1ab25eeb5Syz155240 /* 2*27dbc409San207044 * Copyright (C) 1995-2004 by Darren Reed. 3ab25eeb5Syz155240 * 4ab25eeb5Syz155240 * See the IPFILTER.LICENCE file for details on licencing. 5ab25eeb5Syz155240 * 68899fcfaSjojemann * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 7ab25eeb5Syz155240 * Use is subject to license terms. 8ab25eeb5Syz155240 */ 9ab25eeb5Syz155240 10dcf3e898Sjojemann #pragma ident "%Z%%M% %I% %E% SMI"$ 11ab25eeb5Syz155240 12ab25eeb5Syz155240 #if defined(KERNEL) || defined(_KERNEL) 13ab25eeb5Syz155240 # undef KERNEL 14ab25eeb5Syz155240 # undef _KERNEL 15ab25eeb5Syz155240 # define KERNEL 1 16ab25eeb5Syz155240 # define _KERNEL 1 17ab25eeb5Syz155240 #endif 18ab25eeb5Syz155240 #include <sys/errno.h> 19ab25eeb5Syz155240 #include <sys/types.h> 20ab25eeb5Syz155240 #include <sys/param.h> 21ab25eeb5Syz155240 #include <sys/time.h> 22ab25eeb5Syz155240 #include <sys/file.h> 23ab25eeb5Syz155240 #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \ 24ab25eeb5Syz155240 defined(_KERNEL) 25ab25eeb5Syz155240 # include "opt_ipfilter_log.h" 26ab25eeb5Syz155240 #endif 27ab25eeb5Syz155240 #if !defined(_KERNEL) 28ab25eeb5Syz155240 # include <stdio.h> 29ab25eeb5Syz155240 # include <string.h> 30ab25eeb5Syz155240 # include <stdlib.h> 31ab25eeb5Syz155240 # define _KERNEL 32ab25eeb5Syz155240 # ifdef __OpenBSD__ 33ab25eeb5Syz155240 struct file; 34ab25eeb5Syz155240 # endif 35ab25eeb5Syz155240 # include <sys/uio.h> 36ab25eeb5Syz155240 # undef _KERNEL 37ab25eeb5Syz155240 #endif 38ab25eeb5Syz155240 #if defined(_KERNEL) && (__FreeBSD_version >= 220000) 39ab25eeb5Syz155240 # include <sys/filio.h> 40ab25eeb5Syz155240 # include <sys/fcntl.h> 41ab25eeb5Syz155240 #else 42ab25eeb5Syz155240 # include <sys/ioctl.h> 43ab25eeb5Syz155240 #endif 44ab25eeb5Syz155240 #if !defined(AIX) 45ab25eeb5Syz155240 # include <sys/fcntl.h> 46ab25eeb5Syz155240 #endif 47ab25eeb5Syz155240 #if !defined(linux) 48ab25eeb5Syz155240 # include <sys/protosw.h> 49ab25eeb5Syz155240 #endif 50ab25eeb5Syz155240 #include <sys/socket.h> 51ab25eeb5Syz155240 #if defined(_KERNEL) 52ab25eeb5Syz155240 # include <sys/systm.h> 53ab25eeb5Syz155240 # if !defined(__SVR4) && !defined(__svr4__) 54ab25eeb5Syz155240 # include <sys/mbuf.h> 55ab25eeb5Syz155240 # endif 56ab25eeb5Syz155240 #endif 57ab25eeb5Syz155240 #if defined(__SVR4) || defined(__svr4__) 58ab25eeb5Syz155240 # include <sys/filio.h> 59ab25eeb5Syz155240 # include <sys/byteorder.h> 60ab25eeb5Syz155240 # ifdef _KERNEL 61ab25eeb5Syz155240 # include <sys/dditypes.h> 62ab25eeb5Syz155240 # endif 63ab25eeb5Syz155240 # include <sys/stream.h> 64ab25eeb5Syz155240 # include <sys/kmem.h> 65ab25eeb5Syz155240 #endif 66ab25eeb5Syz155240 #if __FreeBSD_version >= 300000 67ab25eeb5Syz155240 # include <sys/queue.h> 68ab25eeb5Syz155240 #endif 69ab25eeb5Syz155240 #include <net/if.h> 70ab25eeb5Syz155240 #if __FreeBSD_version >= 300000 71ab25eeb5Syz155240 # include <net/if_var.h> 72ab25eeb5Syz155240 # if defined(_KERNEL) && !defined(IPFILTER_LKM) 73ab25eeb5Syz155240 # include "opt_ipfilter.h" 74ab25eeb5Syz155240 # endif 75ab25eeb5Syz155240 #endif 76ab25eeb5Syz155240 #ifdef sun 77ab25eeb5Syz155240 # include <net/af.h> 78ab25eeb5Syz155240 #endif 79ab25eeb5Syz155240 #include <net/route.h> 80ab25eeb5Syz155240 #include <netinet/in.h> 81ab25eeb5Syz155240 #include <netinet/in_systm.h> 82ab25eeb5Syz155240 #include <netinet/ip.h> 83ab25eeb5Syz155240 84ab25eeb5Syz155240 #ifdef RFC1825 85ab25eeb5Syz155240 # include <vpn/md5.h> 86ab25eeb5Syz155240 # include <vpn/ipsec.h> 87ab25eeb5Syz155240 extern struct ifnet vpnif; 88ab25eeb5Syz155240 #endif 89ab25eeb5Syz155240 90ab25eeb5Syz155240 #if !defined(linux) 91ab25eeb5Syz155240 # include <netinet/ip_var.h> 92ab25eeb5Syz155240 #endif 93ab25eeb5Syz155240 #include <netinet/tcp.h> 94ab25eeb5Syz155240 #include <netinet/udp.h> 95ab25eeb5Syz155240 #include <netinet/ip_icmp.h> 96ab25eeb5Syz155240 #include "netinet/ip_compat.h" 97ab25eeb5Syz155240 #include <netinet/tcpip.h> 98ab25eeb5Syz155240 #include "netinet/ip_fil.h" 99ab25eeb5Syz155240 #include "netinet/ip_nat.h" 100ab25eeb5Syz155240 #include "netinet/ip_frag.h" 101ab25eeb5Syz155240 #include "netinet/ip_state.h" 102ab25eeb5Syz155240 #include "netinet/ip_proxy.h" 103f4b3ec61Sdh155122 #include "netinet/ipf_stack.h" 104ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 105ab25eeb5Syz155240 #include "netinet/ip_sync.h" 106ab25eeb5Syz155240 #endif 107ab25eeb5Syz155240 #if (__FreeBSD_version >= 300000) 108ab25eeb5Syz155240 # include <sys/malloc.h> 109ab25eeb5Syz155240 #endif 110ab25eeb5Syz155240 /* END OF INCLUDES */ 111ab25eeb5Syz155240 112ab25eeb5Syz155240 #undef SOCKADDR_IN 113ab25eeb5Syz155240 #define SOCKADDR_IN struct sockaddr_in 114ab25eeb5Syz155240 115ab25eeb5Syz155240 #if !defined(lint) 116ab25eeb5Syz155240 static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed"; 117ab25eeb5Syz155240 static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.195.2.42 2005/08/11 19:51:36 darrenr Exp $"; 118ab25eeb5Syz155240 #endif 119ab25eeb5Syz155240 120ab25eeb5Syz155240 121ab25eeb5Syz155240 /* ======================================================================== */ 122ab25eeb5Syz155240 /* How the NAT is organised and works. */ 123ab25eeb5Syz155240 /* */ 124ab25eeb5Syz155240 /* Inside (interface y) NAT Outside (interface x) */ 125ab25eeb5Syz155240 /* -------------------- -+- ------------------------------------- */ 126ab25eeb5Syz155240 /* Packet going | out, processsed by fr_checknatout() for x */ 127ab25eeb5Syz155240 /* ------------> | ------------> */ 128ab25eeb5Syz155240 /* src=10.1.1.1 | src=192.1.1.1 */ 129ab25eeb5Syz155240 /* | */ 130ab25eeb5Syz155240 /* | in, processed by fr_checknatin() for x */ 131ab25eeb5Syz155240 /* <------------ | <------------ */ 132ab25eeb5Syz155240 /* dst=10.1.1.1 | dst=192.1.1.1 */ 133ab25eeb5Syz155240 /* -------------------- -+- ------------------------------------- */ 134ab25eeb5Syz155240 /* fr_checknatout() - changes ip_src and if required, sport */ 135ab25eeb5Syz155240 /* - creates a new mapping, if required. */ 136ab25eeb5Syz155240 /* fr_checknatin() - changes ip_dst and if required, dport */ 137ab25eeb5Syz155240 /* */ 138ab25eeb5Syz155240 /* In the NAT table, internal source is recorded as "in" and externally */ 139ab25eeb5Syz155240 /* seen as "out". */ 140ab25eeb5Syz155240 /* ======================================================================== */ 141ab25eeb5Syz155240 142ab25eeb5Syz155240 143f4b3ec61Sdh155122 static int nat_flushtable __P((ipf_stack_t *)); 144f4b3ec61Sdh155122 static int nat_clearlist __P((ipf_stack_t *)); 145f4b3ec61Sdh155122 static void nat_addnat __P((struct ipnat *, ipf_stack_t *)); 146f4b3ec61Sdh155122 static void nat_addrdr __P((struct ipnat *, ipf_stack_t *)); 147f4b3ec61Sdh155122 static void nat_delete __P((struct nat *, int, ipf_stack_t *)); 148ab25eeb5Syz155240 static void nat_delrdr __P((struct ipnat *)); 149ab25eeb5Syz155240 static void nat_delnat __P((struct ipnat *)); 150f4b3ec61Sdh155122 static int fr_natgetent __P((caddr_t, ipf_stack_t *)); 151f4b3ec61Sdh155122 static int fr_natgetsz __P((caddr_t, ipf_stack_t *)); 152f4b3ec61Sdh155122 static int fr_natputent __P((caddr_t, int, ipf_stack_t *)); 153f4b3ec61Sdh155122 static void nat_tabmove __P((nat_t *, ipf_stack_t *)); 154ab25eeb5Syz155240 static int nat_match __P((fr_info_t *, ipnat_t *)); 155ab25eeb5Syz155240 static INLINE int nat_newmap __P((fr_info_t *, nat_t *, natinfo_t *)); 156ab25eeb5Syz155240 static INLINE int nat_newrdr __P((fr_info_t *, nat_t *, natinfo_t *)); 157ab25eeb5Syz155240 static hostmap_t *nat_hostmap __P((ipnat_t *, struct in_addr, 158f4b3ec61Sdh155122 struct in_addr, struct in_addr, u_32_t, 159f4b3ec61Sdh155122 ipf_stack_t *)); 160ab25eeb5Syz155240 static INLINE int nat_icmpquerytype4 __P((int)); 161f4b3ec61Sdh155122 static int nat_siocaddnat __P((ipnat_t *, ipnat_t **, int, 162f4b3ec61Sdh155122 ipf_stack_t *)); 163f4b3ec61Sdh155122 static void nat_siocdelnat __P((ipnat_t *, ipnat_t **, int, 164f4b3ec61Sdh155122 ipf_stack_t *)); 165f4b3ec61Sdh155122 static INLINE int nat_icmperrortype4 __P((int)); 166ab25eeb5Syz155240 static INLINE int nat_finalise __P((fr_info_t *, nat_t *, natinfo_t *, 167ab25eeb5Syz155240 tcphdr_t *, nat_t **, int)); 168dcf3e898Sjojemann static INLINE int nat_resolverule __P((ipnat_t *, ipf_stack_t *)); 169ab25eeb5Syz155240 static nat_t *fr_natclone __P((fr_info_t *, nat_t *)); 170381a2a9aSdr146992 static void nat_mssclamp __P((tcphdr_t *, u_32_t, u_short *)); 171ab25eeb5Syz155240 static INLINE int nat_wildok __P((nat_t *, int, int, int, int)); 172f4b3ec61Sdh155122 static int nat_getnext __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *)); 173f4b3ec61Sdh155122 static int nat_iterator __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *)); 1743805c50fSan207044 static int nat_extraflush __P((int, ipf_stack_t *)); 1753805c50fSan207044 static int nat_earlydrop __P((ipftq_t *, int, ipf_stack_t *)); 1763805c50fSan207044 static int nat_flushclosing __P((int, ipf_stack_t *)); 1773805c50fSan207044 1783805c50fSan207044 1793805c50fSan207044 /* 1803805c50fSan207044 * Below we declare a list of constants used only in the nat_extraflush() 1813805c50fSan207044 * routine. We are placing it here, instead of in nat_extraflush() itself, 1823805c50fSan207044 * because we want to make it visible to tools such as mdb, nm etc., so the 1833805c50fSan207044 * values can easily be altered during debugging. 1843805c50fSan207044 */ 1853805c50fSan207044 static const int idletime_tab[] = { 1863805c50fSan207044 IPF_TTLVAL(30), /* 30 seconds */ 1873805c50fSan207044 IPF_TTLVAL(1800), /* 30 minutes */ 1883805c50fSan207044 IPF_TTLVAL(43200), /* 12 hours */ 1893805c50fSan207044 IPF_TTLVAL(345600), /* 4 days */ 1903805c50fSan207044 }; 191ab25eeb5Syz155240 1923c50f6d6San207044 #define NAT_HAS_L4_CHANGED(n) \ 193*27dbc409San207044 (((n)->nat_flags & (IPN_TCPUDPICMP)) && \ 1943c50f6d6San207044 (n)->nat_inport != (n)->nat_outport) 1953c50f6d6San207044 196ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 197ab25eeb5Syz155240 /* Function: fr_natinit */ 198ab25eeb5Syz155240 /* Returns: int - 0 == success, -1 == failure */ 199ab25eeb5Syz155240 /* Parameters: Nil */ 200ab25eeb5Syz155240 /* */ 201ab25eeb5Syz155240 /* Initialise all of the NAT locks, tables and other structures. */ 202ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 203f4b3ec61Sdh155122 int fr_natinit(ifs) 204f4b3ec61Sdh155122 ipf_stack_t *ifs; 205ab25eeb5Syz155240 { 206ab25eeb5Syz155240 int i; 207ab25eeb5Syz155240 208f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_table[0], nat_t **, 209f4b3ec61Sdh155122 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 210f4b3ec61Sdh155122 if (ifs->ifs_nat_table[0] != NULL) 211f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_table[0], 212f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(nat_t *)); 213ab25eeb5Syz155240 else 214ab25eeb5Syz155240 return -1; 215ab25eeb5Syz155240 216f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_table[1], nat_t **, 217f4b3ec61Sdh155122 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 218f4b3ec61Sdh155122 if (ifs->ifs_nat_table[1] != NULL) 219f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_table[1], 220f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(nat_t *)); 221ab25eeb5Syz155240 else 222ab25eeb5Syz155240 return -2; 223ab25eeb5Syz155240 224f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_rules, ipnat_t **, 225f4b3ec61Sdh155122 sizeof(ipnat_t *) * ifs->ifs_ipf_natrules_sz); 226f4b3ec61Sdh155122 if (ifs->ifs_nat_rules != NULL) 227f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_rules, 228f4b3ec61Sdh155122 ifs->ifs_ipf_natrules_sz * sizeof(ipnat_t *)); 229ab25eeb5Syz155240 else 230ab25eeb5Syz155240 return -3; 231ab25eeb5Syz155240 232f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_rdr_rules, ipnat_t **, 233f4b3ec61Sdh155122 sizeof(ipnat_t *) * ifs->ifs_ipf_rdrrules_sz); 234f4b3ec61Sdh155122 if (ifs->ifs_rdr_rules != NULL) 235f4b3ec61Sdh155122 bzero((char *)ifs->ifs_rdr_rules, 236f4b3ec61Sdh155122 ifs->ifs_ipf_rdrrules_sz * sizeof(ipnat_t *)); 237ab25eeb5Syz155240 else 238ab25eeb5Syz155240 return -4; 239ab25eeb5Syz155240 240f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_maptable, hostmap_t **, 241f4b3ec61Sdh155122 sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz); 242f4b3ec61Sdh155122 if (ifs->ifs_maptable != NULL) 243f4b3ec61Sdh155122 bzero((char *)ifs->ifs_maptable, 244f4b3ec61Sdh155122 sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz); 245ab25eeb5Syz155240 else 246ab25eeb5Syz155240 return -5; 247ab25eeb5Syz155240 248f4b3ec61Sdh155122 ifs->ifs_ipf_hm_maplist = NULL; 249ab25eeb5Syz155240 250f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_stats.ns_bucketlen[0], u_long *, 251f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 252f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[0] == NULL) 253f4b3ec61Sdh155122 return -1; 254f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_stats.ns_bucketlen[0], 255f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 256ab25eeb5Syz155240 257f4b3ec61Sdh155122 KMALLOCS(ifs->ifs_nat_stats.ns_bucketlen[1], u_long *, 258f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 259f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[1] == NULL) 260f4b3ec61Sdh155122 return -1; 261f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_stats.ns_bucketlen[1], 262f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 263ab25eeb5Syz155240 264f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_maxbucket == 0) { 265f4b3ec61Sdh155122 for (i = ifs->ifs_ipf_nattable_sz; i > 0; i >>= 1) 266f4b3ec61Sdh155122 ifs->ifs_fr_nat_maxbucket++; 267f4b3ec61Sdh155122 ifs->ifs_fr_nat_maxbucket *= 2; 268ab25eeb5Syz155240 } 269ab25eeb5Syz155240 270f4b3ec61Sdh155122 fr_sttab_init(ifs->ifs_nat_tqb, ifs); 271ab25eeb5Syz155240 /* 272ab25eeb5Syz155240 * Increase this because we may have "keep state" following this too 273ab25eeb5Syz155240 * and packet storms can occur if this is removed too quickly. 274ab25eeb5Syz155240 */ 275f4b3ec61Sdh155122 ifs->ifs_nat_tqb[IPF_TCPS_CLOSED].ifq_ttl = ifs->ifs_fr_tcplastack; 276f4b3ec61Sdh155122 ifs->ifs_nat_tqb[IPF_TCP_NSTATES - 1].ifq_next = &ifs->ifs_nat_udptq; 277f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_ttl = ifs->ifs_fr_defnatage; 278f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_ref = 1; 279f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_head = NULL; 280f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_tail = &ifs->ifs_nat_udptq.ifq_head; 281f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_nat_udptq.ifq_lock, "nat ipftq udp tab"); 282f4b3ec61Sdh155122 ifs->ifs_nat_udptq.ifq_next = &ifs->ifs_nat_icmptq; 283f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_ttl = ifs->ifs_fr_defnaticmpage; 284f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_ref = 1; 285f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_head = NULL; 286f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_tail = &ifs->ifs_nat_icmptq.ifq_head; 287f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_nat_icmptq.ifq_lock, "nat icmp ipftq tab"); 288f4b3ec61Sdh155122 ifs->ifs_nat_icmptq.ifq_next = &ifs->ifs_nat_iptq; 289f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_ttl = ifs->ifs_fr_defnatipage; 290f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_ref = 1; 291f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_head = NULL; 292f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_tail = &ifs->ifs_nat_iptq.ifq_head; 293f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_nat_iptq.ifq_lock, "nat ip ipftq tab"); 294f4b3ec61Sdh155122 ifs->ifs_nat_iptq.ifq_next = NULL; 295ab25eeb5Syz155240 296ab25eeb5Syz155240 for (i = 0; i < IPF_TCP_NSTATES; i++) { 297f4b3ec61Sdh155122 if (ifs->ifs_nat_tqb[i].ifq_ttl < ifs->ifs_fr_defnaticmpage) 298f4b3ec61Sdh155122 ifs->ifs_nat_tqb[i].ifq_ttl = ifs->ifs_fr_defnaticmpage; 299ab25eeb5Syz155240 #ifdef LARGE_NAT 300f4b3ec61Sdh155122 else if (ifs->ifs_nat_tqb[i].ifq_ttl > ifs->ifs_fr_defnatage) 301f4b3ec61Sdh155122 ifs->ifs_nat_tqb[i].ifq_ttl = ifs->ifs_fr_defnatage; 302ab25eeb5Syz155240 #endif 303ab25eeb5Syz155240 } 304ab25eeb5Syz155240 305ab25eeb5Syz155240 /* 306ab25eeb5Syz155240 * Increase this because we may have "keep state" following 307ab25eeb5Syz155240 * this too and packet storms can occur if this is removed 308ab25eeb5Syz155240 * too quickly. 309ab25eeb5Syz155240 */ 310f4b3ec61Sdh155122 ifs->ifs_nat_tqb[IPF_TCPS_CLOSED].ifq_ttl = 311f4b3ec61Sdh155122 ifs->ifs_nat_tqb[IPF_TCPS_LAST_ACK].ifq_ttl; 312ab25eeb5Syz155240 313f4b3ec61Sdh155122 RWLOCK_INIT(&ifs->ifs_ipf_nat, "ipf IP NAT rwlock"); 314f4b3ec61Sdh155122 RWLOCK_INIT(&ifs->ifs_ipf_natfrag, "ipf IP NAT-Frag rwlock"); 315f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ipf_nat_new, "ipf nat new mutex"); 316f4b3ec61Sdh155122 MUTEX_INIT(&ifs->ifs_ipf_natio, "ipf nat io mutex"); 317ab25eeb5Syz155240 318f4b3ec61Sdh155122 ifs->ifs_fr_nat_init = 1; 319ab25eeb5Syz155240 320ab25eeb5Syz155240 return 0; 321ab25eeb5Syz155240 } 322ab25eeb5Syz155240 323ab25eeb5Syz155240 324ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 325ab25eeb5Syz155240 /* Function: nat_addrdr */ 326ab25eeb5Syz155240 /* Returns: Nil */ 327ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule to add */ 328ab25eeb5Syz155240 /* */ 329ab25eeb5Syz155240 /* Adds a redirect rule to the hash table of redirect rules and the list of */ 330ab25eeb5Syz155240 /* loaded NAT rules. Updates the bitmask indicating which netmasks are in */ 331ab25eeb5Syz155240 /* use by redirect rules. */ 332ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 333f4b3ec61Sdh155122 static void nat_addrdr(n, ifs) 334ab25eeb5Syz155240 ipnat_t *n; 335f4b3ec61Sdh155122 ipf_stack_t *ifs; 336ab25eeb5Syz155240 { 337ab25eeb5Syz155240 ipnat_t **np; 338ab25eeb5Syz155240 u_32_t j; 339ab25eeb5Syz155240 u_int hv; 340ab25eeb5Syz155240 int k; 341ab25eeb5Syz155240 342ab25eeb5Syz155240 k = count4bits(n->in_outmsk); 343ab25eeb5Syz155240 if ((k >= 0) && (k != 32)) 344f4b3ec61Sdh155122 ifs->ifs_rdr_masks |= 1 << k; 345ab25eeb5Syz155240 j = (n->in_outip & n->in_outmsk); 346f4b3ec61Sdh155122 hv = NAT_HASH_FN(j, 0, ifs->ifs_ipf_rdrrules_sz); 347f4b3ec61Sdh155122 np = ifs->ifs_rdr_rules + hv; 348ab25eeb5Syz155240 while (*np != NULL) 349ab25eeb5Syz155240 np = &(*np)->in_rnext; 350ab25eeb5Syz155240 n->in_rnext = NULL; 351ab25eeb5Syz155240 n->in_prnext = np; 352ab25eeb5Syz155240 n->in_hv = hv; 353ab25eeb5Syz155240 *np = n; 354ab25eeb5Syz155240 } 355ab25eeb5Syz155240 356ab25eeb5Syz155240 357ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 358ab25eeb5Syz155240 /* Function: nat_addnat */ 359ab25eeb5Syz155240 /* Returns: Nil */ 360ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule to add */ 361ab25eeb5Syz155240 /* */ 362ab25eeb5Syz155240 /* Adds a NAT map rule to the hash table of rules and the list of loaded */ 363ab25eeb5Syz155240 /* NAT rules. Updates the bitmask indicating which netmasks are in use by */ 364ab25eeb5Syz155240 /* redirect rules. */ 365ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 366f4b3ec61Sdh155122 static void nat_addnat(n, ifs) 367ab25eeb5Syz155240 ipnat_t *n; 368f4b3ec61Sdh155122 ipf_stack_t *ifs; 369ab25eeb5Syz155240 { 370ab25eeb5Syz155240 ipnat_t **np; 371ab25eeb5Syz155240 u_32_t j; 372ab25eeb5Syz155240 u_int hv; 373ab25eeb5Syz155240 int k; 374ab25eeb5Syz155240 375ab25eeb5Syz155240 k = count4bits(n->in_inmsk); 376ab25eeb5Syz155240 if ((k >= 0) && (k != 32)) 377f4b3ec61Sdh155122 ifs->ifs_nat_masks |= 1 << k; 378ab25eeb5Syz155240 j = (n->in_inip & n->in_inmsk); 379f4b3ec61Sdh155122 hv = NAT_HASH_FN(j, 0, ifs->ifs_ipf_natrules_sz); 380f4b3ec61Sdh155122 np = ifs->ifs_nat_rules + hv; 381ab25eeb5Syz155240 while (*np != NULL) 382ab25eeb5Syz155240 np = &(*np)->in_mnext; 383ab25eeb5Syz155240 n->in_mnext = NULL; 384ab25eeb5Syz155240 n->in_pmnext = np; 385ab25eeb5Syz155240 n->in_hv = hv; 386ab25eeb5Syz155240 *np = n; 387ab25eeb5Syz155240 } 388ab25eeb5Syz155240 389ab25eeb5Syz155240 390ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 391ab25eeb5Syz155240 /* Function: nat_delrdr */ 392ab25eeb5Syz155240 /* Returns: Nil */ 393ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule to delete */ 394ab25eeb5Syz155240 /* */ 395ab25eeb5Syz155240 /* Removes a redirect rule from the hash table of redirect rules. */ 396ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 397ab25eeb5Syz155240 static void nat_delrdr(n) 398ab25eeb5Syz155240 ipnat_t *n; 399ab25eeb5Syz155240 { 400ab25eeb5Syz155240 if (n->in_rnext) 401ab25eeb5Syz155240 n->in_rnext->in_prnext = n->in_prnext; 402ab25eeb5Syz155240 *n->in_prnext = n->in_rnext; 403ab25eeb5Syz155240 } 404ab25eeb5Syz155240 405ab25eeb5Syz155240 406ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 407ab25eeb5Syz155240 /* Function: nat_delnat */ 408ab25eeb5Syz155240 /* Returns: Nil */ 409ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule to delete */ 410ab25eeb5Syz155240 /* */ 411ab25eeb5Syz155240 /* Removes a NAT map rule from the hash table of NAT map rules. */ 412ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 413ab25eeb5Syz155240 static void nat_delnat(n) 414ab25eeb5Syz155240 ipnat_t *n; 415ab25eeb5Syz155240 { 416ab25eeb5Syz155240 if (n->in_mnext != NULL) 417ab25eeb5Syz155240 n->in_mnext->in_pmnext = n->in_pmnext; 418ab25eeb5Syz155240 *n->in_pmnext = n->in_mnext; 419ab25eeb5Syz155240 } 420ab25eeb5Syz155240 421ab25eeb5Syz155240 422ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 423ab25eeb5Syz155240 /* Function: nat_hostmap */ 424ab25eeb5Syz155240 /* Returns: struct hostmap* - NULL if no hostmap could be created, */ 425ab25eeb5Syz155240 /* else a pointer to the hostmapping to use */ 426ab25eeb5Syz155240 /* Parameters: np(I) - pointer to NAT rule */ 427ab25eeb5Syz155240 /* real(I) - real IP address */ 428ab25eeb5Syz155240 /* map(I) - mapped IP address */ 429ab25eeb5Syz155240 /* port(I) - destination port number */ 430ab25eeb5Syz155240 /* Write Locks: ipf_nat */ 431ab25eeb5Syz155240 /* */ 432ab25eeb5Syz155240 /* Check if an ip address has already been allocated for a given mapping */ 433ab25eeb5Syz155240 /* that is not doing port based translation. If is not yet allocated, then */ 434ab25eeb5Syz155240 /* create a new entry if a non-NULL NAT rule pointer has been supplied. */ 435ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 436f4b3ec61Sdh155122 static struct hostmap *nat_hostmap(np, src, dst, map, port, ifs) 437ab25eeb5Syz155240 ipnat_t *np; 438ab25eeb5Syz155240 struct in_addr src; 439ab25eeb5Syz155240 struct in_addr dst; 440ab25eeb5Syz155240 struct in_addr map; 441ab25eeb5Syz155240 u_32_t port; 442f4b3ec61Sdh155122 ipf_stack_t *ifs; 443ab25eeb5Syz155240 { 444ab25eeb5Syz155240 hostmap_t *hm; 445ab25eeb5Syz155240 u_int hv; 446ab25eeb5Syz155240 447ab25eeb5Syz155240 hv = (src.s_addr ^ dst.s_addr); 448ab25eeb5Syz155240 hv += src.s_addr; 449ab25eeb5Syz155240 hv += dst.s_addr; 450ab25eeb5Syz155240 hv %= HOSTMAP_SIZE; 451f4b3ec61Sdh155122 for (hm = ifs->ifs_maptable[hv]; hm; hm = hm->hm_next) 452ab25eeb5Syz155240 if ((hm->hm_srcip.s_addr == src.s_addr) && 453ab25eeb5Syz155240 (hm->hm_dstip.s_addr == dst.s_addr) && 454ab25eeb5Syz155240 ((np == NULL) || (np == hm->hm_ipnat)) && 455ab25eeb5Syz155240 ((port == 0) || (port == hm->hm_port))) { 456ab25eeb5Syz155240 hm->hm_ref++; 457ab25eeb5Syz155240 return hm; 458ab25eeb5Syz155240 } 459ab25eeb5Syz155240 460ab25eeb5Syz155240 if (np == NULL) 461ab25eeb5Syz155240 return NULL; 462ab25eeb5Syz155240 463ab25eeb5Syz155240 KMALLOC(hm, hostmap_t *); 464ab25eeb5Syz155240 if (hm) { 465f4b3ec61Sdh155122 hm->hm_hnext = ifs->ifs_ipf_hm_maplist; 466f4b3ec61Sdh155122 hm->hm_phnext = &ifs->ifs_ipf_hm_maplist; 467f4b3ec61Sdh155122 if (ifs->ifs_ipf_hm_maplist != NULL) 468f4b3ec61Sdh155122 ifs->ifs_ipf_hm_maplist->hm_phnext = &hm->hm_hnext; 469f4b3ec61Sdh155122 ifs->ifs_ipf_hm_maplist = hm; 470f4b3ec61Sdh155122 471f4b3ec61Sdh155122 hm->hm_next = ifs->ifs_maptable[hv]; 472f4b3ec61Sdh155122 hm->hm_pnext = ifs->ifs_maptable + hv; 473f4b3ec61Sdh155122 if (ifs->ifs_maptable[hv] != NULL) 474f4b3ec61Sdh155122 ifs->ifs_maptable[hv]->hm_pnext = &hm->hm_next; 475f4b3ec61Sdh155122 ifs->ifs_maptable[hv] = hm; 476ab25eeb5Syz155240 hm->hm_ipnat = np; 477ab25eeb5Syz155240 hm->hm_srcip = src; 478ab25eeb5Syz155240 hm->hm_dstip = dst; 479ab25eeb5Syz155240 hm->hm_mapip = map; 480ab25eeb5Syz155240 hm->hm_ref = 1; 481ab25eeb5Syz155240 hm->hm_port = port; 482ab25eeb5Syz155240 } 483ab25eeb5Syz155240 return hm; 484ab25eeb5Syz155240 } 485ab25eeb5Syz155240 486ab25eeb5Syz155240 487ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 48890b0a856Sjojemann /* Function: fr_hostmapdel */ 489ab25eeb5Syz155240 /* Returns: Nil */ 49090b0a856Sjojemann /* Parameters: hmp(I) - pointer to pointer to hostmap structure */ 491ab25eeb5Syz155240 /* Write Locks: ipf_nat */ 492ab25eeb5Syz155240 /* */ 493ab25eeb5Syz155240 /* Decrement the references to this hostmap structure by one. If this */ 494ab25eeb5Syz155240 /* reaches zero then remove it and free it. */ 495ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 49690b0a856Sjojemann void fr_hostmapdel(hmp) 49790b0a856Sjojemann struct hostmap **hmp; 498ab25eeb5Syz155240 { 49990b0a856Sjojemann struct hostmap *hm; 50090b0a856Sjojemann 50190b0a856Sjojemann hm = *hmp; 50290b0a856Sjojemann *hmp = NULL; 50390b0a856Sjojemann 504ab25eeb5Syz155240 hm->hm_ref--; 505ab25eeb5Syz155240 if (hm->hm_ref == 0) { 506ab25eeb5Syz155240 if (hm->hm_next) 507ab25eeb5Syz155240 hm->hm_next->hm_pnext = hm->hm_pnext; 508ab25eeb5Syz155240 *hm->hm_pnext = hm->hm_next; 509f4b3ec61Sdh155122 if (hm->hm_hnext) 510f4b3ec61Sdh155122 hm->hm_hnext->hm_phnext = hm->hm_phnext; 511f4b3ec61Sdh155122 *hm->hm_phnext = hm->hm_hnext; 512ab25eeb5Syz155240 KFREE(hm); 513ab25eeb5Syz155240 } 514ab25eeb5Syz155240 } 515ab25eeb5Syz155240 516ab25eeb5Syz155240 517ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 518ab25eeb5Syz155240 /* Function: fix_outcksum */ 519ab25eeb5Syz155240 /* Returns: Nil */ 520381a2a9aSdr146992 /* Parameters: sp(I) - location of 16bit checksum to update */ 521ab25eeb5Syz155240 /* n((I) - amount to adjust checksum by */ 522ab25eeb5Syz155240 /* */ 523ab25eeb5Syz155240 /* Adjusts the 16bit checksum by "n" for packets going out. */ 524ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 525381a2a9aSdr146992 void fix_outcksum(sp, n) 526ab25eeb5Syz155240 u_short *sp; 527ab25eeb5Syz155240 u_32_t n; 528ab25eeb5Syz155240 { 529ab25eeb5Syz155240 u_short sumshort; 530ab25eeb5Syz155240 u_32_t sum1; 531ab25eeb5Syz155240 532ab25eeb5Syz155240 if (n == 0) 533ab25eeb5Syz155240 return; 534ab25eeb5Syz155240 535ab25eeb5Syz155240 sum1 = (~ntohs(*sp)) & 0xffff; 536ab25eeb5Syz155240 sum1 += (n); 537ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 538ab25eeb5Syz155240 /* Again */ 539ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 540ab25eeb5Syz155240 sumshort = ~(u_short)sum1; 541ab25eeb5Syz155240 *(sp) = htons(sumshort); 542ab25eeb5Syz155240 } 543ab25eeb5Syz155240 544ab25eeb5Syz155240 545ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 546ab25eeb5Syz155240 /* Function: fix_incksum */ 547ab25eeb5Syz155240 /* Returns: Nil */ 548381a2a9aSdr146992 /* Parameters: sp(I) - location of 16bit checksum to update */ 549ab25eeb5Syz155240 /* n((I) - amount to adjust checksum by */ 550ab25eeb5Syz155240 /* */ 551ab25eeb5Syz155240 /* Adjusts the 16bit checksum by "n" for packets going in. */ 552ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 553381a2a9aSdr146992 void fix_incksum(sp, n) 554ab25eeb5Syz155240 u_short *sp; 555ab25eeb5Syz155240 u_32_t n; 556ab25eeb5Syz155240 { 557ab25eeb5Syz155240 u_short sumshort; 558ab25eeb5Syz155240 u_32_t sum1; 559ab25eeb5Syz155240 560ab25eeb5Syz155240 if (n == 0) 561ab25eeb5Syz155240 return; 562ab25eeb5Syz155240 563ab25eeb5Syz155240 sum1 = (~ntohs(*sp)) & 0xffff; 564ab25eeb5Syz155240 sum1 += ~(n) & 0xffff; 565ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 566ab25eeb5Syz155240 /* Again */ 567ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 568ab25eeb5Syz155240 sumshort = ~(u_short)sum1; 569ab25eeb5Syz155240 *(sp) = htons(sumshort); 570ab25eeb5Syz155240 } 571ab25eeb5Syz155240 572ab25eeb5Syz155240 573ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 574ab25eeb5Syz155240 /* Function: fix_datacksum */ 575ab25eeb5Syz155240 /* Returns: Nil */ 576ab25eeb5Syz155240 /* Parameters: sp(I) - location of 16bit checksum to update */ 577ab25eeb5Syz155240 /* n((I) - amount to adjust checksum by */ 578ab25eeb5Syz155240 /* */ 579ab25eeb5Syz155240 /* Fix_datacksum is used *only* for the adjustments of checksums in the */ 580ab25eeb5Syz155240 /* data section of an IP packet. */ 581ab25eeb5Syz155240 /* */ 582ab25eeb5Syz155240 /* The only situation in which you need to do this is when NAT'ing an */ 583ab25eeb5Syz155240 /* ICMP error message. Such a message, contains in its body the IP header */ 584ab25eeb5Syz155240 /* of the original IP packet, that causes the error. */ 585ab25eeb5Syz155240 /* */ 586ab25eeb5Syz155240 /* You can't use fix_incksum or fix_outcksum in that case, because for the */ 587ab25eeb5Syz155240 /* kernel the data section of the ICMP error is just data, and no special */ 588ab25eeb5Syz155240 /* processing like hardware cksum or ntohs processing have been done by the */ 589ab25eeb5Syz155240 /* kernel on the data section. */ 590ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 591ab25eeb5Syz155240 void fix_datacksum(sp, n) 592ab25eeb5Syz155240 u_short *sp; 593ab25eeb5Syz155240 u_32_t n; 594ab25eeb5Syz155240 { 595ab25eeb5Syz155240 u_short sumshort; 596ab25eeb5Syz155240 u_32_t sum1; 597ab25eeb5Syz155240 598ab25eeb5Syz155240 if (n == 0) 599ab25eeb5Syz155240 return; 600ab25eeb5Syz155240 601ab25eeb5Syz155240 sum1 = (~ntohs(*sp)) & 0xffff; 602ab25eeb5Syz155240 sum1 += (n); 603ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 604ab25eeb5Syz155240 /* Again */ 605ab25eeb5Syz155240 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 606ab25eeb5Syz155240 sumshort = ~(u_short)sum1; 607ab25eeb5Syz155240 *(sp) = htons(sumshort); 608ab25eeb5Syz155240 } 609ab25eeb5Syz155240 610ab25eeb5Syz155240 611ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 612ab25eeb5Syz155240 /* Function: fr_nat_ioctl */ 613ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 614ab25eeb5Syz155240 /* Parameters: data(I) - pointer to ioctl data */ 615ab25eeb5Syz155240 /* cmd(I) - ioctl command integer */ 616ab25eeb5Syz155240 /* mode(I) - file mode bits used with open */ 617ab25eeb5Syz155240 /* */ 618ab25eeb5Syz155240 /* Processes an ioctl call made to operate on the IP Filter NAT device. */ 619ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 620f4b3ec61Sdh155122 int fr_nat_ioctl(data, cmd, mode, uid, ctx, ifs) 621ab25eeb5Syz155240 ioctlcmd_t cmd; 622ab25eeb5Syz155240 caddr_t data; 623f4b3ec61Sdh155122 int mode, uid; 624f4b3ec61Sdh155122 void *ctx; 625f4b3ec61Sdh155122 ipf_stack_t *ifs; 626ab25eeb5Syz155240 { 627ab25eeb5Syz155240 ipnat_t *nat, *nt, *n = NULL, **np = NULL; 628ab25eeb5Syz155240 int error = 0, ret, arg, getlock; 629ab25eeb5Syz155240 ipnat_t natd; 630ab25eeb5Syz155240 631ab25eeb5Syz155240 #if (BSD >= 199306) && defined(_KERNEL) 632ab25eeb5Syz155240 if ((securelevel >= 2) && (mode & FWRITE)) 633ab25eeb5Syz155240 return EPERM; 634ab25eeb5Syz155240 #endif 635ab25eeb5Syz155240 636ab25eeb5Syz155240 #if defined(__osf__) && defined(_KERNEL) 637ab25eeb5Syz155240 getlock = 0; 638ab25eeb5Syz155240 #else 639ab25eeb5Syz155240 getlock = (mode & NAT_LOCKHELD) ? 0 : 1; 640ab25eeb5Syz155240 #endif 641ab25eeb5Syz155240 642ab25eeb5Syz155240 nat = NULL; /* XXX gcc -Wuninitialized */ 643ab25eeb5Syz155240 if (cmd == (ioctlcmd_t)SIOCADNAT) { 644ab25eeb5Syz155240 KMALLOC(nt, ipnat_t *); 645ab25eeb5Syz155240 } else { 646ab25eeb5Syz155240 nt = NULL; 647ab25eeb5Syz155240 } 648ab25eeb5Syz155240 649ab25eeb5Syz155240 if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) { 650ab25eeb5Syz155240 if (mode & NAT_SYSSPACE) { 651ab25eeb5Syz155240 bcopy(data, (char *)&natd, sizeof(natd)); 652ab25eeb5Syz155240 error = 0; 653ab25eeb5Syz155240 } else { 654ab25eeb5Syz155240 error = fr_inobj(data, &natd, IPFOBJ_IPNAT); 655ab25eeb5Syz155240 } 656ab25eeb5Syz155240 657ab25eeb5Syz155240 } else if (cmd == (ioctlcmd_t)SIOCIPFFL) { /* SIOCFLNAT & SIOCCNATL */ 658ab25eeb5Syz155240 BCOPYIN(data, &arg, sizeof(arg)); 659ab25eeb5Syz155240 } 660ab25eeb5Syz155240 661ab25eeb5Syz155240 if (error != 0) 662ab25eeb5Syz155240 goto done; 663ab25eeb5Syz155240 664ab25eeb5Syz155240 /* 665ab25eeb5Syz155240 * For add/delete, look to see if the NAT entry is already present 666ab25eeb5Syz155240 */ 667ab25eeb5Syz155240 if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) { 668ab25eeb5Syz155240 nat = &natd; 669ab25eeb5Syz155240 if (nat->in_v == 0) /* For backward compat. */ 670ab25eeb5Syz155240 nat->in_v = 4; 671ab25eeb5Syz155240 nat->in_flags &= IPN_USERFLAGS; 672ab25eeb5Syz155240 if ((nat->in_redir & NAT_MAPBLK) == 0) { 673ab25eeb5Syz155240 if ((nat->in_flags & IPN_SPLIT) == 0) 674ab25eeb5Syz155240 nat->in_inip &= nat->in_inmsk; 675ab25eeb5Syz155240 if ((nat->in_flags & IPN_IPRANGE) == 0) 676ab25eeb5Syz155240 nat->in_outip &= nat->in_outmsk; 677ab25eeb5Syz155240 } 678f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_natio); 679f4b3ec61Sdh155122 for (np = &ifs->ifs_nat_list; ((n = *np) != NULL); 680f4b3ec61Sdh155122 np = &n->in_next) 6818899fcfaSjojemann if (bcmp((char *)&nat->in_flags, (char *)&n->in_flags, 6828899fcfaSjojemann IPN_CMPSIZ) == 0) { 6838899fcfaSjojemann if (nat->in_redir == NAT_REDIRECT && 6848899fcfaSjojemann nat->in_pnext != n->in_pnext) 6858899fcfaSjojemann continue; 686ab25eeb5Syz155240 break; 687ab25eeb5Syz155240 } 6888899fcfaSjojemann } 689ab25eeb5Syz155240 690ab25eeb5Syz155240 switch (cmd) 691ab25eeb5Syz155240 { 692f4b3ec61Sdh155122 case SIOCGENITER : 693f4b3ec61Sdh155122 { 694f4b3ec61Sdh155122 ipfgeniter_t iter; 695f4b3ec61Sdh155122 ipftoken_t *token; 696f4b3ec61Sdh155122 697f4b3ec61Sdh155122 error = fr_inobj(data, &iter, IPFOBJ_GENITER); 698f4b3ec61Sdh155122 if (error != 0) 699f4b3ec61Sdh155122 break; 700f4b3ec61Sdh155122 701f4b3ec61Sdh155122 token = ipf_findtoken(iter.igi_type, uid, ctx, ifs); 702f4b3ec61Sdh155122 if (token != NULL) 703f4b3ec61Sdh155122 error = nat_iterator(token, &iter, ifs); 704f4b3ec61Sdh155122 else 705f4b3ec61Sdh155122 error = ESRCH; 706f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_tokens); 707f4b3ec61Sdh155122 break; 708f4b3ec61Sdh155122 } 709ab25eeb5Syz155240 #ifdef IPFILTER_LOG 710ab25eeb5Syz155240 case SIOCIPFFB : 711ab25eeb5Syz155240 { 712ab25eeb5Syz155240 int tmp; 713ab25eeb5Syz155240 714ab25eeb5Syz155240 if (!(mode & FWRITE)) 715ab25eeb5Syz155240 error = EPERM; 716ab25eeb5Syz155240 else { 717f4b3ec61Sdh155122 tmp = ipflog_clear(IPL_LOGNAT, ifs); 718ab25eeb5Syz155240 BCOPYOUT((char *)&tmp, (char *)data, sizeof(tmp)); 719ab25eeb5Syz155240 } 720ab25eeb5Syz155240 break; 721ab25eeb5Syz155240 } 722ab25eeb5Syz155240 case SIOCSETLG : 723ab25eeb5Syz155240 if (!(mode & FWRITE)) 724ab25eeb5Syz155240 error = EPERM; 725ab25eeb5Syz155240 else { 726f4b3ec61Sdh155122 BCOPYIN((char *)data, 727f4b3ec61Sdh155122 (char *)&ifs->ifs_nat_logging, 728f4b3ec61Sdh155122 sizeof(ifs->ifs_nat_logging)); 729ab25eeb5Syz155240 } 730ab25eeb5Syz155240 break; 731ab25eeb5Syz155240 case SIOCGETLG : 732f4b3ec61Sdh155122 BCOPYOUT((char *)&ifs->ifs_nat_logging, (char *)data, 733f4b3ec61Sdh155122 sizeof(ifs->ifs_nat_logging)); 734ab25eeb5Syz155240 break; 735ab25eeb5Syz155240 case FIONREAD : 736f4b3ec61Sdh155122 arg = ifs->ifs_iplused[IPL_LOGNAT]; 737ab25eeb5Syz155240 BCOPYOUT(&arg, data, sizeof(arg)); 738ab25eeb5Syz155240 break; 739ab25eeb5Syz155240 #endif 740ab25eeb5Syz155240 case SIOCADNAT : 741ab25eeb5Syz155240 if (!(mode & FWRITE)) { 742ab25eeb5Syz155240 error = EPERM; 743ab25eeb5Syz155240 } else if (n != NULL) { 744ab25eeb5Syz155240 error = EEXIST; 745ab25eeb5Syz155240 } else if (nt == NULL) { 746ab25eeb5Syz155240 error = ENOMEM; 747ab25eeb5Syz155240 } 748ab25eeb5Syz155240 if (error != 0) { 749f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_natio); 750ab25eeb5Syz155240 break; 751ab25eeb5Syz155240 } 752ab25eeb5Syz155240 bcopy((char *)nat, (char *)nt, sizeof(*n)); 753f4b3ec61Sdh155122 error = nat_siocaddnat(nt, np, getlock, ifs); 754f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_natio); 755ab25eeb5Syz155240 if (error == 0) 756ab25eeb5Syz155240 nt = NULL; 757ab25eeb5Syz155240 break; 758ab25eeb5Syz155240 case SIOCRMNAT : 759ab25eeb5Syz155240 if (!(mode & FWRITE)) { 760ab25eeb5Syz155240 error = EPERM; 761ab25eeb5Syz155240 n = NULL; 762ab25eeb5Syz155240 } else if (n == NULL) { 763ab25eeb5Syz155240 error = ESRCH; 764ab25eeb5Syz155240 } 765ab25eeb5Syz155240 766ab25eeb5Syz155240 if (error != 0) { 767f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_natio); 768ab25eeb5Syz155240 break; 769ab25eeb5Syz155240 } 770f4b3ec61Sdh155122 nat_siocdelnat(n, np, getlock, ifs); 771ab25eeb5Syz155240 772f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_natio); 773ab25eeb5Syz155240 n = NULL; 774ab25eeb5Syz155240 break; 775ab25eeb5Syz155240 case SIOCGNATS : 776f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_table[0] = ifs->ifs_nat_table[0]; 777f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_table[1] = ifs->ifs_nat_table[1]; 778f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_list = ifs->ifs_nat_list; 779f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_maptable = ifs->ifs_maptable; 780f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_maplist = ifs->ifs_ipf_hm_maplist; 781f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_nattab_max = ifs->ifs_ipf_nattable_max; 782f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_nattab_sz = ifs->ifs_ipf_nattable_sz; 783f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rultab_sz = ifs->ifs_ipf_natrules_sz; 784f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rdrtab_sz = ifs->ifs_ipf_rdrrules_sz; 785f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_hostmap_sz = ifs->ifs_ipf_hostmap_sz; 786f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_instances = ifs->ifs_nat_instances; 787f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_apslist = ifs->ifs_ap_sess_list; 788f4b3ec61Sdh155122 error = fr_outobj(data, &ifs->ifs_nat_stats, IPFOBJ_NATSTAT); 789ab25eeb5Syz155240 break; 790ab25eeb5Syz155240 case SIOCGNATL : 791ab25eeb5Syz155240 { 792ab25eeb5Syz155240 natlookup_t nl; 793ab25eeb5Syz155240 794ab25eeb5Syz155240 if (getlock) { 795f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 796ab25eeb5Syz155240 } 797ab25eeb5Syz155240 error = fr_inobj(data, &nl, IPFOBJ_NATLOOKUP); 798ab25eeb5Syz155240 if (error == 0) { 799f4b3ec61Sdh155122 if (nat_lookupredir(&nl, ifs) != NULL) { 800ab25eeb5Syz155240 error = fr_outobj(data, &nl, IPFOBJ_NATLOOKUP); 801ab25eeb5Syz155240 } else { 802ab25eeb5Syz155240 error = ESRCH; 803ab25eeb5Syz155240 } 804ab25eeb5Syz155240 } 805ab25eeb5Syz155240 if (getlock) { 806f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 807ab25eeb5Syz155240 } 808ab25eeb5Syz155240 break; 809ab25eeb5Syz155240 } 810ab25eeb5Syz155240 case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */ 811ab25eeb5Syz155240 if (!(mode & FWRITE)) { 812ab25eeb5Syz155240 error = EPERM; 813ab25eeb5Syz155240 break; 814ab25eeb5Syz155240 } 815ab25eeb5Syz155240 if (getlock) { 816f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 817ab25eeb5Syz155240 } 818ab25eeb5Syz155240 error = 0; 819ab25eeb5Syz155240 if (arg == 0) 820f4b3ec61Sdh155122 ret = nat_flushtable(ifs); 821ab25eeb5Syz155240 else if (arg == 1) 822f4b3ec61Sdh155122 ret = nat_clearlist(ifs); 8233805c50fSan207044 else if (arg >= 2 && arg <= 4) 8243805c50fSan207044 ret = nat_extraflush(arg - 2, ifs); 825ab25eeb5Syz155240 else 826ab25eeb5Syz155240 error = EINVAL; 827ab25eeb5Syz155240 if (getlock) { 828f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 829ab25eeb5Syz155240 } 830ab25eeb5Syz155240 if (error == 0) { 831ab25eeb5Syz155240 BCOPYOUT(&ret, data, sizeof(ret)); 832ab25eeb5Syz155240 } 833ab25eeb5Syz155240 break; 834ab25eeb5Syz155240 case SIOCPROXY : 835f4b3ec61Sdh155122 error = appr_ioctl(data, cmd, mode, ifs); 836ab25eeb5Syz155240 break; 837ab25eeb5Syz155240 case SIOCSTLCK : 838ab25eeb5Syz155240 if (!(mode & FWRITE)) { 839ab25eeb5Syz155240 error = EPERM; 840ab25eeb5Syz155240 } else { 841f4b3ec61Sdh155122 fr_lock(data, &ifs->ifs_fr_nat_lock); 842ab25eeb5Syz155240 } 843ab25eeb5Syz155240 break; 844ab25eeb5Syz155240 case SIOCSTPUT : 8453c3c3491Sjojemann if ((mode & FWRITE) != 0) { 846f4b3ec61Sdh155122 error = fr_natputent(data, getlock, ifs); 847ab25eeb5Syz155240 } else { 848ab25eeb5Syz155240 error = EACCES; 849ab25eeb5Syz155240 } 850ab25eeb5Syz155240 break; 851ab25eeb5Syz155240 case SIOCSTGSZ : 852f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_lock) { 853ab25eeb5Syz155240 if (getlock) { 854f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 855ab25eeb5Syz155240 } 856f4b3ec61Sdh155122 error = fr_natgetsz(data, ifs); 857ab25eeb5Syz155240 if (getlock) { 858f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 859ab25eeb5Syz155240 } 860ab25eeb5Syz155240 } else 861ab25eeb5Syz155240 error = EACCES; 862ab25eeb5Syz155240 break; 863ab25eeb5Syz155240 case SIOCSTGET : 864f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_lock) { 865ab25eeb5Syz155240 if (getlock) { 866f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 867ab25eeb5Syz155240 } 868f4b3ec61Sdh155122 error = fr_natgetent(data, ifs); 869ab25eeb5Syz155240 if (getlock) { 870f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 871ab25eeb5Syz155240 } 872ab25eeb5Syz155240 } else 873ab25eeb5Syz155240 error = EACCES; 874ab25eeb5Syz155240 break; 875f4b3ec61Sdh155122 case SIOCIPFDELTOK : 876f4b3ec61Sdh155122 (void) BCOPYIN((caddr_t)data, (caddr_t)&arg, sizeof(arg)); 877f4b3ec61Sdh155122 error = ipf_deltoken(arg, uid, ctx, ifs); 878f4b3ec61Sdh155122 break; 879ab25eeb5Syz155240 default : 880ab25eeb5Syz155240 error = EINVAL; 881ab25eeb5Syz155240 break; 882ab25eeb5Syz155240 } 883ab25eeb5Syz155240 done: 884ab25eeb5Syz155240 if (nt) 885ab25eeb5Syz155240 KFREE(nt); 886ab25eeb5Syz155240 return error; 887ab25eeb5Syz155240 } 888ab25eeb5Syz155240 889ab25eeb5Syz155240 890ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 891ab25eeb5Syz155240 /* Function: nat_siocaddnat */ 892ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 893ab25eeb5Syz155240 /* Parameters: n(I) - pointer to new NAT rule */ 894ab25eeb5Syz155240 /* np(I) - pointer to where to insert new NAT rule */ 895ab25eeb5Syz155240 /* getlock(I) - flag indicating if lock on ipf_nat is held */ 896ab25eeb5Syz155240 /* Mutex Locks: ipf_natio */ 897ab25eeb5Syz155240 /* */ 898ab25eeb5Syz155240 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */ 899ab25eeb5Syz155240 /* from information passed to the kernel, then add it to the appropriate */ 900ab25eeb5Syz155240 /* NAT rule table(s). */ 901ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 902f4b3ec61Sdh155122 static int nat_siocaddnat(n, np, getlock, ifs) 903ab25eeb5Syz155240 ipnat_t *n, **np; 904ab25eeb5Syz155240 int getlock; 905f4b3ec61Sdh155122 ipf_stack_t *ifs; 906ab25eeb5Syz155240 { 907ab25eeb5Syz155240 int error = 0, i, j; 908ab25eeb5Syz155240 909dcf3e898Sjojemann if (nat_resolverule(n, ifs) != 0) 910ab25eeb5Syz155240 return ENOENT; 911ab25eeb5Syz155240 912ab25eeb5Syz155240 if ((n->in_age[0] == 0) && (n->in_age[1] != 0)) 913ab25eeb5Syz155240 return EINVAL; 914ab25eeb5Syz155240 915ab25eeb5Syz155240 n->in_use = 0; 916ab25eeb5Syz155240 if (n->in_redir & NAT_MAPBLK) 917ab25eeb5Syz155240 n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk); 918ab25eeb5Syz155240 else if (n->in_flags & IPN_AUTOPORTMAP) 919ab25eeb5Syz155240 n->in_space = USABLE_PORTS * ~ntohl(n->in_inmsk); 920ab25eeb5Syz155240 else if (n->in_flags & IPN_IPRANGE) 921ab25eeb5Syz155240 n->in_space = ntohl(n->in_outmsk) - ntohl(n->in_outip); 922ab25eeb5Syz155240 else if (n->in_flags & IPN_SPLIT) 923ab25eeb5Syz155240 n->in_space = 2; 924ab25eeb5Syz155240 else if (n->in_outmsk != 0) 925ab25eeb5Syz155240 n->in_space = ~ntohl(n->in_outmsk); 926ab25eeb5Syz155240 else 927ab25eeb5Syz155240 n->in_space = 1; 928ab25eeb5Syz155240 929ab25eeb5Syz155240 /* 930ab25eeb5Syz155240 * Calculate the number of valid IP addresses in the output 931ab25eeb5Syz155240 * mapping range. In all cases, the range is inclusive of 932ab25eeb5Syz155240 * the start and ending IP addresses. 933ab25eeb5Syz155240 * If to a CIDR address, lose 2: broadcast + network address 934ab25eeb5Syz155240 * (so subtract 1) 935ab25eeb5Syz155240 * If to a range, add one. 936ab25eeb5Syz155240 * If to a single IP address, set to 1. 937ab25eeb5Syz155240 */ 938ab25eeb5Syz155240 if (n->in_space) { 939ab25eeb5Syz155240 if ((n->in_flags & IPN_IPRANGE) != 0) 940ab25eeb5Syz155240 n->in_space += 1; 941ab25eeb5Syz155240 else 942ab25eeb5Syz155240 n->in_space -= 1; 943ab25eeb5Syz155240 } else 944ab25eeb5Syz155240 n->in_space = 1; 945ab25eeb5Syz155240 946ab25eeb5Syz155240 if ((n->in_outmsk != 0xffffffff) && (n->in_outmsk != 0) && 947ab25eeb5Syz155240 ((n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0)) 948ab25eeb5Syz155240 n->in_nip = ntohl(n->in_outip) + 1; 949ab25eeb5Syz155240 else if ((n->in_flags & IPN_SPLIT) && 950ab25eeb5Syz155240 (n->in_redir & NAT_REDIRECT)) 951ab25eeb5Syz155240 n->in_nip = ntohl(n->in_inip); 952ab25eeb5Syz155240 else 953ab25eeb5Syz155240 n->in_nip = ntohl(n->in_outip); 954ab25eeb5Syz155240 if (n->in_redir & NAT_MAP) { 955ab25eeb5Syz155240 n->in_pnext = ntohs(n->in_pmin); 956ab25eeb5Syz155240 /* 957ab25eeb5Syz155240 * Multiply by the number of ports made available. 958ab25eeb5Syz155240 */ 959ab25eeb5Syz155240 if (ntohs(n->in_pmax) >= ntohs(n->in_pmin)) { 960ab25eeb5Syz155240 n->in_space *= (ntohs(n->in_pmax) - 961ab25eeb5Syz155240 ntohs(n->in_pmin) + 1); 962ab25eeb5Syz155240 /* 963ab25eeb5Syz155240 * Because two different sources can map to 964ab25eeb5Syz155240 * different destinations but use the same 965ab25eeb5Syz155240 * local IP#/port #. 966ab25eeb5Syz155240 * If the result is smaller than in_space, then 967ab25eeb5Syz155240 * we may have wrapped around 32bits. 968ab25eeb5Syz155240 */ 969ab25eeb5Syz155240 i = n->in_inmsk; 970ab25eeb5Syz155240 if ((i != 0) && (i != 0xffffffff)) { 971ab25eeb5Syz155240 j = n->in_space * (~ntohl(i) + 1); 972ab25eeb5Syz155240 if (j >= n->in_space) 973ab25eeb5Syz155240 n->in_space = j; 974ab25eeb5Syz155240 else 975ab25eeb5Syz155240 n->in_space = 0xffffffff; 976ab25eeb5Syz155240 } 977ab25eeb5Syz155240 } 978ab25eeb5Syz155240 /* 979ab25eeb5Syz155240 * If no protocol is specified, multiple by 256 to allow for 980ab25eeb5Syz155240 * at least one IP:IP mapping per protocol. 981ab25eeb5Syz155240 */ 982ab25eeb5Syz155240 if ((n->in_flags & IPN_TCPUDPICMP) == 0) { 983ab25eeb5Syz155240 j = n->in_space * 256; 984ab25eeb5Syz155240 if (j >= n->in_space) 985ab25eeb5Syz155240 n->in_space = j; 986ab25eeb5Syz155240 else 987ab25eeb5Syz155240 n->in_space = 0xffffffff; 988ab25eeb5Syz155240 } 989ab25eeb5Syz155240 } 990ab25eeb5Syz155240 991ab25eeb5Syz155240 /* Otherwise, these fields are preset */ 992ab25eeb5Syz155240 993ab25eeb5Syz155240 if (getlock) { 994f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 995ab25eeb5Syz155240 } 996ab25eeb5Syz155240 n->in_next = NULL; 997ab25eeb5Syz155240 *np = n; 998ab25eeb5Syz155240 999ab25eeb5Syz155240 if (n->in_age[0] != 0) 1000f4b3ec61Sdh155122 n->in_tqehead[0] = fr_addtimeoutqueue(&ifs->ifs_nat_utqe, 1001f4b3ec61Sdh155122 n->in_age[0], ifs); 1002ab25eeb5Syz155240 1003ab25eeb5Syz155240 if (n->in_age[1] != 0) 1004f4b3ec61Sdh155122 n->in_tqehead[1] = fr_addtimeoutqueue(&ifs->ifs_nat_utqe, 1005f4b3ec61Sdh155122 n->in_age[1], ifs); 1006ab25eeb5Syz155240 1007ab25eeb5Syz155240 if (n->in_redir & NAT_REDIRECT) { 1008ab25eeb5Syz155240 n->in_flags &= ~IPN_NOTDST; 1009f4b3ec61Sdh155122 nat_addrdr(n, ifs); 1010ab25eeb5Syz155240 } 1011ab25eeb5Syz155240 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) { 1012ab25eeb5Syz155240 n->in_flags &= ~IPN_NOTSRC; 1013f4b3ec61Sdh155122 nat_addnat(n, ifs); 1014ab25eeb5Syz155240 } 1015ab25eeb5Syz155240 n = NULL; 1016f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules++; 1017ab25eeb5Syz155240 if (getlock) { 1018f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); /* WRITE */ 1019ab25eeb5Syz155240 } 1020ab25eeb5Syz155240 1021ab25eeb5Syz155240 return error; 1022ab25eeb5Syz155240 } 1023ab25eeb5Syz155240 1024ab25eeb5Syz155240 1025ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1026ab25eeb5Syz155240 /* Function: nat_resolvrule */ 1027dcf3e898Sjojemann /* Returns: int - 0 == success, -1 == failure */ 1028ab25eeb5Syz155240 /* Parameters: n(I) - pointer to NAT rule */ 1029ab25eeb5Syz155240 /* */ 1030dcf3e898Sjojemann /* Resolve some of the details inside the NAT rule. Includes resolving */ 1031dcf3e898Sjojemann /* any specified interfaces and proxy labels, and determines whether or not */ 1032dcf3e898Sjojemann /* all proxy labels are correctly specified. */ 1033dcf3e898Sjojemann /* */ 1034dcf3e898Sjojemann /* Called by nat_siocaddnat() (SIOCADNAT) and fr_natputent (SIOCSTPUT). */ 1035ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1036dcf3e898Sjojemann static int nat_resolverule(n, ifs) 1037ab25eeb5Syz155240 ipnat_t *n; 1038f4b3ec61Sdh155122 ipf_stack_t *ifs; 1039ab25eeb5Syz155240 { 1040ab25eeb5Syz155240 n->in_ifnames[0][LIFNAMSIZ - 1] = '\0'; 1041f4b3ec61Sdh155122 n->in_ifps[0] = fr_resolvenic(n->in_ifnames[0], 4, ifs); 1042ab25eeb5Syz155240 1043ab25eeb5Syz155240 n->in_ifnames[1][LIFNAMSIZ - 1] = '\0'; 1044ab25eeb5Syz155240 if (n->in_ifnames[1][0] == '\0') { 1045ab25eeb5Syz155240 (void) strncpy(n->in_ifnames[1], n->in_ifnames[0], LIFNAMSIZ); 1046ab25eeb5Syz155240 n->in_ifps[1] = n->in_ifps[0]; 1047ab25eeb5Syz155240 } else { 1048d3675867Sjojemann n->in_ifps[1] = fr_resolvenic(n->in_ifnames[1], 4, ifs); 1049ab25eeb5Syz155240 } 1050ab25eeb5Syz155240 1051ab25eeb5Syz155240 if (n->in_plabel[0] != '\0') { 1052f4b3ec61Sdh155122 n->in_apr = appr_lookup(n->in_p, n->in_plabel, ifs); 1053dcf3e898Sjojemann if (n->in_apr == NULL) 1054dcf3e898Sjojemann return -1; 1055ab25eeb5Syz155240 } 1056dcf3e898Sjojemann return 0; 1057ab25eeb5Syz155240 } 1058ab25eeb5Syz155240 1059ab25eeb5Syz155240 1060ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1061ab25eeb5Syz155240 /* Function: nat_siocdelnat */ 1062ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 == failure */ 1063ab25eeb5Syz155240 /* Parameters: n(I) - pointer to new NAT rule */ 1064ab25eeb5Syz155240 /* np(I) - pointer to where to insert new NAT rule */ 1065ab25eeb5Syz155240 /* getlock(I) - flag indicating if lock on ipf_nat is held */ 1066ab25eeb5Syz155240 /* Mutex Locks: ipf_natio */ 1067ab25eeb5Syz155240 /* */ 1068ab25eeb5Syz155240 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */ 1069ab25eeb5Syz155240 /* from information passed to the kernel, then add it to the appropriate */ 1070ab25eeb5Syz155240 /* NAT rule table(s). */ 1071ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1072f4b3ec61Sdh155122 static void nat_siocdelnat(n, np, getlock, ifs) 1073ab25eeb5Syz155240 ipnat_t *n, **np; 1074ab25eeb5Syz155240 int getlock; 1075f4b3ec61Sdh155122 ipf_stack_t *ifs; 1076ab25eeb5Syz155240 { 1077ab25eeb5Syz155240 if (getlock) { 1078f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 1079ab25eeb5Syz155240 } 1080ab25eeb5Syz155240 if (n->in_redir & NAT_REDIRECT) 1081ab25eeb5Syz155240 nat_delrdr(n); 1082ab25eeb5Syz155240 if (n->in_redir & (NAT_MAPBLK|NAT_MAP)) 1083ab25eeb5Syz155240 nat_delnat(n); 1084f4b3ec61Sdh155122 if (ifs->ifs_nat_list == NULL) { 1085f4b3ec61Sdh155122 ifs->ifs_nat_masks = 0; 1086f4b3ec61Sdh155122 ifs->ifs_rdr_masks = 0; 1087ab25eeb5Syz155240 } 1088ab25eeb5Syz155240 1089ab25eeb5Syz155240 if (n->in_tqehead[0] != NULL) { 1090ab25eeb5Syz155240 if (fr_deletetimeoutqueue(n->in_tqehead[0]) == 0) { 10913805c50fSan207044 fr_freetimeoutqueue(n->in_tqehead[0], ifs); 1092ab25eeb5Syz155240 } 1093ab25eeb5Syz155240 } 1094ab25eeb5Syz155240 1095ab25eeb5Syz155240 if (n->in_tqehead[1] != NULL) { 1096ab25eeb5Syz155240 if (fr_deletetimeoutqueue(n->in_tqehead[1]) == 0) { 1097f4b3ec61Sdh155122 fr_freetimeoutqueue(n->in_tqehead[1], ifs); 1098ab25eeb5Syz155240 } 1099ab25eeb5Syz155240 } 1100ab25eeb5Syz155240 1101ab25eeb5Syz155240 *np = n->in_next; 1102ab25eeb5Syz155240 1103ab25eeb5Syz155240 if (n->in_use == 0) { 1104ab25eeb5Syz155240 if (n->in_apr) 1105ab25eeb5Syz155240 appr_free(n->in_apr); 1106ab25eeb5Syz155240 KFREE(n); 1107f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules--; 1108ab25eeb5Syz155240 } else { 1109ab25eeb5Syz155240 n->in_flags |= IPN_DELETE; 1110ab25eeb5Syz155240 n->in_next = NULL; 1111ab25eeb5Syz155240 } 1112ab25eeb5Syz155240 if (getlock) { 1113f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); /* READ/WRITE */ 1114ab25eeb5Syz155240 } 1115ab25eeb5Syz155240 } 1116ab25eeb5Syz155240 1117ab25eeb5Syz155240 1118ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1119ab25eeb5Syz155240 /* Function: fr_natgetsz */ 1120ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 is the error value. */ 1121ab25eeb5Syz155240 /* Parameters: data(I) - pointer to natget structure with kernel pointer */ 1122ab25eeb5Syz155240 /* get the size of. */ 1123ab25eeb5Syz155240 /* */ 1124ab25eeb5Syz155240 /* Handle SIOCSTGSZ. */ 1125ab25eeb5Syz155240 /* Return the size of the nat list entry to be copied back to user space. */ 1126ab25eeb5Syz155240 /* The size of the entry is stored in the ng_sz field and the enture natget */ 1127ab25eeb5Syz155240 /* structure is copied back to the user. */ 1128ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1129f4b3ec61Sdh155122 static int fr_natgetsz(data, ifs) 1130ab25eeb5Syz155240 caddr_t data; 1131f4b3ec61Sdh155122 ipf_stack_t *ifs; 1132ab25eeb5Syz155240 { 1133ab25eeb5Syz155240 ap_session_t *aps; 1134ab25eeb5Syz155240 nat_t *nat, *n; 1135ab25eeb5Syz155240 natget_t ng; 1136ab25eeb5Syz155240 1137ab25eeb5Syz155240 BCOPYIN(data, &ng, sizeof(ng)); 1138ab25eeb5Syz155240 1139ab25eeb5Syz155240 nat = ng.ng_ptr; 1140ab25eeb5Syz155240 if (!nat) { 1141f4b3ec61Sdh155122 nat = ifs->ifs_nat_instances; 1142ab25eeb5Syz155240 ng.ng_sz = 0; 1143ab25eeb5Syz155240 /* 1144ab25eeb5Syz155240 * Empty list so the size returned is 0. Simple. 1145ab25eeb5Syz155240 */ 1146ab25eeb5Syz155240 if (nat == NULL) { 1147ab25eeb5Syz155240 BCOPYOUT(&ng, data, sizeof(ng)); 1148ab25eeb5Syz155240 return 0; 1149ab25eeb5Syz155240 } 1150ab25eeb5Syz155240 } else { 1151ab25eeb5Syz155240 /* 1152ab25eeb5Syz155240 * Make sure the pointer we're copying from exists in the 1153ab25eeb5Syz155240 * current list of entries. Security precaution to prevent 1154ab25eeb5Syz155240 * copying of random kernel data. 1155ab25eeb5Syz155240 */ 1156f4b3ec61Sdh155122 for (n = ifs->ifs_nat_instances; n; n = n->nat_next) 1157ab25eeb5Syz155240 if (n == nat) 1158ab25eeb5Syz155240 break; 1159ab25eeb5Syz155240 if (!n) 1160ab25eeb5Syz155240 return ESRCH; 1161ab25eeb5Syz155240 } 1162ab25eeb5Syz155240 1163ab25eeb5Syz155240 /* 1164ab25eeb5Syz155240 * Incluse any space required for proxy data structures. 1165ab25eeb5Syz155240 */ 1166ab25eeb5Syz155240 ng.ng_sz = sizeof(nat_save_t); 1167ab25eeb5Syz155240 aps = nat->nat_aps; 1168ab25eeb5Syz155240 if (aps != NULL) { 1169ab25eeb5Syz155240 ng.ng_sz += sizeof(ap_session_t) - 4; 1170ab25eeb5Syz155240 if (aps->aps_data != 0) 1171ab25eeb5Syz155240 ng.ng_sz += aps->aps_psiz; 1172ab25eeb5Syz155240 } 1173ab25eeb5Syz155240 1174ab25eeb5Syz155240 BCOPYOUT(&ng, data, sizeof(ng)); 1175ab25eeb5Syz155240 return 0; 1176ab25eeb5Syz155240 } 1177ab25eeb5Syz155240 1178ab25eeb5Syz155240 1179ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1180ab25eeb5Syz155240 /* Function: fr_natgetent */ 1181ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 is the error value. */ 1182ab25eeb5Syz155240 /* Parameters: data(I) - pointer to natget structure with kernel pointer */ 1183ab25eeb5Syz155240 /* to NAT structure to copy out. */ 1184ab25eeb5Syz155240 /* */ 1185ab25eeb5Syz155240 /* Handle SIOCSTGET. */ 1186ab25eeb5Syz155240 /* Copies out NAT entry to user space. Any additional data held for a */ 1187ab25eeb5Syz155240 /* proxy is also copied, as to is the NAT rule which was responsible for it */ 1188ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1189f4b3ec61Sdh155122 static int fr_natgetent(data, ifs) 1190ab25eeb5Syz155240 caddr_t data; 1191f4b3ec61Sdh155122 ipf_stack_t *ifs; 1192ab25eeb5Syz155240 { 1193ab25eeb5Syz155240 int error, outsize; 1194ab25eeb5Syz155240 ap_session_t *aps; 1195ab25eeb5Syz155240 nat_save_t *ipn, ipns; 1196ab25eeb5Syz155240 nat_t *n, *nat; 1197ab25eeb5Syz155240 1198ab25eeb5Syz155240 error = fr_inobj(data, &ipns, IPFOBJ_NATSAVE); 1199ab25eeb5Syz155240 if (error != 0) 1200ab25eeb5Syz155240 return error; 1201ab25eeb5Syz155240 1202ab25eeb5Syz155240 if ((ipns.ipn_dsize < sizeof(ipns)) || (ipns.ipn_dsize > 81920)) 1203ab25eeb5Syz155240 return EINVAL; 1204ab25eeb5Syz155240 1205ab25eeb5Syz155240 KMALLOCS(ipn, nat_save_t *, ipns.ipn_dsize); 1206ab25eeb5Syz155240 if (ipn == NULL) 1207ab25eeb5Syz155240 return ENOMEM; 1208ab25eeb5Syz155240 1209ab25eeb5Syz155240 ipn->ipn_dsize = ipns.ipn_dsize; 1210ab25eeb5Syz155240 nat = ipns.ipn_next; 1211ab25eeb5Syz155240 if (nat == NULL) { 1212f4b3ec61Sdh155122 nat = ifs->ifs_nat_instances; 1213ab25eeb5Syz155240 if (nat == NULL) { 1214f4b3ec61Sdh155122 if (ifs->ifs_nat_instances == NULL) 1215ab25eeb5Syz155240 error = ENOENT; 1216ab25eeb5Syz155240 goto finished; 1217ab25eeb5Syz155240 } 1218ab25eeb5Syz155240 } else { 1219ab25eeb5Syz155240 /* 1220ab25eeb5Syz155240 * Make sure the pointer we're copying from exists in the 1221ab25eeb5Syz155240 * current list of entries. Security precaution to prevent 1222ab25eeb5Syz155240 * copying of random kernel data. 1223ab25eeb5Syz155240 */ 1224f4b3ec61Sdh155122 for (n = ifs->ifs_nat_instances; n; n = n->nat_next) 1225ab25eeb5Syz155240 if (n == nat) 1226ab25eeb5Syz155240 break; 1227ab25eeb5Syz155240 if (n == NULL) { 1228ab25eeb5Syz155240 error = ESRCH; 1229ab25eeb5Syz155240 goto finished; 1230ab25eeb5Syz155240 } 1231ab25eeb5Syz155240 } 1232ab25eeb5Syz155240 ipn->ipn_next = nat->nat_next; 1233ab25eeb5Syz155240 1234ab25eeb5Syz155240 /* 1235ab25eeb5Syz155240 * Copy the NAT structure. 1236ab25eeb5Syz155240 */ 1237ab25eeb5Syz155240 bcopy((char *)nat, &ipn->ipn_nat, sizeof(*nat)); 1238ab25eeb5Syz155240 1239ab25eeb5Syz155240 /* 1240ab25eeb5Syz155240 * If we have a pointer to the NAT rule it belongs to, save that too. 1241ab25eeb5Syz155240 */ 1242ab25eeb5Syz155240 if (nat->nat_ptr != NULL) 1243ab25eeb5Syz155240 bcopy((char *)nat->nat_ptr, (char *)&ipn->ipn_ipnat, 1244ab25eeb5Syz155240 sizeof(ipn->ipn_ipnat)); 1245ab25eeb5Syz155240 1246ab25eeb5Syz155240 /* 1247ab25eeb5Syz155240 * If we also know the NAT entry has an associated filter rule, 1248ab25eeb5Syz155240 * save that too. 1249ab25eeb5Syz155240 */ 1250ab25eeb5Syz155240 if (nat->nat_fr != NULL) 1251ab25eeb5Syz155240 bcopy((char *)nat->nat_fr, (char *)&ipn->ipn_fr, 1252ab25eeb5Syz155240 sizeof(ipn->ipn_fr)); 1253ab25eeb5Syz155240 1254ab25eeb5Syz155240 /* 1255ab25eeb5Syz155240 * Last but not least, if there is an application proxy session set 1256ab25eeb5Syz155240 * up for this NAT entry, then copy that out too, including any 1257ab25eeb5Syz155240 * private data saved along side it by the proxy. 1258ab25eeb5Syz155240 */ 1259ab25eeb5Syz155240 aps = nat->nat_aps; 1260ab25eeb5Syz155240 outsize = ipn->ipn_dsize - sizeof(*ipn) + sizeof(ipn->ipn_data); 1261ab25eeb5Syz155240 if (aps != NULL) { 1262ab25eeb5Syz155240 char *s; 1263ab25eeb5Syz155240 1264ab25eeb5Syz155240 if (outsize < sizeof(*aps)) { 1265ab25eeb5Syz155240 error = ENOBUFS; 1266ab25eeb5Syz155240 goto finished; 1267ab25eeb5Syz155240 } 1268ab25eeb5Syz155240 1269ab25eeb5Syz155240 s = ipn->ipn_data; 1270ab25eeb5Syz155240 bcopy((char *)aps, s, sizeof(*aps)); 1271ab25eeb5Syz155240 s += sizeof(*aps); 1272ab25eeb5Syz155240 outsize -= sizeof(*aps); 1273ab25eeb5Syz155240 if ((aps->aps_data != NULL) && (outsize >= aps->aps_psiz)) 1274ab25eeb5Syz155240 bcopy(aps->aps_data, s, aps->aps_psiz); 1275ab25eeb5Syz155240 else 1276ab25eeb5Syz155240 error = ENOBUFS; 1277ab25eeb5Syz155240 } 1278ab25eeb5Syz155240 if (error == 0) { 1279ab25eeb5Syz155240 error = fr_outobjsz(data, ipn, IPFOBJ_NATSAVE, ipns.ipn_dsize); 1280ab25eeb5Syz155240 } 1281ab25eeb5Syz155240 1282ab25eeb5Syz155240 finished: 1283ab25eeb5Syz155240 if (ipn != NULL) { 1284ab25eeb5Syz155240 KFREES(ipn, ipns.ipn_dsize); 1285ab25eeb5Syz155240 } 1286ab25eeb5Syz155240 return error; 1287ab25eeb5Syz155240 } 1288ab25eeb5Syz155240 12893c50f6d6San207044 /* ------------------------------------------------------------------------ */ 12903c50f6d6San207044 /* Function: nat_calc_chksum_diffs */ 12913c50f6d6San207044 /* Returns: void */ 12923c50f6d6San207044 /* Parameters: nat - pointer to NAT table entry */ 12933c50f6d6San207044 /* */ 12943c50f6d6San207044 /* Function calculates chksum deltas for IP header (nat_ipsumd) and TCP/UDP */ 12953c50f6d6San207044 /* headers (nat_sumd). The things for L4 (UDP/TCP) get complicated when */ 12963c50f6d6San207044 /* we are dealing with partial chksum offload. For these cases we need to */ 12973c50f6d6San207044 /* compute a 'partial chksum delta'. The 'partial chksum delta'is stored */ 12983c50f6d6San207044 /* into nat_sumd[1], while ordinary chksum delta for TCP/UDP is in */ 12993c50f6d6San207044 /* nat_sumd[0]. */ 13003c50f6d6San207044 /* */ 13013c50f6d6San207044 /* The function accepts initialized NAT table entry and computes the deltas */ 13023c50f6d6San207044 /* from nat_inip/nat_outip members. The function is called right before */ 13033c50f6d6San207044 /* the new entry is inserted into the table. */ 13043c50f6d6San207044 /* */ 13053c50f6d6San207044 /* The ipsumd (IP hedaer chksum delta adjustment) is computed as a chksum */ 13063c50f6d6San207044 /* of delta between original and new IP addresses. */ 13073c50f6d6San207044 /* */ 13083c50f6d6San207044 /* the nat_sumd[0] (TCP/UDP header chksum delta adjustment) is computed as */ 13093c50f6d6San207044 /* a chkusm of delta between original an new IP addrress:port tupples. */ 13103c50f6d6San207044 /* */ 13113c50f6d6San207044 /* Some facts about chksum, we should remember: */ 13123c50f6d6San207044 /* IP header chksum covers IP header only */ 13133c50f6d6San207044 /* */ 13143c50f6d6San207044 /* TCP/UDP chksum covers data payload and so called pseudo header */ 13153c50f6d6San207044 /* SRC, DST IP address */ 13163c50f6d6San207044 /* SRC, DST Port */ 13173c50f6d6San207044 /* length of payload */ 13183c50f6d6San207044 /* */ 13193c50f6d6San207044 /* The partial chksum delta (nat_sumd[1] is used to adjust db_ckusm16 */ 13203c50f6d6San207044 /* member of dblk_t structure. The db_ckusm16 member is not part of */ 13213c50f6d6San207044 /* IP/UDP/TCP header it is 16 bit value computed by NIC driver with partial */ 13223c50f6d6San207044 /* chksum offload capacbility for every inbound packet. The db_cksum16 is */ 13233c50f6d6San207044 /* stored along with other IP packet data in dblk_t structure and used in */ 13243c50f6d6San207044 /* for IP/UDP/TCP chksum validation later in ip.c. */ 13253c50f6d6San207044 /* */ 13263c50f6d6San207044 /* The partial chksum delta (adjustment, nat_sumd[1]) is computed as chksum */ 13273c50f6d6San207044 /* of delta between new and orig address. NOTE: the order of operands for */ 13283c50f6d6San207044 /* partial delta operation is swapped compared to computing the IP/TCP/UDP */ 13293c50f6d6San207044 /* header adjustment. It is by design see (IP_CKSUM_RECV() macro in ip.c). */ 13303c50f6d6San207044 /* */ 13313c50f6d6San207044 /* ------------------------------------------------------------------------ */ 13323c50f6d6San207044 static void nat_calc_chksum_diffs(nat) 13333c50f6d6San207044 nat_t *nat; 13343c50f6d6San207044 { 13353c50f6d6San207044 u_32_t sum_orig = 0; 13363c50f6d6San207044 u_32_t sum_changed = 0; 13373c50f6d6San207044 u_32_t sumd; 13383c50f6d6San207044 u_32_t ipsum_orig = 0; 13393c50f6d6San207044 u_32_t ipsum_changed = 0; 13403c50f6d6San207044 13413c50f6d6San207044 /* 13423c50f6d6San207044 * the switch calculates operands for CALC_SUMD(), 13433c50f6d6San207044 * which will compute the partial chksum delta. 13443c50f6d6San207044 */ 13453c50f6d6San207044 switch (nat->nat_dir) 13463c50f6d6San207044 { 13473c50f6d6San207044 case NAT_INBOUND: 13483c50f6d6San207044 /* 13493c50f6d6San207044 * we are dealing with RDR rule (DST address gets 13503c50f6d6San207044 * modified on packet from client) 13513c50f6d6San207044 */ 13523c50f6d6San207044 sum_changed = LONG_SUM(ntohl(nat->nat_inip.s_addr)); 13533c50f6d6San207044 sum_orig = LONG_SUM(ntohl(nat->nat_outip.s_addr)); 13543c50f6d6San207044 break; 13553c50f6d6San207044 case NAT_OUTBOUND: 13563c50f6d6San207044 /* 13573c50f6d6San207044 * we are dealing with MAP rule (SRC address gets 13583c50f6d6San207044 * modified on packet from client) 13593c50f6d6San207044 */ 13603c50f6d6San207044 sum_changed = LONG_SUM(ntohl(nat->nat_outip.s_addr)); 13613c50f6d6San207044 sum_orig = LONG_SUM(ntohl(nat->nat_inip.s_addr)); 13623c50f6d6San207044 break; 13633c50f6d6San207044 default: ; 13643c50f6d6San207044 break; 13653c50f6d6San207044 } 13663c50f6d6San207044 13673c50f6d6San207044 /* 13683c50f6d6San207044 * we also preserve CALC_SUMD() operands here, for IP chksum delta 13693c50f6d6San207044 * calculation, which happens at the end of function. 13703c50f6d6San207044 */ 13713c50f6d6San207044 ipsum_changed = sum_changed; 13723c50f6d6San207044 ipsum_orig = sum_orig; 13733c50f6d6San207044 /* 13743c50f6d6San207044 * NOTE: the order of operands for partial chksum adjustment 13753c50f6d6San207044 * computation has to be swapped! 13763c50f6d6San207044 */ 13773c50f6d6San207044 CALC_SUMD(sum_changed, sum_orig, sumd); 13783c50f6d6San207044 nat->nat_sumd[1] = (sumd & 0xffff) + (sumd >> 16); 13793c50f6d6San207044 1380*27dbc409San207044 if (nat->nat_flags & (IPN_TCPUDP | IPN_ICMPQUERY)) { 13813c50f6d6San207044 13823c50f6d6San207044 /* 13833c50f6d6San207044 * switch calculates operands for CALC_SUMD(), which will 13843c50f6d6San207044 * compute the full chksum delta. 13853c50f6d6San207044 */ 13863c50f6d6San207044 switch (nat->nat_dir) 13873c50f6d6San207044 { 13883c50f6d6San207044 case NAT_INBOUND: 13893c50f6d6San207044 sum_changed = LONG_SUM( 13903c50f6d6San207044 ntohl(nat->nat_inip.s_addr) + 13913c50f6d6San207044 ntohs(nat->nat_inport) 13923c50f6d6San207044 ); 13933c50f6d6San207044 sum_orig = LONG_SUM( 13943c50f6d6San207044 ntohl(nat->nat_outip.s_addr) + 13953c50f6d6San207044 ntohs(nat->nat_outport) 13963c50f6d6San207044 ); 13973c50f6d6San207044 break; 13983c50f6d6San207044 case NAT_OUTBOUND: 13993c50f6d6San207044 sum_changed = LONG_SUM( 14003c50f6d6San207044 ntohl(nat->nat_outip.s_addr) + 14013c50f6d6San207044 ntohs(nat->nat_outport) 14023c50f6d6San207044 ); 14033c50f6d6San207044 sum_orig = LONG_SUM( 14043c50f6d6San207044 ntohl(nat->nat_inip.s_addr) + 14053c50f6d6San207044 ntohs(nat->nat_inport) 14063c50f6d6San207044 ); 14073c50f6d6San207044 break; 14083c50f6d6San207044 default: ; 14093c50f6d6San207044 break; 14103c50f6d6San207044 } 14113c50f6d6San207044 14123c50f6d6San207044 CALC_SUMD(sum_orig, sum_changed, sumd); 14133c50f6d6San207044 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 1414*27dbc409San207044 1415*27dbc409San207044 if (!(nat->nat_flags & IPN_TCPUDP)) { 1416*27dbc409San207044 /* 1417*27dbc409San207044 * partial HW chksum offload works for TCP/UDP headers only, 1418*27dbc409San207044 * so we need to enforce full chksum adjustment for ICMP 1419*27dbc409San207044 */ 1420*27dbc409San207044 nat->nat_sumd[1] = nat->nat_sumd[0]; 1421*27dbc409San207044 } 14223c50f6d6San207044 } 14233c50f6d6San207044 else 14243c50f6d6San207044 nat->nat_sumd[0] = nat->nat_sumd[1]; 14253c50f6d6San207044 14263c50f6d6San207044 /* 14273c50f6d6San207044 * we may reuse the already computed nat_sumd[0] for IP header chksum 14283c50f6d6San207044 * adjustment in case the L4 (TCP/UDP header) is not changed by NAT. 14293c50f6d6San207044 */ 14303c50f6d6San207044 if (NAT_HAS_L4_CHANGED(nat)) { 14313c50f6d6San207044 /* 14323c50f6d6San207044 * bad luck, NAT changes also the L4 header, use IP addresses 14333c50f6d6San207044 * to compute chksum adjustment for IP header. 14343c50f6d6San207044 */ 14353c50f6d6San207044 CALC_SUMD(ipsum_orig, ipsum_changed, sumd); 14363c50f6d6San207044 nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16); 14373c50f6d6San207044 } 14383c50f6d6San207044 else { 14393c50f6d6San207044 /* 14403c50f6d6San207044 * the NAT does not change L4 hdr -> reuse chksum adjustment 14413c50f6d6San207044 * for IP hdr. 14423c50f6d6San207044 */ 14433c50f6d6San207044 nat->nat_ipsumd = nat->nat_sumd[0]; 1444*27dbc409San207044 1445*27dbc409San207044 /* 1446*27dbc409San207044 * if L4 header does not use chkusm - zero out deltas 1447*27dbc409San207044 */ 1448*27dbc409San207044 if (!(nat->nat_flags & IPN_TCPUDPICMP)) { 1449*27dbc409San207044 nat->nat_sumd[0] = 0; 1450*27dbc409San207044 nat->nat_sumd[1] = 0; 1451*27dbc409San207044 } 14523c50f6d6San207044 } 14533c50f6d6San207044 14543c50f6d6San207044 return; 14553c50f6d6San207044 } 1456ab25eeb5Syz155240 1457ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1458ab25eeb5Syz155240 /* Function: fr_natputent */ 1459ab25eeb5Syz155240 /* Returns: int - 0 == success, != 0 is the error value. */ 1460ab25eeb5Syz155240 /* Parameters: data(I) - pointer to natget structure with NAT */ 1461ab25eeb5Syz155240 /* structure information to load into the kernel */ 1462ab25eeb5Syz155240 /* getlock(I) - flag indicating whether or not a write lock */ 1463ab25eeb5Syz155240 /* on ipf_nat is already held. */ 1464ab25eeb5Syz155240 /* */ 1465ab25eeb5Syz155240 /* Handle SIOCSTPUT. */ 1466ab25eeb5Syz155240 /* Loads a NAT table entry from user space, including a NAT rule, proxy and */ 1467ab25eeb5Syz155240 /* firewall rule data structures, if pointers to them indicate so. */ 1468ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1469f4b3ec61Sdh155122 static int fr_natputent(data, getlock, ifs) 1470ab25eeb5Syz155240 caddr_t data; 1471ab25eeb5Syz155240 int getlock; 1472f4b3ec61Sdh155122 ipf_stack_t *ifs; 1473ab25eeb5Syz155240 { 1474ab25eeb5Syz155240 nat_save_t ipn, *ipnn; 1475ab25eeb5Syz155240 ap_session_t *aps; 1476ab25eeb5Syz155240 nat_t *n, *nat; 1477ab25eeb5Syz155240 frentry_t *fr; 1478ab25eeb5Syz155240 fr_info_t fin; 1479ab25eeb5Syz155240 ipnat_t *in; 1480ab25eeb5Syz155240 int error; 1481ab25eeb5Syz155240 1482ab25eeb5Syz155240 error = fr_inobj(data, &ipn, IPFOBJ_NATSAVE); 1483ab25eeb5Syz155240 if (error != 0) 1484ab25eeb5Syz155240 return error; 1485ab25eeb5Syz155240 1486ab25eeb5Syz155240 /* 14873805c50fSan207044 * Trigger automatic call to nat_extraflush() if the 14883805c50fSan207044 * table has reached capcity specified by hi watermark. 14893805c50fSan207044 */ 14903805c50fSan207044 if (NAT_TAB_WATER_LEVEL(ifs) > ifs->ifs_nat_flush_lvl_hi) 14913805c50fSan207044 ifs->ifs_nat_doflush = 1; 14923805c50fSan207044 14933805c50fSan207044 /* 1494ab25eeb5Syz155240 * Initialise early because of code at junkput label. 1495ab25eeb5Syz155240 */ 1496ab25eeb5Syz155240 in = NULL; 1497ab25eeb5Syz155240 aps = NULL; 1498ab25eeb5Syz155240 nat = NULL; 1499ab25eeb5Syz155240 ipnn = NULL; 1500ab25eeb5Syz155240 1501ab25eeb5Syz155240 /* 1502ab25eeb5Syz155240 * New entry, copy in the rest of the NAT entry if it's size is more 1503ab25eeb5Syz155240 * than just the nat_t structure. 1504ab25eeb5Syz155240 */ 1505ab25eeb5Syz155240 fr = NULL; 1506ab25eeb5Syz155240 if (ipn.ipn_dsize > sizeof(ipn)) { 1507ab25eeb5Syz155240 if (ipn.ipn_dsize > 81920) { 1508ab25eeb5Syz155240 error = ENOMEM; 1509ab25eeb5Syz155240 goto junkput; 1510ab25eeb5Syz155240 } 1511ab25eeb5Syz155240 1512ab25eeb5Syz155240 KMALLOCS(ipnn, nat_save_t *, ipn.ipn_dsize); 1513ab25eeb5Syz155240 if (ipnn == NULL) 1514ab25eeb5Syz155240 return ENOMEM; 1515ab25eeb5Syz155240 1516ab25eeb5Syz155240 error = fr_inobjsz(data, ipnn, IPFOBJ_NATSAVE, ipn.ipn_dsize); 1517ab25eeb5Syz155240 if (error != 0) { 1518ab25eeb5Syz155240 error = EFAULT; 1519ab25eeb5Syz155240 goto junkput; 1520ab25eeb5Syz155240 } 1521ab25eeb5Syz155240 } else 1522ab25eeb5Syz155240 ipnn = &ipn; 1523ab25eeb5Syz155240 1524ab25eeb5Syz155240 KMALLOC(nat, nat_t *); 1525ab25eeb5Syz155240 if (nat == NULL) { 1526ab25eeb5Syz155240 error = ENOMEM; 1527ab25eeb5Syz155240 goto junkput; 1528ab25eeb5Syz155240 } 1529ab25eeb5Syz155240 1530ab25eeb5Syz155240 bcopy((char *)&ipnn->ipn_nat, (char *)nat, sizeof(*nat)); 1531ab25eeb5Syz155240 /* 1532ab25eeb5Syz155240 * Initialize all these so that nat_delete() doesn't cause a crash. 1533ab25eeb5Syz155240 */ 1534ab25eeb5Syz155240 bzero((char *)nat, offsetof(struct nat, nat_tqe)); 1535ab25eeb5Syz155240 nat->nat_tqe.tqe_pnext = NULL; 1536ab25eeb5Syz155240 nat->nat_tqe.tqe_next = NULL; 1537ab25eeb5Syz155240 nat->nat_tqe.tqe_ifq = NULL; 1538ab25eeb5Syz155240 nat->nat_tqe.tqe_parent = nat; 1539ab25eeb5Syz155240 1540ab25eeb5Syz155240 /* 1541ab25eeb5Syz155240 * Restore the rule associated with this nat session 1542ab25eeb5Syz155240 */ 1543ab25eeb5Syz155240 in = ipnn->ipn_nat.nat_ptr; 1544ab25eeb5Syz155240 if (in != NULL) { 1545ab25eeb5Syz155240 KMALLOC(in, ipnat_t *); 1546ab25eeb5Syz155240 nat->nat_ptr = in; 1547ab25eeb5Syz155240 if (in == NULL) { 1548ab25eeb5Syz155240 error = ENOMEM; 1549ab25eeb5Syz155240 goto junkput; 1550ab25eeb5Syz155240 } 1551ab25eeb5Syz155240 bzero((char *)in, offsetof(struct ipnat, in_next6)); 1552ab25eeb5Syz155240 bcopy((char *)&ipnn->ipn_ipnat, (char *)in, sizeof(*in)); 1553ab25eeb5Syz155240 in->in_use = 1; 1554ab25eeb5Syz155240 in->in_flags |= IPN_DELETE; 1555ab25eeb5Syz155240 1556f4b3ec61Sdh155122 ATOMIC_INC(ifs->ifs_nat_stats.ns_rules); 1557ab25eeb5Syz155240 1558dcf3e898Sjojemann if (nat_resolverule(in, ifs) != 0) { 1559dcf3e898Sjojemann error = ESRCH; 1560dcf3e898Sjojemann goto junkput; 1561dcf3e898Sjojemann } 1562ab25eeb5Syz155240 } 1563ab25eeb5Syz155240 1564ab25eeb5Syz155240 /* 1565ab25eeb5Syz155240 * Check that the NAT entry doesn't already exist in the kernel. 1566ab25eeb5Syz155240 */ 1567ab25eeb5Syz155240 bzero((char *)&fin, sizeof(fin)); 1568ab25eeb5Syz155240 fin.fin_p = nat->nat_p; 156975c9105fSjojemann fin.fin_ifs = ifs; 1570ab25eeb5Syz155240 if (nat->nat_dir == NAT_OUTBOUND) { 1571ab25eeb5Syz155240 fin.fin_data[0] = ntohs(nat->nat_oport); 1572ab25eeb5Syz155240 fin.fin_data[1] = ntohs(nat->nat_outport); 1573e6c6c1faSyz155240 fin.fin_ifp = nat->nat_ifps[0]; 1574ab25eeb5Syz155240 if (getlock) { 1575f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 1576ab25eeb5Syz155240 } 1577ab25eeb5Syz155240 n = nat_inlookup(&fin, nat->nat_flags, fin.fin_p, 1578ab25eeb5Syz155240 nat->nat_oip, nat->nat_outip); 1579ab25eeb5Syz155240 if (getlock) { 1580f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1581ab25eeb5Syz155240 } 1582ab25eeb5Syz155240 if (n != NULL) { 1583ab25eeb5Syz155240 error = EEXIST; 1584ab25eeb5Syz155240 goto junkput; 1585ab25eeb5Syz155240 } 1586ab25eeb5Syz155240 } else if (nat->nat_dir == NAT_INBOUND) { 1587ab25eeb5Syz155240 fin.fin_data[0] = ntohs(nat->nat_inport); 1588ab25eeb5Syz155240 fin.fin_data[1] = ntohs(nat->nat_oport); 1589e6c6c1faSyz155240 fin.fin_ifp = nat->nat_ifps[1]; 1590ab25eeb5Syz155240 if (getlock) { 1591f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 1592ab25eeb5Syz155240 } 1593ab25eeb5Syz155240 n = nat_outlookup(&fin, nat->nat_flags, fin.fin_p, 1594e6c6c1faSyz155240 nat->nat_inip, nat->nat_oip); 1595ab25eeb5Syz155240 if (getlock) { 1596f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1597ab25eeb5Syz155240 } 1598ab25eeb5Syz155240 if (n != NULL) { 1599ab25eeb5Syz155240 error = EEXIST; 1600ab25eeb5Syz155240 goto junkput; 1601ab25eeb5Syz155240 } 1602ab25eeb5Syz155240 } else { 1603ab25eeb5Syz155240 error = EINVAL; 1604ab25eeb5Syz155240 goto junkput; 1605ab25eeb5Syz155240 } 1606ab25eeb5Syz155240 1607ab25eeb5Syz155240 /* 1608ab25eeb5Syz155240 * Restore ap_session_t structure. Include the private data allocated 1609ab25eeb5Syz155240 * if it was there. 1610ab25eeb5Syz155240 */ 1611ab25eeb5Syz155240 aps = nat->nat_aps; 1612ab25eeb5Syz155240 if (aps != NULL) { 1613ab25eeb5Syz155240 KMALLOC(aps, ap_session_t *); 1614ab25eeb5Syz155240 nat->nat_aps = aps; 1615ab25eeb5Syz155240 if (aps == NULL) { 1616ab25eeb5Syz155240 error = ENOMEM; 1617ab25eeb5Syz155240 goto junkput; 1618ab25eeb5Syz155240 } 1619ab25eeb5Syz155240 bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps)); 1620ab25eeb5Syz155240 if (in != NULL) 1621ab25eeb5Syz155240 aps->aps_apr = in->in_apr; 1622ab25eeb5Syz155240 else 1623ab25eeb5Syz155240 aps->aps_apr = NULL; 1624ab25eeb5Syz155240 if (aps->aps_psiz != 0) { 1625ab25eeb5Syz155240 if (aps->aps_psiz > 81920) { 1626ab25eeb5Syz155240 error = ENOMEM; 1627ab25eeb5Syz155240 goto junkput; 1628ab25eeb5Syz155240 } 1629ab25eeb5Syz155240 KMALLOCS(aps->aps_data, void *, aps->aps_psiz); 1630ab25eeb5Syz155240 if (aps->aps_data == NULL) { 1631ab25eeb5Syz155240 error = ENOMEM; 1632ab25eeb5Syz155240 goto junkput; 1633ab25eeb5Syz155240 } 1634ab25eeb5Syz155240 bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data, 1635ab25eeb5Syz155240 aps->aps_psiz); 1636ab25eeb5Syz155240 } else { 1637ab25eeb5Syz155240 aps->aps_psiz = 0; 1638ab25eeb5Syz155240 aps->aps_data = NULL; 1639ab25eeb5Syz155240 } 1640ab25eeb5Syz155240 } 1641ab25eeb5Syz155240 1642ab25eeb5Syz155240 /* 1643ab25eeb5Syz155240 * If there was a filtering rule associated with this entry then 1644ab25eeb5Syz155240 * build up a new one. 1645ab25eeb5Syz155240 */ 1646ab25eeb5Syz155240 fr = nat->nat_fr; 1647ab25eeb5Syz155240 if (fr != NULL) { 1648ab25eeb5Syz155240 if ((nat->nat_flags & SI_NEWFR) != 0) { 1649ab25eeb5Syz155240 KMALLOC(fr, frentry_t *); 1650ab25eeb5Syz155240 nat->nat_fr = fr; 1651ab25eeb5Syz155240 if (fr == NULL) { 1652ab25eeb5Syz155240 error = ENOMEM; 1653ab25eeb5Syz155240 goto junkput; 1654ab25eeb5Syz155240 } 1655ab25eeb5Syz155240 ipnn->ipn_nat.nat_fr = fr; 1656ab25eeb5Syz155240 (void) fr_outobj(data, ipnn, IPFOBJ_NATSAVE); 1657ab25eeb5Syz155240 bcopy((char *)&ipnn->ipn_fr, (char *)fr, sizeof(*fr)); 1658dcf3e898Sjojemann 1659dcf3e898Sjojemann fr->fr_ref = 1; 1660dcf3e898Sjojemann fr->fr_dsize = 0; 1661dcf3e898Sjojemann fr->fr_data = NULL; 1662dcf3e898Sjojemann fr->fr_type = FR_T_NONE; 1663dcf3e898Sjojemann 1664ab25eeb5Syz155240 MUTEX_NUKE(&fr->fr_lock); 1665ab25eeb5Syz155240 MUTEX_INIT(&fr->fr_lock, "nat-filter rule lock"); 1666ab25eeb5Syz155240 } else { 1667dcf3e898Sjojemann if (getlock) { 1668f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 1669dcf3e898Sjojemann } 1670f4b3ec61Sdh155122 for (n = ifs->ifs_nat_instances; n; n = n->nat_next) 1671ab25eeb5Syz155240 if (n->nat_fr == fr) 1672ab25eeb5Syz155240 break; 1673ab25eeb5Syz155240 1674ab25eeb5Syz155240 if (n != NULL) { 1675ab25eeb5Syz155240 MUTEX_ENTER(&fr->fr_lock); 1676ab25eeb5Syz155240 fr->fr_ref++; 1677ab25eeb5Syz155240 MUTEX_EXIT(&fr->fr_lock); 1678ab25eeb5Syz155240 } 1679dcf3e898Sjojemann if (getlock) { 1680f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1681dcf3e898Sjojemann } 1682ab25eeb5Syz155240 if (!n) { 1683ab25eeb5Syz155240 error = ESRCH; 1684ab25eeb5Syz155240 goto junkput; 1685ab25eeb5Syz155240 } 1686ab25eeb5Syz155240 } 1687ab25eeb5Syz155240 } 1688ab25eeb5Syz155240 1689ab25eeb5Syz155240 if (ipnn != &ipn) { 1690ab25eeb5Syz155240 KFREES(ipnn, ipn.ipn_dsize); 1691ab25eeb5Syz155240 ipnn = NULL; 1692ab25eeb5Syz155240 } 1693ab25eeb5Syz155240 16943c50f6d6San207044 nat_calc_chksum_diffs(nat); 16953c50f6d6San207044 1696ab25eeb5Syz155240 if (getlock) { 1697f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 1698ab25eeb5Syz155240 } 1699f4b3ec61Sdh155122 error = nat_insert(nat, nat->nat_rev, ifs); 1700ab25eeb5Syz155240 if ((error == 0) && (aps != NULL)) { 1701f4b3ec61Sdh155122 aps->aps_next = ifs->ifs_ap_sess_list; 1702f4b3ec61Sdh155122 ifs->ifs_ap_sess_list = aps; 1703ab25eeb5Syz155240 } 1704ab25eeb5Syz155240 if (getlock) { 1705f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1706ab25eeb5Syz155240 } 1707ab25eeb5Syz155240 1708ab25eeb5Syz155240 if (error == 0) 1709ab25eeb5Syz155240 return 0; 1710ab25eeb5Syz155240 1711ab25eeb5Syz155240 error = ENOMEM; 1712ab25eeb5Syz155240 1713ab25eeb5Syz155240 junkput: 1714ab25eeb5Syz155240 if (fr != NULL) 1715f4b3ec61Sdh155122 (void) fr_derefrule(&fr, ifs); 1716ab25eeb5Syz155240 1717ab25eeb5Syz155240 if ((ipnn != NULL) && (ipnn != &ipn)) { 1718ab25eeb5Syz155240 KFREES(ipnn, ipn.ipn_dsize); 1719ab25eeb5Syz155240 } 1720ab25eeb5Syz155240 if (nat != NULL) { 1721ab25eeb5Syz155240 if (aps != NULL) { 1722ab25eeb5Syz155240 if (aps->aps_data != NULL) { 1723ab25eeb5Syz155240 KFREES(aps->aps_data, aps->aps_psiz); 1724ab25eeb5Syz155240 } 1725ab25eeb5Syz155240 KFREE(aps); 1726ab25eeb5Syz155240 } 1727ab25eeb5Syz155240 if (in != NULL) { 1728ab25eeb5Syz155240 if (in->in_apr) 1729ab25eeb5Syz155240 appr_free(in->in_apr); 1730ab25eeb5Syz155240 KFREE(in); 1731ab25eeb5Syz155240 } 1732ab25eeb5Syz155240 KFREE(nat); 1733ab25eeb5Syz155240 } 1734ab25eeb5Syz155240 return error; 1735ab25eeb5Syz155240 } 1736ab25eeb5Syz155240 1737ab25eeb5Syz155240 1738ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1739ab25eeb5Syz155240 /* Function: nat_delete */ 1740ab25eeb5Syz155240 /* Returns: Nil */ 1741ab25eeb5Syz155240 /* Parameters: natd(I) - pointer to NAT structure to delete */ 1742ab25eeb5Syz155240 /* logtype(I) - type of LOG record to create before deleting */ 1743ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 1744ab25eeb5Syz155240 /* */ 1745ab25eeb5Syz155240 /* Delete a nat entry from the various lists and table. If NAT logging is */ 1746ab25eeb5Syz155240 /* enabled then generate a NAT log record for this event. */ 1747ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1748f4b3ec61Sdh155122 static void nat_delete(nat, logtype, ifs) 1749ab25eeb5Syz155240 struct nat *nat; 1750ab25eeb5Syz155240 int logtype; 1751f4b3ec61Sdh155122 ipf_stack_t *ifs; 1752ab25eeb5Syz155240 { 1753ab25eeb5Syz155240 struct ipnat *ipn; 1754ab25eeb5Syz155240 1755f4b3ec61Sdh155122 if (logtype != 0 && ifs->ifs_nat_logging != 0) 1756f4b3ec61Sdh155122 nat_log(nat, logtype, ifs); 1757ab25eeb5Syz155240 1758ab25eeb5Syz155240 /* 1759ab25eeb5Syz155240 * Take it as a general indication that all the pointers are set if 1760ab25eeb5Syz155240 * nat_pnext is set. 1761ab25eeb5Syz155240 */ 1762ab25eeb5Syz155240 if (nat->nat_pnext != NULL) { 1763f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0][nat->nat_hv[0]]--; 1764f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][nat->nat_hv[1]]--; 1765ab25eeb5Syz155240 1766ab25eeb5Syz155240 *nat->nat_pnext = nat->nat_next; 1767ab25eeb5Syz155240 if (nat->nat_next != NULL) { 1768ab25eeb5Syz155240 nat->nat_next->nat_pnext = nat->nat_pnext; 1769ab25eeb5Syz155240 nat->nat_next = NULL; 1770ab25eeb5Syz155240 } 1771ab25eeb5Syz155240 nat->nat_pnext = NULL; 1772ab25eeb5Syz155240 1773ab25eeb5Syz155240 *nat->nat_phnext[0] = nat->nat_hnext[0]; 1774ab25eeb5Syz155240 if (nat->nat_hnext[0] != NULL) { 1775ab25eeb5Syz155240 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; 1776ab25eeb5Syz155240 nat->nat_hnext[0] = NULL; 1777ab25eeb5Syz155240 } 1778ab25eeb5Syz155240 nat->nat_phnext[0] = NULL; 1779ab25eeb5Syz155240 1780ab25eeb5Syz155240 *nat->nat_phnext[1] = nat->nat_hnext[1]; 1781ab25eeb5Syz155240 if (nat->nat_hnext[1] != NULL) { 1782ab25eeb5Syz155240 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; 1783ab25eeb5Syz155240 nat->nat_hnext[1] = NULL; 1784ab25eeb5Syz155240 } 1785ab25eeb5Syz155240 nat->nat_phnext[1] = NULL; 1786ab25eeb5Syz155240 1787ab25eeb5Syz155240 if ((nat->nat_flags & SI_WILDP) != 0) 1788f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_wilds--; 1789ab25eeb5Syz155240 } 1790ab25eeb5Syz155240 1791ab25eeb5Syz155240 if (nat->nat_me != NULL) { 1792ab25eeb5Syz155240 *nat->nat_me = NULL; 1793ab25eeb5Syz155240 nat->nat_me = NULL; 1794ab25eeb5Syz155240 } 1795ab25eeb5Syz155240 1796ab25eeb5Syz155240 fr_deletequeueentry(&nat->nat_tqe); 1797ab25eeb5Syz155240 17980e01ff8bSdr146992 MUTEX_ENTER(&nat->nat_lock); 17990e01ff8bSdr146992 if (nat->nat_ref > 1) { 1800ab25eeb5Syz155240 nat->nat_ref--; 18010e01ff8bSdr146992 MUTEX_EXIT(&nat->nat_lock); 1802ab25eeb5Syz155240 return; 1803ab25eeb5Syz155240 } 18040e01ff8bSdr146992 MUTEX_EXIT(&nat->nat_lock); 18050e01ff8bSdr146992 18060e01ff8bSdr146992 /* 18070e01ff8bSdr146992 * At this point, nat_ref is 1, doing "--" would make it 0.. 18080e01ff8bSdr146992 */ 18090e01ff8bSdr146992 nat->nat_ref = 0; 1810ab25eeb5Syz155240 1811ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 1812ab25eeb5Syz155240 if (nat->nat_sync) 1813ab25eeb5Syz155240 ipfsync_del(nat->nat_sync); 1814ab25eeb5Syz155240 #endif 1815ab25eeb5Syz155240 1816ab25eeb5Syz155240 if (nat->nat_fr != NULL) 1817f4b3ec61Sdh155122 (void)fr_derefrule(&nat->nat_fr, ifs); 1818ab25eeb5Syz155240 1819ab25eeb5Syz155240 if (nat->nat_hm != NULL) 182090b0a856Sjojemann fr_hostmapdel(&nat->nat_hm); 1821ab25eeb5Syz155240 1822ab25eeb5Syz155240 /* 1823ab25eeb5Syz155240 * If there is an active reference from the nat entry to its parent 1824ab25eeb5Syz155240 * rule, decrement the rule's reference count and free it too if no 1825ab25eeb5Syz155240 * longer being used. 1826ab25eeb5Syz155240 */ 1827ab25eeb5Syz155240 ipn = nat->nat_ptr; 1828ab25eeb5Syz155240 if (ipn != NULL) { 1829ab25eeb5Syz155240 ipn->in_space++; 1830ab25eeb5Syz155240 ipn->in_use--; 1831ab25eeb5Syz155240 if (ipn->in_use == 0 && (ipn->in_flags & IPN_DELETE)) { 1832ab25eeb5Syz155240 if (ipn->in_apr) 1833ab25eeb5Syz155240 appr_free(ipn->in_apr); 1834ab25eeb5Syz155240 KFREE(ipn); 1835f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules--; 1836ab25eeb5Syz155240 } 1837ab25eeb5Syz155240 } 1838ab25eeb5Syz155240 1839ab25eeb5Syz155240 MUTEX_DESTROY(&nat->nat_lock); 1840ab25eeb5Syz155240 1841f4b3ec61Sdh155122 aps_free(nat->nat_aps, ifs); 1842f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_inuse--; 1843ab25eeb5Syz155240 1844ab25eeb5Syz155240 /* 1845ab25eeb5Syz155240 * If there's a fragment table entry too for this nat entry, then 1846ab25eeb5Syz155240 * dereference that as well. This is after nat_lock is released 1847ab25eeb5Syz155240 * because of Tru64. 1848ab25eeb5Syz155240 */ 1849f4b3ec61Sdh155122 fr_forgetnat((void *)nat, ifs); 1850ab25eeb5Syz155240 1851ab25eeb5Syz155240 KFREE(nat); 1852ab25eeb5Syz155240 } 1853ab25eeb5Syz155240 1854ab25eeb5Syz155240 1855ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1856ab25eeb5Syz155240 /* Function: nat_flushtable */ 1857ab25eeb5Syz155240 /* Returns: int - number of NAT rules deleted */ 1858ab25eeb5Syz155240 /* Parameters: Nil */ 1859ab25eeb5Syz155240 /* */ 1860ab25eeb5Syz155240 /* Deletes all currently active NAT sessions. In deleting each NAT entry a */ 1861ab25eeb5Syz155240 /* log record should be emitted in nat_delete() if NAT logging is enabled. */ 1862ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1863ab25eeb5Syz155240 /* 1864ab25eeb5Syz155240 * nat_flushtable - clear the NAT table of all mapping entries. 1865ab25eeb5Syz155240 */ 1866f4b3ec61Sdh155122 static int nat_flushtable(ifs) 1867f4b3ec61Sdh155122 ipf_stack_t *ifs; 1868ab25eeb5Syz155240 { 1869ab25eeb5Syz155240 nat_t *nat; 1870ab25eeb5Syz155240 int j = 0; 1871ab25eeb5Syz155240 1872ab25eeb5Syz155240 /* 1873ab25eeb5Syz155240 * ALL NAT mappings deleted, so lets just make the deletions 1874ab25eeb5Syz155240 * quicker. 1875ab25eeb5Syz155240 */ 1876f4b3ec61Sdh155122 if (ifs->ifs_nat_table[0] != NULL) 1877f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_table[0], 1878f4b3ec61Sdh155122 sizeof(ifs->ifs_nat_table[0]) * ifs->ifs_ipf_nattable_sz); 1879f4b3ec61Sdh155122 if (ifs->ifs_nat_table[1] != NULL) 1880f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_table[1], 1881f4b3ec61Sdh155122 sizeof(ifs->ifs_nat_table[1]) * ifs->ifs_ipf_nattable_sz); 1882ab25eeb5Syz155240 1883f4b3ec61Sdh155122 while ((nat = ifs->ifs_nat_instances) != NULL) { 1884f4b3ec61Sdh155122 nat_delete(nat, NL_FLUSH, ifs); 1885ab25eeb5Syz155240 j++; 1886ab25eeb5Syz155240 } 1887ab25eeb5Syz155240 1888ab25eeb5Syz155240 return j; 1889ab25eeb5Syz155240 } 1890ab25eeb5Syz155240 1891ab25eeb5Syz155240 1892ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1893ab25eeb5Syz155240 /* Function: nat_clearlist */ 1894ab25eeb5Syz155240 /* Returns: int - number of NAT/RDR rules deleted */ 1895ab25eeb5Syz155240 /* Parameters: Nil */ 1896ab25eeb5Syz155240 /* */ 1897ab25eeb5Syz155240 /* Delete all rules in the current list of rules. There is nothing elegant */ 1898ab25eeb5Syz155240 /* about this cleanup: simply free all entries on the list of rules and */ 1899ab25eeb5Syz155240 /* clear out the tables used for hashed NAT rule lookups. */ 1900ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1901f4b3ec61Sdh155122 static int nat_clearlist(ifs) 1902f4b3ec61Sdh155122 ipf_stack_t *ifs; 1903ab25eeb5Syz155240 { 1904f4b3ec61Sdh155122 ipnat_t *n, **np = &ifs->ifs_nat_list; 1905ab25eeb5Syz155240 int i = 0; 1906ab25eeb5Syz155240 1907f4b3ec61Sdh155122 if (ifs->ifs_nat_rules != NULL) 1908f4b3ec61Sdh155122 bzero((char *)ifs->ifs_nat_rules, 1909f4b3ec61Sdh155122 sizeof(*ifs->ifs_nat_rules) * ifs->ifs_ipf_natrules_sz); 1910f4b3ec61Sdh155122 if (ifs->ifs_rdr_rules != NULL) 1911f4b3ec61Sdh155122 bzero((char *)ifs->ifs_rdr_rules, 1912f4b3ec61Sdh155122 sizeof(*ifs->ifs_rdr_rules) * ifs->ifs_ipf_rdrrules_sz); 1913ab25eeb5Syz155240 1914ab25eeb5Syz155240 while ((n = *np) != NULL) { 1915ab25eeb5Syz155240 *np = n->in_next; 1916ab25eeb5Syz155240 if (n->in_use == 0) { 1917ab25eeb5Syz155240 if (n->in_apr != NULL) 1918ab25eeb5Syz155240 appr_free(n->in_apr); 1919ab25eeb5Syz155240 KFREE(n); 1920f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules--; 1921ab25eeb5Syz155240 } else { 1922ab25eeb5Syz155240 n->in_flags |= IPN_DELETE; 1923ab25eeb5Syz155240 n->in_next = NULL; 1924ab25eeb5Syz155240 } 1925ab25eeb5Syz155240 i++; 1926ab25eeb5Syz155240 } 1927f4b3ec61Sdh155122 ifs->ifs_nat_masks = 0; 1928f4b3ec61Sdh155122 ifs->ifs_rdr_masks = 0; 1929ab25eeb5Syz155240 return i; 1930ab25eeb5Syz155240 } 1931ab25eeb5Syz155240 1932ab25eeb5Syz155240 1933ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1934ab25eeb5Syz155240 /* Function: nat_newmap */ 1935ab25eeb5Syz155240 /* Returns: int - -1 == error, 0 == success */ 1936ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 1937ab25eeb5Syz155240 /* nat(I) - pointer to NAT entry */ 1938ab25eeb5Syz155240 /* ni(I) - pointer to structure with misc. information needed */ 1939ab25eeb5Syz155240 /* to create new NAT entry. */ 1940ab25eeb5Syz155240 /* */ 1941ab25eeb5Syz155240 /* Given an empty NAT structure, populate it with new information about a */ 1942ab25eeb5Syz155240 /* new NAT session, as defined by the matching NAT rule. */ 1943ab25eeb5Syz155240 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/ 1944ab25eeb5Syz155240 /* to the new IP address for the translation. */ 1945ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 1946ab25eeb5Syz155240 static INLINE int nat_newmap(fin, nat, ni) 1947ab25eeb5Syz155240 fr_info_t *fin; 1948ab25eeb5Syz155240 nat_t *nat; 1949ab25eeb5Syz155240 natinfo_t *ni; 1950ab25eeb5Syz155240 { 1951ab25eeb5Syz155240 u_short st_port, dport, sport, port, sp, dp; 1952ab25eeb5Syz155240 struct in_addr in, inb; 1953ab25eeb5Syz155240 hostmap_t *hm; 1954ab25eeb5Syz155240 u_32_t flags; 1955ab25eeb5Syz155240 u_32_t st_ip; 1956ab25eeb5Syz155240 ipnat_t *np; 1957ab25eeb5Syz155240 nat_t *natl; 1958ab25eeb5Syz155240 int l; 1959f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 1960ab25eeb5Syz155240 1961ab25eeb5Syz155240 /* 1962ab25eeb5Syz155240 * If it's an outbound packet which doesn't match any existing 1963ab25eeb5Syz155240 * record, then create a new port 1964ab25eeb5Syz155240 */ 1965ab25eeb5Syz155240 l = 0; 1966ab25eeb5Syz155240 hm = NULL; 1967ab25eeb5Syz155240 np = ni->nai_np; 1968ab25eeb5Syz155240 st_ip = np->in_nip; 1969ab25eeb5Syz155240 st_port = np->in_pnext; 1970ab25eeb5Syz155240 flags = ni->nai_flags; 1971ab25eeb5Syz155240 sport = ni->nai_sport; 1972ab25eeb5Syz155240 dport = ni->nai_dport; 1973ab25eeb5Syz155240 1974ab25eeb5Syz155240 /* 1975ab25eeb5Syz155240 * Do a loop until we either run out of entries to try or we find 1976ab25eeb5Syz155240 * a NAT mapping that isn't currently being used. This is done 1977ab25eeb5Syz155240 * because the change to the source is not (usually) being fixed. 1978ab25eeb5Syz155240 */ 1979ab25eeb5Syz155240 do { 1980ab25eeb5Syz155240 port = 0; 1981ab25eeb5Syz155240 in.s_addr = htonl(np->in_nip); 1982ab25eeb5Syz155240 if (l == 0) { 1983ab25eeb5Syz155240 /* 1984ab25eeb5Syz155240 * Check to see if there is an existing NAT 1985ab25eeb5Syz155240 * setup for this IP address pair. 1986ab25eeb5Syz155240 */ 1987ab25eeb5Syz155240 hm = nat_hostmap(np, fin->fin_src, fin->fin_dst, 1988f4b3ec61Sdh155122 in, 0, ifs); 1989ab25eeb5Syz155240 if (hm != NULL) 1990ab25eeb5Syz155240 in.s_addr = hm->hm_mapip.s_addr; 1991ab25eeb5Syz155240 } else if ((l == 1) && (hm != NULL)) { 199290b0a856Sjojemann fr_hostmapdel(&hm); 1993ab25eeb5Syz155240 } 1994ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 1995ab25eeb5Syz155240 1996ab25eeb5Syz155240 nat->nat_hm = hm; 1997ab25eeb5Syz155240 1998ab25eeb5Syz155240 if ((np->in_outmsk == 0xffffffff) && (np->in_pnext == 0)) { 1999ab25eeb5Syz155240 if (l > 0) 2000ab25eeb5Syz155240 return -1; 2001ab25eeb5Syz155240 } 2002ab25eeb5Syz155240 2003ab25eeb5Syz155240 if (np->in_redir == NAT_BIMAP && 2004ab25eeb5Syz155240 np->in_inmsk == np->in_outmsk) { 2005ab25eeb5Syz155240 /* 2006ab25eeb5Syz155240 * map the address block in a 1:1 fashion 2007ab25eeb5Syz155240 */ 2008ab25eeb5Syz155240 in.s_addr = np->in_outip; 2009ab25eeb5Syz155240 in.s_addr |= fin->fin_saddr & ~np->in_inmsk; 2010ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 2011ab25eeb5Syz155240 2012ab25eeb5Syz155240 } else if (np->in_redir & NAT_MAPBLK) { 2013ab25eeb5Syz155240 if ((l >= np->in_ppip) || ((l > 0) && 2014ab25eeb5Syz155240 !(flags & IPN_TCPUDP))) 2015ab25eeb5Syz155240 return -1; 2016ab25eeb5Syz155240 /* 2017ab25eeb5Syz155240 * map-block - Calculate destination address. 2018ab25eeb5Syz155240 */ 2019ab25eeb5Syz155240 in.s_addr = ntohl(fin->fin_saddr); 2020ab25eeb5Syz155240 in.s_addr &= ntohl(~np->in_inmsk); 2021ab25eeb5Syz155240 inb.s_addr = in.s_addr; 2022ab25eeb5Syz155240 in.s_addr /= np->in_ippip; 2023ab25eeb5Syz155240 in.s_addr &= ntohl(~np->in_outmsk); 2024ab25eeb5Syz155240 in.s_addr += ntohl(np->in_outip); 2025ab25eeb5Syz155240 /* 2026ab25eeb5Syz155240 * Calculate destination port. 2027ab25eeb5Syz155240 */ 2028ab25eeb5Syz155240 if ((flags & IPN_TCPUDP) && 2029ab25eeb5Syz155240 (np->in_ppip != 0)) { 2030ab25eeb5Syz155240 port = ntohs(sport) + l; 2031ab25eeb5Syz155240 port %= np->in_ppip; 2032ab25eeb5Syz155240 port += np->in_ppip * 2033ab25eeb5Syz155240 (inb.s_addr % np->in_ippip); 2034ab25eeb5Syz155240 port += MAPBLK_MINPORT; 2035ab25eeb5Syz155240 port = htons(port); 2036ab25eeb5Syz155240 } 2037ab25eeb5Syz155240 2038ab25eeb5Syz155240 } else if ((np->in_outip == 0) && 2039ab25eeb5Syz155240 (np->in_outmsk == 0xffffffff)) { 2040ab25eeb5Syz155240 /* 2041ab25eeb5Syz155240 * 0/32 - use the interface's IP address. 2042ab25eeb5Syz155240 */ 2043ab25eeb5Syz155240 if ((l > 0) || 2044ab25eeb5Syz155240 fr_ifpaddr(4, FRI_NORMAL, fin->fin_ifp, 2045f4b3ec61Sdh155122 &in, NULL, fin->fin_ifs) == -1) 2046ab25eeb5Syz155240 return -1; 2047ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 2048ab25eeb5Syz155240 2049ab25eeb5Syz155240 } else if ((np->in_outip == 0) && (np->in_outmsk == 0)) { 2050ab25eeb5Syz155240 /* 2051ab25eeb5Syz155240 * 0/0 - use the original source address/port. 2052ab25eeb5Syz155240 */ 2053ab25eeb5Syz155240 if (l > 0) 2054ab25eeb5Syz155240 return -1; 2055ab25eeb5Syz155240 in.s_addr = ntohl(fin->fin_saddr); 2056ab25eeb5Syz155240 2057ab25eeb5Syz155240 } else if ((np->in_outmsk != 0xffffffff) && 2058ab25eeb5Syz155240 (np->in_pnext == 0) && ((l > 0) || (hm == NULL))) 2059ab25eeb5Syz155240 np->in_nip++; 2060ab25eeb5Syz155240 2061ab25eeb5Syz155240 natl = NULL; 2062ab25eeb5Syz155240 2063ab25eeb5Syz155240 if ((flags & IPN_TCPUDP) && 2064ab25eeb5Syz155240 ((np->in_redir & NAT_MAPBLK) == 0) && 2065ab25eeb5Syz155240 (np->in_flags & IPN_AUTOPORTMAP)) { 2066ab25eeb5Syz155240 /* 2067ab25eeb5Syz155240 * "ports auto" (without map-block) 2068ab25eeb5Syz155240 */ 2069ab25eeb5Syz155240 if ((l > 0) && (l % np->in_ppip == 0)) { 2070ab25eeb5Syz155240 if (l > np->in_space) { 2071ab25eeb5Syz155240 return -1; 2072ab25eeb5Syz155240 } else if ((l > np->in_ppip) && 2073ab25eeb5Syz155240 np->in_outmsk != 0xffffffff) 2074ab25eeb5Syz155240 np->in_nip++; 2075ab25eeb5Syz155240 } 2076ab25eeb5Syz155240 if (np->in_ppip != 0) { 2077ab25eeb5Syz155240 port = ntohs(sport); 2078ab25eeb5Syz155240 port += (l % np->in_ppip); 2079ab25eeb5Syz155240 port %= np->in_ppip; 2080ab25eeb5Syz155240 port += np->in_ppip * 2081ab25eeb5Syz155240 (ntohl(fin->fin_saddr) % 2082ab25eeb5Syz155240 np->in_ippip); 2083ab25eeb5Syz155240 port += MAPBLK_MINPORT; 2084ab25eeb5Syz155240 port = htons(port); 2085ab25eeb5Syz155240 } 2086ab25eeb5Syz155240 2087ab25eeb5Syz155240 } else if (((np->in_redir & NAT_MAPBLK) == 0) && 2088ab25eeb5Syz155240 (flags & IPN_TCPUDPICMP) && (np->in_pnext != 0)) { 2089ab25eeb5Syz155240 /* 2090ab25eeb5Syz155240 * Standard port translation. Select next port. 2091ab25eeb5Syz155240 */ 2092ab25eeb5Syz155240 port = htons(np->in_pnext++); 2093ab25eeb5Syz155240 2094ab25eeb5Syz155240 if (np->in_pnext > ntohs(np->in_pmax)) { 2095ab25eeb5Syz155240 np->in_pnext = ntohs(np->in_pmin); 2096ab25eeb5Syz155240 if (np->in_outmsk != 0xffffffff) 2097ab25eeb5Syz155240 np->in_nip++; 2098ab25eeb5Syz155240 } 2099ab25eeb5Syz155240 } 2100ab25eeb5Syz155240 2101ab25eeb5Syz155240 if (np->in_flags & IPN_IPRANGE) { 2102ab25eeb5Syz155240 if (np->in_nip > ntohl(np->in_outmsk)) 2103ab25eeb5Syz155240 np->in_nip = ntohl(np->in_outip); 2104ab25eeb5Syz155240 } else { 2105ab25eeb5Syz155240 if ((np->in_outmsk != 0xffffffff) && 2106ab25eeb5Syz155240 ((np->in_nip + 1) & ntohl(np->in_outmsk)) > 2107ab25eeb5Syz155240 ntohl(np->in_outip)) 2108ab25eeb5Syz155240 np->in_nip = ntohl(np->in_outip) + 1; 2109ab25eeb5Syz155240 } 2110ab25eeb5Syz155240 2111ab25eeb5Syz155240 if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY))) 2112ab25eeb5Syz155240 port = sport; 2113ab25eeb5Syz155240 2114ab25eeb5Syz155240 /* 2115ab25eeb5Syz155240 * Here we do a lookup of the connection as seen from 2116ab25eeb5Syz155240 * the outside. If an IP# pair already exists, try 2117ab25eeb5Syz155240 * again. So if you have A->B becomes C->B, you can 2118ab25eeb5Syz155240 * also have D->E become C->E but not D->B causing 2119ab25eeb5Syz155240 * another C->B. Also take protocol and ports into 2120ab25eeb5Syz155240 * account when determining whether a pre-existing 2121ab25eeb5Syz155240 * NAT setup will cause an external conflict where 2122ab25eeb5Syz155240 * this is appropriate. 2123ab25eeb5Syz155240 */ 2124ab25eeb5Syz155240 inb.s_addr = htonl(in.s_addr); 2125ab25eeb5Syz155240 sp = fin->fin_data[0]; 2126ab25eeb5Syz155240 dp = fin->fin_data[1]; 2127ab25eeb5Syz155240 fin->fin_data[0] = fin->fin_data[1]; 2128ab25eeb5Syz155240 fin->fin_data[1] = htons(port); 2129ab25eeb5Syz155240 natl = nat_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH), 2130ab25eeb5Syz155240 (u_int)fin->fin_p, fin->fin_dst, inb); 2131ab25eeb5Syz155240 fin->fin_data[0] = sp; 2132ab25eeb5Syz155240 fin->fin_data[1] = dp; 2133ab25eeb5Syz155240 2134ab25eeb5Syz155240 /* 2135ab25eeb5Syz155240 * Has the search wrapped around and come back to the 2136ab25eeb5Syz155240 * start ? 2137ab25eeb5Syz155240 */ 2138ab25eeb5Syz155240 if ((natl != NULL) && 2139ab25eeb5Syz155240 (np->in_pnext != 0) && (st_port == np->in_pnext) && 2140ab25eeb5Syz155240 (np->in_nip != 0) && (st_ip == np->in_nip)) 2141ab25eeb5Syz155240 return -1; 2142ab25eeb5Syz155240 l++; 2143ab25eeb5Syz155240 } while (natl != NULL); 2144ab25eeb5Syz155240 2145ab25eeb5Syz155240 if (np->in_space > 0) 2146ab25eeb5Syz155240 np->in_space--; 2147ab25eeb5Syz155240 2148ab25eeb5Syz155240 /* Setup the NAT table */ 2149ab25eeb5Syz155240 nat->nat_inip = fin->fin_src; 2150ab25eeb5Syz155240 nat->nat_outip.s_addr = htonl(in.s_addr); 2151ab25eeb5Syz155240 nat->nat_oip = fin->fin_dst; 2152ab25eeb5Syz155240 if (nat->nat_hm == NULL) 2153ab25eeb5Syz155240 nat->nat_hm = nat_hostmap(np, fin->fin_src, fin->fin_dst, 2154f4b3ec61Sdh155122 nat->nat_outip, 0, ifs); 2155ab25eeb5Syz155240 2156ab25eeb5Syz155240 if (flags & IPN_TCPUDP) { 2157ab25eeb5Syz155240 nat->nat_inport = sport; 2158ab25eeb5Syz155240 nat->nat_outport = port; /* sport */ 2159ab25eeb5Syz155240 nat->nat_oport = dport; 2160ab25eeb5Syz155240 ((tcphdr_t *)fin->fin_dp)->th_sport = port; 2161ab25eeb5Syz155240 } else if (flags & IPN_ICMPQUERY) { 2162ab25eeb5Syz155240 ((icmphdr_t *)fin->fin_dp)->icmp_id = port; 2163ab25eeb5Syz155240 nat->nat_inport = port; 2164ab25eeb5Syz155240 nat->nat_outport = port; 2165ab25eeb5Syz155240 } 2166ab25eeb5Syz155240 2167ab25eeb5Syz155240 ni->nai_ip.s_addr = in.s_addr; 2168ab25eeb5Syz155240 ni->nai_port = port; 2169ab25eeb5Syz155240 ni->nai_nport = dport; 2170ab25eeb5Syz155240 return 0; 2171ab25eeb5Syz155240 } 2172ab25eeb5Syz155240 2173ab25eeb5Syz155240 2174ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2175ab25eeb5Syz155240 /* Function: nat_newrdr */ 2176ab25eeb5Syz155240 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */ 2177ab25eeb5Syz155240 /* allow rule to be moved if IPN_ROUNDR is set. */ 2178ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2179ab25eeb5Syz155240 /* nat(I) - pointer to NAT entry */ 2180ab25eeb5Syz155240 /* ni(I) - pointer to structure with misc. information needed */ 2181ab25eeb5Syz155240 /* to create new NAT entry. */ 2182ab25eeb5Syz155240 /* */ 2183ab25eeb5Syz155240 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/ 2184ab25eeb5Syz155240 /* to the new IP address for the translation. */ 2185ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2186ab25eeb5Syz155240 static INLINE int nat_newrdr(fin, nat, ni) 2187ab25eeb5Syz155240 fr_info_t *fin; 2188ab25eeb5Syz155240 nat_t *nat; 2189ab25eeb5Syz155240 natinfo_t *ni; 2190ab25eeb5Syz155240 { 2191ab25eeb5Syz155240 u_short nport, dport, sport; 21928899fcfaSjojemann struct in_addr in, inb; 21938899fcfaSjojemann u_short sp, dp; 2194ab25eeb5Syz155240 hostmap_t *hm; 2195ab25eeb5Syz155240 u_32_t flags; 2196ab25eeb5Syz155240 ipnat_t *np; 21978899fcfaSjojemann nat_t *natl; 2198ab25eeb5Syz155240 int move; 2199f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 2200ab25eeb5Syz155240 2201ab25eeb5Syz155240 move = 1; 2202ab25eeb5Syz155240 hm = NULL; 2203ab25eeb5Syz155240 in.s_addr = 0; 2204ab25eeb5Syz155240 np = ni->nai_np; 2205ab25eeb5Syz155240 flags = ni->nai_flags; 2206ab25eeb5Syz155240 sport = ni->nai_sport; 2207ab25eeb5Syz155240 dport = ni->nai_dport; 2208ab25eeb5Syz155240 2209ab25eeb5Syz155240 /* 2210ab25eeb5Syz155240 * If the matching rule has IPN_STICKY set, then we want to have the 2211ab25eeb5Syz155240 * same rule kick in as before. Why would this happen? If you have 2212ab25eeb5Syz155240 * a collection of rdr rules with "round-robin sticky", the current 2213ab25eeb5Syz155240 * packet might match a different one to the previous connection but 2214ab25eeb5Syz155240 * we want the same destination to be used. 2215ab25eeb5Syz155240 */ 2216ab25eeb5Syz155240 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == 2217ab25eeb5Syz155240 (IPN_ROUNDR|IPN_STICKY)) { 2218ab25eeb5Syz155240 hm = nat_hostmap(NULL, fin->fin_src, fin->fin_dst, in, 2219f4b3ec61Sdh155122 (u_32_t)dport, ifs); 2220ab25eeb5Syz155240 if (hm != NULL) { 2221ab25eeb5Syz155240 in.s_addr = ntohl(hm->hm_mapip.s_addr); 2222ab25eeb5Syz155240 np = hm->hm_ipnat; 2223ab25eeb5Syz155240 ni->nai_np = np; 2224ab25eeb5Syz155240 move = 0; 2225ab25eeb5Syz155240 } 2226ab25eeb5Syz155240 } 2227ab25eeb5Syz155240 2228ab25eeb5Syz155240 /* 2229ab25eeb5Syz155240 * Otherwise, it's an inbound packet. Most likely, we don't 2230ab25eeb5Syz155240 * want to rewrite source ports and source addresses. Instead, 2231ab25eeb5Syz155240 * we want to rewrite to a fixed internal address and fixed 2232ab25eeb5Syz155240 * internal port. 2233ab25eeb5Syz155240 */ 2234ab25eeb5Syz155240 if (np->in_flags & IPN_SPLIT) { 2235ab25eeb5Syz155240 in.s_addr = np->in_nip; 2236ab25eeb5Syz155240 2237ab25eeb5Syz155240 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) { 2238ab25eeb5Syz155240 hm = nat_hostmap(np, fin->fin_src, fin->fin_dst, 2239f4b3ec61Sdh155122 in, (u_32_t)dport, ifs); 2240ab25eeb5Syz155240 if (hm != NULL) { 2241ab25eeb5Syz155240 in.s_addr = hm->hm_mapip.s_addr; 2242ab25eeb5Syz155240 move = 0; 2243ab25eeb5Syz155240 } 2244ab25eeb5Syz155240 } 2245ab25eeb5Syz155240 2246ab25eeb5Syz155240 if (hm == NULL || hm->hm_ref == 1) { 2247ab25eeb5Syz155240 if (np->in_inip == htonl(in.s_addr)) { 2248ab25eeb5Syz155240 np->in_nip = ntohl(np->in_inmsk); 2249ab25eeb5Syz155240 move = 0; 2250ab25eeb5Syz155240 } else { 2251ab25eeb5Syz155240 np->in_nip = ntohl(np->in_inip); 2252ab25eeb5Syz155240 } 2253ab25eeb5Syz155240 } 2254ab25eeb5Syz155240 2255ab25eeb5Syz155240 } else if ((np->in_inip == 0) && (np->in_inmsk == 0xffffffff)) { 2256ab25eeb5Syz155240 /* 2257ab25eeb5Syz155240 * 0/32 - use the interface's IP address. 2258ab25eeb5Syz155240 */ 2259f4b3ec61Sdh155122 if (fr_ifpaddr(4, FRI_NORMAL, fin->fin_ifp, &in, NULL, 2260f4b3ec61Sdh155122 fin->fin_ifs) == -1) 2261ab25eeb5Syz155240 return -1; 2262ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 2263ab25eeb5Syz155240 2264ab25eeb5Syz155240 } else if ((np->in_inip == 0) && (np->in_inmsk== 0)) { 2265ab25eeb5Syz155240 /* 2266ab25eeb5Syz155240 * 0/0 - use the original destination address/port. 2267ab25eeb5Syz155240 */ 2268ab25eeb5Syz155240 in.s_addr = ntohl(fin->fin_daddr); 2269ab25eeb5Syz155240 2270ab25eeb5Syz155240 } else if (np->in_redir == NAT_BIMAP && 2271ab25eeb5Syz155240 np->in_inmsk == np->in_outmsk) { 2272ab25eeb5Syz155240 /* 2273ab25eeb5Syz155240 * map the address block in a 1:1 fashion 2274ab25eeb5Syz155240 */ 2275ab25eeb5Syz155240 in.s_addr = np->in_inip; 2276ab25eeb5Syz155240 in.s_addr |= fin->fin_daddr & ~np->in_inmsk; 2277ab25eeb5Syz155240 in.s_addr = ntohl(in.s_addr); 2278ab25eeb5Syz155240 } else { 2279ab25eeb5Syz155240 in.s_addr = ntohl(np->in_inip); 2280ab25eeb5Syz155240 } 2281ab25eeb5Syz155240 2282ab25eeb5Syz155240 if ((np->in_pnext == 0) || ((flags & NAT_NOTRULEPORT) != 0)) 2283ab25eeb5Syz155240 nport = dport; 2284ab25eeb5Syz155240 else { 2285ab25eeb5Syz155240 /* 2286ab25eeb5Syz155240 * Whilst not optimized for the case where 2287ab25eeb5Syz155240 * pmin == pmax, the gain is not significant. 2288ab25eeb5Syz155240 */ 2289ab25eeb5Syz155240 if (((np->in_flags & IPN_FIXEDDPORT) == 0) && 2290ab25eeb5Syz155240 (np->in_pmin != np->in_pmax)) { 2291ab25eeb5Syz155240 nport = ntohs(dport) - ntohs(np->in_pmin) + 2292ab25eeb5Syz155240 ntohs(np->in_pnext); 2293ab25eeb5Syz155240 nport = htons(nport); 2294ab25eeb5Syz155240 } else 2295ab25eeb5Syz155240 nport = np->in_pnext; 2296ab25eeb5Syz155240 } 2297ab25eeb5Syz155240 2298ab25eeb5Syz155240 /* 2299ab25eeb5Syz155240 * When the redirect-to address is set to 0.0.0.0, just 2300ab25eeb5Syz155240 * assume a blank `forwarding' of the packet. We don't 2301ab25eeb5Syz155240 * setup any translation for this either. 2302ab25eeb5Syz155240 */ 2303ab25eeb5Syz155240 if (in.s_addr == 0) { 2304ab25eeb5Syz155240 if (nport == dport) 2305ab25eeb5Syz155240 return -1; 2306ab25eeb5Syz155240 in.s_addr = ntohl(fin->fin_daddr); 2307ab25eeb5Syz155240 } 2308ab25eeb5Syz155240 23098899fcfaSjojemann /* 23108899fcfaSjojemann * Check to see if this redirect mapping already exists and if 23118899fcfaSjojemann * it does, return "failure" (allowing it to be created will just 23128899fcfaSjojemann * cause one or both of these "connections" to stop working.) 23138899fcfaSjojemann */ 23148899fcfaSjojemann inb.s_addr = htonl(in.s_addr); 23158899fcfaSjojemann sp = fin->fin_data[0]; 23168899fcfaSjojemann dp = fin->fin_data[1]; 23178899fcfaSjojemann fin->fin_data[1] = fin->fin_data[0]; 23188899fcfaSjojemann fin->fin_data[0] = ntohs(nport); 23198899fcfaSjojemann natl = nat_outlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH), 23208899fcfaSjojemann (u_int)fin->fin_p, inb, fin->fin_src); 23218899fcfaSjojemann fin->fin_data[0] = sp; 23228899fcfaSjojemann fin->fin_data[1] = dp; 23238899fcfaSjojemann if (natl != NULL) 23248899fcfaSjojemann return (-1); 23258899fcfaSjojemann 2326ab25eeb5Syz155240 nat->nat_inip.s_addr = htonl(in.s_addr); 2327ab25eeb5Syz155240 nat->nat_outip = fin->fin_dst; 2328ab25eeb5Syz155240 nat->nat_oip = fin->fin_src; 2329ab25eeb5Syz155240 2330ab25eeb5Syz155240 ni->nai_ip.s_addr = in.s_addr; 2331ab25eeb5Syz155240 ni->nai_nport = nport; 2332ab25eeb5Syz155240 ni->nai_port = sport; 2333ab25eeb5Syz155240 2334ab25eeb5Syz155240 if (flags & IPN_TCPUDP) { 2335ab25eeb5Syz155240 nat->nat_inport = nport; 2336ab25eeb5Syz155240 nat->nat_outport = dport; 2337ab25eeb5Syz155240 nat->nat_oport = sport; 2338ab25eeb5Syz155240 ((tcphdr_t *)fin->fin_dp)->th_dport = nport; 2339ab25eeb5Syz155240 } else if (flags & IPN_ICMPQUERY) { 2340ab25eeb5Syz155240 ((icmphdr_t *)fin->fin_dp)->icmp_id = nport; 2341ab25eeb5Syz155240 nat->nat_inport = nport; 2342ab25eeb5Syz155240 nat->nat_outport = nport; 2343ab25eeb5Syz155240 } 2344ab25eeb5Syz155240 2345ab25eeb5Syz155240 return move; 2346ab25eeb5Syz155240 } 2347ab25eeb5Syz155240 2348ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2349ab25eeb5Syz155240 /* Function: nat_new */ 2350ab25eeb5Syz155240 /* Returns: nat_t* - NULL == failure to create new NAT structure, */ 2351ab25eeb5Syz155240 /* else pointer to new NAT structure */ 2352ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2353ab25eeb5Syz155240 /* np(I) - pointer to NAT rule */ 2354ab25eeb5Syz155240 /* natsave(I) - pointer to where to store NAT struct pointer */ 2355ab25eeb5Syz155240 /* flags(I) - flags describing the current packet */ 2356ab25eeb5Syz155240 /* direction(I) - direction of packet (in/out) */ 2357ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 2358ab25eeb5Syz155240 /* */ 2359ab25eeb5Syz155240 /* Attempts to create a new NAT entry. Does not actually change the packet */ 2360ab25eeb5Syz155240 /* in any way. */ 2361ab25eeb5Syz155240 /* */ 2362ab25eeb5Syz155240 /* This fucntion is in three main parts: (1) deal with creating a new NAT */ 2363ab25eeb5Syz155240 /* structure for a "MAP" rule (outgoing NAT translation); (2) deal with */ 2364ab25eeb5Syz155240 /* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */ 2365ab25eeb5Syz155240 /* and (3) building that structure and putting it into the NAT table(s). */ 2366ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2367ab25eeb5Syz155240 nat_t *nat_new(fin, np, natsave, flags, direction) 2368ab25eeb5Syz155240 fr_info_t *fin; 2369ab25eeb5Syz155240 ipnat_t *np; 2370ab25eeb5Syz155240 nat_t **natsave; 2371ab25eeb5Syz155240 u_int flags; 2372ab25eeb5Syz155240 int direction; 2373ab25eeb5Syz155240 { 2374ab25eeb5Syz155240 tcphdr_t *tcp = NULL; 2375ab25eeb5Syz155240 hostmap_t *hm = NULL; 2376ab25eeb5Syz155240 nat_t *nat, *natl; 2377ab25eeb5Syz155240 u_int nflags; 2378ab25eeb5Syz155240 natinfo_t ni; 2379ab25eeb5Syz155240 int move; 2380f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 2381ab25eeb5Syz155240 23823805c50fSan207044 /* 23833805c50fSan207044 * Trigger automatic call to nat_extraflush() if the 23843805c50fSan207044 * table has reached capcity specified by hi watermark. 23853805c50fSan207044 */ 23863805c50fSan207044 if (NAT_TAB_WATER_LEVEL(ifs) > ifs->ifs_nat_flush_lvl_hi) 23873805c50fSan207044 ifs->ifs_nat_doflush = 1; 23883805c50fSan207044 2389f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_inuse >= ifs->ifs_ipf_nattable_max) { 2390f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_memfail++; 2391ab25eeb5Syz155240 return NULL; 2392ab25eeb5Syz155240 } 2393ab25eeb5Syz155240 2394ab25eeb5Syz155240 move = 1; 2395ab25eeb5Syz155240 nflags = np->in_flags & flags; 2396ab25eeb5Syz155240 nflags &= NAT_FROMRULE; 2397ab25eeb5Syz155240 2398ab25eeb5Syz155240 ni.nai_np = np; 2399ab25eeb5Syz155240 ni.nai_nflags = nflags; 2400ab25eeb5Syz155240 ni.nai_flags = flags; 2401ab25eeb5Syz155240 2402ab25eeb5Syz155240 /* Give me a new nat */ 2403ab25eeb5Syz155240 KMALLOC(nat, nat_t *); 2404ab25eeb5Syz155240 if (nat == NULL) { 2405f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_memfail++; 2406ab25eeb5Syz155240 /* 2407ab25eeb5Syz155240 * Try to automatically tune the max # of entries in the 2408ab25eeb5Syz155240 * table allowed to be less than what will cause kmem_alloc() 2409ab25eeb5Syz155240 * to fail and try to eliminate panics due to out of memory 2410ab25eeb5Syz155240 * conditions arising. 2411ab25eeb5Syz155240 */ 2412f4b3ec61Sdh155122 if (ifs->ifs_ipf_nattable_max > ifs->ifs_ipf_nattable_sz) { 2413f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_max = ifs->ifs_nat_stats.ns_inuse - 100; 2414ab25eeb5Syz155240 printf("ipf_nattable_max reduced to %d\n", 2415f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_max); 2416ab25eeb5Syz155240 } 2417ab25eeb5Syz155240 return NULL; 2418ab25eeb5Syz155240 } 2419ab25eeb5Syz155240 2420ab25eeb5Syz155240 if (flags & IPN_TCPUDP) { 2421ab25eeb5Syz155240 tcp = fin->fin_dp; 2422ab25eeb5Syz155240 ni.nai_sport = htons(fin->fin_sport); 2423ab25eeb5Syz155240 ni.nai_dport = htons(fin->fin_dport); 2424ab25eeb5Syz155240 } else if (flags & IPN_ICMPQUERY) { 2425ab25eeb5Syz155240 /* 2426ab25eeb5Syz155240 * In the ICMP query NAT code, we translate the ICMP id fields 2427ab25eeb5Syz155240 * to make them unique. This is indepedent of the ICMP type 2428ab25eeb5Syz155240 * (e.g. in the unlikely event that a host sends an echo and 2429ab25eeb5Syz155240 * an tstamp request with the same id, both packets will have 2430ab25eeb5Syz155240 * their ip address/id field changed in the same way). 2431ab25eeb5Syz155240 */ 2432ab25eeb5Syz155240 /* The icmp_id field is used by the sender to identify the 2433ab25eeb5Syz155240 * process making the icmp request. (the receiver justs 2434ab25eeb5Syz155240 * copies it back in its response). So, it closely matches 2435ab25eeb5Syz155240 * the concept of source port. We overlay sport, so we can 2436ab25eeb5Syz155240 * maximally reuse the existing code. 2437ab25eeb5Syz155240 */ 2438ab25eeb5Syz155240 ni.nai_sport = ((icmphdr_t *)fin->fin_dp)->icmp_id; 2439ab25eeb5Syz155240 ni.nai_dport = ni.nai_sport; 2440ab25eeb5Syz155240 } 2441ab25eeb5Syz155240 2442ab25eeb5Syz155240 bzero((char *)nat, sizeof(*nat)); 2443ab25eeb5Syz155240 nat->nat_flags = flags; 2444f4b3ec61Sdh155122 nat->nat_redir = np->in_redir; 2445ab25eeb5Syz155240 2446ab25eeb5Syz155240 if ((flags & NAT_SLAVE) == 0) { 2447f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 2448ab25eeb5Syz155240 } 2449ab25eeb5Syz155240 2450ab25eeb5Syz155240 /* 2451ab25eeb5Syz155240 * Search the current table for a match. 2452ab25eeb5Syz155240 */ 2453ab25eeb5Syz155240 if (direction == NAT_OUTBOUND) { 2454ab25eeb5Syz155240 /* 2455ab25eeb5Syz155240 * We can now arrange to call this for the same connection 2456ab25eeb5Syz155240 * because ipf_nat_new doesn't protect the code path into 2457ab25eeb5Syz155240 * this function. 2458ab25eeb5Syz155240 */ 2459ab25eeb5Syz155240 natl = nat_outlookup(fin, nflags, (u_int)fin->fin_p, 2460ab25eeb5Syz155240 fin->fin_src, fin->fin_dst); 2461ab25eeb5Syz155240 if (natl != NULL) { 2462dcf3e898Sjojemann KFREE(nat); 2463ab25eeb5Syz155240 nat = natl; 2464ab25eeb5Syz155240 goto done; 2465ab25eeb5Syz155240 } 2466ab25eeb5Syz155240 2467ab25eeb5Syz155240 move = nat_newmap(fin, nat, &ni); 2468ab25eeb5Syz155240 if (move == -1) 2469ab25eeb5Syz155240 goto badnat; 2470ab25eeb5Syz155240 2471ab25eeb5Syz155240 np = ni.nai_np; 2472ab25eeb5Syz155240 } else { 2473ab25eeb5Syz155240 /* 2474ab25eeb5Syz155240 * NAT_INBOUND is used only for redirects rules 2475ab25eeb5Syz155240 */ 2476ab25eeb5Syz155240 natl = nat_inlookup(fin, nflags, (u_int)fin->fin_p, 2477ab25eeb5Syz155240 fin->fin_src, fin->fin_dst); 2478ab25eeb5Syz155240 if (natl != NULL) { 2479dcf3e898Sjojemann KFREE(nat); 2480ab25eeb5Syz155240 nat = natl; 2481ab25eeb5Syz155240 goto done; 2482ab25eeb5Syz155240 } 2483ab25eeb5Syz155240 2484ab25eeb5Syz155240 move = nat_newrdr(fin, nat, &ni); 2485ab25eeb5Syz155240 if (move == -1) 2486ab25eeb5Syz155240 goto badnat; 2487ab25eeb5Syz155240 2488ab25eeb5Syz155240 np = ni.nai_np; 2489ab25eeb5Syz155240 } 2490ab25eeb5Syz155240 2491ab25eeb5Syz155240 if ((move == 1) && (np->in_flags & IPN_ROUNDR)) { 2492ab25eeb5Syz155240 if (np->in_redir == NAT_REDIRECT) { 2493ab25eeb5Syz155240 nat_delrdr(np); 2494f4b3ec61Sdh155122 nat_addrdr(np, ifs); 2495ab25eeb5Syz155240 } else if (np->in_redir == NAT_MAP) { 2496ab25eeb5Syz155240 nat_delnat(np); 2497f4b3ec61Sdh155122 nat_addnat(np, ifs); 2498ab25eeb5Syz155240 } 2499ab25eeb5Syz155240 } 2500ab25eeb5Syz155240 2501ab25eeb5Syz155240 if (nat_finalise(fin, nat, &ni, tcp, natsave, direction) == -1) { 2502ab25eeb5Syz155240 goto badnat; 2503ab25eeb5Syz155240 } 25043c50f6d6San207044 25053c50f6d6San207044 nat_calc_chksum_diffs(nat); 25063c50f6d6San207044 2507ab25eeb5Syz155240 if (flags & SI_WILDP) 2508f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_wilds++; 2509ab25eeb5Syz155240 goto done; 2510ab25eeb5Syz155240 badnat: 2511f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_badnat++; 2512ab25eeb5Syz155240 if ((hm = nat->nat_hm) != NULL) 251390b0a856Sjojemann fr_hostmapdel(&hm); 2514ab25eeb5Syz155240 KFREE(nat); 2515ab25eeb5Syz155240 nat = NULL; 2516ab25eeb5Syz155240 done: 2517ab25eeb5Syz155240 if ((flags & NAT_SLAVE) == 0) { 2518f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 2519ab25eeb5Syz155240 } 2520ab25eeb5Syz155240 return nat; 2521ab25eeb5Syz155240 } 2522ab25eeb5Syz155240 2523ab25eeb5Syz155240 2524ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2525ab25eeb5Syz155240 /* Function: nat_finalise */ 2526ab25eeb5Syz155240 /* Returns: int - 0 == sucess, -1 == failure */ 2527ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2528ab25eeb5Syz155240 /* nat(I) - pointer to NAT entry */ 2529ab25eeb5Syz155240 /* ni(I) - pointer to structure with misc. information needed */ 2530ab25eeb5Syz155240 /* to create new NAT entry. */ 2531ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 2532ab25eeb5Syz155240 /* */ 2533ab25eeb5Syz155240 /* This is the tail end of constructing a new NAT entry and is the same */ 2534ab25eeb5Syz155240 /* for both IPv4 and IPv6. */ 2535ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2536ab25eeb5Syz155240 /*ARGSUSED*/ 2537ab25eeb5Syz155240 static INLINE int nat_finalise(fin, nat, ni, tcp, natsave, direction) 2538ab25eeb5Syz155240 fr_info_t *fin; 2539ab25eeb5Syz155240 nat_t *nat; 2540ab25eeb5Syz155240 natinfo_t *ni; 2541ab25eeb5Syz155240 tcphdr_t *tcp; 2542ab25eeb5Syz155240 nat_t **natsave; 2543ab25eeb5Syz155240 int direction; 2544ab25eeb5Syz155240 { 2545ab25eeb5Syz155240 frentry_t *fr; 2546ab25eeb5Syz155240 ipnat_t *np; 2547f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 2548ab25eeb5Syz155240 2549ab25eeb5Syz155240 np = ni->nai_np; 2550ab25eeb5Syz155240 2551381a2a9aSdr146992 COPYIFNAME(fin->fin_ifp, nat->nat_ifnames[0], fin->fin_v); 2552381a2a9aSdr146992 2553ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 2554ab25eeb5Syz155240 if ((nat->nat_flags & SI_CLONE) == 0) 2555ab25eeb5Syz155240 nat->nat_sync = ipfsync_new(SMC_NAT, fin, nat); 2556ab25eeb5Syz155240 #endif 2557ab25eeb5Syz155240 2558ab25eeb5Syz155240 nat->nat_me = natsave; 2559ab25eeb5Syz155240 nat->nat_dir = direction; 2560e6c6c1faSyz155240 nat->nat_ifps[0] = np->in_ifps[0]; 2561e6c6c1faSyz155240 nat->nat_ifps[1] = np->in_ifps[1]; 2562ab25eeb5Syz155240 nat->nat_ptr = np; 2563ab25eeb5Syz155240 nat->nat_p = fin->fin_p; 2564ab25eeb5Syz155240 nat->nat_mssclamp = np->in_mssclamp; 2565ab25eeb5Syz155240 fr = fin->fin_fr; 2566ab25eeb5Syz155240 nat->nat_fr = fr; 2567ab25eeb5Syz155240 2568ab25eeb5Syz155240 if ((np->in_apr != NULL) && ((ni->nai_flags & NAT_SLAVE) == 0)) 2569ab25eeb5Syz155240 if (appr_new(fin, nat) == -1) 2570ab25eeb5Syz155240 return -1; 2571ab25eeb5Syz155240 2572f4b3ec61Sdh155122 if (nat_insert(nat, fin->fin_rev, ifs) == 0) { 2573f4b3ec61Sdh155122 if (ifs->ifs_nat_logging) 2574f4b3ec61Sdh155122 nat_log(nat, (u_int)np->in_redir, ifs); 2575ab25eeb5Syz155240 np->in_use++; 2576ab25eeb5Syz155240 if (fr != NULL) { 2577ab25eeb5Syz155240 MUTEX_ENTER(&fr->fr_lock); 2578ab25eeb5Syz155240 fr->fr_ref++; 2579ab25eeb5Syz155240 MUTEX_EXIT(&fr->fr_lock); 2580ab25eeb5Syz155240 } 2581ab25eeb5Syz155240 return 0; 2582ab25eeb5Syz155240 } 2583ab25eeb5Syz155240 2584ab25eeb5Syz155240 /* 2585ab25eeb5Syz155240 * nat_insert failed, so cleanup time... 2586ab25eeb5Syz155240 */ 2587ab25eeb5Syz155240 return -1; 2588ab25eeb5Syz155240 } 2589ab25eeb5Syz155240 2590ab25eeb5Syz155240 2591ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2592ab25eeb5Syz155240 /* Function: nat_insert */ 2593ab25eeb5Syz155240 /* Returns: int - 0 == sucess, -1 == failure */ 2594ab25eeb5Syz155240 /* Parameters: nat(I) - pointer to NAT structure */ 2595ab25eeb5Syz155240 /* rev(I) - flag indicating forward/reverse direction of packet */ 2596ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 2597ab25eeb5Syz155240 /* */ 2598ab25eeb5Syz155240 /* Insert a NAT entry into the hash tables for searching and add it to the */ 2599ab25eeb5Syz155240 /* list of active NAT entries. Adjust global counters when complete. */ 2600ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2601f4b3ec61Sdh155122 int nat_insert(nat, rev, ifs) 2602ab25eeb5Syz155240 nat_t *nat; 2603ab25eeb5Syz155240 int rev; 2604f4b3ec61Sdh155122 ipf_stack_t *ifs; 2605ab25eeb5Syz155240 { 2606ab25eeb5Syz155240 u_int hv1, hv2; 2607ab25eeb5Syz155240 nat_t **natp; 2608ab25eeb5Syz155240 2609ab25eeb5Syz155240 /* 2610ab25eeb5Syz155240 * Try and return an error as early as possible, so calculate the hash 2611ab25eeb5Syz155240 * entry numbers first and then proceed. 2612ab25eeb5Syz155240 */ 2613ab25eeb5Syz155240 if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) { 2614ab25eeb5Syz155240 hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport, 2615ab25eeb5Syz155240 0xffffffff); 2616ab25eeb5Syz155240 hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1 + nat->nat_oport, 2617f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 2618ab25eeb5Syz155240 hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport, 2619ab25eeb5Syz155240 0xffffffff); 2620ab25eeb5Syz155240 hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2 + nat->nat_oport, 2621f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 2622ab25eeb5Syz155240 } else { 2623ab25eeb5Syz155240 hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, 0, 0xffffffff); 2624f4b3ec61Sdh155122 hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1, 2625f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 2626ab25eeb5Syz155240 hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, 0, 0xffffffff); 2627f4b3ec61Sdh155122 hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2, 2628f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 2629ab25eeb5Syz155240 } 2630ab25eeb5Syz155240 2631f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[0][hv1] >= ifs->ifs_fr_nat_maxbucket || 2632f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][hv2] >= ifs->ifs_fr_nat_maxbucket) { 2633ab25eeb5Syz155240 return -1; 2634ab25eeb5Syz155240 } 2635ab25eeb5Syz155240 2636ab25eeb5Syz155240 nat->nat_hv[0] = hv1; 2637ab25eeb5Syz155240 nat->nat_hv[1] = hv2; 2638ab25eeb5Syz155240 2639ab25eeb5Syz155240 MUTEX_INIT(&nat->nat_lock, "nat entry lock"); 2640ab25eeb5Syz155240 2641ab25eeb5Syz155240 nat->nat_rev = rev; 2642ab25eeb5Syz155240 nat->nat_ref = 1; 2643ab25eeb5Syz155240 nat->nat_bytes[0] = 0; 2644ab25eeb5Syz155240 nat->nat_pkts[0] = 0; 2645ab25eeb5Syz155240 nat->nat_bytes[1] = 0; 2646ab25eeb5Syz155240 nat->nat_pkts[1] = 0; 2647ab25eeb5Syz155240 2648ab25eeb5Syz155240 nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0'; 2649f4b3ec61Sdh155122 nat->nat_ifps[0] = fr_resolvenic(nat->nat_ifnames[0], 4, ifs); 2650ab25eeb5Syz155240 2651ab25eeb5Syz155240 if (nat->nat_ifnames[1][0] !='\0') { 2652ab25eeb5Syz155240 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0'; 2653f4b3ec61Sdh155122 nat->nat_ifps[1] = fr_resolvenic(nat->nat_ifnames[1], 4, ifs); 2654ab25eeb5Syz155240 } else { 2655ab25eeb5Syz155240 (void) strncpy(nat->nat_ifnames[1], nat->nat_ifnames[0], 2656ab25eeb5Syz155240 LIFNAMSIZ); 2657ab25eeb5Syz155240 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0'; 2658ab25eeb5Syz155240 nat->nat_ifps[1] = nat->nat_ifps[0]; 2659ab25eeb5Syz155240 } 2660ab25eeb5Syz155240 2661f4b3ec61Sdh155122 nat->nat_next = ifs->ifs_nat_instances; 2662f4b3ec61Sdh155122 nat->nat_pnext = &ifs->ifs_nat_instances; 2663f4b3ec61Sdh155122 if (ifs->ifs_nat_instances) 2664f4b3ec61Sdh155122 ifs->ifs_nat_instances->nat_pnext = &nat->nat_next; 2665f4b3ec61Sdh155122 ifs->ifs_nat_instances = nat; 2666ab25eeb5Syz155240 2667f4b3ec61Sdh155122 natp = &ifs->ifs_nat_table[0][hv1]; 2668ab25eeb5Syz155240 if (*natp) 2669ab25eeb5Syz155240 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 2670ab25eeb5Syz155240 nat->nat_phnext[0] = natp; 2671ab25eeb5Syz155240 nat->nat_hnext[0] = *natp; 2672ab25eeb5Syz155240 *natp = nat; 2673f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0][hv1]++; 2674ab25eeb5Syz155240 2675f4b3ec61Sdh155122 natp = &ifs->ifs_nat_table[1][hv2]; 2676ab25eeb5Syz155240 if (*natp) 2677ab25eeb5Syz155240 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 2678ab25eeb5Syz155240 nat->nat_phnext[1] = natp; 2679ab25eeb5Syz155240 nat->nat_hnext[1] = *natp; 2680ab25eeb5Syz155240 *natp = nat; 2681f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][hv2]++; 2682ab25eeb5Syz155240 2683f4b3ec61Sdh155122 fr_setnatqueue(nat, rev, ifs); 2684ab25eeb5Syz155240 2685f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_added++; 2686f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_inuse++; 2687ab25eeb5Syz155240 return 0; 2688ab25eeb5Syz155240 } 2689ab25eeb5Syz155240 2690ab25eeb5Syz155240 2691ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2692ab25eeb5Syz155240 /* Function: nat_icmperrorlookup */ 2693ab25eeb5Syz155240 /* Returns: nat_t* - point to matching NAT structure */ 2694ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2695ab25eeb5Syz155240 /* dir(I) - direction of packet (in/out) */ 2696ab25eeb5Syz155240 /* */ 2697ab25eeb5Syz155240 /* Check if the ICMP error message is related to an existing TCP, UDP or */ 2698ab25eeb5Syz155240 /* ICMP query nat entry. It is assumed that the packet is already of the */ 2699ab25eeb5Syz155240 /* the required length. */ 2700ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2701ab25eeb5Syz155240 nat_t *nat_icmperrorlookup(fin, dir) 2702ab25eeb5Syz155240 fr_info_t *fin; 2703ab25eeb5Syz155240 int dir; 2704ab25eeb5Syz155240 { 2705ab25eeb5Syz155240 int flags = 0, minlen; 2706ab25eeb5Syz155240 icmphdr_t *orgicmp; 2707ab25eeb5Syz155240 tcphdr_t *tcp = NULL; 2708ab25eeb5Syz155240 u_short data[2]; 2709ab25eeb5Syz155240 nat_t *nat; 2710ab25eeb5Syz155240 ip_t *oip; 2711ab25eeb5Syz155240 u_int p; 2712ab25eeb5Syz155240 2713ab25eeb5Syz155240 /* 2714ab25eeb5Syz155240 * Does it at least have the return (basic) IP header ? 2715ab25eeb5Syz155240 * Only a basic IP header (no options) should be with an ICMP error 2716ab25eeb5Syz155240 * header. Also, if it's not an error type, then return. 2717ab25eeb5Syz155240 */ 2718ab25eeb5Syz155240 if ((fin->fin_hlen != sizeof(ip_t)) || !(fin->fin_flx & FI_ICMPERR)) 2719ab25eeb5Syz155240 return NULL; 2720ab25eeb5Syz155240 2721ab25eeb5Syz155240 /* 2722ab25eeb5Syz155240 * Check packet size 2723ab25eeb5Syz155240 */ 2724ab25eeb5Syz155240 oip = (ip_t *)((char *)fin->fin_dp + 8); 2725ab25eeb5Syz155240 minlen = IP_HL(oip) << 2; 2726ab25eeb5Syz155240 if ((minlen < sizeof(ip_t)) || 2727ab25eeb5Syz155240 (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen)) 2728ab25eeb5Syz155240 return NULL; 2729ab25eeb5Syz155240 /* 2730ab25eeb5Syz155240 * Is the buffer big enough for all of it ? It's the size of the IP 2731ab25eeb5Syz155240 * header claimed in the encapsulated part which is of concern. It 2732ab25eeb5Syz155240 * may be too big to be in this buffer but not so big that it's 2733ab25eeb5Syz155240 * outside the ICMP packet, leading to TCP deref's causing problems. 2734ab25eeb5Syz155240 * This is possible because we don't know how big oip_hl is when we 2735ab25eeb5Syz155240 * do the pullup early in fr_check() and thus can't gaurantee it is 2736ab25eeb5Syz155240 * all here now. 2737ab25eeb5Syz155240 */ 2738ab25eeb5Syz155240 #ifdef _KERNEL 2739ab25eeb5Syz155240 { 2740ab25eeb5Syz155240 mb_t *m; 2741ab25eeb5Syz155240 2742ab25eeb5Syz155240 m = fin->fin_m; 2743ab25eeb5Syz155240 # if defined(MENTAT) 2744ab25eeb5Syz155240 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > (char *)m->b_wptr) 2745ab25eeb5Syz155240 return NULL; 2746ab25eeb5Syz155240 # else 2747ab25eeb5Syz155240 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > 2748ab25eeb5Syz155240 (char *)fin->fin_ip + M_LEN(m)) 2749ab25eeb5Syz155240 return NULL; 2750ab25eeb5Syz155240 # endif 2751ab25eeb5Syz155240 } 2752ab25eeb5Syz155240 #endif 2753ab25eeb5Syz155240 2754ab25eeb5Syz155240 if (fin->fin_daddr != oip->ip_src.s_addr) 2755ab25eeb5Syz155240 return NULL; 2756ab25eeb5Syz155240 2757ab25eeb5Syz155240 p = oip->ip_p; 2758ab25eeb5Syz155240 if (p == IPPROTO_TCP) 2759ab25eeb5Syz155240 flags = IPN_TCP; 2760ab25eeb5Syz155240 else if (p == IPPROTO_UDP) 2761ab25eeb5Syz155240 flags = IPN_UDP; 2762ab25eeb5Syz155240 else if (p == IPPROTO_ICMP) { 2763ab25eeb5Syz155240 orgicmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 2764ab25eeb5Syz155240 2765ab25eeb5Syz155240 /* see if this is related to an ICMP query */ 2766ab25eeb5Syz155240 if (nat_icmpquerytype4(orgicmp->icmp_type)) { 2767ab25eeb5Syz155240 data[0] = fin->fin_data[0]; 2768ab25eeb5Syz155240 data[1] = fin->fin_data[1]; 2769ab25eeb5Syz155240 fin->fin_data[0] = 0; 2770ab25eeb5Syz155240 fin->fin_data[1] = orgicmp->icmp_id; 2771ab25eeb5Syz155240 2772ab25eeb5Syz155240 flags = IPN_ICMPERR|IPN_ICMPQUERY; 2773ab25eeb5Syz155240 /* 2774ab25eeb5Syz155240 * NOTE : dir refers to the direction of the original 2775ab25eeb5Syz155240 * ip packet. By definition the icmp error 2776ab25eeb5Syz155240 * message flows in the opposite direction. 2777ab25eeb5Syz155240 */ 2778ab25eeb5Syz155240 if (dir == NAT_INBOUND) 2779ab25eeb5Syz155240 nat = nat_inlookup(fin, flags, p, oip->ip_dst, 2780ab25eeb5Syz155240 oip->ip_src); 2781ab25eeb5Syz155240 else 2782ab25eeb5Syz155240 nat = nat_outlookup(fin, flags, p, oip->ip_dst, 2783ab25eeb5Syz155240 oip->ip_src); 2784ab25eeb5Syz155240 fin->fin_data[0] = data[0]; 2785ab25eeb5Syz155240 fin->fin_data[1] = data[1]; 2786ab25eeb5Syz155240 return nat; 2787ab25eeb5Syz155240 } 2788ab25eeb5Syz155240 } 2789ab25eeb5Syz155240 2790ab25eeb5Syz155240 if (flags & IPN_TCPUDP) { 2791ab25eeb5Syz155240 minlen += 8; /* + 64bits of data to get ports */ 2792ab25eeb5Syz155240 if (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen) 2793ab25eeb5Syz155240 return NULL; 2794ab25eeb5Syz155240 2795ab25eeb5Syz155240 data[0] = fin->fin_data[0]; 2796ab25eeb5Syz155240 data[1] = fin->fin_data[1]; 2797ab25eeb5Syz155240 tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 2798ab25eeb5Syz155240 fin->fin_data[0] = ntohs(tcp->th_dport); 2799ab25eeb5Syz155240 fin->fin_data[1] = ntohs(tcp->th_sport); 2800ab25eeb5Syz155240 2801ab25eeb5Syz155240 if (dir == NAT_INBOUND) { 2802ab25eeb5Syz155240 nat = nat_inlookup(fin, flags, p, oip->ip_dst, 2803ab25eeb5Syz155240 oip->ip_src); 2804ab25eeb5Syz155240 } else { 2805ab25eeb5Syz155240 nat = nat_outlookup(fin, flags, p, oip->ip_dst, 2806ab25eeb5Syz155240 oip->ip_src); 2807ab25eeb5Syz155240 } 2808ab25eeb5Syz155240 fin->fin_data[0] = data[0]; 2809ab25eeb5Syz155240 fin->fin_data[1] = data[1]; 2810ab25eeb5Syz155240 return nat; 2811ab25eeb5Syz155240 } 2812ab25eeb5Syz155240 if (dir == NAT_INBOUND) 2813ab25eeb5Syz155240 return nat_inlookup(fin, 0, p, oip->ip_dst, oip->ip_src); 2814ab25eeb5Syz155240 else 2815ab25eeb5Syz155240 return nat_outlookup(fin, 0, p, oip->ip_dst, oip->ip_src); 2816ab25eeb5Syz155240 } 2817ab25eeb5Syz155240 2818ab25eeb5Syz155240 2819ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2820ab25eeb5Syz155240 /* Function: nat_icmperror */ 2821ab25eeb5Syz155240 /* Returns: nat_t* - point to matching NAT structure */ 2822ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 2823ab25eeb5Syz155240 /* nflags(I) - NAT flags for this packet */ 2824ab25eeb5Syz155240 /* dir(I) - direction of packet (in/out) */ 2825ab25eeb5Syz155240 /* */ 2826ab25eeb5Syz155240 /* Fix up an ICMP packet which is an error message for an existing NAT */ 2827ab25eeb5Syz155240 /* session. This will correct both packet header data and checksums. */ 2828ab25eeb5Syz155240 /* */ 2829ab25eeb5Syz155240 /* This should *ONLY* be used for incoming ICMP error packets to make sure */ 2830ab25eeb5Syz155240 /* a NAT'd ICMP packet gets correctly recognised. */ 2831ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 2832ab25eeb5Syz155240 nat_t *nat_icmperror(fin, nflags, dir) 2833ab25eeb5Syz155240 fr_info_t *fin; 2834ab25eeb5Syz155240 u_int *nflags; 2835ab25eeb5Syz155240 int dir; 2836ab25eeb5Syz155240 { 28375142ed1fSjojemann u_32_t sum1, sum2, sumd, psum1, psum2, psumd, sumd2; 2838ab25eeb5Syz155240 struct in_addr in; 28395142ed1fSjojemann icmphdr_t *icmp, *orgicmp; 28405142ed1fSjojemann int dlen; 28415142ed1fSjojemann udphdr_t *udp; 2842ab25eeb5Syz155240 tcphdr_t *tcp; 2843ab25eeb5Syz155240 nat_t *nat; 2844ab25eeb5Syz155240 ip_t *oip; 2845ab25eeb5Syz155240 if ((fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) 2846ab25eeb5Syz155240 return NULL; 28475142ed1fSjojemann 2848ab25eeb5Syz155240 /* 28495142ed1fSjojemann * nat_icmperrorlookup() looks up nat entry associated with the 28505142ed1fSjojemann * offending IP packet and returns pointer to the entry, or NULL 28515142ed1fSjojemann * if packet wasn't natted or for `defective' packets. 2852ab25eeb5Syz155240 */ 28535142ed1fSjojemann 2854ab25eeb5Syz155240 if ((fin->fin_v != 4) || !(nat = nat_icmperrorlookup(fin, dir))) 2855ab25eeb5Syz155240 return NULL; 2856ab25eeb5Syz155240 2857ab25eeb5Syz155240 sumd2 = 0; 2858ab25eeb5Syz155240 *nflags = IPN_ICMPERR; 2859ab25eeb5Syz155240 icmp = fin->fin_dp; 2860ab25eeb5Syz155240 oip = (ip_t *)&icmp->icmp_ip; 28615142ed1fSjojemann udp = (udphdr_t *)((((char *)oip) + (IP_HL(oip) << 2))); 28625142ed1fSjojemann tcp = (tcphdr_t *)udp; 28635142ed1fSjojemann dlen = fin->fin_plen - ((char *)udp - (char *)fin->fin_ip); 2864ab25eeb5Syz155240 2865ab25eeb5Syz155240 /* 2866ab25eeb5Syz155240 * Need to adjust ICMP header to include the real IP#'s and 28675142ed1fSjojemann * port #'s. There are three steps required. 2868ab25eeb5Syz155240 * 28695142ed1fSjojemann * Step 1 28705142ed1fSjojemann * Fix the IP addresses in the offending IP packet and update 28715142ed1fSjojemann * ip header checksum to compensate for the change. 28725142ed1fSjojemann * 28735142ed1fSjojemann * No update needed here for icmp_cksum because the ICMP checksum 28745142ed1fSjojemann * is calculated over the complete ICMP packet, which includes the 28755142ed1fSjojemann * changed oip IP addresses and oip->ip_sum. These two changes 28765142ed1fSjojemann * cancel each other out (if the delta for the IP address is x, 28775142ed1fSjojemann * then the delta for ip_sum is minus x). 2878ab25eeb5Syz155240 */ 2879ab25eeb5Syz155240 2880ab25eeb5Syz155240 if (oip->ip_dst.s_addr == nat->nat_oip.s_addr) { 2881ab25eeb5Syz155240 sum1 = LONG_SUM(ntohl(oip->ip_src.s_addr)); 2882ab25eeb5Syz155240 in = nat->nat_inip; 2883ab25eeb5Syz155240 oip->ip_src = in; 2884ab25eeb5Syz155240 } else { 2885ab25eeb5Syz155240 sum1 = LONG_SUM(ntohl(oip->ip_dst.s_addr)); 2886ab25eeb5Syz155240 in = nat->nat_outip; 2887ab25eeb5Syz155240 oip->ip_dst = in; 2888ab25eeb5Syz155240 } 2889ab25eeb5Syz155240 2890ab25eeb5Syz155240 sum2 = LONG_SUM(ntohl(in.s_addr)); 2891ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 2892ab25eeb5Syz155240 fix_datacksum(&oip->ip_sum, sumd); 2893ab25eeb5Syz155240 2894ab25eeb5Syz155240 /* 28955142ed1fSjojemann * Step 2 28965142ed1fSjojemann * Perform other adjustments based on protocol of offending packet. 2897ab25eeb5Syz155240 */ 28985142ed1fSjojemann 28995142ed1fSjojemann switch (oip->ip_p) { 29005142ed1fSjojemann case IPPROTO_TCP : 29015142ed1fSjojemann case IPPROTO_UDP : 2902ab25eeb5Syz155240 2903ab25eeb5Syz155240 /* 29045142ed1fSjojemann * For offending TCP/UDP IP packets, translate the ports 29055142ed1fSjojemann * based on the NAT specification. 2906ab25eeb5Syz155240 * 2907ab25eeb5Syz155240 * Advance notice : Now it becomes complicated :-) 2908ab25eeb5Syz155240 * 29095142ed1fSjojemann * Since the port and IP addresse fields are both part 29105142ed1fSjojemann * of the TCP/UDP checksum of the offending IP packet, 29115142ed1fSjojemann * we need to adjust that checksum as well. 2912ab25eeb5Syz155240 * 29135142ed1fSjojemann * To further complicate things, the TCP/UDP checksum 29145142ed1fSjojemann * may not be present. We must check to see if the 29155142ed1fSjojemann * length of the data portion is big enough to hold 29165142ed1fSjojemann * the checksum. In the UDP case, a test to determine 29175142ed1fSjojemann * if the checksum is even set is also required. 29185142ed1fSjojemann * 29195142ed1fSjojemann * Any changes to an IP address, port or checksum within 29205142ed1fSjojemann * the ICMP packet requires a change to icmp_cksum. 29215142ed1fSjojemann * 29225142ed1fSjojemann * Be extremely careful here ... The change is dependent 29235142ed1fSjojemann * upon whether or not the TCP/UPD checksum is present. 29245142ed1fSjojemann * 29255142ed1fSjojemann * If TCP/UPD checksum is present, the icmp_cksum must 29265142ed1fSjojemann * compensate for checksum modification resulting from 29275142ed1fSjojemann * IP address change only. Port change and resulting 29285142ed1fSjojemann * data checksum adjustments cancel each other out. 29295142ed1fSjojemann * 29305142ed1fSjojemann * If TCP/UDP checksum is not present, icmp_cksum must 29315142ed1fSjojemann * compensate for port change only. The IP address 29325142ed1fSjojemann * change does not modify anything else in this case. 2933ab25eeb5Syz155240 */ 2934ab25eeb5Syz155240 29355142ed1fSjojemann psum1 = 0; 29365142ed1fSjojemann psum2 = 0; 29375142ed1fSjojemann psumd = 0; 29385142ed1fSjojemann 29395142ed1fSjojemann if ((tcp->th_dport == nat->nat_oport) && 29405142ed1fSjojemann (tcp->th_sport != nat->nat_inport)) { 29415142ed1fSjojemann 29425142ed1fSjojemann /* 29435142ed1fSjojemann * Translate the source port. 29445142ed1fSjojemann */ 29455142ed1fSjojemann 29465142ed1fSjojemann psum1 = ntohs(tcp->th_sport); 29475142ed1fSjojemann psum2 = ntohs(nat->nat_inport); 29485142ed1fSjojemann tcp->th_sport = nat->nat_inport; 29495142ed1fSjojemann 29505142ed1fSjojemann } else if ((tcp->th_sport == nat->nat_oport) && 29515142ed1fSjojemann (tcp->th_dport != nat->nat_outport)) { 29525142ed1fSjojemann 29535142ed1fSjojemann /* 29545142ed1fSjojemann * Translate the destination port. 29555142ed1fSjojemann */ 29565142ed1fSjojemann 29575142ed1fSjojemann psum1 = ntohs(tcp->th_dport); 29585142ed1fSjojemann psum2 = ntohs(nat->nat_outport); 29595142ed1fSjojemann tcp->th_dport = nat->nat_outport; 2960ab25eeb5Syz155240 } 2961ab25eeb5Syz155240 29625142ed1fSjojemann if ((oip->ip_p == IPPROTO_TCP) && (dlen >= 18)) { 2963ab25eeb5Syz155240 2964ab25eeb5Syz155240 /* 29655142ed1fSjojemann * TCP checksum present. 2966ab25eeb5Syz155240 * 29675142ed1fSjojemann * Adjust data checksum and icmp checksum to 29685142ed1fSjojemann * compensate for any IP address change. 2969ab25eeb5Syz155240 */ 2970ab25eeb5Syz155240 29715142ed1fSjojemann sum1 = ntohs(tcp->th_sum); 29725142ed1fSjojemann fix_datacksum(&tcp->th_sum, sumd); 29735142ed1fSjojemann sum2 = ntohs(tcp->th_sum); 29745142ed1fSjojemann sumd2 = sumd << 1; 2975ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 2976ab25eeb5Syz155240 sumd2 += sumd; 29775142ed1fSjojemann 29785142ed1fSjojemann /* 29795142ed1fSjojemann * Also make data checksum adjustment to 29805142ed1fSjojemann * compensate for any port change. 29815142ed1fSjojemann */ 29825142ed1fSjojemann 29835142ed1fSjojemann if (psum1 != psum2) { 29845142ed1fSjojemann CALC_SUMD(psum1, psum2, psumd); 29855142ed1fSjojemann fix_datacksum(&tcp->th_sum, psumd); 2986ab25eeb5Syz155240 } 2987ab25eeb5Syz155240 29885142ed1fSjojemann } else if ((oip->ip_p == IPPROTO_UDP) && 29895142ed1fSjojemann (dlen >= 8) && (udp->uh_sum != 0)) { 2990ab25eeb5Syz155240 2991ab25eeb5Syz155240 /* 29925142ed1fSjojemann * The UDP checksum is present and set. 29935142ed1fSjojemann * 29945142ed1fSjojemann * Adjust data checksum and icmp checksum to 29955142ed1fSjojemann * compensate for any IP address change. 2996ab25eeb5Syz155240 */ 29975142ed1fSjojemann 29985142ed1fSjojemann sum1 = ntohs(udp->uh_sum); 29995142ed1fSjojemann fix_datacksum(&udp->uh_sum, sumd); 30005142ed1fSjojemann sum2 = ntohs(udp->uh_sum); 30015142ed1fSjojemann sumd2 = sumd << 1; 3002ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 3003ab25eeb5Syz155240 sumd2 += sumd; 30045142ed1fSjojemann 30055142ed1fSjojemann /* 30065142ed1fSjojemann * Also make data checksum adjustment to 30075142ed1fSjojemann * compensate for any port change. 30085142ed1fSjojemann */ 30095142ed1fSjojemann 30105142ed1fSjojemann if (psum1 != psum2) { 30115142ed1fSjojemann CALC_SUMD(psum1, psum2, psumd); 30125142ed1fSjojemann fix_datacksum(&udp->uh_sum, psumd); 30135142ed1fSjojemann } 30145142ed1fSjojemann 3015ab25eeb5Syz155240 } else { 3016ab25eeb5Syz155240 3017ab25eeb5Syz155240 /* 30185142ed1fSjojemann * Data checksum was not present. 3019ab25eeb5Syz155240 * 30205142ed1fSjojemann * Compensate for any port change. 3021ab25eeb5Syz155240 */ 3022ab25eeb5Syz155240 30235142ed1fSjojemann CALC_SUMD(psum2, psum1, psumd); 30245142ed1fSjojemann sumd2 += psumd; 3025ab25eeb5Syz155240 } 30265142ed1fSjojemann break; 3027ab25eeb5Syz155240 30285142ed1fSjojemann case IPPROTO_ICMP : 3029ab25eeb5Syz155240 30305142ed1fSjojemann orgicmp = (icmphdr_t *)udp; 3031ab25eeb5Syz155240 30325142ed1fSjojemann if ((nat->nat_dir == NAT_OUTBOUND) && 30335142ed1fSjojemann (orgicmp->icmp_id != nat->nat_inport) && 30345142ed1fSjojemann (dlen >= 8)) { 3035ab25eeb5Syz155240 3036ab25eeb5Syz155240 /* 3037ab25eeb5Syz155240 * Fix ICMP checksum (of the offening ICMP 3038ab25eeb5Syz155240 * query packet) to compensate the change 3039ab25eeb5Syz155240 * in the ICMP id of the offending ICMP 3040ab25eeb5Syz155240 * packet. 3041ab25eeb5Syz155240 * 3042ab25eeb5Syz155240 * Since you modify orgicmp->icmp_id with 3043ab25eeb5Syz155240 * a delta (say x) and you compensate that 3044ab25eeb5Syz155240 * in origicmp->icmp_cksum with a delta 3045ab25eeb5Syz155240 * minus x, you don't have to adjust the 3046ab25eeb5Syz155240 * overall icmp->icmp_cksum 3047ab25eeb5Syz155240 */ 30485142ed1fSjojemann 3049ab25eeb5Syz155240 sum1 = ntohs(orgicmp->icmp_id); 3050ab25eeb5Syz155240 sum2 = ntohs(nat->nat_inport); 3051ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 3052ab25eeb5Syz155240 orgicmp->icmp_id = nat->nat_inport; 3053ab25eeb5Syz155240 fix_datacksum(&orgicmp->icmp_cksum, sumd); 30545142ed1fSjojemann 30555142ed1fSjojemann } /* nat_dir can't be NAT_INBOUND for icmp queries */ 30565142ed1fSjojemann 30575142ed1fSjojemann break; 30585142ed1fSjojemann 30595142ed1fSjojemann default : 30605142ed1fSjojemann 30615142ed1fSjojemann break; 30625142ed1fSjojemann 30635142ed1fSjojemann } /* switch (oip->ip_p) */ 30645142ed1fSjojemann 30655142ed1fSjojemann /* 30665142ed1fSjojemann * Step 3 30675142ed1fSjojemann * Make the adjustments to icmp checksum. 30685142ed1fSjojemann */ 30695142ed1fSjojemann 30705142ed1fSjojemann if (sumd2 != 0) { 30715142ed1fSjojemann sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 30725142ed1fSjojemann sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 3073381a2a9aSdr146992 fix_incksum(&icmp->icmp_cksum, sumd2); 3074ab25eeb5Syz155240 } 3075ab25eeb5Syz155240 return nat; 3076ab25eeb5Syz155240 } 3077ab25eeb5Syz155240 3078ab25eeb5Syz155240 3079ab25eeb5Syz155240 /* 3080ab25eeb5Syz155240 * NB: these lookups don't lock access to the list, it assumed that it has 3081ab25eeb5Syz155240 * already been done! 3082ab25eeb5Syz155240 */ 3083ab25eeb5Syz155240 3084ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3085ab25eeb5Syz155240 /* Function: nat_inlookup */ 3086ab25eeb5Syz155240 /* Returns: nat_t* - NULL == no match, */ 3087ab25eeb5Syz155240 /* else pointer to matching NAT entry */ 3088ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3089ab25eeb5Syz155240 /* flags(I) - NAT flags for this packet */ 3090ab25eeb5Syz155240 /* p(I) - protocol for this packet */ 3091ab25eeb5Syz155240 /* src(I) - source IP address */ 3092ab25eeb5Syz155240 /* mapdst(I) - destination IP address */ 3093ab25eeb5Syz155240 /* */ 3094ab25eeb5Syz155240 /* Lookup a nat entry based on the mapped destination ip address/port and */ 3095ab25eeb5Syz155240 /* real source address/port. We use this lookup when receiving a packet, */ 3096ab25eeb5Syz155240 /* we're looking for a table entry, based on the destination address. */ 3097ab25eeb5Syz155240 /* */ 3098ab25eeb5Syz155240 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */ 3099ab25eeb5Syz155240 /* */ 3100ab25eeb5Syz155240 /* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN */ 3101ab25eeb5Syz155240 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */ 3102ab25eeb5Syz155240 /* */ 3103ab25eeb5Syz155240 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */ 3104ab25eeb5Syz155240 /* the packet is of said protocol */ 3105ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3106ab25eeb5Syz155240 nat_t *nat_inlookup(fin, flags, p, src, mapdst) 3107ab25eeb5Syz155240 fr_info_t *fin; 3108ab25eeb5Syz155240 u_int flags, p; 3109ab25eeb5Syz155240 struct in_addr src , mapdst; 3110ab25eeb5Syz155240 { 3111ab25eeb5Syz155240 u_short sport, dport; 3112ab25eeb5Syz155240 ipnat_t *ipn; 3113ab25eeb5Syz155240 u_int sflags; 3114ab25eeb5Syz155240 nat_t *nat; 3115ab25eeb5Syz155240 int nflags; 3116ab25eeb5Syz155240 u_32_t dst; 3117ab25eeb5Syz155240 void *ifp; 3118ab25eeb5Syz155240 u_int hv; 3119f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3120ab25eeb5Syz155240 3121ab25eeb5Syz155240 if (fin != NULL) 3122ab25eeb5Syz155240 ifp = fin->fin_ifp; 3123ab25eeb5Syz155240 else 3124ab25eeb5Syz155240 ifp = NULL; 3125ab25eeb5Syz155240 sport = 0; 3126ab25eeb5Syz155240 dport = 0; 3127ab25eeb5Syz155240 dst = mapdst.s_addr; 3128ab25eeb5Syz155240 sflags = flags & NAT_TCPUDPICMP; 3129ab25eeb5Syz155240 3130ab25eeb5Syz155240 switch (p) 3131ab25eeb5Syz155240 { 3132ab25eeb5Syz155240 case IPPROTO_TCP : 3133ab25eeb5Syz155240 case IPPROTO_UDP : 3134ab25eeb5Syz155240 sport = htons(fin->fin_data[0]); 3135ab25eeb5Syz155240 dport = htons(fin->fin_data[1]); 3136ab25eeb5Syz155240 break; 3137ab25eeb5Syz155240 case IPPROTO_ICMP : 3138ab25eeb5Syz155240 if (flags & IPN_ICMPERR) 3139ab25eeb5Syz155240 sport = fin->fin_data[1]; 3140ab25eeb5Syz155240 else 3141ab25eeb5Syz155240 dport = fin->fin_data[1]; 3142ab25eeb5Syz155240 break; 3143ab25eeb5Syz155240 default : 3144ab25eeb5Syz155240 break; 3145ab25eeb5Syz155240 } 3146ab25eeb5Syz155240 3147ab25eeb5Syz155240 3148ab25eeb5Syz155240 if ((flags & SI_WILDP) != 0) 3149ab25eeb5Syz155240 goto find_in_wild_ports; 3150ab25eeb5Syz155240 3151ab25eeb5Syz155240 hv = NAT_HASH_FN(dst, dport, 0xffffffff); 3152f4b3ec61Sdh155122 hv = NAT_HASH_FN(src.s_addr, hv + sport, ifs->ifs_ipf_nattable_sz); 3153f4b3ec61Sdh155122 nat = ifs->ifs_nat_table[1][hv]; 3154ab25eeb5Syz155240 for (; nat; nat = nat->nat_hnext[1]) { 3155e6c6c1faSyz155240 if (nat->nat_ifps[0] != NULL) { 3156e6c6c1faSyz155240 if ((ifp != NULL) && (ifp != nat->nat_ifps[0])) 3157e6c6c1faSyz155240 continue; 3158e6c6c1faSyz155240 } else if (ifp != NULL) 3159e6c6c1faSyz155240 nat->nat_ifps[0] = ifp; 3160ab25eeb5Syz155240 3161e6c6c1faSyz155240 nflags = nat->nat_flags; 3162ab25eeb5Syz155240 3163ab25eeb5Syz155240 if (nat->nat_oip.s_addr == src.s_addr && 3164ab25eeb5Syz155240 nat->nat_outip.s_addr == dst && 3165ab25eeb5Syz155240 (((p == 0) && 3166ab25eeb5Syz155240 (sflags == (nat->nat_flags & IPN_TCPUDPICMP))) 3167ab25eeb5Syz155240 || (p == nat->nat_p))) { 3168ab25eeb5Syz155240 switch (p) 3169ab25eeb5Syz155240 { 3170ab25eeb5Syz155240 #if 0 3171ab25eeb5Syz155240 case IPPROTO_GRE : 3172ab25eeb5Syz155240 if (nat->nat_call[1] != fin->fin_data[0]) 3173ab25eeb5Syz155240 continue; 3174ab25eeb5Syz155240 break; 3175ab25eeb5Syz155240 #endif 3176ab25eeb5Syz155240 case IPPROTO_ICMP : 3177ab25eeb5Syz155240 if ((flags & IPN_ICMPERR) != 0) { 3178ab25eeb5Syz155240 if (nat->nat_outport != sport) 3179ab25eeb5Syz155240 continue; 3180ab25eeb5Syz155240 } else { 3181ab25eeb5Syz155240 if (nat->nat_outport != dport) 3182ab25eeb5Syz155240 continue; 3183ab25eeb5Syz155240 } 3184ab25eeb5Syz155240 break; 3185ab25eeb5Syz155240 case IPPROTO_TCP : 3186ab25eeb5Syz155240 case IPPROTO_UDP : 3187ab25eeb5Syz155240 if (nat->nat_oport != sport) 3188ab25eeb5Syz155240 continue; 3189ab25eeb5Syz155240 if (nat->nat_outport != dport) 3190ab25eeb5Syz155240 continue; 3191ab25eeb5Syz155240 break; 3192ab25eeb5Syz155240 default : 3193ab25eeb5Syz155240 break; 3194ab25eeb5Syz155240 } 3195ab25eeb5Syz155240 3196ab25eeb5Syz155240 ipn = nat->nat_ptr; 3197ab25eeb5Syz155240 if ((ipn != NULL) && (nat->nat_aps != NULL)) 3198ab25eeb5Syz155240 if (appr_match(fin, nat) != 0) 3199ab25eeb5Syz155240 continue; 3200ab25eeb5Syz155240 return nat; 3201ab25eeb5Syz155240 } 3202ab25eeb5Syz155240 } 3203ab25eeb5Syz155240 3204ab25eeb5Syz155240 /* 3205ab25eeb5Syz155240 * So if we didn't find it but there are wildcard members in the hash 3206ab25eeb5Syz155240 * table, go back and look for them. We do this search and update here 3207ab25eeb5Syz155240 * because it is modifying the NAT table and we want to do this only 3208ab25eeb5Syz155240 * for the first packet that matches. The exception, of course, is 3209ab25eeb5Syz155240 * for "dummy" (FI_IGNORE) lookups. 3210ab25eeb5Syz155240 */ 3211ab25eeb5Syz155240 find_in_wild_ports: 3212ab25eeb5Syz155240 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) 3213ab25eeb5Syz155240 return NULL; 3214f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_wilds == 0) 3215ab25eeb5Syz155240 return NULL; 3216ab25eeb5Syz155240 3217f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3218ab25eeb5Syz155240 3219ab25eeb5Syz155240 hv = NAT_HASH_FN(dst, 0, 0xffffffff); 3220f4b3ec61Sdh155122 hv = NAT_HASH_FN(src.s_addr, hv, ifs->ifs_ipf_nattable_sz); 3221ab25eeb5Syz155240 3222f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 3223ab25eeb5Syz155240 3224f4b3ec61Sdh155122 nat = ifs->ifs_nat_table[1][hv]; 3225ab25eeb5Syz155240 for (; nat; nat = nat->nat_hnext[1]) { 3226e6c6c1faSyz155240 if (nat->nat_ifps[0] != NULL) { 3227e6c6c1faSyz155240 if ((ifp != NULL) && (ifp != nat->nat_ifps[0])) 3228ab25eeb5Syz155240 continue; 3229e6c6c1faSyz155240 } else if (ifp != NULL) 3230e6c6c1faSyz155240 nat->nat_ifps[0] = ifp; 3231ab25eeb5Syz155240 3232ab25eeb5Syz155240 if (nat->nat_p != fin->fin_p) 3233ab25eeb5Syz155240 continue; 3234ab25eeb5Syz155240 if (nat->nat_oip.s_addr != src.s_addr || 3235ab25eeb5Syz155240 nat->nat_outip.s_addr != dst) 3236ab25eeb5Syz155240 continue; 3237ab25eeb5Syz155240 3238ab25eeb5Syz155240 nflags = nat->nat_flags; 3239ab25eeb5Syz155240 if (!(nflags & (NAT_TCPUDP|SI_WILDP))) 3240ab25eeb5Syz155240 continue; 3241ab25eeb5Syz155240 3242ab25eeb5Syz155240 if (nat_wildok(nat, (int)sport, (int)dport, nflags, 3243ab25eeb5Syz155240 NAT_INBOUND) == 1) { 3244ab25eeb5Syz155240 if ((fin->fin_flx & FI_IGNORE) != 0) 3245ab25eeb5Syz155240 break; 3246ab25eeb5Syz155240 if ((nflags & SI_CLONE) != 0) { 3247ab25eeb5Syz155240 nat = fr_natclone(fin, nat); 3248ab25eeb5Syz155240 if (nat == NULL) 3249ab25eeb5Syz155240 break; 3250ab25eeb5Syz155240 } else { 3251f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 3252f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_wilds--; 3253f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 3254ab25eeb5Syz155240 } 3255ab25eeb5Syz155240 nat->nat_oport = sport; 3256ab25eeb5Syz155240 nat->nat_outport = dport; 3257ab25eeb5Syz155240 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT); 3258f4b3ec61Sdh155122 nat_tabmove(nat, ifs); 3259ab25eeb5Syz155240 break; 3260ab25eeb5Syz155240 } 3261ab25eeb5Syz155240 } 3262ab25eeb5Syz155240 3263f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 3264ab25eeb5Syz155240 3265ab25eeb5Syz155240 return nat; 3266ab25eeb5Syz155240 } 3267ab25eeb5Syz155240 3268ab25eeb5Syz155240 3269ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3270ab25eeb5Syz155240 /* Function: nat_tabmove */ 3271ab25eeb5Syz155240 /* Returns: Nil */ 3272ab25eeb5Syz155240 /* Parameters: nat(I) - pointer to NAT structure */ 3273ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 3274ab25eeb5Syz155240 /* */ 3275ab25eeb5Syz155240 /* This function is only called for TCP/UDP NAT table entries where the */ 3276ab25eeb5Syz155240 /* original was placed in the table without hashing on the ports and we now */ 3277ab25eeb5Syz155240 /* want to include hashing on port numbers. */ 3278ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3279f4b3ec61Sdh155122 static void nat_tabmove(nat, ifs) 3280ab25eeb5Syz155240 nat_t *nat; 3281f4b3ec61Sdh155122 ipf_stack_t *ifs; 3282ab25eeb5Syz155240 { 3283ab25eeb5Syz155240 nat_t **natp; 3284ab25eeb5Syz155240 u_int hv; 3285ab25eeb5Syz155240 3286ab25eeb5Syz155240 if (nat->nat_flags & SI_CLONE) 3287ab25eeb5Syz155240 return; 3288ab25eeb5Syz155240 3289ab25eeb5Syz155240 /* 3290ab25eeb5Syz155240 * Remove the NAT entry from the old location 3291ab25eeb5Syz155240 */ 3292ab25eeb5Syz155240 if (nat->nat_hnext[0]) 3293ab25eeb5Syz155240 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; 3294ab25eeb5Syz155240 *nat->nat_phnext[0] = nat->nat_hnext[0]; 3295f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0][nat->nat_hv[0]]--; 3296ab25eeb5Syz155240 3297ab25eeb5Syz155240 if (nat->nat_hnext[1]) 3298ab25eeb5Syz155240 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; 3299ab25eeb5Syz155240 *nat->nat_phnext[1] = nat->nat_hnext[1]; 3300f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][nat->nat_hv[1]]--; 3301ab25eeb5Syz155240 3302ab25eeb5Syz155240 /* 3303ab25eeb5Syz155240 * Add into the NAT table in the new position 3304ab25eeb5Syz155240 */ 3305ab25eeb5Syz155240 hv = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport, 0xffffffff); 3306ab25eeb5Syz155240 hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + nat->nat_oport, 3307f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 3308ab25eeb5Syz155240 nat->nat_hv[0] = hv; 3309f4b3ec61Sdh155122 natp = &ifs->ifs_nat_table[0][hv]; 3310ab25eeb5Syz155240 if (*natp) 3311ab25eeb5Syz155240 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 3312ab25eeb5Syz155240 nat->nat_phnext[0] = natp; 3313ab25eeb5Syz155240 nat->nat_hnext[0] = *natp; 3314ab25eeb5Syz155240 *natp = nat; 3315f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0][hv]++; 3316ab25eeb5Syz155240 3317ab25eeb5Syz155240 hv = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport, 0xffffffff); 3318ab25eeb5Syz155240 hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + nat->nat_oport, 3319f4b3ec61Sdh155122 ifs->ifs_ipf_nattable_sz); 3320ab25eeb5Syz155240 nat->nat_hv[1] = hv; 3321f4b3ec61Sdh155122 natp = &ifs->ifs_nat_table[1][hv]; 3322ab25eeb5Syz155240 if (*natp) 3323ab25eeb5Syz155240 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 3324ab25eeb5Syz155240 nat->nat_phnext[1] = natp; 3325ab25eeb5Syz155240 nat->nat_hnext[1] = *natp; 3326ab25eeb5Syz155240 *natp = nat; 3327f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1][hv]++; 3328ab25eeb5Syz155240 } 3329ab25eeb5Syz155240 3330ab25eeb5Syz155240 3331ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3332ab25eeb5Syz155240 /* Function: nat_outlookup */ 3333ab25eeb5Syz155240 /* Returns: nat_t* - NULL == no match, */ 3334ab25eeb5Syz155240 /* else pointer to matching NAT entry */ 3335ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3336ab25eeb5Syz155240 /* flags(I) - NAT flags for this packet */ 3337ab25eeb5Syz155240 /* p(I) - protocol for this packet */ 3338ab25eeb5Syz155240 /* src(I) - source IP address */ 3339ab25eeb5Syz155240 /* dst(I) - destination IP address */ 3340ab25eeb5Syz155240 /* rw(I) - 1 == write lock on ipf_nat held, 0 == read lock. */ 3341ab25eeb5Syz155240 /* */ 3342ab25eeb5Syz155240 /* Lookup a nat entry based on the source 'real' ip address/port and */ 3343ab25eeb5Syz155240 /* destination address/port. We use this lookup when sending a packet out, */ 3344ab25eeb5Syz155240 /* we're looking for a table entry, based on the source address. */ 3345ab25eeb5Syz155240 /* */ 3346ab25eeb5Syz155240 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */ 3347ab25eeb5Syz155240 /* */ 3348ab25eeb5Syz155240 /* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN */ 3349ab25eeb5Syz155240 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */ 3350ab25eeb5Syz155240 /* */ 3351ab25eeb5Syz155240 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */ 3352ab25eeb5Syz155240 /* the packet is of said protocol */ 3353ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3354ab25eeb5Syz155240 nat_t *nat_outlookup(fin, flags, p, src, dst) 3355ab25eeb5Syz155240 fr_info_t *fin; 3356ab25eeb5Syz155240 u_int flags, p; 3357ab25eeb5Syz155240 struct in_addr src , dst; 3358ab25eeb5Syz155240 { 3359ab25eeb5Syz155240 u_short sport, dport; 3360ab25eeb5Syz155240 u_int sflags; 3361ab25eeb5Syz155240 ipnat_t *ipn; 3362ab25eeb5Syz155240 u_32_t srcip; 3363ab25eeb5Syz155240 nat_t *nat; 3364ab25eeb5Syz155240 int nflags; 3365ab25eeb5Syz155240 void *ifp; 3366ab25eeb5Syz155240 u_int hv; 3367f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3368ab25eeb5Syz155240 3369ab25eeb5Syz155240 ifp = fin->fin_ifp; 3370e6c6c1faSyz155240 3371ab25eeb5Syz155240 srcip = src.s_addr; 3372ab25eeb5Syz155240 sflags = flags & IPN_TCPUDPICMP; 3373ab25eeb5Syz155240 sport = 0; 3374ab25eeb5Syz155240 dport = 0; 3375ab25eeb5Syz155240 3376ab25eeb5Syz155240 switch (p) 3377ab25eeb5Syz155240 { 3378ab25eeb5Syz155240 case IPPROTO_TCP : 3379ab25eeb5Syz155240 case IPPROTO_UDP : 3380ab25eeb5Syz155240 sport = htons(fin->fin_data[0]); 3381ab25eeb5Syz155240 dport = htons(fin->fin_data[1]); 3382ab25eeb5Syz155240 break; 3383ab25eeb5Syz155240 case IPPROTO_ICMP : 3384ab25eeb5Syz155240 if (flags & IPN_ICMPERR) 3385ab25eeb5Syz155240 sport = fin->fin_data[1]; 3386ab25eeb5Syz155240 else 3387ab25eeb5Syz155240 dport = fin->fin_data[1]; 3388ab25eeb5Syz155240 break; 3389ab25eeb5Syz155240 default : 3390ab25eeb5Syz155240 break; 3391ab25eeb5Syz155240 } 3392ab25eeb5Syz155240 3393ab25eeb5Syz155240 if ((flags & SI_WILDP) != 0) 3394ab25eeb5Syz155240 goto find_out_wild_ports; 3395ab25eeb5Syz155240 3396ab25eeb5Syz155240 hv = NAT_HASH_FN(srcip, sport, 0xffffffff); 3397f4b3ec61Sdh155122 hv = NAT_HASH_FN(dst.s_addr, hv + dport, ifs->ifs_ipf_nattable_sz); 3398f4b3ec61Sdh155122 nat = ifs->ifs_nat_table[0][hv]; 3399ab25eeb5Syz155240 for (; nat; nat = nat->nat_hnext[0]) { 3400e6c6c1faSyz155240 if (nat->nat_ifps[1] != NULL) { 3401e6c6c1faSyz155240 if ((ifp != NULL) && (ifp != nat->nat_ifps[1])) 3402e6c6c1faSyz155240 continue; 3403e6c6c1faSyz155240 } else if (ifp != NULL) 3404e6c6c1faSyz155240 nat->nat_ifps[1] = ifp; 3405ab25eeb5Syz155240 3406e6c6c1faSyz155240 nflags = nat->nat_flags; 3407ab25eeb5Syz155240 3408ab25eeb5Syz155240 if (nat->nat_inip.s_addr == srcip && 3409ab25eeb5Syz155240 nat->nat_oip.s_addr == dst.s_addr && 3410ab25eeb5Syz155240 (((p == 0) && (sflags == (nflags & NAT_TCPUDPICMP))) 3411ab25eeb5Syz155240 || (p == nat->nat_p))) { 3412ab25eeb5Syz155240 switch (p) 3413ab25eeb5Syz155240 { 3414ab25eeb5Syz155240 #if 0 3415ab25eeb5Syz155240 case IPPROTO_GRE : 3416ab25eeb5Syz155240 if (nat->nat_call[1] != fin->fin_data[0]) 3417ab25eeb5Syz155240 continue; 3418ab25eeb5Syz155240 break; 3419ab25eeb5Syz155240 #endif 3420ab25eeb5Syz155240 case IPPROTO_TCP : 3421ab25eeb5Syz155240 case IPPROTO_UDP : 3422ab25eeb5Syz155240 if (nat->nat_oport != dport) 3423ab25eeb5Syz155240 continue; 3424ab25eeb5Syz155240 if (nat->nat_inport != sport) 3425ab25eeb5Syz155240 continue; 3426ab25eeb5Syz155240 break; 3427ab25eeb5Syz155240 default : 3428ab25eeb5Syz155240 break; 3429ab25eeb5Syz155240 } 3430ab25eeb5Syz155240 3431ab25eeb5Syz155240 ipn = nat->nat_ptr; 3432ab25eeb5Syz155240 if ((ipn != NULL) && (nat->nat_aps != NULL)) 3433ab25eeb5Syz155240 if (appr_match(fin, nat) != 0) 3434ab25eeb5Syz155240 continue; 3435ab25eeb5Syz155240 return nat; 3436ab25eeb5Syz155240 } 3437ab25eeb5Syz155240 } 3438ab25eeb5Syz155240 3439ab25eeb5Syz155240 /* 3440ab25eeb5Syz155240 * So if we didn't find it but there are wildcard members in the hash 3441ab25eeb5Syz155240 * table, go back and look for them. We do this search and update here 3442ab25eeb5Syz155240 * because it is modifying the NAT table and we want to do this only 3443ab25eeb5Syz155240 * for the first packet that matches. The exception, of course, is 3444ab25eeb5Syz155240 * for "dummy" (FI_IGNORE) lookups. 3445ab25eeb5Syz155240 */ 3446ab25eeb5Syz155240 find_out_wild_ports: 3447ab25eeb5Syz155240 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) 3448ab25eeb5Syz155240 return NULL; 3449f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_wilds == 0) 3450ab25eeb5Syz155240 return NULL; 3451ab25eeb5Syz155240 3452f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3453ab25eeb5Syz155240 3454ab25eeb5Syz155240 hv = NAT_HASH_FN(srcip, 0, 0xffffffff); 3455f4b3ec61Sdh155122 hv = NAT_HASH_FN(dst.s_addr, hv, ifs->ifs_ipf_nattable_sz); 3456ab25eeb5Syz155240 3457f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 3458ab25eeb5Syz155240 3459f4b3ec61Sdh155122 nat = ifs->ifs_nat_table[0][hv]; 3460ab25eeb5Syz155240 for (; nat; nat = nat->nat_hnext[0]) { 3461e6c6c1faSyz155240 if (nat->nat_ifps[1] != NULL) { 3462e6c6c1faSyz155240 if ((ifp != NULL) && (ifp != nat->nat_ifps[1])) 3463ab25eeb5Syz155240 continue; 3464e6c6c1faSyz155240 } else if (ifp != NULL) 3465e6c6c1faSyz155240 nat->nat_ifps[1] = ifp; 3466ab25eeb5Syz155240 3467ab25eeb5Syz155240 if (nat->nat_p != fin->fin_p) 3468ab25eeb5Syz155240 continue; 3469ab25eeb5Syz155240 if ((nat->nat_inip.s_addr != srcip) || 3470ab25eeb5Syz155240 (nat->nat_oip.s_addr != dst.s_addr)) 3471ab25eeb5Syz155240 continue; 3472ab25eeb5Syz155240 3473ab25eeb5Syz155240 nflags = nat->nat_flags; 3474ab25eeb5Syz155240 if (!(nflags & (NAT_TCPUDP|SI_WILDP))) 3475ab25eeb5Syz155240 continue; 3476ab25eeb5Syz155240 3477ab25eeb5Syz155240 if (nat_wildok(nat, (int)sport, (int)dport, nflags, 3478ab25eeb5Syz155240 NAT_OUTBOUND) == 1) { 3479ab25eeb5Syz155240 if ((fin->fin_flx & FI_IGNORE) != 0) 3480ab25eeb5Syz155240 break; 3481ab25eeb5Syz155240 if ((nflags & SI_CLONE) != 0) { 3482ab25eeb5Syz155240 nat = fr_natclone(fin, nat); 3483ab25eeb5Syz155240 if (nat == NULL) 3484ab25eeb5Syz155240 break; 3485ab25eeb5Syz155240 } else { 3486f4b3ec61Sdh155122 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 3487f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_wilds--; 3488f4b3ec61Sdh155122 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 3489ab25eeb5Syz155240 } 3490ab25eeb5Syz155240 nat->nat_inport = sport; 3491ab25eeb5Syz155240 nat->nat_oport = dport; 3492ab25eeb5Syz155240 if (nat->nat_outport == 0) 3493ab25eeb5Syz155240 nat->nat_outport = sport; 3494ab25eeb5Syz155240 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT); 3495f4b3ec61Sdh155122 nat_tabmove(nat, ifs); 3496ab25eeb5Syz155240 break; 3497ab25eeb5Syz155240 } 3498ab25eeb5Syz155240 } 3499ab25eeb5Syz155240 3500f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 3501ab25eeb5Syz155240 3502ab25eeb5Syz155240 return nat; 3503ab25eeb5Syz155240 } 3504ab25eeb5Syz155240 3505ab25eeb5Syz155240 3506ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3507ab25eeb5Syz155240 /* Function: nat_lookupredir */ 3508ab25eeb5Syz155240 /* Returns: nat_t* - NULL == no match, */ 3509ab25eeb5Syz155240 /* else pointer to matching NAT entry */ 3510ab25eeb5Syz155240 /* Parameters: np(I) - pointer to description of packet to find NAT table */ 3511ab25eeb5Syz155240 /* entry for. */ 3512ab25eeb5Syz155240 /* */ 3513ab25eeb5Syz155240 /* Lookup the NAT tables to search for a matching redirect */ 3514ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3515f4b3ec61Sdh155122 nat_t *nat_lookupredir(np, ifs) 3516ab25eeb5Syz155240 natlookup_t *np; 3517f4b3ec61Sdh155122 ipf_stack_t *ifs; 3518ab25eeb5Syz155240 { 3519ab25eeb5Syz155240 fr_info_t fi; 3520ab25eeb5Syz155240 nat_t *nat; 3521ab25eeb5Syz155240 3522ab25eeb5Syz155240 bzero((char *)&fi, sizeof(fi)); 3523ab25eeb5Syz155240 if (np->nl_flags & IPN_IN) { 3524ab25eeb5Syz155240 fi.fin_data[0] = ntohs(np->nl_realport); 3525ab25eeb5Syz155240 fi.fin_data[1] = ntohs(np->nl_outport); 3526ab25eeb5Syz155240 } else { 3527ab25eeb5Syz155240 fi.fin_data[0] = ntohs(np->nl_inport); 3528ab25eeb5Syz155240 fi.fin_data[1] = ntohs(np->nl_outport); 3529ab25eeb5Syz155240 } 3530ab25eeb5Syz155240 if (np->nl_flags & IPN_TCP) 3531ab25eeb5Syz155240 fi.fin_p = IPPROTO_TCP; 3532ab25eeb5Syz155240 else if (np->nl_flags & IPN_UDP) 3533ab25eeb5Syz155240 fi.fin_p = IPPROTO_UDP; 3534ab25eeb5Syz155240 else if (np->nl_flags & (IPN_ICMPERR|IPN_ICMPQUERY)) 3535ab25eeb5Syz155240 fi.fin_p = IPPROTO_ICMP; 3536ab25eeb5Syz155240 3537f4b3ec61Sdh155122 fi.fin_ifs = ifs; 3538ab25eeb5Syz155240 /* 3539ab25eeb5Syz155240 * We can do two sorts of lookups: 3540ab25eeb5Syz155240 * - IPN_IN: we have the `real' and `out' address, look for `in'. 3541ab25eeb5Syz155240 * - default: we have the `in' and `out' address, look for `real'. 3542ab25eeb5Syz155240 */ 3543ab25eeb5Syz155240 if (np->nl_flags & IPN_IN) { 3544ab25eeb5Syz155240 if ((nat = nat_inlookup(&fi, np->nl_flags, fi.fin_p, 3545ab25eeb5Syz155240 np->nl_realip, np->nl_outip))) { 3546ab25eeb5Syz155240 np->nl_inip = nat->nat_inip; 3547ab25eeb5Syz155240 np->nl_inport = nat->nat_inport; 3548ab25eeb5Syz155240 } 3549ab25eeb5Syz155240 } else { 3550ab25eeb5Syz155240 /* 3551ab25eeb5Syz155240 * If nl_inip is non null, this is a lookup based on the real 3552ab25eeb5Syz155240 * ip address. Else, we use the fake. 3553ab25eeb5Syz155240 */ 3554ab25eeb5Syz155240 if ((nat = nat_outlookup(&fi, np->nl_flags, fi.fin_p, 3555ab25eeb5Syz155240 np->nl_inip, np->nl_outip))) { 3556ab25eeb5Syz155240 3557ab25eeb5Syz155240 if ((np->nl_flags & IPN_FINDFORWARD) != 0) { 3558ab25eeb5Syz155240 fr_info_t fin; 3559ab25eeb5Syz155240 bzero((char *)&fin, sizeof(fin)); 3560ab25eeb5Syz155240 fin.fin_p = nat->nat_p; 3561ab25eeb5Syz155240 fin.fin_data[0] = ntohs(nat->nat_outport); 3562ab25eeb5Syz155240 fin.fin_data[1] = ntohs(nat->nat_oport); 3563f4b3ec61Sdh155122 fin.fin_ifs = ifs; 3564ab25eeb5Syz155240 if (nat_inlookup(&fin, np->nl_flags, fin.fin_p, 3565ab25eeb5Syz155240 nat->nat_outip, 3566ab25eeb5Syz155240 nat->nat_oip) != NULL) { 3567ab25eeb5Syz155240 np->nl_flags &= ~IPN_FINDFORWARD; 3568ab25eeb5Syz155240 } 3569ab25eeb5Syz155240 } 3570ab25eeb5Syz155240 3571ab25eeb5Syz155240 np->nl_realip = nat->nat_outip; 3572ab25eeb5Syz155240 np->nl_realport = nat->nat_outport; 3573ab25eeb5Syz155240 } 3574ab25eeb5Syz155240 } 3575ab25eeb5Syz155240 3576ab25eeb5Syz155240 return nat; 3577ab25eeb5Syz155240 } 3578ab25eeb5Syz155240 3579ab25eeb5Syz155240 3580ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3581ab25eeb5Syz155240 /* Function: nat_match */ 3582ab25eeb5Syz155240 /* Returns: int - 0 == no match, 1 == match */ 3583ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3584ab25eeb5Syz155240 /* np(I) - pointer to NAT rule */ 3585ab25eeb5Syz155240 /* */ 3586ab25eeb5Syz155240 /* Pull the matching of a packet against a NAT rule out of that complex */ 3587ab25eeb5Syz155240 /* loop inside fr_checknatin() and lay it out properly in its own function. */ 3588ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3589ab25eeb5Syz155240 static int nat_match(fin, np) 3590ab25eeb5Syz155240 fr_info_t *fin; 3591ab25eeb5Syz155240 ipnat_t *np; 3592ab25eeb5Syz155240 { 3593ab25eeb5Syz155240 frtuc_t *ft; 3594ab25eeb5Syz155240 3595ab25eeb5Syz155240 if (fin->fin_v != 4) 3596ab25eeb5Syz155240 return 0; 3597ab25eeb5Syz155240 3598ab25eeb5Syz155240 if (np->in_p && fin->fin_p != np->in_p) 3599ab25eeb5Syz155240 return 0; 3600ab25eeb5Syz155240 3601ab25eeb5Syz155240 if (fin->fin_out) { 3602ab25eeb5Syz155240 if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK))) 3603ab25eeb5Syz155240 return 0; 3604ab25eeb5Syz155240 if (((fin->fin_fi.fi_saddr & np->in_inmsk) != np->in_inip) 3605ab25eeb5Syz155240 ^ ((np->in_flags & IPN_NOTSRC) != 0)) 3606ab25eeb5Syz155240 return 0; 3607ab25eeb5Syz155240 if (((fin->fin_fi.fi_daddr & np->in_srcmsk) != np->in_srcip) 3608ab25eeb5Syz155240 ^ ((np->in_flags & IPN_NOTDST) != 0)) 3609ab25eeb5Syz155240 return 0; 3610ab25eeb5Syz155240 } else { 3611ab25eeb5Syz155240 if (!(np->in_redir & NAT_REDIRECT)) 3612ab25eeb5Syz155240 return 0; 3613ab25eeb5Syz155240 if (((fin->fin_fi.fi_saddr & np->in_srcmsk) != np->in_srcip) 3614ab25eeb5Syz155240 ^ ((np->in_flags & IPN_NOTSRC) != 0)) 3615ab25eeb5Syz155240 return 0; 3616ab25eeb5Syz155240 if (((fin->fin_fi.fi_daddr & np->in_outmsk) != np->in_outip) 3617ab25eeb5Syz155240 ^ ((np->in_flags & IPN_NOTDST) != 0)) 3618ab25eeb5Syz155240 return 0; 3619ab25eeb5Syz155240 } 3620ab25eeb5Syz155240 3621ab25eeb5Syz155240 ft = &np->in_tuc; 3622ab25eeb5Syz155240 if (!(fin->fin_flx & FI_TCPUDP) || 3623ab25eeb5Syz155240 (fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) { 3624ab25eeb5Syz155240 if (ft->ftu_scmp || ft->ftu_dcmp) 3625ab25eeb5Syz155240 return 0; 3626ab25eeb5Syz155240 return 1; 3627ab25eeb5Syz155240 } 3628ab25eeb5Syz155240 3629ab25eeb5Syz155240 return fr_tcpudpchk(fin, ft); 3630ab25eeb5Syz155240 } 3631ab25eeb5Syz155240 3632ab25eeb5Syz155240 3633ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3634ab25eeb5Syz155240 /* Function: nat_update */ 3635ab25eeb5Syz155240 /* Returns: Nil */ 3636ab25eeb5Syz155240 /* Parameters: nat(I) - pointer to NAT structure */ 3637ab25eeb5Syz155240 /* np(I) - pointer to NAT rule */ 3638ab25eeb5Syz155240 /* */ 3639ab25eeb5Syz155240 /* Updates the lifetime of a NAT table entry for non-TCP packets. Must be */ 3640ab25eeb5Syz155240 /* called with fin_rev updated - i.e. after calling nat_proto(). */ 3641ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3642ab25eeb5Syz155240 void nat_update(fin, nat, np) 3643ab25eeb5Syz155240 fr_info_t *fin; 3644ab25eeb5Syz155240 nat_t *nat; 3645ab25eeb5Syz155240 ipnat_t *np; 3646ab25eeb5Syz155240 { 3647ab25eeb5Syz155240 ipftq_t *ifq, *ifq2; 3648ab25eeb5Syz155240 ipftqent_t *tqe; 3649f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3650ab25eeb5Syz155240 3651ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 3652ab25eeb5Syz155240 tqe = &nat->nat_tqe; 3653ab25eeb5Syz155240 ifq = tqe->tqe_ifq; 3654ab25eeb5Syz155240 3655ab25eeb5Syz155240 /* 3656ab25eeb5Syz155240 * We allow over-riding of NAT timeouts from NAT rules, even for 3657ab25eeb5Syz155240 * TCP, however, if it is TCP and there is no rule timeout set, 3658ab25eeb5Syz155240 * then do not update the timeout here. 3659ab25eeb5Syz155240 */ 3660ab25eeb5Syz155240 if (np != NULL) 3661ab25eeb5Syz155240 ifq2 = np->in_tqehead[fin->fin_rev]; 3662ab25eeb5Syz155240 else 3663ab25eeb5Syz155240 ifq2 = NULL; 3664ab25eeb5Syz155240 3665ab25eeb5Syz155240 if (nat->nat_p == IPPROTO_TCP && ifq2 == NULL) { 3666f4b3ec61Sdh155122 (void) fr_tcp_age(&nat->nat_tqe, fin, ifs->ifs_nat_tqb, 0); 3667ab25eeb5Syz155240 } else { 3668ab25eeb5Syz155240 if (ifq2 == NULL) { 3669ab25eeb5Syz155240 if (nat->nat_p == IPPROTO_UDP) 3670f4b3ec61Sdh155122 ifq2 = &ifs->ifs_nat_udptq; 3671ab25eeb5Syz155240 else if (nat->nat_p == IPPROTO_ICMP) 3672f4b3ec61Sdh155122 ifq2 = &ifs->ifs_nat_icmptq; 3673ab25eeb5Syz155240 else 3674f4b3ec61Sdh155122 ifq2 = &ifs->ifs_nat_iptq; 3675ab25eeb5Syz155240 } 3676ab25eeb5Syz155240 3677f4b3ec61Sdh155122 fr_movequeue(tqe, ifq, ifq2, ifs); 3678ab25eeb5Syz155240 } 3679ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 3680ab25eeb5Syz155240 } 3681ab25eeb5Syz155240 3682ab25eeb5Syz155240 3683ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3684ab25eeb5Syz155240 /* Function: fr_checknatout */ 3685ab25eeb5Syz155240 /* Returns: int - -1 == packet failed NAT checks so block it, */ 3686ab25eeb5Syz155240 /* 0 == no packet translation occurred, */ 3687ab25eeb5Syz155240 /* 1 == packet was successfully translated. */ 3688ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3689ab25eeb5Syz155240 /* passp(I) - pointer to filtering result flags */ 3690ab25eeb5Syz155240 /* */ 3691ab25eeb5Syz155240 /* Check to see if an outcoming packet should be changed. ICMP packets are */ 3692ab25eeb5Syz155240 /* first checked to see if they match an existing entry (if an error), */ 3693ab25eeb5Syz155240 /* otherwise a search of the current NAT table is made. If neither results */ 3694ab25eeb5Syz155240 /* in a match then a search for a matching NAT rule is made. Create a new */ 3695ab25eeb5Syz155240 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */ 3696ab25eeb5Syz155240 /* packet header(s) as required. */ 3697ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3698ab25eeb5Syz155240 int fr_checknatout(fin, passp) 3699ab25eeb5Syz155240 fr_info_t *fin; 3700ab25eeb5Syz155240 u_32_t *passp; 3701ab25eeb5Syz155240 { 3702ab25eeb5Syz155240 struct ifnet *ifp, *sifp; 3703ab25eeb5Syz155240 icmphdr_t *icmp = NULL; 3704ab25eeb5Syz155240 tcphdr_t *tcp = NULL; 3705ab25eeb5Syz155240 int rval, natfailed; 3706ab25eeb5Syz155240 ipnat_t *np = NULL; 3707ab25eeb5Syz155240 u_int nflags = 0; 3708ab25eeb5Syz155240 u_32_t ipa, iph; 3709ab25eeb5Syz155240 int natadd = 1; 3710ab25eeb5Syz155240 frentry_t *fr; 3711ab25eeb5Syz155240 nat_t *nat; 3712f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3713ab25eeb5Syz155240 3714f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_rules == 0 || ifs->ifs_fr_nat_lock != 0) 3715ab25eeb5Syz155240 return 0; 3716ab25eeb5Syz155240 3717ab25eeb5Syz155240 natfailed = 0; 3718ab25eeb5Syz155240 fr = fin->fin_fr; 3719ab25eeb5Syz155240 sifp = fin->fin_ifp; 3720ab25eeb5Syz155240 if ((fr != NULL) && !(fr->fr_flags & FR_DUP) && 3721d3675867Sjojemann fr->fr_tifs[fin->fin_rev].fd_ifp && 3722d3675867Sjojemann fr->fr_tifs[fin->fin_rev].fd_ifp != (void *)-1) 3723d3675867Sjojemann fin->fin_ifp = fr->fr_tifs[fin->fin_rev].fd_ifp; 3724ab25eeb5Syz155240 ifp = fin->fin_ifp; 3725ab25eeb5Syz155240 3726ab25eeb5Syz155240 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 3727ab25eeb5Syz155240 switch (fin->fin_p) 3728ab25eeb5Syz155240 { 3729ab25eeb5Syz155240 case IPPROTO_TCP : 3730ab25eeb5Syz155240 nflags = IPN_TCP; 3731ab25eeb5Syz155240 break; 3732ab25eeb5Syz155240 case IPPROTO_UDP : 3733ab25eeb5Syz155240 nflags = IPN_UDP; 3734ab25eeb5Syz155240 break; 3735ab25eeb5Syz155240 case IPPROTO_ICMP : 3736ab25eeb5Syz155240 icmp = fin->fin_dp; 3737ab25eeb5Syz155240 3738ab25eeb5Syz155240 /* 3739ab25eeb5Syz155240 * This is an incoming packet, so the destination is 3740ab25eeb5Syz155240 * the icmp_id and the source port equals 0 3741ab25eeb5Syz155240 */ 3742ab25eeb5Syz155240 if (nat_icmpquerytype4(icmp->icmp_type)) 3743ab25eeb5Syz155240 nflags = IPN_ICMPQUERY; 3744ab25eeb5Syz155240 break; 3745ab25eeb5Syz155240 default : 3746ab25eeb5Syz155240 break; 3747ab25eeb5Syz155240 } 3748ab25eeb5Syz155240 3749ab25eeb5Syz155240 if ((nflags & IPN_TCPUDP)) 3750ab25eeb5Syz155240 tcp = fin->fin_dp; 3751ab25eeb5Syz155240 } 3752ab25eeb5Syz155240 3753ab25eeb5Syz155240 ipa = fin->fin_saddr; 3754ab25eeb5Syz155240 3755f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 3756ab25eeb5Syz155240 3757ab25eeb5Syz155240 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) && 3758ab25eeb5Syz155240 (nat = nat_icmperror(fin, &nflags, NAT_OUTBOUND))) 3759ab25eeb5Syz155240 /*EMPTY*/; 3760ab25eeb5Syz155240 else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin))) 3761ab25eeb5Syz155240 natadd = 0; 3762ab25eeb5Syz155240 else if ((nat = nat_outlookup(fin, nflags|NAT_SEARCH, (u_int)fin->fin_p, 3763ab25eeb5Syz155240 fin->fin_src, fin->fin_dst))) { 3764ab25eeb5Syz155240 nflags = nat->nat_flags; 3765ab25eeb5Syz155240 } else { 3766ab25eeb5Syz155240 u_32_t hv, msk, nmsk; 3767ab25eeb5Syz155240 3768ab25eeb5Syz155240 /* 3769ab25eeb5Syz155240 * If there is no current entry in the nat table for this IP#, 3770ab25eeb5Syz155240 * create one for it (if there is a matching rule). 3771ab25eeb5Syz155240 */ 3772f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3773ab25eeb5Syz155240 msk = 0xffffffff; 3774f4b3ec61Sdh155122 nmsk = ifs->ifs_nat_masks; 3775f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 3776ab25eeb5Syz155240 maskloop: 3777ab25eeb5Syz155240 iph = ipa & htonl(msk); 3778f4b3ec61Sdh155122 hv = NAT_HASH_FN(iph, 0, ifs->ifs_ipf_natrules_sz); 3779f4b3ec61Sdh155122 for (np = ifs->ifs_nat_rules[hv]; np; np = np->in_mnext) 3780ab25eeb5Syz155240 { 3781e6c6c1faSyz155240 if ((np->in_ifps[1] && (np->in_ifps[1] != ifp))) 3782ab25eeb5Syz155240 continue; 3783ab25eeb5Syz155240 if (np->in_v != fin->fin_v) 3784ab25eeb5Syz155240 continue; 3785ab25eeb5Syz155240 if (np->in_p && (np->in_p != fin->fin_p)) 3786ab25eeb5Syz155240 continue; 3787ab25eeb5Syz155240 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags)) 3788ab25eeb5Syz155240 continue; 3789ab25eeb5Syz155240 if (np->in_flags & IPN_FILTER) { 3790ab25eeb5Syz155240 if (!nat_match(fin, np)) 3791ab25eeb5Syz155240 continue; 3792ab25eeb5Syz155240 } else if ((ipa & np->in_inmsk) != np->in_inip) 3793ab25eeb5Syz155240 continue; 3794ab25eeb5Syz155240 3795ab25eeb5Syz155240 if ((fr != NULL) && 3796ab25eeb5Syz155240 !fr_matchtag(&np->in_tag, &fr->fr_nattag)) 3797ab25eeb5Syz155240 continue; 3798ab25eeb5Syz155240 3799ab25eeb5Syz155240 if (*np->in_plabel != '\0') { 3800ab25eeb5Syz155240 if (((np->in_flags & IPN_FILTER) == 0) && 3801ab25eeb5Syz155240 (np->in_dport != tcp->th_dport)) 3802ab25eeb5Syz155240 continue; 3803ab25eeb5Syz155240 if (appr_ok(fin, tcp, np) == 0) 3804ab25eeb5Syz155240 continue; 3805ab25eeb5Syz155240 } 3806ab25eeb5Syz155240 3807ab25eeb5Syz155240 if ((nat = nat_new(fin, np, NULL, nflags, 3808ab25eeb5Syz155240 NAT_OUTBOUND))) { 3809ab25eeb5Syz155240 np->in_hits++; 3810ab25eeb5Syz155240 break; 3811ab25eeb5Syz155240 } else 3812ab25eeb5Syz155240 natfailed = -1; 3813ab25eeb5Syz155240 } 3814ab25eeb5Syz155240 if ((np == NULL) && (nmsk != 0)) { 3815ab25eeb5Syz155240 while (nmsk) { 3816ab25eeb5Syz155240 msk <<= 1; 3817ab25eeb5Syz155240 if (nmsk & 0x80000000) 3818ab25eeb5Syz155240 break; 3819ab25eeb5Syz155240 nmsk <<= 1; 3820ab25eeb5Syz155240 } 3821ab25eeb5Syz155240 if (nmsk != 0) { 3822ab25eeb5Syz155240 nmsk <<= 1; 3823ab25eeb5Syz155240 goto maskloop; 3824ab25eeb5Syz155240 } 3825ab25eeb5Syz155240 } 3826f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 3827ab25eeb5Syz155240 } 3828ab25eeb5Syz155240 3829ab25eeb5Syz155240 if (nat != NULL) { 3830ab25eeb5Syz155240 rval = fr_natout(fin, nat, natadd, nflags); 3831ab25eeb5Syz155240 if (rval == 1) { 3832ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 3833ab25eeb5Syz155240 nat->nat_ref++; 3834ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 38353805c50fSan207044 nat->nat_touched = ifs->ifs_fr_ticks; 3836ab25eeb5Syz155240 fin->fin_nat = nat; 3837ab25eeb5Syz155240 } 3838ab25eeb5Syz155240 } else 3839ab25eeb5Syz155240 rval = natfailed; 3840f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3841ab25eeb5Syz155240 3842ab25eeb5Syz155240 if (rval == -1) { 3843ab25eeb5Syz155240 if (passp != NULL) 3844ab25eeb5Syz155240 *passp = FR_BLOCK; 3845ab25eeb5Syz155240 fin->fin_flx |= FI_BADNAT; 3846ab25eeb5Syz155240 } 3847ab25eeb5Syz155240 fin->fin_ifp = sifp; 3848ab25eeb5Syz155240 return rval; 3849ab25eeb5Syz155240 } 3850ab25eeb5Syz155240 3851ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3852ab25eeb5Syz155240 /* Function: fr_natout */ 3853ab25eeb5Syz155240 /* Returns: int - -1 == packet failed NAT checks so block it, */ 3854ab25eeb5Syz155240 /* 1 == packet was successfully translated. */ 3855ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 3856ab25eeb5Syz155240 /* nat(I) - pointer to NAT structure */ 3857ab25eeb5Syz155240 /* natadd(I) - flag indicating if it is safe to add frag cache */ 3858ab25eeb5Syz155240 /* nflags(I) - NAT flags set for this packet */ 3859ab25eeb5Syz155240 /* */ 3860ab25eeb5Syz155240 /* Translate a packet coming "out" on an interface. */ 3861ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3862ab25eeb5Syz155240 int fr_natout(fin, nat, natadd, nflags) 3863ab25eeb5Syz155240 fr_info_t *fin; 3864ab25eeb5Syz155240 nat_t *nat; 3865ab25eeb5Syz155240 int natadd; 3866ab25eeb5Syz155240 u_32_t nflags; 3867ab25eeb5Syz155240 { 3868ab25eeb5Syz155240 icmphdr_t *icmp; 3869ab25eeb5Syz155240 u_short *csump; 3870381a2a9aSdr146992 u_32_t sumd; 3871ab25eeb5Syz155240 tcphdr_t *tcp; 3872ab25eeb5Syz155240 ipnat_t *np; 3873ab25eeb5Syz155240 int i; 3874f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 3875ab25eeb5Syz155240 3876381a2a9aSdr146992 #if SOLARIS && defined(_KERNEL) 3877381a2a9aSdr146992 net_data_t net_data_p; 3878381a2a9aSdr146992 if (fin->fin_v == 4) 3879f4b3ec61Sdh155122 net_data_p = ifs->ifs_ipf_ipv4; 3880381a2a9aSdr146992 else 3881f4b3ec61Sdh155122 net_data_p = ifs->ifs_ipf_ipv6; 3882381a2a9aSdr146992 #endif 3883381a2a9aSdr146992 3884ab25eeb5Syz155240 tcp = NULL; 3885ab25eeb5Syz155240 icmp = NULL; 3886ab25eeb5Syz155240 csump = NULL; 3887ab25eeb5Syz155240 np = nat->nat_ptr; 3888ab25eeb5Syz155240 388915013d88Szf203873 if ((natadd != 0) && (fin->fin_flx & FI_FRAG)) 3890ab25eeb5Syz155240 (void) fr_nat_newfrag(fin, 0, nat); 3891ab25eeb5Syz155240 3892ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 3893ab25eeb5Syz155240 nat->nat_bytes[1] += fin->fin_plen; 3894ab25eeb5Syz155240 nat->nat_pkts[1]++; 3895ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 3896ab25eeb5Syz155240 3897ab25eeb5Syz155240 /* 3898ab25eeb5Syz155240 * Fix up checksums, not by recalculating them, but 3899ab25eeb5Syz155240 * simply computing adjustments. 3900ab25eeb5Syz155240 * This is only done for STREAMS based IP implementations where the 3901ab25eeb5Syz155240 * checksum has already been calculated by IP. In all other cases, 3902ab25eeb5Syz155240 * IPFilter is called before the checksum needs calculating so there 3903ab25eeb5Syz155240 * is no call to modify whatever is in the header now. 3904ab25eeb5Syz155240 */ 3905381a2a9aSdr146992 ASSERT(fin->fin_m != NULL); 3906381a2a9aSdr146992 if (fin->fin_v == 4 && !NET_IS_HCK_L3_FULL(net_data_p, fin->fin_m)) { 3907ab25eeb5Syz155240 if (nflags == IPN_ICMPERR) { 3908381a2a9aSdr146992 u_32_t s1, s2; 3909ab25eeb5Syz155240 3910ab25eeb5Syz155240 s1 = LONG_SUM(ntohl(fin->fin_saddr)); 3911ab25eeb5Syz155240 s2 = LONG_SUM(ntohl(nat->nat_outip.s_addr)); 3912ab25eeb5Syz155240 CALC_SUMD(s1, s2, sumd); 3913381a2a9aSdr146992 3914381a2a9aSdr146992 fix_outcksum(&fin->fin_ip->ip_sum, sumd); 3915ab25eeb5Syz155240 } 3916ab25eeb5Syz155240 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 3917ab25eeb5Syz155240 defined(linux) || defined(BRIDGE_IPF) 3918ab25eeb5Syz155240 else { 3919ab25eeb5Syz155240 /* 3920ab25eeb5Syz155240 * Strictly speaking, this isn't necessary on BSD 3921ab25eeb5Syz155240 * kernels because they do checksum calculation after 3922ab25eeb5Syz155240 * this code has run BUT if ipfilter is being used 3923ab25eeb5Syz155240 * to do NAT as a bridge, that code doesn't exist. 3924ab25eeb5Syz155240 */ 3925ab25eeb5Syz155240 if (nat->nat_dir == NAT_OUTBOUND) 3926381a2a9aSdr146992 fix_outcksum(&fin->fin_ip->ip_sum, 3927ab25eeb5Syz155240 nat->nat_ipsumd); 3928ab25eeb5Syz155240 else 3929381a2a9aSdr146992 fix_incksum(&fin->fin_ip->ip_sum, 3930ab25eeb5Syz155240 nat->nat_ipsumd); 3931ab25eeb5Syz155240 } 3932ab25eeb5Syz155240 #endif 3933ab25eeb5Syz155240 } 3934ab25eeb5Syz155240 3935ab25eeb5Syz155240 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 3936ab25eeb5Syz155240 if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) { 3937ab25eeb5Syz155240 tcp = fin->fin_dp; 3938ab25eeb5Syz155240 3939ab25eeb5Syz155240 tcp->th_sport = nat->nat_outport; 3940ab25eeb5Syz155240 fin->fin_data[0] = ntohs(nat->nat_outport); 3941ab25eeb5Syz155240 } 3942ab25eeb5Syz155240 3943ab25eeb5Syz155240 if ((nat->nat_outport != 0) && (nflags & IPN_ICMPQUERY)) { 3944ab25eeb5Syz155240 icmp = fin->fin_dp; 3945ab25eeb5Syz155240 icmp->icmp_id = nat->nat_outport; 3946ab25eeb5Syz155240 } 3947ab25eeb5Syz155240 3948ab25eeb5Syz155240 csump = nat_proto(fin, nat, nflags); 3949ab25eeb5Syz155240 } 3950ab25eeb5Syz155240 3951ab25eeb5Syz155240 fin->fin_ip->ip_src = nat->nat_outip; 3952ab25eeb5Syz155240 3953ab25eeb5Syz155240 nat_update(fin, nat, np); 3954ab25eeb5Syz155240 3955ab25eeb5Syz155240 /* 3956ab25eeb5Syz155240 * The above comments do not hold for layer 4 (or higher) checksums... 3957ab25eeb5Syz155240 */ 3958381a2a9aSdr146992 if (csump != NULL && !NET_IS_HCK_L4_FULL(net_data_p, fin->fin_m)) { 3959381a2a9aSdr146992 if (nflags & IPN_TCPUDP && 3960381a2a9aSdr146992 NET_IS_HCK_L4_PART(net_data_p, fin->fin_m)) 3961381a2a9aSdr146992 sumd = nat->nat_sumd[1]; 3962ab25eeb5Syz155240 else 3963381a2a9aSdr146992 sumd = nat->nat_sumd[0]; 3964381a2a9aSdr146992 3965381a2a9aSdr146992 if (nat->nat_dir == NAT_OUTBOUND) 3966381a2a9aSdr146992 fix_outcksum(csump, sumd); 3967381a2a9aSdr146992 else 3968381a2a9aSdr146992 fix_incksum(csump, sumd); 3969ab25eeb5Syz155240 } 3970ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 3971ab25eeb5Syz155240 ipfsync_update(SMC_NAT, fin, nat->nat_sync); 3972ab25eeb5Syz155240 #endif 3973ab25eeb5Syz155240 /* ------------------------------------------------------------- */ 3974ab25eeb5Syz155240 /* A few quick notes: */ 3975ab25eeb5Syz155240 /* Following are test conditions prior to calling the */ 3976ab25eeb5Syz155240 /* appr_check routine. */ 3977ab25eeb5Syz155240 /* */ 3978ab25eeb5Syz155240 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ 3979ab25eeb5Syz155240 /* with a redirect rule, we attempt to match the packet's */ 3980ab25eeb5Syz155240 /* source port against in_dport, otherwise we'd compare the */ 3981ab25eeb5Syz155240 /* packet's destination. */ 3982ab25eeb5Syz155240 /* ------------------------------------------------------------- */ 3983ab25eeb5Syz155240 if ((np != NULL) && (np->in_apr != NULL)) { 3984ab25eeb5Syz155240 i = appr_check(fin, nat); 3985ab25eeb5Syz155240 if (i == 0) 3986ab25eeb5Syz155240 i = 1; 3987ab25eeb5Syz155240 } else 3988ab25eeb5Syz155240 i = 1; 3989f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_nat_stats.ns_mapped[1]); 3990ab25eeb5Syz155240 fin->fin_flx |= FI_NATED; 3991ab25eeb5Syz155240 return i; 3992ab25eeb5Syz155240 } 3993ab25eeb5Syz155240 3994ab25eeb5Syz155240 3995ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 3996ab25eeb5Syz155240 /* Function: fr_checknatin */ 3997ab25eeb5Syz155240 /* Returns: int - -1 == packet failed NAT checks so block it, */ 3998ab25eeb5Syz155240 /* 0 == no packet translation occurred, */ 3999ab25eeb5Syz155240 /* 1 == packet was successfully translated. */ 4000ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 4001ab25eeb5Syz155240 /* passp(I) - pointer to filtering result flags */ 4002ab25eeb5Syz155240 /* */ 4003ab25eeb5Syz155240 /* Check to see if an incoming packet should be changed. ICMP packets are */ 4004ab25eeb5Syz155240 /* first checked to see if they match an existing entry (if an error), */ 4005ab25eeb5Syz155240 /* otherwise a search of the current NAT table is made. If neither results */ 4006ab25eeb5Syz155240 /* in a match then a search for a matching NAT rule is made. Create a new */ 4007ab25eeb5Syz155240 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */ 4008ab25eeb5Syz155240 /* packet header(s) as required. */ 4009ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4010ab25eeb5Syz155240 int fr_checknatin(fin, passp) 4011ab25eeb5Syz155240 fr_info_t *fin; 4012ab25eeb5Syz155240 u_32_t *passp; 4013ab25eeb5Syz155240 { 4014ab25eeb5Syz155240 u_int nflags, natadd; 4015ab25eeb5Syz155240 int rval, natfailed; 4016ab25eeb5Syz155240 struct ifnet *ifp; 4017ab25eeb5Syz155240 struct in_addr in; 4018ab25eeb5Syz155240 icmphdr_t *icmp; 4019ab25eeb5Syz155240 tcphdr_t *tcp; 4020ab25eeb5Syz155240 u_short dport; 4021ab25eeb5Syz155240 ipnat_t *np; 4022ab25eeb5Syz155240 nat_t *nat; 4023ab25eeb5Syz155240 u_32_t iph; 4024f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 4025ab25eeb5Syz155240 4026f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_rules == 0 || ifs->ifs_fr_nat_lock != 0) 4027ab25eeb5Syz155240 return 0; 4028ab25eeb5Syz155240 4029ab25eeb5Syz155240 tcp = NULL; 4030ab25eeb5Syz155240 icmp = NULL; 4031ab25eeb5Syz155240 dport = 0; 4032ab25eeb5Syz155240 natadd = 1; 4033ab25eeb5Syz155240 nflags = 0; 4034ab25eeb5Syz155240 natfailed = 0; 4035ab25eeb5Syz155240 ifp = fin->fin_ifp; 4036ab25eeb5Syz155240 4037ab25eeb5Syz155240 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 4038ab25eeb5Syz155240 switch (fin->fin_p) 4039ab25eeb5Syz155240 { 4040ab25eeb5Syz155240 case IPPROTO_TCP : 4041ab25eeb5Syz155240 nflags = IPN_TCP; 4042ab25eeb5Syz155240 break; 4043ab25eeb5Syz155240 case IPPROTO_UDP : 4044ab25eeb5Syz155240 nflags = IPN_UDP; 4045ab25eeb5Syz155240 break; 4046ab25eeb5Syz155240 case IPPROTO_ICMP : 4047ab25eeb5Syz155240 icmp = fin->fin_dp; 4048ab25eeb5Syz155240 4049ab25eeb5Syz155240 /* 4050ab25eeb5Syz155240 * This is an incoming packet, so the destination is 4051ab25eeb5Syz155240 * the icmp_id and the source port equals 0 4052ab25eeb5Syz155240 */ 4053ab25eeb5Syz155240 if (nat_icmpquerytype4(icmp->icmp_type)) { 4054ab25eeb5Syz155240 nflags = IPN_ICMPQUERY; 4055ab25eeb5Syz155240 dport = icmp->icmp_id; 4056ab25eeb5Syz155240 } break; 4057ab25eeb5Syz155240 default : 4058ab25eeb5Syz155240 break; 4059ab25eeb5Syz155240 } 4060ab25eeb5Syz155240 4061ab25eeb5Syz155240 if ((nflags & IPN_TCPUDP)) { 4062ab25eeb5Syz155240 tcp = fin->fin_dp; 4063ab25eeb5Syz155240 dport = tcp->th_dport; 4064ab25eeb5Syz155240 } 4065ab25eeb5Syz155240 } 4066ab25eeb5Syz155240 4067ab25eeb5Syz155240 in = fin->fin_dst; 4068ab25eeb5Syz155240 4069f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 4070ab25eeb5Syz155240 4071ab25eeb5Syz155240 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) && 4072ab25eeb5Syz155240 (nat = nat_icmperror(fin, &nflags, NAT_INBOUND))) 4073ab25eeb5Syz155240 /*EMPTY*/; 4074ab25eeb5Syz155240 else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin))) 4075ab25eeb5Syz155240 natadd = 0; 4076ab25eeb5Syz155240 else if ((nat = nat_inlookup(fin, nflags|NAT_SEARCH, (u_int)fin->fin_p, 4077ab25eeb5Syz155240 fin->fin_src, in))) { 4078ab25eeb5Syz155240 nflags = nat->nat_flags; 4079ab25eeb5Syz155240 } else { 4080ab25eeb5Syz155240 u_32_t hv, msk, rmsk; 4081ab25eeb5Syz155240 4082f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4083f4b3ec61Sdh155122 rmsk = ifs->ifs_rdr_masks; 4084ab25eeb5Syz155240 msk = 0xffffffff; 4085f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 4086ab25eeb5Syz155240 /* 4087ab25eeb5Syz155240 * If there is no current entry in the nat table for this IP#, 4088ab25eeb5Syz155240 * create one for it (if there is a matching rule). 4089ab25eeb5Syz155240 */ 4090ab25eeb5Syz155240 maskloop: 4091ab25eeb5Syz155240 iph = in.s_addr & htonl(msk); 4092f4b3ec61Sdh155122 hv = NAT_HASH_FN(iph, 0, ifs->ifs_ipf_rdrrules_sz); 4093f4b3ec61Sdh155122 for (np = ifs->ifs_rdr_rules[hv]; np; np = np->in_rnext) { 4094ab25eeb5Syz155240 if (np->in_ifps[0] && (np->in_ifps[0] != ifp)) 4095ab25eeb5Syz155240 continue; 4096ab25eeb5Syz155240 if (np->in_v != fin->fin_v) 4097ab25eeb5Syz155240 continue; 4098ab25eeb5Syz155240 if (np->in_p && (np->in_p != fin->fin_p)) 4099ab25eeb5Syz155240 continue; 4100ab25eeb5Syz155240 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags)) 4101ab25eeb5Syz155240 continue; 4102ab25eeb5Syz155240 if (np->in_flags & IPN_FILTER) { 4103ab25eeb5Syz155240 if (!nat_match(fin, np)) 4104ab25eeb5Syz155240 continue; 4105ab25eeb5Syz155240 } else { 4106ab25eeb5Syz155240 if ((in.s_addr & np->in_outmsk) != np->in_outip) 4107ab25eeb5Syz155240 continue; 4108ab25eeb5Syz155240 if (np->in_pmin && 4109ab25eeb5Syz155240 ((ntohs(np->in_pmax) < ntohs(dport)) || 4110ab25eeb5Syz155240 (ntohs(dport) < ntohs(np->in_pmin)))) 4111ab25eeb5Syz155240 continue; 4112ab25eeb5Syz155240 } 4113ab25eeb5Syz155240 4114ab25eeb5Syz155240 if (*np->in_plabel != '\0') { 4115ab25eeb5Syz155240 if (!appr_ok(fin, tcp, np)) { 4116ab25eeb5Syz155240 continue; 4117ab25eeb5Syz155240 } 4118ab25eeb5Syz155240 } 4119ab25eeb5Syz155240 4120ab25eeb5Syz155240 nat = nat_new(fin, np, NULL, nflags, NAT_INBOUND); 4121ab25eeb5Syz155240 if (nat != NULL) { 4122ab25eeb5Syz155240 np->in_hits++; 4123ab25eeb5Syz155240 break; 4124ab25eeb5Syz155240 } else 4125ab25eeb5Syz155240 natfailed = -1; 4126ab25eeb5Syz155240 } 4127ab25eeb5Syz155240 4128ab25eeb5Syz155240 if ((np == NULL) && (rmsk != 0)) { 4129ab25eeb5Syz155240 while (rmsk) { 4130ab25eeb5Syz155240 msk <<= 1; 4131ab25eeb5Syz155240 if (rmsk & 0x80000000) 4132ab25eeb5Syz155240 break; 4133ab25eeb5Syz155240 rmsk <<= 1; 4134ab25eeb5Syz155240 } 4135ab25eeb5Syz155240 if (rmsk != 0) { 4136ab25eeb5Syz155240 rmsk <<= 1; 4137ab25eeb5Syz155240 goto maskloop; 4138ab25eeb5Syz155240 } 4139ab25eeb5Syz155240 } 4140f4b3ec61Sdh155122 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 4141ab25eeb5Syz155240 } 4142ab25eeb5Syz155240 if (nat != NULL) { 4143ab25eeb5Syz155240 rval = fr_natin(fin, nat, natadd, nflags); 4144ab25eeb5Syz155240 if (rval == 1) { 4145ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 4146ab25eeb5Syz155240 nat->nat_ref++; 4147ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 41483805c50fSan207044 nat->nat_touched = ifs->ifs_fr_ticks; 4149ab25eeb5Syz155240 fin->fin_nat = nat; 4150ab25eeb5Syz155240 fin->fin_state = nat->nat_state; 4151ab25eeb5Syz155240 } 4152ab25eeb5Syz155240 } else 4153ab25eeb5Syz155240 rval = natfailed; 4154f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4155ab25eeb5Syz155240 4156ab25eeb5Syz155240 if (rval == -1) { 4157ab25eeb5Syz155240 if (passp != NULL) 4158ab25eeb5Syz155240 *passp = FR_BLOCK; 4159ab25eeb5Syz155240 fin->fin_flx |= FI_BADNAT; 4160ab25eeb5Syz155240 } 4161ab25eeb5Syz155240 return rval; 4162ab25eeb5Syz155240 } 4163ab25eeb5Syz155240 4164ab25eeb5Syz155240 4165ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4166ab25eeb5Syz155240 /* Function: fr_natin */ 4167ab25eeb5Syz155240 /* Returns: int - -1 == packet failed NAT checks so block it, */ 4168ab25eeb5Syz155240 /* 1 == packet was successfully translated. */ 4169ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 4170ab25eeb5Syz155240 /* nat(I) - pointer to NAT structure */ 4171ab25eeb5Syz155240 /* natadd(I) - flag indicating if it is safe to add frag cache */ 4172ab25eeb5Syz155240 /* nflags(I) - NAT flags set for this packet */ 4173ab25eeb5Syz155240 /* Locks Held: ipf_nat (READ) */ 4174ab25eeb5Syz155240 /* */ 4175ab25eeb5Syz155240 /* Translate a packet coming "in" on an interface. */ 4176ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4177ab25eeb5Syz155240 int fr_natin(fin, nat, natadd, nflags) 4178ab25eeb5Syz155240 fr_info_t *fin; 4179ab25eeb5Syz155240 nat_t *nat; 4180ab25eeb5Syz155240 int natadd; 4181ab25eeb5Syz155240 u_32_t nflags; 4182ab25eeb5Syz155240 { 4183ab25eeb5Syz155240 icmphdr_t *icmp; 418424109627Syx160601 u_short *csump; 4185ab25eeb5Syz155240 tcphdr_t *tcp; 4186ab25eeb5Syz155240 ipnat_t *np; 4187ab25eeb5Syz155240 int i; 4188f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 4189ab25eeb5Syz155240 4190381a2a9aSdr146992 #if SOLARIS && defined(_KERNEL) 4191381a2a9aSdr146992 net_data_t net_data_p; 4192381a2a9aSdr146992 if (fin->fin_v == 4) 4193f4b3ec61Sdh155122 net_data_p = ifs->ifs_ipf_ipv4; 4194381a2a9aSdr146992 else 4195f4b3ec61Sdh155122 net_data_p = ifs->ifs_ipf_ipv6; 4196381a2a9aSdr146992 #endif 4197381a2a9aSdr146992 4198ab25eeb5Syz155240 tcp = NULL; 4199ab25eeb5Syz155240 csump = NULL; 4200ab25eeb5Syz155240 np = nat->nat_ptr; 4201ab25eeb5Syz155240 fin->fin_fr = nat->nat_fr; 4202ab25eeb5Syz155240 4203ab25eeb5Syz155240 if ((natadd != 0) && (fin->fin_flx & FI_FRAG)) 4204ab25eeb5Syz155240 (void) fr_nat_newfrag(fin, 0, nat); 4205ab25eeb5Syz155240 420615013d88Szf203873 if (np != NULL) { 420715013d88Szf203873 4208ab25eeb5Syz155240 /* ------------------------------------------------------------- */ 4209ab25eeb5Syz155240 /* A few quick notes: */ 4210ab25eeb5Syz155240 /* Following are test conditions prior to calling the */ 4211ab25eeb5Syz155240 /* appr_check routine. */ 4212ab25eeb5Syz155240 /* */ 4213ab25eeb5Syz155240 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ 4214ab25eeb5Syz155240 /* with a map rule, we attempt to match the packet's */ 4215ab25eeb5Syz155240 /* source port against in_dport, otherwise we'd compare the */ 4216ab25eeb5Syz155240 /* packet's destination. */ 4217ab25eeb5Syz155240 /* ------------------------------------------------------------- */ 4218ab25eeb5Syz155240 if (np->in_apr != NULL) { 4219ab25eeb5Syz155240 i = appr_check(fin, nat); 4220ab25eeb5Syz155240 if (i == -1) { 4221ab25eeb5Syz155240 return -1; 4222ab25eeb5Syz155240 } 4223ab25eeb5Syz155240 } 4224ab25eeb5Syz155240 } 4225ab25eeb5Syz155240 4226ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 4227ab25eeb5Syz155240 ipfsync_update(SMC_NAT, fin, nat->nat_sync); 4228ab25eeb5Syz155240 #endif 4229ab25eeb5Syz155240 4230ab25eeb5Syz155240 MUTEX_ENTER(&nat->nat_lock); 4231ab25eeb5Syz155240 nat->nat_bytes[0] += fin->fin_plen; 4232ab25eeb5Syz155240 nat->nat_pkts[0]++; 4233ab25eeb5Syz155240 MUTEX_EXIT(&nat->nat_lock); 4234ab25eeb5Syz155240 4235ab25eeb5Syz155240 fin->fin_ip->ip_dst = nat->nat_inip; 4236ab25eeb5Syz155240 fin->fin_fi.fi_daddr = nat->nat_inip.s_addr; 4237ab25eeb5Syz155240 if (nflags & IPN_TCPUDP) 4238ab25eeb5Syz155240 tcp = fin->fin_dp; 4239ab25eeb5Syz155240 4240ab25eeb5Syz155240 /* 4241ab25eeb5Syz155240 * Fix up checksums, not by recalculating them, but 4242ab25eeb5Syz155240 * simply computing adjustments. 4243ab25eeb5Syz155240 * Why only do this for some platforms on inbound packets ? 4244ab25eeb5Syz155240 * Because for those that it is done, IP processing is yet to happen 4245ab25eeb5Syz155240 * and so the IPv4 header checksum has not yet been evaluated. 4246ab25eeb5Syz155240 * Perhaps it should always be done for the benefit of things like 4247ab25eeb5Syz155240 * fast forwarding (so that it doesn't need to be recomputed) but with 4248ab25eeb5Syz155240 * header checksum offloading, perhaps it is a moot point. 4249ab25eeb5Syz155240 */ 4250ab25eeb5Syz155240 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 4251ab25eeb5Syz155240 defined(__osf__) || defined(linux) 4252ab25eeb5Syz155240 if (nat->nat_dir == NAT_OUTBOUND) 4253381a2a9aSdr146992 fix_incksum(&fin->fin_ip->ip_sum, nat->nat_ipsumd); 4254ab25eeb5Syz155240 else 4255381a2a9aSdr146992 fix_outcksum(&fin->fin_ip->ip_sum, nat->nat_ipsumd); 4256ab25eeb5Syz155240 #endif 4257ab25eeb5Syz155240 4258ab25eeb5Syz155240 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 4259ab25eeb5Syz155240 if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) { 4260ab25eeb5Syz155240 tcp->th_dport = nat->nat_inport; 4261ab25eeb5Syz155240 fin->fin_data[1] = ntohs(nat->nat_inport); 4262ab25eeb5Syz155240 } 4263ab25eeb5Syz155240 4264ab25eeb5Syz155240 4265ab25eeb5Syz155240 if ((nat->nat_inport != 0) && (nflags & IPN_ICMPQUERY)) { 4266ab25eeb5Syz155240 icmp = fin->fin_dp; 4267ab25eeb5Syz155240 4268ab25eeb5Syz155240 icmp->icmp_id = nat->nat_inport; 4269ab25eeb5Syz155240 } 4270ab25eeb5Syz155240 4271ab25eeb5Syz155240 csump = nat_proto(fin, nat, nflags); 4272ab25eeb5Syz155240 } 4273ab25eeb5Syz155240 4274ab25eeb5Syz155240 nat_update(fin, nat, np); 4275ab25eeb5Syz155240 4276ab25eeb5Syz155240 /* 427724109627Syx160601 * In case they are being forwarded, inbound packets always need to have 427824109627Syx160601 * their checksum adjusted even if hardware checksum validation said OK. 4279ab25eeb5Syz155240 */ 4280ab25eeb5Syz155240 if (csump != NULL) { 4281ab25eeb5Syz155240 if (nat->nat_dir == NAT_OUTBOUND) 428224109627Syx160601 fix_incksum(csump, nat->nat_sumd[0]); 4283ab25eeb5Syz155240 else 428424109627Syx160601 fix_outcksum(csump, nat->nat_sumd[0]); 4285ab25eeb5Syz155240 } 428624109627Syx160601 428724109627Syx160601 #if SOLARIS && defined(_KERNEL) 428824109627Syx160601 if (nflags & IPN_TCPUDP && 428924109627Syx160601 NET_IS_HCK_L4_PART(net_data_p, fin->fin_m)) { 429024109627Syx160601 /* 429124109627Syx160601 * Need to adjust the partial checksum result stored in 429224109627Syx160601 * db_cksum16, which will be used for validation in IP. 429324109627Syx160601 * See IP_CKSUM_RECV(). 429424109627Syx160601 * Adjustment data should be the inverse of the IP address 429524109627Syx160601 * changes, because db_cksum16 is supposed to be the complement 429624109627Syx160601 * of the pesudo header. 429724109627Syx160601 */ 429824109627Syx160601 csump = &fin->fin_m->b_datap->db_cksum16; 429924109627Syx160601 if (nat->nat_dir == NAT_OUTBOUND) 430024109627Syx160601 fix_outcksum(csump, nat->nat_sumd[1]); 430124109627Syx160601 else 430224109627Syx160601 fix_incksum(csump, nat->nat_sumd[1]); 430324109627Syx160601 } 430424109627Syx160601 #endif 430524109627Syx160601 4306f4b3ec61Sdh155122 ATOMIC_INCL(ifs->ifs_nat_stats.ns_mapped[0]); 4307ab25eeb5Syz155240 fin->fin_flx |= FI_NATED; 4308ab25eeb5Syz155240 if (np != NULL && np->in_tag.ipt_num[0] != 0) 4309ab25eeb5Syz155240 fin->fin_nattag = &np->in_tag; 4310ab25eeb5Syz155240 return 1; 4311ab25eeb5Syz155240 } 4312ab25eeb5Syz155240 4313ab25eeb5Syz155240 4314ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4315ab25eeb5Syz155240 /* Function: nat_proto */ 4316ab25eeb5Syz155240 /* Returns: u_short* - pointer to transport header checksum to update, */ 4317ab25eeb5Syz155240 /* NULL if the transport protocol is not recognised */ 4318ab25eeb5Syz155240 /* as needing a checksum update. */ 4319ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 4320ab25eeb5Syz155240 /* nat(I) - pointer to NAT structure */ 4321ab25eeb5Syz155240 /* nflags(I) - NAT flags set for this packet */ 4322ab25eeb5Syz155240 /* */ 4323ab25eeb5Syz155240 /* Return the pointer to the checksum field for each protocol so understood.*/ 4324ab25eeb5Syz155240 /* If support for making other changes to a protocol header is required, */ 4325ab25eeb5Syz155240 /* that is not strictly 'address' translation, such as clamping the MSS in */ 4326ab25eeb5Syz155240 /* TCP down to a specific value, then do it from here. */ 4327ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4328ab25eeb5Syz155240 u_short *nat_proto(fin, nat, nflags) 4329ab25eeb5Syz155240 fr_info_t *fin; 4330ab25eeb5Syz155240 nat_t *nat; 4331ab25eeb5Syz155240 u_int nflags; 4332ab25eeb5Syz155240 { 4333ab25eeb5Syz155240 icmphdr_t *icmp; 4334ab25eeb5Syz155240 u_short *csump; 4335ab25eeb5Syz155240 tcphdr_t *tcp; 4336ab25eeb5Syz155240 udphdr_t *udp; 4337ab25eeb5Syz155240 4338ab25eeb5Syz155240 csump = NULL; 4339ab25eeb5Syz155240 if (fin->fin_out == 0) { 4340ab25eeb5Syz155240 fin->fin_rev = (nat->nat_dir == NAT_OUTBOUND); 4341ab25eeb5Syz155240 } else { 4342ab25eeb5Syz155240 fin->fin_rev = (nat->nat_dir == NAT_INBOUND); 4343ab25eeb5Syz155240 } 4344ab25eeb5Syz155240 4345ab25eeb5Syz155240 switch (fin->fin_p) 4346ab25eeb5Syz155240 { 4347ab25eeb5Syz155240 case IPPROTO_TCP : 4348ab25eeb5Syz155240 tcp = fin->fin_dp; 4349ab25eeb5Syz155240 4350ab25eeb5Syz155240 csump = &tcp->th_sum; 4351ab25eeb5Syz155240 4352ab25eeb5Syz155240 /* 4353ab25eeb5Syz155240 * Do a MSS CLAMPING on a SYN packet, 4354ab25eeb5Syz155240 * only deal IPv4 for now. 4355ab25eeb5Syz155240 */ 4356ab25eeb5Syz155240 if ((nat->nat_mssclamp != 0) && (tcp->th_flags & TH_SYN) != 0) 4357381a2a9aSdr146992 nat_mssclamp(tcp, nat->nat_mssclamp, csump); 4358ab25eeb5Syz155240 4359ab25eeb5Syz155240 break; 4360ab25eeb5Syz155240 4361ab25eeb5Syz155240 case IPPROTO_UDP : 4362ab25eeb5Syz155240 udp = fin->fin_dp; 4363ab25eeb5Syz155240 4364ab25eeb5Syz155240 if (udp->uh_sum) 4365ab25eeb5Syz155240 csump = &udp->uh_sum; 4366ab25eeb5Syz155240 break; 4367ab25eeb5Syz155240 4368ab25eeb5Syz155240 case IPPROTO_ICMP : 4369ab25eeb5Syz155240 icmp = fin->fin_dp; 4370ab25eeb5Syz155240 4371ab25eeb5Syz155240 if ((nflags & IPN_ICMPQUERY) != 0) { 4372ab25eeb5Syz155240 if (icmp->icmp_cksum != 0) 4373ab25eeb5Syz155240 csump = &icmp->icmp_cksum; 4374ab25eeb5Syz155240 } 4375ab25eeb5Syz155240 break; 4376ab25eeb5Syz155240 } 4377ab25eeb5Syz155240 return csump; 4378ab25eeb5Syz155240 } 4379ab25eeb5Syz155240 4380ab25eeb5Syz155240 4381ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4382ab25eeb5Syz155240 /* Function: fr_natunload */ 4383ab25eeb5Syz155240 /* Returns: Nil */ 4384ab25eeb5Syz155240 /* Parameters: Nil */ 4385ab25eeb5Syz155240 /* */ 4386ab25eeb5Syz155240 /* Free all memory used by NAT structures allocated at runtime. */ 4387ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4388f4b3ec61Sdh155122 void fr_natunload(ifs) 4389f4b3ec61Sdh155122 ipf_stack_t *ifs; 4390ab25eeb5Syz155240 { 4391ab25eeb5Syz155240 ipftq_t *ifq, *ifqnext; 4392ab25eeb5Syz155240 4393f4b3ec61Sdh155122 (void) nat_clearlist(ifs); 4394f4b3ec61Sdh155122 (void) nat_flushtable(ifs); 4395ab25eeb5Syz155240 4396ab25eeb5Syz155240 /* 4397ab25eeb5Syz155240 * Proxy timeout queues are not cleaned here because although they 4398ab25eeb5Syz155240 * exist on the NAT list, appr_unload is called after fr_natunload 4399ab25eeb5Syz155240 * and the proxies actually are responsible for them being created. 4400ab25eeb5Syz155240 * Should the proxy timeouts have their own list? There's no real 4401ab25eeb5Syz155240 * justification as this is the only complication. 4402ab25eeb5Syz155240 */ 4403f4b3ec61Sdh155122 for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) { 4404ab25eeb5Syz155240 ifqnext = ifq->ifq_next; 4405ab25eeb5Syz155240 if (((ifq->ifq_flags & IFQF_PROXY) == 0) && 4406ab25eeb5Syz155240 (fr_deletetimeoutqueue(ifq) == 0)) 4407f4b3ec61Sdh155122 fr_freetimeoutqueue(ifq, ifs); 4408ab25eeb5Syz155240 } 4409ab25eeb5Syz155240 4410f4b3ec61Sdh155122 if (ifs->ifs_nat_table[0] != NULL) { 4411f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_table[0], 4412f4b3ec61Sdh155122 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 4413f4b3ec61Sdh155122 ifs->ifs_nat_table[0] = NULL; 4414ab25eeb5Syz155240 } 4415f4b3ec61Sdh155122 if (ifs->ifs_nat_table[1] != NULL) { 4416f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_table[1], 4417f4b3ec61Sdh155122 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 4418f4b3ec61Sdh155122 ifs->ifs_nat_table[1] = NULL; 4419ab25eeb5Syz155240 } 4420f4b3ec61Sdh155122 if (ifs->ifs_nat_rules != NULL) { 4421f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_rules, 4422f4b3ec61Sdh155122 sizeof(ipnat_t *) * ifs->ifs_ipf_natrules_sz); 4423f4b3ec61Sdh155122 ifs->ifs_nat_rules = NULL; 4424ab25eeb5Syz155240 } 4425f4b3ec61Sdh155122 if (ifs->ifs_rdr_rules != NULL) { 4426f4b3ec61Sdh155122 KFREES(ifs->ifs_rdr_rules, 4427f4b3ec61Sdh155122 sizeof(ipnat_t *) * ifs->ifs_ipf_rdrrules_sz); 4428f4b3ec61Sdh155122 ifs->ifs_rdr_rules = NULL; 4429ab25eeb5Syz155240 } 4430f4b3ec61Sdh155122 if (ifs->ifs_maptable != NULL) { 4431f4b3ec61Sdh155122 KFREES(ifs->ifs_maptable, 4432f4b3ec61Sdh155122 sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz); 4433f4b3ec61Sdh155122 ifs->ifs_maptable = NULL; 4434ab25eeb5Syz155240 } 4435f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[0] != NULL) { 4436f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_stats.ns_bucketlen[0], 4437f4b3ec61Sdh155122 sizeof(u_long *) * ifs->ifs_ipf_nattable_sz); 4438f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[0] = NULL; 4439ab25eeb5Syz155240 } 4440f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_bucketlen[1] != NULL) { 4441f4b3ec61Sdh155122 KFREES(ifs->ifs_nat_stats.ns_bucketlen[1], 4442f4b3ec61Sdh155122 sizeof(u_long *) * ifs->ifs_ipf_nattable_sz); 4443f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_bucketlen[1] = NULL; 4444ab25eeb5Syz155240 } 4445ab25eeb5Syz155240 4446f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_maxbucket_reset == 1) 4447f4b3ec61Sdh155122 ifs->ifs_fr_nat_maxbucket = 0; 4448ab25eeb5Syz155240 4449f4b3ec61Sdh155122 if (ifs->ifs_fr_nat_init == 1) { 4450f4b3ec61Sdh155122 ifs->ifs_fr_nat_init = 0; 4451f4b3ec61Sdh155122 fr_sttab_destroy(ifs->ifs_nat_tqb); 4452ab25eeb5Syz155240 4453f4b3ec61Sdh155122 RW_DESTROY(&ifs->ifs_ipf_natfrag); 4454f4b3ec61Sdh155122 RW_DESTROY(&ifs->ifs_ipf_nat); 4455ab25eeb5Syz155240 4456f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ipf_nat_new); 4457f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_ipf_natio); 4458ab25eeb5Syz155240 4459f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_nat_udptq.ifq_lock); 4460f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_nat_icmptq.ifq_lock); 4461f4b3ec61Sdh155122 MUTEX_DESTROY(&ifs->ifs_nat_iptq.ifq_lock); 4462ab25eeb5Syz155240 } 4463ab25eeb5Syz155240 } 4464ab25eeb5Syz155240 4465ab25eeb5Syz155240 4466ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4467ab25eeb5Syz155240 /* Function: fr_natexpire */ 4468ab25eeb5Syz155240 /* Returns: Nil */ 4469ab25eeb5Syz155240 /* Parameters: Nil */ 4470ab25eeb5Syz155240 /* */ 4471ab25eeb5Syz155240 /* Check all of the timeout queues for entries at the top which need to be */ 4472ab25eeb5Syz155240 /* expired. */ 4473ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4474f4b3ec61Sdh155122 void fr_natexpire(ifs) 4475f4b3ec61Sdh155122 ipf_stack_t *ifs; 4476ab25eeb5Syz155240 { 4477ab25eeb5Syz155240 ipftq_t *ifq, *ifqnext; 4478ab25eeb5Syz155240 ipftqent_t *tqe, *tqn; 4479ab25eeb5Syz155240 int i; 4480ab25eeb5Syz155240 SPL_INT(s); 4481ab25eeb5Syz155240 4482ab25eeb5Syz155240 SPL_NET(s); 4483f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 4484f4b3ec61Sdh155122 for (ifq = ifs->ifs_nat_tqb, i = 0; ifq != NULL; ifq = ifq->ifq_next) { 4485ab25eeb5Syz155240 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) { 4486f4b3ec61Sdh155122 if (tqe->tqe_die > ifs->ifs_fr_ticks) 4487ab25eeb5Syz155240 break; 4488ab25eeb5Syz155240 tqn = tqe->tqe_next; 4489f4b3ec61Sdh155122 nat_delete(tqe->tqe_parent, NL_EXPIRE, ifs); 4490ab25eeb5Syz155240 } 4491ab25eeb5Syz155240 } 4492ab25eeb5Syz155240 4493f4b3ec61Sdh155122 for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) { 4494ab25eeb5Syz155240 ifqnext = ifq->ifq_next; 4495ab25eeb5Syz155240 4496ab25eeb5Syz155240 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) { 4497f4b3ec61Sdh155122 if (tqe->tqe_die > ifs->ifs_fr_ticks) 4498ab25eeb5Syz155240 break; 4499ab25eeb5Syz155240 tqn = tqe->tqe_next; 4500f4b3ec61Sdh155122 nat_delete(tqe->tqe_parent, NL_EXPIRE, ifs); 4501ab25eeb5Syz155240 } 4502ab25eeb5Syz155240 } 4503ab25eeb5Syz155240 4504f4b3ec61Sdh155122 for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) { 4505ab25eeb5Syz155240 ifqnext = ifq->ifq_next; 4506ab25eeb5Syz155240 4507ab25eeb5Syz155240 if (((ifq->ifq_flags & IFQF_DELETE) != 0) && 4508ab25eeb5Syz155240 (ifq->ifq_ref == 0)) { 4509f4b3ec61Sdh155122 fr_freetimeoutqueue(ifq, ifs); 4510ab25eeb5Syz155240 } 4511ab25eeb5Syz155240 } 4512ab25eeb5Syz155240 45133805c50fSan207044 if (ifs->ifs_nat_doflush != 0) { 45143805c50fSan207044 (void) nat_extraflush(2, ifs); 45153805c50fSan207044 ifs->ifs_nat_doflush = 0; 45163805c50fSan207044 } 45173805c50fSan207044 4518f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4519ab25eeb5Syz155240 SPL_X(s); 4520ab25eeb5Syz155240 } 4521ab25eeb5Syz155240 4522ab25eeb5Syz155240 4523ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4524381a2a9aSdr146992 /* Function: fr_nataddrsync */ 4525ab25eeb5Syz155240 /* Returns: Nil */ 4526ab25eeb5Syz155240 /* Parameters: ifp(I) - pointer to network interface */ 4527381a2a9aSdr146992 /* addr(I) - pointer to new network address */ 4528ab25eeb5Syz155240 /* */ 4529ab25eeb5Syz155240 /* Walk through all of the currently active NAT sessions, looking for those */ 4530381a2a9aSdr146992 /* which need to have their translated address updated (where the interface */ 4531381a2a9aSdr146992 /* matches the one passed in) and change it, recalculating the checksum sum */ 4532381a2a9aSdr146992 /* difference too. */ 4533ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4534f4b3ec61Sdh155122 void fr_nataddrsync(ifp, addr, ifs) 4535ab25eeb5Syz155240 void *ifp; 4536381a2a9aSdr146992 struct in_addr *addr; 4537f4b3ec61Sdh155122 ipf_stack_t *ifs; 4538ab25eeb5Syz155240 { 4539ab25eeb5Syz155240 u_32_t sum1, sum2, sumd; 4540ab25eeb5Syz155240 nat_t *nat; 4541381a2a9aSdr146992 ipnat_t *np; 4542ab25eeb5Syz155240 SPL_INT(s); 4543ab25eeb5Syz155240 4544f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) 4545ab25eeb5Syz155240 return; 4546ab25eeb5Syz155240 4547ab25eeb5Syz155240 SPL_NET(s); 4548f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 4549ab25eeb5Syz155240 4550f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) { 4551f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4552ab25eeb5Syz155240 return; 4553ab25eeb5Syz155240 } 4554ab25eeb5Syz155240 4555381a2a9aSdr146992 /* 4556381a2a9aSdr146992 * Change IP addresses for NAT sessions for any protocol except TCP 4557381a2a9aSdr146992 * since it will break the TCP connection anyway. The only rules 4558381a2a9aSdr146992 * which will get changed are those which are "map ... -> 0/32", 4559381a2a9aSdr146992 * where the rule specifies the address is taken from the interface. 4560381a2a9aSdr146992 */ 4561f4b3ec61Sdh155122 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4562381a2a9aSdr146992 if (addr != NULL) { 4563381a2a9aSdr146992 if (((ifp != NULL) && ifp != (nat->nat_ifps[0])) || 4564381a2a9aSdr146992 ((nat->nat_flags & IPN_TCP) != 0)) 4565ab25eeb5Syz155240 continue; 4566381a2a9aSdr146992 if (((np = nat->nat_ptr) == NULL) || 4567381a2a9aSdr146992 (np->in_nip || (np->in_outmsk != 0xffffffff))) 4568ab25eeb5Syz155240 continue; 4569ab25eeb5Syz155240 4570ab25eeb5Syz155240 /* 4571ab25eeb5Syz155240 * Change the map-to address to be the same as the 4572ab25eeb5Syz155240 * new one. 4573ab25eeb5Syz155240 */ 4574ab25eeb5Syz155240 sum1 = nat->nat_outip.s_addr; 4575381a2a9aSdr146992 nat->nat_outip = *addr; 4576381a2a9aSdr146992 sum2 = nat->nat_outip.s_addr; 4577381a2a9aSdr146992 4578381a2a9aSdr146992 } else if (((ifp == NULL) || (ifp == nat->nat_ifps[0])) && 4579381a2a9aSdr146992 !(nat->nat_flags & IPN_TCP) && (np = nat->nat_ptr) && 4580381a2a9aSdr146992 (np->in_outmsk == 0xffffffff) && !np->in_nip) { 4581381a2a9aSdr146992 struct in_addr in; 4582381a2a9aSdr146992 4583381a2a9aSdr146992 /* 4584381a2a9aSdr146992 * Change the map-to address to be the same as the 4585381a2a9aSdr146992 * new one. 4586381a2a9aSdr146992 */ 4587381a2a9aSdr146992 sum1 = nat->nat_outip.s_addr; 4588381a2a9aSdr146992 if (fr_ifpaddr(4, FRI_NORMAL, nat->nat_ifps[0], 4589f4b3ec61Sdh155122 &in, NULL, ifs) != -1) 4590ab25eeb5Syz155240 nat->nat_outip = in; 4591ab25eeb5Syz155240 sum2 = nat->nat_outip.s_addr; 4592381a2a9aSdr146992 } else { 4593381a2a9aSdr146992 continue; 4594381a2a9aSdr146992 } 4595ab25eeb5Syz155240 4596ab25eeb5Syz155240 if (sum1 == sum2) 4597ab25eeb5Syz155240 continue; 4598ab25eeb5Syz155240 /* 4599ab25eeb5Syz155240 * Readjust the checksum adjustment to take into 4600ab25eeb5Syz155240 * account the new IP#. 4601ab25eeb5Syz155240 */ 4602ab25eeb5Syz155240 CALC_SUMD(sum1, sum2, sumd); 4603ab25eeb5Syz155240 /* XXX - dont change for TCP when solaris does 4604ab25eeb5Syz155240 * hardware checksumming. 4605ab25eeb5Syz155240 */ 4606ab25eeb5Syz155240 sumd += nat->nat_sumd[0]; 4607ab25eeb5Syz155240 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 4608ab25eeb5Syz155240 nat->nat_sumd[1] = nat->nat_sumd[0]; 4609ab25eeb5Syz155240 } 4610381a2a9aSdr146992 4611f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4612381a2a9aSdr146992 SPL_X(s); 4613381a2a9aSdr146992 } 4614381a2a9aSdr146992 4615381a2a9aSdr146992 4616381a2a9aSdr146992 /* ------------------------------------------------------------------------ */ 4617381a2a9aSdr146992 /* Function: fr_natifpsync */ 4618381a2a9aSdr146992 /* Returns: Nil */ 4619381a2a9aSdr146992 /* Parameters: action(I) - how we are syncing */ 4620381a2a9aSdr146992 /* ifp(I) - pointer to network interface */ 4621381a2a9aSdr146992 /* name(I) - name of interface to sync to */ 4622381a2a9aSdr146992 /* */ 4623381a2a9aSdr146992 /* This function is used to resync the mapping of interface names and their */ 4624381a2a9aSdr146992 /* respective 'pointers'. For "action == IPFSYNC_RESYNC", resync all */ 4625381a2a9aSdr146992 /* interfaces by doing a new lookup of name to 'pointer'. For "action == */ 4626381a2a9aSdr146992 /* IPFSYNC_NEWIFP", treat ifp as the new pointer value associated with */ 4627381a2a9aSdr146992 /* "name" and for "action == IPFSYNC_OLDIFP", ifp is a pointer for which */ 4628381a2a9aSdr146992 /* there is no longer any interface associated with it. */ 4629381a2a9aSdr146992 /* ------------------------------------------------------------------------ */ 4630f4b3ec61Sdh155122 void fr_natifpsync(action, ifp, name, ifs) 4631381a2a9aSdr146992 int action; 4632381a2a9aSdr146992 void *ifp; 4633381a2a9aSdr146992 char *name; 4634f4b3ec61Sdh155122 ipf_stack_t *ifs; 4635381a2a9aSdr146992 { 4636381a2a9aSdr146992 #if defined(_KERNEL) && !defined(MENTAT) && defined(USE_SPL) 4637381a2a9aSdr146992 int s; 4638381a2a9aSdr146992 #endif 4639381a2a9aSdr146992 nat_t *nat; 4640381a2a9aSdr146992 ipnat_t *n; 4641381a2a9aSdr146992 4642f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) 4643381a2a9aSdr146992 return; 4644381a2a9aSdr146992 4645381a2a9aSdr146992 SPL_NET(s); 4646f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 4647381a2a9aSdr146992 4648f4b3ec61Sdh155122 if (ifs->ifs_fr_running <= 0) { 4649f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4650381a2a9aSdr146992 return; 4651381a2a9aSdr146992 } 4652381a2a9aSdr146992 4653381a2a9aSdr146992 switch (action) 4654381a2a9aSdr146992 { 4655381a2a9aSdr146992 case IPFSYNC_RESYNC : 4656f4b3ec61Sdh155122 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4657381a2a9aSdr146992 if ((ifp == nat->nat_ifps[0]) || 4658381a2a9aSdr146992 (nat->nat_ifps[0] == (void *)-1)) { 4659381a2a9aSdr146992 nat->nat_ifps[0] = 4660f4b3ec61Sdh155122 fr_resolvenic(nat->nat_ifnames[0], 4, ifs); 4661381a2a9aSdr146992 } 4662381a2a9aSdr146992 4663381a2a9aSdr146992 if ((ifp == nat->nat_ifps[1]) || 4664381a2a9aSdr146992 (nat->nat_ifps[1] == (void *)-1)) { 4665381a2a9aSdr146992 nat->nat_ifps[1] = 4666f4b3ec61Sdh155122 fr_resolvenic(nat->nat_ifnames[1], 4, ifs); 4667381a2a9aSdr146992 } 4668ab25eeb5Syz155240 } 4669ab25eeb5Syz155240 4670f4b3ec61Sdh155122 for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) { 4671381a2a9aSdr146992 if (n->in_ifps[0] == ifp || 4672381a2a9aSdr146992 n->in_ifps[0] == (void *)-1) { 4673381a2a9aSdr146992 n->in_ifps[0] = 4674f4b3ec61Sdh155122 fr_resolvenic(n->in_ifnames[0], 4, ifs); 4675381a2a9aSdr146992 } 4676381a2a9aSdr146992 if (n->in_ifps[1] == ifp || 4677381a2a9aSdr146992 n->in_ifps[1] == (void *)-1) { 4678381a2a9aSdr146992 n->in_ifps[1] = 4679f4b3ec61Sdh155122 fr_resolvenic(n->in_ifnames[1], 4, ifs); 4680381a2a9aSdr146992 } 4681381a2a9aSdr146992 } 4682381a2a9aSdr146992 break; 4683381a2a9aSdr146992 case IPFSYNC_NEWIFP : 4684f4b3ec61Sdh155122 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4685381a2a9aSdr146992 if (!strncmp(name, nat->nat_ifnames[0], 4686381a2a9aSdr146992 sizeof(nat->nat_ifnames[0]))) 4687381a2a9aSdr146992 nat->nat_ifps[0] = ifp; 4688381a2a9aSdr146992 if (!strncmp(name, nat->nat_ifnames[1], 4689381a2a9aSdr146992 sizeof(nat->nat_ifnames[1]))) 4690381a2a9aSdr146992 nat->nat_ifps[1] = ifp; 4691381a2a9aSdr146992 } 4692f4b3ec61Sdh155122 for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) { 4693381a2a9aSdr146992 if (!strncmp(name, n->in_ifnames[0], 4694381a2a9aSdr146992 sizeof(n->in_ifnames[0]))) 4695381a2a9aSdr146992 n->in_ifps[0] = ifp; 4696381a2a9aSdr146992 if (!strncmp(name, n->in_ifnames[1], 4697381a2a9aSdr146992 sizeof(n->in_ifnames[1]))) 4698381a2a9aSdr146992 n->in_ifps[1] = ifp; 4699381a2a9aSdr146992 } 4700381a2a9aSdr146992 break; 4701381a2a9aSdr146992 case IPFSYNC_OLDIFP : 4702f4b3ec61Sdh155122 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4703381a2a9aSdr146992 if (ifp == nat->nat_ifps[0]) 4704381a2a9aSdr146992 nat->nat_ifps[0] = (void *)-1; 4705381a2a9aSdr146992 if (ifp == nat->nat_ifps[1]) 4706381a2a9aSdr146992 nat->nat_ifps[1] = (void *)-1; 4707381a2a9aSdr146992 } 4708f4b3ec61Sdh155122 for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) { 4709381a2a9aSdr146992 if (n->in_ifps[0] == ifp) 4710381a2a9aSdr146992 n->in_ifps[0] = (void *)-1; 4711381a2a9aSdr146992 if (n->in_ifps[1] == ifp) 4712381a2a9aSdr146992 n->in_ifps[1] = (void *)-1; 4713381a2a9aSdr146992 } 4714381a2a9aSdr146992 break; 4715ab25eeb5Syz155240 } 4716f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4717ab25eeb5Syz155240 SPL_X(s); 4718ab25eeb5Syz155240 } 4719ab25eeb5Syz155240 4720ab25eeb5Syz155240 4721ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4722ab25eeb5Syz155240 /* Function: nat_icmpquerytype4 */ 4723ab25eeb5Syz155240 /* Returns: int - 1 == success, 0 == failure */ 4724ab25eeb5Syz155240 /* Parameters: icmptype(I) - ICMP type number */ 4725ab25eeb5Syz155240 /* */ 4726ab25eeb5Syz155240 /* Tests to see if the ICMP type number passed is a query/response type or */ 4727ab25eeb5Syz155240 /* not. */ 4728ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4729ab25eeb5Syz155240 static INLINE int nat_icmpquerytype4(icmptype) 4730ab25eeb5Syz155240 int icmptype; 4731ab25eeb5Syz155240 { 4732ab25eeb5Syz155240 4733ab25eeb5Syz155240 /* 4734ab25eeb5Syz155240 * For the ICMP query NAT code, it is essential that both the query 4735ab25eeb5Syz155240 * and the reply match on the NAT rule. Because the NAT structure 4736ab25eeb5Syz155240 * does not keep track of the icmptype, and a single NAT structure 4737ab25eeb5Syz155240 * is used for all icmp types with the same src, dest and id, we 4738ab25eeb5Syz155240 * simply define the replies as queries as well. The funny thing is, 4739ab25eeb5Syz155240 * altough it seems silly to call a reply a query, this is exactly 4740ab25eeb5Syz155240 * as it is defined in the IPv4 specification 4741ab25eeb5Syz155240 */ 4742ab25eeb5Syz155240 4743ab25eeb5Syz155240 switch (icmptype) 4744ab25eeb5Syz155240 { 4745ab25eeb5Syz155240 4746ab25eeb5Syz155240 case ICMP_ECHOREPLY: 4747ab25eeb5Syz155240 case ICMP_ECHO: 4748ab25eeb5Syz155240 /* route aedvertisement/solliciation is currently unsupported: */ 4749ab25eeb5Syz155240 /* it would require rewriting the ICMP data section */ 4750ab25eeb5Syz155240 case ICMP_TSTAMP: 4751ab25eeb5Syz155240 case ICMP_TSTAMPREPLY: 4752ab25eeb5Syz155240 case ICMP_IREQ: 4753ab25eeb5Syz155240 case ICMP_IREQREPLY: 4754ab25eeb5Syz155240 case ICMP_MASKREQ: 4755ab25eeb5Syz155240 case ICMP_MASKREPLY: 4756ab25eeb5Syz155240 return 1; 4757ab25eeb5Syz155240 default: 4758ab25eeb5Syz155240 return 0; 4759ab25eeb5Syz155240 } 4760ab25eeb5Syz155240 } 4761ab25eeb5Syz155240 4762ab25eeb5Syz155240 4763ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4764ab25eeb5Syz155240 /* Function: nat_log */ 4765ab25eeb5Syz155240 /* Returns: Nil */ 4766ab25eeb5Syz155240 /* Parameters: nat(I) - pointer to NAT structure */ 4767ab25eeb5Syz155240 /* type(I) - type of log entry to create */ 4768ab25eeb5Syz155240 /* */ 4769ab25eeb5Syz155240 /* Creates a NAT log entry. */ 4770ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4771f4b3ec61Sdh155122 void nat_log(nat, type, ifs) 4772ab25eeb5Syz155240 struct nat *nat; 4773ab25eeb5Syz155240 u_int type; 4774f4b3ec61Sdh155122 ipf_stack_t *ifs; 4775ab25eeb5Syz155240 { 4776ab25eeb5Syz155240 #ifdef IPFILTER_LOG 4777ab25eeb5Syz155240 # ifndef LARGE_NAT 4778ab25eeb5Syz155240 struct ipnat *np; 4779ab25eeb5Syz155240 int rulen; 4780ab25eeb5Syz155240 # endif 4781ab25eeb5Syz155240 struct natlog natl; 4782ab25eeb5Syz155240 void *items[1]; 4783ab25eeb5Syz155240 size_t sizes[1]; 4784ab25eeb5Syz155240 int types[1]; 4785ab25eeb5Syz155240 4786ab25eeb5Syz155240 natl.nl_inip = nat->nat_inip; 4787ab25eeb5Syz155240 natl.nl_outip = nat->nat_outip; 4788ab25eeb5Syz155240 natl.nl_origip = nat->nat_oip; 4789ab25eeb5Syz155240 natl.nl_bytes[0] = nat->nat_bytes[0]; 4790ab25eeb5Syz155240 natl.nl_bytes[1] = nat->nat_bytes[1]; 4791ab25eeb5Syz155240 natl.nl_pkts[0] = nat->nat_pkts[0]; 4792ab25eeb5Syz155240 natl.nl_pkts[1] = nat->nat_pkts[1]; 4793ab25eeb5Syz155240 natl.nl_origport = nat->nat_oport; 4794ab25eeb5Syz155240 natl.nl_inport = nat->nat_inport; 4795ab25eeb5Syz155240 natl.nl_outport = nat->nat_outport; 4796ab25eeb5Syz155240 natl.nl_p = nat->nat_p; 4797ab25eeb5Syz155240 natl.nl_type = type; 4798ab25eeb5Syz155240 natl.nl_rule = -1; 4799ab25eeb5Syz155240 # ifndef LARGE_NAT 4800ab25eeb5Syz155240 if (nat->nat_ptr != NULL) { 4801f4b3ec61Sdh155122 for (rulen = 0, np = ifs->ifs_nat_list; np; 4802f4b3ec61Sdh155122 np = np->in_next, rulen++) 4803ab25eeb5Syz155240 if (np == nat->nat_ptr) { 4804ab25eeb5Syz155240 natl.nl_rule = rulen; 4805ab25eeb5Syz155240 break; 4806ab25eeb5Syz155240 } 4807ab25eeb5Syz155240 } 4808ab25eeb5Syz155240 # endif 4809ab25eeb5Syz155240 items[0] = &natl; 4810ab25eeb5Syz155240 sizes[0] = sizeof(natl); 4811ab25eeb5Syz155240 types[0] = 0; 4812ab25eeb5Syz155240 4813f4b3ec61Sdh155122 (void) ipllog(IPL_LOGNAT, NULL, items, sizes, types, 1, ifs); 4814ab25eeb5Syz155240 #endif 4815ab25eeb5Syz155240 } 4816ab25eeb5Syz155240 4817ab25eeb5Syz155240 4818ab25eeb5Syz155240 #if defined(__OpenBSD__) 4819ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4820ab25eeb5Syz155240 /* Function: nat_ifdetach */ 4821ab25eeb5Syz155240 /* Returns: Nil */ 4822ab25eeb5Syz155240 /* Parameters: ifp(I) - pointer to network interface */ 4823ab25eeb5Syz155240 /* */ 4824ab25eeb5Syz155240 /* Compatibility interface for OpenBSD to trigger the correct updating of */ 4825ab25eeb5Syz155240 /* interface references within IPFilter. */ 4826ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4827f4b3ec61Sdh155122 void nat_ifdetach(ifp, ifs) 4828ab25eeb5Syz155240 void *ifp; 4829f4b3ec61Sdh155122 ipf_stack_t *ifs; 4830ab25eeb5Syz155240 { 4831f4b3ec61Sdh155122 frsync(ifp, ifs); 4832ab25eeb5Syz155240 return; 4833ab25eeb5Syz155240 } 4834ab25eeb5Syz155240 #endif 4835ab25eeb5Syz155240 4836ab25eeb5Syz155240 4837ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4838f4b3ec61Sdh155122 /* Function: fr_ipnatderef */ 4839f4b3ec61Sdh155122 /* Returns: Nil */ 4840f4b3ec61Sdh155122 /* Parameters: isp(I) - pointer to pointer to NAT rule */ 4841f4b3ec61Sdh155122 /* Write Locks: ipf_nat */ 4842f4b3ec61Sdh155122 /* */ 4843f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 4844f4b3ec61Sdh155122 void fr_ipnatderef(inp, ifs) 4845f4b3ec61Sdh155122 ipnat_t **inp; 4846f4b3ec61Sdh155122 ipf_stack_t *ifs; 4847f4b3ec61Sdh155122 { 4848f4b3ec61Sdh155122 ipnat_t *in; 4849f4b3ec61Sdh155122 4850f4b3ec61Sdh155122 in = *inp; 4851f4b3ec61Sdh155122 *inp = NULL; 4852f4b3ec61Sdh155122 in->in_space++; 4853f4b3ec61Sdh155122 in->in_use--; 4854f4b3ec61Sdh155122 if (in->in_use == 0 && (in->in_flags & IPN_DELETE)) { 4855f4b3ec61Sdh155122 if (in->in_apr) 4856f4b3ec61Sdh155122 appr_free(in->in_apr); 4857f4b3ec61Sdh155122 KFREE(in); 4858f4b3ec61Sdh155122 ifs->ifs_nat_stats.ns_rules--; 4859f4b3ec61Sdh155122 #ifdef notdef 4860f4b3ec61Sdh155122 #if SOLARIS 4861f4b3ec61Sdh155122 if (ifs->ifs_nat_stats.ns_rules == 0) 4862f4b3ec61Sdh155122 ifs->ifs_pfil_delayed_copy = 1; 4863f4b3ec61Sdh155122 #endif 4864f4b3ec61Sdh155122 #endif 4865f4b3ec61Sdh155122 } 4866f4b3ec61Sdh155122 } 4867f4b3ec61Sdh155122 4868f4b3ec61Sdh155122 4869f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 4870ab25eeb5Syz155240 /* Function: fr_natderef */ 4871ab25eeb5Syz155240 /* Returns: Nil */ 4872ab25eeb5Syz155240 /* Parameters: isp(I) - pointer to pointer to NAT table entry */ 4873ab25eeb5Syz155240 /* */ 4874ab25eeb5Syz155240 /* Decrement the reference counter for this NAT table entry and free it if */ 4875ab25eeb5Syz155240 /* there are no more things using it. */ 48760e01ff8bSdr146992 /* */ 48770e01ff8bSdr146992 /* IF nat_ref == 1 when this function is called, then we have an orphan nat */ 48780e01ff8bSdr146992 /* structure *because* it only gets called on paths _after_ nat_ref has been*/ 48790e01ff8bSdr146992 /* incremented. If nat_ref == 1 then we shouldn't decrement it here */ 48800e01ff8bSdr146992 /* because nat_delete() will do that and send nat_ref to -1. */ 48810e01ff8bSdr146992 /* */ 48820e01ff8bSdr146992 /* Holding the lock on nat_lock is required to serialise nat_delete() being */ 48830e01ff8bSdr146992 /* called from a NAT flush ioctl with a deref happening because of a packet.*/ 4884ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4885f4b3ec61Sdh155122 void fr_natderef(natp, ifs) 4886ab25eeb5Syz155240 nat_t **natp; 4887f4b3ec61Sdh155122 ipf_stack_t *ifs; 4888ab25eeb5Syz155240 { 4889ab25eeb5Syz155240 nat_t *nat; 4890ab25eeb5Syz155240 4891ab25eeb5Syz155240 nat = *natp; 4892ab25eeb5Syz155240 *natp = NULL; 48930e01ff8bSdr146992 48940e01ff8bSdr146992 MUTEX_ENTER(&nat->nat_lock); 48950e01ff8bSdr146992 if (nat->nat_ref > 1) { 4896ab25eeb5Syz155240 nat->nat_ref--; 48970e01ff8bSdr146992 MUTEX_EXIT(&nat->nat_lock); 48980e01ff8bSdr146992 return; 48990e01ff8bSdr146992 } 49000e01ff8bSdr146992 MUTEX_EXIT(&nat->nat_lock); 49010e01ff8bSdr146992 49020e01ff8bSdr146992 WRITE_ENTER(&ifs->ifs_ipf_nat); 4903f4b3ec61Sdh155122 nat_delete(nat, NL_EXPIRE, ifs); 4904f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4905ab25eeb5Syz155240 } 4906ab25eeb5Syz155240 4907ab25eeb5Syz155240 4908ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4909ab25eeb5Syz155240 /* Function: fr_natclone */ 4910ab25eeb5Syz155240 /* Returns: ipstate_t* - NULL == cloning failed, */ 4911ab25eeb5Syz155240 /* else pointer to new state structure */ 4912ab25eeb5Syz155240 /* Parameters: fin(I) - pointer to packet information */ 4913ab25eeb5Syz155240 /* is(I) - pointer to master state structure */ 4914ab25eeb5Syz155240 /* Write Lock: ipf_nat */ 4915ab25eeb5Syz155240 /* */ 4916ab25eeb5Syz155240 /* Create a "duplcate" state table entry from the master. */ 4917ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4918ab25eeb5Syz155240 static nat_t *fr_natclone(fin, nat) 4919ab25eeb5Syz155240 fr_info_t *fin; 4920ab25eeb5Syz155240 nat_t *nat; 4921ab25eeb5Syz155240 { 4922ab25eeb5Syz155240 frentry_t *fr; 4923ab25eeb5Syz155240 nat_t *clone; 4924ab25eeb5Syz155240 ipnat_t *np; 4925f4b3ec61Sdh155122 ipf_stack_t *ifs = fin->fin_ifs; 4926ab25eeb5Syz155240 4927ab25eeb5Syz155240 KMALLOC(clone, nat_t *); 4928ab25eeb5Syz155240 if (clone == NULL) 4929ab25eeb5Syz155240 return NULL; 4930ab25eeb5Syz155240 bcopy((char *)nat, (char *)clone, sizeof(*clone)); 4931ab25eeb5Syz155240 4932ab25eeb5Syz155240 MUTEX_NUKE(&clone->nat_lock); 4933ab25eeb5Syz155240 4934ab25eeb5Syz155240 clone->nat_aps = NULL; 4935ab25eeb5Syz155240 /* 4936ab25eeb5Syz155240 * Initialize all these so that nat_delete() doesn't cause a crash. 4937ab25eeb5Syz155240 */ 4938ab25eeb5Syz155240 clone->nat_tqe.tqe_pnext = NULL; 4939ab25eeb5Syz155240 clone->nat_tqe.tqe_next = NULL; 4940ab25eeb5Syz155240 clone->nat_tqe.tqe_ifq = NULL; 4941ab25eeb5Syz155240 clone->nat_tqe.tqe_parent = clone; 4942ab25eeb5Syz155240 4943ab25eeb5Syz155240 clone->nat_flags &= ~SI_CLONE; 4944ab25eeb5Syz155240 clone->nat_flags |= SI_CLONED; 4945ab25eeb5Syz155240 4946ab25eeb5Syz155240 if (clone->nat_hm) 4947ab25eeb5Syz155240 clone->nat_hm->hm_ref++; 4948ab25eeb5Syz155240 4949f4b3ec61Sdh155122 if (nat_insert(clone, fin->fin_rev, ifs) == -1) { 4950ab25eeb5Syz155240 KFREE(clone); 4951ab25eeb5Syz155240 return NULL; 4952ab25eeb5Syz155240 } 4953ab25eeb5Syz155240 np = clone->nat_ptr; 4954ab25eeb5Syz155240 if (np != NULL) { 4955f4b3ec61Sdh155122 if (ifs->ifs_nat_logging) 4956f4b3ec61Sdh155122 nat_log(clone, (u_int)np->in_redir, ifs); 4957ab25eeb5Syz155240 np->in_use++; 4958ab25eeb5Syz155240 } 4959ab25eeb5Syz155240 fr = clone->nat_fr; 4960ab25eeb5Syz155240 if (fr != NULL) { 4961ab25eeb5Syz155240 MUTEX_ENTER(&fr->fr_lock); 4962ab25eeb5Syz155240 fr->fr_ref++; 4963ab25eeb5Syz155240 MUTEX_EXIT(&fr->fr_lock); 4964ab25eeb5Syz155240 } 4965ab25eeb5Syz155240 4966ab25eeb5Syz155240 /* 4967ab25eeb5Syz155240 * Because the clone is created outside the normal loop of things and 4968ab25eeb5Syz155240 * TCP has special needs in terms of state, initialise the timeout 4969ab25eeb5Syz155240 * state of the new NAT from here. 4970ab25eeb5Syz155240 */ 4971ab25eeb5Syz155240 if (clone->nat_p == IPPROTO_TCP) { 4972f4b3ec61Sdh155122 (void) fr_tcp_age(&clone->nat_tqe, fin, ifs->ifs_nat_tqb, 4973ab25eeb5Syz155240 clone->nat_flags); 4974ab25eeb5Syz155240 } 4975ab25eeb5Syz155240 #ifdef IPFILTER_SYNC 4976ab25eeb5Syz155240 clone->nat_sync = ipfsync_new(SMC_NAT, fin, clone); 4977ab25eeb5Syz155240 #endif 4978f4b3ec61Sdh155122 if (ifs->ifs_nat_logging) 4979f4b3ec61Sdh155122 nat_log(clone, NL_CLONE, ifs); 4980ab25eeb5Syz155240 return clone; 4981ab25eeb5Syz155240 } 4982ab25eeb5Syz155240 4983ab25eeb5Syz155240 4984ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4985ab25eeb5Syz155240 /* Function: nat_wildok */ 4986ab25eeb5Syz155240 /* Returns: int - 1 == packet's ports match wildcards */ 4987ab25eeb5Syz155240 /* 0 == packet's ports don't match wildcards */ 4988ab25eeb5Syz155240 /* Parameters: nat(I) - NAT entry */ 4989ab25eeb5Syz155240 /* sport(I) - source port */ 4990ab25eeb5Syz155240 /* dport(I) - destination port */ 4991ab25eeb5Syz155240 /* flags(I) - wildcard flags */ 4992ab25eeb5Syz155240 /* dir(I) - packet direction */ 4993ab25eeb5Syz155240 /* */ 4994ab25eeb5Syz155240 /* Use NAT entry and packet direction to determine which combination of */ 4995ab25eeb5Syz155240 /* wildcard flags should be used. */ 4996ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 4997ab25eeb5Syz155240 static INLINE int nat_wildok(nat, sport, dport, flags, dir) 4998ab25eeb5Syz155240 nat_t *nat; 4999ab25eeb5Syz155240 int sport; 5000ab25eeb5Syz155240 int dport; 5001ab25eeb5Syz155240 int flags; 5002ab25eeb5Syz155240 int dir; 5003ab25eeb5Syz155240 { 5004ab25eeb5Syz155240 /* 5005ab25eeb5Syz155240 * When called by dir is set to 5006ab25eeb5Syz155240 * nat_inlookup NAT_INBOUND (0) 5007ab25eeb5Syz155240 * nat_outlookup NAT_OUTBOUND (1) 5008ab25eeb5Syz155240 * 5009ab25eeb5Syz155240 * We simply combine the packet's direction in dir with the original 5010ab25eeb5Syz155240 * "intended" direction of that NAT entry in nat->nat_dir to decide 5011ab25eeb5Syz155240 * which combination of wildcard flags to allow. 5012ab25eeb5Syz155240 */ 5013ab25eeb5Syz155240 5014ab25eeb5Syz155240 switch ((dir << 1) | nat->nat_dir) 5015ab25eeb5Syz155240 { 5016ab25eeb5Syz155240 case 3: /* outbound packet / outbound entry */ 5017ab25eeb5Syz155240 if (((nat->nat_inport == sport) || 5018ab25eeb5Syz155240 (flags & SI_W_SPORT)) && 5019ab25eeb5Syz155240 ((nat->nat_oport == dport) || 5020ab25eeb5Syz155240 (flags & SI_W_DPORT))) 5021ab25eeb5Syz155240 return 1; 5022ab25eeb5Syz155240 break; 5023ab25eeb5Syz155240 case 2: /* outbound packet / inbound entry */ 5024ab25eeb5Syz155240 if (((nat->nat_outport == sport) || 5025ab25eeb5Syz155240 (flags & SI_W_DPORT)) && 5026ab25eeb5Syz155240 ((nat->nat_oport == dport) || 5027ab25eeb5Syz155240 (flags & SI_W_SPORT))) 5028ab25eeb5Syz155240 return 1; 5029ab25eeb5Syz155240 break; 5030ab25eeb5Syz155240 case 1: /* inbound packet / outbound entry */ 5031ab25eeb5Syz155240 if (((nat->nat_oport == sport) || 5032ab25eeb5Syz155240 (flags & SI_W_DPORT)) && 5033ab25eeb5Syz155240 ((nat->nat_outport == dport) || 5034ab25eeb5Syz155240 (flags & SI_W_SPORT))) 5035ab25eeb5Syz155240 return 1; 5036ab25eeb5Syz155240 break; 5037ab25eeb5Syz155240 case 0: /* inbound packet / inbound entry */ 5038ab25eeb5Syz155240 if (((nat->nat_oport == sport) || 5039ab25eeb5Syz155240 (flags & SI_W_SPORT)) && 5040ab25eeb5Syz155240 ((nat->nat_outport == dport) || 5041ab25eeb5Syz155240 (flags & SI_W_DPORT))) 5042ab25eeb5Syz155240 return 1; 5043ab25eeb5Syz155240 break; 5044ab25eeb5Syz155240 default: 5045ab25eeb5Syz155240 break; 5046ab25eeb5Syz155240 } 5047ab25eeb5Syz155240 5048ab25eeb5Syz155240 return(0); 5049ab25eeb5Syz155240 } 5050ab25eeb5Syz155240 5051ab25eeb5Syz155240 5052ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 5053ab25eeb5Syz155240 /* Function: nat_mssclamp */ 5054ab25eeb5Syz155240 /* Returns: Nil */ 5055ab25eeb5Syz155240 /* Parameters: tcp(I) - pointer to TCP header */ 5056ab25eeb5Syz155240 /* maxmss(I) - value to clamp the TCP MSS to */ 5057ab25eeb5Syz155240 /* csump(I) - pointer to TCP checksum */ 5058ab25eeb5Syz155240 /* */ 5059ab25eeb5Syz155240 /* Check for MSS option and clamp it if necessary. If found and changed, */ 5060ab25eeb5Syz155240 /* then the TCP header checksum will be updated to reflect the change in */ 5061ab25eeb5Syz155240 /* the MSS. */ 5062ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 5063381a2a9aSdr146992 static void nat_mssclamp(tcp, maxmss, csump) 5064ab25eeb5Syz155240 tcphdr_t *tcp; 5065ab25eeb5Syz155240 u_32_t maxmss; 5066ab25eeb5Syz155240 u_short *csump; 5067ab25eeb5Syz155240 { 5068ab25eeb5Syz155240 u_char *cp, *ep, opt; 5069ab25eeb5Syz155240 int hlen, advance; 5070ab25eeb5Syz155240 u_32_t mss, sumd; 5071ab25eeb5Syz155240 5072ab25eeb5Syz155240 hlen = TCP_OFF(tcp) << 2; 5073ab25eeb5Syz155240 if (hlen > sizeof(*tcp)) { 5074ab25eeb5Syz155240 cp = (u_char *)tcp + sizeof(*tcp); 5075ab25eeb5Syz155240 ep = (u_char *)tcp + hlen; 5076ab25eeb5Syz155240 5077ab25eeb5Syz155240 while (cp < ep) { 5078ab25eeb5Syz155240 opt = cp[0]; 5079ab25eeb5Syz155240 if (opt == TCPOPT_EOL) 5080ab25eeb5Syz155240 break; 5081ab25eeb5Syz155240 else if (opt == TCPOPT_NOP) { 5082ab25eeb5Syz155240 cp++; 5083ab25eeb5Syz155240 continue; 5084ab25eeb5Syz155240 } 5085ab25eeb5Syz155240 5086ab25eeb5Syz155240 if (cp + 1 >= ep) 5087ab25eeb5Syz155240 break; 5088ab25eeb5Syz155240 advance = cp[1]; 5089ab25eeb5Syz155240 if ((cp + advance > ep) || (advance <= 0)) 5090ab25eeb5Syz155240 break; 5091ab25eeb5Syz155240 switch (opt) 5092ab25eeb5Syz155240 { 5093ab25eeb5Syz155240 case TCPOPT_MAXSEG: 5094ab25eeb5Syz155240 if (advance != 4) 5095ab25eeb5Syz155240 break; 5096ab25eeb5Syz155240 mss = cp[2] * 256 + cp[3]; 5097ab25eeb5Syz155240 if (mss > maxmss) { 5098ab25eeb5Syz155240 cp[2] = maxmss / 256; 5099ab25eeb5Syz155240 cp[3] = maxmss & 0xff; 5100ab25eeb5Syz155240 CALC_SUMD(mss, maxmss, sumd); 5101381a2a9aSdr146992 fix_outcksum(csump, sumd); 5102ab25eeb5Syz155240 } 5103ab25eeb5Syz155240 break; 5104ab25eeb5Syz155240 default: 5105ab25eeb5Syz155240 /* ignore unknown options */ 5106ab25eeb5Syz155240 break; 5107ab25eeb5Syz155240 } 5108ab25eeb5Syz155240 5109ab25eeb5Syz155240 cp += advance; 5110ab25eeb5Syz155240 } 5111ab25eeb5Syz155240 } 5112ab25eeb5Syz155240 } 5113ab25eeb5Syz155240 5114ab25eeb5Syz155240 5115ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 5116ab25eeb5Syz155240 /* Function: fr_setnatqueue */ 5117ab25eeb5Syz155240 /* Returns: Nil */ 5118ab25eeb5Syz155240 /* Parameters: nat(I)- pointer to NAT structure */ 5119ab25eeb5Syz155240 /* rev(I) - forward(0) or reverse(1) direction */ 5120ab25eeb5Syz155240 /* Locks: ipf_nat (read or write) */ 5121ab25eeb5Syz155240 /* */ 5122ab25eeb5Syz155240 /* Put the NAT entry on its default queue entry, using rev as a helped in */ 5123ab25eeb5Syz155240 /* determining which queue it should be placed on. */ 5124ab25eeb5Syz155240 /* ------------------------------------------------------------------------ */ 5125f4b3ec61Sdh155122 void fr_setnatqueue(nat, rev, ifs) 5126ab25eeb5Syz155240 nat_t *nat; 5127ab25eeb5Syz155240 int rev; 5128f4b3ec61Sdh155122 ipf_stack_t *ifs; 5129ab25eeb5Syz155240 { 5130ab25eeb5Syz155240 ipftq_t *oifq, *nifq; 5131ab25eeb5Syz155240 5132ab25eeb5Syz155240 if (nat->nat_ptr != NULL) 5133ab25eeb5Syz155240 nifq = nat->nat_ptr->in_tqehead[rev]; 5134ab25eeb5Syz155240 else 5135ab25eeb5Syz155240 nifq = NULL; 5136ab25eeb5Syz155240 5137ab25eeb5Syz155240 if (nifq == NULL) { 5138ab25eeb5Syz155240 switch (nat->nat_p) 5139ab25eeb5Syz155240 { 5140ab25eeb5Syz155240 case IPPROTO_UDP : 5141f4b3ec61Sdh155122 nifq = &ifs->ifs_nat_udptq; 5142ab25eeb5Syz155240 break; 5143ab25eeb5Syz155240 case IPPROTO_ICMP : 5144f4b3ec61Sdh155122 nifq = &ifs->ifs_nat_icmptq; 5145ab25eeb5Syz155240 break; 5146ab25eeb5Syz155240 case IPPROTO_TCP : 5147f4b3ec61Sdh155122 nifq = ifs->ifs_nat_tqb + nat->nat_tqe.tqe_state[rev]; 5148ab25eeb5Syz155240 break; 5149ab25eeb5Syz155240 default : 5150f4b3ec61Sdh155122 nifq = &ifs->ifs_nat_iptq; 5151ab25eeb5Syz155240 break; 5152ab25eeb5Syz155240 } 5153ab25eeb5Syz155240 } 5154ab25eeb5Syz155240 5155ab25eeb5Syz155240 oifq = nat->nat_tqe.tqe_ifq; 5156ab25eeb5Syz155240 /* 5157ab25eeb5Syz155240 * If it's currently on a timeout queue, move it from one queue to 5158ab25eeb5Syz155240 * another, else put it on the end of the newly determined queue. 5159ab25eeb5Syz155240 */ 5160ab25eeb5Syz155240 if (oifq != NULL) 5161f4b3ec61Sdh155122 fr_movequeue(&nat->nat_tqe, oifq, nifq, ifs); 5162ab25eeb5Syz155240 else 5163f4b3ec61Sdh155122 fr_queueappend(&nat->nat_tqe, nifq, nat, ifs); 5164ab25eeb5Syz155240 return; 5165ab25eeb5Syz155240 } 5166f4b3ec61Sdh155122 516790b0a856Sjojemann /* ------------------------------------------------------------------------ */ 5168f4b3ec61Sdh155122 /* Function: nat_getnext */ 5169f4b3ec61Sdh155122 /* Returns: int - 0 == ok, else error */ 5170f4b3ec61Sdh155122 /* Parameters: t(I) - pointer to ipftoken structure */ 5171f4b3ec61Sdh155122 /* itp(I) - pointer to ipfgeniter_t structure */ 517290b0a856Sjojemann /* ifs - ipf stack instance */ 5173f4b3ec61Sdh155122 /* */ 517490b0a856Sjojemann /* Fetch the next nat/ipnat/hostmap structure pointer from the linked list */ 517590b0a856Sjojemann /* and copy it out to the storage space pointed to by itp. The next item */ 5176f4b3ec61Sdh155122 /* in the list to look at is put back in the ipftoken struture. */ 5177f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 5178f4b3ec61Sdh155122 static int nat_getnext(t, itp, ifs) 5179f4b3ec61Sdh155122 ipftoken_t *t; 5180f4b3ec61Sdh155122 ipfgeniter_t *itp; 5181f4b3ec61Sdh155122 ipf_stack_t *ifs; 5182f4b3ec61Sdh155122 { 5183f4b3ec61Sdh155122 hostmap_t *hm, *nexthm = NULL, zerohm; 5184f4b3ec61Sdh155122 ipnat_t *ipn, *nextipnat = NULL, zeroipn; 5185f4b3ec61Sdh155122 nat_t *nat, *nextnat = NULL, zeronat; 518690b0a856Sjojemann int error = 0, count; 518790b0a856Sjojemann char *dst; 518890b0a856Sjojemann 518990b0a856Sjojemann if (itp->igi_nitems == 0) 519090b0a856Sjojemann return EINVAL; 5191f4b3ec61Sdh155122 5192f4b3ec61Sdh155122 READ_ENTER(&ifs->ifs_ipf_nat); 519390b0a856Sjojemann 5194f4b3ec61Sdh155122 switch (itp->igi_type) 5195f4b3ec61Sdh155122 { 5196f4b3ec61Sdh155122 case IPFGENITER_HOSTMAP : 5197f4b3ec61Sdh155122 hm = t->ipt_data; 5198f4b3ec61Sdh155122 if (hm == NULL) { 5199f4b3ec61Sdh155122 nexthm = ifs->ifs_ipf_hm_maplist; 5200f4b3ec61Sdh155122 } else { 520190b0a856Sjojemann nexthm = hm->hm_next; 5202f4b3ec61Sdh155122 } 5203f4b3ec61Sdh155122 break; 5204f4b3ec61Sdh155122 5205f4b3ec61Sdh155122 case IPFGENITER_IPNAT : 5206f4b3ec61Sdh155122 ipn = t->ipt_data; 5207f4b3ec61Sdh155122 if (ipn == NULL) { 5208f4b3ec61Sdh155122 nextipnat = ifs->ifs_nat_list; 5209f4b3ec61Sdh155122 } else { 5210f4b3ec61Sdh155122 nextipnat = ipn->in_next; 5211f4b3ec61Sdh155122 } 5212f4b3ec61Sdh155122 break; 5213f4b3ec61Sdh155122 5214f4b3ec61Sdh155122 case IPFGENITER_NAT : 5215f4b3ec61Sdh155122 nat = t->ipt_data; 5216f4b3ec61Sdh155122 if (nat == NULL) { 5217f4b3ec61Sdh155122 nextnat = ifs->ifs_nat_instances; 5218f4b3ec61Sdh155122 } else { 5219f4b3ec61Sdh155122 nextnat = nat->nat_next; 5220f4b3ec61Sdh155122 } 522190b0a856Sjojemann break; 522290b0a856Sjojemann default : 522390b0a856Sjojemann RWLOCK_EXIT(&ifs->ifs_ipf_nat); 522490b0a856Sjojemann return EINVAL; 522590b0a856Sjojemann } 522690b0a856Sjojemann 522790b0a856Sjojemann dst = itp->igi_data; 522890b0a856Sjojemann for (count = itp->igi_nitems; count > 0; count--) { 522990b0a856Sjojemann switch (itp->igi_type) 523090b0a856Sjojemann { 523190b0a856Sjojemann case IPFGENITER_HOSTMAP : 523290b0a856Sjojemann if (nexthm != NULL) { 523390b0a856Sjojemann ATOMIC_INC32(nexthm->hm_ref); 523490b0a856Sjojemann t->ipt_data = nexthm; 5235f4b3ec61Sdh155122 } else { 523690b0a856Sjojemann bzero(&zerohm, sizeof(zerohm)); 523790b0a856Sjojemann nexthm = &zerohm; 523890b0a856Sjojemann count = 1; 523990b0a856Sjojemann t->ipt_data = NULL; 524090b0a856Sjojemann } 524190b0a856Sjojemann break; 524290b0a856Sjojemann case IPFGENITER_IPNAT : 524390b0a856Sjojemann if (nextipnat != NULL) { 524490b0a856Sjojemann ATOMIC_INC32(nextipnat->in_use); 524590b0a856Sjojemann t->ipt_data = nextipnat; 524690b0a856Sjojemann } else { 524790b0a856Sjojemann bzero(&zeroipn, sizeof(zeroipn)); 524890b0a856Sjojemann nextipnat = &zeroipn; 524990b0a856Sjojemann count = 1; 525090b0a856Sjojemann t->ipt_data = NULL; 525190b0a856Sjojemann } 525290b0a856Sjojemann break; 525390b0a856Sjojemann case IPFGENITER_NAT : 525490b0a856Sjojemann if (nextnat != NULL) { 5255f4b3ec61Sdh155122 MUTEX_ENTER(&nextnat->nat_lock); 5256f4b3ec61Sdh155122 nextnat->nat_ref++; 5257f4b3ec61Sdh155122 MUTEX_EXIT(&nextnat->nat_lock); 525890b0a856Sjojemann t->ipt_data = nextnat; 5259f4b3ec61Sdh155122 } else { 5260f4b3ec61Sdh155122 bzero(&zeronat, sizeof(zeronat)); 5261f4b3ec61Sdh155122 nextnat = &zeronat; 526290b0a856Sjojemann count = 1; 526390b0a856Sjojemann t->ipt_data = NULL; 5264f4b3ec61Sdh155122 } 5265f4b3ec61Sdh155122 break; 526690b0a856Sjojemann default : 526790b0a856Sjojemann break; 5268f4b3ec61Sdh155122 } 5269f4b3ec61Sdh155122 527090b0a856Sjojemann /* 527190b0a856Sjojemann * We can safely release our hold on ipf_nat. 527290b0a856Sjojemann */ 5273f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 5274f4b3ec61Sdh155122 5275f4b3ec61Sdh155122 switch (itp->igi_type) 5276f4b3ec61Sdh155122 { 5277f4b3ec61Sdh155122 case IPFGENITER_HOSTMAP : 5278f4b3ec61Sdh155122 if (hm != NULL) { 5279f4b3ec61Sdh155122 WRITE_ENTER(&ifs->ifs_ipf_nat); 528090b0a856Sjojemann fr_hostmapdel(&hm); 5281f4b3ec61Sdh155122 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 5282f4b3ec61Sdh155122 } 528390b0a856Sjojemann error = COPYOUT(nexthm, dst, sizeof(*nexthm)); 528490b0a856Sjojemann if (error != 0) { 5285f4b3ec61Sdh155122 error = EFAULT; 528690b0a856Sjojemann } else { 528790b0a856Sjojemann dst += sizeof(*nexthm); 528890b0a856Sjojemann hm = nexthm; 528990b0a856Sjojemann nexthm = nexthm->hm_next; 529090b0a856Sjojemann } 5291f4b3ec61Sdh155122 break; 5292f4b3ec61Sdh155122 case IPFGENITER_IPNAT : 529390b0a856Sjojemann if (ipn != NULL) { 529490b0a856Sjojemann WRITE_ENTER(&ifs->ifs_ipf_nat); 5295f4b3ec61Sdh155122 fr_ipnatderef(&ipn, ifs); 529690b0a856Sjojemann RWLOCK_EXIT(&ifs->ifs_ipf_nat); 529790b0a856Sjojemann } 529890b0a856Sjojemann error = COPYOUT(nextipnat, dst, sizeof(*nextipnat)); 529990b0a856Sjojemann if (error != 0) { 5300f4b3ec61Sdh155122 error = EFAULT; 530190b0a856Sjojemann } else { 530290b0a856Sjojemann dst += sizeof(*nextipnat); 530390b0a856Sjojemann ipn = nextipnat; 530490b0a856Sjojemann nextipnat = nextipnat->in_next; 530590b0a856Sjojemann } 530690b0a856Sjojemann break; 530790b0a856Sjojemann case IPFGENITER_NAT : 530890b0a856Sjojemann if (nat != NULL) { 530990b0a856Sjojemann fr_natderef(&nat, ifs); 531090b0a856Sjojemann } 531190b0a856Sjojemann error = COPYOUT(nextnat, dst, sizeof(*nextnat)); 531290b0a856Sjojemann if (error != 0) { 531390b0a856Sjojemann error = EFAULT; 531490b0a856Sjojemann } else { 531590b0a856Sjojemann dst += sizeof(*nextnat); 531690b0a856Sjojemann nat = nextnat; 531790b0a856Sjojemann nextnat = nextnat->nat_next; 531890b0a856Sjojemann } 531990b0a856Sjojemann break; 532090b0a856Sjojemann default : 532190b0a856Sjojemann break; 532290b0a856Sjojemann } 532390b0a856Sjojemann 532490b0a856Sjojemann if ((count == 1) || (error != 0)) 5325f4b3ec61Sdh155122 break; 5326f4b3ec61Sdh155122 532790b0a856Sjojemann READ_ENTER(&ifs->ifs_ipf_nat); 5328f4b3ec61Sdh155122 } 5329f4b3ec61Sdh155122 5330f4b3ec61Sdh155122 return error; 5331f4b3ec61Sdh155122 } 5332f4b3ec61Sdh155122 5333f4b3ec61Sdh155122 5334f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 5335f4b3ec61Sdh155122 /* Function: nat_iterator */ 5336f4b3ec61Sdh155122 /* Returns: int - 0 == ok, else error */ 5337f4b3ec61Sdh155122 /* Parameters: token(I) - pointer to ipftoken structure */ 5338f4b3ec61Sdh155122 /* itp(I) - pointer to ipfgeniter_t structure */ 5339f4b3ec61Sdh155122 /* */ 5340f4b3ec61Sdh155122 /* This function acts as a handler for the SIOCGENITER ioctls that use a */ 5341f4b3ec61Sdh155122 /* generic structure to iterate through a list. There are three different */ 5342f4b3ec61Sdh155122 /* linked lists of NAT related information to go through: NAT rules, active */ 5343f4b3ec61Sdh155122 /* NAT mappings and the NAT fragment cache. */ 5344f4b3ec61Sdh155122 /* ------------------------------------------------------------------------ */ 5345f4b3ec61Sdh155122 static int nat_iterator(token, itp, ifs) 5346f4b3ec61Sdh155122 ipftoken_t *token; 5347f4b3ec61Sdh155122 ipfgeniter_t *itp; 5348f4b3ec61Sdh155122 ipf_stack_t *ifs; 5349f4b3ec61Sdh155122 { 5350f4b3ec61Sdh155122 int error; 5351f4b3ec61Sdh155122 5352f4b3ec61Sdh155122 if (itp->igi_data == NULL) 5353f4b3ec61Sdh155122 return EFAULT; 5354f4b3ec61Sdh155122 5355f4b3ec61Sdh155122 token->ipt_subtype = itp->igi_type; 5356f4b3ec61Sdh155122 5357f4b3ec61Sdh155122 switch (itp->igi_type) 5358f4b3ec61Sdh155122 { 5359f4b3ec61Sdh155122 case IPFGENITER_HOSTMAP : 5360f4b3ec61Sdh155122 case IPFGENITER_IPNAT : 5361f4b3ec61Sdh155122 case IPFGENITER_NAT : 5362f4b3ec61Sdh155122 error = nat_getnext(token, itp, ifs); 5363f4b3ec61Sdh155122 break; 5364f4b3ec61Sdh155122 case IPFGENITER_NATFRAG : 5365f4b3ec61Sdh155122 error = fr_nextfrag(token, itp, &ifs->ifs_ipfr_natlist, 5366f4b3ec61Sdh155122 &ifs->ifs_ipfr_nattail, 5367f4b3ec61Sdh155122 &ifs->ifs_ipf_natfrag, ifs); 5368f4b3ec61Sdh155122 break; 5369f4b3ec61Sdh155122 default : 5370f4b3ec61Sdh155122 error = EINVAL; 5371f4b3ec61Sdh155122 break; 5372f4b3ec61Sdh155122 } 5373f4b3ec61Sdh155122 5374f4b3ec61Sdh155122 return error; 5375f4b3ec61Sdh155122 } 53763805c50fSan207044 53773805c50fSan207044 53783805c50fSan207044 /* -------------------------------------------------------------------- */ 53793805c50fSan207044 /* Function: nat_earlydrop */ 53803805c50fSan207044 /* Returns: number of dropped/removed entries from the queue */ 53813805c50fSan207044 /* Parameters: ifq - pointer to queue with entries to be processed */ 53823805c50fSan207044 /* maxidle - entry must be idle this long to be dropped */ 53833805c50fSan207044 /* ifs - ipf stack instance */ 53843805c50fSan207044 /* */ 53853805c50fSan207044 /* Function is invoked from nat_extraflush() only. Removes entries */ 53863805c50fSan207044 /* form specified timeout queue, based on how long they've sat idle, */ 53873805c50fSan207044 /* without waiting for it to happen on its own. */ 53883805c50fSan207044 /* -------------------------------------------------------------------- */ 53893805c50fSan207044 static int nat_earlydrop(ifq, maxidle, ifs) 53903805c50fSan207044 ipftq_t *ifq; 53913805c50fSan207044 int maxidle; 53923805c50fSan207044 ipf_stack_t *ifs; 53933805c50fSan207044 { 53943805c50fSan207044 ipftqent_t *tqe, *tqn; 53953805c50fSan207044 nat_t *nat; 53963805c50fSan207044 unsigned int dropped; 53973805c50fSan207044 int droptick; 53983805c50fSan207044 53993805c50fSan207044 if (ifq == NULL) 54003805c50fSan207044 return (0); 54013805c50fSan207044 54023805c50fSan207044 dropped = 0; 54033805c50fSan207044 54043805c50fSan207044 /* 54053805c50fSan207044 * Determine the tick representing the idle time we're interested 54063805c50fSan207044 * in. If an entry exists in the queue, and it was touched before 54073805c50fSan207044 * that tick, then it's been idle longer than maxidle ... remove it. 54083805c50fSan207044 */ 54093805c50fSan207044 droptick = ifs->ifs_fr_ticks - maxidle; 54103805c50fSan207044 tqn = ifq->ifq_head; 54113805c50fSan207044 while ((tqe = tqn) != NULL && tqe->tqe_touched < droptick) { 54123805c50fSan207044 tqn = tqe->tqe_next; 54133805c50fSan207044 nat = tqe->tqe_parent; 54143805c50fSan207044 nat_delete(nat, ISL_EXPIRE, ifs); 54153805c50fSan207044 dropped++; 54163805c50fSan207044 } 54173805c50fSan207044 return (dropped); 54183805c50fSan207044 } 54193805c50fSan207044 54203805c50fSan207044 54213805c50fSan207044 /* --------------------------------------------------------------------- */ 54223805c50fSan207044 /* Function: nat_flushclosing */ 54233805c50fSan207044 /* Returns: int - number of NAT entries deleted */ 54243805c50fSan207044 /* Parameters: stateval(I) - State at which to start removing entries */ 54253805c50fSan207044 /* ifs - ipf stack instance */ 54263805c50fSan207044 /* */ 54273805c50fSan207044 /* Remove nat table entries for TCP connections which are in the process */ 54283805c50fSan207044 /* of closing, and are in (or "beyond") state specified by 'stateval'. */ 54293805c50fSan207044 /* --------------------------------------------------------------------- */ 54303805c50fSan207044 static int nat_flushclosing(stateval, ifs) 54313805c50fSan207044 int stateval; 54323805c50fSan207044 ipf_stack_t *ifs; 54333805c50fSan207044 { 54343805c50fSan207044 ipftq_t *ifq, *ifqn; 54353805c50fSan207044 ipftqent_t *tqe, *tqn; 54363805c50fSan207044 nat_t *nat; 54373805c50fSan207044 int dropped; 54383805c50fSan207044 54393805c50fSan207044 dropped = 0; 54403805c50fSan207044 54413805c50fSan207044 /* 54423805c50fSan207044 * Start by deleting any entries in specific timeout queues. 54433805c50fSan207044 */ 54443805c50fSan207044 ifqn = &ifs->ifs_nat_tqb[stateval]; 54453805c50fSan207044 while ((ifq = ifqn) != NULL) { 54463805c50fSan207044 ifqn = ifq->ifq_next; 54473805c50fSan207044 dropped += nat_earlydrop(ifq, (int)0, ifs); 54483805c50fSan207044 } 54493805c50fSan207044 54503805c50fSan207044 /* 54513805c50fSan207044 * Next, look through user defined queues for closing entries. 54523805c50fSan207044 */ 54533805c50fSan207044 ifqn = ifs->ifs_nat_utqe; 54543805c50fSan207044 while ((ifq = ifqn) != NULL) { 54553805c50fSan207044 ifqn = ifq->ifq_next; 54563805c50fSan207044 tqn = ifq->ifq_head; 54573805c50fSan207044 while ((tqe = tqn) != NULL) { 54583805c50fSan207044 tqn = tqe->tqe_next; 54593805c50fSan207044 nat = tqe->tqe_parent; 54603805c50fSan207044 if (nat->nat_p != IPPROTO_TCP) 54613805c50fSan207044 continue; 54623805c50fSan207044 if ((nat->nat_tcpstate[0] >= stateval) && 54633805c50fSan207044 (nat->nat_tcpstate[1] >= stateval)) { 54643805c50fSan207044 nat_delete(nat, NL_EXPIRE, ifs); 54653805c50fSan207044 dropped++; 54663805c50fSan207044 } 54673805c50fSan207044 } 54683805c50fSan207044 } 54693805c50fSan207044 return (dropped); 54703805c50fSan207044 } 54713805c50fSan207044 54723805c50fSan207044 54733805c50fSan207044 /* --------------------------------------------------------------------- */ 54743805c50fSan207044 /* Function: nat_extraflush */ 54753805c50fSan207044 /* Returns: int - number of NAT entries deleted */ 54763805c50fSan207044 /* Parameters: which(I) - how to flush the active NAT table */ 54773805c50fSan207044 /* ifs - ipf stack instance */ 54783805c50fSan207044 /* Write Locks: ipf_nat */ 54793805c50fSan207044 /* */ 54803805c50fSan207044 /* Flush nat tables. Three actions currently defined: */ 54813805c50fSan207044 /* */ 54823805c50fSan207044 /* which == 0 : Flush all nat table entries. */ 54833805c50fSan207044 /* */ 54843805c50fSan207044 /* which == 1 : Flush entries with TCP connections which have started */ 54853805c50fSan207044 /* to close on both ends. */ 54863805c50fSan207044 /* */ 54873805c50fSan207044 /* which == 2 : First, flush entries which are "almost" closed. If that */ 54883805c50fSan207044 /* does not take us below specified threshold in the table, */ 54893805c50fSan207044 /* we want to flush entries with TCP connections which have */ 54903805c50fSan207044 /* been idle for a long time. Start with connections idle */ 54913805c50fSan207044 /* over 12 hours, and then work backwards in half hour */ 54923805c50fSan207044 /* increments to at most 30 minutes idle, and finally work */ 54933805c50fSan207044 /* back in 30 second increments to at most 30 seconds. */ 54943805c50fSan207044 /* --------------------------------------------------------------------- */ 54953805c50fSan207044 static int nat_extraflush(which, ifs) 54963805c50fSan207044 int which; 54973805c50fSan207044 ipf_stack_t *ifs; 54983805c50fSan207044 { 54993805c50fSan207044 ipftq_t *ifq, *ifqn; 55003805c50fSan207044 nat_t *nat, **natp; 55013805c50fSan207044 int idletime, removed, idle_idx; 55023805c50fSan207044 SPL_INT(s); 55033805c50fSan207044 55043805c50fSan207044 removed = 0; 55053805c50fSan207044 55063805c50fSan207044 SPL_NET(s); 55073805c50fSan207044 switch (which) 55083805c50fSan207044 { 55093805c50fSan207044 case 0: 55103805c50fSan207044 natp = &ifs->ifs_nat_instances; 55113805c50fSan207044 while ((nat = *natp) != NULL) { 55123805c50fSan207044 natp = &nat->nat_next; 55133805c50fSan207044 nat_delete(nat, ISL_FLUSH, ifs); 55143805c50fSan207044 removed++; 55153805c50fSan207044 } 55163805c50fSan207044 break; 55173805c50fSan207044 55183805c50fSan207044 case 1: 55193805c50fSan207044 removed = nat_flushclosing(IPF_TCPS_CLOSE_WAIT, ifs); 55203805c50fSan207044 break; 55213805c50fSan207044 55223805c50fSan207044 case 2: 55233805c50fSan207044 removed = nat_flushclosing(IPF_TCPS_FIN_WAIT_2, ifs); 55243805c50fSan207044 55253805c50fSan207044 /* 55263805c50fSan207044 * Be sure we haven't done this in the last 10 seconds. 55273805c50fSan207044 */ 55283805c50fSan207044 if (ifs->ifs_fr_ticks - ifs->ifs_nat_last_force_flush < 55293805c50fSan207044 IPF_TTLVAL(10)) 55303805c50fSan207044 break; 55313805c50fSan207044 ifs->ifs_nat_last_force_flush = ifs->ifs_fr_ticks; 55323805c50fSan207044 55333805c50fSan207044 /* 55343805c50fSan207044 * Determine initial threshold for minimum idle time based on 55353805c50fSan207044 * how long ipfilter has been running. Ipfilter needs to have 55363805c50fSan207044 * been up as long as the smallest interval to continue on. 55373805c50fSan207044 * 55383805c50fSan207044 * Minimum idle times stored in idletime_tab and indexed by 55393805c50fSan207044 * idle_idx. Start at upper end of array and work backwards. 55403805c50fSan207044 * 55413805c50fSan207044 * Once the index is found, set the initial idle time to the 55423805c50fSan207044 * first interval before the current ipfilter run time. 55433805c50fSan207044 */ 55443805c50fSan207044 if (ifs->ifs_fr_ticks < idletime_tab[0]) 55453805c50fSan207044 break; /* switch */ 55463805c50fSan207044 idle_idx = (sizeof (idletime_tab) / sizeof (int)) - 1; 55473805c50fSan207044 if (ifs->ifs_fr_ticks > idletime_tab[idle_idx]) { 55483805c50fSan207044 idletime = idletime_tab[idle_idx]; 55493805c50fSan207044 } else { 55503805c50fSan207044 while ((idle_idx > 0) && 55513805c50fSan207044 (ifs->ifs_fr_ticks < idletime_tab[idle_idx])) 55523805c50fSan207044 idle_idx--; 55533805c50fSan207044 idletime = (ifs->ifs_fr_ticks / 55543805c50fSan207044 idletime_tab[idle_idx]) * 55553805c50fSan207044 idletime_tab[idle_idx]; 55563805c50fSan207044 } 55573805c50fSan207044 55583805c50fSan207044 while ((idle_idx >= 0) && 55593805c50fSan207044 (NAT_TAB_WATER_LEVEL(ifs) > ifs->ifs_nat_flush_lvl_lo)) { 55603805c50fSan207044 /* 55613805c50fSan207044 * Start with appropriate timeout queue. 55623805c50fSan207044 */ 55633805c50fSan207044 removed += nat_earlydrop( 55643805c50fSan207044 &ifs->ifs_nat_tqb[IPF_TCPS_ESTABLISHED], 55653805c50fSan207044 idletime, ifs); 55663805c50fSan207044 55673805c50fSan207044 /* 55683805c50fSan207044 * Make sure we haven't already deleted enough 55693805c50fSan207044 * entries before checking the user defined queues. 55703805c50fSan207044 */ 55713805c50fSan207044 if (NAT_TAB_WATER_LEVEL(ifs) <= 55723805c50fSan207044 ifs->ifs_nat_flush_lvl_lo) 55733805c50fSan207044 break; 55743805c50fSan207044 55753805c50fSan207044 /* 55763805c50fSan207044 * Next, look through the user defined queues. 55773805c50fSan207044 */ 55783805c50fSan207044 ifqn = ifs->ifs_nat_utqe; 55793805c50fSan207044 while ((ifq = ifqn) != NULL) { 55803805c50fSan207044 ifqn = ifq->ifq_next; 55813805c50fSan207044 removed += nat_earlydrop(ifq, idletime, ifs); 55823805c50fSan207044 } 55833805c50fSan207044 55843805c50fSan207044 /* 55853805c50fSan207044 * Adjust the granularity of idle time. 55863805c50fSan207044 * 55873805c50fSan207044 * If we reach an interval boundary, we need to 55883805c50fSan207044 * either adjust the idle time accordingly or exit 55893805c50fSan207044 * the loop altogether (if this is very last check). 55903805c50fSan207044 */ 55913805c50fSan207044 idletime -= idletime_tab[idle_idx]; 55923805c50fSan207044 if (idletime < idletime_tab[idle_idx]) { 55933805c50fSan207044 if (idle_idx != 0) { 55943805c50fSan207044 idletime = idletime_tab[idle_idx] - 55953805c50fSan207044 idletime_tab[idle_idx - 1]; 55963805c50fSan207044 idle_idx--; 55973805c50fSan207044 } else { 55983805c50fSan207044 break; /* while */ 55993805c50fSan207044 } 56003805c50fSan207044 } 56013805c50fSan207044 } 56023805c50fSan207044 break; 56033805c50fSan207044 default: 56043805c50fSan207044 break; 56053805c50fSan207044 } 56063805c50fSan207044 56073805c50fSan207044 SPL_X(s); 56083805c50fSan207044 return (removed); 56093805c50fSan207044 } 5610