155240 144f4b3ec61Sdh155122 static int nat_flushtable __P((ipf_stack_t *)); 145f4b3ec61Sdh155122 static int nat_clearlist __P((ipf_stack_t *)); 146f4b3ec61Sdh155122 static void nat_addnat __P((struct ipnat *, ipf_stack_t *)); 147f4b3ec61Sdh155122 static void nat_addrdr __P((struct ipnat *, ipf_stack_t *)); 148f4b3ec61Sdh155122 static void nat_delete __P((struct nat *, int, ipf_stack_t *)); 149ab25eeb5Syz155240 static void nat_delrdr __P((struct ipnat *)); 150ab25eeb5Syz155240 static void nat_delnat __P((struct ipnat *)); 151f4b3ec61Sdh155122 static int fr_natgetent __P((caddr_t, ipf_stack_t *)); 152f4b3ec61Sdh155122 static int fr_natgetsz __P((caddr_t, ipf_stack_t *)); 153f4b3ec61Sdh155122 static int fr_natputent __P((caddr_t, int, ipf_stack_t *)); 154f4b3ec61Sdh155122 static void nat_tabmove __P((nat_t *, ipf_stack_t *)); 155ab25eeb5Syz155240 static int nat_match __P((fr_info_t *, ipnat_t *)); 156ab25eeb5Syz155240 static INLINE int nat_newmap __P((fr_info_t *, nat_t *, natinfo_t *)); 157ab25eeb5Syz155240 static INLINE int nat_newrdr __P((fr_info_t *, nat_t *, natinfo_t *)); 158ab25eeb5Syz155240 static hostmap_t *nat_hostmap __P((ipnat_t *, struct in_addr, 159f4b3ec61Sdh155122 struct in_addr, struct in_addr, u_32_t, 160f4b3ec61Sdh155122 ipf_stack_t *)); 161ab25eeb5Syz155240 static void nat_hostmapdel __P((struct hostmap *)); 162ab25eeb5Syz155240 static INLINE int nat_icmpquerytype4 __P((int)); 163f4b3ec61Sdh155122 static int nat_siocaddnat __P((ipnat_t *, ipnat_t **, int, 164f4b3ec61Sdh155122 ipf_stack_t *)); 165f4b3ec61Sdh155122 static void nat_siocdelnat __P((ipnat_t *, ipnat_t **, int, 166f4b3ec61Sdh155122 ipf_stack_t *)); 167f4b3ec61Sdh155122 static INLINE int nat_icmperrortype4 __P((int)); 168ab25eeb5Syz155240 static INLINE int nat_finalise __P((fr_info_t *, nat_t *, natinfo_t *, 169ab25eeb5Syz155240 tcphdr_t *, nat_t **, int)); 170dcf3e898Sjojemann static INLINE int nat_resolverule __P((ipnat_t *, ipf_stack_t *)); 171ab25eeb5Syz155240 static nat_t *fr_natclone __P((fr_info_t *, nat_t *)); 172381a2a9aSdr146992 static void nat_mssclamp __P((tcphdr_t *, u_32_t, u_short *)); 173ab25eeb5Syz155240 static INLINE int nat_wildok __P((nat_t *, int, int, int, int)); 174f4b3ec61Sdh155122 static int nat_getnext __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *)); 175f4b3ec61Sdh155122 static int nat_iterator __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *)); 176ab25eeb5Syz155240 177ab25eeb5Syz155240 178ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 179ab25eeb5Syz155240 /* Function: fr_natinit */ 180ab25eeb5Syz155240 /* Returns: int - 0 == success, -1 == failure */ 181ab25eeb5Syz155240 /* Parameters: Nil */ 182ab25eeb5Syz155240 /* */ 183ab25eeb5Syz155240 /* Initialise all of the NAT locks, tables and other structures. */ 184ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 185f4b3ec61Sdh155122 int fr_natinit(ifs) 186f4b3ec61Sdh155122 ipf_stack_t *ifs; 187ab25eeb5Syz155240 { 188ab25eeb5Syz155240 int i; 189ab25eeb5Syz155240 190f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_table[0], nat_t **, 191f4b3ec61Sdh155122 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 192f4b3ec61Sdh155122 if (ifs->ifs_nat_table[0] != NULL) 193f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_table[0], 194f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(nat_t *)); 195ab25eeb5Syz155240 else 196ab25eeb5Syz155240 return -1; 197ab25eeb5Syz155240 198f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_table[1], nat_t **, 199f4b3ec61Sdh155122 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 200f4b3ec61Sdh155122 if (ifs->ifs_nat_table[1] != NULL) 201f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_table[1], 202f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(nat_t *)); 203ab25eeb5Syz155240 else 204ab25eeb5Syz155240 return -2; 205ab25eeb5Syz155240 206f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_rules, ipnat_t **, 207f4b3ec61Sdh155122 sizeof(ipnat_t *) * ifs->ifs_ipf_natrules_sz); 208f4b3ec61Sdh155122 if (ifs->ifs_nat_rules != NULL) 209f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_rules, 210f4b3ec61Sdh155122 ifs->ifs_ipf_natrules_sz * sizeof(ipnat_t *)); 211ab25eeb5Syz155240 else 212ab25eeb5Syz155240 return -3; 213ab25eeb5Syz155240 214f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_rdr_rules, ipnat_t **, 215f4b3ec61Sdh155122 sizeof(ipnat_t *) * ifs->ifs_ipf_rdrrules_sz); 216f4b3ec61Sdh155122 if (ifs->ifs_rdr_rules != NULL) 217f4b3ec61Sdh155122 bzero((char *)ifs->ifs_rdr_rules, 218f4b3ec61Sdh155122 ifs->ifs_ipf_rdrrules_sz * sizeof(ipnat_t *)); 219ab25eeb5Syz155240 else 220ab25eeb5Syz155240 return -4; 221ab25eeb5Syz155240 222f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_maptable, hostmap_t **, 223f4b3ec61Sdh155122 sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz); 224f4b3ec61Sdh155122 if (ifs->ifs_maptable != NULL) 225f4b3ec61Sdh155122 bzero((char *)ifs->ifs_maptable, 226f4b3ec61Sdh155122 sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz); 227ab25eeb5Syz155240 else 228ab25eeb5Syz155240 return -5; 229ab25eeb5Syz155240 230f4b3ec61Sdh155122 ifs->ifs_ipf_hm_maplist = NULL; 231ab25eeb5Syz155240 232f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_stats.ns_bucketlen[0], u_long *, 233f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 234f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[0] == NULL) 235f4b3ec61Sdh155122 return -1; 236f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_stats.ns_bucketlen[0], 237f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 238ab25eeb5Syz155240 239f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_stats.ns_bucketlen[1], u_long *, 240f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 241f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[1] == NULL) 242f4b3ec61Sdh155122 return -1; 243f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_stats.ns_bucketlen[1], 244f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 245ab25eeb5Syz155240 246f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_maxbucket == 0) { 247f4b3ec61Sdh155122 for (i = ifs->ifs_ipf_nattable_sz; i > 0; i >>= 1) 248f4b3ec61Sdh155122 ifs->ifs_fr_nat_maxbucket++; 249f4b3ec61Sdh155122 ifs->ifs_fr_nat_maxbucket *= 2; 250ab25eeb5Syz155240 } 251ab25eeb5Syz155240 252f4b3ec61Sdh155122 fr_sttab_init(ifs->ifs_nat_tqb, ifs); 253ab25eeb5Syz155240 /* 254ab25eeb5Syz155240 * Increase this because we may have "keep state" following this too 255ab25eeb5Syz155240 * and packet storms can occur if this is removed too quickly. 256ab25eeb5Syz155240 */ 257f4b3ec61Sdh155122 ifs->ifs_nat_tqb[IPF_TCPS_CLOSED].ifq_ttl = ifs->ifs_fr_tcplastack; 258f4b3ec61Sdh155122 ifs->ifs_nat_tqb[IPF_TCP_NSTATES - 1].ifq_next = &ifs->ifs_nat_udptq; 259f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_ttl = ifs->ifs_fr_defnatage; 260f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_ref = 1; 261f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_head = NULL; 262f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_tail = &ifs->ifs_nat_udptq.ifq_head; 263f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_nat_udptq.ifq_lock, "nat ipftq udp tab"); 264f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_next = &ifs->ifs_nat_icmptq; 265f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_ttl = ifs->ifs_fr_defnaticmpage; 266f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_ref = 1; 267f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_head = NULL; 268f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_tail = &ifs->ifs_nat_icmptq.ifq_head; 269f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_nat_icmptq.ifq_lock, "nat icmp ipftq tab"); 270f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_next = &ifs->ifs_nat_iptq; 271f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_ttl = ifs->ifs_fr_defnatipage; 272f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_ref = 1; 273f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_head = NULL; 274f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_tail = &ifs->ifs_nat_iptq.ifq_head; 275f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_nat_iptq.ifq_lock, "nat ip ipftq tab"); 276f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_next = NULL; 277ab25eeb5Syz155240 278ab25eeb5Syz155240 for (i = 0; i < IPF_TCP_NSTATES; i++) { 279f4b3ec61Sdh155122 if (ifs->ifs_nat_tqb[i].ifq_ttl < ifs->ifs_fr_defnaticmpage) 280f4b3ec61Sdh155122 ifs->ifs_nat_tqb[i].ifq_ttl = ifs->ifs_fr_defnaticmpage; 281ab25eeb5Syz155240 #ifdef LARGE_NAT 282f4b3ec61Sdh155122 else if (ifs->ifs_nat_tqb[i].ifq_ttl > ifs->ifs_fr_defnatage) 283f4b3ec61Sdh155122 ifs->ifs_nat_tqb[i].ifq_ttl = ifs->ifs_fr_defnatage; 284ab25eeb5Syz155240 #endif 285ab25eeb5Syz155240 } 286ab25eeb5Syz155240 287ab25eeb5Syz155240 /* 288ab25eeb5Syz155240 * Increase this because we may have "keep state" following 289ab25eeb5Syz155240 * this too and packet storms can occur if this is removed 290ab25eeb5Syz155240 * too quickly. 291ab25eeb5Syz155240 */ 292f4b3ec61Sdh155122 ifs->ifs_nat_tqb[IPF_TCPS_CLOSED].ifq_ttl = 293f4b3ec61Sdh155122 ifs->ifs_nat_tqb[IPF_TCPS_LAST_ACK].ifq_ttl; 294ab25eeb5Syz155240 295f4b3ec61Sdh155122 RWLOCK_INIT(&ifs->ifs_ipf_nat, "ipf IP NAT rwlock"); 296f4b3ec61Sdh155122 RWLOCK_INIT(&ifs->ifs_ipf_natfrag, "ipf IP NAT-Frag rwlock"); 297f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ipf_nat_new, "ipf nat new mutex"); 298f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ipf_natio, "ipf nat io mutex"); 299ab25eeb5Syz155240 300f4b3ec61Sdh155122 ifs->ifs_fr_nat_init = 1; 301ab25eeb5Syz155240 302ab25eeb5Syz155240 return 0; 303ab25eeb5Syz155240 } 304ab25eeb5Syz155240 305ab25eeb5Syz155240 306ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 307ab25eeb5Syz155240 /* Function: nat_addrdr */ 308ab25eeb5Syz155240 /* Returns: Nil */ 309ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule to add */ 310ab25eeb5Syz155240 /* */ 311ab25eeb5Syz155240 /* Adds a redirect rule to the hash table of redirect rules and the list of */ 312ab25eeb5Syz155240 /* loaded NAT rules. Updates the bitmask indicating which netmasks are in */ 313ab25eeb5Syz155240 /* use by redirect rules. */ 314ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 315f4b3ec61Sdh155122 static void nat_addrdr(n, ifs) 316ab25eeb5Syz155240 ipnat_t *n; 317f4b3ec61Sdh155122 ipf_stack_t *ifs; 318ab25eeb5Syz155240 { 319ab25eeb5Syz155240 ipnat_t **np; 320ab25eeb5Syz155240 u_32_t j; 321ab25eeb5Syz155240 u_int hv; 322ab25eeb5Syz155240 int k; 323ab25eeb5Syz155240 324ab25eeb5Syz155240 k = count4bits(n->in_outmsk); 325ab25eeb5Syz155240 if ((k >= 0) && (k != 32)) 326f4b3ec61Sdh155122 ifs->ifs_rdr_masks |= 1 << k; 327ab25eeb5Syz155240 j = (n->in_outip & n->in_outmsk); 328f4b3ec61Sdh155122 hv = NAT_HASH_FN(j, 0, ifs->ifs_ipf_rdrrules_sz); 329f4b3ec61Sdh155122 np = ifs->ifs_rdr_rules + hv; 330ab25eeb5Syz155240 while (*np != NULL) 331ab25eeb5Syz155240 np = &(*np)->in_rnext; 332ab25eeb5Syz155240 n->in_rnext = NULL; 333ab25eeb5Syz155240 n->in_prnext = np; 334ab25eeb5Syz155240 n->in_hv = hv; 335ab25eeb5Syz155240 *np = n; 336ab25eeb5Syz155240 } 337ab25eeb5Syz155240 338ab25eeb5Syz155240 339ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 340ab25eeb5Syz155240 /* Function: nat_addnat */ 341ab25eeb5Syz155240 /* Returns: Nil */ 342ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule to add */ 343ab25eeb5Syz155240 /* */ 344ab25eeb5Syz155240 /* Adds a NAT map rule to the hash table of rules and the list of loaded */ 345ab25eeb5Syz155240 /* NAT rules. Updates the bitmask indicating which netmasks are in use by */ 346ab25eeb5Syz155240 /* redirect rules. */ 347ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 348f4b3ec61Sdh155122 static void nat_addnat(n, ifs) 349ab25eeb5Syz155240 ipnat_t *n; 350f4b3ec61Sdh155122 ipf_stack_t *ifs; 351ab25eeb5Syz155240 { 352ab25eeb5Syz155240 ipnat_t **np; 353ab25eeb5Syz155240 u_32_t j; 354ab25eeb5Syz155240 u_int hv; 355ab25eeb5Syz155240 int k; 356ab25eeb5Syz155240 357ab25eeb5Syz155240 k = count4bits(n->in_inmsk); 358ab25eeb5Syz155240 if ((k >= 0) && (k != 32)) 359f4b3ec61Sdh155122 ifs->ifs_nat_masks |= 1 << k; 360ab25eeb5Syz155240 j = (n->in_inip & n->in_inmsk); 361f4b3ec61Sdh155122 hv = NAT_HASH_FN(j, 0, ifs->ifs_ipf_natrules_sz); 362f4b3ec61Sdh155122 np = ifs->ifs_nat_rules + hv; 363ab25eeb5Syz155240 while (*np != NULL) 364ab25eeb5Syz155240 np = &(*np)->in_mnext; 365ab25eeb5Syz155240 n->in_mnext = NULL; 366ab25eeb5Syz155240 n->in_pmnext = np; 367ab25eeb5Syz155240 n->in_hv = hv; 368ab25eeb5Syz155240 *np = n; 369ab25eeb5Syz155240 } 370ab25eeb5Syz155240 371ab25eeb5Syz155240 372ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 373ab25eeb5Syz155240 /* Function: nat_delrdr */ 374ab25eeb5Syz155240 /* Returns: Nil */ 375ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule to delete */ 376ab25eeb5Syz155240 /* */ 377ab25eeb5Syz155240 /* Removes a redirect rule from the hash table of redirect rules. */ 378ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 379ab25eeb5Syz155240 static void nat_delrdr(n) 380ab25eeb5Syz155240 ipnat_t *n; 381ab25eeb5Syz155240 { 382ab25eeb5Syz155240 if (n->in_rnext) 383ab25eeb5Syz155240 n->in_rnext->in_prnext = n->in_prnext; 384ab25eeb5Syz155240 *n->in_prnext = n->in_rnext; 385ab25eeb5Syz155240 } 386ab25eeb5Syz155240 387ab25eeb5Syz155240 388ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 389ab25eeb5Syz155240 /* Function: nat_delnat */ 390ab25eeb5Syz155240 /* Returns: Nil */ 391ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule to delete */ 392ab25eeb5Syz155240 /* */ 393ab25eeb5Syz155240 /* Removes a NAT map rule from the hash table of NAT map rules. */ 394ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 395ab25eeb5Syz155240 static void nat_delnat(n) 396ab25eeb5Syz155240 ipnat_t *n; 397ab25eeb5Syz155240 { 398ab25eeb5Syz155240 if (n->in_mnext != NULL) 399ab25eeb5Syz155240 n->in_mnext->in_pmnext = n->in_pmnext; 400ab25eeb5Syz155240 *n->in_pmnext = n->in_mnext; 401ab25eeb5Syz155240 } 402ab25eeb5Syz155240 403ab25eeb5Syz155240 404ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 405ab25eeb5Syz155240 /* Function: nat_hostmap */ 406ab25eeb5Syz155240 /* Returns: struct hostmap* - NULL if no hostmap could be created, */ 407ab25eeb5Syz155240 /* else a pointer to the hostmapping to use */ 408ab25eeb5Syz155240 /* Parameters: np(I) - pointer to NAT rule */ 409ab25eeb5Syz155240 /* real(I) - real IP address */ 410ab25eeb5Syz155240 /* map(I) - mapped IP address */ 411ab25eeb5Syz155240 /* port(I) - destination port number */ 412ab25eeb5Syz155240 /* Write Locks: ipf_nat */ 413ab25eeb5Syz155240 /* */ 414ab25eeb5Syz155240 /* Check if an ip address has already been allocated for a given mapping */ 415ab25eeb5Syz155240 /* that is not doing port based translation. If is not yet allocated, then */ 416ab25eeb5Syz155240 /* create a new entry if a non-NULL NAT rule pointer has been supplied. */ 417ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 418f4b3ec61Sdh155122 static struct hostmap *nat_hostmap(np, src, dst, map, port, ifs) 419ab25eeb5Syz155240 ipnat_t *np; 420ab25eeb5Syz155240 struct in_addr src; 421ab25eeb5Syz155240 struct in_addr dst; 422ab25eeb5Syz155240 struct in_addr map; 423ab25eeb5Syz155240 u_32_t port; 424f4b3ec61Sdh155122 ipf_stack_t *ifs; 425ab25eeb5Syz155240 { 426ab25eeb5Syz155240 hostmap_t *hm; 427ab25eeb5Syz155240 u_int hv; 428ab25eeb5Syz155240 429ab25eeb5Syz155240 hv = (src.s_addr ^ dst.s_addr); 430ab25eeb5Syz155240 hv += src.s_addr; 431ab25eeb5Syz155240 hv += dst.s_addr; 432ab25eeb5Syz155240 hv %= HOSTMAP_SIZE; 433f4b3ec61Sdh155122 for (hm = ifs->ifs_maptable[hv]; hm; hm = hm->hm_next) 434ab25eeb5Syz155240 if ((hm->hm_srcip.s_addr == src.s_addr) && 435ab25eeb5Syz155240 (hm->hm_dstip.s_addr == dst.s_addr) && 436ab25eeb5Syz155240 ((np == NULL) || (np == hm->hm_ipnat)) && 437ab25eeb5Syz155240 ((port == 0) || (port == hm->hm_port))) { 438ab25eeb5Syz155240 hm->hm_ref++; 439ab25eeb5Syz155240 return hm; 440ab25eeb5Syz155240 } 441ab25eeb5Syz155240 442ab25eeb5Syz155240 if (np == NULL) 443ab25eeb5Syz155240 return NULL; 444ab25eeb5Syz155240 445ab25eeb5Syz155240 KMALLOC(hm, hostmap_t *); 446ab25eeb5Syz155240 if (hm) { 447f4b3ec61Sdh155122 hm->hm_hnext = ifs->ifs_ipf_hm_maplist; 448f4b3ec61Sdh155122 hm->hm_phnext = &ifs->ifs_ipf_hm_maplist; 449f4b3ec61Sdh155122 if (ifs->ifs_ipf_hm_maplist != NULL) 450f4b3ec61Sdh155122 ifs->ifs_ipf_hm_maplist->hm_phnext = &hm->hm_hnext; 451f4b3ec61Sdh155122 ifs->ifs_ipf_hm_maplist = hm; 452f4b3ec61Sdh155122 453f4b3ec61Sdh155122 hm->hm_next = ifs->ifs_maptable[hv]; 454f4b3ec61Sdh155122 hm->hm_pnext = ifs->ifs_maptable + hv; 455f4b3ec61Sdh155122 if (ifs->ifs_maptable[hv] != NULL) 456f4b3ec61Sdh155122 ifs->ifs_maptable[hv]->hm_pnext = &hm->hm_next; 457f4b3ec61Sdh155122 ifs->ifs_maptable[hv] = hm; 458ab25eeb5Syz155240 hm->hm_ipnat = np; 459ab25eeb5Syz155240 hm->hm_srcip = src; 460ab25eeb5Syz155240 hm->hm_dstip = dst; 461ab25eeb5Syz155240 hm->hm_mapip = map; 462ab25eeb5Syz155240 hm->hm_ref = 1; 463ab25eeb5Syz155240 hm->hm_port = port; 464ab25eeb5Syz155240 } 465ab25eeb5Syz155240 return hm; 466ab25eeb5Syz155240 } 467ab25eeb5Syz155240 468ab25eeb5Syz155240 469ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 470ab25eeb5Syz155240 /* Function: nat_hostmapdel */ 471ab25eeb5Syz155240 /* Returns: Nil */ 472ab25eeb5Syz155240 /* Parameters: hm(I) - pointer to hostmap structure */ 473ab25eeb5Syz155240 /* Write Locks: ipf_nat */ 474ab25eeb5Syz155240 /* */ 475ab25eeb5Syz155240 /* Decrement the references to this hostmap structure by one. If this */ 476ab25eeb5Syz155240 /* reaches zero then remove it and free it. */ 477ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 478ab25eeb5Syz155240 static void nat_hostmapdel(hm) 479ab25eeb5Syz155240 struct hostmap *hm; 480ab25eeb5Syz155240 { 481ab25eeb5Syz155240 hm->hm_ref--; 482ab25eeb5Syz155240 if (hm->hm_ref == 0) { 483ab25eeb5Syz155240 if (hm->hm_next) 484ab25eeb5Syz155240 hm->hm_next->hm_pnext = hm->hm_pnext; 485ab25eeb5Syz155240 *hm->hm_pnext = hm->hm_next; 486f4b3ec61Sdh155122 if (hm->hm_hnext) 487f4b3ec61Sdh155122 hm->hm_hnext->hm_phnext = hm->hm_phnext; 488f4b3ec61Sdh155122 *hm->hm_phnext = hm->hm_hnext; 489ab25eeb5Syz155240 KFREE(hm); 490ab25eeb5Syz155240 } 491ab25eeb5Syz155240 } 492ab25eeb5Syz155240 493f4b3ec61Sdh155122 void fr_hostmapderef(hmp) 494f4b3ec61Sdh155122 struct hostmap **hmp; 495f4b3ec61Sdh155122 { 496f4b3ec61Sdh155122 struct hostmap *hm; 497f4b3ec61Sdh155122 498f4b3ec61Sdh155122 hm = *hmp; 499f4b3ec61Sdh155122 *hmp = NULL; 500f4b3ec61Sdh155122 hm->hm_ref--; 501f4b3ec61Sdh155122 if (hm->hm_ref == 0) 502f4b3ec61Sdh155122 nat_hostmapdel(hm); 503f4b3ec61Sdh155122 } 504f4b3ec61Sdh155122 505ab25eeb5Syz155240 506ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 507ab25eeb5Syz155240 /* Function: fix_outcksum */ 508ab25eeb5Syz155240 /* Returns: Nil */ 509381a2a9aSdr146992 /* Parameters: sp(I) - location of 16bit checksum to update */ 510ab25eeb5Syz155240 /* n((I) - amount to adjust checksum by */ 511ab25eeb5Syz155240 /* */ 512ab25eeb5Syz155240 /* Adjusts the 16bit checksum by "n" for packets going out. */ 513ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 514381a2a9aSdr146992 void fix_outcksum(sp, n) 515ab25eeb5Syz155240 u_short *sp; 516ab25eeb5Syz155240 u_32_t n; 517ab25eeb5Syz155240 { 518ab25eeb5Syz155240 u_short sumshort; 519ab25eeb5Syz155240 u_32_t sum1; 520ab25eeb5Syz155240 521ab25eeb5Syz155240 if (n == 0) 522ab25eeb5Syz155240 return; 523ab25eeb5Syz155240 524ab25eeb5Syz155240 sum1 = (~ntohs(*sp)) & 0xffff; 525ab25eeb5Syz155240 sum1 += (n); 526ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 527ab25eeb5Syz155240 /* Again */ 528ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 529ab25eeb5Syz155240 sumshort = ~(u_short)sum1; 530ab25eeb5Syz155240 *(sp) = htons(sumshort); 531ab25eeb5Syz155240 } 532ab25eeb5Syz155240 533ab25eeb5Syz155240 534ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 535ab25eeb5Syz155240 /* Function: fix_incksum */ 536ab25eeb5Syz155240 /* Returns: Nil */ 537381a2a9aSdr146992 /* Parameters: sp(I) - location of 16bit checksum to update */ 538ab25eeb5Syz155240 /* n((I) - amount to adjust checksum by */ 539ab25eeb5Syz155240 /* */ 540ab25eeb5Syz155240 /* Adjusts the 16bit checksum by "n" for packets going in. */ 541ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 542381a2a9aSdr146992 void fix_incksum(sp, n) 543ab25eeb5Syz155240 u_short *sp; 544ab25eeb5Syz155240 u_32_t n; 545ab25eeb5Syz155240 { 546ab25eeb5Syz155240 u_short sumshort; 547ab25eeb5Syz155240 u_32_t sum1; 548ab25eeb5Syz155240 549ab25eeb5Syz155240 if (n == 0) 550ab25eeb5Syz155240 return; 551ab25eeb5Syz155240 552ab25eeb5Syz155240 sum1 = (~ntohs(*sp)) & 0xffff; 553ab25eeb5Syz155240 sum1 += ~(n) & 0xffff; 554ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 555ab25eeb5Syz155240 /* Again */ 556ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 557ab25eeb5Syz155240 sumshort = ~(u_short)sum1; 558ab25eeb5Syz155240 *(sp) = htons(sumshort); 559ab25eeb5Syz155240 } 560ab25eeb5Syz155240 561ab25eeb5Syz155240 562ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 563ab25eeb5Syz155240 /* Function: fix_datacksum */ 564ab25eeb5Syz155240 /* Returns: Nil */ 565ab25eeb5Syz155240 /* Parameters: sp(I) - location of 16bit checksum to update */ 566ab25eeb5Syz155240 /* n((I) - amount to adjust checksum by */ 567ab25eeb5Syz155240 /* */ 568ab25eeb5Syz155240 /* Fix_datacksum is used *only* for the adjustments of checksums in the */ 569ab25eeb5Syz155240 /* data section of an IP packet. */ 570ab25eeb5Syz155240 /* */ 571ab25eeb5Syz155240 /* The only situation in which you need to do this is when NAT'ing an */ 572ab25eeb5Syz155240 /* ICMP error message. Such a message, contains in its body the IP header */ 573ab25eeb5Syz155240 /* of the original IP packet, that causes the error. */ 574ab25eeb5Syz155240 /* */ 575ab25eeb5Syz155240 /* You can't use fix_incksum or fix_outcksum in that case, because for the */ 576ab25eeb5Syz155240 /* kernel the data section of the ICMP error is just data, and no special */ 577ab25eeb5Syz155240 /* processing like hardware cksum or ntohs processing have been done by the */ 578ab25eeb5Syz155240 /* kernel on the data section. */ 579ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 580ab25eeb5Syz155240 void fix_datacksum(sp, n) 581ab25eeb5Syz155240 u_short *sp; 582ab25eeb5Syz155240 u_32_t n; 583ab25eeb5Syz155240 { 584ab25eeb5Syz155240 u_short sumshort; 585ab25eeb5Syz155240 u_32_t sum1; 586ab25eeb5Syz155240 587ab25eeb5Syz155240 if (n == 0) 588ab25eeb5Syz155240 return; 589ab25eeb5Syz155240 590ab25eeb5Syz155240 sum1 = (~ntohs(*sp)) & 0xffff; 591ab25eeb5Syz155240 sum1 += (n); 592ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 593ab25eeb5Syz155240 /* Again */ 594ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 595ab25eeb5Syz155240 sumshort = ~(u_short)sum1; 596ab25eeb5Syz155240 *(sp) = htons(sumshort); 597ab25eeb5Syz155240 } 598ab25eeb5Syz155240 599ab25eeb5Syz155240 600ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 601ab25eeb5Syz155240 /* Function: fr_nat_ioctl */ 602ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 603ab25eeb5Syz155240 /* Parameters: data(I) - pointer to ioctl data */ 604ab25eeb5Syz155240 /* cmd(I) - ioctl command integer */ 605ab25eeb5Syz155240 /* mode(I) - file mode bits used with open */ 606ab25eeb5Syz155240 /* */ 607ab25eeb5Syz155240 /* Processes an ioctl call made to operate on the IP Filter NAT device. */ 608ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 609f4b3ec61Sdh155122 int fr_nat_ioctl(data, cmd, mode, uid, ctx, ifs) 610ab25eeb5Syz155240 ioctlcmd_t cmd; 611ab25eeb5Syz155240 caddr_t data; 612f4b3ec61Sdh155122 int mode, uid; 613f4b3ec61Sdh155122 void *ctx; 614f4b3ec61Sdh155122 ipf_stack_t *ifs; 615ab25eeb5Syz155240 { 616ab25eeb5Syz155240 ipnat_t *nat, *nt, *n = NULL, **np = NULL; 617ab25eeb5Syz155240 int error = 0, ret, arg, getlock; 618ab25eeb5Syz155240 ipnat_t natd; 619ab25eeb5Syz155240 620ab25eeb5Syz155240 #if (BSD >= 199306) && defined(_KERNEL) 621ab25eeb5Syz155240 if ((securelevel >= 2) && (mode & FWRITE)) 622ab25eeb5Syz155240 return EPERM; 623ab25eeb5Syz155240 #endif 624ab25eeb5Syz155240 625ab25eeb5Syz155240 #if defined(__osf__) && defined(_KERNEL) 626ab25eeb5Syz155240 getlock = 0; 627ab25eeb5Syz155240 #else 628ab25eeb5Syz155240 getlock = (mode & NAT_LOCKHELD) ? 0 : 1; 629ab25eeb5Syz155240 #endif 630ab25eeb5Syz155240 631ab25eeb5Syz155240 nat = NULL; /* XXX gcc -Wuninitialized */ 632ab25eeb5Syz155240 if (cmd == (ioctlcmd_t)SIOCADNAT) { 633ab25eeb5Syz155240 KMALLOC(nt, ipnat_t *); 634ab25eeb5Syz155240 } else { 635ab25eeb5Syz155240 nt = NULL; 636ab25eeb5Syz155240 } 637ab25eeb5Syz155240 638ab25eeb5Syz155240 if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) { 639ab25eeb5Syz155240 if (mode & NAT_SYSSPACE) { 640ab25eeb5Syz155240 bcopy(data, (char *)&natd, sizeof(natd)); 641ab25eeb5Syz155240 error = 0; 642ab25eeb5Syz155240 } else { 643ab25eeb5Syz155240 error = fr_inobj(data, &natd, IPFOBJ_IPNAT); 644ab25eeb5Syz155240 } 645ab25eeb5Syz155240 646ab25eeb5Syz155240 } else if (cmd == (ioctlcmd_t)SIOCIPFFL) { /* SIOCFLNAT & SIOCCNATL */ 647ab25eeb5Syz155240 BCOPYIN(data, &arg, sizeof(arg)); 648ab25eeb5Syz155240 } 649ab25eeb5Syz155240 650ab25eeb5Syz155240 if (error != 0) 651ab25eeb5Syz155240 goto done; 652ab25eeb5Syz155240 653ab25eeb5Syz155240 /* 654ab25eeb5Syz155240 * For add/delete, look to see if the NAT entry is already present 655ab25eeb5Syz155240 */ 656ab25eeb5Syz155240 if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) { 657ab25eeb5Syz155240 nat = &natd; 658ab25eeb5Syz155240 if (nat->in_v == 0) /* For backward compat. */ 659ab25eeb5Syz155240 nat->in_v = 4; 660ab25eeb5Syz155240 nat->in_flags &= IPN_USERFLAGS; 661ab25eeb5Syz155240 if ((nat->in_redir & NAT_MAPBLK) == 0) { 662ab25eeb5Syz155240 if ((nat->in_flags & IPN_SPLIT) == 0) 663ab25eeb5Syz155240 nat->in_inip &= nat->in_inmsk; 664ab25eeb5Syz155240 if ((nat->in_flags & IPN_IPRANGE) == 0) 665ab25eeb5Syz155240 nat->in_outip &= nat->in_outmsk; 666ab25eeb5Syz155240 } 667f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_natio); 668f4b3ec61Sdh155122 for (np = &ifs->ifs_nat_list; ((n = *np) != NULL); 669f4b3ec61Sdh155122 np = &n->in_next) 670ab25eeb5Syz155240 if (!bcmp((char *)&nat->in_flags, (char *)&n->in_flags, 671ab25eeb5Syz155240 IPN_CMPSIZ)) 672ab25eeb5Syz155240 break; 673ab25eeb5Syz155240 } 674ab25eeb5Syz155240 675ab25eeb5Syz155240 switch (cmd) 676ab25eeb5Syz155240 { 677f4b3ec61Sdh155122 case SIOCGENITER : 678f4b3ec61Sdh155122 { 679f4b3ec61Sdh155122 ipfgeniter_t iter; 680f4b3ec61Sdh155122 ipftoken_t *token; 681f4b3ec61Sdh155122 682f4b3ec61Sdh155122 error = fr_inobj(data, &iter, IPFOBJ_GENITER); 683f4b3ec61Sdh155122 if (error != 0) 684f4b3ec61Sdh155122 break; 685f4b3ec61Sdh155122 686f4b3ec61Sdh155122 token = ipf_findtoken(iter.igi_type, uid, ctx, ifs); 687f4b3ec61Sdh155122 if (token != NULL) 688f4b3ec61Sdh155122 error = nat_iterator(token, &iter, ifs); 689f4b3ec61Sdh155122 else 690f4b3ec61Sdh155122 error = ESRCH; 691f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_tokens); 692f4b3ec61Sdh155122 break; 693f4b3ec61Sdh155122 } 694ab25eeb5Syz155240 #ifdef IPFILTER_LOG 695ab25eeb5Syz155240 case SIOCIPFFB : 696ab25eeb5Syz155240 { 697ab25eeb5Syz155240 int tmp; 698ab25eeb5Syz155240 699ab25eeb5Syz155240 if (!(mode & FWRITE)) 700ab25eeb5Syz155240 error = EPERM; 701ab25eeb5Syz155240 else { 702f4b3ec61Sdh155122 tmp = ipflog_clear(IPL_LOGNAT, ifs); 703ab25eeb5Syz155240 BCOPYOUT((char *)&tmp, (char *)data, sizeof(tmp)); 704ab25eeb5Syz155240 } 705ab25eeb5Syz155240 break; 706ab25eeb5Syz155240 } 707ab25eeb5Syz155240 case SIOCSETLG : 708ab25eeb5Syz155240 if (!(mode & FWRITE)) 709ab25eeb5Syz155240 error = EPERM; 710ab25eeb5Syz155240 else { 711f4b3ec61Sdh155122 BCOPYIN((char *)data, 712f4b3ec61Sdh155122 (char *)&ifs->ifs_nat_logging, 713f4b3ec61Sdh155122 sizeof(ifs->ifs_nat_logging)); 714ab25eeb5Syz155240 } 715ab25eeb5Syz155240 break; 716ab25eeb5Syz155240 case SIOCGETLG : 717f4b3ec61Sdh155122 BCOPYOUT((char *)&ifs->ifs_nat_logging, (char *)data, 718f4b3ec61Sdh155122 sizeof(ifs->ifs_nat_logging)); 719ab25eeb5Syz155240 break; 720ab25eeb5Syz155240 case FIONREAD : 721f4b3ec61Sdh155122 arg = ifs->ifs_iplused[IPL_LOGNAT]; 722ab25eeb5Syz155240 BCOPYOUT(&arg, data, sizeof(arg)); 723ab25eeb5Syz155240 break; 724ab25eeb5Syz155240 #endif 725ab25eeb5Syz155240 case SIOCADNAT : 726ab25eeb5Syz155240 if (!(mode & FWRITE)) { 727ab25eeb5Syz155240 error = EPERM; 728ab25eeb5Syz155240 } else if (n != NULL) { 729ab25eeb5Syz155240 error = EEXIST; 730ab25eeb5Syz155240 } else if (nt == NULL) { 731ab25eeb5Syz155240 error = ENOMEM; 732ab25eeb5Syz155240 } 733ab25eeb5Syz155240 if (error != 0) { 734f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_natio); 735ab25eeb5Syz155240 break; 736ab25eeb5Syz155240 } 737ab25eeb5Syz155240 bcopy((char *)nat, (char *)nt, sizeof(*n)); 738f4b3ec61Sdh155122 error = nat_siocaddnat(nt, np, getlock, ifs); 739f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_natio); 740ab25eeb5Syz155240 if (error == 0) 741ab25eeb5Syz155240 nt = NULL; 742ab25eeb5Syz155240 break; 743ab25eeb5Syz155240 case SIOCRMNAT : 744ab25eeb5Syz155240 if (!(mode & FWRITE)) { 745ab25eeb5Syz155240 error = EPERM; 746ab25eeb5Syz155240 n = NULL; 747ab25eeb5Syz155240 } else if (n == NULL) { 748ab25eeb5Syz155240 error = ESRCH; 749ab25eeb5Syz155240 } 750ab25eeb5Syz155240 751ab25eeb5Syz155240 if (error != 0) { 752f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_natio); 753ab25eeb5Syz155240 break; 754ab25eeb5Syz155240 } 755f4b3ec61Sdh155122 nat_siocdelnat(n, np, getlock, ifs); 756ab25eeb5Syz155240 757f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_natio); 758ab25eeb5Syz155240 n = NULL; 759ab25eeb5Syz155240 break; 760ab25eeb5Syz155240 case SIOCGNATS : 761f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_table[0] = ifs->ifs_nat_table[0]; 762f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_table[1] = ifs->ifs_nat_table[1]; 763f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_list = ifs->ifs_nat_list; 764f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_maptable = ifs->ifs_maptable; 765f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_maplist = ifs->ifs_ipf_hm_maplist; 766f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_nattab_max = ifs->ifs_ipf_nattable_max; 767f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_nattab_sz = ifs->ifs_ipf_nattable_sz; 768f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rultab_sz = ifs->ifs_ipf_natrules_sz; 769f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rdrtab_sz = ifs->ifs_ipf_rdrrules_sz; 770f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_hostmap_sz = ifs->ifs_ipf_hostmap_sz; 771f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_instances = ifs->ifs_nat_instances; 772f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_apslist = ifs->ifs_ap_sess_list; 773f4b3ec61Sdh155122 error = fr_outobj(data, &ifs->ifs_nat_stats, IPFOBJ_NATSTAT); 774ab25eeb5Syz155240 break; 775ab25eeb5Syz155240 case SIOCGNATL : 776ab25eeb5Syz155240 { 777ab25eeb5Syz155240 natlookup_t nl; 778ab25eeb5Syz155240 779ab25eeb5Syz155240 if (getlock) { 780f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 781ab25eeb5Syz155240 } 782ab25eeb5Syz155240 error = fr_inobj(data, &nl, IPFOBJ_NATLOOKUP); 783ab25eeb5Syz155240 if (error == 0) { 784f4b3ec61Sdh155122 if (nat_lookupredir(&nl, ifs) != NULL) { 785ab25eeb5Syz155240 error = fr_outobj(data, &nl, IPFOBJ_NATLOOKUP); 786ab25eeb5Syz155240 } else { 787ab25eeb5Syz155240 error = ESRCH; 788ab25eeb5Syz155240 } 789ab25eeb5Syz155240 } 790ab25eeb5Syz155240 if (getlock) { 791f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 792ab25eeb5Syz155240 } 793ab25eeb5Syz155240 break; 794ab25eeb5Syz155240 } 795ab25eeb5Syz155240 case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */ 796ab25eeb5Syz155240 if (!(mode & FWRITE)) { 797ab25eeb5Syz155240 error = EPERM; 798ab25eeb5Syz155240 break; 799ab25eeb5Syz155240 } 800ab25eeb5Syz155240 if (getlock) { 801f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 802ab25eeb5Syz155240 } 803ab25eeb5Syz155240 error = 0; 804ab25eeb5Syz155240 if (arg == 0) 805f4b3ec61Sdh155122 ret = nat_flushtable(ifs); 806ab25eeb5Syz155240 else if (arg == 1) 807f4b3ec61Sdh155122 ret = nat_clearlist(ifs); 808ab25eeb5Syz155240 else 809ab25eeb5Syz155240 error = EINVAL; 810ab25eeb5Syz155240 if (getlock) { 811f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 812ab25eeb5Syz155240 } 813ab25eeb5Syz155240 if (error == 0) { 814ab25eeb5Syz155240 BCOPYOUT(&ret, data, sizeof(ret)); 815ab25eeb5Syz155240 } 816ab25eeb5Syz155240 break; 817ab25eeb5Syz155240 case SIOCPROXY : 818f4b3ec61Sdh155122 error = appr_ioctl(data, cmd, mode, ifs); 819ab25eeb5Syz155240 break; 820ab25eeb5Syz155240 case SIOCSTLCK : 821ab25eeb5Syz155240 if (!(mode & FWRITE)) { 822ab25eeb5Syz155240 error = EPERM; 823ab25eeb5Syz155240 } else { 824f4b3ec61Sdh155122 fr_lock(data, &ifs->ifs_fr_nat_lock); 825ab25eeb5Syz155240 } 826ab25eeb5Syz155240 break; 827ab25eeb5Syz155240 case SIOCSTPUT : 8283c3c3491Sjojemann if ((mode & FWRITE) != 0) { 829f4b3ec61Sdh155122 error = fr_natputent(data, getlock, ifs); 830ab25eeb5Syz155240 } else { 831ab25eeb5Syz155240 error = EACCES; 832ab25eeb5Syz155240 } 833ab25eeb5Syz155240 break; 834ab25eeb5Syz155240 case SIOCSTGSZ : 835f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_lock) { 836ab25eeb5Syz155240 if (getlock) { 837f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 838ab25eeb5Syz155240 } 839f4b3ec61Sdh155122 error = fr_natgetsz(data, ifs); 840ab25eeb5Syz155240 if (getlock) { 841f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 842ab25eeb5Syz155240 } 843ab25eeb5Syz155240 } else 844ab25eeb5Syz155240 error = EACCES; 845ab25eeb5Syz155240 break; 846ab25eeb5Syz155240 case SIOCSTGET : 847f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_lock) { 848ab25eeb5Syz155240 if (getlock) { 849f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 850ab25eeb5Syz155240 } 851f4b3ec61Sdh155122 error = fr_natgetent(data, ifs); 852ab25eeb5Syz155240 if (getlock) { 853f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 854ab25eeb5Syz155240 } 855ab25eeb5Syz155240 } else 856ab25eeb5Syz155240 error = EACCES; 857ab25eeb5Syz155240 break; 858f4b3ec61Sdh155122 case SIOCIPFDELTOK : 859f4b3ec61Sdh155122 (void) BCOPYIN((caddr_t)data, (caddr_t)&arg, sizeof(arg)); 860f4b3ec61Sdh155122 error = ipf_deltoken(arg, uid, ctx, ifs); 861f4b3ec61Sdh155122 break; 862ab25eeb5Syz155240 default : 863ab25eeb5Syz155240 error = EINVAL; 864ab25eeb5Syz155240 break; 865ab25eeb5Syz155240 } 866ab25eeb5Syz155240 done: 867ab25eeb5Syz155240 if (nt) 868ab25eeb5Syz155240 KFREE(nt); 869ab25eeb5Syz155240 return error; 870ab25eeb5Syz155240 } 871ab25eeb5Syz155240 872ab25eeb5Syz155240 873ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 874ab25eeb5Syz155240 /* Function: nat_siocaddnat */ 875ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 876ab25eeb5Syz155240 /* Parameters: n(I) - pointer to new NAT rule */ 877ab25eeb5Syz155240 /* np(I) - pointer to where to insert new NAT rule */ 878ab25eeb5Syz155240 /* getlock(I) - flag indicating if lock on ipf_nat is held */ 879ab25eeb5Syz155240 /* Mutex Locks: ipf_natio */ 880ab25eeb5Syz155240 /* */ 881ab25eeb5Syz155240 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */ 882ab25eeb5Syz155240 /* from information passed to the kernel, then add it to the appropriate */ 883ab25eeb5Syz155240 /* NAT rule table(s). */ 884ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 885f4b3ec61Sdh155122 static int nat_siocaddnat(n, np, getlock, ifs) 886ab25eeb5Syz155240 ipnat_t *n, **np; 887ab25eeb5Syz155240 int getlock; 888f4b3ec61Sdh155122 ipf_stack_t *ifs; 889ab25eeb5Syz155240 { 890ab25eeb5Syz155240 int error = 0, i, j; 891ab25eeb5Syz155240 892dcf3e898Sjojemann if (nat_resolverule(n, ifs) != 0) 893ab25eeb5Syz155240 return ENOENT; 894ab25eeb5Syz155240 895ab25eeb5Syz155240 if ((n->in_age[0] == 0) && (n->in_age[1] != 0)) 896ab25eeb5Syz155240 return EINVAL; 897ab25eeb5Syz155240 898ab25eeb5Syz155240 n->in_use = 0; 899ab25eeb5Syz155240 if (n->in_redir & NAT_MAPBLK) 900ab25eeb5Syz155240 n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk); 901ab25eeb5Syz155240 else if (n->in_flags & IPN_AUTOPORTMAP) 902ab25eeb5Syz155240 n->in_space = USABLE_PORTS * ~ntohl(n->in_inmsk); 903ab25eeb5Syz155240 else if (n->in_flags & IPN_IPRANGE) 904ab25eeb5Syz155240 n->in_space = ntohl(n->in_outmsk) - ntohl(n->in_outip); 905ab25eeb5Syz155240 else if (n->in_flags & IPN_SPLIT) 906ab25eeb5Syz155240 n->in_space = 2; 907ab25eeb5Syz155240 else if (n->in_outmsk != 0) 908ab25eeb5Syz155240 n->in_space = ~ntohl(n->in_outmsk); 909ab25eeb5Syz155240 else 910ab25eeb5Syz155240 n->in_space = 1; 911ab25eeb5Syz155240 912ab25eeb5Syz155240 /* 913ab25eeb5Syz155240 * Calculate the number of valid IP addresses in the output 914ab25eeb5Syz155240 * mapping range. In all cases, the range is inclusive of 915ab25eeb5Syz155240 * the start and ending IP addresses. 916ab25eeb5Syz155240 * If to a CIDR address, lose 2: broadcast + network address 917ab25eeb5Syz155240 * (so subtract 1) 918ab25eeb5Syz155240 * If to a range, add one. 919ab25eeb5Syz155240 * If to a single IP address, set to 1. 920ab25eeb5Syz155240 */ 921ab25eeb5Syz155240 if (n->in_space) { 922ab25eeb5Syz155240 if ((n->in_flags & IPN_IPRANGE) != 0) 923ab25eeb5Syz155240 n->in_space += 1; 924ab25eeb5Syz155240 else 925ab25eeb5Syz155240 n->in_space -= 1; 926ab25eeb5Syz155240 } else 927ab25eeb5Syz155240 n->in_space = 1; 928ab25eeb5Syz155240 929ab25eeb5Syz155240 if ((n->in_outmsk != 0xffffffff) && (n->in_outmsk != 0) && 930ab25eeb5Syz155240 ((n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0)) 931ab25eeb5Syz155240 n->in_nip = ntohl(n->in_outip) + 1; 932ab25eeb5Syz155240 else if ((n->in_flags & IPN_SPLIT) && 933ab25eeb5Syz155240 (n->in_redir & NAT_REDIRECT)) 934ab25eeb5Syz155240 n->in_nip = ntohl(n->in_inip); 935ab25eeb5Syz155240 else 936ab25eeb5Syz155240 n->in_nip = ntohl(n->in_outip); 937ab25eeb5Syz155240 if (n->in_redir & NAT_MAP) { 938ab25eeb5Syz155240 n->in_pnext = ntohs(n->in_pmin); 939ab25eeb5Syz155240 /* 940ab25eeb5Syz155240 * Multiply by the number of ports made available. 941ab25eeb5Syz155240 */ 942ab25eeb5Syz155240 if (ntohs(n->in_pmax) >= ntohs(n->in_pmin)) { 943ab25eeb5Syz155240 n->in_space *= (ntohs(n->in_pmax) - 944ab25eeb5Syz155240 ntohs(n->in_pmin) + 1); 945ab25eeb5Syz155240 /* 946ab25eeb5Syz155240 * Because two different sources can map to 947ab25eeb5Syz155240 * different destinations but use the same 948ab25eeb5Syz155240 * local IP#/port #. 949ab25eeb5Syz155240 * If the result is smaller than in_space, then 950ab25eeb5Syz155240 * we may have wrapped around 32bits. 951ab25eeb5Syz155240 */ 952ab25eeb5Syz155240 i = n->in_inmsk; 953ab25eeb5Syz155240 if ((i != 0) && (i != 0xffffffff)) { 954ab25eeb5Syz155240 j = n->in_space * (~ntohl(i) + 1); 955ab25eeb5Syz155240 if (j >= n->in_space) 956ab25eeb5Syz155240 n->in_space = j; 957ab25eeb5Syz155240 else 958ab25eeb5Syz155240 n->in_space = 0xffffffff; 959ab25eeb5Syz155240 } 960ab25eeb5Syz155240 } 961ab25eeb5Syz155240 /* 962ab25eeb5Syz155240 * If no protocol is specified, multiple by 256 to allow for 963ab25eeb5Syz155240 * at least one IP:IP mapping per protocol. 964ab25eeb5Syz155240 */ 965ab25eeb5Syz155240 if ((n->in_flags & IPN_TCPUDPICMP) == 0) { 966ab25eeb5Syz155240 j = n->in_space * 256; 967ab25eeb5Syz155240 if (j >= n->in_space) 968ab25eeb5Syz155240 n->in_space = j; 969ab25eeb5Syz155240 else 970ab25eeb5Syz155240 n->in_space = 0xffffffff; 971ab25eeb5Syz155240 } 972ab25eeb5Syz155240 } 973ab25eeb5Syz155240 974ab25eeb5Syz155240 /* Otherwise, these fields are preset */ 975ab25eeb5Syz155240 976ab25eeb5Syz155240 if (getlock) { 977f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 978ab25eeb5Syz155240 } 979ab25eeb5Syz155240 n->in_next = NULL; 980ab25eeb5Syz155240 *np = n; 981ab25eeb5Syz155240 982ab25eeb5Syz155240 if (n->in_age[0] != 0) 983f4b3ec61Sdh155122 n->in_tqehead[0] = fr_addtimeoutqueue(&ifs->ifs_nat_utqe, 984f4b3ec61Sdh155122 n->in_age[0], ifs); 985ab25eeb5Syz155240 986ab25eeb5Syz155240 if (n->in_age[1] != 0) 987f4b3ec61Sdh155122 n->in_tqehead[1] = fr_addtimeoutqueue(&ifs->ifs_nat_utqe, 988f4b3ec61Sdh155122 n->in_age[1], ifs); 989ab25eeb5Syz155240 990ab25eeb5Syz155240 if (n->in_redir & NAT_REDIRECT) { 991ab25eeb5Syz155240 n->in_flags &= ~IPN_NOTDST; 992f4b3ec61Sdh155122 nat_addrdr(n, ifs); 993ab25eeb5Syz155240 } 994ab25eeb5Syz155240 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) { 995ab25eeb5Syz155240 n->in_flags &= ~IPN_NOTSRC; 996f4b3ec61Sdh155122 nat_addnat(n, ifs); 997ab25eeb5Syz155240 } 998ab25eeb5Syz155240 n = NULL; 999f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules++; 1000ab25eeb5Syz155240 if (getlock) { 1001f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); /* WRITE */ 1002ab25eeb5Syz155240 } 1003ab25eeb5Syz155240 1004ab25eeb5Syz155240 return error; 1005ab25eeb5Syz155240 } 1006ab25eeb5Syz155240 1007ab25eeb5Syz155240 1008ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1009ab25eeb5Syz155240 /* Function: nat_resolvrule */ 1010dcf3e898Sjojemann /* Returns: int - 0 == success, -1 == failure */ 1011ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule */ 1012ab25eeb5Syz155240 /* */ 1013dcf3e898Sjojemann /* Resolve some of the details inside the NAT rule. Includes resolving */ 1014dcf3e898Sjojemann /* any specified interfaces and proxy labels, and determines whether or not */ 1015dcf3e898Sjojemann /* all proxy labels are correctly specified. */ 1016dcf3e898Sjojemann /* */ 1017dcf3e898Sjojemann /* Called by nat_siocaddnat() (SIOCADNAT) and fr_natputent (SIOCSTPUT). */ 1018ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1019dcf3e898Sjojemann static int nat_resolverule(n, ifs) 1020ab25eeb5Syz155240 ipnat_t *n; 1021f4b3ec61Sdh155122 ipf_stack_t *ifs; 1022ab25eeb5Syz155240 { 1023ab25eeb5Syz155240 n->in_ifnames[0][LIFNAMSIZ - 1] = '\0'; 1024f4b3ec61Sdh155122 n->in_ifps[0] = fr_resolvenic(n->in_ifnames[0], 4, ifs); 1025ab25eeb5Syz155240 1026ab25eeb5Syz155240 n->in_ifnames[1][LIFNAMSIZ - 1] = '\0'; 1027ab25eeb5Syz155240 if (n->in_ifnames[1][0] == '\0') { 1028ab25eeb5Syz155240 (void) strncpy(n->in_ifnames[1], n->in_ifnames[0], LIFNAMSIZ); 1029ab25eeb5Syz155240 n->in_ifps[1] = n->in_ifps[0]; 1030ab25eeb5Syz155240 } else { 1031d3675867Sjojemann n->in_ifps[1] = fr_resolvenic(n->in_ifnames[1], 4, ifs); 1032ab25eeb5Syz155240 } 1033ab25eeb5Syz155240 1034ab25eeb5Syz155240 if (n->in_plabel[0] != '\0') { 1035f4b3ec61Sdh155122 n->in_apr = appr_lookup(n->in_p, n->in_plabel, ifs); 1036dcf3e898Sjojemann if (n->in_apr == NULL) 1037dcf3e898Sjojemann return -1; 1038ab25eeb5Syz155240 } 1039dcf3e898Sjojemann return 0; 1040ab25eeb5Syz155240 } 1041ab25eeb5Syz155240 1042ab25eeb5Syz155240 1043ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1044ab25eeb5Syz155240 /* Function: nat_siocdelnat */ 1045ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 1046ab25eeb5Syz155240 /* Parameters: n(I) - pointer to new NAT rule */ 1047ab25eeb5Syz155240 /* np(I) - pointer to where to insert new NAT rule */ 1048ab25eeb5Syz155240 /* getlock(I) - flag indicating if lock on ipf_nat is held */ 1049ab25eeb5Syz155240 /* Mutex Locks: ipf_natio */ 1050ab25eeb5Syz155240 /* */ 1051ab25eeb5Syz155240 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */ 1052ab25eeb5Syz155240 /* from information passed to the kernel, then add it to the appropriate */ 1053ab25eeb5Syz155240 /* NAT rule table(s). */ 1054ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1055f4b3ec61Sdh155122 static void nat_siocdelnat(n, np, getlock, ifs) 1056ab25eeb5Syz155240 ipnat_t *n, **np; 1057ab25eeb5Syz155240 int getlock; 1058f4b3ec61Sdh155122 ipf_stack_t *ifs; 1059ab25eeb5Syz155240 { 1060ab25eeb5Syz155240 if (getlock) { 1061f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 1062ab25eeb5Syz155240 } 1063ab25eeb5Syz155240 if (n->in_redir & NAT_REDIRECT) 1064ab25eeb5Syz155240 nat_delrdr(n); 1065ab25eeb5Syz155240 if (n->in_redir & (NAT_MAPBLK|NAT_MAP)) 1066ab25eeb5Syz155240 nat_delnat(n); 1067f4b3ec61Sdh155122 if (ifs->ifs_nat_list == NULL) { 1068f4b3ec61Sdh155122 ifs->ifs_nat_masks = 0; 1069f4b3ec61Sdh155122 ifs->ifs_rdr_masks = 0; 1070ab25eeb5Syz155240 } 1071ab25eeb5Syz155240 1072ab25eeb5Syz155240 if (n->in_tqehead[0] != NULL) { 1073ab25eeb5Syz155240 if (fr_deletetimeoutqueue(n->in_tqehead[0]) == 0) { 1074f4b3ec61Sdh155122 fr_freetimeoutqueue(n->in_tqehead[1], ifs); 1075ab25eeb5Syz155240 } 1076ab25eeb5Syz155240 } 1077ab25eeb5Syz155240 1078ab25eeb5Syz155240 if (n->in_tqehead[1] != NULL) { 1079ab25eeb5Syz155240 if (fr_deletetimeoutqueue(n->in_tqehead[1]) == 0) { 1080f4b3ec61Sdh155122 fr_freetimeoutqueue(n->in_tqehead[1], ifs); 1081ab25eeb5Syz155240 } 1082ab25eeb5Syz155240 } 1083ab25eeb5Syz155240 1084ab25eeb5Syz155240 *np = n->in_next; 1085ab25eeb5Syz155240 1086ab25eeb5Syz155240 if (n->in_use == 0) { 1087ab25eeb5Syz155240 if (n->in_apr) 1088ab25eeb5Syz155240 appr_free(n->in_apr); 1089ab25eeb5Syz155240 KFREE(n); 1090f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules--; 1091ab25eeb5Syz155240 } else { 1092ab25eeb5Syz155240 n->in_flags |= IPN_DELETE; 1093ab25eeb5Syz155240 n->in_next = NULL; 1094ab25eeb5Syz155240 } 1095ab25eeb5Syz155240 if (getlock) { 1096f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); /* READ/WRITE */ 1097ab25eeb5Syz155240 } 1098ab25eeb5Syz155240 } 1099ab25eeb5Syz155240 1100ab25eeb5Syz155240 1101ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1102ab25eeb5Syz155240 /* Function: fr_natgetsz */ 1103ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 is the error value. */ 1104ab25eeb5Syz155240 /* Parameters: data(I) - pointer to natget structure with kernel pointer */ 1105ab25eeb5Syz155240 /* get the size of. */ 1106ab25eeb5Syz155240 /* */ 1107ab25eeb5Syz155240 /* Handle SIOCSTGSZ. */ 1108ab25eeb5Syz155240 /* Return the size of the nat list entry to be copied back to user space. */ 1109ab25eeb5Syz155240 /* The size of the entry is stored in the ng_sz field and the enture natget */ 1110ab25eeb5Syz155240 /* structure is copied back to the user. */ 1111ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1112f4b3ec61Sdh155122 static int fr_natgetsz(data, ifs) 1113ab25eeb5Syz155240 caddr_t data; 1114f4b3ec61Sdh155122 ipf_stack_t *ifs; 1115ab25eeb5Syz155240 { 1116ab25eeb5Syz155240 ap_session_t *aps; 1117ab25eeb5Syz155240 nat_t *nat, *n; 1118ab25eeb5Syz155240 natget_t ng; 1119ab25eeb5Syz155240 1120ab25eeb5Syz155240 BCOPYIN(data, &ng, sizeof(ng)); 1121ab25eeb5Syz155240 1122ab25eeb5Syz155240 nat = ng.ng_ptr; 1123ab25eeb5Syz155240 if (!nat) { 1124f4b3ec61Sdh155122 nat = ifs->ifs_nat_instances; 1125ab25eeb5Syz155240 ng.ng_sz = 0; 1126ab25eeb5Syz155240 /* 1127ab25eeb5Syz155240 * Empty list so the size returned is 0. Simple. 1128ab25eeb5Syz155240 */ 1129ab25eeb5Syz155240 if (nat == NULL) { 1130ab25eeb5Syz155240 BCOPYOUT(&ng, data, sizeof(ng)); 1131ab25eeb5Syz155240 return 0; 1132ab25eeb5Syz155240 } 1133ab25eeb5Syz155240 } else { 1134ab25eeb5Syz155240 /* 1135ab25eeb5Syz155240 * Make sure the pointer we're copying from exists in the 1136ab25eeb5Syz155240 * current list of entries. Security precaution to prevent 1137ab25eeb5Syz155240 * copying of random kernel data. 1138ab25eeb5Syz155240 */ 1139f4b3ec61Sdh155122 for (n = ifs->ifs_nat_instances; n; n = n->nat_next) 1140ab25eeb5Syz155240 if (n == nat) 1141ab25eeb5Syz155240 break; 1142ab25eeb5Syz155240 if (!n) 1143ab25eeb5Syz155240 return ESRCH; 1144ab25eeb5Syz155240 } 1145ab25eeb5Syz155240 1146ab25eeb5Syz155240 /* 1147ab25eeb5Syz155240 * Incluse any space required for proxy data structures. 1148ab25eeb5Syz155240 */ 1149ab25eeb5Syz155240 ng.ng_sz = sizeof(nat_save_t); 1150ab25eeb5Syz155240 aps = nat->nat_aps; 1151ab25eeb5Syz155240 if (aps != NULL) { 1152ab25eeb5Syz155240 ng.ng_sz += sizeof(ap_session_t) - 4; 1153ab25eeb5Syz155240 if (aps->aps_data != 0) 1154ab25eeb5Syz155240 ng.ng_sz += aps->aps_psiz; 1155ab25eeb5Syz155240 } 1156ab25eeb5Syz155240 1157ab25eeb5Syz155240 BCOPYOUT(&ng, data, sizeof(ng)); 1158ab25eeb5Syz155240 return 0; 1159ab25eeb5Syz155240 } 1160ab25eeb5Syz155240 1161ab25eeb5Syz155240 1162ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1163ab25eeb5Syz155240 /* Function: fr_natgetent */ 1164ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 is the error value. */ 1165ab25eeb5Syz155240 /* Parameters: data(I) - pointer to natget structure with kernel pointer */ 1166ab25eeb5Syz155240 /* to NAT structure to copy out. */ 1167ab25eeb5Syz155240 /* */ 1168ab25eeb5Syz155240 /* Handle SIOCSTGET. */ 1169ab25eeb5Syz155240 /* Copies out NAT entry to user space. Any additional data held for a */ 1170ab25eeb5Syz155240 /* proxy is also copied, as to is the NAT rule which was responsible for it */ 1171ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1172f4b3ec61Sdh155122 static int fr_natgetent(data, ifs) 1173ab25eeb5Syz155240 caddr_t data; 1174f4b3ec61Sdh155122 ipf_stack_t *ifs; 1175ab25eeb5Syz155240 { 1176ab25eeb5Syz155240 int error, outsize; 1177ab25eeb5Syz155240 ap_session_t *aps; 1178ab25eeb5Syz155240 nat_save_t *ipn, ipns; 1179ab25eeb5Syz155240 nat_t *n, *nat; 1180ab25eeb5Syz155240 1181ab25eeb5Syz155240 error = fr_inobj(data, &ipns, IPFOBJ_NATSAVE); 1182ab25eeb5Syz155240 if (error != 0) 1183ab25eeb5Syz155240 return error; 1184ab25eeb5Syz155240 1185ab25eeb5Syz155240 if ((ipns.ipn_dsize < sizeof(ipns)) || (ipns.ipn_dsize > 81920)) 1186ab25eeb5Syz155240 return EINVAL; 1187ab25eeb5Syz155240 1188ab25eeb5Syz155240 KMALLOCS(ipn, nat_save_t *, ipns.ipn_dsize); 1189ab25eeb5Syz155240 if (ipn == NULL) 1190ab25eeb5Syz155240 return ENOMEM; 1191ab25eeb5Syz155240 1192ab25eeb5Syz155240 ipn->ipn_dsize = ipns.ipn_dsize; 1193ab25eeb5Syz155240 nat = ipns.ipn_next; 1194ab25eeb5Syz155240 if (nat == NULL) { 1195f4b3ec61Sdh155122 nat = ifs->ifs_nat_instances; 1196ab25eeb5Syz155240 if (nat == NULL) { 1197f4b3ec61Sdh155122 if (ifs->ifs_nat_instances == NULL) 1198ab25eeb5Syz155240 error = ENOENT; 1199ab25eeb5Syz155240 goto finished; 1200ab25eeb5Syz155240 } 1201ab25eeb5Syz155240 } else { 1202ab25eeb5Syz155240 /* 1203ab25eeb5Syz155240 * Make sure the pointer we're copying from exists in the 1204ab25eeb5Syz155240 * current list of entries. Security precaution to prevent 1205ab25eeb5Syz155240 * copying of random kernel data. 1206ab25eeb5Syz155240 */ 1207f4b3ec61Sdh155122 for (n = ifs->ifs_nat_instances; n; n = n->nat_next) 1208ab25eeb5Syz155240 if (n == nat) 1209ab25eeb5Syz155240 break; 1210ab25eeb5Syz155240 if (n == NULL) { 1211ab25eeb5Syz155240 error = ESRCH; 1212ab25eeb5Syz155240 goto finished; 1213ab25eeb5Syz155240 } 1214ab25eeb5Syz155240 } 1215ab25eeb5Syz155240 ipn->ipn_next = nat->nat_next; 1216ab25eeb5Syz155240 1217ab25eeb5Syz155240 /* 1218ab25eeb5Syz155240 * Copy the NAT structure. 1219ab25eeb5Syz155240 */ 1220ab25eeb5Syz155240 bcopy((char *)nat, &ipn->ipn_nat, sizeof(*nat)); 1221ab25eeb5Syz155240 1222ab25eeb5Syz155240 /* 1223ab25eeb5Syz155240 * If we have a pointer to the NAT rule it belongs to, save that too. 1224ab25eeb5Syz155240 */ 1225ab25eeb5Syz155240 if (nat->nat_ptr != NULL) 1226ab25eeb5Syz155240 bcopy((char *)nat->nat_ptr, (char *)&ipn->ipn_ipnat, 1227ab25eeb5Syz155240 sizeof(ipn->ipn_ipnat)); 1228ab25eeb5Syz155240 1229ab25eeb5Syz155240 /* 1230ab25eeb5Syz155240 * If we also know the NAT entry has an associated filter rule, 1231ab25eeb5Syz155240 * save that too. 1232ab25eeb5Syz155240 */ 1233ab25eeb5Syz155240 if (nat->nat_fr != NULL) 1234ab25eeb5Syz155240 bcopy((char *)nat->nat_fr, (char *)&ipn->ipn_fr, 1235ab25eeb5Syz155240 sizeof(ipn->ipn_fr)); 1236ab25eeb5Syz155240 1237ab25eeb5Syz155240 /* 1238ab25eeb5Syz155240 * Last but not least, if there is an application proxy session set 1239ab25eeb5Syz155240 * up for this NAT entry, then copy that out too, including any 1240ab25eeb5Syz155240 * private data saved along side it by the proxy. 1241ab25eeb5Syz155240 */ 1242ab25eeb5Syz155240 aps = nat->nat_aps; 1243ab25eeb5Syz155240 outsize = ipn->ipn_dsize - sizeof(*ipn) + sizeof(ipn->ipn_data); 1244ab25eeb5Syz155240 if (aps != NULL) { 1245ab25eeb5Syz155240 char *s; 1246ab25eeb5Syz155240 1247ab25eeb5Syz155240 if (outsize < sizeof(*aps)) { 1248ab25eeb5Syz155240 error = ENOBUFS; 1249ab25eeb5Syz155240 goto finished; 1250ab25eeb5Syz155240 } 1251ab25eeb5Syz155240 1252ab25eeb5Syz155240 s = ipn->ipn_data; 1253ab25eeb5Syz155240 bcopy((char *)aps, s, sizeof(*aps)); 1254ab25eeb5Syz155240 s += sizeof(*aps); 1255ab25eeb5Syz155240 outsize -= sizeof(*aps); 1256ab25eeb5Syz155240 if ((aps->aps_data != NULL) && (outsize >= aps->aps_psiz)) 1257ab25eeb5Syz155240 bcopy(aps->aps_data, s, aps->aps_psiz); 1258ab25eeb5Syz155240 else 1259ab25eeb5Syz155240 error = ENOBUFS; 1260ab25eeb5Syz155240 } 1261ab25eeb5Syz155240 if (error == 0) { 1262ab25eeb5Syz155240 error = fr_outobjsz(data, ipn, IPFOBJ_NATSAVE, ipns.ipn_dsize); 1263ab25eeb5Syz155240 } 1264ab25eeb5Syz155240 1265ab25eeb5Syz155240 finished: 1266ab25eeb5Syz155240 if (ipn != NULL) { 1267ab25eeb5Syz155240 KFREES(ipn, ipns.ipn_dsize); 1268ab25eeb5Syz155240 } 1269ab25eeb5Syz155240 return error; 1270ab25eeb5Syz155240 } 1271ab25eeb5Syz155240 1272ab25eeb5Syz155240 1273ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1274ab25eeb5Syz155240 /* Function: fr_natputent */ 1275ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 is the error value. */ 1276ab25eeb5Syz155240 /* Parameters: data(I) - pointer to natget structure with NAT */ 1277ab25eeb5Syz155240 /* structure information to load into the kernel */ 1278ab25eeb5Syz155240 /* getlock(I) - flag indicating whether or not a write lock */ 1279ab25eeb5Syz155240 /* on ipf_nat is already held. */ 1280ab25eeb5Syz155240 /* */ 1281ab25eeb5Syz155240 /* Handle SIOCSTPUT. */ 1282ab25eeb5Syz155240 /* Loads a NAT table entry from user space, including a NAT rule, proxy and */ 1283ab25eeb5Syz155240 /* firewall rule data structures, if pointers to them indicate so. */ 1284ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1285f4b3ec61Sdh155122 static int fr_natputent(data, getlock, ifs) 1286ab25eeb5Syz155240 caddr_t data; 1287ab25eeb5Syz155240 int getlock; 1288f4b3ec61Sdh155122 ipf_stack_t *ifs; 1289ab25eeb5Syz155240 { 1290ab25eeb5Syz155240 nat_save_t ipn, *ipnn; 1291ab25eeb5Syz155240 ap_session_t *aps; 1292ab25eeb5Syz155240 nat_t *n, *nat; 1293ab25eeb5Syz155240 frentry_t *fr; 1294ab25eeb5Syz155240 fr_info_t fin; 1295ab25eeb5Syz155240 ipnat_t *in; 1296ab25eeb5Syz155240 int error; 1297ab25eeb5Syz155240 1298ab25eeb5Syz155240 error = fr_inobj(data, &ipn, IPFOBJ_NATSAVE); 1299ab25eeb5Syz155240 if (error != 0) 1300ab25eeb5Syz155240 return error; 1301ab25eeb5Syz155240 1302ab25eeb5Syz155240 /* 1303ab25eeb5Syz155240 * Initialise early because of code at junkput label. 1304ab25eeb5Syz155240 */ 1305ab25eeb5Syz155240 in = NULL; 1306ab25eeb5Syz155240 aps = NULL; 1307ab25eeb5Syz155240 nat = NULL; 1308ab25eeb5Syz155240 ipnn = NULL; 1309ab25eeb5Syz155240 1310ab25eeb5Syz155240 /* 1311ab25eeb5Syz155240 * New entry, copy in the rest of the NAT entry if it's size is more 1312ab25eeb5Syz155240 * than just the nat_t structure. 1313ab25eeb5Syz155240 */ 1314ab25eeb5Syz155240 fr = NULL; 1315ab25eeb5Syz155240 if (ipn.ipn_dsize > sizeof(ipn)) { 1316ab25eeb5Syz155240 if (ipn.ipn_dsize > 81920) { 1317ab25eeb5Syz155240 error = ENOMEM; 1318ab25eeb5Syz155240 goto junkput; 1319ab25eeb5Syz155240 } 1320ab25eeb5Syz155240 1321ab25eeb5Syz155240 KMALLOCS(ipnn, nat_save_t *, ipn.ipn_dsize); 1322ab25eeb5Syz155240 if (ipnn == NULL) 1323ab25eeb5Syz155240 return ENOMEM; 1324ab25eeb5Syz155240 1325ab25eeb5Syz155240 error = fr_inobjsz(data, ipnn, IPFOBJ_NATSAVE, ipn.ipn_dsize); 1326ab25eeb5Syz155240 if (error != 0) { 1327ab25eeb5Syz155240 error = EFAULT; 1328ab25eeb5Syz155240 goto junkput; 1329ab25eeb5Syz155240 } 1330ab25eeb5Syz155240 } else 1331ab25eeb5Syz155240 ipnn = &ipn; 1332ab25eeb5Syz155240 1333ab25eeb5Syz155240 KMALLOC(nat, nat_t *); 1334ab25eeb5Syz155240 if (nat == NULL) { 1335ab25eeb5Syz155240 error = ENOMEM; 1336ab25eeb5Syz155240 goto junkput; 1337ab25eeb5Syz155240 } 1338ab25eeb5Syz155240 1339ab25eeb5Syz155240 bcopy((char *)&ipnn->ipn_nat, (char *)nat, sizeof(*nat)); 1340ab25eeb5Syz155240 /* 1341ab25eeb5Syz155240 * Initialize all these so that nat_delete() doesn't cause a crash. 1342ab25eeb5Syz155240 */ 1343ab25eeb5Syz155240 bzero((char *)nat, offsetof(struct nat, nat_tqe)); 1344ab25eeb5Syz155240 nat->nat_tqe.tqe_pnext = NULL; 1345ab25eeb5Syz155240 nat->nat_tqe.tqe_next = NULL; 1346ab25eeb5Syz155240 nat->nat_tqe.tqe_ifq = NULL; 1347ab25eeb5Syz155240 nat->nat_tqe.tqe_parent = nat; 1348ab25eeb5Syz155240 1349ab25eeb5Syz155240 /* 1350ab25eeb5Syz155240 * Restore the rule associated with this nat session 1351ab25eeb5Syz155240 */ 1352ab25eeb5Syz155240 in = ipnn->ipn_nat.nat_ptr; 1353ab25eeb5Syz155240 if (in != NULL) { 1354ab25eeb5Syz155240 KMALLOC(in, ipnat_t *); 1355ab25eeb5Syz155240 nat->nat_ptr = in; 1356ab25eeb5Syz155240 if (in == NULL) { 1357ab25eeb5Syz155240 error = ENOMEM; 1358ab25eeb5Syz155240 goto junkput; 1359ab25eeb5Syz155240 } 1360ab25eeb5Syz155240 bzero((char *)in, offsetof(struct ipnat, in_next6)); 1361ab25eeb5Syz155240 bcopy((char *)&ipnn->ipn_ipnat, (char *)in, sizeof(*in)); 1362ab25eeb5Syz155240 in->in_use = 1; 1363ab25eeb5Syz155240 in->in_flags |= IPN_DELETE; 1364ab25eeb5Syz155240 1365f4b3ec61Sdh155122 ATOMIC_INC(ifs->ifs_nat_stats.ns_rules); 1366ab25eeb5Syz155240 1367dcf3e898Sjojemann if (nat_resolverule(in, ifs) != 0) { 1368dcf3e898Sjojemann error = ESRCH; 1369dcf3e898Sjojemann goto junkput; 1370dcf3e898Sjojemann } 1371ab25eeb5Syz155240 } 1372ab25eeb5Syz155240 1373ab25eeb5Syz155240 /* 1374ab25eeb5Syz155240 * Check that the NAT entry doesn't already exist in the kernel. 1375ab25eeb5Syz155240 */ 1376ab25eeb5Syz155240 bzero((char *)&fin, sizeof(fin)); 1377ab25eeb5Syz155240 fin.fin_p = nat->nat_p; 137875c9105fSjojemann fin.fin_ifs = ifs; 1379ab25eeb5Syz155240 if (nat->nat_dir == NAT_OUTBOUND) { 1380ab25eeb5Syz155240 fin.fin_data[0] = ntohs(nat->nat_oport); 1381ab25eeb5Syz155240 fin.fin_data[1] = ntohs(nat->nat_outport); 1382e6c6c1faSyz155240 fin.fin_ifp = nat->nat_ifps[0]; 1383ab25eeb5Syz155240 if (getlock) { 1384f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 1385ab25eeb5Syz155240 } 1386ab25eeb5Syz155240 n = nat_inlookup(&fin, nat->nat_flags, fin.fin_p, 1387ab25eeb5Syz155240 nat->nat_oip, nat->nat_outip); 1388ab25eeb5Syz155240 if (getlock) { 1389f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1390ab25eeb5Syz155240 } 1391ab25eeb5Syz155240 if (n != NULL) { 1392ab25eeb5Syz155240 error = EEXIST; 1393ab25eeb5Syz155240 goto junkput; 1394ab25eeb5Syz155240 } 1395ab25eeb5Syz155240 } else if (nat->nat_dir == NAT_INBOUND) { 1396ab25eeb5Syz155240 fin.fin_data[0] = ntohs(nat->nat_inport); 1397ab25eeb5Syz155240 fin.fin_data[1] = ntohs(nat->nat_oport); 1398e6c6c1faSyz155240 fin.fin_ifp = nat->nat_ifps[1]; 1399ab25eeb5Syz155240 if (getlock) { 1400f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 1401ab25eeb5Syz155240 } 1402ab25eeb5Syz155240 n = nat_outlookup(&fin, nat->nat_flags, fin.fin_p, 1403e6c6c1faSyz155240 nat->nat_inip, nat->nat_oip); 1404ab25eeb5Syz155240 if (getlock) { 1405f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1406ab25eeb5Syz155240 } 1407ab25eeb5Syz155240 if (n != NULL) { 1408ab25eeb5Syz155240 error = EEXIST; 1409ab25eeb5Syz155240 goto junkput; 1410ab25eeb5Syz155240 } 1411ab25eeb5Syz155240 } else { 1412ab25eeb5Syz155240 error = EINVAL; 1413ab25eeb5Syz155240 goto junkput; 1414ab25eeb5Syz155240 } 1415ab25eeb5Syz155240 1416ab25eeb5Syz155240 /* 1417ab25eeb5Syz155240 * Restore ap_session_t structure. Include the private data allocated 1418ab25eeb5Syz155240 * if it was there. 1419ab25eeb5Syz155240 */ 1420ab25eeb5Syz155240 aps = nat->nat_aps; 1421ab25eeb5Syz155240 if (aps != NULL) { 1422ab25eeb5Syz155240 KMALLOC(aps, ap_session_t *); 1423ab25eeb5Syz155240 nat->nat_aps = aps; 1424ab25eeb5Syz155240 if (aps == NULL) { 1425ab25eeb5Syz155240 error = ENOMEM; 1426ab25eeb5Syz155240 goto junkput; 1427ab25eeb5Syz155240 } 1428ab25eeb5Syz155240 bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps)); 1429ab25eeb5Syz155240 if (in != NULL) 1430ab25eeb5Syz155240 aps->aps_apr = in->in_apr; 1431ab25eeb5Syz155240 else 1432ab25eeb5Syz155240 aps->aps_apr = NULL; 1433ab25eeb5Syz155240 if (aps->aps_psiz != 0) { 1434ab25eeb5Syz155240 if (aps->aps_psiz > 81920) { 1435ab25eeb5Syz155240 error = ENOMEM; 1436ab25eeb5Syz155240 goto junkput; 1437ab25eeb5Syz155240 } 1438ab25eeb5Syz155240 KMALLOCS(aps->aps_data, void *, aps->aps_psiz); 1439ab25eeb5Syz155240 if (aps->aps_data == NULL) { 1440ab25eeb5Syz155240 error = ENOMEM; 1441ab25eeb5Syz155240 goto junkput; 1442ab25eeb5Syz155240 } 1443ab25eeb5Syz155240 bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data, 1444ab25eeb5Syz155240 aps->aps_psiz); 1445ab25eeb5Syz155240 } else { 1446ab25eeb5Syz155240 aps->aps_psiz = 0; 1447ab25eeb5Syz155240 aps->aps_data = NULL; 1448ab25eeb5Syz155240 } 1449ab25eeb5Syz155240 } 1450ab25eeb5Syz155240 1451ab25eeb5Syz155240 /* 1452ab25eeb5Syz155240 * If there was a filtering rule associated with this entry then 1453ab25eeb5Syz155240 * build up a new one. 1454ab25eeb5Syz155240 */ 1455ab25eeb5Syz155240 fr = nat->nat_fr; 1456ab25eeb5Syz155240 if (fr != NULL) { 1457ab25eeb5Syz155240 if ((nat->nat_flags & SI_NEWFR) != 0) { 1458ab25eeb5Syz155240 KMALLOC(fr, frentry_t *); 1459ab25eeb5Syz155240 nat->nat_fr = fr; 1460ab25eeb5Syz155240 if (fr == NULL) { 1461ab25eeb5Syz155240 error = ENOMEM; 1462ab25eeb5Syz155240 goto junkput; 1463ab25eeb5Syz155240 } 1464ab25eeb5Syz155240 ipnn->ipn_nat.nat_fr = fr; 1465ab25eeb5Syz155240 (void) fr_outobj(data, ipnn, IPFOBJ_NATSAVE); 1466ab25eeb5Syz155240 bcopy((char *)&ipnn->ipn_fr, (char *)fr, sizeof(*fr)); 1467dcf3e898Sjojemann 1468dcf3e898Sjojemann fr->fr_ref = 1; 1469dcf3e898Sjojemann fr->fr_dsize = 0; 1470dcf3e898Sjojemann fr->fr_data = NULL; 1471dcf3e898Sjojemann fr->fr_type = FR_T_NONE; 1472dcf3e898Sjojemann 1473ab25eeb5Syz155240 MUTEX_NUKE(&fr->fr_lock); 1474ab25eeb5Syz155240 MUTEX_INIT(&fr->fr_lock, "nat-filter rule lock"); 1475ab25eeb5Syz155240 } else { 1476dcf3e898Sjojemann if (getlock) { 1477f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 1478dcf3e898Sjojemann } 1479f4b3ec61Sdh155122 for (n = ifs->ifs_nat_instances; n; n = n->nat_next) 1480ab25eeb5Syz155240 if (n->nat_fr == fr) 1481ab25eeb5Syz155240 break; 1482ab25eeb5Syz155240 1483ab25eeb5Syz155240 if (n != NULL) { 1484ab25eeb5Syz155240 MUTEX_ENTER(&fr->fr_lock); 1485ab25eeb5Syz155240 fr->fr_ref++; 1486ab25eeb5Syz155240 MUTEX_EXIT(&fr->fr_lock); 1487ab25eeb5Syz155240 } 1488dcf3e898Sjojemann if (getlock) { 1489f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1490dcf3e898Sjojemann } 1491ab25eeb5Syz155240 if (!n) { 1492ab25eeb5Syz155240 error = ESRCH; 1493ab25eeb5Syz155240 goto junkput; 1494ab25eeb5Syz155240 } 1495ab25eeb5Syz155240 } 1496ab25eeb5Syz155240 } 1497ab25eeb5Syz155240 1498ab25eeb5Syz155240 if (ipnn != &ipn) { 1499ab25eeb5Syz155240 KFREES(ipnn, ipn.ipn_dsize); 1500ab25eeb5Syz155240 ipnn = NULL; 1501ab25eeb5Syz155240 } 1502ab25eeb5Syz155240 1503ab25eeb5Syz155240 if (getlock) { 1504f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 1505ab25eeb5Syz155240 } 1506f4b3ec61Sdh155122 error = nat_insert(nat, nat->nat_rev, ifs); 1507ab25eeb5Syz155240 if ((error == 0) && (aps != NULL)) { 1508f4b3ec61Sdh155122 aps->aps_next = ifs->ifs_ap_sess_list; 1509f4b3ec61Sdh155122 ifs->ifs_ap_sess_list = aps; 1510ab25eeb5Syz155240 } 1511ab25eeb5Syz155240 if (getlock) { 1512f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1513ab25eeb5Syz155240 } 1514ab25eeb5Syz155240 1515ab25eeb5Syz155240 if (error == 0) 1516ab25eeb5Syz155240 return 0; 1517ab25eeb5Syz155240 1518ab25eeb5Syz155240 error = ENOMEM; 1519ab25eeb5Syz155240 1520ab25eeb5Syz155240 junkput: 1521ab25eeb5Syz155240 if (fr != NULL) 1522f4b3ec61Sdh155122 (void) fr_derefrule(&fr, ifs); 1523ab25eeb5Syz155240 1524ab25eeb5Syz155240 if ((ipnn != NULL) && (ipnn != &ipn)) { 1525ab25eeb5Syz155240 KFREES(ipnn, ipn.ipn_dsize); 1526ab25eeb5Syz155240 } 1527ab25eeb5Syz155240 if (nat != NULL) { 1528ab25eeb5Syz155240 if (aps != NULL) { 1529ab25eeb5Syz155240 if (aps->aps_data != NULL) { 1530ab25eeb5Syz155240 KFREES(aps->aps_data, aps->aps_psiz); 1531ab25eeb5Syz155240 } 1532ab25eeb5Syz155240 KFREE(aps); 1533ab25eeb5Syz155240 } 1534ab25eeb5Syz155240 if (in != NULL) { 1535ab25eeb5Syz155240 if (in->in_apr) 1536ab25eeb5Syz155240 appr_free(in->in_apr); 1537ab25eeb5Syz155240 KFREE(in); 1538ab25eeb5Syz155240 } 1539ab25eeb5Syz155240 KFREE(nat); 1540ab25eeb5Syz155240 } 1541ab25eeb5Syz155240 return error; 1542ab25eeb5Syz155240 } 1543ab25eeb5Syz155240 1544ab25eeb5Syz155240 1545ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1546ab25eeb5Syz155240 /* Function: nat_delete */ 1547ab25eeb5Syz155240 /* Returns: Nil */ 1548ab25eeb5Syz155240 /* Parameters: natd(I) - pointer to NAT structure to delete */ 1549ab25eeb5Syz155240 /* logtype(I) - type of LOG record to create before deleting */ 1550ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 1551ab25eeb5Syz155240 /* */ 1552ab25eeb5Syz155240 /* Delete a nat entry from the various lists and table. If NAT logging is */ 1553ab25eeb5Syz155240 /* enabled then generate a NAT log record for this event. */ 1554ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1555f4b3ec61Sdh155122 static void nat_delete(nat, logtype, ifs) 1556ab25eeb5Syz155240 struct nat *nat; 1557ab25eeb5Syz155240 int logtype; 1558f4b3ec61Sdh155122 ipf_stack_t *ifs; 1559ab25eeb5Syz155240 { 1560ab25eeb5Syz155240 struct ipnat *ipn; 1561ab25eeb5Syz155240 1562f4b3ec61Sdh155122 if (logtype != 0 && ifs->ifs_nat_logging != 0) 1563f4b3ec61Sdh155122 nat_log(nat, logtype, ifs); 1564ab25eeb5Syz155240 1565f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 1566ab25eeb5Syz155240 1567ab25eeb5Syz155240 /* 1568ab25eeb5Syz155240 * Take it as a general indication that all the pointers are set if 1569ab25eeb5Syz155240 * nat_pnext is set. 1570ab25eeb5Syz155240 */ 1571ab25eeb5Syz155240 if (nat->nat_pnext != NULL) { 1572f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0][nat->nat_hv[0]]--; 1573f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][nat->nat_hv[1]]--; 1574ab25eeb5Syz155240 1575ab25eeb5Syz155240 *nat->nat_pnext = nat->nat_next; 1576ab25eeb5Syz155240 if (nat->nat_next != NULL) { 1577ab25eeb5Syz155240 nat->nat_next->nat_pnext = nat->nat_pnext; 1578ab25eeb5Syz155240 nat->nat_next = NULL; 1579ab25eeb5Syz155240 } 1580ab25eeb5Syz155240 nat->nat_pnext = NULL; 1581ab25eeb5Syz155240 1582ab25eeb5Syz155240 *nat->nat_phnext[0] = nat->nat_hnext[0]; 1583ab25eeb5Syz155240 if (nat->nat_hnext[0] != NULL) { 1584ab25eeb5Syz155240 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; 1585ab25eeb5Syz155240 nat->nat_hnext[0] = NULL; 1586ab25eeb5Syz155240 } 1587ab25eeb5Syz155240 nat->nat_phnext[0] = NULL; 1588ab25eeb5Syz155240 1589ab25eeb5Syz155240 *nat->nat_phnext[1] = nat->nat_hnext[1]; 1590ab25eeb5Syz155240 if (nat->nat_hnext[1] != NULL) { 1591ab25eeb5Syz155240 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; 1592ab25eeb5Syz155240 nat->nat_hnext[1] = NULL; 1593ab25eeb5Syz155240 } 1594ab25eeb5Syz155240 nat->nat_phnext[1] = NULL; 1595ab25eeb5Syz155240 1596ab25eeb5Syz155240 if ((nat->nat_flags & SI_WILDP) != 0) 1597f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_wilds--; 1598ab25eeb5Syz155240 } 1599ab25eeb5Syz155240 1600ab25eeb5Syz155240 if (nat->nat_me != NULL) { 1601ab25eeb5Syz155240 *nat->nat_me = NULL; 1602ab25eeb5Syz155240 nat->nat_me = NULL; 1603ab25eeb5Syz155240 } 1604ab25eeb5Syz155240 1605ab25eeb5Syz155240 fr_deletequeueentry(&nat->nat_tqe); 1606ab25eeb5Syz155240 1607ab25eeb5Syz155240 nat->nat_ref--; 1608ab25eeb5Syz155240 if (nat->nat_ref > 0) { 1609f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 1610ab25eeb5Syz155240 return; 1611ab25eeb5Syz155240 } 1612ab25eeb5Syz155240 1613ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 1614ab25eeb5Syz155240 if (nat->nat_sync) 1615ab25eeb5Syz155240 ipfsync_del(nat->nat_sync); 1616ab25eeb5Syz155240 #endif 1617ab25eeb5Syz155240 1618ab25eeb5Syz155240 if (nat->nat_fr != NULL) 1619f4b3ec61Sdh155122 (void)fr_derefrule(&nat->nat_fr, ifs); 1620ab25eeb5Syz155240 1621ab25eeb5Syz155240 if (nat->nat_hm != NULL) 1622ab25eeb5Syz155240 nat_hostmapdel(nat->nat_hm); 1623ab25eeb5Syz155240 1624ab25eeb5Syz155240 /* 1625ab25eeb5Syz155240 * If there is an active reference from the nat entry to its parent 1626ab25eeb5Syz155240 * rule, decrement the rule's reference count and free it too if no 1627ab25eeb5Syz155240 * longer being used. 1628ab25eeb5Syz155240 */ 1629ab25eeb5Syz155240 ipn = nat->nat_ptr; 1630ab25eeb5Syz155240 if (ipn != NULL) { 1631ab25eeb5Syz155240 ipn->in_space++; 1632ab25eeb5Syz155240 ipn->in_use--; 1633ab25eeb5Syz155240 if (ipn->in_use == 0 && (ipn->in_flags & IPN_DELETE)) { 1634ab25eeb5Syz155240 if (ipn->in_apr) 1635ab25eeb5Syz155240 appr_free(ipn->in_apr); 1636ab25eeb5Syz155240 KFREE(ipn); 1637f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules--; 1638ab25eeb5Syz155240 } 1639ab25eeb5Syz155240 } 1640ab25eeb5Syz155240 1641ab25eeb5Syz155240 MUTEX_DESTROY(&nat->nat_lock); 1642ab25eeb5Syz155240 1643f4b3ec61Sdh155122 aps_free(nat->nat_aps, ifs); 1644f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_inuse--; 1645f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 1646ab25eeb5Syz155240 1647ab25eeb5Syz155240 /* 1648ab25eeb5Syz155240 * If there's a fragment table entry too for this nat entry, then 1649ab25eeb5Syz155240 * dereference that as well. This is after nat_lock is released 1650ab25eeb5Syz155240 * because of Tru64. 1651ab25eeb5Syz155240 */ 1652f4b3ec61Sdh155122 fr_forgetnat((void *)nat, ifs); 1653ab25eeb5Syz155240 1654ab25eeb5Syz155240 KFREE(nat); 1655ab25eeb5Syz155240 } 1656ab25eeb5Syz155240 1657ab25eeb5Syz155240 1658ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1659ab25eeb5Syz155240 /* Function: nat_flushtable */ 1660ab25eeb5Syz155240 /* Returns: int - number of NAT rules deleted */ 1661ab25eeb5Syz155240 /* Parameters: Nil */ 1662ab25eeb5Syz155240 /* */ 1663ab25eeb5Syz155240 /* Deletes all currently active NAT sessions. In deleting each NAT entry a */ 1664ab25eeb5Syz155240 /* log record should be emitted in nat_delete() if NAT logging is enabled. */ 1665ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1666ab25eeb5Syz155240 /* 1667ab25eeb5Syz155240 * nat_flushtable - clear the NAT table of all mapping entries. 1668ab25eeb5Syz155240 */ 1669f4b3ec61Sdh155122 static int nat_flushtable(ifs) 1670f4b3ec61Sdh155122 ipf_stack_t *ifs; 1671ab25eeb5Syz155240 { 1672ab25eeb5Syz155240 nat_t *nat; 1673ab25eeb5Syz155240 int j = 0; 1674ab25eeb5Syz155240 1675ab25eeb5Syz155240 /* 1676ab25eeb5Syz155240 * ALL NAT mappings deleted, so lets just make the deletions 1677ab25eeb5Syz155240 * quicker. 1678ab25eeb5Syz155240 */ 1679f4b3ec61Sdh155122 if (ifs->ifs_nat_table[0] != NULL) 1680f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_table[0], 1681f4b3ec61Sdh155122 sizeof(ifs->ifs_nat_table[0]) * ifs->ifs_ipf_nattable_sz); 1682f4b3ec61Sdh155122 if (ifs->ifs_nat_table[1] != NULL) 1683f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_table[1], 1684f4b3ec61Sdh155122 sizeof(ifs->ifs_nat_table[1]) * ifs->ifs_ipf_nattable_sz); 1685ab25eeb5Syz155240 1686f4b3ec61Sdh155122 while ((nat = ifs->ifs_nat_instances) != NULL) { 1687f4b3ec61Sdh155122 nat_delete(nat, NL_FLUSH, ifs); 1688ab25eeb5Syz155240 j++; 1689ab25eeb5Syz155240 } 1690ab25eeb5Syz155240 1691f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_inuse = 0; 1692ab25eeb5Syz155240 return j; 1693ab25eeb5Syz155240 } 1694ab25eeb5Syz155240 1695ab25eeb5Syz155240 1696ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1697ab25eeb5Syz155240 /* Function: nat_clearlist */ 1698ab25eeb5Syz155240 /* Returns: int - number of NAT/RDR rules deleted */ 1699ab25eeb5Syz155240 /* Parameters: Nil */ 1700ab25eeb5Syz155240 /* */ 1701ab25eeb5Syz155240 /* Delete all rules in the current list of rules. There is nothing elegant */ 1702ab25eeb5Syz155240 /* about this cleanup: simply free all entries on the list of rules and */ 1703ab25eeb5Syz155240 /* clear out the tables used for hashed NAT rule lookups. */ 1704ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1705f4b3ec61Sdh155122 static int nat_clearlist(ifs) 1706f4b3ec61Sdh155122 ipf_stack_t *ifs; 1707ab25eeb5Syz155240 { 1708f4b3ec61Sdh155122 ipnat_t *n, **np = &ifs->ifs_nat_list; 1709ab25eeb5Syz155240 int i = 0; 1710ab25eeb5Syz155240 1711f4b3ec61Sdh155122 if (ifs->ifs_nat_rules != NULL) 1712f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_rules, 1713f4b3ec61Sdh155122 sizeof(*ifs->ifs_nat_rules) * ifs->ifs_ipf_natrules_sz); 1714f4b3ec61Sdh155122 if (ifs->ifs_rdr_rules != NULL) 1715f4b3ec61Sdh155122 bzero((char *)ifs->ifs_rdr_rules, 1716f4b3ec61Sdh155122 sizeof(*ifs->ifs_rdr_rules) * ifs->ifs_ipf_rdrrules_sz); 1717ab25eeb5Syz155240 1718ab25eeb5Syz155240 while ((n = *np) != NULL) { 1719ab25eeb5Syz155240 *np = n->in_next; 1720ab25eeb5Syz155240 if (n->in_use == 0) { 1721ab25eeb5Syz155240 if (n->in_apr != NULL) 1722ab25eeb5Syz155240 appr_free(n->in_apr); 1723ab25eeb5Syz155240 KFREE(n); 1724f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules--; 1725ab25eeb5Syz155240 } else { 1726ab25eeb5Syz155240 n->in_flags |= IPN_DELETE; 1727ab25eeb5Syz155240 n->in_next = NULL; 1728ab25eeb5Syz155240 } 1729ab25eeb5Syz155240 i++; 1730ab25eeb5Syz155240 } 1731f4b3ec61Sdh155122 ifs->ifs_nat_masks = 0; 1732f4b3ec61Sdh155122 ifs->ifs_rdr_masks = 0; 1733ab25eeb5Syz155240 return i; 1734ab25eeb5Syz155240 } 1735ab25eeb5Syz155240 1736ab25eeb5Syz155240 1737ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1738ab25eeb5Syz155240 /* Function: nat_newmap */ 1739ab25eeb5Syz155240 /* Returns: int - -1 == error, 0 == success */ 1740ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 1741ab25eeb5Syz155240 /* nat(I) - pointer to NAT entry */ 1742ab25eeb5Syz155240 /* ni(I) - pointer to structure with misc. information needed */ 1743ab25eeb5Syz155240 /* to create new NAT entry. */ 1744ab25eeb5Syz155240 /* */ 1745ab25eeb5Syz155240 /* Given an empty NAT structure, populate it with new information about a */ 1746ab25eeb5Syz155240 /* new NAT session, as defined by the matching NAT rule. */ 1747ab25eeb5Syz155240 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/ 1748ab25eeb5Syz155240 /* to the new IP address for the translation. */ 1749ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1750ab25eeb5Syz155240 static INLINE int nat_newmap(fin, nat, ni) 1751ab25eeb5Syz155240 fr_info_t *fin; 1752ab25eeb5Syz155240 nat_t *nat; 1753ab25eeb5Syz155240 natinfo_t *ni; 1754ab25eeb5Syz155240 { 1755ab25eeb5Syz155240 u_short st_port, dport, sport, port, sp, dp; 1756ab25eeb5Syz155240 struct in_addr in, inb; 1757ab25eeb5Syz155240 hostmap_t *hm; 1758ab25eeb5Syz155240 u_32_t flags; 1759ab25eeb5Syz155240 u_32_t st_ip; 1760ab25eeb5Syz155240 ipnat_t *np; 1761ab25eeb5Syz155240 nat_t *natl; 1762ab25eeb5Syz155240 int l; 1763f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 1764ab25eeb5Syz155240 1765ab25eeb5Syz155240 /* 1766ab25eeb5Syz155240 * If it's an outbound packet which doesn't match any existing 1767ab25eeb5Syz155240 * record, then create a new port 1768ab25eeb5Syz155240 */ 1769ab25eeb5Syz155240 l = 0; 1770ab25eeb5Syz155240 hm = NULL; 1771ab25eeb5Syz155240 np = ni->nai_np; 1772ab25eeb5Syz155240 st_ip = np->in_nip; 1773ab25eeb5Syz155240 st_port = np->in_pnext; 1774ab25eeb5Syz155240 flags = ni->nai_flags; 1775ab25eeb5Syz155240 sport = ni->nai_sport; 1776ab25eeb5Syz155240 dport = ni->nai_dport; 1777ab25eeb5Syz155240 1778ab25eeb5Syz155240 /* 1779ab25eeb5Syz155240 * Do a loop until we either run out of entries to try or we find 1780ab25eeb5Syz155240 * a NAT mapping that isn't currently being used. This is done 1781ab25eeb5Syz155240 * because the change to the source is not (usually) being fixed. 1782ab25eeb5Syz155240 */ 1783ab25eeb5Syz155240 do { 1784ab25eeb5Syz155240 port = 0; 1785ab25eeb5Syz155240 in.s_addr = htonl(np->in_nip); 1786ab25eeb5Syz155240 if (l == 0) { 1787ab25eeb5Syz155240 /* 1788ab25eeb5Syz155240 * Check to see if there is an existing NAT 1789ab25eeb5Syz155240 * setup for this IP address pair. 1790ab25eeb5Syz155240 */ 1791ab25eeb5Syz155240 hm = nat_hostmap(np, fin->fin_src, fin->fin_dst, 1792f4b3ec61Sdh155122 in, 0, ifs); 1793ab25eeb5Syz155240 if (hm != NULL) 1794ab25eeb5Syz155240 in.s_addr = hm->hm_mapip.s_addr; 1795ab25eeb5Syz155240 } else if ((l == 1) && (hm != NULL)) { 1796ab25eeb5Syz155240 nat_hostmapdel(hm); 1797ab25eeb5Syz155240 hm = NULL; 1798ab25eeb5Syz155240 } 1799ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 1800ab25eeb5Syz155240 1801ab25eeb5Syz155240 nat->nat_hm = hm; 1802ab25eeb5Syz155240 1803ab25eeb5Syz155240 if ((np->in_outmsk == 0xffffffff) && (np->in_pnext == 0)) { 1804ab25eeb5Syz155240 if (l > 0) 1805ab25eeb5Syz155240 return -1; 1806ab25eeb5Syz155240 } 1807ab25eeb5Syz155240 1808ab25eeb5Syz155240 if (np->in_redir == NAT_BIMAP && 1809ab25eeb5Syz155240 np->in_inmsk == np->in_outmsk) { 1810ab25eeb5Syz155240 /* 1811ab25eeb5Syz155240 * map the address block in a 1:1 fashion 1812ab25eeb5Syz155240 */ 1813ab25eeb5Syz155240 in.s_addr = np->in_outip; 1814ab25eeb5Syz155240 in.s_addr |= fin->fin_saddr & ~np->in_inmsk; 1815ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 1816ab25eeb5Syz155240 1817ab25eeb5Syz155240 } else if (np->in_redir & NAT_MAPBLK) { 1818ab25eeb5Syz155240 if ((l >= np->in_ppip) || ((l > 0) && 1819ab25eeb5Syz155240 !(flags & IPN_TCPUDP))) 1820ab25eeb5Syz155240 return -1; 1821ab25eeb5Syz155240 /* 1822ab25eeb5Syz155240 * map-block - Calculate destination address. 1823ab25eeb5Syz155240 */ 1824ab25eeb5Syz155240 in.s_addr = ntohl(fin->fin_saddr); 1825ab25eeb5Syz155240 in.s_addr &= ntohl(~np->in_inmsk); 1826ab25eeb5Syz155240 inb.s_addr = in.s_addr; 1827ab25eeb5Syz155240 in.s_addr /= np->in_ippip; 1828ab25eeb5Syz155240 in.s_addr &= ntohl(~np->in_outmsk); 1829ab25eeb5Syz155240 in.s_addr += ntohl(np->in_outip); 1830ab25eeb5Syz155240 /* 1831ab25eeb5Syz155240 * Calculate destination port. 1832ab25eeb5Syz155240 */ 1833ab25eeb5Syz155240 if ((flags & IPN_TCPUDP) && 1834ab25eeb5Syz155240 (np->in_ppip != 0)) { 1835ab25eeb5Syz155240 port = ntohs(sport) + l; 1836ab25eeb5Syz155240 port %= np->in_ppip; 1837ab25eeb5Syz155240 port += np->in_ppip * 1838ab25eeb5Syz155240 (inb.s_addr % np->in_ippip); 1839ab25eeb5Syz155240 port += MAPBLK_MINPORT; 1840ab25eeb5Syz155240 port = htons(port); 1841ab25eeb5Syz155240 } 1842ab25eeb5Syz155240 1843ab25eeb5Syz155240 } else if ((np->in_outip == 0) && 1844ab25eeb5Syz155240 (np->in_outmsk == 0xffffffff)) { 1845ab25eeb5Syz155240 /* 1846ab25eeb5Syz155240 * 0/32 - use the interface's IP address. 1847ab25eeb5Syz155240 */ 1848ab25eeb5Syz155240 if ((l > 0) || 1849ab25eeb5Syz155240 fr_ifpaddr(4, FRI_NORMAL, fin->fin_ifp, 1850f4b3ec61Sdh155122 &in, NULL, fin->fin_ifs) == -1) 1851ab25eeb5Syz155240 return -1; 1852ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 1853ab25eeb5Syz155240 1854ab25eeb5Syz155240 } else if ((np->in_outip == 0) && (np->in_outmsk == 0)) { 1855ab25eeb5Syz155240 /* 1856ab25eeb5Syz155240 * 0/0 - use the original source address/port. 1857ab25eeb5Syz155240 */ 1858ab25eeb5Syz155240 if (l > 0) 1859ab25eeb5Syz155240 return -1; 1860ab25eeb5Syz155240 in.s_addr = ntohl(fin->fin_saddr); 1861ab25eeb5Syz155240 1862ab25eeb5Syz155240 } else if ((np->in_outmsk != 0xffffffff) && 1863ab25eeb5Syz155240 (np->in_pnext == 0) && ((l > 0) || (hm == NULL))) 1864ab25eeb5Syz155240 np->in_nip++; 1865ab25eeb5Syz155240 1866ab25eeb5Syz155240 natl = NULL; 1867ab25eeb5Syz155240 1868ab25eeb5Syz155240 if ((flags & IPN_TCPUDP) && 1869ab25eeb5Syz155240 ((np->in_redir & NAT_MAPBLK) == 0) && 1870ab25eeb5Syz155240 (np->in_flags & IPN_AUTOPORTMAP)) { 1871ab25eeb5Syz155240 /* 1872ab25eeb5Syz155240 * "ports auto" (without map-block) 1873ab25eeb5Syz155240 */ 1874ab25eeb5Syz155240 if ((l > 0) && (l % np->in_ppip == 0)) { 1875ab25eeb5Syz155240 if (l > np->in_space) { 1876ab25eeb5Syz155240 return -1; 1877ab25eeb5Syz155240 } else if ((l > np->in_ppip) && 1878ab25eeb5Syz155240 np->in_outmsk != 0xffffffff) 1879ab25eeb5Syz155240 np->in_nip++; 1880ab25eeb5Syz155240 } 1881ab25eeb5Syz155240 if (np->in_ppip != 0) { 1882ab25eeb5Syz155240 port = ntohs(sport); 1883ab25eeb5Syz155240 port += (l % np->in_ppip); 1884ab25eeb5Syz155240 port %= np->in_ppip; 1885ab25eeb5Syz155240 port += np->in_ppip * 1886ab25eeb5Syz155240 (ntohl(fin->fin_saddr) % 1887ab25eeb5Syz155240 np->in_ippip); 1888ab25eeb5Syz155240 port += MAPBLK_MINPORT; 1889ab25eeb5Syz155240 port = htons(port); 1890ab25eeb5Syz155240 } 1891ab25eeb5Syz155240 1892ab25eeb5Syz155240 } else if (((np->in_redir & NAT_MAPBLK) == 0) && 1893ab25eeb5Syz155240 (flags & IPN_TCPUDPICMP) && (np->in_pnext != 0)) { 1894ab25eeb5Syz155240 /* 1895ab25eeb5Syz155240 * Standard port translation. Select next port. 1896ab25eeb5Syz155240 */ 1897ab25eeb5Syz155240 port = htons(np->in_pnext++); 1898ab25eeb5Syz155240 1899ab25eeb5Syz155240 if (np->in_pnext > ntohs(np->in_pmax)) { 1900ab25eeb5Syz155240 np->in_pnext = ntohs(np->in_pmin); 1901ab25eeb5Syz155240 if (np->in_outmsk != 0xffffffff) 1902ab25eeb5Syz155240 np->in_nip++; 1903ab25eeb5Syz155240 } 1904ab25eeb5Syz155240 } 1905ab25eeb5Syz155240 1906ab25eeb5Syz155240 if (np->in_flags & IPN_IPRANGE) { 1907ab25eeb5Syz155240 if (np->in_nip > ntohl(np->in_outmsk)) 1908ab25eeb5Syz155240 np->in_nip = ntohl(np->in_outip); 1909ab25eeb5Syz155240 } else { 1910ab25eeb5Syz155240 if ((np->in_outmsk != 0xffffffff) && 1911ab25eeb5Syz155240 ((np->in_nip + 1) & ntohl(np->in_outmsk)) > 1912ab25eeb5Syz155240 ntohl(np->in_outip)) 1913ab25eeb5Syz155240 np->in_nip = ntohl(np->in_outip) + 1; 1914ab25eeb5Syz155240 } 1915ab25eeb5Syz155240 1916ab25eeb5Syz155240 if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY))) 1917ab25eeb5Syz155240 port = sport; 1918ab25eeb5Syz155240 1919ab25eeb5Syz155240 /* 1920ab25eeb5Syz155240 * Here we do a lookup of the connection as seen from 1921ab25eeb5Syz155240 * the outside. If an IP# pair already exists, try 1922ab25eeb5Syz155240 * again. So if you have A->B becomes C->B, you can 1923ab25eeb5Syz155240 * also have D->E become C->E but not D->B causing 1924ab25eeb5Syz155240 * another C->B. Also take protocol and ports into 1925ab25eeb5Syz155240 * account when determining whether a pre-existing 1926ab25eeb5Syz155240 * NAT setup will cause an external conflict where 1927ab25eeb5Syz155240 * this is appropriate. 1928ab25eeb5Syz155240 */ 1929ab25eeb5Syz155240 inb.s_addr = htonl(in.s_addr); 1930ab25eeb5Syz155240 sp = fin->fin_data[0]; 1931ab25eeb5Syz155240 dp = fin->fin_data[1]; 1932ab25eeb5Syz155240 fin->fin_data[0] = fin->fin_data[1]; 1933ab25eeb5Syz155240 fin->fin_data[1] = htons(port); 1934ab25eeb5Syz155240 natl = nat_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH), 1935ab25eeb5Syz155240 (u_int)fin->fin_p, fin->fin_dst, inb); 1936ab25eeb5Syz155240 fin->fin_data[0] = sp; 1937ab25eeb5Syz155240 fin->fin_data[1] = dp; 1938ab25eeb5Syz155240 1939ab25eeb5Syz155240 /* 1940ab25eeb5Syz155240 * Has the search wrapped around and come back to the 1941ab25eeb5Syz155240 * start ? 1942ab25eeb5Syz155240 */ 1943ab25eeb5Syz155240 if ((natl != NULL) && 1944ab25eeb5Syz155240 (np->in_pnext != 0) && (st_port == np->in_pnext) && 1945ab25eeb5Syz155240 (np->in_nip != 0) && (st_ip == np->in_nip)) 1946ab25eeb5Syz155240 return -1; 1947ab25eeb5Syz155240 l++; 1948ab25eeb5Syz155240 } while (natl != NULL); 1949ab25eeb5Syz155240 1950ab25eeb5Syz155240 if (np->in_space > 0) 1951ab25eeb5Syz155240 np->in_space--; 1952ab25eeb5Syz155240 1953ab25eeb5Syz155240 /* Setup the NAT table */ 1954ab25eeb5Syz155240 nat->nat_inip = fin->fin_src; 1955ab25eeb5Syz155240 nat->nat_outip.s_addr = htonl(in.s_addr); 1956ab25eeb5Syz155240 nat->nat_oip = fin->fin_dst; 1957ab25eeb5Syz155240 if (nat->nat_hm == NULL) 1958ab25eeb5Syz155240 nat->nat_hm = nat_hostmap(np, fin->fin_src, fin->fin_dst, 1959f4b3ec61Sdh155122 nat->nat_outip, 0, ifs); 1960ab25eeb5Syz155240 1961ab25eeb5Syz155240 /* 1962ab25eeb5Syz155240 * The ICMP checksum does not have a pseudo header containing 1963ab25eeb5Syz155240 * the IP addresses 1964ab25eeb5Syz155240 */ 1965ab25eeb5Syz155240 ni->nai_sum1 = LONG_SUM(ntohl(fin->fin_saddr)); 1966ab25eeb5Syz155240 ni->nai_sum2 = LONG_SUM(in.s_addr); 1967ab25eeb5Syz155240 if ((flags & IPN_TCPUDP)) { 1968ab25eeb5Syz155240 ni->nai_sum1 += ntohs(sport); 1969ab25eeb5Syz155240 ni->nai_sum2 += ntohs(port); 1970ab25eeb5Syz155240 } 1971ab25eeb5Syz155240 1972ab25eeb5Syz155240 if (flags & IPN_TCPUDP) { 1973ab25eeb5Syz155240 nat->nat_inport = sport; 1974ab25eeb5Syz155240 nat->nat_outport = port; /* sport */ 1975ab25eeb5Syz155240 nat->nat_oport = dport; 1976ab25eeb5Syz155240 ((tcphdr_t *)fin->fin_dp)->th_sport = port; 1977ab25eeb5Syz155240 } else if (flags & IPN_ICMPQUERY) { 1978ab25eeb5Syz155240 ((icmphdr_t *)fin->fin_dp)->icmp_id = port; 1979ab25eeb5Syz155240 nat->nat_inport = port; 1980ab25eeb5Syz155240 nat->nat_outport = port; 1981ab25eeb5Syz155240 } 1982ab25eeb5Syz155240 1983ab25eeb5Syz155240 ni->nai_ip.s_addr = in.s_addr; 1984ab25eeb5Syz155240 ni->nai_port = port; 1985ab25eeb5Syz155240 ni->nai_nport = dport; 1986ab25eeb5Syz155240 return 0; 1987ab25eeb5Syz155240 } 1988ab25eeb5Syz155240 1989ab25eeb5Syz155240 1990ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1991ab25eeb5Syz155240 /* Function: nat_newrdr */ 1992ab25eeb5Syz155240 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */ 1993ab25eeb5Syz155240 /* allow rule to be moved if IPN_ROUNDR is set. */ 1994ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 1995ab25eeb5Syz155240 /* nat(I) - pointer to NAT entry */ 1996ab25eeb5Syz155240 /* ni(I) - pointer to structure with misc. information needed */ 1997ab25eeb5Syz155240 /* to create new NAT entry. */ 1998ab25eeb5Syz155240 /* */ 1999ab25eeb5Syz155240 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/ 2000ab25eeb5Syz155240 /* to the new IP address for the translation. */ 2001ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2002ab25eeb5Syz155240 static INLINE int nat_newrdr(fin, nat, ni) 2003ab25eeb5Syz155240 fr_info_t *fin; 2004ab25eeb5Syz155240 nat_t *nat; 2005ab25eeb5Syz155240 natinfo_t *ni; 2006ab25eeb5Syz155240 { 2007ab25eeb5Syz155240 u_short nport, dport, sport; 2008ab25eeb5Syz155240 struct in_addr in; 2009ab25eeb5Syz155240 hostmap_t *hm; 2010ab25eeb5Syz155240 u_32_t flags; 2011ab25eeb5Syz155240 ipnat_t *np; 2012ab25eeb5Syz155240 int move; 2013f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 2014ab25eeb5Syz155240 2015ab25eeb5Syz155240 move = 1; 2016ab25eeb5Syz155240 hm = NULL; 2017ab25eeb5Syz155240 in.s_addr = 0; 2018ab25eeb5Syz155240 np = ni->nai_np; 2019ab25eeb5Syz155240 flags = ni->nai_flags; 2020ab25eeb5Syz155240 sport = ni->nai_sport; 2021ab25eeb5Syz155240 dport = ni->nai_dport; 2022ab25eeb5Syz155240 2023ab25eeb5Syz155240 /* 2024ab25eeb5Syz155240 * If the matching rule has IPN_STICKY set, then we want to have the 2025ab25eeb5Syz155240 * same rule kick in as before. Why would this happen? If you have 2026ab25eeb5Syz155240 * a collection of rdr rules with "round-robin sticky", the current 2027ab25eeb5Syz155240 * packet might match a different one to the previous connection but 2028ab25eeb5Syz155240 * we want the same destination to be used. 2029ab25eeb5Syz155240 */ 2030ab25eeb5Syz155240 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == 2031ab25eeb5Syz155240 (IPN_ROUNDR|IPN_STICKY)) { 2032ab25eeb5Syz155240 hm = nat_hostmap(NULL, fin->fin_src, fin->fin_dst, in, 2033f4b3ec61Sdh155122 (u_32_t)dport, ifs); 2034ab25eeb5Syz155240 if (hm != NULL) { 2035ab25eeb5Syz155240 in.s_addr = ntohl(hm->hm_mapip.s_addr); 2036ab25eeb5Syz155240 np = hm->hm_ipnat; 2037ab25eeb5Syz155240 ni->nai_np = np; 2038ab25eeb5Syz155240 move = 0; 2039ab25eeb5Syz155240 } 2040ab25eeb5Syz155240 } 2041ab25eeb5Syz155240 2042ab25eeb5Syz155240 /* 2043ab25eeb5Syz155240 * Otherwise, it's an inbound packet. Most likely, we don't 2044ab25eeb5Syz155240 * want to rewrite source ports and source addresses. Instead, 2045ab25eeb5Syz155240 * we want to rewrite to a fixed internal address and fixed 2046ab25eeb5Syz155240 * internal port. 2047ab25eeb5Syz155240 */ 2048ab25eeb5Syz155240 if (np->in_flags & IPN_SPLIT) { 2049ab25eeb5Syz155240 in.s_addr = np->in_nip; 2050ab25eeb5Syz155240 2051ab25eeb5Syz155240 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) { 2052ab25eeb5Syz155240 hm = nat_hostmap(np, fin->fin_src, fin->fin_dst, 2053f4b3ec61Sdh155122 in, (u_32_t)dport, ifs); 2054ab25eeb5Syz155240 if (hm != NULL) { 2055ab25eeb5Syz155240 in.s_addr = hm->hm_mapip.s_addr; 2056ab25eeb5Syz155240 move = 0; 2057ab25eeb5Syz155240 } 2058ab25eeb5Syz155240 } 2059ab25eeb5Syz155240 2060ab25eeb5Syz155240 if (hm == NULL || hm->hm_ref == 1) { 2061ab25eeb5Syz155240 if (np->in_inip == htonl(in.s_addr)) { 2062ab25eeb5Syz155240 np->in_nip = ntohl(np->in_inmsk); 2063ab25eeb5Syz155240 move = 0; 2064ab25eeb5Syz155240 } else { 2065ab25eeb5Syz155240 np->in_nip = ntohl(np->in_inip); 2066ab25eeb5Syz155240 } 2067ab25eeb5Syz155240 } 2068ab25eeb5Syz155240 2069ab25eeb5Syz155240 } else if ((np->in_inip == 0) && (np->in_inmsk == 0xffffffff)) { 2070ab25eeb5Syz155240 /* 2071ab25eeb5Syz155240 * 0/32 - use the interface's IP address. 2072ab25eeb5Syz155240 */ 2073f4b3ec61Sdh155122 if (fr_ifpaddr(4, FRI_NORMAL, fin->fin_ifp, &in, NULL, 2074f4b3ec61Sdh155122 fin->fin_ifs) == -1) 2075ab25eeb5Syz155240 return -1; 2076ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 2077ab25eeb5Syz155240 2078ab25eeb5Syz155240 } else if ((np->in_inip == 0) && (np->in_inmsk== 0)) { 2079ab25eeb5Syz155240 /* 2080ab25eeb5Syz155240 * 0/0 - use the original destination address/port. 2081ab25eeb5Syz155240 */ 2082ab25eeb5Syz155240 in.s_addr = ntohl(fin->fin_daddr); 2083ab25eeb5Syz155240 2084ab25eeb5Syz155240 } else if (np->in_redir == NAT_BIMAP && 2085ab25eeb5Syz155240 np->in_inmsk == np->in_outmsk) { 2086ab25eeb5Syz155240 /* 2087ab25eeb5Syz155240 * map the address block in a 1:1 fashion 2088ab25eeb5Syz155240 */ 2089ab25eeb5Syz155240 in.s_addr = np->in_inip; 2090ab25eeb5Syz155240 in.s_addr |= fin->fin_daddr & ~np->in_inmsk; 2091ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 2092ab25eeb5Syz155240 } else { 2093ab25eeb5Syz155240 in.s_addr = ntohl(np->in_inip); 2094ab25eeb5Syz155240 } 2095ab25eeb5Syz155240 2096ab25eeb5Syz155240 if ((np->in_pnext == 0) || ((flags & NAT_NOTRULEPORT) != 0)) 2097ab25eeb5Syz155240 nport = dport; 2098ab25eeb5Syz155240 else { 2099ab25eeb5Syz155240 /* 2100ab25eeb5Syz155240 * Whilst not optimized for the case where 2101ab25eeb5Syz155240 * pmin == pmax, the gain is not significant. 2102ab25eeb5Syz155240 */ 2103ab25eeb5Syz155240 if (((np->in_flags & IPN_FIXEDDPORT) == 0) && 2104ab25eeb5Syz155240 (np->in_pmin != np->in_pmax)) { 2105ab25eeb5Syz155240 nport = ntohs(dport) - ntohs(np->in_pmin) + 2106ab25eeb5Syz155240 ntohs(np->in_pnext); 2107ab25eeb5Syz155240 nport = htons(nport); 2108ab25eeb5Syz155240 } else 2109ab25eeb5Syz155240 nport = np->in_pnext; 2110ab25eeb5Syz155240 } 2111ab25eeb5Syz155240 2112ab25eeb5Syz155240 /* 2113ab25eeb5Syz155240 * When the redirect-to address is set to 0.0.0.0, just 2114ab25eeb5Syz155240 * assume a blank `forwarding' of the packet. We don't 2115ab25eeb5Syz155240 * setup any translation for this either. 2116ab25eeb5Syz155240 */ 2117ab25eeb5Syz155240 if (in.s_addr == 0) { 2118ab25eeb5Syz155240 if (nport == dport) 2119ab25eeb5Syz155240 return -1; 2120ab25eeb5Syz155240 in.s_addr = ntohl(fin->fin_daddr); 2121ab25eeb5Syz155240 } 2122ab25eeb5Syz155240 2123ab25eeb5Syz155240 nat->nat_inip.s_addr = htonl(in.s_addr); 2124ab25eeb5Syz155240 nat->nat_outip = fin->fin_dst; 2125ab25eeb5Syz155240 nat->nat_oip = fin->fin_src; 2126ab25eeb5Syz155240 2127ab25eeb5Syz155240 ni->nai_sum1 = LONG_SUM(ntohl(fin->fin_daddr)) + ntohs(dport); 2128ab25eeb5Syz155240 ni->nai_sum2 = LONG_SUM(in.s_addr) + ntohs(nport); 2129ab25eeb5Syz155240 2130ab25eeb5Syz155240 ni->nai_ip.s_addr = in.s_addr; 2131ab25eeb5Syz155240 ni->nai_nport = nport; 2132ab25eeb5Syz155240 ni->nai_port = sport; 2133ab25eeb5Syz155240 2134ab25eeb5Syz155240 if (flags & IPN_TCPUDP) { 2135ab25eeb5Syz155240 nat->nat_inport = nport; 2136ab25eeb5Syz155240 nat->nat_outport = dport; 2137ab25eeb5Syz155240 nat->nat_oport = sport; 2138ab25eeb5Syz155240 ((tcphdr_t *)fin->fin_dp)->th_dport = nport; 2139ab25eeb5Syz155240 } else if (flags & IPN_ICMPQUERY) { 2140ab25eeb5Syz155240 ((icmphdr_t *)fin->fin_dp)->icmp_id = nport; 2141ab25eeb5Syz155240 nat->nat_inport = nport; 2142ab25eeb5Syz155240 nat->nat_outport = nport; 2143ab25eeb5Syz155240 } 2144ab25eeb5Syz155240 2145ab25eeb5Syz155240 return move; 2146ab25eeb5Syz155240 } 2147ab25eeb5Syz155240 2148ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2149ab25eeb5Syz155240 /* Function: nat_new */ 2150ab25eeb5Syz155240 /* Returns: nat_t* - NULL == failure to create new NAT structure, */ 2151ab25eeb5Syz155240 /* else pointer to new NAT structure */ 2152ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2153ab25eeb5Syz155240 /* np(I) - pointer to NAT rule */ 2154ab25eeb5Syz155240 /* natsave(I) - pointer to where to store NAT struct pointer */ 2155ab25eeb5Syz155240 /* flags(I) - flags describing the current packet */ 2156ab25eeb5Syz155240 /* direction(I) - direction of packet (in/out) */ 2157ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 2158ab25eeb5Syz155240 /* */ 2159ab25eeb5Syz155240 /* Attempts to create a new NAT entry. Does not actually change the packet */ 2160ab25eeb5Syz155240 /* in any way. */ 2161ab25eeb5Syz155240 /* */ 2162ab25eeb5Syz155240 /* This fucntion is in three main parts: (1) deal with creating a new NAT */ 2163ab25eeb5Syz155240 /* structure for a "MAP" rule (outgoing NAT translation); (2) deal with */ 2164ab25eeb5Syz155240 /* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */ 2165ab25eeb5Syz155240 /* and (3) building that structure and putting it into the NAT table(s). */ 2166ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2167ab25eeb5Syz155240 nat_t *nat_new(fin, np, natsave, flags, direction) 2168ab25eeb5Syz155240 fr_info_t *fin; 2169ab25eeb5Syz155240 ipnat_t *np; 2170ab25eeb5Syz155240 nat_t **natsave; 2171ab25eeb5Syz155240 u_int flags; 2172ab25eeb5Syz155240 int direction; 2173ab25eeb5Syz155240 { 2174ab25eeb5Syz155240 u_short port = 0, sport = 0, dport = 0, nport = 0; 2175ab25eeb5Syz155240 tcphdr_t *tcp = NULL; 2176ab25eeb5Syz155240 hostmap_t *hm = NULL; 2177ab25eeb5Syz155240 struct in_addr in; 2178ab25eeb5Syz155240 nat_t *nat, *natl; 2179ab25eeb5Syz155240 u_int nflags; 2180ab25eeb5Syz155240 natinfo_t ni; 2181ab25eeb5Syz155240 u_32_t sumd; 2182ab25eeb5Syz155240 int move; 2183f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 2184ab25eeb5Syz155240 2185f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_inuse >= ifs->ifs_ipf_nattable_max) { 2186f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_memfail++; 2187ab25eeb5Syz155240 return NULL; 2188ab25eeb5Syz155240 } 2189ab25eeb5Syz155240 2190ab25eeb5Syz155240 move = 1; 2191ab25eeb5Syz155240 nflags = np->in_flags & flags; 2192ab25eeb5Syz155240 nflags &= NAT_FROMRULE; 2193ab25eeb5Syz155240 2194ab25eeb5Syz155240 ni.nai_np = np; 2195ab25eeb5Syz155240 ni.nai_nflags = nflags; 2196ab25eeb5Syz155240 ni.nai_flags = flags; 2197ab25eeb5Syz155240 2198ab25eeb5Syz155240 /* Give me a new nat */ 2199ab25eeb5Syz155240 KMALLOC(nat, nat_t *); 2200ab25eeb5Syz155240 if (nat == NULL) { 2201f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_memfail++; 2202ab25eeb5Syz155240 /* 2203ab25eeb5Syz155240 * Try to automatically tune the max # of entries in the 2204ab25eeb5Syz155240 * table allowed to be less than what will cause kmem_alloc() 2205ab25eeb5Syz155240 * to fail and try to eliminate panics due to out of memory 2206ab25eeb5Syz155240 * conditions arising. 2207ab25eeb5Syz155240 */ 2208f4b3ec61Sdh155122 if (ifs->ifs_ipf_nattable_max > ifs->ifs_ipf_nattable_sz) { 2209f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_max = ifs->ifs_nat_stats.ns_inuse - 100; 2210ab25eeb5Syz155240 printf("ipf_nattable_max reduced to %d\n", 2211f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_max); 2212ab25eeb5Syz155240 } 2213ab25eeb5Syz155240 return NULL; 2214ab25eeb5Syz155240 } 2215ab25eeb5Syz155240 2216ab25eeb5Syz155240 if (flags & IPN_TCPUDP) { 2217ab25eeb5Syz155240 tcp = fin->fin_dp; 2218ab25eeb5Syz155240 ni.nai_sport = htons(fin->fin_sport); 2219ab25eeb5Syz155240 ni.nai_dport = htons(fin->fin_dport); 2220ab25eeb5Syz155240 } else if (flags & IPN_ICMPQUERY) { 2221ab25eeb5Syz155240 /* 2222ab25eeb5Syz155240 * In the ICMP query NAT code, we translate the ICMP id fields 2223ab25eeb5Syz155240 * to make them unique. This is indepedent of the ICMP type 2224ab25eeb5Syz155240 * (e.g. in the unlikely event that a host sends an echo and 2225ab25eeb5Syz155240 * an tstamp request with the same id, both packets will have 2226ab25eeb5Syz155240 * their ip address/id field changed in the same way). 2227ab25eeb5Syz155240 */ 2228ab25eeb5Syz155240 /* The icmp_id field is used by the sender to identify the 2229ab25eeb5Syz155240 * process making the icmp request. (the receiver justs 2230ab25eeb5Syz155240 * copies it back in its response). So, it closely matches 2231ab25eeb5Syz155240 * the concept of source port. We overlay sport, so we can 2232ab25eeb5Syz155240 * maximally reuse the existing code. 2233ab25eeb5Syz155240 */ 2234ab25eeb5Syz155240 ni.nai_sport = ((icmphdr_t *)fin->fin_dp)->icmp_id; 2235ab25eeb5Syz155240 ni.nai_dport = ni.nai_sport; 2236ab25eeb5Syz155240 } 2237ab25eeb5Syz155240 2238ab25eeb5Syz155240 bzero((char *)nat, sizeof(*nat)); 2239ab25eeb5Syz155240 nat->nat_flags = flags; 2240f4b3ec61Sdh155122 nat->nat_redir = np->in_redir; 2241ab25eeb5Syz155240 2242ab25eeb5Syz155240 if ((flags & NAT_SLAVE) == 0) { 2243f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 2244ab25eeb5Syz155240 } 2245ab25eeb5Syz155240 2246ab25eeb5Syz155240 /* 2247ab25eeb5Syz155240 * Search the current table for a match. 2248ab25eeb5Syz155240 */ 2249ab25eeb5Syz155240 if (direction == NAT_OUTBOUND) { 2250ab25eeb5Syz155240 /* 2251ab25eeb5Syz155240 * We can now arrange to call this for the same connection 2252ab25eeb5Syz155240 * because ipf_nat_new doesn't protect the code path into 2253ab25eeb5Syz155240 * this function. 2254ab25eeb5Syz155240 */ 2255ab25eeb5Syz155240 natl = nat_outlookup(fin, nflags, (u_int)fin->fin_p, 2256ab25eeb5Syz155240 fin->fin_src, fin->fin_dst); 2257ab25eeb5Syz155240 if (natl != NULL) { 2258dcf3e898Sjojemann KFREE(nat); 2259ab25eeb5Syz155240 nat = natl; 2260ab25eeb5Syz155240 goto done; 2261ab25eeb5Syz155240 } 2262ab25eeb5Syz155240 2263ab25eeb5Syz155240 move = nat_newmap(fin, nat, &ni); 2264ab25eeb5Syz155240 if (move == -1) 2265ab25eeb5Syz155240 goto badnat; 2266ab25eeb5Syz155240 2267ab25eeb5Syz155240 np = ni.nai_np; 2268ab25eeb5Syz155240 in = ni.nai_ip; 2269ab25eeb5Syz155240 } else { 2270ab25eeb5Syz155240 /* 2271ab25eeb5Syz155240 * NAT_INBOUND is used only for redirects rules 2272ab25eeb5Syz155240 */ 2273ab25eeb5Syz155240 natl = nat_inlookup(fin, nflags, (u_int)fin->fin_p, 2274ab25eeb5Syz155240 fin->fin_src, fin->fin_dst); 2275ab25eeb5Syz155240 if (natl != NULL) { 2276dcf3e898Sjojemann KFREE(nat); 2277ab25eeb5Syz155240 nat = natl; 2278ab25eeb5Syz155240 goto done; 2279ab25eeb5Syz155240 } 2280ab25eeb5Syz155240 2281ab25eeb5Syz155240 move = nat_newrdr(fin, nat, &ni); 2282ab25eeb5Syz155240 if (move == -1) 2283ab25eeb5Syz155240 goto badnat; 2284ab25eeb5Syz155240 2285ab25eeb5Syz155240 np = ni.nai_np; 2286ab25eeb5Syz155240 in = ni.nai_ip; 2287ab25eeb5Syz155240 } 2288ab25eeb5Syz155240 port = ni.nai_port; 2289ab25eeb5Syz155240 nport = ni.nai_nport; 2290ab25eeb5Syz155240 2291ab25eeb5Syz155240 if ((move == 1) && (np->in_flags & IPN_ROUNDR)) { 2292ab25eeb5Syz155240 if (np->in_redir == NAT_REDIRECT) { 2293ab25eeb5Syz155240 nat_delrdr(np); 2294f4b3ec61Sdh155122 nat_addrdr(np, ifs); 2295ab25eeb5Syz155240 } else if (np->in_redir == NAT_MAP) { 2296ab25eeb5Syz155240 nat_delnat(np); 2297f4b3ec61Sdh155122 nat_addnat(np, ifs); 2298ab25eeb5Syz155240 } 2299ab25eeb5Syz155240 } 2300ab25eeb5Syz155240 2301ab25eeb5Syz155240 if (flags & IPN_TCPUDP) { 2302ab25eeb5Syz155240 sport = ni.nai_sport; 2303ab25eeb5Syz155240 dport = ni.nai_dport; 2304ab25eeb5Syz155240 } else if (flags & IPN_ICMPQUERY) { 2305ab25eeb5Syz155240 sport = ni.nai_sport; 2306ab25eeb5Syz155240 dport = 0; 2307ab25eeb5Syz155240 } 2308ab25eeb5Syz155240 2309381a2a9aSdr146992 /* 2310381a2a9aSdr146992 * nat_sumd[0] stores adjustment value including both IP address and 2311381a2a9aSdr146992 * port number changes. nat_sumd[1] stores adjustment value only for 2312381a2a9aSdr146992 * IP address changes, to be used for pseudo header adjustment, in 2313381a2a9aSdr146992 * case hardware partial checksum offload is offered. 2314381a2a9aSdr146992 */ 2315ab25eeb5Syz155240 CALC_SUMD(ni.nai_sum1, ni.nai_sum2, sumd); 2316ab25eeb5Syz155240 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 2317381a2a9aSdr146992 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) 2318381a2a9aSdr146992 if (flags & IPN_TCPUDP) { 2319ab25eeb5Syz155240 ni.nai_sum1 = LONG_SUM(in.s_addr); 2320381a2a9aSdr146992 if (direction == NAT_OUTBOUND) 2321381a2a9aSdr146992 ni.nai_sum2 = LONG_SUM(ntohl(fin->fin_saddr)); 2322ab25eeb5Syz155240 else 2323381a2a9aSdr146992 ni.nai_sum2 = LONG_SUM(ntohl(fin->fin_daddr)); 2324381a2a9aSdr146992 2325381a2a9aSdr146992 CALC_SUMD(ni.nai_sum1, ni.nai_sum2, sumd); 2326381a2a9aSdr146992 nat->nat_sumd[1] = (sumd & 0xffff) + (sumd >> 16); 2327ab25eeb5Syz155240 } else 2328ab25eeb5Syz155240 #endif 2329ab25eeb5Syz155240 nat->nat_sumd[1] = nat->nat_sumd[0]; 2330ab25eeb5Syz155240 2331ab25eeb5Syz155240 if ((flags & IPN_TCPUDPICMP) && ((sport != port) || (dport != nport))) { 2332ab25eeb5Syz155240 if (direction == NAT_OUTBOUND) 2333ab25eeb5Syz155240 ni.nai_sum1 = LONG_SUM(ntohl(fin->fin_saddr)); 2334ab25eeb5Syz155240 else 2335ab25eeb5Syz155240 ni.nai_sum1 = LONG_SUM(ntohl(fin->fin_daddr)); 2336ab25eeb5Syz155240 2337ab25eeb5Syz155240 ni.nai_sum2 = LONG_SUM(in.s_addr); 2338ab25eeb5Syz155240 2339ab25eeb5Syz155240 CALC_SUMD(ni.nai_sum1, ni.nai_sum2, sumd); 2340ab25eeb5Syz155240 nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16); 2341ab25eeb5Syz155240 } else { 2342ab25eeb5Syz155240 nat->nat_ipsumd = nat->nat_sumd[0]; 2343ab25eeb5Syz155240 if (!(flags & IPN_TCPUDPICMP)) { 2344ab25eeb5Syz155240 nat->nat_sumd[0] = 0; 2345ab25eeb5Syz155240 nat->nat_sumd[1] = 0; 2346ab25eeb5Syz155240 } 2347ab25eeb5Syz155240 } 2348ab25eeb5Syz155240 2349ab25eeb5Syz155240 if (nat_finalise(fin, nat, &ni, tcp, natsave, direction) == -1) { 2350ab25eeb5Syz155240 goto badnat; 2351ab25eeb5Syz155240 } 2352ab25eeb5Syz155240 if (flags & SI_WILDP) 2353f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_wilds++; 2354ab25eeb5Syz155240 goto done; 2355ab25eeb5Syz155240 badnat: 2356f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_badnat++; 2357ab25eeb5Syz155240 if ((hm = nat->nat_hm) != NULL) 2358ab25eeb5Syz155240 nat_hostmapdel(hm); 2359ab25eeb5Syz155240 KFREE(nat); 2360ab25eeb5Syz155240 nat = NULL; 2361ab25eeb5Syz155240 done: 2362ab25eeb5Syz155240 if ((flags & NAT_SLAVE) == 0) { 2363f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 2364ab25eeb5Syz155240 } 2365ab25eeb5Syz155240 return nat; 2366ab25eeb5Syz155240 } 2367ab25eeb5Syz155240 2368ab25eeb5Syz155240 2369ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2370ab25eeb5Syz155240 /* Function: nat_finalise */ 2371ab25eeb5Syz155240 /* Returns: int - 0 == sucess, -1 == failure */ 2372ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2373ab25eeb5Syz155240 /* nat(I) - pointer to NAT entry */ 2374ab25eeb5Syz155240 /* ni(I) - pointer to structure with misc. information needed */ 2375ab25eeb5Syz155240 /* to create new NAT entry. */ 2376ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 2377ab25eeb5Syz155240 /* */ 2378ab25eeb5Syz155240 /* This is the tail end of constructing a new NAT entry and is the same */ 2379ab25eeb5Syz155240 /* for both IPv4 and IPv6. */ 2380ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2381ab25eeb5Syz155240 /*ARGSUSED*/ 2382ab25eeb5Syz155240 static INLINE int nat_finalise(fin, nat, ni, tcp, natsave, direction) 2383ab25eeb5Syz155240 fr_info_t *fin; 2384ab25eeb5Syz155240 nat_t *nat; 2385ab25eeb5Syz155240 natinfo_t *ni; 2386ab25eeb5Syz155240 tcphdr_t *tcp; 2387ab25eeb5Syz155240 nat_t **natsave; 2388ab25eeb5Syz155240 int direction; 2389ab25eeb5Syz155240 { 2390ab25eeb5Syz155240 frentry_t *fr; 2391ab25eeb5Syz155240 ipnat_t *np; 2392f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 2393ab25eeb5Syz155240 2394ab25eeb5Syz155240 np = ni->nai_np; 2395ab25eeb5Syz155240 2396381a2a9aSdr146992 COPYIFNAME(fin->fin_ifp, nat->nat_ifnames[0], fin->fin_v); 2397381a2a9aSdr146992 2398ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 2399ab25eeb5Syz155240 if ((nat->nat_flags & SI_CLONE) == 0) 2400ab25eeb5Syz155240 nat->nat_sync = ipfsync_new(SMC_NAT, fin, nat); 2401ab25eeb5Syz155240 #endif 2402ab25eeb5Syz155240 2403ab25eeb5Syz155240 nat->nat_me = natsave; 2404ab25eeb5Syz155240 nat->nat_dir = direction; 2405e6c6c1faSyz155240 nat->nat_ifps[0] = np->in_ifps[0]; 2406e6c6c1faSyz155240 nat->nat_ifps[1] = np->in_ifps[1]; 2407ab25eeb5Syz155240 nat->nat_ptr = np; 2408ab25eeb5Syz155240 nat->nat_p = fin->fin_p; 2409ab25eeb5Syz155240 nat->nat_mssclamp = np->in_mssclamp; 2410ab25eeb5Syz155240 fr = fin->fin_fr; 2411ab25eeb5Syz155240 nat->nat_fr = fr; 2412ab25eeb5Syz155240 2413ab25eeb5Syz155240 if ((np->in_apr != NULL) && ((ni->nai_flags & NAT_SLAVE) == 0)) 2414ab25eeb5Syz155240 if (appr_new(fin, nat) == -1) 2415ab25eeb5Syz155240 return -1; 2416ab25eeb5Syz155240 2417f4b3ec61Sdh155122 if (nat_insert(nat, fin->fin_rev, ifs) == 0) { 2418f4b3ec61Sdh155122 if (ifs->ifs_nat_logging) 2419f4b3ec61Sdh155122 nat_log(nat, (u_int)np->in_redir, ifs); 2420ab25eeb5Syz155240 np->in_use++; 2421ab25eeb5Syz155240 if (fr != NULL) { 2422ab25eeb5Syz155240 MUTEX_ENTER(&fr->fr_lock); 2423ab25eeb5Syz155240 fr->fr_ref++; 2424ab25eeb5Syz155240 MUTEX_EXIT(&fr->fr_lock); 2425ab25eeb5Syz155240 } 2426ab25eeb5Syz155240 return 0; 2427ab25eeb5Syz155240 } 2428ab25eeb5Syz155240 2429ab25eeb5Syz155240 /* 2430ab25eeb5Syz155240 * nat_insert failed, so cleanup time... 2431ab25eeb5Syz155240 */ 2432ab25eeb5Syz155240 return -1; 2433ab25eeb5Syz155240 } 2434ab25eeb5Syz155240 2435ab25eeb5Syz155240 2436ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2437ab25eeb5Syz155240 /* Function: nat_insert */ 2438ab25eeb5Syz155240 /* Returns: int - 0 == sucess, -1 == failure */ 2439ab25eeb5Syz155240 /* Parameters: nat(I) - pointer to NAT structure */ 2440ab25eeb5Syz155240 /* rev(I) - flag indicating forward/reverse direction of packet */ 2441ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 2442ab25eeb5Syz155240 /* */ 2443ab25eeb5Syz155240 /* Insert a NAT entry into the hash tables for searching and add it to the */ 2444ab25eeb5Syz155240 /* list of active NAT entries. Adjust global counters when complete. */ 2445ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2446f4b3ec61Sdh155122 int nat_insert(nat, rev, ifs) 2447ab25eeb5Syz155240 nat_t *nat; 2448ab25eeb5Syz155240 int rev; 2449f4b3ec61Sdh155122 ipf_stack_t *ifs; 2450ab25eeb5Syz155240 { 2451ab25eeb5Syz155240 u_int hv1, hv2; 2452ab25eeb5Syz155240 nat_t **natp; 2453ab25eeb5Syz155240 2454ab25eeb5Syz155240 /* 2455ab25eeb5Syz155240 * Try and return an error as early as possible, so calculate the hash 2456ab25eeb5Syz155240 * entry numbers first and then proceed. 2457ab25eeb5Syz155240 */ 2458ab25eeb5Syz155240 if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) { 2459ab25eeb5Syz155240 hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport, 2460ab25eeb5Syz155240 0xffffffff); 2461ab25eeb5Syz155240 hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1 + nat->nat_oport, 2462f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 2463ab25eeb5Syz155240 hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport, 2464ab25eeb5Syz155240 0xffffffff); 2465ab25eeb5Syz155240 hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2 + nat->nat_oport, 2466f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 2467ab25eeb5Syz155240 } else { 2468ab25eeb5Syz155240 hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, 0, 0xffffffff); 2469f4b3ec61Sdh155122 hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1, 2470f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 2471ab25eeb5Syz155240 hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, 0, 0xffffffff); 2472f4b3ec61Sdh155122 hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2, 2473f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 2474ab25eeb5Syz155240 } 2475ab25eeb5Syz155240 2476f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[0][hv1] >= ifs->ifs_fr_nat_maxbucket || 2477f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][hv2] >= ifs->ifs_fr_nat_maxbucket) { 2478ab25eeb5Syz155240 return -1; 2479ab25eeb5Syz155240 } 2480ab25eeb5Syz155240 2481ab25eeb5Syz155240 nat->nat_hv[0] = hv1; 2482ab25eeb5Syz155240 nat->nat_hv[1] = hv2; 2483ab25eeb5Syz155240 2484ab25eeb5Syz155240 MUTEX_INIT(&nat->nat_lock, "nat entry lock"); 2485ab25eeb5Syz155240 2486ab25eeb5Syz155240 nat->nat_rev = rev; 2487ab25eeb5Syz155240 nat->nat_ref = 1; 2488ab25eeb5Syz155240 nat->nat_bytes[0] = 0; 2489ab25eeb5Syz155240 nat->nat_pkts[0] = 0; 2490ab25eeb5Syz155240 nat->nat_bytes[1] = 0; 2491ab25eeb5Syz155240 nat->nat_pkts[1] = 0; 2492ab25eeb5Syz155240 2493ab25eeb5Syz155240 nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0'; 2494f4b3ec61Sdh155122 nat->nat_ifps[0] = fr_resolvenic(nat->nat_ifnames[0], 4, ifs); 2495ab25eeb5Syz155240 2496ab25eeb5Syz155240 if (nat->nat_ifnames[1][0] !='\0') { 2497ab25eeb5Syz155240 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0'; 2498f4b3ec61Sdh155122 nat->nat_ifps[1] = fr_resolvenic(nat->nat_ifnames[1], 4, ifs); 2499ab25eeb5Syz155240 } else { 2500ab25eeb5Syz155240 (void) strncpy(nat->nat_ifnames[1], nat->nat_ifnames[0], 2501ab25eeb5Syz155240 LIFNAMSIZ); 2502ab25eeb5Syz155240 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0'; 2503ab25eeb5Syz155240 nat->nat_ifps[1] = nat->nat_ifps[0]; 2504ab25eeb5Syz155240 } 2505ab25eeb5Syz155240 2506f4b3ec61Sdh155122 nat->nat_next = ifs->ifs_nat_instances; 2507f4b3ec61Sdh155122 nat->nat_pnext = &ifs->ifs_nat_instances; 2508f4b3ec61Sdh155122 if (ifs->ifs_nat_instances) 2509f4b3ec61Sdh155122 ifs->ifs_nat_instances->nat_pnext = &nat->nat_next; 2510f4b3ec61Sdh155122 ifs->ifs_nat_instances = nat; 2511ab25eeb5Syz155240 2512f4b3ec61Sdh155122 natp = &ifs->ifs_nat_table[0][hv1]; 2513ab25eeb5Syz155240 if (*natp) 2514ab25eeb5Syz155240 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 2515ab25eeb5Syz155240 nat->nat_phnext[0] = natp; 2516ab25eeb5Syz155240 nat->nat_hnext[0] = *natp; 2517ab25eeb5Syz155240 *natp = nat; 2518f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0][hv1]++; 2519ab25eeb5Syz155240 2520f4b3ec61Sdh155122 natp = &ifs->ifs_nat_table[1][hv2]; 2521ab25eeb5Syz155240 if (*natp) 2522ab25eeb5Syz155240 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 2523ab25eeb5Syz155240 nat->nat_phnext[1] = natp; 2524ab25eeb5Syz155240 nat->nat_hnext[1] = *natp; 2525ab25eeb5Syz155240 *natp = nat; 2526f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][hv2]++; 2527ab25eeb5Syz155240 2528f4b3ec61Sdh155122 fr_setnatqueue(nat, rev, ifs); 2529ab25eeb5Syz155240 2530f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_added++; 2531f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_inuse++; 2532ab25eeb5Syz155240 return 0; 2533ab25eeb5Syz155240 } 2534ab25eeb5Syz155240 2535ab25eeb5Syz155240 2536ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2537ab25eeb5Syz155240 /* Function: nat_icmperrorlookup */ 2538ab25eeb5Syz155240 /* Returns: nat_t* - point to matching NAT structure */ 2539ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2540ab25eeb5Syz155240 /* dir(I) - direction of packet (in/out) */ 2541ab25eeb5Syz155240 /* */ 2542ab25eeb5Syz155240 /* Check if the ICMP error message is related to an existing TCP, UDP or */ 2543ab25eeb5Syz155240 /* ICMP query nat entry. It is assumed that the packet is already of the */ 2544ab25eeb5Syz155240 /* the required length. */ 2545ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2546ab25eeb5Syz155240 nat_t *nat_icmperrorlookup(fin, dir) 2547ab25eeb5Syz155240 fr_info_t *fin; 2548ab25eeb5Syz155240 int dir; 2549ab25eeb5Syz155240 { 2550ab25eeb5Syz155240 int flags = 0, minlen; 2551ab25eeb5Syz155240 icmphdr_t *orgicmp; 2552ab25eeb5Syz155240 tcphdr_t *tcp = NULL; 2553ab25eeb5Syz155240 u_short data[2]; 2554ab25eeb5Syz155240 nat_t *nat; 2555ab25eeb5Syz155240 ip_t *oip; 2556ab25eeb5Syz155240 u_int p; 2557ab25eeb5Syz155240 2558ab25eeb5Syz155240 /* 2559ab25eeb5Syz155240 * Does it at least have the return (basic) IP header ? 2560ab25eeb5Syz155240 * Only a basic IP header (no options) should be with an ICMP error 2561ab25eeb5Syz155240 * header. Also, if it's not an error type, then return. 2562ab25eeb5Syz155240 */ 2563ab25eeb5Syz155240 if ((fin->fin_hlen != sizeof(ip_t)) || !(fin->fin_flx & FI_ICMPERR)) 2564ab25eeb5Syz155240 return NULL; 2565ab25eeb5Syz155240 2566ab25eeb5Syz155240 /* 2567ab25eeb5Syz155240 * Check packet size 2568ab25eeb5Syz155240 */ 2569ab25eeb5Syz155240 oip = (ip_t *)((char *)fin->fin_dp + 8); 2570ab25eeb5Syz155240 minlen = IP_HL(oip) << 2; 2571ab25eeb5Syz155240 if ((minlen < sizeof(ip_t)) || 2572ab25eeb5Syz155240 (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen)) 2573ab25eeb5Syz155240 return NULL; 2574ab25eeb5Syz155240 /* 2575ab25eeb5Syz155240 * Is the buffer big enough for all of it ? It's the size of the IP 2576ab25eeb5Syz155240 * header claimed in the encapsulated part which is of concern. It 2577ab25eeb5Syz155240 * may be too big to be in this buffer but not so big that it's 2578ab25eeb5Syz155240 * outside the ICMP packet, leading to TCP deref's causing problems. 2579ab25eeb5Syz155240 * This is possible because we don't know how big oip_hl is when we 2580ab25eeb5Syz155240 * do the pullup early in fr_check() and thus can't gaurantee it is 2581ab25eeb5Syz155240 * all here now. 2582ab25eeb5Syz155240 */ 2583ab25eeb5Syz155240 #ifdef _KERNEL 2584ab25eeb5Syz155240 { 2585ab25eeb5Syz155240 mb_t *m; 2586ab25eeb5Syz155240 2587ab25eeb5Syz155240 m = fin->fin_m; 2588ab25eeb5Syz155240 # if defined(MENTAT) 2589ab25eeb5Syz155240 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > (char *)m->b_wptr) 2590ab25eeb5Syz155240 return NULL; 2591ab25eeb5Syz155240 # else 2592ab25eeb5Syz155240 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > 2593ab25eeb5Syz155240 (char *)fin->fin_ip + M_LEN(m)) 2594ab25eeb5Syz155240 return NULL; 2595ab25eeb5Syz155240 # endif 2596ab25eeb5Syz155240 } 2597ab25eeb5Syz155240 #endif 2598ab25eeb5Syz155240 2599ab25eeb5Syz155240 if (fin->fin_daddr != oip->ip_src.s_addr) 2600ab25eeb5Syz155240 return NULL; 2601ab25eeb5Syz155240 2602ab25eeb5Syz155240 p = oip->ip_p; 2603ab25eeb5Syz155240 if (p == IPPROTO_TCP) 2604ab25eeb5Syz155240 flags = IPN_TCP; 2605ab25eeb5Syz155240 else if (p == IPPROTO_UDP) 2606ab25eeb5Syz155240 flags = IPN_UDP; 2607ab25eeb5Syz155240 else if (p == IPPROTO_ICMP) { 2608ab25eeb5Syz155240 orgicmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 2609ab25eeb5Syz155240 2610ab25eeb5Syz155240 /* see if this is related to an ICMP query */ 2611ab25eeb5Syz155240 if (nat_icmpquerytype4(orgicmp->icmp_type)) { 2612ab25eeb5Syz155240 data[0] = fin->fin_data[0]; 2613ab25eeb5Syz155240 data[1] = fin->fin_data[1]; 2614ab25eeb5Syz155240 fin->fin_data[0] = 0; 2615ab25eeb5Syz155240 fin->fin_data[1] = orgicmp->icmp_id; 2616ab25eeb5Syz155240 2617ab25eeb5Syz155240 flags = IPN_ICMPERR|IPN_ICMPQUERY; 2618ab25eeb5Syz155240 /* 2619ab25eeb5Syz155240 * NOTE : dir refers to the direction of the original 2620ab25eeb5Syz155240 * ip packet. By definition the icmp error 2621ab25eeb5Syz155240 * message flows in the opposite direction. 2622ab25eeb5Syz155240 */ 2623ab25eeb5Syz155240 if (dir == NAT_INBOUND) 2624ab25eeb5Syz155240 nat = nat_inlookup(fin, flags, p, oip->ip_dst, 2625ab25eeb5Syz155240 oip->ip_src); 2626ab25eeb5Syz155240 else 2627ab25eeb5Syz155240 nat = nat_outlookup(fin, flags, p, oip->ip_dst, 2628ab25eeb5Syz155240 oip->ip_src); 2629ab25eeb5Syz155240 fin->fin_data[0] = data[0]; 2630ab25eeb5Syz155240 fin->fin_data[1] = data[1]; 2631ab25eeb5Syz155240 return nat; 2632ab25eeb5Syz155240 } 2633ab25eeb5Syz155240 } 2634ab25eeb5Syz155240 2635ab25eeb5Syz155240 if (flags & IPN_TCPUDP) { 2636ab25eeb5Syz155240 minlen += 8; /* + 64bits of data to get ports */ 2637ab25eeb5Syz155240 if (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen) 2638ab25eeb5Syz155240 return NULL; 2639ab25eeb5Syz155240 2640ab25eeb5Syz155240 data[0] = fin->fin_data[0]; 2641ab25eeb5Syz155240 data[1] = fin->fin_data[1]; 2642ab25eeb5Syz155240 tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 2643ab25eeb5Syz155240 fin->fin_data[0] = ntohs(tcp->th_dport); 2644ab25eeb5Syz155240 fin->fin_data[1] = ntohs(tcp->th_sport); 2645ab25eeb5Syz155240 2646ab25eeb5Syz155240 if (dir == NAT_INBOUND) { 2647ab25eeb5Syz155240 nat = nat_inlookup(fin, flags, p, oip->ip_dst, 2648ab25eeb5Syz155240 oip->ip_src); 2649ab25eeb5Syz155240 } else { 2650ab25eeb5Syz155240 nat = nat_outlookup(fin, flags, p, oip->ip_dst, 2651ab25eeb5Syz155240 oip->ip_src); 2652ab25eeb5Syz155240 } 2653ab25eeb5Syz155240 fin->fin_data[0] = data[0]; 2654ab25eeb5Syz155240 fin->fin_data[1] = data[1]; 2655ab25eeb5Syz155240 return nat; 2656ab25eeb5Syz155240 } 2657ab25eeb5Syz155240 if (dir == NAT_INBOUND) 2658ab25eeb5Syz155240 return nat_inlookup(fin, 0, p, oip->ip_dst, oip->ip_src); 2659ab25eeb5Syz155240 else 2660ab25eeb5Syz155240 return nat_outlookup(fin, 0, p, oip->ip_dst, oip->ip_src); 2661ab25eeb5Syz155240 } 2662ab25eeb5Syz155240 2663ab25eeb5Syz155240 2664ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2665ab25eeb5Syz155240 /* Function: nat_icmperror */ 2666ab25eeb5Syz155240 /* Returns: nat_t* - point to matching NAT structure */ 2667ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2668ab25eeb5Syz155240 /* nflags(I) - NAT flags for this packet */ 2669ab25eeb5Syz155240 /* dir(I) - direction of packet (in/out) */ 2670ab25eeb5Syz155240 /* */ 2671ab25eeb5Syz155240 /* Fix up an ICMP packet which is an error message for an existing NAT */ 2672ab25eeb5Syz155240 /* session. This will correct both packet header data and checksums. */ 2673ab25eeb5Syz155240 /* */ 2674ab25eeb5Syz155240 /* This should *ONLY* be used for incoming ICMP error packets to make sure */ 2675ab25eeb5Syz155240 /* a NAT'd ICMP packet gets correctly recognised. */ 2676ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2677ab25eeb5Syz155240 nat_t *nat_icmperror(fin, nflags, dir) 2678ab25eeb5Syz155240 fr_info_t *fin; 2679ab25eeb5Syz155240 u_int *nflags; 2680ab25eeb5Syz155240 int dir; 2681ab25eeb5Syz155240 { 26825142ed1fSjojemann u_32_t sum1, sum2, sumd, psum1, psum2, psumd, sumd2; 2683ab25eeb5Syz155240 struct in_addr in; 26845142ed1fSjojemann icmphdr_t *icmp, *orgicmp; 26855142ed1fSjojemann int dlen; 26865142ed1fSjojemann udphdr_t *udp; 2687ab25eeb5Syz155240 tcphdr_t *tcp; 2688ab25eeb5Syz155240 nat_t *nat; 2689ab25eeb5Syz155240 ip_t *oip; 2690ab25eeb5Syz155240 if ((fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) 2691ab25eeb5Syz155240 return NULL; 26925142ed1fSjojemann 2693ab25eeb5Syz155240 /* 26945142ed1fSjojemann * nat_icmperrorlookup() looks up nat entry associated with the 26955142ed1fSjojemann * offending IP packet and returns pointer to the entry, or NULL 26965142ed1fSjojemann * if packet wasn't natted or for `defective' packets. 2697ab25eeb5Syz155240 */ 26985142ed1fSjojemann 2699ab25eeb5Syz155240 if ((fin->fin_v != 4) || !(nat = nat_icmperrorlookup(fin, dir))) 2700ab25eeb5Syz155240 return NULL; 2701ab25eeb5Syz155240 2702ab25eeb5Syz155240 sumd2 = 0; 2703ab25eeb5Syz155240 *nflags = IPN_ICMPERR; 2704ab25eeb5Syz155240 icmp = fin->fin_dp; 2705ab25eeb5Syz155240 oip = (ip_t *)&icmp->icmp_ip; 27065142ed1fSjojemann udp = (udphdr_t *)((((char *)oip) + (IP_HL(oip) << 2))); 27075142ed1fSjojemann tcp = (tcphdr_t *)udp; 27085142ed1fSjojemann dlen = fin->fin_plen - ((char *)udp - (char *)fin->fin_ip); 2709ab25eeb5Syz155240 2710ab25eeb5Syz155240 /* 2711ab25eeb5Syz155240 * Need to adjust ICMP header to include the real IP#'s and 27125142ed1fSjojemann * port #'s. There are three steps required. 2713ab25eeb5Syz155240 * 27145142ed1fSjojemann * Step 1 27155142ed1fSjojemann * Fix the IP addresses in the offending IP packet and update 27165142ed1fSjojemann * ip header checksum to compensate for the change. 27175142ed1fSjojemann * 27185142ed1fSjojemann * No update needed here for icmp_cksum because the ICMP checksum 27195142ed1fSjojemann * is calculated over the complete ICMP packet, which includes the 27205142ed1fSjojemann * changed oip IP addresses and oip->ip_sum. These two changes 27215142ed1fSjojemann * cancel each other out (if the delta for the IP address is x, 27225142ed1fSjojemann * then the delta for ip_sum is minus x). 2723ab25eeb5Syz155240 */ 2724ab25eeb5Syz155240 2725ab25eeb5Syz155240 if (oip->ip_dst.s_addr == nat->nat_oip.s_addr) { 2726ab25eeb5Syz155240 sum1 = LONG_SUM(ntohl(oip->ip_src.s_addr)); 2727ab25eeb5Syz155240 in = nat->nat_inip; 2728ab25eeb5Syz155240 oip->ip_src = in; 2729ab25eeb5Syz155240 } else { 2730ab25eeb5Syz155240 sum1 = LONG_SUM(ntohl(oip->ip_dst.s_addr)); 2731ab25eeb5Syz155240 in = nat->nat_outip; 2732ab25eeb5Syz155240 oip->ip_dst = in; 2733ab25eeb5Syz155240 } 2734ab25eeb5Syz155240 2735ab25eeb5Syz155240 sum2 = LONG_SUM(ntohl(in.s_addr)); 2736ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 2737ab25eeb5Syz155240 fix_datacksum(&oip->ip_sum, sumd); 2738ab25eeb5Syz155240 2739ab25eeb5Syz155240 /* 27405142ed1fSjojemann * Step 2 27415142ed1fSjojemann * Perform other adjustments based on protocol of offending packet. 2742ab25eeb5Syz155240 */ 27435142ed1fSjojemann 27445142ed1fSjojemann switch (oip->ip_p) { 27455142ed1fSjojemann case IPPROTO_TCP : 27465142ed1fSjojemann case IPPROTO_UDP : 2747ab25eeb5Syz155240 2748ab25eeb5Syz155240 /* 27495142ed1fSjojemann * For offending TCP/UDP IP packets, translate the ports 27505142ed1fSjojemann * based on the NAT specification. 2751ab25eeb5Syz155240 * 2752ab25eeb5Syz155240 * Advance notice : Now it becomes complicated :-) 2753ab25eeb5Syz155240 * 27545142ed1fSjojemann * Since the port and IP addresse fields are both part 27555142ed1fSjojemann * of the TCP/UDP checksum of the offending IP packet, 27565142ed1fSjojemann * we need to adjust that checksum as well. 2757ab25eeb5Syz155240 * 27585142ed1fSjojemann * To further complicate things, the TCP/UDP checksum 27595142ed1fSjojemann * may not be present. We must check to see if the 27605142ed1fSjojemann * length of the data portion is big enough to hold 27615142ed1fSjojemann * the checksum. In the UDP case, a test to determine 27625142ed1fSjojemann * if the checksum is even set is also required. 27635142ed1fSjojemann * 27645142ed1fSjojemann * Any changes to an IP address, port or checksum within 27655142ed1fSjojemann * the ICMP packet requires a change to icmp_cksum. 27665142ed1fSjojemann * 27675142ed1fSjojemann * Be extremely careful here ... The change is dependent 27685142ed1fSjojemann * upon whether or not the TCP/UPD checksum is present. 27695142ed1fSjojemann * 27705142ed1fSjojemann * If TCP/UPD checksum is present, the icmp_cksum must 27715142ed1fSjojemann * compensate for checksum modification resulting from 27725142ed1fSjojemann * IP address change only. Port change and resulting 27735142ed1fSjojemann * data checksum adjustments cancel each other out. 27745142ed1fSjojemann * 27755142ed1fSjojemann * If TCP/UDP checksum is not present, icmp_cksum must 27765142ed1fSjojemann * compensate for port change only. The IP address 27775142ed1fSjojemann * change does not modify anything else in this case. 2778ab25eeb5Syz155240 */ 2779ab25eeb5Syz155240 27805142ed1fSjojemann psum1 = 0; 27815142ed1fSjojemann psum2 = 0; 27825142ed1fSjojemann psumd = 0; 27835142ed1fSjojemann 27845142ed1fSjojemann if ((tcp->th_dport == nat->nat_oport) && 27855142ed1fSjojemann (tcp->th_sport != nat->nat_inport)) { 27865142ed1fSjojemann 27875142ed1fSjojemann /* 27885142ed1fSjojemann * Translate the source port. 27895142ed1fSjojemann */ 27905142ed1fSjojemann 27915142ed1fSjojemann psum1 = ntohs(tcp->th_sport); 27925142ed1fSjojemann psum2 = ntohs(nat->nat_inport); 27935142ed1fSjojemann tcp->th_sport = nat->nat_inport; 27945142ed1fSjojemann 27955142ed1fSjojemann } else if ((tcp->th_sport == nat->nat_oport) && 27965142ed1fSjojemann (tcp->th_dport != nat->nat_outport)) { 27975142ed1fSjojemann 27985142ed1fSjojemann /* 27995142ed1fSjojemann * Translate the destination port. 28005142ed1fSjojemann */ 28015142ed1fSjojemann 28025142ed1fSjojemann psum1 = ntohs(tcp->th_dport); 28035142ed1fSjojemann psum2 = ntohs(nat->nat_outport); 28045142ed1fSjojemann tcp->th_dport = nat->nat_outport; 2805ab25eeb5Syz155240 } 2806ab25eeb5Syz155240 28075142ed1fSjojemann if ((oip->ip_p == IPPROTO_TCP) && (dlen >= 18)) { 2808ab25eeb5Syz155240 2809ab25eeb5Syz155240 /* 28105142ed1fSjojemann * TCP checksum present. 2811ab25eeb5Syz155240 * 28125142ed1fSjojemann * Adjust data checksum and icmp checksum to 28135142ed1fSjojemann * compensate for any IP address change. 2814ab25eeb5Syz155240 */ 2815ab25eeb5Syz155240 28165142ed1fSjojemann sum1 = ntohs(tcp->th_sum); 28175142ed1fSjojemann fix_datacksum(&tcp->th_sum, sumd); 28185142ed1fSjojemann sum2 = ntohs(tcp->th_sum); 28195142ed1fSjojemann sumd2 = sumd << 1; 2820ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 2821ab25eeb5Syz155240 sumd2 += sumd; 28225142ed1fSjojemann 28235142ed1fSjojemann /* 28245142ed1fSjojemann * Also make data checksum adjustment to 28255142ed1fSjojemann * compensate for any port change. 28265142ed1fSjojemann */ 28275142ed1fSjojemann 28285142ed1fSjojemann if (psum1 != psum2) { 28295142ed1fSjojemann CALC_SUMD(psum1, psum2, psumd); 28305142ed1fSjojemann fix_datacksum(&tcp->th_sum, psumd); 2831ab25eeb5Syz155240 } 2832ab25eeb5Syz155240 28335142ed1fSjojemann } else if ((oip->ip_p == IPPROTO_UDP) && 28345142ed1fSjojemann (dlen >= 8) && (udp->uh_sum != 0)) { 2835ab25eeb5Syz155240 2836ab25eeb5Syz155240 /* 28375142ed1fSjojemann * The UDP checksum is present and set. 28385142ed1fSjojemann * 28395142ed1fSjojemann * Adjust data checksum and icmp checksum to 28405142ed1fSjojemann * compensate for any IP address change. 2841ab25eeb5Syz155240 */ 28425142ed1fSjojemann 28435142ed1fSjojemann sum1 = ntohs(udp->uh_sum); 28445142ed1fSjojemann fix_datacksum(&udp->uh_sum, sumd); 28455142ed1fSjojemann sum2 = ntohs(udp->uh_sum); 28465142ed1fSjojemann sumd2 = sumd << 1; 2847ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 2848ab25eeb5Syz155240 sumd2 += sumd; 28495142ed1fSjojemann 28505142ed1fSjojemann /* 28515142ed1fSjojemann * Also make data checksum adjustment to 28525142ed1fSjojemann * compensate for any port change. 28535142ed1fSjojemann */ 28545142ed1fSjojemann 28555142ed1fSjojemann if (psum1 != psum2) { 28565142ed1fSjojemann CALC_SUMD(psum1, psum2, psumd); 28575142ed1fSjojemann fix_datacksum(&udp->uh_sum, psumd); 28585142ed1fSjojemann } 28595142ed1fSjojemann 2860ab25eeb5Syz155240 } else { 2861ab25eeb5Syz155240 2862ab25eeb5Syz155240 /* 28635142ed1fSjojemann * Data checksum was not present. 2864ab25eeb5Syz155240 * 28655142ed1fSjojemann * Compensate for any port change. 2866ab25eeb5Syz155240 */ 2867ab25eeb5Syz155240 28685142ed1fSjojemann CALC_SUMD(psum2, psum1, psumd); 28695142ed1fSjojemann sumd2 += psumd; 2870ab25eeb5Syz155240 } 28715142ed1fSjojemann break; 2872ab25eeb5Syz155240 28735142ed1fSjojemann case IPPROTO_ICMP : 2874ab25eeb5Syz155240 28755142ed1fSjojemann orgicmp = (icmphdr_t *)udp; 2876ab25eeb5Syz155240 28775142ed1fSjojemann if ((nat->nat_dir == NAT_OUTBOUND) && 28785142ed1fSjojemann (orgicmp->icmp_id != nat->nat_inport) && 28795142ed1fSjojemann (dlen >= 8)) { 2880ab25eeb5Syz155240 2881ab25eeb5Syz155240 /* 2882ab25eeb5Syz155240 * Fix ICMP checksum (of the offening ICMP 2883ab25eeb5Syz155240 * query packet) to compensate the change 2884ab25eeb5Syz155240 * in the ICMP id of the offending ICMP 2885ab25eeb5Syz155240 * packet. 2886ab25eeb5Syz155240 * 2887ab25eeb5Syz155240 * Since you modify orgicmp->icmp_id with 2888ab25eeb5Syz155240 * a delta (say x) and you compensate that 2889ab25eeb5Syz155240 * in origicmp->icmp_cksum with a delta 2890ab25eeb5Syz155240 * minus x, you don't have to adjust the 2891ab25eeb5Syz155240 * overall icmp->icmp_cksum 2892ab25eeb5Syz155240 */ 28935142ed1fSjojemann 2894ab25eeb5Syz155240 sum1 = ntohs(orgicmp->icmp_id); 2895ab25eeb5Syz155240 sum2 = ntohs(nat->nat_inport); 2896ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 2897ab25eeb5Syz155240 orgicmp->icmp_id = nat->nat_inport; 2898ab25eeb5Syz155240 fix_datacksum(&orgicmp->icmp_cksum, sumd); 28995142ed1fSjojemann 29005142ed1fSjojemann } /* nat_dir can't be NAT_INBOUND for icmp queries */ 29015142ed1fSjojemann 29025142ed1fSjojemann break; 29035142ed1fSjojemann 29045142ed1fSjojemann default : 29055142ed1fSjojemann 29065142ed1fSjojemann break; 29075142ed1fSjojemann 29085142ed1fSjojemann } /* switch (oip->ip_p) */ 29095142ed1fSjojemann 29105142ed1fSjojemann /* 29115142ed1fSjojemann * Step 3 29125142ed1fSjojemann * Make the adjustments to icmp checksum. 29135142ed1fSjojemann */ 29145142ed1fSjojemann 29155142ed1fSjojemann if (sumd2 != 0) { 29165142ed1fSjojemann sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 29175142ed1fSjojemann sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 2918381a2a9aSdr146992 fix_incksum(&icmp->icmp_cksum, sumd2); 2919ab25eeb5Syz155240 } 2920ab25eeb5Syz155240 return nat; 2921ab25eeb5Syz155240 } 2922ab25eeb5Syz155240 2923ab25eeb5Syz155240 2924ab25eeb5Syz155240 /* 2925ab25eeb5Syz155240 * NB: these lookups don't lock access to the list, it assumed that it has 2926ab25eeb5Syz155240 * already been done! 2927ab25eeb5Syz155240 */ 2928ab25eeb5Syz155240 2929ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2930ab25eeb5Syz155240 /* Function: nat_inlookup */ 2931ab25eeb5Syz155240 /* Returns: nat_t* - NULL == no match, */ 2932ab25eeb5Syz155240 /* else pointer to matching NAT entry */ 2933ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2934ab25eeb5Syz155240 /* flags(I) - NAT flags for this packet */ 2935ab25eeb5Syz155240 /* p(I) - protocol for this packet */ 2936ab25eeb5Syz155240 /* src(I) - source IP address */ 2937ab25eeb5Syz155240 /* mapdst(I) - destination IP address */ 2938ab25eeb5Syz155240 /* */ 2939ab25eeb5Syz155240 /* Lookup a nat entry based on the mapped destination ip address/port and */ 2940ab25eeb5Syz155240 /* real source address/port. We use this lookup when receiving a packet, */ 2941ab25eeb5Syz155240 /* we're looking for a table entry, based on the destination address. */ 2942ab25eeb5Syz155240 /* */ 2943ab25eeb5Syz155240 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */ 2944ab25eeb5Syz155240 /* */ 2945ab25eeb5Syz155240 /* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN */ 2946ab25eeb5Syz155240 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */ 2947ab25eeb5Syz155240 /* */ 2948ab25eeb5Syz155240 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */ 2949ab25eeb5Syz155240 /* the packet is of said protocol */ 2950ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2951ab25eeb5Syz155240 nat_t *nat_inlookup(fin, flags, p, src, mapdst) 2952ab25eeb5Syz155240 fr_info_t *fin; 2953ab25eeb5Syz155240 u_int flags, p; 2954ab25eeb5Syz155240 struct in_addr src , mapdst; 2955ab25eeb5Syz155240 { 2956ab25eeb5Syz155240 u_short sport, dport; 2957ab25eeb5Syz155240 ipnat_t *ipn; 2958ab25eeb5Syz155240 u_int sflags; 2959ab25eeb5Syz155240 nat_t *nat; 2960ab25eeb5Syz155240 int nflags; 2961ab25eeb5Syz155240 u_32_t dst; 2962ab25eeb5Syz155240 void *ifp; 2963ab25eeb5Syz155240 u_int hv; 2964f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 2965ab25eeb5Syz155240 2966ab25eeb5Syz155240 if (fin != NULL) 2967ab25eeb5Syz155240 ifp = fin->fin_ifp; 2968ab25eeb5Syz155240 else 2969ab25eeb5Syz155240 ifp = NULL; 2970ab25eeb5Syz155240 sport = 0; 2971ab25eeb5Syz155240 dport = 0; 2972ab25eeb5Syz155240 dst = mapdst.s_addr; 2973ab25eeb5Syz155240 sflags = flags & NAT_TCPUDPICMP; 2974ab25eeb5Syz155240 2975ab25eeb5Syz155240 switch (p) 2976ab25eeb5Syz155240 { 2977ab25eeb5Syz155240 case IPPROTO_TCP : 2978ab25eeb5Syz155240 case IPPROTO_UDP : 2979ab25eeb5Syz155240 sport = htons(fin->fin_data[0]); 2980ab25eeb5Syz155240 dport = htons(fin->fin_data[1]); 2981ab25eeb5Syz155240 break; 2982ab25eeb5Syz155240 case IPPROTO_ICMP : 2983ab25eeb5Syz155240 if (flags & IPN_ICMPERR) 2984ab25eeb5Syz155240 sport = fin->fin_data[1]; 2985ab25eeb5Syz155240 else 2986ab25eeb5Syz155240 dport = fin->fin_data[1]; 2987ab25eeb5Syz155240 break; 2988ab25eeb5Syz155240 default : 2989ab25eeb5Syz155240 break; 2990ab25eeb5Syz155240 } 2991ab25eeb5Syz155240 2992ab25eeb5Syz155240 2993ab25eeb5Syz155240 if ((flags & SI_WILDP) != 0) 2994ab25eeb5Syz155240 goto find_in_wild_ports; 2995ab25eeb5Syz155240 2996ab25eeb5Syz155240 hv = NAT_HASH_FN(dst, dport, 0xffffffff); 2997f4b3ec61Sdh155122 hv = NAT_HASH_FN(src.s_addr, hv + sport, ifs->ifs_ipf_nattable_sz); 2998f4b3ec61Sdh155122 nat = ifs->ifs_nat_table[1][hv]; 2999ab25eeb5Syz155240 for (; nat; nat = nat->nat_hnext[1]) { 3000e6c6c1faSyz155240 if (nat->nat_ifps[0] != NULL) { 3001e6c6c1faSyz155240 if ((ifp != NULL) && (ifp != nat->nat_ifps[0])) 3002e6c6c1faSyz155240 continue; 3003e6c6c1faSyz155240 } else if (ifp != NULL) 3004e6c6c1faSyz155240 nat->nat_ifps[0] = ifp; 3005ab25eeb5Syz155240 3006e6c6c1faSyz155240 nflags = nat->nat_flags; 3007ab25eeb5Syz155240 3008ab25eeb5Syz155240 if (nat->nat_oip.s_addr == src.s_addr && 3009ab25eeb5Syz155240 nat->nat_outip.s_addr == dst && 3010ab25eeb5Syz155240 (((p == 0) && 3011ab25eeb5Syz155240 (sflags == (nat->nat_flags & IPN_TCPUDPICMP))) 3012ab25eeb5Syz155240 || (p == nat->nat_p))) { 3013ab25eeb5Syz155240 switch (p) 3014ab25eeb5Syz155240 { 3015ab25eeb5Syz155240 #if 0 3016ab25eeb5Syz155240 case IPPROTO_GRE : 3017ab25eeb5Syz155240 if (nat->nat_call[1] != fin->fin_data[0]) 3018ab25eeb5Syz155240 continue; 3019ab25eeb5Syz155240 break; 3020ab25eeb5Syz155240 #endif 3021ab25eeb5Syz155240 case IPPROTO_ICMP : 3022ab25eeb5Syz155240 if ((flags & IPN_ICMPERR) != 0) { 3023ab25eeb5Syz155240 if (nat->nat_outport != sport) 3024ab25eeb5Syz155240 continue; 3025ab25eeb5Syz155240 } else { 3026ab25eeb5Syz155240 if (nat->nat_outport != dport) 3027ab25eeb5Syz155240 continue; 3028ab25eeb5Syz155240 } 3029ab25eeb5Syz155240 break; 3030ab25eeb5Syz155240 case IPPROTO_TCP : 3031ab25eeb5Syz155240 case IPPROTO_UDP : 3032ab25eeb5Syz155240 if (nat->nat_oport != sport) 3033ab25eeb5Syz155240 continue; 3034ab25eeb5Syz155240 if (nat->nat_outport != dport) 3035ab25eeb5Syz155240 continue; 3036ab25eeb5Syz155240 break; 3037ab25eeb5Syz155240 default : 3038ab25eeb5Syz155240 break; 3039ab25eeb5Syz155240 } 3040ab25eeb5Syz155240 3041ab25eeb5Syz155240 ipn = nat->nat_ptr; 3042ab25eeb5Syz155240 if ((ipn != NULL) && (nat->nat_aps != NULL)) 3043ab25eeb5Syz155240 if (appr_match(fin, nat) != 0) 3044ab25eeb5Syz155240 continue; 3045ab25eeb5Syz155240 return nat; 3046ab25eeb5Syz155240 } 3047ab25eeb5Syz155240 } 3048ab25eeb5Syz155240 3049ab25eeb5Syz155240 /* 3050ab25eeb5Syz155240 * So if we didn't find it but there are wildcard members in the hash 3051ab25eeb5Syz155240 * table, go back and look for them. We do this search and update here 3052ab25eeb5Syz155240 * because it is modifying the NAT table and we want to do this only 3053ab25eeb5Syz155240 * for the first packet that matches. The exception, of course, is 3054ab25eeb5Syz155240 * for "dummy" (FI_IGNORE) lookups. 3055ab25eeb5Syz155240 */ 3056ab25eeb5Syz155240 find_in_wild_ports: 3057ab25eeb5Syz155240 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) 3058ab25eeb5Syz155240 return NULL; 3059f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_wilds == 0) 3060ab25eeb5Syz155240 return NULL; 3061ab25eeb5Syz155240 3062f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3063ab25eeb5Syz155240 3064ab25eeb5Syz155240 hv = NAT_HASH_FN(dst, 0, 0xffffffff); 3065f4b3ec61Sdh155122 hv = NAT_HASH_FN(src.s_addr, hv, ifs->ifs_ipf_nattable_sz); 3066ab25eeb5Syz155240 3067f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 3068ab25eeb5Syz155240 3069f4b3ec61Sdh155122 nat = ifs->ifs_nat_table[1][hv]; 3070ab25eeb5Syz155240 for (; nat; nat = nat->nat_hnext[1]) { 3071e6c6c1faSyz155240 if (nat->nat_ifps[0] != NULL) { 3072e6c6c1faSyz155240 if ((ifp != NULL) && (ifp != nat->nat_ifps[0])) 3073ab25eeb5Syz155240 continue; 3074e6c6c1faSyz155240 } else if (ifp != NULL) 3075e6c6c1faSyz155240 nat->nat_ifps[0] = ifp; 3076ab25eeb5Syz155240 3077ab25eeb5Syz155240 if (nat->nat_p != fin->fin_p) 3078ab25eeb5Syz155240 continue; 3079ab25eeb5Syz155240 if (nat->nat_oip.s_addr != src.s_addr || 3080ab25eeb5Syz155240 nat->nat_outip.s_addr != dst) 3081ab25eeb5Syz155240 continue; 3082ab25eeb5Syz155240 3083ab25eeb5Syz155240 nflags = nat->nat_flags; 3084ab25eeb5Syz155240 if (!(nflags & (NAT_TCPUDP|SI_WILDP))) 3085ab25eeb5Syz155240 continue; 3086ab25eeb5Syz155240 3087ab25eeb5Syz155240 if (nat_wildok(nat, (int)sport, (int)dport, nflags, 3088ab25eeb5Syz155240 NAT_INBOUND) == 1) { 3089ab25eeb5Syz155240 if ((fin->fin_flx & FI_IGNORE) != 0) 3090ab25eeb5Syz155240 break; 3091ab25eeb5Syz155240 if ((nflags & SI_CLONE) != 0) { 3092ab25eeb5Syz155240 nat = fr_natclone(fin, nat); 3093ab25eeb5Syz155240 if (nat == NULL) 3094ab25eeb5Syz155240 break; 3095ab25eeb5Syz155240 } else { 3096f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 3097f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_wilds--; 3098f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 3099ab25eeb5Syz155240 } 3100ab25eeb5Syz155240 nat->nat_oport = sport; 3101ab25eeb5Syz155240 nat->nat_outport = dport; 3102ab25eeb5Syz155240 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT); 3103f4b3ec61Sdh155122 nat_tabmove(nat, ifs); 3104ab25eeb5Syz155240 break; 3105ab25eeb5Syz155240 } 3106ab25eeb5Syz155240 } 3107ab25eeb5Syz155240 3108f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 3109ab25eeb5Syz155240 3110ab25eeb5Syz155240 return nat; 3111ab25eeb5Syz155240 } 3112ab25eeb5Syz155240 3113ab25eeb5Syz155240 3114ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3115ab25eeb5Syz155240 /* Function: nat_tabmove */ 3116ab25eeb5Syz155240 /* Returns: Nil */ 3117ab25eeb5Syz155240 /* Parameters: nat(I) - pointer to NAT structure */ 3118ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 3119ab25eeb5Syz155240 /* */ 3120ab25eeb5Syz155240 /* This function is only called for TCP/UDP NAT table entries where the */ 3121ab25eeb5Syz155240 /* original was placed in the table without hashing on the ports and we now */ 3122ab25eeb5Syz155240 /* want to include hashing on port numbers. */ 3123ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3124f4b3ec61Sdh155122 static void nat_tabmove(nat, ifs) 3125ab25eeb5Syz155240 nat_t *nat; 3126f4b3ec61Sdh155122 ipf_stack_t *ifs; 3127ab25eeb5Syz155240 { 3128ab25eeb5Syz155240 nat_t **natp; 3129ab25eeb5Syz155240 u_int hv; 3130ab25eeb5Syz155240 3131ab25eeb5Syz155240 if (nat->nat_flags & SI_CLONE) 3132ab25eeb5Syz155240 return; 3133ab25eeb5Syz155240 3134ab25eeb5Syz155240 /* 3135ab25eeb5Syz155240 * Remove the NAT entry from the old location 3136ab25eeb5Syz155240 */ 3137ab25eeb5Syz155240 if (nat->nat_hnext[0]) 3138ab25eeb5Syz155240 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; 3139ab25eeb5Syz155240 *nat->nat_phnext[0] = nat->nat_hnext[0]; 3140f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0][nat->nat_hv[0]]--; 3141ab25eeb5Syz155240 3142ab25eeb5Syz155240 if (nat->nat_hnext[1]) 3143ab25eeb5Syz155240 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; 3144ab25eeb5Syz155240 *nat->nat_phnext[1] = nat->nat_hnext[1]; 3145f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][nat->nat_hv[1]]--; 3146ab25eeb5Syz155240 3147ab25eeb5Syz155240 /* 3148ab25eeb5Syz155240 * Add into the NAT table in the new position 3149ab25eeb5Syz155240 */ 3150ab25eeb5Syz155240 hv = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport, 0xffffffff); 3151ab25eeb5Syz155240 hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + nat->nat_oport, 3152f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 3153ab25eeb5Syz155240 nat->nat_hv[0] = hv; 3154f4b3ec61Sdh155122 natp = &ifs->ifs_nat_table[0][hv]; 3155ab25eeb5Syz155240 if (*natp) 3156ab25eeb5Syz155240 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 3157ab25eeb5Syz155240 nat->nat_phnext[0] = natp; 3158ab25eeb5Syz155240 nat->nat_hnext[0] = *natp; 3159ab25eeb5Syz155240 *natp = nat; 3160f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0][hv]++; 3161ab25eeb5Syz155240 3162ab25eeb5Syz155240 hv = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport, 0xffffffff); 3163ab25eeb5Syz155240 hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + nat->nat_oport, 3164f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 3165ab25eeb5Syz155240 nat->nat_hv[1] = hv; 3166f4b3ec61Sdh155122 natp = &ifs->ifs_nat_table[1][hv]; 3167ab25eeb5Syz155240 if (*natp) 3168ab25eeb5Syz155240 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 3169ab25eeb5Syz155240 nat->nat_phnext[1] = natp; 3170ab25eeb5Syz155240 nat->nat_hnext[1] = *natp; 3171ab25eeb5Syz155240 *natp = nat; 3172f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][hv]++; 3173ab25eeb5Syz155240 } 3174ab25eeb5Syz155240 3175ab25eeb5Syz155240 3176ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3177ab25eeb5Syz155240 /* Function: nat_outlookup */ 3178ab25eeb5Syz155240 /* Returns: nat_t* - NULL == no match, */ 3179ab25eeb5Syz155240 /* else pointer to matching NAT entry */ 3180ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3181ab25eeb5Syz155240 /* flags(I) - NAT flags for this packet */ 3182ab25eeb5Syz155240 /* p(I) - protocol for this packet */ 3183ab25eeb5Syz155240 /* src(I) - source IP address */ 3184ab25eeb5Syz155240 /* dst(I) - destination IP address */ 3185ab25eeb5Syz155240 /* rw(I) - 1 == write lock on ipf_nat held, 0 == read lock. */ 3186ab25eeb5Syz155240 /* */ 3187ab25eeb5Syz155240 /* Lookup a nat entry based on the source 'real' ip address/port and */ 3188ab25eeb5Syz155240 /* destination address/port. We use this lookup when sending a packet out, */ 3189ab25eeb5Syz155240 /* we're looking for a table entry, based on the source address. */ 3190ab25eeb5Syz155240 /* */ 3191ab25eeb5Syz155240 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */ 3192ab25eeb5Syz155240 /* */ 3193ab25eeb5Syz155240 /* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN */ 3194ab25eeb5Syz155240 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */ 3195ab25eeb5Syz155240 /* */ 3196ab25eeb5Syz155240 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */ 3197ab25eeb5Syz155240 /* the packet is of said protocol */ 3198ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3199ab25eeb5Syz155240 nat_t *nat_outlookup(fin, flags, p, src, dst) 3200ab25eeb5Syz155240 fr_info_t *fin; 3201ab25eeb5Syz155240 u_int flags, p; 3202ab25eeb5Syz155240 struct in_addr src , dst; 3203ab25eeb5Syz155240 { 3204ab25eeb5Syz155240 u_short sport, dport; 3205ab25eeb5Syz155240 u_int sflags; 3206ab25eeb5Syz155240 ipnat_t *ipn; 3207ab25eeb5Syz155240 u_32_t srcip; 3208ab25eeb5Syz155240 nat_t *nat; 3209ab25eeb5Syz155240 int nflags; 3210ab25eeb5Syz155240 void *ifp; 3211ab25eeb5Syz155240 u_int hv; 3212f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3213ab25eeb5Syz155240 3214ab25eeb5Syz155240 ifp = fin->fin_ifp; 3215e6c6c1faSyz155240 3216ab25eeb5Syz155240 srcip = src.s_addr; 3217ab25eeb5Syz155240 sflags = flags & IPN_TCPUDPICMP; 3218ab25eeb5Syz155240 sport = 0; 3219ab25eeb5Syz155240 dport = 0; 3220ab25eeb5Syz155240 3221ab25eeb5Syz155240 switch (p) 3222ab25eeb5Syz155240 { 3223ab25eeb5Syz155240 case IPPROTO_TCP : 3224ab25eeb5Syz155240 case IPPROTO_UDP : 3225ab25eeb5Syz155240 sport = htons(fin->fin_data[0]); 3226ab25eeb5Syz155240 dport = htons(fin->fin_data[1]); 3227ab25eeb5Syz155240 break; 3228ab25eeb5Syz155240 case IPPROTO_ICMP : 3229ab25eeb5Syz155240 if (flags & IPN_ICMPERR) 3230ab25eeb5Syz155240 sport = fin->fin_data[1]; 3231ab25eeb5Syz155240 else 3232ab25eeb5Syz155240 dport = fin->fin_data[1]; 3233ab25eeb5Syz155240 break; 3234ab25eeb5Syz155240 default : 3235ab25eeb5Syz155240 break; 3236ab25eeb5Syz155240 } 3237ab25eeb5Syz155240 3238ab25eeb5Syz155240 if ((flags & SI_WILDP) != 0) 3239ab25eeb5Syz155240 goto find_out_wild_ports; 3240ab25eeb5Syz155240 3241ab25eeb5Syz155240 hv = NAT_HASH_FN(srcip, sport, 0xffffffff); 3242f4b3ec61Sdh155122 hv = NAT_HASH_FN(dst.s_addr, hv + dport, ifs->ifs_ipf_nattable_sz); 3243f4b3ec61Sdh155122 nat = ifs->ifs_nat_table[0][hv]; 3244ab25eeb5Syz155240 for (; nat; nat = nat->nat_hnext[0]) { 3245e6c6c1faSyz155240 if (nat->nat_ifps[1] != NULL) { 3246e6c6c1faSyz155240 if ((ifp != NULL) && (ifp != nat->nat_ifps[1])) 3247e6c6c1faSyz155240 continue; 3248e6c6c1faSyz155240 } else if (ifp != NULL) 3249e6c6c1faSyz155240 nat->nat_ifps[1] = ifp; 3250ab25eeb5Syz155240 3251e6c6c1faSyz155240 nflags = nat->nat_flags; 3252ab25eeb5Syz155240 3253ab25eeb5Syz155240 if (nat->nat_inip.s_addr == srcip && 3254ab25eeb5Syz155240 nat->nat_oip.s_addr == dst.s_addr && 3255ab25eeb5Syz155240 (((p == 0) && (sflags == (nflags & NAT_TCPUDPICMP))) 3256ab25eeb5Syz155240 || (p == nat->nat_p))) { 3257ab25eeb5Syz155240 switch (p) 3258ab25eeb5Syz155240 { 3259ab25eeb5Syz155240 #if 0 3260ab25eeb5Syz155240 case IPPROTO_GRE : 3261ab25eeb5Syz155240 if (nat->nat_call[1] != fin->fin_data[0]) 3262ab25eeb5Syz155240 continue; 3263ab25eeb5Syz155240 break; 3264ab25eeb5Syz155240 #endif 3265ab25eeb5Syz155240 case IPPROTO_TCP : 3266ab25eeb5Syz155240 case IPPROTO_UDP : 3267ab25eeb5Syz155240 if (nat->nat_oport != dport) 3268ab25eeb5Syz155240 continue; 3269ab25eeb5Syz155240 if (nat->nat_inport != sport) 3270ab25eeb5Syz155240 continue; 3271ab25eeb5Syz155240 break; 3272ab25eeb5Syz155240 default : 3273ab25eeb5Syz155240 break; 3274ab25eeb5Syz155240 } 3275ab25eeb5Syz155240 3276ab25eeb5Syz155240 ipn = nat->nat_ptr; 3277ab25eeb5Syz155240 if ((ipn != NULL) && (nat->nat_aps != NULL)) 3278ab25eeb5Syz155240 if (appr_match(fin, nat) != 0) 3279ab25eeb5Syz155240 continue; 3280ab25eeb5Syz155240 return nat; 3281ab25eeb5Syz155240 } 3282ab25eeb5Syz155240 } 3283ab25eeb5Syz155240 3284ab25eeb5Syz155240 /* 3285ab25eeb5Syz155240 * So if we didn't find it but there are wildcard members in the hash 3286ab25eeb5Syz155240 * table, go back and look for them. We do this search and update here 3287ab25eeb5Syz155240 * because it is modifying the NAT table and we want to do this only 3288ab25eeb5Syz155240 * for the first packet that matches. The exception, of course, is 3289ab25eeb5Syz155240 * for "dummy" (FI_IGNORE) lookups. 3290ab25eeb5Syz155240 */ 3291ab25eeb5Syz155240 find_out_wild_ports: 3292ab25eeb5Syz155240 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) 3293ab25eeb5Syz155240 return NULL; 3294f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_wilds == 0) 3295ab25eeb5Syz155240 return NULL; 3296ab25eeb5Syz155240 3297f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3298ab25eeb5Syz155240 3299ab25eeb5Syz155240 hv = NAT_HASH_FN(srcip, 0, 0xffffffff); 3300f4b3ec61Sdh155122 hv = NAT_HASH_FN(dst.s_addr, hv, ifs->ifs_ipf_nattable_sz); 3301ab25eeb5Syz155240 3302f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 3303ab25eeb5Syz155240 3304f4b3ec61Sdh155122 nat = ifs->ifs_nat_table[0][hv]; 3305ab25eeb5Syz155240 for (; nat; nat = nat->nat_hnext[0]) { 3306e6c6c1faSyz155240 if (nat->nat_ifps[1] != NULL) { 3307e6c6c1faSyz155240 if ((ifp != NULL) && (ifp != nat->nat_ifps[1])) 3308ab25eeb5Syz155240 continue; 3309e6c6c1faSyz155240 } else if (ifp != NULL) 3310e6c6c1faSyz155240 nat->nat_ifps[1] = ifp; 3311ab25eeb5Syz155240 3312ab25eeb5Syz155240 if (nat->nat_p != fin->fin_p) 3313ab25eeb5Syz155240 continue; 3314ab25eeb5Syz155240 if ((nat->nat_inip.s_addr != srcip) || 3315ab25eeb5Syz155240 (nat->nat_oip.s_addr != dst.s_addr)) 3316ab25eeb5Syz155240 continue; 3317ab25eeb5Syz155240 3318ab25eeb5Syz155240 nflags = nat->nat_flags; 3319ab25eeb5Syz155240 if (!(nflags & (NAT_TCPUDP|SI_WILDP))) 3320ab25eeb5Syz155240 continue; 3321ab25eeb5Syz155240 3322ab25eeb5Syz155240 if (nat_wildok(nat, (int)sport, (int)dport, nflags, 3323ab25eeb5Syz155240 NAT_OUTBOUND) == 1) { 3324ab25eeb5Syz155240 if ((fin->fin_flx & FI_IGNORE) != 0) 3325ab25eeb5Syz155240 break; 3326ab25eeb5Syz155240 if ((nflags & SI_CLONE) != 0) { 3327ab25eeb5Syz155240 nat = fr_natclone(fin, nat); 3328ab25eeb5Syz155240 if (nat == NULL) 3329ab25eeb5Syz155240 break; 3330ab25eeb5Syz155240 } else { 3331f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 3332f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_wilds--; 3333f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 3334ab25eeb5Syz155240 } 3335ab25eeb5Syz155240 nat->nat_inport = sport; 3336ab25eeb5Syz155240 nat->nat_oport = dport; 3337ab25eeb5Syz155240 if (nat->nat_outport == 0) 3338ab25eeb5Syz155240 nat->nat_outport = sport; 3339ab25eeb5Syz155240 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT); 3340f4b3ec61Sdh155122 nat_tabmove(nat, ifs); 3341ab25eeb5Syz155240 break; 3342ab25eeb5Syz155240 } 3343ab25eeb5Syz155240 } 3344ab25eeb5Syz155240 3345f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 3346ab25eeb5Syz155240 3347ab25eeb5Syz155240 return nat; 3348ab25eeb5Syz155240 } 3349ab25eeb5Syz155240 3350ab25eeb5Syz155240 3351ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3352ab25eeb5Syz155240 /* Function: nat_lookupredir */ 3353ab25eeb5Syz155240 /* Returns: nat_t* - NULL == no match, */ 3354ab25eeb5Syz155240 /* else pointer to matching NAT entry */ 3355ab25eeb5Syz155240 /* Parameters: np(I) - pointer to description of packet to find NAT table */ 3356ab25eeb5Syz155240 /* entry for. */ 3357ab25eeb5Syz155240 /* */ 3358ab25eeb5Syz155240 /* Lookup the NAT tables to search for a matching redirect */ 3359ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3360f4b3ec61Sdh155122 nat_t *nat_lookupredir(np, ifs) 3361ab25eeb5Syz155240 natlookup_t *np; 3362f4b3ec61Sdh155122 ipf_stack_t *ifs; 3363ab25eeb5Syz155240 { 3364ab25eeb5Syz155240 fr_info_t fi; 3365ab25eeb5Syz155240 nat_t *nat; 3366ab25eeb5Syz155240 3367ab25eeb5Syz155240 bzero((char *)&fi, sizeof(fi)); 3368ab25eeb5Syz155240 if (np->nl_flags & IPN_IN) { 3369ab25eeb5Syz155240 fi.fin_data[0] = ntohs(np->nl_realport); 3370ab25eeb5Syz155240 fi.fin_data[1] = ntohs(np->nl_outport); 3371ab25eeb5Syz155240 } else { 3372ab25eeb5Syz155240 fi.fin_data[0] = ntohs(np->nl_inport); 3373ab25eeb5Syz155240 fi.fin_data[1] = ntohs(np->nl_outport); 3374ab25eeb5Syz155240 } 3375ab25eeb5Syz155240 if (np->nl_flags & IPN_TCP) 3376ab25eeb5Syz155240 fi.fin_p = IPPROTO_TCP; 3377ab25eeb5Syz155240 else if (np->nl_flags & IPN_UDP) 3378ab25eeb5Syz155240 fi.fin_p = IPPROTO_UDP; 3379ab25eeb5Syz155240 else if (np->nl_flags & (IPN_ICMPERR|IPN_ICMPQUERY)) 3380ab25eeb5Syz155240 fi.fin_p = IPPROTO_ICMP; 3381ab25eeb5Syz155240 3382f4b3ec61Sdh155122 fi.fin_ifs = ifs; 3383ab25eeb5Syz155240 /* 3384ab25eeb5Syz155240 * We can do two sorts of lookups: 3385ab25eeb5Syz155240 * - IPN_IN: we have the `real' and `out' address, look for `in'. 3386ab25eeb5Syz155240 * - default: we have the `in' and `out' address, look for `real'. 3387ab25eeb5Syz155240 */ 3388ab25eeb5Syz155240 if (np->nl_flags & IPN_IN) { 3389ab25eeb5Syz155240 if ((nat = nat_inlookup(&fi, np->nl_flags, fi.fin_p, 3390ab25eeb5Syz155240 np->nl_realip, np->nl_outip))) { 3391ab25eeb5Syz155240 np->nl_inip = nat->nat_inip; 3392ab25eeb5Syz155240 np->nl_inport = nat->nat_inport; 3393ab25eeb5Syz155240 } 3394ab25eeb5Syz155240 } else { 3395ab25eeb5Syz155240 /* 3396ab25eeb5Syz155240 * If nl_inip is non null, this is a lookup based on the real 3397ab25eeb5Syz155240 * ip address. Else, we use the fake. 3398ab25eeb5Syz155240 */ 3399ab25eeb5Syz155240 if ((nat = nat_outlookup(&fi, np->nl_flags, fi.fin_p, 3400ab25eeb5Syz155240 np->nl_inip, np->nl_outip))) { 3401ab25eeb5Syz155240 3402ab25eeb5Syz155240 if ((np->nl_flags & IPN_FINDFORWARD) != 0) { 3403ab25eeb5Syz155240 fr_info_t fin; 3404ab25eeb5Syz155240 bzero((char *)&fin, sizeof(fin)); 3405ab25eeb5Syz155240 fin.fin_p = nat->nat_p; 3406ab25eeb5Syz155240 fin.fin_data[0] = ntohs(nat->nat_outport); 3407ab25eeb5Syz155240 fin.fin_data[1] = ntohs(nat->nat_oport); 3408f4b3ec61Sdh155122 fin.fin_ifs = ifs; 3409ab25eeb5Syz155240 if (nat_inlookup(&fin, np->nl_flags, fin.fin_p, 3410ab25eeb5Syz155240 nat->nat_outip, 3411ab25eeb5Syz155240 nat->nat_oip) != NULL) { 3412ab25eeb5Syz155240 np->nl_flags &= ~IPN_FINDFORWARD; 3413ab25eeb5Syz155240 } 3414ab25eeb5Syz155240 } 3415ab25eeb5Syz155240 3416ab25eeb5Syz155240 np->nl_realip = nat->nat_outip; 3417ab25eeb5Syz155240 np->nl_realport = nat->nat_outport; 3418ab25eeb5Syz155240 } 3419ab25eeb5Syz155240 } 3420ab25eeb5Syz155240 3421ab25eeb5Syz155240 return nat; 3422ab25eeb5Syz155240 } 3423ab25eeb5Syz155240 3424ab25eeb5Syz155240 3425ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3426ab25eeb5Syz155240 /* Function: nat_match */ 3427ab25eeb5Syz155240 /* Returns: int - 0 == no match, 1 == match */ 3428ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3429ab25eeb5Syz155240 /* np(I) - pointer to NAT rule */ 3430ab25eeb5Syz155240 /* */ 3431ab25eeb5Syz155240 /* Pull the matching of a packet against a NAT rule out of that complex */ 3432ab25eeb5Syz155240 /* loop inside fr_checknatin() and lay it out properly in its own function. */ 3433ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3434ab25eeb5Syz155240 static int nat_match(fin, np) 3435ab25eeb5Syz155240 fr_info_t *fin; 3436ab25eeb5Syz155240 ipnat_t *np; 3437ab25eeb5Syz155240 { 3438ab25eeb5Syz155240 frtuc_t *ft; 3439ab25eeb5Syz155240 3440ab25eeb5Syz155240 if (fin->fin_v != 4) 3441ab25eeb5Syz155240 return 0; 3442ab25eeb5Syz155240 3443ab25eeb5Syz155240 if (np->in_p && fin->fin_p != np->in_p) 3444ab25eeb5Syz155240 return 0; 3445ab25eeb5Syz155240 3446ab25eeb5Syz155240 if (fin->fin_out) { 3447ab25eeb5Syz155240 if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK))) 3448ab25eeb5Syz155240 return 0; 3449ab25eeb5Syz155240 if (((fin->fin_fi.fi_saddr & np->in_inmsk) != np->in_inip) 3450ab25eeb5Syz155240 ^ ((np->in_flags & IPN_NOTSRC) != 0)) 3451ab25eeb5Syz155240 return 0; 3452ab25eeb5Syz155240 if (((fin->fin_fi.fi_daddr & np->in_srcmsk) != np->in_srcip) 3453ab25eeb5Syz155240 ^ ((np->in_flags & IPN_NOTDST) != 0)) 3454ab25eeb5Syz155240 return 0; 3455ab25eeb5Syz155240 } else { 3456ab25eeb5Syz155240 if (!(np->in_redir & NAT_REDIRECT)) 3457ab25eeb5Syz155240 return 0; 3458ab25eeb5Syz155240 if (((fin->fin_fi.fi_saddr & np->in_srcmsk) != np->in_srcip) 3459ab25eeb5Syz155240 ^ ((np->in_flags & IPN_NOTSRC) != 0)) 3460ab25eeb5Syz155240 return 0; 3461ab25eeb5Syz155240 if (((fin->fin_fi.fi_daddr & np->in_outmsk) != np->in_outip) 3462ab25eeb5Syz155240 ^ ((np->in_flags & IPN_NOTDST) != 0)) 3463ab25eeb5Syz155240 return 0; 3464ab25eeb5Syz155240 } 3465ab25eeb5Syz155240 3466ab25eeb5Syz155240 ft = &np->in_tuc; 3467ab25eeb5Syz155240 if (!(fin->fin_flx & FI_TCPUDP) || 3468ab25eeb5Syz155240 (fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) { 3469ab25eeb5Syz155240 if (ft->ftu_scmp || ft->ftu_dcmp) 3470ab25eeb5Syz155240 return 0; 3471ab25eeb5Syz155240 return 1; 3472ab25eeb5Syz155240 } 3473ab25eeb5Syz155240 3474ab25eeb5Syz155240 return fr_tcpudpchk(fin, ft); 3475ab25eeb5Syz155240 } 3476ab25eeb5Syz155240 3477ab25eeb5Syz155240 3478ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3479ab25eeb5Syz155240 /* Function: nat_update */ 3480ab25eeb5Syz155240 /* Returns: Nil */ 3481ab25eeb5Syz155240 /* Parameters: nat(I) - pointer to NAT structure */ 3482ab25eeb5Syz155240 /* np(I) - pointer to NAT rule */ 3483ab25eeb5Syz155240 /* */ 3484ab25eeb5Syz155240 /* Updates the lifetime of a NAT table entry for non-TCP packets. Must be */ 3485ab25eeb5Syz155240 /* called with fin_rev updated - i.e. after calling nat_proto(). */ 3486ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3487ab25eeb5Syz155240 void nat_update(fin, nat, np) 3488ab25eeb5Syz155240 fr_info_t *fin; 3489ab25eeb5Syz155240 nat_t *nat; 3490ab25eeb5Syz155240 ipnat_t *np; 3491ab25eeb5Syz155240 { 3492ab25eeb5Syz155240 ipftq_t *ifq, *ifq2; 3493ab25eeb5Syz155240 ipftqent_t *tqe; 3494f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3495ab25eeb5Syz155240 3496ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 3497ab25eeb5Syz155240 tqe = &nat->nat_tqe; 3498ab25eeb5Syz155240 ifq = tqe->tqe_ifq; 3499ab25eeb5Syz155240 3500ab25eeb5Syz155240 /* 3501ab25eeb5Syz155240 * We allow over-riding of NAT timeouts from NAT rules, even for 3502ab25eeb5Syz155240 * TCP, however, if it is TCP and there is no rule timeout set, 3503ab25eeb5Syz155240 * then do not update the timeout here. 3504ab25eeb5Syz155240 */ 3505ab25eeb5Syz155240 if (np != NULL) 3506ab25eeb5Syz155240 ifq2 = np->in_tqehead[fin->fin_rev]; 3507ab25eeb5Syz155240 else 3508ab25eeb5Syz155240 ifq2 = NULL; 3509ab25eeb5Syz155240 3510ab25eeb5Syz155240 if (nat->nat_p == IPPROTO_TCP && ifq2 == NULL) { 3511f4b3ec61Sdh155122 (void) fr_tcp_age(&nat->nat_tqe, fin, ifs->ifs_nat_tqb, 0); 3512ab25eeb5Syz155240 } else { 3513ab25eeb5Syz155240 if (ifq2 == NULL) { 3514ab25eeb5Syz155240 if (nat->nat_p == IPPROTO_UDP) 3515f4b3ec61Sdh155122 ifq2 = &ifs->ifs_nat_udptq; 3516ab25eeb5Syz155240 else if (nat->nat_p == IPPROTO_ICMP) 3517f4b3ec61Sdh155122 ifq2 = &ifs->ifs_nat_icmptq; 3518ab25eeb5Syz155240 else 3519f4b3ec61Sdh155122 ifq2 = &ifs->ifs_nat_iptq; 3520ab25eeb5Syz155240 } 3521ab25eeb5Syz155240 3522f4b3ec61Sdh155122 fr_movequeue(tqe, ifq, ifq2, ifs); 3523ab25eeb5Syz155240 } 3524ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 3525ab25eeb5Syz155240 } 3526ab25eeb5Syz155240 3527ab25eeb5Syz155240 3528ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3529ab25eeb5Syz155240 /* Function: fr_checknatout */ 3530ab25eeb5Syz155240 /* Returns: int - -1 == packet failed NAT checks so block it, */ 3531ab25eeb5Syz155240 /* 0 == no packet translation occurred, */ 3532ab25eeb5Syz155240 /* 1 == packet was successfully translated. */ 3533ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3534ab25eeb5Syz155240 /* passp(I) - pointer to filtering result flags */ 3535ab25eeb5Syz155240 /* */ 3536ab25eeb5Syz155240 /* Check to see if an outcoming packet should be changed. ICMP packets are */ 3537ab25eeb5Syz155240 /* first checked to see if they match an existing entry (if an error), */ 3538ab25eeb5Syz155240 /* otherwise a search of the current NAT table is made. If neither results */ 3539ab25eeb5Syz155240 /* in a match then a search for a matching NAT rule is made. Create a new */ 3540ab25eeb5Syz155240 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */ 3541ab25eeb5Syz155240 /* packet header(s) as required. */ 3542ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3543ab25eeb5Syz155240 int fr_checknatout(fin, passp) 3544ab25eeb5Syz155240 fr_info_t *fin; 3545ab25eeb5Syz155240 u_32_t *passp; 3546ab25eeb5Syz155240 { 3547ab25eeb5Syz155240 struct ifnet *ifp, *sifp; 3548ab25eeb5Syz155240 icmphdr_t *icmp = NULL; 3549ab25eeb5Syz155240 tcphdr_t *tcp = NULL; 3550ab25eeb5Syz155240 int rval, natfailed; 3551ab25eeb5Syz155240 ipnat_t *np = NULL; 3552ab25eeb5Syz155240 u_int nflags = 0; 3553ab25eeb5Syz155240 u_32_t ipa, iph; 3554ab25eeb5Syz155240 int natadd = 1; 3555ab25eeb5Syz155240 frentry_t *fr; 3556ab25eeb5Syz155240 nat_t *nat; 3557f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3558ab25eeb5Syz155240 3559f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_rules == 0 || ifs->ifs_fr_nat_lock != 0) 3560ab25eeb5Syz155240 return 0; 3561ab25eeb5Syz155240 3562ab25eeb5Syz155240 natfailed = 0; 3563ab25eeb5Syz155240 fr = fin->fin_fr; 3564ab25eeb5Syz155240 sifp = fin->fin_ifp; 3565ab25eeb5Syz155240 if ((fr != NULL) && !(fr->fr_flags & FR_DUP) && 3566d3675867Sjojemann fr->fr_tifs[fin->fin_rev].fd_ifp && 3567d3675867Sjojemann fr->fr_tifs[fin->fin_rev].fd_ifp != (void *)-1) 3568d3675867Sjojemann fin->fin_ifp = fr->fr_tifs[fin->fin_rev].fd_ifp; 3569ab25eeb5Syz155240 ifp = fin->fin_ifp; 3570ab25eeb5Syz155240 3571ab25eeb5Syz155240 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 3572ab25eeb5Syz155240 switch (fin->fin_p) 3573ab25eeb5Syz155240 { 3574ab25eeb5Syz155240 case IPPROTO_TCP : 3575ab25eeb5Syz155240 nflags = IPN_TCP; 3576ab25eeb5Syz155240 break; 3577ab25eeb5Syz155240 case IPPROTO_UDP : 3578ab25eeb5Syz155240 nflags = IPN_UDP; 3579ab25eeb5Syz155240 break; 3580ab25eeb5Syz155240 case IPPROTO_ICMP : 3581ab25eeb5Syz155240 icmp = fin->fin_dp; 3582ab25eeb5Syz155240 3583ab25eeb5Syz155240 /* 3584ab25eeb5Syz155240 * This is an incoming packet, so the destination is 3585ab25eeb5Syz155240 * the icmp_id and the source port equals 0 3586ab25eeb5Syz155240 */ 3587ab25eeb5Syz155240 if (nat_icmpquerytype4(icmp->icmp_type)) 3588ab25eeb5Syz155240 nflags = IPN_ICMPQUERY; 3589ab25eeb5Syz155240 break; 3590ab25eeb5Syz155240 default : 3591ab25eeb5Syz155240 break; 3592ab25eeb5Syz155240 } 3593ab25eeb5Syz155240 3594ab25eeb5Syz155240 if ((nflags & IPN_TCPUDP)) 3595ab25eeb5Syz155240 tcp = fin->fin_dp; 3596ab25eeb5Syz155240 } 3597ab25eeb5Syz155240 3598ab25eeb5Syz155240 ipa = fin->fin_saddr; 3599ab25eeb5Syz155240 3600f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 3601ab25eeb5Syz155240 3602ab25eeb5Syz155240 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) && 3603ab25eeb5Syz155240 (nat = nat_icmperror(fin, &nflags, NAT_OUTBOUND))) 3604ab25eeb5Syz155240 /*EMPTY*/; 3605ab25eeb5Syz155240 else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin))) 3606ab25eeb5Syz155240 natadd = 0; 3607ab25eeb5Syz155240 else if ((nat = nat_outlookup(fin, nflags|NAT_SEARCH, (u_int)fin->fin_p, 3608ab25eeb5Syz155240 fin->fin_src, fin->fin_dst))) { 3609ab25eeb5Syz155240 nflags = nat->nat_flags; 3610ab25eeb5Syz155240 } else { 3611ab25eeb5Syz155240 u_32_t hv, msk, nmsk; 3612ab25eeb5Syz155240 3613ab25eeb5Syz155240 /* 3614ab25eeb5Syz155240 * If there is no current entry in the nat table for this IP#, 3615ab25eeb5Syz155240 * create one for it (if there is a matching rule). 3616ab25eeb5Syz155240 */ 3617f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3618ab25eeb5Syz155240 msk = 0xffffffff; 3619f4b3ec61Sdh155122 nmsk = ifs->ifs_nat_masks; 3620f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 3621ab25eeb5Syz155240 maskloop: 3622ab25eeb5Syz155240 iph = ipa & htonl(msk); 3623f4b3ec61Sdh155122 hv = NAT_HASH_FN(iph, 0, ifs->ifs_ipf_natrules_sz); 3624f4b3ec61Sdh155122 for (np = ifs->ifs_nat_rules[hv]; np; np = np->in_mnext) 3625ab25eeb5Syz155240 { 3626e6c6c1faSyz155240 if ((np->in_ifps[1] && (np->in_ifps[1] != ifp))) 3627ab25eeb5Syz155240 continue; 3628ab25eeb5Syz155240 if (np->in_v != fin->fin_v) 3629ab25eeb5Syz155240 continue; 3630ab25eeb5Syz155240 if (np->in_p && (np->in_p != fin->fin_p)) 3631ab25eeb5Syz155240 continue; 3632ab25eeb5Syz155240 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags)) 3633ab25eeb5Syz155240 continue; 3634ab25eeb5Syz155240 if (np->in_flags & IPN_FILTER) { 3635ab25eeb5Syz155240 if (!nat_match(fin, np)) 3636ab25eeb5Syz155240 continue; 3637ab25eeb5Syz155240 } else if ((ipa & np->in_inmsk) != np->in_inip) 3638ab25eeb5Syz155240 continue; 3639ab25eeb5Syz155240 3640ab25eeb5Syz155240 if ((fr != NULL) && 3641ab25eeb5Syz155240 !fr_matchtag(&np->in_tag, &fr->fr_nattag)) 3642ab25eeb5Syz155240 continue; 3643ab25eeb5Syz155240 3644ab25eeb5Syz155240 if (*np->in_plabel != '\0') { 3645ab25eeb5Syz155240 if (((np->in_flags & IPN_FILTER) == 0) && 3646ab25eeb5Syz155240 (np->in_dport != tcp->th_dport)) 3647ab25eeb5Syz155240 continue; 3648ab25eeb5Syz155240 if (appr_ok(fin, tcp, np) == 0) 3649ab25eeb5Syz155240 continue; 3650ab25eeb5Syz155240 } 3651ab25eeb5Syz155240 3652ab25eeb5Syz155240 if ((nat = nat_new(fin, np, NULL, nflags, 3653ab25eeb5Syz155240 NAT_OUTBOUND))) { 3654ab25eeb5Syz155240 np->in_hits++; 3655ab25eeb5Syz155240 break; 3656ab25eeb5Syz155240 } else 3657ab25eeb5Syz155240 natfailed = -1; 3658ab25eeb5Syz155240 } 3659ab25eeb5Syz155240 if ((np == NULL) && (nmsk != 0)) { 3660ab25eeb5Syz155240 while (nmsk) { 3661ab25eeb5Syz155240 msk <<= 1; 3662ab25eeb5Syz155240 if (nmsk & 0x80000000) 3663ab25eeb5Syz155240 break; 3664ab25eeb5Syz155240 nmsk <<= 1; 3665ab25eeb5Syz155240 } 3666ab25eeb5Syz155240 if (nmsk != 0) { 3667ab25eeb5Syz155240 nmsk <<= 1; 3668ab25eeb5Syz155240 goto maskloop; 3669ab25eeb5Syz155240 } 3670ab25eeb5Syz155240 } 3671f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 3672ab25eeb5Syz155240 } 3673ab25eeb5Syz155240 3674ab25eeb5Syz155240 if (nat != NULL) { 3675ab25eeb5Syz155240 rval = fr_natout(fin, nat, natadd, nflags); 3676ab25eeb5Syz155240 if (rval == 1) { 3677ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 3678ab25eeb5Syz155240 nat->nat_ref++; 3679ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 3680ab25eeb5Syz155240 fin->fin_nat = nat; 3681ab25eeb5Syz155240 } 3682ab25eeb5Syz155240 } else 3683ab25eeb5Syz155240 rval = natfailed; 3684f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3685ab25eeb5Syz155240 3686ab25eeb5Syz155240 if (rval == -1) { 3687ab25eeb5Syz155240 if (passp != NULL) 3688ab25eeb5Syz155240 *passp = FR_BLOCK; 3689ab25eeb5Syz155240 fin->fin_flx |= FI_BADNAT; 3690ab25eeb5Syz155240 } 3691ab25eeb5Syz155240 fin->fin_ifp = sifp; 3692ab25eeb5Syz155240 return rval; 3693ab25eeb5Syz155240 } 3694ab25eeb5Syz155240 3695ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3696ab25eeb5Syz155240 /* Function: fr_natout */ 3697ab25eeb5Syz155240 /* Returns: int - -1 == packet failed NAT checks so block it, */ 3698ab25eeb5Syz155240 /* 1 == packet was successfully translated. */ 3699ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3700ab25eeb5Syz155240 /* nat(I) - pointer to NAT structure */ 3701ab25eeb5Syz155240 /* natadd(I) - flag indicating if it is safe to add frag cache */ 3702ab25eeb5Syz155240 /* nflags(I) - NAT flags set for this packet */ 3703ab25eeb5Syz155240 /* */ 3704ab25eeb5Syz155240 /* Translate a packet coming "out" on an interface. */ 3705ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3706ab25eeb5Syz155240 int fr_natout(fin, nat, natadd, nflags) 3707ab25eeb5Syz155240 fr_info_t *fin; 3708ab25eeb5Syz155240 nat_t *nat; 3709ab25eeb5Syz155240 int natadd; 3710ab25eeb5Syz155240 u_32_t nflags; 3711ab25eeb5Syz155240 { 3712ab25eeb5Syz155240 icmphdr_t *icmp; 3713ab25eeb5Syz155240 u_short *csump; 3714381a2a9aSdr146992 u_32_t sumd; 3715ab25eeb5Syz155240 tcphdr_t *tcp; 3716ab25eeb5Syz155240 ipnat_t *np; 3717ab25eeb5Syz155240 int i; 3718f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3719ab25eeb5Syz155240 3720381a2a9aSdr146992 #if SOLARIS && defined(_KERNEL) 3721381a2a9aSdr146992 net_data_t net_data_p; 3722381a2a9aSdr146992 if (fin->fin_v == 4) 3723f4b3ec61Sdh155122 net_data_p = ifs->ifs_ipf_ipv4; 3724381a2a9aSdr146992 else 3725f4b3ec61Sdh155122 net_data_p = ifs->ifs_ipf_ipv6; 3726381a2a9aSdr146992 #endif 3727381a2a9aSdr146992 3728ab25eeb5Syz155240 tcp = NULL; 3729ab25eeb5Syz155240 icmp = NULL; 3730ab25eeb5Syz155240 csump = NULL; 3731ab25eeb5Syz155240 np = nat->nat_ptr; 3732ab25eeb5Syz155240 3733*15013d88Szf203873 if ((natadd != 0) && (fin->fin_flx & FI_FRAG)) 3734ab25eeb5Syz155240 (void) fr_nat_newfrag(fin, 0, nat); 3735ab25eeb5Syz155240 3736ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 3737ab25eeb5Syz155240 nat->nat_bytes[1] += fin->fin_plen; 3738ab25eeb5Syz155240 nat->nat_pkts[1]++; 3739ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 3740ab25eeb5Syz155240 3741ab25eeb5Syz155240 /* 3742ab25eeb5Syz155240 * Fix up checksums, not by recalculating them, but 3743ab25eeb5Syz155240 * simply computing adjustments. 3744ab25eeb5Syz155240 * This is only done for STREAMS based IP implementations where the 3745ab25eeb5Syz155240 * checksum has already been calculated by IP. In all other cases, 3746ab25eeb5Syz155240 * IPFilter is called before the checksum needs calculating so there 3747ab25eeb5Syz155240 * is no call to modify whatever is in the header now. 3748ab25eeb5Syz155240 */ 3749381a2a9aSdr146992 ASSERT(fin->fin_m != NULL); 3750381a2a9aSdr146992 if (fin->fin_v == 4 && !NET_IS_HCK_L3_FULL(net_data_p, fin->fin_m)) { 3751ab25eeb5Syz155240 if (nflags == IPN_ICMPERR) { 3752381a2a9aSdr146992 u_32_t s1, s2; 3753ab25eeb5Syz155240 3754ab25eeb5Syz155240 s1 = LONG_SUM(ntohl(fin->fin_saddr)); 3755ab25eeb5Syz155240 s2 = LONG_SUM(ntohl(nat->nat_outip.s_addr)); 3756ab25eeb5Syz155240 CALC_SUMD(s1, s2, sumd); 3757381a2a9aSdr146992 3758381a2a9aSdr146992 fix_outcksum(&fin->fin_ip->ip_sum, sumd); 3759ab25eeb5Syz155240 } 3760ab25eeb5Syz155240 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 3761ab25eeb5Syz155240 defined(linux) || defined(BRIDGE_IPF) 3762ab25eeb5Syz155240 else { 3763ab25eeb5Syz155240 /* 3764ab25eeb5Syz155240 * Strictly speaking, this isn't necessary on BSD 3765ab25eeb5Syz155240 * kernels because they do checksum calculation after 3766ab25eeb5Syz155240 * this code has run BUT if ipfilter is being used 3767ab25eeb5Syz155240 * to do NAT as a bridge, that code doesn't exist. 3768ab25eeb5Syz155240 */ 3769ab25eeb5Syz155240 if (nat->nat_dir == NAT_OUTBOUND) 3770381a2a9aSdr146992 fix_outcksum(&fin->fin_ip->ip_sum, 3771ab25eeb5Syz155240 nat->nat_ipsumd); 3772ab25eeb5Syz155240 else 3773381a2a9aSdr146992 fix_incksum(&fin->fin_ip->ip_sum, 3774ab25eeb5Syz155240 nat->nat_ipsumd); 3775ab25eeb5Syz155240 } 3776ab25eeb5Syz155240 #endif 3777ab25eeb5Syz155240 } 3778ab25eeb5Syz155240 3779ab25eeb5Syz155240 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 3780ab25eeb5Syz155240 if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) { 3781ab25eeb5Syz155240 tcp = fin->fin_dp; 3782ab25eeb5Syz155240 3783ab25eeb5Syz155240 tcp->th_sport = nat->nat_outport; 3784ab25eeb5Syz155240 fin->fin_data[0] = ntohs(nat->nat_outport); 3785ab25eeb5Syz155240 } 3786ab25eeb5Syz155240 3787ab25eeb5Syz155240 if ((nat->nat_outport != 0) && (nflags & IPN_ICMPQUERY)) { 3788ab25eeb5Syz155240 icmp = fin->fin_dp; 3789ab25eeb5Syz155240 icmp->icmp_id = nat->nat_outport; 3790ab25eeb5Syz155240 } 3791ab25eeb5Syz155240 3792ab25eeb5Syz155240 csump = nat_proto(fin, nat, nflags); 3793ab25eeb5Syz155240 } 3794ab25eeb5Syz155240 3795ab25eeb5Syz155240 fin->fin_ip->ip_src = nat->nat_outip; 3796ab25eeb5Syz155240 3797ab25eeb5Syz155240 nat_update(fin, nat, np); 3798ab25eeb5Syz155240 3799ab25eeb5Syz155240 /* 3800ab25eeb5Syz155240 * The above comments do not hold for layer 4 (or higher) checksums... 3801ab25eeb5Syz155240 */ 3802381a2a9aSdr146992 if (csump != NULL && !NET_IS_HCK_L4_FULL(net_data_p, fin->fin_m)) { 3803381a2a9aSdr146992 if (nflags & IPN_TCPUDP && 3804381a2a9aSdr146992 NET_IS_HCK_L4_PART(net_data_p, fin->fin_m)) 3805381a2a9aSdr146992 sumd = nat->nat_sumd[1]; 3806ab25eeb5Syz155240 else 3807381a2a9aSdr146992 sumd = nat->nat_sumd[0]; 3808381a2a9aSdr146992 3809381a2a9aSdr146992 if (nat->nat_dir == NAT_OUTBOUND) 3810381a2a9aSdr146992 fix_outcksum(csump, sumd); 3811381a2a9aSdr146992 else 3812381a2a9aSdr146992 fix_incksum(csump, sumd); 3813ab25eeb5Syz155240 } 3814ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 3815ab25eeb5Syz155240 ipfsync_update(SMC_NAT, fin, nat->nat_sync); 3816ab25eeb5Syz155240 #endif 3817ab25eeb5Syz155240 /* ------------------------------------------------------------- */ 3818ab25eeb5Syz155240 /* A few quick notes: */ 3819ab25eeb5Syz155240 /* Following are test conditions prior to calling the */ 3820ab25eeb5Syz155240 /* appr_check routine. */ 3821ab25eeb5Syz155240 /* */ 3822ab25eeb5Syz155240 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ 3823ab25eeb5Syz155240 /* with a redirect rule, we attempt to match the packet's */ 3824ab25eeb5Syz155240 /* source port against in_dport, otherwise we'd compare the */ 3825ab25eeb5Syz155240 /* packet's destination. */ 3826ab25eeb5Syz155240 /* ------------------------------------------------------------- */ 3827ab25eeb5Syz155240 if ((np != NULL) && (np->in_apr != NULL)) { 3828ab25eeb5Syz155240 i = appr_check(fin, nat); 3829ab25eeb5Syz155240 if (i == 0) 3830ab25eeb5Syz155240 i = 1; 3831ab25eeb5Syz155240 } else 3832ab25eeb5Syz155240 i = 1; 3833f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_nat_stats.ns_mapped[1]); 3834ab25eeb5Syz155240 fin->fin_flx |= FI_NATED; 3835ab25eeb5Syz155240 return i; 3836ab25eeb5Syz155240 } 3837ab25eeb5Syz155240 3838ab25eeb5Syz155240 3839ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3840ab25eeb5Syz155240 /* Function: fr_checknatin */ 3841ab25eeb5Syz155240 /* Returns: int - -1 == packet failed NAT checks so block it, */ 3842ab25eeb5Syz155240 /* 0 == no packet translation occurred, */ 3843ab25eeb5Syz155240 /* 1 == packet was successfully translated. */ 3844ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3845ab25eeb5Syz155240 /* passp(I) - pointer to filtering result flags */ 3846ab25eeb5Syz155240 /* */ 3847ab25eeb5Syz155240 /* Check to see if an incoming packet should be changed. ICMP packets are */ 3848ab25eeb5Syz155240 /* first checked to see if they match an existing entry (if an error), */ 3849ab25eeb5Syz155240 /* otherwise a search of the current NAT table is made. If neither results */ 3850ab25eeb5Syz155240 /* in a match then a search for a matching NAT rule is made. Create a new */ 3851ab25eeb5Syz155240 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */ 3852ab25eeb5Syz155240 /* packet header(s) as required. */ 3853ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3854ab25eeb5Syz155240 int fr_checknatin(fin, passp) 3855ab25eeb5Syz155240 fr_info_t *fin; 3856ab25eeb5Syz155240 u_32_t *passp; 3857ab25eeb5Syz155240 { 3858ab25eeb5Syz155240 u_int nflags, natadd; 3859ab25eeb5Syz155240 int rval, natfailed; 3860ab25eeb5Syz155240 struct ifnet *ifp; 3861ab25eeb5Syz155240 struct in_addr in; 3862ab25eeb5Syz155240 icmphdr_t *icmp; 3863ab25eeb5Syz155240 tcphdr_t *tcp; 3864ab25eeb5Syz155240 u_short dport; 3865ab25eeb5Syz155240 ipnat_t *np; 3866ab25eeb5Syz155240 nat_t *nat; 3867ab25eeb5Syz155240 u_32_t iph; 3868f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3869ab25eeb5Syz155240 3870f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_rules == 0 || ifs->ifs_fr_nat_lock != 0) 3871ab25eeb5Syz155240 return 0; 3872ab25eeb5Syz155240 3873ab25eeb5Syz155240 tcp = NULL; 3874ab25eeb5Syz155240 icmp = NULL; 3875ab25eeb5Syz155240 dport = 0; 3876ab25eeb5Syz155240 natadd = 1; 3877ab25eeb5Syz155240 nflags = 0; 3878ab25eeb5Syz155240 natfailed = 0; 3879ab25eeb5Syz155240 ifp = fin->fin_ifp; 3880ab25eeb5Syz155240 3881ab25eeb5Syz155240 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 3882ab25eeb5Syz155240 switch (fin->fin_p) 3883ab25eeb5Syz155240 { 3884ab25eeb5Syz155240 case IPPROTO_TCP : 3885ab25eeb5Syz155240 nflags = IPN_TCP; 3886ab25eeb5Syz155240 break; 3887ab25eeb5Syz155240 case IPPROTO_UDP : 3888ab25eeb5Syz155240 nflags = IPN_UDP; 3889ab25eeb5Syz155240 break; 3890ab25eeb5Syz155240 case IPPROTO_ICMP : 3891ab25eeb5Syz155240 icmp = fin->fin_dp; 3892ab25eeb5Syz155240 3893ab25eeb5Syz155240 /* 3894ab25eeb5Syz155240 * This is an incoming packet, so the destination is 3895ab25eeb5Syz155240 * the icmp_id and the source port equals 0 3896ab25eeb5Syz155240 */ 3897ab25eeb5Syz155240 if (nat_icmpquerytype4(icmp->icmp_type)) { 3898ab25eeb5Syz155240 nflags = IPN_ICMPQUERY; 3899ab25eeb5Syz155240 dport = icmp->icmp_id; 3900ab25eeb5Syz155240 } break; 3901ab25eeb5Syz155240 default : 3902ab25eeb5Syz155240 break; 3903ab25eeb5Syz155240 } 3904ab25eeb5Syz155240 3905ab25eeb5Syz155240 if ((nflags & IPN_TCPUDP)) { 3906ab25eeb5Syz155240 tcp = fin->fin_dp; 3907ab25eeb5Syz155240 dport = tcp->th_dport; 3908ab25eeb5Syz155240 } 3909ab25eeb5Syz155240 } 3910ab25eeb5Syz155240 3911ab25eeb5Syz155240 in = fin->fin_dst; 3912ab25eeb5Syz155240 3913f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 3914ab25eeb5Syz155240 3915ab25eeb5Syz155240 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) && 3916ab25eeb5Syz155240 (nat = nat_icmperror(fin, &nflags, NAT_INBOUND))) 3917ab25eeb5Syz155240 /*EMPTY*/; 3918ab25eeb5Syz155240 else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin))) 3919ab25eeb5Syz155240 natadd = 0; 3920ab25eeb5Syz155240 else if ((nat = nat_inlookup(fin, nflags|NAT_SEARCH, (u_int)fin->fin_p, 3921ab25eeb5Syz155240 fin->fin_src, in))) { 3922ab25eeb5Syz155240 nflags = nat->nat_flags; 3923ab25eeb5Syz155240 } else { 3924ab25eeb5Syz155240 u_32_t hv, msk, rmsk; 3925ab25eeb5Syz155240 3926f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3927f4b3ec61Sdh155122 rmsk = ifs->ifs_rdr_masks; 3928ab25eeb5Syz155240 msk = 0xffffffff; 3929f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 3930ab25eeb5Syz155240 /* 3931ab25eeb5Syz155240 * If there is no current entry in the nat table for this IP#, 3932ab25eeb5Syz155240 * create one for it (if there is a matching rule). 3933ab25eeb5Syz155240 */ 3934ab25eeb5Syz155240 maskloop: 3935ab25eeb5Syz155240 iph = in.s_addr & htonl(msk); 3936f4b3ec61Sdh155122 hv = NAT_HASH_FN(iph, 0, ifs->ifs_ipf_rdrrules_sz); 3937f4b3ec61Sdh155122 for (np = ifs->ifs_rdr_rules[hv]; np; np = np->in_rnext) { 3938ab25eeb5Syz155240 if (np->in_ifps[0] && (np->in_ifps[0] != ifp)) 3939ab25eeb5Syz155240 continue; 3940ab25eeb5Syz155240 if (np->in_v != fin->fin_v) 3941ab25eeb5Syz155240 continue; 3942ab25eeb5Syz155240 if (np->in_p && (np->in_p != fin->fin_p)) 3943ab25eeb5Syz155240 continue; 3944ab25eeb5Syz155240 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags)) 3945ab25eeb5Syz155240 continue; 3946ab25eeb5Syz155240 if (np->in_flags & IPN_FILTER) { 3947ab25eeb5Syz155240 if (!nat_match(fin, np)) 3948ab25eeb5Syz155240 continue; 3949ab25eeb5Syz155240 } else { 3950ab25eeb5Syz155240 if ((in.s_addr & np->in_outmsk) != np->in_outip) 3951ab25eeb5Syz155240 continue; 3952ab25eeb5Syz155240 if (np->in_pmin && 3953ab25eeb5Syz155240 ((ntohs(np->in_pmax) < ntohs(dport)) || 3954ab25eeb5Syz155240 (ntohs(dport) < ntohs(np->in_pmin)))) 3955ab25eeb5Syz155240 continue; 3956ab25eeb5Syz155240 } 3957ab25eeb5Syz155240 3958ab25eeb5Syz155240 if (*np->in_plabel != '\0') { 3959ab25eeb5Syz155240 if (!appr_ok(fin, tcp, np)) { 3960ab25eeb5Syz155240 continue; 3961ab25eeb5Syz155240 } 3962ab25eeb5Syz155240 } 3963ab25eeb5Syz155240 3964ab25eeb5Syz155240 nat = nat_new(fin, np, NULL, nflags, NAT_INBOUND); 3965ab25eeb5Syz155240 if (nat != NULL) { 3966ab25eeb5Syz155240 np->in_hits++; 3967ab25eeb5Syz155240 break; 3968ab25eeb5Syz155240 } else 3969ab25eeb5Syz155240 natfailed = -1; 3970ab25eeb5Syz155240 } 3971ab25eeb5Syz155240 3972ab25eeb5Syz155240 if ((np == NULL) && (rmsk != 0)) { 3973ab25eeb5Syz155240 while (rmsk) { 3974ab25eeb5Syz155240 msk <<= 1; 3975ab25eeb5Syz155240 if (rmsk & 0x80000000) 3976ab25eeb5Syz155240 break; 3977ab25eeb5Syz155240 rmsk <<= 1; 3978ab25eeb5Syz155240 } 3979ab25eeb5Syz155240 if (rmsk != 0) { 3980ab25eeb5Syz155240 rmsk <<= 1; 3981ab25eeb5Syz155240 goto maskloop; 3982ab25eeb5Syz155240 } 3983ab25eeb5Syz155240 } 3984f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 3985ab25eeb5Syz155240 } 3986ab25eeb5Syz155240 if (nat != NULL) { 3987ab25eeb5Syz155240 rval = fr_natin(fin, nat, natadd, nflags); 3988ab25eeb5Syz155240 if (rval == 1) { 3989ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 3990ab25eeb5Syz155240 nat->nat_ref++; 3991ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 3992ab25eeb5Syz155240 fin->fin_nat = nat; 3993ab25eeb5Syz155240 fin->fin_state = nat->nat_state; 3994ab25eeb5Syz155240 } 3995ab25eeb5Syz155240 } else 3996ab25eeb5Syz155240 rval = natfailed; 3997f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3998ab25eeb5Syz155240 3999ab25eeb5Syz155240 if (rval == -1) { 4000ab25eeb5Syz155240 if (passp != NULL) 4001ab25eeb5Syz155240 *passp = FR_BLOCK; 4002ab25eeb5Syz155240 fin->fin_flx |= FI_BADNAT; 4003ab25eeb5Syz155240 } 4004ab25eeb5Syz155240 return rval; 4005ab25eeb5Syz155240 } 4006ab25eeb5Syz155240 4007ab25eeb5Syz155240 4008ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4009ab25eeb5Syz155240 /* Function: fr_natin */ 4010ab25eeb5Syz155240 /* Returns: int - -1 == packet failed NAT checks so block it, */ 4011ab25eeb5Syz155240 /* 1 == packet was successfully translated. */ 4012ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 4013ab25eeb5Syz155240 /* nat(I) - pointer to NAT structure */ 4014ab25eeb5Syz155240 /* natadd(I) - flag indicating if it is safe to add frag cache */ 4015ab25eeb5Syz155240 /* nflags(I) - NAT flags set for this packet */ 4016ab25eeb5Syz155240 /* Locks Held: ipf_nat (READ) */ 4017ab25eeb5Syz155240 /* */ 4018ab25eeb5Syz155240 /* Translate a packet coming "in" on an interface. */ 4019ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4020ab25eeb5Syz155240 int fr_natin(fin, nat, natadd, nflags) 4021ab25eeb5Syz155240 fr_info_t *fin; 4022ab25eeb5Syz155240 nat_t *nat; 4023ab25eeb5Syz155240 int natadd; 4024ab25eeb5Syz155240 u_32_t nflags; 4025ab25eeb5Syz155240 { 4026ab25eeb5Syz155240 icmphdr_t *icmp; 4027381a2a9aSdr146992 u_short *csump, *csump1; 4028381a2a9aSdr146992 u_32_t sumd; 4029ab25eeb5Syz155240 tcphdr_t *tcp; 4030ab25eeb5Syz155240 ipnat_t *np; 4031ab25eeb5Syz155240 int i; 4032f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 4033ab25eeb5Syz155240 4034381a2a9aSdr146992 #if SOLARIS && defined(_KERNEL) 4035381a2a9aSdr146992 net_data_t net_data_p; 4036381a2a9aSdr146992 if (fin->fin_v == 4) 4037f4b3ec61Sdh155122 net_data_p = ifs->ifs_ipf_ipv4; 4038381a2a9aSdr146992 else 4039f4b3ec61Sdh155122 net_data_p = ifs->ifs_ipf_ipv6; 4040381a2a9aSdr146992 #endif 4041381a2a9aSdr146992 4042ab25eeb5Syz155240 tcp = NULL; 4043ab25eeb5Syz155240 csump = NULL; 4044ab25eeb5Syz155240 np = nat->nat_ptr; 4045ab25eeb5Syz155240 fin->fin_fr = nat->nat_fr; 4046ab25eeb5Syz155240 4047ab25eeb5Syz155240 if ((natadd != 0) && (fin->fin_flx & FI_FRAG)) 4048ab25eeb5Syz155240 (void) fr_nat_newfrag(fin, 0, nat); 4049ab25eeb5Syz155240 4050*15013d88Szf203873 if (np != NULL) { 4051*15013d88Szf203873 4052ab25eeb5Syz155240 /* ------------------------------------------------------------- */ 4053ab25eeb5Syz155240 /* A few quick notes: */ 4054ab25eeb5Syz155240 /* Following are test conditions prior to calling the */ 4055ab25eeb5Syz155240 /* appr_check routine. */ 4056ab25eeb5Syz155240 /* */ 4057ab25eeb5Syz155240 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ 4058ab25eeb5Syz155240 /* with a map rule, we attempt to match the packet's */ 4059ab25eeb5Syz155240 /* source port against in_dport, otherwise we'd compare the */ 4060ab25eeb5Syz155240 /* packet's destination. */ 4061ab25eeb5Syz155240 /* ------------------------------------------------------------- */ 4062ab25eeb5Syz155240 if (np->in_apr != NULL) { 4063ab25eeb5Syz155240 i = appr_check(fin, nat); 4064ab25eeb5Syz155240 if (i == -1) { 4065ab25eeb5Syz155240 return -1; 4066ab25eeb5Syz155240 } 4067ab25eeb5Syz155240 } 4068ab25eeb5Syz155240 } 4069ab25eeb5Syz155240 4070ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 4071ab25eeb5Syz155240 ipfsync_update(SMC_NAT, fin, nat->nat_sync); 4072ab25eeb5Syz155240 #endif 4073ab25eeb5Syz155240 4074ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 4075ab25eeb5Syz155240 nat->nat_bytes[0] += fin->fin_plen; 4076ab25eeb5Syz155240 nat->nat_pkts[0]++; 4077ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 4078ab25eeb5Syz155240 4079ab25eeb5Syz155240 fin->fin_ip->ip_dst = nat->nat_inip; 4080ab25eeb5Syz155240 fin->fin_fi.fi_daddr = nat->nat_inip.s_addr; 4081ab25eeb5Syz155240 if (nflags & IPN_TCPUDP) 4082ab25eeb5Syz155240 tcp = fin->fin_dp; 4083ab25eeb5Syz155240 4084ab25eeb5Syz155240 /* 4085ab25eeb5Syz155240 * Fix up checksums, not by recalculating them, but 4086ab25eeb5Syz155240 * simply computing adjustments. 4087ab25eeb5Syz155240 * Why only do this for some platforms on inbound packets ? 4088ab25eeb5Syz155240 * Because for those that it is done, IP processing is yet to happen 4089ab25eeb5Syz155240 * and so the IPv4 header checksum has not yet been evaluated. 4090ab25eeb5Syz155240 * Perhaps it should always be done for the benefit of things like 4091ab25eeb5Syz155240 * fast forwarding (so that it doesn't need to be recomputed) but with 4092ab25eeb5Syz155240 * header checksum offloading, perhaps it is a moot point. 4093ab25eeb5Syz155240 */ 4094ab25eeb5Syz155240 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 4095ab25eeb5Syz155240 defined(__osf__) || defined(linux) 4096ab25eeb5Syz155240 if (nat->nat_dir == NAT_OUTBOUND) 4097381a2a9aSdr146992 fix_incksum(&fin->fin_ip->ip_sum, nat->nat_ipsumd); 4098ab25eeb5Syz155240 else 4099381a2a9aSdr146992 fix_outcksum(&fin->fin_ip->ip_sum, nat->nat_ipsumd); 4100ab25eeb5Syz155240 #endif 4101ab25eeb5Syz155240 4102ab25eeb5Syz155240 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 4103ab25eeb5Syz155240 if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) { 4104ab25eeb5Syz155240 tcp->th_dport = nat->nat_inport; 4105ab25eeb5Syz155240 fin->fin_data[1] = ntohs(nat->nat_inport); 4106ab25eeb5Syz155240 } 4107ab25eeb5Syz155240 4108ab25eeb5Syz155240 4109ab25eeb5Syz155240 if ((nat->nat_inport != 0) && (nflags & IPN_ICMPQUERY)) { 4110ab25eeb5Syz155240 icmp = fin->fin_dp; 4111ab25eeb5Syz155240 4112ab25eeb5Syz155240 icmp->icmp_id = nat->nat_inport; 4113ab25eeb5Syz155240 } 4114ab25eeb5Syz155240 4115ab25eeb5Syz155240 csump = nat_proto(fin, nat, nflags); 4116ab25eeb5Syz155240 } 4117ab25eeb5Syz155240 4118ab25eeb5Syz155240 nat_update(fin, nat, np); 4119ab25eeb5Syz155240 4120381a2a9aSdr146992 #if SOLARIS && defined(_KERNEL) 4121381a2a9aSdr146992 if (nflags & IPN_TCPUDP && 4122381a2a9aSdr146992 NET_IS_HCK_L4_PART(net_data_p, fin->fin_m)) { 4123381a2a9aSdr146992 sumd = nat->nat_sumd[1]; 4124381a2a9aSdr146992 csump1 = &(fin->fin_m->b_datap->db_struioun.cksum.cksum_val.u16); 4125381a2a9aSdr146992 if (csump1 != NULL) { 4126381a2a9aSdr146992 if (nat->nat_dir == NAT_OUTBOUND) 4127381a2a9aSdr146992 fix_incksum(csump1, sumd); 4128381a2a9aSdr146992 else 4129381a2a9aSdr146992 fix_outcksum(csump1, sumd); 4130381a2a9aSdr146992 } 4131381a2a9aSdr146992 } else 4132381a2a9aSdr146992 #endif 4133381a2a9aSdr146992 sumd = nat->nat_sumd[0]; 4134381a2a9aSdr146992 4135ab25eeb5Syz155240 /* 4136381a2a9aSdr146992 * Inbound packets always need to have their address adjusted in case 4137381a2a9aSdr146992 * code following this validates it. 4138ab25eeb5Syz155240 */ 4139ab25eeb5Syz155240 if (csump != NULL) { 4140ab25eeb5Syz155240 if (nat->nat_dir == NAT_OUTBOUND) 4141381a2a9aSdr146992 fix_incksum(csump, sumd); 4142ab25eeb5Syz155240 else 4143381a2a9aSdr146992 fix_outcksum(csump, sumd); 4144ab25eeb5Syz155240 } 4145f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_nat_stats.ns_mapped[0]); 4146ab25eeb5Syz155240 fin->fin_flx |= FI_NATED; 4147ab25eeb5Syz155240 if (np != NULL && np->in_tag.ipt_num[0] != 0) 4148ab25eeb5Syz155240 fin->fin_nattag = &np->in_tag; 4149ab25eeb5Syz155240 return 1; 4150ab25eeb5Syz155240 } 4151ab25eeb5Syz155240 4152ab25eeb5Syz155240 4153ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4154ab25eeb5Syz155240 /* Function: nat_proto */ 4155ab25eeb5Syz155240 /* Returns: u_short* - pointer to transport header checksum to update, */ 4156ab25eeb5Syz155240 /* NULL if the transport protocol is not recognised */ 4157ab25eeb5Syz155240 /* as needing a checksum update. */ 4158ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 4159ab25eeb5Syz155240 /* nat(I) - pointer to NAT structure */ 4160ab25eeb5Syz155240 /* nflags(I) - NAT flags set for this packet */ 4161ab25eeb5Syz155240 /* */ 4162ab25eeb5Syz155240 /* Return the pointer to the checksum field for each protocol so understood.*/ 4163ab25eeb5Syz155240 /* If support for making other changes to a protocol header is required, */ 4164ab25eeb5Syz155240 /* that is not strictly 'address' translation, such as clamping the MSS in */ 4165ab25eeb5Syz155240 /* TCP down to a specific value, then do it from here. */ 4166ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4167ab25eeb5Syz155240 u_short *nat_proto(fin, nat, nflags) 4168ab25eeb5Syz155240 fr_info_t *fin; 4169ab25eeb5Syz155240 nat_t *nat; 4170ab25eeb5Syz155240 u_int nflags; 4171ab25eeb5Syz155240 { 4172ab25eeb5Syz155240 icmphdr_t *icmp; 4173ab25eeb5Syz155240 u_short *csump; 4174ab25eeb5Syz155240 tcphdr_t *tcp; 4175ab25eeb5Syz155240 udphdr_t *udp; 4176ab25eeb5Syz155240 4177ab25eeb5Syz155240 csump = NULL; 4178ab25eeb5Syz155240 if (fin->fin_out == 0) { 4179ab25eeb5Syz155240 fin->fin_rev = (nat->nat_dir == NAT_OUTBOUND); 4180ab25eeb5Syz155240 } else { 4181ab25eeb5Syz155240 fin->fin_rev = (nat->nat_dir == NAT_INBOUND); 4182ab25eeb5Syz155240 } 4183ab25eeb5Syz155240 4184ab25eeb5Syz155240 switch (fin->fin_p) 4185ab25eeb5Syz155240 { 4186ab25eeb5Syz155240 case IPPROTO_TCP : 4187ab25eeb5Syz155240 tcp = fin->fin_dp; 4188ab25eeb5Syz155240 4189ab25eeb5Syz155240 csump = &tcp->th_sum; 4190ab25eeb5Syz155240 4191ab25eeb5Syz155240 /* 4192ab25eeb5Syz155240 * Do a MSS CLAMPING on a SYN packet, 4193ab25eeb5Syz155240 * only deal IPv4 for now. 4194ab25eeb5Syz155240 */ 4195ab25eeb5Syz155240 if ((nat->nat_mssclamp != 0) && (tcp->th_flags & TH_SYN) != 0) 4196381a2a9aSdr146992 nat_mssclamp(tcp, nat->nat_mssclamp, csump); 4197ab25eeb5Syz155240 4198ab25eeb5Syz155240 break; 4199ab25eeb5Syz155240 4200ab25eeb5Syz155240 case IPPROTO_UDP : 4201ab25eeb5Syz155240 udp = fin->fin_dp; 4202ab25eeb5Syz155240 4203ab25eeb5Syz155240 if (udp->uh_sum) 4204ab25eeb5Syz155240 csump = &udp->uh_sum; 4205ab25eeb5Syz155240 break; 4206ab25eeb5Syz155240 4207ab25eeb5Syz155240 case IPPROTO_ICMP : 4208ab25eeb5Syz155240 icmp = fin->fin_dp; 4209ab25eeb5Syz155240 4210ab25eeb5Syz155240 if ((nflags & IPN_ICMPQUERY) != 0) { 4211ab25eeb5Syz155240 if (icmp->icmp_cksum != 0) 4212ab25eeb5Syz155240 csump = &icmp->icmp_cksum; 4213ab25eeb5Syz155240 } 4214ab25eeb5Syz155240 break; 4215ab25eeb5Syz155240 } 4216ab25eeb5Syz155240 return csump; 4217ab25eeb5Syz155240 } 4218ab25eeb5Syz155240 4219ab25eeb5Syz155240 4220ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4221ab25eeb5Syz155240 /* Function: fr_natunload */ 4222ab25eeb5Syz155240 /* Returns: Nil */ 4223ab25eeb5Syz155240 /* Parameters: Nil */ 4224ab25eeb5Syz155240 /* */ 4225ab25eeb5Syz155240 /* Free all memory used by NAT structures allocated at runtime. */ 4226ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4227f4b3ec61Sdh155122 void fr_natunload(ifs) 4228f4b3ec61Sdh155122 ipf_stack_t *ifs; 4229ab25eeb5Syz155240 { 4230ab25eeb5Syz155240 ipftq_t *ifq, *ifqnext; 4231ab25eeb5Syz155240 4232f4b3ec61Sdh155122 (void) nat_clearlist(ifs); 4233f4b3ec61Sdh155122 (void) nat_flushtable(ifs); 4234ab25eeb5Syz155240 4235ab25eeb5Syz155240 /* 4236ab25eeb5Syz155240 * Proxy timeout queues are not cleaned here because although they 4237ab25eeb5Syz155240 * exist on the NAT list, appr_unload is called after fr_natunload 4238ab25eeb5Syz155240 * and the proxies actually are responsible for them being created. 4239ab25eeb5Syz155240 * Should the proxy timeouts have their own list? There's no real 4240ab25eeb5Syz155240 * justification as this is the only complication. 4241ab25eeb5Syz155240 */ 4242f4b3ec61Sdh155122 for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) { 4243ab25eeb5Syz155240 ifqnext = ifq->ifq_next; 4244ab25eeb5Syz155240 if (((ifq->ifq_flags & IFQF_PROXY) == 0) && 4245ab25eeb5Syz155240 (fr_deletetimeoutqueue(ifq) == 0)) 4246f4b3ec61Sdh155122 fr_freetimeoutqueue(ifq, ifs); 4247ab25eeb5Syz155240 } 4248ab25eeb5Syz155240 4249f4b3ec61Sdh155122 if (ifs->ifs_nat_table[0] != NULL) { 4250f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_table[0], 4251f4b3ec61Sdh155122 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 4252f4b3ec61Sdh155122 ifs->ifs_nat_table[0] = NULL; 4253ab25eeb5Syz155240 } 4254f4b3ec61Sdh155122 if (ifs->ifs_nat_table[1] != NULL) { 4255f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_table[1], 4256f4b3ec61Sdh155122 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 4257f4b3ec61Sdh155122 ifs->ifs_nat_table[1] = NULL; 4258ab25eeb5Syz155240 } 4259f4b3ec61Sdh155122 if (ifs->ifs_nat_rules != NULL) { 4260f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_rules, 4261f4b3ec61Sdh155122 sizeof(ipnat_t *) * ifs->ifs_ipf_natrules_sz); 4262f4b3ec61Sdh155122 ifs->ifs_nat_rules = NULL; 4263ab25eeb5Syz155240 } 4264f4b3ec61Sdh155122 if (ifs->ifs_rdr_rules != NULL) { 4265f4b3ec61Sdh155122 KFREES(ifs->ifs_rdr_rules, 4266f4b3ec61Sdh155122 sizeof(ipnat_t *) * ifs->ifs_ipf_rdrrules_sz); 4267f4b3ec61Sdh155122 ifs->ifs_rdr_rules = NULL; 4268ab25eeb5Syz155240 } 4269f4b3ec61Sdh155122 if (ifs->ifs_maptable != NULL) { 4270f4b3ec61Sdh155122 KFREES(ifs->ifs_maptable, 4271f4b3ec61Sdh155122 sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz); 4272f4b3ec61Sdh155122 ifs->ifs_maptable = NULL; 4273ab25eeb5Syz155240 } 4274f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[0] != NULL) { 4275f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_stats.ns_bucketlen[0], 4276f4b3ec61Sdh155122 sizeof(u_long *) * ifs->ifs_ipf_nattable_sz); 4277f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0] = NULL; 4278ab25eeb5Syz155240 } 4279f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[1] != NULL) { 4280f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_stats.ns_bucketlen[1], 4281f4b3ec61Sdh155122 sizeof(u_long *) * ifs->ifs_ipf_nattable_sz); 4282f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1] = NULL; 4283ab25eeb5Syz155240 } 4284ab25eeb5Syz155240 4285f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_maxbucket_reset == 1) 4286f4b3ec61Sdh155122 ifs->ifs_fr_nat_maxbucket = 0; 4287ab25eeb5Syz155240 4288f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_init == 1) { 4289f4b3ec61Sdh155122 ifs->ifs_fr_nat_init = 0; 4290f4b3ec61Sdh155122 fr_sttab_destroy(ifs->ifs_nat_tqb); 4291ab25eeb5Syz155240 4292f4b3ec61Sdh155122 RW_DESTROY(&ifs->ifs_ipf_natfrag); 4293f4b3ec61Sdh155122 RW_DESTROY(&ifs->ifs_ipf_nat); 4294ab25eeb5Syz155240 4295f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ipf_nat_new); 4296f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ipf_natio); 4297ab25eeb5Syz155240 4298f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_nat_udptq.ifq_lock); 4299f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_nat_icmptq.ifq_lock); 4300f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_nat_iptq.ifq_lock); 4301ab25eeb5Syz155240 } 4302ab25eeb5Syz155240 } 4303ab25eeb5Syz155240 4304ab25eeb5Syz155240 4305ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4306ab25eeb5Syz155240 /* Function: fr_natexpire */ 4307ab25eeb5Syz155240 /* Returns: Nil */ 4308ab25eeb5Syz155240 /* Parameters: Nil */ 4309ab25eeb5Syz155240 /* */ 4310ab25eeb5Syz155240 /* Check all of the timeout queues for entries at the top which need to be */ 4311ab25eeb5Syz155240 /* expired. */ 4312ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4313f4b3ec61Sdh155122 void fr_natexpire(ifs) 4314f4b3ec61Sdh155122 ipf_stack_t *ifs; 4315ab25eeb5Syz155240 { 4316ab25eeb5Syz155240 ipftq_t *ifq, *ifqnext; 4317ab25eeb5Syz155240 ipftqent_t *tqe, *tqn; 4318ab25eeb5Syz155240 int i; 4319ab25eeb5Syz155240 SPL_INT(s); 4320ab25eeb5Syz155240 4321ab25eeb5Syz155240 SPL_NET(s); 4322f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 4323f4b3ec61Sdh155122 for (ifq = ifs->ifs_nat_tqb, i = 0; ifq != NULL; ifq = ifq->ifq_next) { 4324ab25eeb5Syz155240 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) { 4325f4b3ec61Sdh155122 if (tqe->tqe_die > ifs->ifs_fr_ticks) 4326ab25eeb5Syz155240 break; 4327ab25eeb5Syz155240 tqn = tqe->tqe_next; 4328f4b3ec61Sdh155122 nat_delete(tqe->tqe_parent, NL_EXPIRE, ifs); 4329ab25eeb5Syz155240 } 4330ab25eeb5Syz155240 } 4331ab25eeb5Syz155240 4332f4b3ec61Sdh155122 for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) { 4333ab25eeb5Syz155240 ifqnext = ifq->ifq_next; 4334ab25eeb5Syz155240 4335ab25eeb5Syz155240 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) { 4336f4b3ec61Sdh155122 if (tqe->tqe_die > ifs->ifs_fr_ticks) 4337ab25eeb5Syz155240 break; 4338ab25eeb5Syz155240 tqn = tqe->tqe_next; 4339f4b3ec61Sdh155122 nat_delete(tqe->tqe_parent, NL_EXPIRE, ifs); 4340ab25eeb5Syz155240 } 4341ab25eeb5Syz155240 } 4342ab25eeb5Syz155240 4343f4b3ec61Sdh155122 for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) { 4344ab25eeb5Syz155240 ifqnext = ifq->ifq_next; 4345ab25eeb5Syz155240 4346ab25eeb5Syz155240 if (((ifq->ifq_flags & IFQF_DELETE) != 0) && 4347ab25eeb5Syz155240 (ifq->ifq_ref == 0)) { 4348f4b3ec61Sdh155122 fr_freetimeoutqueue(ifq, ifs); 4349ab25eeb5Syz155240 } 4350ab25eeb5Syz155240 } 4351ab25eeb5Syz155240 4352f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4353ab25eeb5Syz155240 SPL_X(s); 4354ab25eeb5Syz155240 } 4355ab25eeb5Syz155240 4356ab25eeb5Syz155240 4357ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4358381a2a9aSdr146992 /* Function: fr_nataddrsync */ 4359ab25eeb5Syz155240 /* Returns: Nil */ 4360ab25eeb5Syz155240 /* Parameters: ifp(I) - pointer to network interface */ 4361381a2a9aSdr146992 /* addr(I) - pointer to new network address */ 4362ab25eeb5Syz155240 /* */ 4363ab25eeb5Syz155240 /* Walk through all of the currently active NAT sessions, looking for those */ 4364381a2a9aSdr146992 /* which need to have their translated address updated (where the interface */ 4365381a2a9aSdr146992 /* matches the one passed in) and change it, recalculating the checksum sum */ 4366381a2a9aSdr146992 /* difference too. */ 4367ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4368f4b3ec61Sdh155122 void fr_nataddrsync(ifp, addr, ifs) 4369ab25eeb5Syz155240 void *ifp; 4370381a2a9aSdr146992 struct in_addr *addr; 4371f4b3ec61Sdh155122 ipf_stack_t *ifs; 4372ab25eeb5Syz155240 { 4373ab25eeb5Syz155240 u_32_t sum1, sum2, sumd; 4374ab25eeb5Syz155240 nat_t *nat; 4375381a2a9aSdr146992 ipnat_t *np; 4376ab25eeb5Syz155240 SPL_INT(s); 4377ab25eeb5Syz155240 4378f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) 4379ab25eeb5Syz155240 return; 4380ab25eeb5Syz155240 4381ab25eeb5Syz155240 SPL_NET(s); 4382f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 4383ab25eeb5Syz155240 4384f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) { 4385f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4386ab25eeb5Syz155240 return; 4387ab25eeb5Syz155240 } 4388ab25eeb5Syz155240 4389381a2a9aSdr146992 /* 4390381a2a9aSdr146992 * Change IP addresses for NAT sessions for any protocol except TCP 4391381a2a9aSdr146992 * since it will break the TCP connection anyway. The only rules 4392381a2a9aSdr146992 * which will get changed are those which are "map ... -> 0/32", 4393381a2a9aSdr146992 * where the rule specifies the address is taken from the interface. 4394381a2a9aSdr146992 */ 4395f4b3ec61Sdh155122 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4396381a2a9aSdr146992 if (addr != NULL) { 4397381a2a9aSdr146992 if (((ifp != NULL) && ifp != (nat->nat_ifps[0])) || 4398381a2a9aSdr146992 ((nat->nat_flags & IPN_TCP) != 0)) 4399ab25eeb5Syz155240 continue; 4400381a2a9aSdr146992 if (((np = nat->nat_ptr) == NULL) || 4401381a2a9aSdr146992 (np->in_nip || (np->in_outmsk != 0xffffffff))) 4402ab25eeb5Syz155240 continue; 4403ab25eeb5Syz155240 4404ab25eeb5Syz155240 /* 4405ab25eeb5Syz155240 * Change the map-to address to be the same as the 4406ab25eeb5Syz155240 * new one. 4407ab25eeb5Syz155240 */ 4408ab25eeb5Syz155240 sum1 = nat->nat_outip.s_addr; 4409381a2a9aSdr146992 nat->nat_outip = *addr; 4410381a2a9aSdr146992 sum2 = nat->nat_outip.s_addr; 4411381a2a9aSdr146992 4412381a2a9aSdr146992 } else if (((ifp == NULL) || (ifp == nat->nat_ifps[0])) && 4413381a2a9aSdr146992 !(nat->nat_flags & IPN_TCP) && (np = nat->nat_ptr) && 4414381a2a9aSdr146992 (np->in_outmsk == 0xffffffff) && !np->in_nip) { 4415381a2a9aSdr146992 struct in_addr in; 4416381a2a9aSdr146992 4417381a2a9aSdr146992 /* 4418381a2a9aSdr146992 * Change the map-to address to be the same as the 4419381a2a9aSdr146992 * new one. 4420381a2a9aSdr146992 */ 4421381a2a9aSdr146992 sum1 = nat->nat_outip.s_addr; 4422381a2a9aSdr146992 if (fr_ifpaddr(4, FRI_NORMAL, nat->nat_ifps[0], 4423f4b3ec61Sdh155122 &in, NULL, ifs) != -1) 4424ab25eeb5Syz155240 nat->nat_outip = in; 4425ab25eeb5Syz155240 sum2 = nat->nat_outip.s_addr; 4426381a2a9aSdr146992 } else { 4427381a2a9aSdr146992 continue; 4428381a2a9aSdr146992 } 4429ab25eeb5Syz155240 4430ab25eeb5Syz155240 if (sum1 == sum2) 4431ab25eeb5Syz155240 continue; 4432ab25eeb5Syz155240 /* 4433ab25eeb5Syz155240 * Readjust the checksum adjustment to take into 4434ab25eeb5Syz155240 * account the new IP#. 4435ab25eeb5Syz155240 */ 4436ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 4437ab25eeb5Syz155240 /* XXX - dont change for TCP when solaris does 4438ab25eeb5Syz155240 * hardware checksumming. 4439ab25eeb5Syz155240 */ 4440ab25eeb5Syz155240 sumd += nat->nat_sumd[0]; 4441ab25eeb5Syz155240 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 4442ab25eeb5Syz155240 nat->nat_sumd[1] = nat->nat_sumd[0]; 4443ab25eeb5Syz155240 } 4444381a2a9aSdr146992 4445f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4446381a2a9aSdr146992 SPL_X(s); 4447381a2a9aSdr146992 } 4448381a2a9aSdr146992 4449381a2a9aSdr146992 4450381a2a9aSdr146992 /* ------------------------------------------------------------------------ */ 4451381a2a9aSdr146992 /* Function: fr_natifpsync */ 4452381a2a9aSdr146992 /* Returns: Nil */ 4453381a2a9aSdr146992 /* Parameters: action(I) - how we are syncing */ 4454381a2a9aSdr146992 /* ifp(I) - pointer to network interface */ 4455381a2a9aSdr146992 /* name(I) - name of interface to sync to */ 4456381a2a9aSdr146992 /* */ 4457381a2a9aSdr146992 /* This function is used to resync the mapping of interface names and their */ 4458381a2a9aSdr146992 /* respective 'pointers'. For "action == IPFSYNC_RESYNC", resync all */ 4459381a2a9aSdr146992 /* interfaces by doing a new lookup of name to 'pointer'. For "action == */ 4460381a2a9aSdr146992 /* IPFSYNC_NEWIFP", treat ifp as the new pointer value associated with */ 4461381a2a9aSdr146992 /* "name" and for "action == IPFSYNC_OLDIFP", ifp is a pointer for which */ 4462381a2a9aSdr146992 /* there is no longer any interface associated with it. */ 4463381a2a9aSdr146992 /* ------------------------------------------------------------------------ */ 4464f4b3ec61Sdh155122 void fr_natifpsync(action, ifp, name, ifs) 4465381a2a9aSdr146992 int action; 4466381a2a9aSdr146992 void *ifp; 4467381a2a9aSdr146992 char *name; 4468f4b3ec61Sdh155122 ipf_stack_t *ifs; 4469381a2a9aSdr146992 { 4470381a2a9aSdr146992 #if defined(_KERNEL) && !defined(MENTAT) && defined(USE_SPL) 4471381a2a9aSdr146992 int s; 4472381a2a9aSdr146992 #endif 4473381a2a9aSdr146992 nat_t *nat; 4474381a2a9aSdr146992 ipnat_t *n; 4475381a2a9aSdr146992 4476f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) 4477381a2a9aSdr146992 return; 4478381a2a9aSdr146992 4479381a2a9aSdr146992 SPL_NET(s); 4480f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 4481381a2a9aSdr146992 4482f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) { 4483f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4484381a2a9aSdr146992 return; 4485381a2a9aSdr146992 } 4486381a2a9aSdr146992 4487381a2a9aSdr146992 switch (action) 4488381a2a9aSdr146992 { 4489381a2a9aSdr146992 case IPFSYNC_RESYNC : 4490f4b3ec61Sdh155122 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4491381a2a9aSdr146992 if ((ifp == nat->nat_ifps[0]) || 4492381a2a9aSdr146992 (nat->nat_ifps[0] == (void *)-1)) { 4493381a2a9aSdr146992 nat->nat_ifps[0] = 4494f4b3ec61Sdh155122 fr_resolvenic(nat->nat_ifnames[0], 4, ifs); 4495381a2a9aSdr146992 } 4496381a2a9aSdr146992 4497381a2a9aSdr146992 if ((ifp == nat->nat_ifps[1]) || 4498381a2a9aSdr146992 (nat->nat_ifps[1] == (void *)-1)) { 4499381a2a9aSdr146992 nat->nat_ifps[1] = 4500f4b3ec61Sdh155122 fr_resolvenic(nat->nat_ifnames[1], 4, ifs); 4501381a2a9aSdr146992 } 4502ab25eeb5Syz155240 } 4503ab25eeb5Syz155240 4504f4b3ec61Sdh155122 for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) { 4505381a2a9aSdr146992 if (n->in_ifps[0] == ifp || 4506381a2a9aSdr146992 n->in_ifps[0] == (void *)-1) { 4507381a2a9aSdr146992 n->in_ifps[0] = 4508f4b3ec61Sdh155122 fr_resolvenic(n->in_ifnames[0], 4, ifs); 4509381a2a9aSdr146992 } 4510381a2a9aSdr146992 if (n->in_ifps[1] == ifp || 4511381a2a9aSdr146992 n->in_ifps[1] == (void *)-1) { 4512381a2a9aSdr146992 n->in_ifps[1] = 4513f4b3ec61Sdh155122 fr_resolvenic(n->in_ifnames[1], 4, ifs); 4514381a2a9aSdr146992 } 4515381a2a9aSdr146992 } 4516381a2a9aSdr146992 break; 4517381a2a9aSdr146992 case IPFSYNC_NEWIFP : 4518f4b3ec61Sdh155122 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4519381a2a9aSdr146992 if (!strncmp(name, nat->nat_ifnames[0], 4520381a2a9aSdr146992 sizeof(nat->nat_ifnames[0]))) 4521381a2a9aSdr146992 nat->nat_ifps[0] = ifp; 4522381a2a9aSdr146992 if (!strncmp(name, nat->nat_ifnames[1], 4523381a2a9aSdr146992 sizeof(nat->nat_ifnames[1]))) 4524381a2a9aSdr146992 nat->nat_ifps[1] = ifp; 4525381a2a9aSdr146992 } 4526f4b3ec61Sdh155122 for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) { 4527381a2a9aSdr146992 if (!strncmp(name, n->in_ifnames[0], 4528381a2a9aSdr146992 sizeof(n->in_ifnames[0]))) 4529381a2a9aSdr146992 n->in_ifps[0] = ifp; 4530381a2a9aSdr146992 if (!strncmp(name, n->in_ifnames[1], 4531381a2a9aSdr146992 sizeof(n->in_ifnames[1]))) 4532381a2a9aSdr146992 n->in_ifps[1] = ifp; 4533381a2a9aSdr146992 } 4534381a2a9aSdr146992 break; 4535381a2a9aSdr146992 case IPFSYNC_OLDIFP : 4536f4b3ec61Sdh155122 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4537381a2a9aSdr146992 if (ifp == nat->nat_ifps[0]) 4538381a2a9aSdr146992 nat->nat_ifps[0] = (void *)-1; 4539381a2a9aSdr146992 if (ifp == nat->nat_ifps[1]) 4540381a2a9aSdr146992 nat->nat_ifps[1] = (void *)-1; 4541381a2a9aSdr146992 } 4542f4b3ec61Sdh155122 for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) { 4543381a2a9aSdr146992 if (n->in_ifps[0] == ifp) 4544381a2a9aSdr146992 n->in_ifps[0] = (void *)-1; 4545381a2a9aSdr146992 if (n->in_ifps[1] == ifp) 4546381a2a9aSdr146992 n->in_ifps[1] = (void *)-1; 4547381a2a9aSdr146992 } 4548381a2a9aSdr146992 break; 4549ab25eeb5Syz155240 } 4550f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4551ab25eeb5Syz155240 SPL_X(s); 4552ab25eeb5Syz155240 } 4553ab25eeb5Syz155240 4554ab25eeb5Syz155240 4555ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4556ab25eeb5Syz155240 /* Function: nat_icmpquerytype4 */ 4557ab25eeb5Syz155240 /* Returns: int - 1 == success, 0 == failure */ 4558ab25eeb5Syz155240 /* Parameters: icmptype(I) - ICMP type number */ 4559ab25eeb5Syz155240 /* */ 4560ab25eeb5Syz155240 /* Tests to see if the ICMP type number passed is a query/response type or */ 4561ab25eeb5Syz155240 /* not. */ 4562ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4563ab25eeb5Syz155240 static INLINE int nat_icmpquerytype4(icmptype) 4564ab25eeb5Syz155240 int icmptype; 4565ab25eeb5Syz155240 { 4566ab25eeb5Syz155240 4567ab25eeb5Syz155240 /* 4568ab25eeb5Syz155240 * For the ICMP query NAT code, it is essential that both the query 4569ab25eeb5Syz155240 * and the reply match on the NAT rule. Because the NAT structure 4570ab25eeb5Syz155240 * does not keep track of the icmptype, and a single NAT structure 4571ab25eeb5Syz155240 * is used for all icmp types with the same src, dest and id, we 4572ab25eeb5Syz155240 * simply define the replies as queries as well. The funny thing is, 4573ab25eeb5Syz155240 * altough it seems silly to call a reply a query, this is exactly 4574ab25eeb5Syz155240 * as it is defined in the IPv4 specification 4575ab25eeb5Syz155240 */ 4576ab25eeb5Syz155240 4577ab25eeb5Syz155240 switch (icmptype) 4578ab25eeb5Syz155240 { 4579ab25eeb5Syz155240 4580ab25eeb5Syz155240 case ICMP_ECHOREPLY: 4581ab25eeb5Syz155240 case ICMP_ECHO: 4582ab25eeb5Syz155240 /* route aedvertisement/solliciation is currently unsupported: */ 4583ab25eeb5Syz155240 /* it would require rewriting the ICMP data section */ 4584ab25eeb5Syz155240 case ICMP_TSTAMP: 4585ab25eeb5Syz155240 case ICMP_TSTAMPREPLY: 4586ab25eeb5Syz155240 case ICMP_IREQ: 4587ab25eeb5Syz155240 case ICMP_IREQREPLY: 4588ab25eeb5Syz155240 case ICMP_MASKREQ: 4589ab25eeb5Syz155240 case ICMP_MASKREPLY: 4590ab25eeb5Syz155240 return 1; 4591ab25eeb5Syz155240 default: 4592ab25eeb5Syz155240 return 0; 4593ab25eeb5Syz155240 } 4594ab25eeb5Syz155240 } 4595ab25eeb5Syz155240 4596ab25eeb5Syz155240 4597ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4598ab25eeb5Syz155240 /* Function: nat_log */ 4599ab25eeb5Syz155240 /* Returns: Nil */ 4600ab25eeb5Syz155240 /* Parameters: nat(I) - pointer to NAT structure */ 4601ab25eeb5Syz155240 /* type(I) - type of log entry to create */ 4602ab25eeb5Syz155240 /* */ 4603ab25eeb5Syz155240 /* Creates a NAT log entry. */ 4604ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4605f4b3ec61Sdh155122 void nat_log(nat, type, ifs) 4606ab25eeb5Syz155240 struct nat *nat; 4607ab25eeb5Syz155240 u_int type; 4608f4b3ec61Sdh155122 ipf_stack_t *ifs; 4609ab25eeb5Syz155240 { 4610ab25eeb5Syz155240 #ifdef IPFILTER_LOG 4611ab25eeb5Syz155240 # ifndef LARGE_NAT 4612ab25eeb5Syz155240 struct ipnat *np; 4613ab25eeb5Syz155240 int rulen; 4614ab25eeb5Syz155240 # endif 4615ab25eeb5Syz155240 struct natlog natl; 4616ab25eeb5Syz155240 void *items[1]; 4617ab25eeb5Syz155240 size_t sizes[1]; 4618ab25eeb5Syz155240 int types[1]; 4619ab25eeb5Syz155240 4620ab25eeb5Syz155240 natl.nl_inip = nat->nat_inip; 4621ab25eeb5Syz155240 natl.nl_outip = nat->nat_outip; 4622ab25eeb5Syz155240 natl.nl_origip = nat->nat_oip; 4623ab25eeb5Syz155240 natl.nl_bytes[0] = nat->nat_bytes[0]; 4624ab25eeb5Syz155240 natl.nl_bytes[1] = nat->nat_bytes[1]; 4625ab25eeb5Syz155240 natl.nl_pkts[0] = nat->nat_pkts[0]; 4626ab25eeb5Syz155240 natl.nl_pkts[1] = nat->nat_pkts[1]; 4627ab25eeb5Syz155240 natl.nl_origport = nat->nat_oport; 4628ab25eeb5Syz155240 natl.nl_inport = nat->nat_inport; 4629ab25eeb5Syz155240 natl.nl_outport = nat->nat_outport; 4630ab25eeb5Syz155240 natl.nl_p = nat->nat_p; 4631ab25eeb5Syz155240 natl.nl_type = type; 4632ab25eeb5Syz155240 natl.nl_rule = -1; 4633ab25eeb5Syz155240 # ifndef LARGE_NAT 4634ab25eeb5Syz155240 if (nat->nat_ptr != NULL) { 4635f4b3ec61Sdh155122 for (rulen = 0, np = ifs->ifs_nat_list; np; 4636f4b3ec61Sdh155122 np = np->in_next, rulen++) 4637ab25eeb5Syz155240 if (np == nat->nat_ptr) { 4638ab25eeb5Syz155240 natl.nl_rule = rulen; 4639ab25eeb5Syz155240 break; 4640ab25eeb5Syz155240 } 4641ab25eeb5Syz155240 } 4642ab25eeb5Syz155240 # endif 4643ab25eeb5Syz155240 items[0] = &natl; 4644ab25eeb5Syz155240 sizes[0] = sizeof(natl); 4645ab25eeb5Syz155240 types[0] = 0; 4646ab25eeb5Syz155240 4647f4b3ec61Sdh155122 (void) ipllog(IPL_LOGNAT, NULL, items, sizes, types, 1, ifs); 4648ab25eeb5Syz155240 #endif 4649ab25eeb5Syz155240 } 4650ab25eeb5Syz155240 4651ab25eeb5Syz155240 4652ab25eeb5Syz155240 #if defined(__OpenBSD__) 4653ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4654ab25eeb5Syz155240 /* Function: nat_ifdetach */ 4655ab25eeb5Syz155240 /* Returns: Nil */ 4656ab25eeb5Syz155240 /* Parameters: ifp(I) - pointer to network interface */ 4657ab25eeb5Syz155240 /* */ 4658ab25eeb5Syz155240 /* Compatibility interface for OpenBSD to trigger the correct updating of */ 4659ab25eeb5Syz155240 /* interface references within IPFilter. */ 4660ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4661f4b3ec61Sdh155122 void nat_ifdetach(ifp, ifs) 4662ab25eeb5Syz155240 void *ifp; 4663f4b3ec61Sdh155122 ipf_stack_t *ifs; 4664ab25eeb5Syz155240 { 4665f4b3ec61Sdh155122 frsync(ifp, ifs); 4666ab25eeb5Syz155240 return; 4667ab25eeb5Syz155240 } 4668ab25eeb5Syz155240 #endif 4669ab25eeb5Syz155240 4670ab25eeb5Syz155240 4671ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4672f4b3ec61Sdh155122 /* Function: fr_ipnatderef */ 4673f4b3ec61Sdh155122 /* Returns: Nil */ 4674f4b3ec61Sdh155122 /* Parameters: isp(I) - pointer to pointer to NAT rule */ 4675f4b3ec61Sdh155122 /* Write Locks: ipf_nat */ 4676f4b3ec61Sdh155122 /* */ 4677f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 4678f4b3ec61Sdh155122 void fr_ipnatderef(inp, ifs) 4679f4b3ec61Sdh155122 ipnat_t **inp; 4680f4b3ec61Sdh155122 ipf_stack_t *ifs; 4681f4b3ec61Sdh155122 { 4682f4b3ec61Sdh155122 ipnat_t *in; 4683f4b3ec61Sdh155122 4684f4b3ec61Sdh155122 in = *inp; 4685f4b3ec61Sdh155122 *inp = NULL; 4686f4b3ec61Sdh155122 in->in_space++; 4687f4b3ec61Sdh155122 in->in_use--; 4688f4b3ec61Sdh155122 if (in->in_use == 0 && (in->in_flags & IPN_DELETE)) { 4689f4b3ec61Sdh155122 if (in->in_apr) 4690f4b3ec61Sdh155122 appr_free(in->in_apr); 4691f4b3ec61Sdh155122 KFREE(in); 4692f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules--; 4693f4b3ec61Sdh155122 #ifdef notdef 4694f4b3ec61Sdh155122 #if SOLARIS 4695f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_rules == 0) 4696f4b3ec61Sdh155122 ifs->ifs_pfil_delayed_copy = 1; 4697f4b3ec61Sdh155122 #endif 4698f4b3ec61Sdh155122 #endif 4699f4b3ec61Sdh155122 } 4700f4b3ec61Sdh155122 } 4701f4b3ec61Sdh155122 4702f4b3ec61Sdh155122 4703f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 4704ab25eeb5Syz155240 /* Function: fr_natderef */ 4705ab25eeb5Syz155240 /* Returns: Nil */ 4706ab25eeb5Syz155240 /* Parameters: isp(I) - pointer to pointer to NAT table entry */ 4707ab25eeb5Syz155240 /* */ 4708ab25eeb5Syz155240 /* Decrement the reference counter for this NAT table entry and free it if */ 4709ab25eeb5Syz155240 /* there are no more things using it. */ 4710ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4711f4b3ec61Sdh155122 void fr_natderef(natp, ifs) 4712ab25eeb5Syz155240 nat_t **natp; 4713f4b3ec61Sdh155122 ipf_stack_t *ifs; 4714ab25eeb5Syz155240 { 4715ab25eeb5Syz155240 nat_t *nat; 4716ab25eeb5Syz155240 4717ab25eeb5Syz155240 nat = *natp; 4718ab25eeb5Syz155240 *natp = NULL; 4719f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 4720ab25eeb5Syz155240 nat->nat_ref--; 4721ab25eeb5Syz155240 if (nat->nat_ref == 0) 4722f4b3ec61Sdh155122 nat_delete(nat, NL_EXPIRE, ifs); 4723f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4724ab25eeb5Syz155240 } 4725ab25eeb5Syz155240 4726ab25eeb5Syz155240 4727ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4728ab25eeb5Syz155240 /* Function: fr_natclone */ 4729ab25eeb5Syz155240 /* Returns: ipstate_t* - NULL == cloning failed, */ 4730ab25eeb5Syz155240 /* else pointer to new state structure */ 4731ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 4732ab25eeb5Syz155240 /* is(I) - pointer to master state structure */ 4733ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 4734ab25eeb5Syz155240 /* */ 4735ab25eeb5Syz155240 /* Create a "duplcate" state table entry from the master. */ 4736ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4737ab25eeb5Syz155240 static nat_t *fr_natclone(fin, nat) 4738ab25eeb5Syz155240 fr_info_t *fin; 4739ab25eeb5Syz155240 nat_t *nat; 4740ab25eeb5Syz155240 { 4741ab25eeb5Syz155240 frentry_t *fr; 4742ab25eeb5Syz155240 nat_t *clone; 4743ab25eeb5Syz155240 ipnat_t *np; 4744f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 4745ab25eeb5Syz155240 4746ab25eeb5Syz155240 KMALLOC(clone, nat_t *); 4747ab25eeb5Syz155240 if (clone == NULL) 4748ab25eeb5Syz155240 return NULL; 4749ab25eeb5Syz155240 bcopy((char *)nat, (char *)clone, sizeof(*clone)); 4750ab25eeb5Syz155240 4751ab25eeb5Syz155240 MUTEX_NUKE(&clone->nat_lock); 4752ab25eeb5Syz155240 4753ab25eeb5Syz155240 clone->nat_aps = NULL; 4754ab25eeb5Syz155240 /* 4755ab25eeb5Syz155240 * Initialize all these so that nat_delete() doesn't cause a crash. 4756ab25eeb5Syz155240 */ 4757ab25eeb5Syz155240 clone->nat_tqe.tqe_pnext = NULL; 4758ab25eeb5Syz155240 clone->nat_tqe.tqe_next = NULL; 4759ab25eeb5Syz155240 clone->nat_tqe.tqe_ifq = NULL; 4760ab25eeb5Syz155240 clone->nat_tqe.tqe_parent = clone; 4761ab25eeb5Syz155240 4762ab25eeb5Syz155240 clone->nat_flags &= ~SI_CLONE; 4763ab25eeb5Syz155240 clone->nat_flags |= SI_CLONED; 4764ab25eeb5Syz155240 4765ab25eeb5Syz155240 if (clone->nat_hm) 4766ab25eeb5Syz155240 clone->nat_hm->hm_ref++; 4767ab25eeb5Syz155240 4768f4b3ec61Sdh155122 if (nat_insert(clone, fin->fin_rev, ifs) == -1) { 4769ab25eeb5Syz155240 KFREE(clone); 4770ab25eeb5Syz155240 return NULL; 4771ab25eeb5Syz155240 } 4772ab25eeb5Syz155240 np = clone->nat_ptr; 4773ab25eeb5Syz155240 if (np != NULL) { 4774f4b3ec61Sdh155122 if (ifs->ifs_nat_logging) 4775f4b3ec61Sdh155122 nat_log(clone, (u_int)np->in_redir, ifs); 4776ab25eeb5Syz155240 np->in_use++; 4777ab25eeb5Syz155240 } 4778ab25eeb5Syz155240 fr = clone->nat_fr; 4779ab25eeb5Syz155240 if (fr != NULL) { 4780ab25eeb5Syz155240 MUTEX_ENTER(&fr->fr_lock); 4781ab25eeb5Syz155240 fr->fr_ref++; 4782ab25eeb5Syz155240 MUTEX_EXIT(&fr->fr_lock); 4783ab25eeb5Syz155240 } 4784ab25eeb5Syz155240 4785ab25eeb5Syz155240 /* 4786ab25eeb5Syz155240 * Because the clone is created outside the normal loop of things and 4787ab25eeb5Syz155240 * TCP has special needs in terms of state, initialise the timeout 4788ab25eeb5Syz155240 * state of the new NAT from here. 4789ab25eeb5Syz155240 */ 4790ab25eeb5Syz155240 if (clone->nat_p == IPPROTO_TCP) { 4791f4b3ec61Sdh155122 (void) fr_tcp_age(&clone->nat_tqe, fin, ifs->ifs_nat_tqb, 4792ab25eeb5Syz155240 clone->nat_flags); 4793ab25eeb5Syz155240 } 4794ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 4795ab25eeb5Syz155240 clone->nat_sync = ipfsync_new(SMC_NAT, fin, clone); 4796ab25eeb5Syz155240 #endif 4797f4b3ec61Sdh155122 if (ifs->ifs_nat_logging) 4798f4b3ec61Sdh155122 nat_log(clone, NL_CLONE, ifs); 4799ab25eeb5Syz155240 return clone; 4800ab25eeb5Syz155240 } 4801ab25eeb5Syz155240 4802ab25eeb5Syz155240 4803ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4804ab25eeb5Syz155240 /* Function: nat_wildok */ 4805ab25eeb5Syz155240 /* Returns: int - 1 == packet's ports match wildcards */ 4806ab25eeb5Syz155240 /* 0 == packet's ports don't match wildcards */ 4807ab25eeb5Syz155240 /* Parameters: nat(I) - NAT entry */ 4808ab25eeb5Syz155240 /* sport(I) - source port */ 4809ab25eeb5Syz155240 /* dport(I) - destination port */ 4810ab25eeb5Syz155240 /* flags(I) - wildcard flags */ 4811ab25eeb5Syz155240 /* dir(I) - packet direction */ 4812ab25eeb5Syz155240 /* */ 4813ab25eeb5Syz155240 /* Use NAT entry and packet direction to determine which combination of */ 4814ab25eeb5Syz155240 /* wildcard flags should be used. */ 4815ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4816ab25eeb5Syz155240 static INLINE int nat_wildok(nat, sport, dport, flags, dir) 4817ab25eeb5Syz155240 nat_t *nat; 4818ab25eeb5Syz155240 int sport; 4819ab25eeb5Syz155240 int dport; 4820ab25eeb5Syz155240 int flags; 4821ab25eeb5Syz155240 int dir; 4822ab25eeb5Syz155240 { 4823ab25eeb5Syz155240 /* 4824ab25eeb5Syz155240 * When called by dir is set to 4825ab25eeb5Syz155240 * nat_inlookup NAT_INBOUND (0) 4826ab25eeb5Syz155240 * nat_outlookup NAT_OUTBOUND (1) 4827ab25eeb5Syz155240 * 4828ab25eeb5Syz155240 * We simply combine the packet's direction in dir with the original 4829ab25eeb5Syz155240 * "intended" direction of that NAT entry in nat->nat_dir to decide 4830ab25eeb5Syz155240 * which combination of wildcard flags to allow. 4831ab25eeb5Syz155240 */ 4832ab25eeb5Syz155240 4833ab25eeb5Syz155240 switch ((dir << 1) | nat->nat_dir) 4834ab25eeb5Syz155240 { 4835ab25eeb5Syz155240 case 3: /* outbound packet / outbound entry */ 4836ab25eeb5Syz155240 if (((nat->nat_inport == sport) || 4837ab25eeb5Syz155240 (flags & SI_W_SPORT)) && 4838ab25eeb5Syz155240 ((nat->nat_oport == dport) || 4839ab25eeb5Syz155240 (flags & SI_W_DPORT))) 4840ab25eeb5Syz155240 return 1; 4841ab25eeb5Syz155240 break; 4842ab25eeb5Syz155240 case 2: /* outbound packet / inbound entry */ 4843ab25eeb5Syz155240 if (((nat->nat_outport == sport) || 4844ab25eeb5Syz155240 (flags & SI_W_DPORT)) && 4845ab25eeb5Syz155240 ((nat->nat_oport == dport) || 4846ab25eeb5Syz155240 (flags & SI_W_SPORT))) 4847ab25eeb5Syz155240 return 1; 4848ab25eeb5Syz155240 break; 4849ab25eeb5Syz155240 case 1: /* inbound packet / outbound entry */ 4850ab25eeb5Syz155240 if (((nat->nat_oport == sport) || 4851ab25eeb5Syz155240 (flags & SI_W_DPORT)) && 4852ab25eeb5Syz155240 ((nat->nat_outport == dport) || 4853ab25eeb5Syz155240 (flags & SI_W_SPORT))) 4854ab25eeb5Syz155240 return 1; 4855ab25eeb5Syz155240 break; 4856ab25eeb5Syz155240 case 0: /* inbound packet / inbound entry */ 4857ab25eeb5Syz155240 if (((nat->nat_oport == sport) || 4858ab25eeb5Syz155240 (flags & SI_W_SPORT)) && 4859ab25eeb5Syz155240 ((nat->nat_outport == dport) || 4860ab25eeb5Syz155240 (flags & SI_W_DPORT))) 4861ab25eeb5Syz155240 return 1; 4862ab25eeb5Syz155240 break; 4863ab25eeb5Syz155240 default: 4864ab25eeb5Syz155240 break; 4865ab25eeb5Syz155240 } 4866ab25eeb5Syz155240 4867ab25eeb5Syz155240 return(0); 4868ab25eeb5Syz155240 } 4869ab25eeb5Syz155240 4870ab25eeb5Syz155240 4871ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4872ab25eeb5Syz155240 /* Function: nat_mssclamp */ 4873ab25eeb5Syz155240 /* Returns: Nil */ 4874ab25eeb5Syz155240 /* Parameters: tcp(I) - pointer to TCP header */ 4875ab25eeb5Syz155240 /* maxmss(I) - value to clamp the TCP MSS to */ 4876ab25eeb5Syz155240 /* csump(I) - pointer to TCP checksum */ 4877ab25eeb5Syz155240 /* */ 4878ab25eeb5Syz155240 /* Check for MSS option and clamp it if necessary. If found and changed, */ 4879ab25eeb5Syz155240 /* then the TCP header checksum will be updated to reflect the change in */ 4880ab25eeb5Syz155240 /* the MSS. */ 4881ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4882381a2a9aSdr146992 static void nat_mssclamp(tcp, maxmss, csump) 4883ab25eeb5Syz155240 tcphdr_t *tcp; 4884ab25eeb5Syz155240 u_32_t maxmss; 4885ab25eeb5Syz155240 u_short *csump; 4886ab25eeb5Syz155240 { 4887ab25eeb5Syz155240 u_char *cp, *ep, opt; 4888ab25eeb5Syz155240 int hlen, advance; 4889ab25eeb5Syz155240 u_32_t mss, sumd; 4890ab25eeb5Syz155240 4891ab25eeb5Syz155240 hlen = TCP_OFF(tcp) << 2; 4892ab25eeb5Syz155240 if (hlen > sizeof(*tcp)) { 4893ab25eeb5Syz155240 cp = (u_char *)tcp + sizeof(*tcp); 4894ab25eeb5Syz155240 ep = (u_char *)tcp + hlen; 4895ab25eeb5Syz155240 4896ab25eeb5Syz155240 while (cp < ep) { 4897ab25eeb5Syz155240 opt = cp[0]; 4898ab25eeb5Syz155240 if (opt == TCPOPT_EOL) 4899ab25eeb5Syz155240 break; 4900ab25eeb5Syz155240 else if (opt == TCPOPT_NOP) { 4901ab25eeb5Syz155240 cp++; 4902ab25eeb5Syz155240 continue; 4903ab25eeb5Syz155240 } 4904ab25eeb5Syz155240 4905ab25eeb5Syz155240 if (cp + 1 >= ep) 4906ab25eeb5Syz155240 break; 4907ab25eeb5Syz155240 advance = cp[1]; 4908ab25eeb5Syz155240 if ((cp + advance > ep) || (advance <= 0)) 4909ab25eeb5Syz155240 break; 4910ab25eeb5Syz155240 switch (opt) 4911ab25eeb5Syz155240 { 4912ab25eeb5Syz155240 case TCPOPT_MAXSEG: 4913ab25eeb5Syz155240 if (advance != 4) 4914ab25eeb5Syz155240 break; 4915ab25eeb5Syz155240 mss = cp[2] * 256 + cp[3]; 4916ab25eeb5Syz155240 if (mss > maxmss) { 4917ab25eeb5Syz155240 cp[2] = maxmss / 256; 4918ab25eeb5Syz155240 cp[3] = maxmss & 0xff; 4919ab25eeb5Syz155240 CALC_SUMD(mss, maxmss, sumd); 4920381a2a9aSdr146992 fix_outcksum(csump, sumd); 4921ab25eeb5Syz155240 } 4922ab25eeb5Syz155240 break; 4923ab25eeb5Syz155240 default: 4924ab25eeb5Syz155240 /* ignore unknown options */ 4925ab25eeb5Syz155240 break; 4926ab25eeb5Syz155240 } 4927ab25eeb5Syz155240 4928ab25eeb5Syz155240 cp += advance; 4929ab25eeb5Syz155240 } 4930ab25eeb5Syz155240 } 4931ab25eeb5Syz155240 } 4932ab25eeb5Syz155240 4933ab25eeb5Syz155240 4934ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4935ab25eeb5Syz155240 /* Function: fr_setnatqueue */ 4936ab25eeb5Syz155240 /* Returns: Nil */ 4937ab25eeb5Syz155240 /* Parameters: nat(I)- pointer to NAT structure */ 4938ab25eeb5Syz155240 /* rev(I) - forward(0) or reverse(1) direction */ 4939ab25eeb5Syz155240 /* Locks: ipf_nat (read or write) */ 4940ab25eeb5Syz155240 /* */ 4941ab25eeb5Syz155240 /* Put the NAT entry on its default queue entry, using rev as a helped in */ 4942ab25eeb5Syz155240 /* determining which queue it should be placed on. */ 4943ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4944f4b3ec61Sdh155122 void fr_setnatqueue(nat, rev, ifs) 4945ab25eeb5Syz155240 nat_t *nat; 4946ab25eeb5Syz155240 int rev; 4947f4b3ec61Sdh155122 ipf_stack_t *ifs; 4948ab25eeb5Syz155240 { 4949ab25eeb5Syz155240 ipftq_t *oifq, *nifq; 4950ab25eeb5Syz155240 4951ab25eeb5Syz155240 if (nat->nat_ptr != NULL) 4952ab25eeb5Syz155240 nifq = nat->nat_ptr->in_tqehead[rev]; 4953ab25eeb5Syz155240 else 4954ab25eeb5Syz155240 nifq = NULL; 4955ab25eeb5Syz155240 4956ab25eeb5Syz155240 if (nifq == NULL) { 4957ab25eeb5Syz155240 switch (nat->nat_p) 4958ab25eeb5Syz155240 { 4959ab25eeb5Syz155240 case IPPROTO_UDP : 4960f4b3ec61Sdh155122 nifq = &ifs->ifs_nat_udptq; 4961ab25eeb5Syz155240 break; 4962ab25eeb5Syz155240 case IPPROTO_ICMP : 4963f4b3ec61Sdh155122 nifq = &ifs->ifs_nat_icmptq; 4964ab25eeb5Syz155240 break; 4965ab25eeb5Syz155240 case IPPROTO_TCP : 4966f4b3ec61Sdh155122 nifq = ifs->ifs_nat_tqb + nat->nat_tqe.tqe_state[rev]; 4967ab25eeb5Syz155240 break; 4968ab25eeb5Syz155240 default : 4969f4b3ec61Sdh155122 nifq = &ifs->ifs_nat_iptq; 4970ab25eeb5Syz155240 break; 4971ab25eeb5Syz155240 } 4972ab25eeb5Syz155240 } 4973ab25eeb5Syz155240 4974ab25eeb5Syz155240 oifq = nat->nat_tqe.tqe_ifq; 4975ab25eeb5Syz155240 /* 4976ab25eeb5Syz155240 * If it's currently on a timeout queue, move it from one queue to 4977ab25eeb5Syz155240 * another, else put it on the end of the newly determined queue. 4978ab25eeb5Syz155240 */ 4979ab25eeb5Syz155240 if (oifq != NULL) 4980f4b3ec61Sdh155122 fr_movequeue(&nat->nat_tqe, oifq, nifq, ifs); 4981ab25eeb5Syz155240 else 4982f4b3ec61Sdh155122 fr_queueappend(&nat->nat_tqe, nifq, nat, ifs); 4983ab25eeb5Syz155240 return; 4984ab25eeb5Syz155240 } 4985f4b3ec61Sdh155122 4986f4b3ec61Sdh155122 /* Function: nat_getnext */ 4987f4b3ec61Sdh155122 /* Returns: int - 0 == ok, else error */ 4988f4b3ec61Sdh155122 /* Parameters: t(I) - pointer to ipftoken structure */ 4989f4b3ec61Sdh155122 /* itp(I) - pointer to ipfgeniter_t structure */ 4990f4b3ec61Sdh155122 /* */ 4991f4b3ec61Sdh155122 /* Fetch the next nat/ipnat structure pointer from the linked list and */ 4992f4b3ec61Sdh155122 /* copy it out to the storage space pointed to by itp_data. The next item */ 4993f4b3ec61Sdh155122 /* in the list to look at is put back in the ipftoken struture. */ 4994f4b3ec61Sdh155122 /* If we call ipf_freetoken, the accompanying pointer is set to NULL because*/ 4995f4b3ec61Sdh155122 /* ipf_freetoken will call a deref function for us and we dont want to call */ 4996f4b3ec61Sdh155122 /* that twice (second time would be in the second switch statement below. */ 4997f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 4998f4b3ec61Sdh155122 static int nat_getnext(t, itp, ifs) 4999f4b3ec61Sdh155122 ipftoken_t *t; 5000f4b3ec61Sdh155122 ipfgeniter_t *itp; 5001f4b3ec61Sdh155122 ipf_stack_t *ifs; 5002f4b3ec61Sdh155122 { 5003f4b3ec61Sdh155122 hostmap_t *hm, *nexthm = NULL, zerohm; 5004f4b3ec61Sdh155122 ipnat_t *ipn, *nextipnat = NULL, zeroipn; 5005f4b3ec61Sdh155122 nat_t *nat, *nextnat = NULL, zeronat; 5006f4b3ec61Sdh155122 int error = 0; 5007f4b3ec61Sdh155122 5008f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 5009f4b3ec61Sdh155122 switch (itp->igi_type) 5010f4b3ec61Sdh155122 { 5011f4b3ec61Sdh155122 case IPFGENITER_HOSTMAP : 5012f4b3ec61Sdh155122 hm = t->ipt_data; 5013f4b3ec61Sdh155122 if (hm == NULL) { 5014f4b3ec61Sdh155122 nexthm = ifs->ifs_ipf_hm_maplist; 5015f4b3ec61Sdh155122 } else { 5016f4b3ec61Sdh155122 nexthm = hm->hm_hnext; 5017f4b3ec61Sdh155122 } 5018f4b3ec61Sdh155122 if (nexthm != NULL) { 5019f4b3ec61Sdh155122 if (nexthm->hm_hnext == NULL) { 5020f4b3ec61Sdh155122 t->ipt_alive = 0; 5021966f126dSzf203873 ipf_unlinktoken(t, ifs); 5022966f126dSzf203873 KFREE(t); 5023f4b3ec61Sdh155122 } else { 5024f4b3ec61Sdh155122 /*MUTEX_ENTER(&nexthm->hm_lock);*/ 5025f4b3ec61Sdh155122 nexthm->hm_ref++; 5026f4b3ec61Sdh155122 /*MUTEX_EXIT(&nextipnat->hm_lock);*/ 5027f4b3ec61Sdh155122 } 5028f4b3ec61Sdh155122 5029f4b3ec61Sdh155122 } else { 5030f4b3ec61Sdh155122 bzero(&zerohm, sizeof(zerohm)); 5031f4b3ec61Sdh155122 nexthm = &zerohm; 5032966f126dSzf203873 ipf_freetoken(t, ifs); 5033f4b3ec61Sdh155122 } 5034f4b3ec61Sdh155122 break; 5035f4b3ec61Sdh155122 5036f4b3ec61Sdh155122 case IPFGENITER_IPNAT : 5037f4b3ec61Sdh155122 ipn = t->ipt_data; 5038f4b3ec61Sdh155122 if (ipn == NULL) { 5039f4b3ec61Sdh155122 nextipnat = ifs->ifs_nat_list; 5040f4b3ec61Sdh155122 } else { 5041f4b3ec61Sdh155122 nextipnat = ipn->in_next; 5042f4b3ec61Sdh155122 } 5043f4b3ec61Sdh155122 if (nextipnat != NULL) { 5044f4b3ec61Sdh155122 if (nextipnat->in_next == NULL) { 5045f4b3ec61Sdh155122 t->ipt_alive = 0; 5046966f126dSzf203873 ipf_unlinktoken(t, ifs); 5047966f126dSzf203873 KFREE(t); 5048f4b3ec61Sdh155122 } else { 5049f4b3ec61Sdh155122 /* MUTEX_ENTER(&nextipnat->in_lock); */ 5050f4b3ec61Sdh155122 nextipnat->in_use++; 5051f4b3ec61Sdh155122 /* MUTEX_EXIT(&nextipnat->in_lock); */ 5052f4b3ec61Sdh155122 } 5053f4b3ec61Sdh155122 } else { 5054f4b3ec61Sdh155122 bzero(&zeroipn, sizeof(zeroipn)); 5055f4b3ec61Sdh155122 nextipnat = &zeroipn; 5056966f126dSzf203873 ipf_freetoken(t, ifs); 5057f4b3ec61Sdh155122 } 5058f4b3ec61Sdh155122 break; 5059f4b3ec61Sdh155122 5060f4b3ec61Sdh155122 case IPFGENITER_NAT : 5061f4b3ec61Sdh155122 nat = t->ipt_data; 5062f4b3ec61Sdh155122 if (nat == NULL) { 5063f4b3ec61Sdh155122 nextnat = ifs->ifs_nat_instances; 5064f4b3ec61Sdh155122 } else { 5065f4b3ec61Sdh155122 nextnat = nat->nat_next; 5066f4b3ec61Sdh155122 } 5067f4b3ec61Sdh155122 if (nextnat != NULL) { 5068f4b3ec61Sdh155122 if (nextnat->nat_next == NULL) { 5069f4b3ec61Sdh155122 t->ipt_alive = 0; 5070966f126dSzf203873 ipf_unlinktoken(t, ifs); 5071966f126dSzf203873 KFREE(t); 5072f4b3ec61Sdh155122 } else { 5073f4b3ec61Sdh155122 MUTEX_ENTER(&nextnat->nat_lock); 5074f4b3ec61Sdh155122 nextnat->nat_ref++; 5075f4b3ec61Sdh155122 MUTEX_EXIT(&nextnat->nat_lock); 5076f4b3ec61Sdh155122 } 5077f4b3ec61Sdh155122 } else { 5078f4b3ec61Sdh155122 bzero(&zeronat, sizeof(zeronat)); 5079f4b3ec61Sdh155122 nextnat = &zeronat; 5080966f126dSzf203873 ipf_freetoken(t, ifs); 5081f4b3ec61Sdh155122 } 5082f4b3ec61Sdh155122 break; 5083f4b3ec61Sdh155122 } 5084f4b3ec61Sdh155122 5085f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 5086f4b3ec61Sdh155122 5087f4b3ec61Sdh155122 switch (itp->igi_type) 5088f4b3ec61Sdh155122 { 5089f4b3ec61Sdh155122 case IPFGENITER_HOSTMAP : 5090f4b3ec61Sdh155122 if (hm != NULL) { 5091f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 5092f4b3ec61Sdh155122 fr_hostmapderef(&hm); 5093f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 5094f4b3ec61Sdh155122 } 5095966f126dSzf203873 if (nexthm->hm_hnext != NULL) 5096f4b3ec61Sdh155122 t->ipt_data = nexthm; 5097f4b3ec61Sdh155122 error = COPYOUT(nexthm, itp->igi_data, sizeof(*nexthm)); 5098f4b3ec61Sdh155122 if (error != 0) 5099f4b3ec61Sdh155122 error = EFAULT; 5100f4b3ec61Sdh155122 break; 5101f4b3ec61Sdh155122 5102f4b3ec61Sdh155122 case IPFGENITER_IPNAT : 5103f4b3ec61Sdh155122 if (ipn != NULL) 5104f4b3ec61Sdh155122 fr_ipnatderef(&ipn, ifs); 5105966f126dSzf203873 if (nextipnat->in_next != NULL) 5106f4b3ec61Sdh155122 t->ipt_data = nextipnat; 5107f4b3ec61Sdh155122 error = COPYOUT(nextipnat, itp->igi_data, sizeof(*nextipnat)); 5108f4b3ec61Sdh155122 if (error != 0) 5109f4b3ec61Sdh155122 error = EFAULT; 5110f4b3ec61Sdh155122 break; 5111f4b3ec61Sdh155122 5112f4b3ec61Sdh155122 case IPFGENITER_NAT : 5113f4b3ec61Sdh155122 if (nat != NULL) 5114f4b3ec61Sdh155122 fr_natderef(&nat, ifs); 5115966f126dSzf203873 if (nextnat->nat_next != NULL) 5116f4b3ec61Sdh155122 t->ipt_data = nextnat; 5117f4b3ec61Sdh155122 error = COPYOUT(nextnat, itp->igi_data, sizeof(*nextnat)); 5118f4b3ec61Sdh155122 if (error != 0) 5119f4b3ec61Sdh155122 error = EFAULT; 5120f4b3ec61Sdh155122 break; 5121f4b3ec61Sdh155122 } 5122f4b3ec61Sdh155122 5123f4b3ec61Sdh155122 return error; 5124f4b3ec61Sdh155122 } 5125f4b3ec61Sdh155122 5126f4b3ec61Sdh155122 5127f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 5128f4b3ec61Sdh155122 /* Function: nat_iterator */ 5129f4b3ec61Sdh155122 /* Returns: int - 0 == ok, else error */ 5130f4b3ec61Sdh155122 /* Parameters: token(I) - pointer to ipftoken structure */ 5131f4b3ec61Sdh155122 /* itp(I) - pointer to ipfgeniter_t structure */ 5132f4b3ec61Sdh155122 /* */ 5133f4b3ec61Sdh155122 /* This function acts as a handler for the SIOCGENITER ioctls that use a */ 5134f4b3ec61Sdh155122 /* generic structure to iterate through a list. There are three different */ 5135f4b3ec61Sdh155122 /* linked lists of NAT related information to go through: NAT rules, active */ 5136f4b3ec61Sdh155122 /* NAT mappings and the NAT fragment cache. */ 5137f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 5138f4b3ec61Sdh155122 static int nat_iterator(token, itp, ifs) 5139f4b3ec61Sdh155122 ipftoken_t *token; 5140f4b3ec61Sdh155122 ipfgeniter_t *itp; 5141f4b3ec61Sdh155122 ipf_stack_t *ifs; 5142f4b3ec61Sdh155122 { 5143f4b3ec61Sdh155122 int error; 5144f4b3ec61Sdh155122 5145f4b3ec61Sdh155122 if (itp->igi_data == NULL) 5146f4b3ec61Sdh155122 return EFAULT; 5147f4b3ec61Sdh155122 5148f4b3ec61Sdh155122 token->ipt_subtype = itp->igi_type; 5149f4b3ec61Sdh155122 5150f4b3ec61Sdh155122 switch (itp->igi_type) 5151f4b3ec61Sdh155122 { 5152f4b3ec61Sdh155122 case IPFGENITER_HOSTMAP : 5153f4b3ec61Sdh155122 case IPFGENITER_IPNAT : 5154f4b3ec61Sdh155122 case IPFGENITER_NAT : 5155f4b3ec61Sdh155122 error = nat_getnext(token, itp, ifs); 5156f4b3ec61Sdh155122 break; 5157f4b3ec61Sdh155122 case IPFGENITER_NATFRAG : 5158f4b3ec61Sdh155122 error = fr_nextfrag(token, itp, &ifs->ifs_ipfr_natlist, 5159f4b3ec61Sdh155122 &ifs->ifs_ipfr_nattail, 5160f4b3ec61Sdh155122 &ifs->ifs_ipf_natfrag, ifs); 5161f4b3ec61Sdh155122 break; 5162f4b3ec61Sdh155122 default : 5163f4b3ec61Sdh155122 error = EINVAL; 5164f4b3ec61Sdh155122 break; 5165f4b3ec61Sdh155122 } 5166f4b3ec61Sdh155122 5167f4b3ec61Sdh155122 return error; 5168f4b3ec61Sdh155122 } 5169