1 /* 2 * Copyright (C) 1995-2003 by Darren Reed. 3 * 4 * See the IPFILTER.LICENCE file for details on licencing. 5 * 6 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 7 * Use is subject to license terms. 8 */ 9 10 #if defined(KERNEL) || defined(_KERNEL) 11 # undef KERNEL 12 # undef _KERNEL 13 # define KERNEL 1 14 # define _KERNEL 1 15 #endif 16 #include <sys/errno.h> 17 #include <sys/types.h> 18 #include <sys/param.h> 19 #include <sys/time.h> 20 #include <sys/file.h> 21 #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \ 22 defined(_KERNEL) 23 # include "opt_ipfilter_log.h" 24 #endif 25 #if !defined(_KERNEL) 26 # include <stdio.h> 27 # include <string.h> 28 # include <stdlib.h> 29 # define _KERNEL 30 # ifdef __OpenBSD__ 31 struct file; 32 # endif 33 # include <sys/uio.h> 34 # undef _KERNEL 35 #endif 36 #if defined(_KERNEL) && (__FreeBSD_version >= 220000) 37 # include <sys/filio.h> 38 # include <sys/fcntl.h> 39 #else 40 # include <sys/ioctl.h> 41 #endif 42 #if !defined(AIX) 43 # include <sys/fcntl.h> 44 #endif 45 #if !defined(linux) 46 # include <sys/protosw.h> 47 #endif 48 #include <sys/socket.h> 49 #if defined(_KERNEL) 50 # include <sys/systm.h> 51 # if !defined(__SVR4) && !defined(__svr4__) 52 # include <sys/mbuf.h> 53 # endif 54 #endif 55 #if defined(__SVR4) || defined(__svr4__) 56 # include <sys/filio.h> 57 # include <sys/byteorder.h> 58 # ifdef _KERNEL 59 # include <sys/dditypes.h> 60 # endif 61 # include <sys/stream.h> 62 # include <sys/kmem.h> 63 #endif 64 #if __FreeBSD_version >= 300000 65 # include <sys/queue.h> 66 #endif 67 #include <net/if.h> 68 #if __FreeBSD_version >= 300000 69 # include <net/if_var.h> 70 # if defined(_KERNEL) && !defined(IPFILTER_LKM) 71 # include "opt_ipfilter.h" 72 # endif 73 #endif 74 #ifdef sun 75 # include <net/af.h> 76 #endif 77 #include <net/route.h> 78 #include <netinet/in.h> 79 #include <netinet/in_systm.h> 80 #include <netinet/ip.h> 81 82 #ifdef RFC1825 83 # include <vpn/md5.h> 84 # include <vpn/ipsec.h> 85 extern struct ifnet vpnif; 86 #endif 87 88 #if !defined(linux) 89 # include <netinet/ip_var.h> 90 #endif 91 #include <netinet/tcp.h> 92 #include <netinet/udp.h> 93 #include <netinet/ip_icmp.h> 94 #include "netinet/ip_compat.h" 95 #include <netinet/tcpip.h> 96 #include "netinet/ip_fil.h" 97 #include "netinet/ip_nat.h" 98 #include "netinet/ip_frag.h" 99 #include "netinet/ip_state.h" 100 #include "netinet/ip_proxy.h" 101 #include "netinet/ipf_stack.h" 102 #ifdef IPFILTER_SYNC 103 #include "netinet/ip_sync.h" 104 #endif 105 #if (__FreeBSD_version >= 300000) 106 # include <sys/malloc.h> 107 #endif 108 /* END OF INCLUDES */ 109 110 #undef SOCKADDR_IN 111 #define SOCKADDR_IN struct sockaddr_in 112 113 #if !defined(lint) 114 static const char rcsid[] = "@(#)$Id: ip_nat6.c,v 1.2 2008/02/14 21:05:50 darrenr Exp $"; 115 #endif 116 117 static hostmap_t *nat6_hostmap __P((ipnat_t *, i6addr_t *, i6addr_t *, 118 i6addr_t *, u_32_t, ipf_stack_t *)); 119 static INLINE int nat6_newmap __P((fr_info_t *, nat_t *, natinfo_t *)); 120 static INLINE int nat6_newrdr __P((fr_info_t *, nat_t *, natinfo_t *)); 121 static INLINE int nat6_finalise __P((fr_info_t *, nat_t *, natinfo_t *, 122 tcphdr_t *, nat_t **, int)); 123 static void nat6_tabmove __P((nat_t *, ipf_stack_t *)); 124 static int nat6_match __P((fr_info_t *, ipnat_t *)); 125 static INLINE int nat_icmpquerytype6 __P((int)); 126 127 128 /* ------------------------------------------------------------------------ */ 129 /* Function: nat6_addrdr */ 130 /* Returns: Nil */ 131 /* Parameters: n(I) - pointer to NAT rule to add */ 132 /* */ 133 /* Adds a redirect rule to the hash table of redirect rules and the list of */ 134 /* loaded NAT rules. Updates the bitmask indicating which netmasks are in */ 135 /* use by redirect rules. */ 136 /* ------------------------------------------------------------------------ */ 137 void nat6_addrdr(n, ifs) 138 ipnat_t *n; 139 ipf_stack_t *ifs; 140 { 141 ipnat_t **np; 142 i6addr_t j; 143 u_int hv; 144 int k; 145 146 k = count6bits(n->in_out[1].i6); 147 if ((k >= 0) && (k != 128)) 148 ifs->ifs_rdr6_masks[k >> 5] |= 1 << (k & 31); 149 IP6_AND(&n->in_out[0], &n->in_out[1], &j); 150 hv = NAT_HASH_FN6(&j, 0, ifs->ifs_ipf_rdrrules_sz); 151 np = ifs->ifs_rdr_rules + hv; 152 while (*np != NULL) 153 np = &(*np)->in_rnext; 154 n->in_rnext = NULL; 155 n->in_prnext = np; 156 n->in_hv = hv; 157 *np = n; 158 } 159 160 161 /* ------------------------------------------------------------------------ */ 162 /* Function: nat6_addnat */ 163 /* Returns: Nil */ 164 /* Parameters: n(I) - pointer to NAT rule to add */ 165 /* */ 166 /* Adds a NAT map rule to the hash table of rules and the list of loaded */ 167 /* NAT rules. Updates the bitmask indicating which netmasks are in use by */ 168 /* redirect rules. */ 169 /* ------------------------------------------------------------------------ */ 170 void nat6_addnat(n, ifs) 171 ipnat_t *n; 172 ipf_stack_t *ifs; 173 { 174 ipnat_t **np; 175 i6addr_t j; 176 u_int hv; 177 int k; 178 179 k = count6bits(n->in_in[1].i6); 180 if ((k >= 0) && (k != 128)) 181 ifs->ifs_nat6_masks[k >> 5] |= 1 << (k & 31); 182 IP6_AND(&n->in_in[0], &n->in_in[1], &j); 183 hv = NAT_HASH_FN6(&j, 0, ifs->ifs_ipf_natrules_sz); 184 np = ifs->ifs_nat_rules + hv; 185 while (*np != NULL) 186 np = &(*np)->in_mnext; 187 n->in_mnext = NULL; 188 n->in_pmnext = np; 189 n->in_hv = hv; 190 *np = n; 191 } 192 193 194 /* ------------------------------------------------------------------------ */ 195 /* Function: nat6_hostmap */ 196 /* Returns: struct hostmap* - NULL if no hostmap could be created, */ 197 /* else a pointer to the hostmapping to use */ 198 /* Parameters: np(I) - pointer to NAT rule */ 199 /* real(I) - real IP address */ 200 /* map(I) - mapped IP address */ 201 /* port(I) - destination port number */ 202 /* Write Locks: ipf_nat */ 203 /* */ 204 /* Check if an ip address has already been allocated for a given mapping */ 205 /* that is not doing port based translation. If is not yet allocated, then */ 206 /* create a new entry if a non-NULL NAT rule pointer has been supplied. */ 207 /* ------------------------------------------------------------------------ */ 208 static struct hostmap *nat6_hostmap(np, src, dst, map, port, ifs) 209 ipnat_t *np; 210 i6addr_t *src, *dst, *map; 211 u_32_t port; 212 ipf_stack_t *ifs; 213 { 214 hostmap_t *hm; 215 u_int hv; 216 217 hv = (src->i6[3] ^ dst->i6[3]); 218 hv += (src->i6[2] ^ dst->i6[2]); 219 hv += (src->i6[1] ^ dst->i6[1]); 220 hv += (src->i6[0] ^ dst->i6[0]); 221 hv += src->i6[3]; 222 hv += src->i6[2]; 223 hv += src->i6[1]; 224 hv += src->i6[0]; 225 hv += dst->i6[3]; 226 hv += dst->i6[2]; 227 hv += dst->i6[1]; 228 hv += dst->i6[0]; 229 hv %= HOSTMAP_SIZE; 230 for (hm = ifs->ifs_maptable[hv]; hm; hm = hm->hm_next) 231 if (IP6_EQ(&hm->hm_srcip6, src) && 232 IP6_EQ(&hm->hm_dstip6, dst) && 233 ((np == NULL) || (np == hm->hm_ipnat)) && 234 ((port == 0) || (port == hm->hm_port))) { 235 hm->hm_ref++; 236 return hm; 237 } 238 239 if (np == NULL) 240 return NULL; 241 242 KMALLOC(hm, hostmap_t *); 243 if (hm) { 244 hm->hm_hnext = ifs->ifs_ipf_hm_maplist; 245 hm->hm_phnext = &ifs->ifs_ipf_hm_maplist; 246 if (ifs->ifs_ipf_hm_maplist != NULL) 247 ifs->ifs_ipf_hm_maplist->hm_phnext = &hm->hm_hnext; 248 ifs->ifs_ipf_hm_maplist = hm; 249 250 hm->hm_next = ifs->ifs_maptable[hv]; 251 hm->hm_pnext = ifs->ifs_maptable + hv; 252 if (ifs->ifs_maptable[hv] != NULL) 253 ifs->ifs_maptable[hv]->hm_pnext = &hm->hm_next; 254 ifs->ifs_maptable[hv] = hm; 255 hm->hm_ipnat = np; 256 hm->hm_src = *src; 257 hm->hm_dst = *dst; 258 hm->hm_map = *map; 259 hm->hm_ref = 1; 260 hm->hm_port = port; 261 hm->hm_v = 6; 262 } 263 return hm; 264 } 265 266 267 /* ------------------------------------------------------------------------ */ 268 /* Function: nat6_newmap */ 269 /* Returns: int - -1 == error, 0 == success */ 270 /* Parameters: fin(I) - pointer to packet information */ 271 /* nat(I) - pointer to NAT entry */ 272 /* ni(I) - pointer to structure with misc. information needed */ 273 /* to create new NAT entry. */ 274 /* */ 275 /* Given an empty NAT structure, populate it with new information about a */ 276 /* new NAT session, as defined by the matching NAT rule. */ 277 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/ 278 /* to the new IP address for the translation. */ 279 /* ------------------------------------------------------------------------ */ 280 static INLINE int nat6_newmap(fin, nat, ni) 281 fr_info_t *fin; 282 nat_t *nat; 283 natinfo_t *ni; 284 { 285 u_short st_port, dport, sport, port, sp, dp; 286 i6addr_t in, st_ip; 287 hostmap_t *hm; 288 u_32_t flags; 289 ipnat_t *np; 290 nat_t *natl; 291 int l; 292 ipf_stack_t *ifs = fin->fin_ifs; 293 294 /* 295 * If it's an outbound packet which doesn't match any existing 296 * record, then create a new port 297 */ 298 l = 0; 299 hm = NULL; 300 np = ni->nai_np; 301 st_ip = np->in_next6; 302 st_port = np->in_pnext; 303 flags = ni->nai_flags; 304 sport = ni->nai_sport; 305 dport = ni->nai_dport; 306 307 /* 308 * Do a loop until we either run out of entries to try or we find 309 * a NAT mapping that isn't currently being used. This is done 310 * because the change to the source is not (usually) being fixed. 311 */ 312 do { 313 port = 0; 314 in = np->in_next6; 315 if (l == 0) { 316 /* 317 * Check to see if there is an existing NAT 318 * setup for this IP address pair. 319 */ 320 hm = nat6_hostmap(np, &fin->fin_src6, &fin->fin_dst6, 321 &in, 0, ifs); 322 if (hm != NULL) 323 in = hm->hm_map; 324 } else if ((l == 1) && (hm != NULL)) { 325 fr_hostmapdel(&hm); 326 } 327 328 nat->nat_hm = hm; 329 330 if (IP6_ISONES(&np->in_out[1]) && (np->in_pnext == 0)) { 331 if (l > 0) 332 return -1; 333 } 334 335 if (np->in_redir == NAT_BIMAP && 336 IP6_EQ(&np->in_in[1], &np->in_out[1])) { 337 i6addr_t temp; 338 /* 339 * map the address block in a 1:1 fashion 340 */ 341 temp.i6[0] = fin->fin_src6.i6[0] & 342 ~np->in_in[1].i6[0]; 343 temp.i6[1] = fin->fin_src6.i6[1] & 344 ~np->in_in[1].i6[1]; 345 temp.i6[2] = fin->fin_src6.i6[2] & 346 ~np->in_in[1].i6[2]; 347 temp.i6[3] = fin->fin_src6.i6[3] & 348 ~np->in_in[1].i6[3]; 349 in = np->in_out[0]; 350 IP6_MERGE(&in, &temp, &np->in_in[0]); 351 352 #ifdef NEED_128BIT_MATH 353 } else if (np->in_redir & NAT_MAPBLK) { 354 if ((l >= np->in_ppip) || ((l > 0) && 355 !(flags & IPN_TCPUDP))) 356 return -1; 357 /* 358 * map-block - Calculate destination address. 359 */ 360 IP6_MASK(&in, &fin->fin_src6, &np->in_in[1]); 361 in = ntol(in); 362 inb = in; 363 in /= np->in_ippip; 364 in &= ntohl(~np->in_out[1]); 365 in += ntohl(np->in_out[0]); 366 /* 367 * Calculate destination port. 368 */ 369 if ((flags & IPN_TCPUDP) && 370 (np->in_ppip != 0)) { 371 port = ntohs(sport) + l; 372 port %= np->in_ppip; 373 port += np->in_ppip * 374 (inb.s_addr % np->in_ippip); 375 port += MAPBLK_MINPORT; 376 port = htons(port); 377 } 378 #endif 379 380 } else if (IP6_ISZERO(&np->in_out[0]) && 381 IP6_ISONES(&np->in_out[1])) { 382 /* 383 * 0/128 - use the interface's IP address. 384 */ 385 if ((l > 0) || 386 fr_ifpaddr(6, FRI_NORMAL, fin->fin_ifp, 387 (void *)&in, NULL, fin->fin_ifs) == -1) 388 return -1; 389 390 } else if (IP6_ISZERO(&np->in_out[0]) && 391 IP6_ISZERO(&np->in_out[1])) { 392 /* 393 * 0/0 - use the original source address/port. 394 */ 395 if (l > 0) 396 return -1; 397 in = fin->fin_src6; 398 399 } else if (!IP6_ISONES(&np->in_out[1]) && 400 (np->in_pnext == 0) && ((l > 0) || (hm == NULL))) { 401 IP6_INC(&np->in_next6); 402 } 403 404 natl = NULL; 405 406 if ((flags & IPN_TCPUDP) && 407 ((np->in_redir & NAT_MAPBLK) == 0) && 408 (np->in_flags & IPN_AUTOPORTMAP)) { 409 /*EMPTY*/; 410 #ifdef NEED_128BIT_MATH 411 /* 412 * XXX "ports auto" (without map-block) 413 */ 414 if ((l > 0) && (l % np->in_ppip == 0)) { 415 if (l > np->in_space) { 416 return -1; 417 } else if ((l > np->in_ppip) && 418 !IP6_ISONES(&np->in_out[1])) { 419 IP6_INC(&np->in_next6); 420 } 421 } 422 if (np->in_ppip != 0) { 423 port = ntohs(sport); 424 port += (l % np->in_ppip); 425 port %= np->in_ppip; 426 port += np->in_ppip * 427 (ntohl(fin->fin_src6) % 428 np->in_ippip); 429 port += MAPBLK_MINPORT; 430 port = htons(port); 431 } 432 #endif 433 434 } else if (((np->in_redir & NAT_MAPBLK) == 0) && 435 (flags & IPN_TCPUDPICMP) && (np->in_pnext != 0)) { 436 /* 437 * Standard port translation. Select next port. 438 */ 439 if (np->in_flags & IPN_SEQUENTIAL) { 440 port = np->in_pnext; 441 } else { 442 port = ipf_random() % (ntohs(np->in_pmax) - 443 ntohs(np->in_pmin)); 444 port += ntohs(np->in_pmin); 445 } 446 port = htons(port); 447 np->in_pnext++; 448 449 if (np->in_pnext > ntohs(np->in_pmax)) { 450 np->in_pnext = ntohs(np->in_pmin); 451 if (!IP6_ISONES(&np->in_out[1])) { 452 IP6_INC(&np->in_next6); 453 } 454 } 455 } 456 457 if (np->in_flags & IPN_IPRANGE) { 458 if (IP6_GT(&np->in_next6, &np->in_out[1])) 459 np->in_next6 = np->in_out[0]; 460 } else { 461 i6addr_t a1, a2; 462 463 a1 = np->in_next6; 464 IP6_INC(&a1); 465 IP6_AND(&a1, &np->in_out[1], &a2); 466 if (!IP6_ISONES(&np->in_out[1]) && 467 IP6_GT(&a2, &np->in_out[0])) { 468 IP6_ADD(&np->in_out[0], 1, &np->in_next6); 469 } 470 } 471 472 if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY))) 473 port = sport; 474 475 /* 476 * Here we do a lookup of the connection as seen from 477 * the outside. If an IP# pair already exists, try 478 * again. So if you have A->B becomes C->B, you can 479 * also have D->E become C->E but not D->B causing 480 * another C->B. Also take protocol and ports into 481 * account when determining whether a pre-existing 482 * NAT setup will cause an external conflict where 483 * this is appropriate. 484 */ 485 sp = fin->fin_data[0]; 486 dp = fin->fin_data[1]; 487 fin->fin_data[0] = fin->fin_data[1]; 488 fin->fin_data[1] = htons(port); 489 natl = nat6_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH), 490 (u_int)fin->fin_p, &fin->fin_dst6.in6, &in.in6); 491 fin->fin_data[0] = sp; 492 fin->fin_data[1] = dp; 493 494 /* 495 * Has the search wrapped around and come back to the 496 * start ? 497 */ 498 if ((natl != NULL) && 499 (np->in_pnext != 0) && (st_port == np->in_pnext) && 500 !IP6_ISZERO(&np->in_next6) && 501 IP6_EQ(&st_ip, &np->in_next6)) 502 return -1; 503 l++; 504 } while (natl != NULL); 505 506 if (np->in_space > 0) 507 np->in_space--; 508 509 /* Setup the NAT table */ 510 nat->nat_inip6 = fin->fin_src6; 511 nat->nat_outip6 = in; 512 nat->nat_oip6 = fin->fin_dst6; 513 if (nat->nat_hm == NULL) 514 nat->nat_hm = nat6_hostmap(np, &fin->fin_src6, &fin->fin_dst6, 515 &nat->nat_outip6, 0, ifs); 516 517 if (flags & IPN_TCPUDP) { 518 nat->nat_inport = sport; 519 nat->nat_outport = port; /* sport */ 520 nat->nat_oport = dport; 521 ((tcphdr_t *)fin->fin_dp)->th_sport = port; 522 } else if (flags & IPN_ICMPQUERY) { 523 ((struct icmp6_hdr *)fin->fin_dp)->icmp6_id = port; 524 nat->nat_inport = port; 525 nat->nat_outport = port; 526 } 527 528 ni->nai_port = port; 529 ni->nai_nport = dport; 530 return 0; 531 } 532 533 534 /* ------------------------------------------------------------------------ */ 535 /* Function: nat6_newrdr */ 536 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */ 537 /* allow rule to be moved if IPN_ROUNDR is set. */ 538 /* Parameters: fin(I) - pointer to packet information */ 539 /* nat(I) - pointer to NAT entry */ 540 /* ni(I) - pointer to structure with misc. information needed */ 541 /* to create new NAT entry. */ 542 /* */ 543 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/ 544 /* to the new IP address for the translation. */ 545 /* ------------------------------------------------------------------------ */ 546 static INLINE int nat6_newrdr(fin, nat, ni) 547 fr_info_t *fin; 548 nat_t *nat; 549 natinfo_t *ni; 550 { 551 u_short nport, dport, sport; 552 i6addr_t in; 553 u_short sp, dp; 554 hostmap_t *hm; 555 u_32_t flags; 556 ipnat_t *np; 557 nat_t *natl; 558 int move; 559 ipf_stack_t *ifs = fin->fin_ifs; 560 561 move = 1; 562 hm = NULL; 563 in.i6[0] = 0; 564 in.i6[1] = 0; 565 in.i6[2] = 0; 566 in.i6[3] = 0; 567 np = ni->nai_np; 568 flags = ni->nai_flags; 569 sport = ni->nai_sport; 570 dport = ni->nai_dport; 571 572 /* 573 * If the matching rule has IPN_STICKY set, then we want to have the 574 * same rule kick in as before. Why would this happen? If you have 575 * a collection of rdr rules with "round-robin sticky", the current 576 * packet might match a different one to the previous connection but 577 * we want the same destination to be used. 578 */ 579 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == 580 (IPN_ROUNDR|IPN_STICKY)) { 581 hm = nat6_hostmap(NULL, &fin->fin_src6, &fin->fin_dst6, &in, 582 (u_32_t)dport, ifs); 583 if (hm != NULL) { 584 in = hm->hm_map; 585 np = hm->hm_ipnat; 586 ni->nai_np = np; 587 move = 0; 588 } 589 } 590 591 /* 592 * Otherwise, it's an inbound packet. Most likely, we don't 593 * want to rewrite source ports and source addresses. Instead, 594 * we want to rewrite to a fixed internal address and fixed 595 * internal port. 596 */ 597 if (np->in_flags & IPN_SPLIT) { 598 in = np->in_next6; 599 600 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) { 601 hm = nat6_hostmap(np, &fin->fin_src6, &fin->fin_dst6, 602 &in, (u_32_t)dport, ifs); 603 if (hm != NULL) { 604 in = hm->hm_map; 605 move = 0; 606 } 607 } 608 609 if (hm == NULL || hm->hm_ref == 1) { 610 if (IP6_EQ(&np->in_in[0], &in)) { 611 np->in_next6 = np->in_in[1]; 612 move = 0; 613 } else { 614 np->in_next6 = np->in_in[0]; 615 } 616 } 617 618 } else if (IP6_ISZERO(&np->in_in[0]) && 619 IP6_ISONES(&np->in_in[1])) { 620 /* 621 * 0/128 - use the interface's IP address. 622 */ 623 if (fr_ifpaddr(6, FRI_NORMAL, fin->fin_ifp, (void *)&in, NULL, 624 fin->fin_ifs) == -1) 625 return -1; 626 627 } else if (IP6_ISZERO(&np->in_in[0]) && 628 IP6_ISZERO(&np->in_in[1])) { 629 /* 630 * 0/0 - use the original destination address/port. 631 */ 632 in = fin->fin_dst6; 633 634 } else if (np->in_redir == NAT_BIMAP && 635 IP6_EQ(&np->in_in[1], &np->in_out[1])) { 636 i6addr_t temp; 637 /* 638 * map the address block in a 1:1 fashion 639 */ 640 temp.i6[0] = fin->fin_dst6.i6[0] & ~np->in_in[1].i6[0]; 641 temp.i6[1] = fin->fin_dst6.i6[1] & ~np->in_in[1].i6[1]; 642 temp.i6[2] = fin->fin_dst6.i6[2] & ~np->in_in[1].i6[2]; 643 temp.i6[3] = fin->fin_dst6.i6[3] & ~np->in_in[1].i6[3]; 644 in = np->in_in[0]; 645 IP6_MERGE(&in, &temp, &np->in_in[1]); 646 } else { 647 in = np->in_in[0]; 648 } 649 650 if ((np->in_pnext == 0) || ((flags & NAT_NOTRULEPORT) != 0)) 651 nport = dport; 652 else { 653 /* 654 * Whilst not optimized for the case where 655 * pmin == pmax, the gain is not significant. 656 */ 657 if (((np->in_flags & IPN_FIXEDDPORT) == 0) && 658 (np->in_pmin != np->in_pmax)) { 659 nport = ntohs(dport) - ntohs(np->in_pmin) + 660 ntohs(np->in_pnext); 661 nport = htons(nport); 662 } else 663 nport = np->in_pnext; 664 } 665 666 /* 667 * When the redirect-to address is set to 0.0.0.0, just 668 * assume a blank `forwarding' of the packet. We don't 669 * setup any translation for this either. 670 */ 671 if (IP6_ISZERO(&in)) { 672 if (nport == dport) 673 return -1; 674 in = fin->fin_dst6; 675 } 676 677 /* 678 * Check to see if this redirect mapping already exists and if 679 * it does, return "failure" (allowing it to be created will just 680 * cause one or both of these "connections" to stop working.) 681 */ 682 sp = fin->fin_data[0]; 683 dp = fin->fin_data[1]; 684 fin->fin_data[1] = fin->fin_data[0]; 685 fin->fin_data[0] = ntohs(nport); 686 natl = nat6_outlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH), 687 (u_int)fin->fin_p, &in.in6, &fin->fin_src6.in6); 688 fin->fin_data[0] = sp; 689 fin->fin_data[1] = dp; 690 if (natl != NULL) 691 return -1; 692 693 nat->nat_inip6 = in; 694 nat->nat_outip6 = fin->fin_dst6; 695 nat->nat_oip6 = fin->fin_src6; 696 if ((nat->nat_hm == NULL) && ((np->in_flags & IPN_STICKY) != 0)) 697 nat->nat_hm = nat6_hostmap(np, &fin->fin_src6, 698 &fin->fin_dst6, &in, (u_32_t)dport, ifs); 699 700 ni->nai_nport = nport; 701 ni->nai_port = sport; 702 703 if (flags & IPN_TCPUDP) { 704 nat->nat_inport = nport; 705 nat->nat_outport = dport; 706 nat->nat_oport = sport; 707 ((tcphdr_t *)fin->fin_dp)->th_dport = nport; 708 } else if (flags & IPN_ICMPQUERY) { 709 ((struct icmp6_hdr *)fin->fin_dp)->icmp6_id = nport; 710 nat->nat_inport = nport; 711 nat->nat_outport = nport; 712 } 713 714 return move; 715 } 716 717 /* ------------------------------------------------------------------------ */ 718 /* Function: nat6_new */ 719 /* Returns: nat_t* - NULL == failure to create new NAT structure, */ 720 /* else pointer to new NAT structure */ 721 /* Parameters: fin(I) - pointer to packet information */ 722 /* np(I) - pointer to NAT rule */ 723 /* natsave(I) - pointer to where to store NAT struct pointer */ 724 /* flags(I) - flags describing the current packet */ 725 /* direction(I) - direction of packet (in/out) */ 726 /* Write Lock: ipf_nat */ 727 /* */ 728 /* Attempts to create a new NAT entry. Does not actually change the packet */ 729 /* in any way. */ 730 /* */ 731 /* This fucntion is in three main parts: (1) deal with creating a new NAT */ 732 /* structure for a "MAP" rule (outgoing NAT translation); (2) deal with */ 733 /* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */ 734 /* and (3) building that structure and putting it into the NAT table(s). */ 735 /* ------------------------------------------------------------------------ */ 736 nat_t *nat6_new(fin, np, natsave, flags, direction) 737 fr_info_t *fin; 738 ipnat_t *np; 739 nat_t **natsave; 740 u_int flags; 741 int direction; 742 { 743 tcphdr_t *tcp = NULL; 744 hostmap_t *hm = NULL; 745 nat_t *nat, *natl; 746 u_int nflags; 747 natinfo_t ni; 748 int move; 749 ipf_stack_t *ifs = fin->fin_ifs; 750 751 /* 752 * Trigger automatic call to ipf_extraflush() if the 753 * table has reached capcity specified by hi watermark. 754 */ 755 if (NAT_TAB_WATER_LEVEL(ifs) > ifs->ifs_nat_flush_level_hi) 756 ifs->ifs_nat_doflush = 1; 757 758 if (ifs->ifs_nat_stats.ns_inuse >= ifs->ifs_ipf_nattable_max) { 759 ifs->ifs_nat_stats.ns_memfail++; 760 return NULL; 761 } 762 763 move = 1; 764 nflags = np->in_flags & flags; 765 nflags &= NAT_FROMRULE; 766 767 ni.nai_np = np; 768 ni.nai_nflags = nflags; 769 ni.nai_flags = flags; 770 771 /* Give me a new nat */ 772 KMALLOC(nat, nat_t *); 773 if (nat == NULL) { 774 ifs->ifs_nat_stats.ns_memfail++; 775 /* 776 * Try to automatically tune the max # of entries in the 777 * table allowed to be less than what will cause kmem_alloc() 778 * to fail and try to eliminate panics due to out of memory 779 * conditions arising. 780 */ 781 if (ifs->ifs_ipf_nattable_max > ifs->ifs_ipf_nattable_sz) { 782 ifs->ifs_ipf_nattable_max = 783 ifs->ifs_nat_stats.ns_inuse - 100; 784 printf("ipf_nattable_max reduced to %d\n", 785 ifs->ifs_ipf_nattable_max); 786 } 787 return NULL; 788 } 789 790 if (flags & IPN_TCPUDP) { 791 tcp = fin->fin_dp; 792 ni.nai_sport = htons(fin->fin_sport); 793 ni.nai_dport = htons(fin->fin_dport); 794 } else if (flags & IPN_ICMPQUERY) { 795 /* 796 * In the ICMP query NAT code, we translate the ICMP id fields 797 * to make them unique. This is indepedent of the ICMP type 798 * (e.g. in the unlikely event that a host sends an echo and 799 * an tstamp request with the same id, both packets will have 800 * their ip address/id field changed in the same way). 801 * 802 * The icmp_id field is used by the sender to identify the 803 * process making the icmp request. (the receiver justs 804 * copies it back in its response). So, it closely matches 805 * the concept of source port. We overlay sport, so we can 806 * maximally reuse the existing code. 807 */ 808 ni.nai_sport = ((struct icmp6_hdr *)fin->fin_dp)->icmp6_id; 809 ni.nai_dport = ni.nai_sport; 810 } 811 812 bzero((char *)nat, sizeof (*nat)); 813 nat->nat_flags = flags; 814 nat->nat_redir = np->in_redir; 815 816 if ((flags & NAT_SLAVE) == 0) { 817 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 818 } 819 820 /* 821 * Search the current table for a match. 822 */ 823 if (direction == NAT_OUTBOUND) { 824 /* 825 * We can now arrange to call this for the same connection 826 * because ipf_nat_new doesn't protect the code path into 827 * this function. 828 */ 829 natl = nat6_outlookup(fin, nflags, (u_int)fin->fin_p, 830 &fin->fin_src6.in6, &fin->fin_dst6.in6); 831 if (natl != NULL) { 832 KFREE(nat); 833 nat = natl; 834 goto done; 835 } 836 837 move = nat6_newmap(fin, nat, &ni); 838 if (move == -1) 839 goto badnat; 840 841 np = ni.nai_np; 842 } else { 843 /* 844 * NAT_INBOUND is used only for redirects rules 845 */ 846 natl = nat6_inlookup(fin, nflags, (u_int)fin->fin_p, 847 &fin->fin_src6.in6, &fin->fin_dst6.in6); 848 if (natl != NULL) { 849 KFREE(nat); 850 nat = natl; 851 goto done; 852 } 853 854 move = nat6_newrdr(fin, nat, &ni); 855 if (move == -1) 856 goto badnat; 857 858 np = ni.nai_np; 859 } 860 861 if ((move == 1) && (np->in_flags & IPN_ROUNDR)) { 862 if (np->in_redir == NAT_REDIRECT) { 863 nat_delrdr(np); 864 nat6_addrdr(np, ifs); 865 } else if (np->in_redir == NAT_MAP) { 866 nat_delnat(np); 867 nat6_addnat(np, ifs); 868 } 869 } 870 871 if (nat6_finalise(fin, nat, &ni, tcp, natsave, direction) == -1) { 872 goto badnat; 873 } 874 875 nat_calc_chksum_diffs(nat); 876 877 if (flags & SI_WILDP) 878 ifs->ifs_nat_stats.ns_wilds++; 879 goto done; 880 badnat: 881 ifs->ifs_nat_stats.ns_badnat++; 882 if ((hm = nat->nat_hm) != NULL) 883 fr_hostmapdel(&hm); 884 KFREE(nat); 885 nat = NULL; 886 done: 887 if ((flags & NAT_SLAVE) == 0) { 888 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 889 } 890 return nat; 891 } 892 893 894 /* ------------------------------------------------------------------------ */ 895 /* Function: nat6_finalise */ 896 /* Returns: int - 0 == sucess, -1 == failure */ 897 /* Parameters: fin(I) - pointer to packet information */ 898 /* nat(I) - pointer to NAT entry */ 899 /* ni(I) - pointer to structure with misc. information needed */ 900 /* to create new NAT entry. */ 901 /* Write Lock: ipf_nat */ 902 /* */ 903 /* This is the tail end of constructing a new NAT entry and is the same */ 904 /* for both IPv4 and IPv6. */ 905 /* ------------------------------------------------------------------------ */ 906 /*ARGSUSED*/ 907 static INLINE int nat6_finalise(fin, nat, ni, tcp, natsave, direction) 908 fr_info_t *fin; 909 nat_t *nat; 910 natinfo_t *ni; 911 tcphdr_t *tcp; 912 nat_t **natsave; 913 int direction; 914 { 915 frentry_t *fr; 916 ipnat_t *np; 917 ipf_stack_t *ifs = fin->fin_ifs; 918 919 np = ni->nai_np; 920 921 COPYIFNAME(fin->fin_ifp, nat->nat_ifnames[0], fin->fin_v); 922 923 #ifdef IPFILTER_SYNC 924 if ((nat->nat_flags & SI_CLONE) == 0) 925 nat->nat_sync = ipfsync_new(SMC_NAT, fin, nat); 926 #endif 927 928 nat->nat_me = natsave; 929 nat->nat_dir = direction; 930 nat->nat_ifps[0] = np->in_ifps[0]; 931 nat->nat_ifps[1] = np->in_ifps[1]; 932 nat->nat_ptr = np; 933 nat->nat_p = fin->fin_p; 934 nat->nat_v = fin->fin_v; 935 nat->nat_mssclamp = np->in_mssclamp; 936 fr = fin->fin_fr; 937 nat->nat_fr = fr; 938 nat->nat_v = 6; 939 940 #ifdef IPF_V6_PROXIES 941 if ((np->in_apr != NULL) && ((ni->nai_flags & NAT_SLAVE) == 0)) 942 if (appr_new(fin, nat) == -1) 943 return -1; 944 #endif 945 946 if (nat6_insert(nat, fin->fin_rev, ifs) == 0) { 947 if (ifs->ifs_nat_logging) 948 nat_log(nat, (u_int)np->in_redir, ifs); 949 np->in_use++; 950 if (fr != NULL) { 951 MUTEX_ENTER(&fr->fr_lock); 952 fr->fr_ref++; 953 MUTEX_EXIT(&fr->fr_lock); 954 } 955 return 0; 956 } 957 958 /* 959 * nat6_insert failed, so cleanup time... 960 */ 961 return -1; 962 } 963 964 965 /* ------------------------------------------------------------------------ */ 966 /* Function: nat6_insert */ 967 /* Returns: int - 0 == sucess, -1 == failure */ 968 /* Parameters: nat(I) - pointer to NAT structure */ 969 /* rev(I) - flag indicating forward/reverse direction of packet */ 970 /* Write Lock: ipf_nat */ 971 /* */ 972 /* Insert a NAT entry into the hash tables for searching and add it to the */ 973 /* list of active NAT entries. Adjust global counters when complete. */ 974 /* ------------------------------------------------------------------------ */ 975 int nat6_insert(nat, rev, ifs) 976 nat_t *nat; 977 int rev; 978 ipf_stack_t *ifs; 979 { 980 u_int hv1, hv2; 981 nat_t **natp; 982 983 /* 984 * Try and return an error as early as possible, so calculate the hash 985 * entry numbers first and then proceed. 986 */ 987 if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) { 988 hv1 = NAT_HASH_FN6(&nat->nat_inip6, nat->nat_inport, 989 0xffffffff); 990 hv1 = NAT_HASH_FN6(&nat->nat_oip6, hv1 + nat->nat_oport, 991 ifs->ifs_ipf_nattable_sz); 992 hv2 = NAT_HASH_FN6(&nat->nat_outip6, nat->nat_outport, 993 0xffffffff); 994 hv2 = NAT_HASH_FN6(&nat->nat_oip6, hv2 + nat->nat_oport, 995 ifs->ifs_ipf_nattable_sz); 996 } else { 997 hv1 = NAT_HASH_FN6(&nat->nat_inip6, 0, 0xffffffff); 998 hv1 = NAT_HASH_FN6(&nat->nat_oip6, hv1, 999 ifs->ifs_ipf_nattable_sz); 1000 hv2 = NAT_HASH_FN6(&nat->nat_outip6, 0, 0xffffffff); 1001 hv2 = NAT_HASH_FN6(&nat->nat_oip6, hv2, 1002 ifs->ifs_ipf_nattable_sz); 1003 } 1004 1005 if ((ifs->ifs_nat_stats.ns_bucketlen[0][hv1] >= 1006 ifs->ifs_fr_nat_maxbucket) || 1007 (ifs->ifs_nat_stats.ns_bucketlen[1][hv2] >= 1008 ifs->ifs_fr_nat_maxbucket)) { 1009 return -1; 1010 } 1011 1012 nat->nat_hv[0] = hv1; 1013 nat->nat_hv[1] = hv2; 1014 1015 MUTEX_INIT(&nat->nat_lock, "nat entry lock"); 1016 1017 nat->nat_rev = rev; 1018 nat->nat_ref = 1; 1019 nat->nat_bytes[0] = 0; 1020 nat->nat_pkts[0] = 0; 1021 nat->nat_bytes[1] = 0; 1022 nat->nat_pkts[1] = 0; 1023 1024 nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0'; 1025 nat->nat_ifps[0] = fr_resolvenic(nat->nat_ifnames[0], 6, ifs); 1026 1027 if (nat->nat_ifnames[1][0] !='\0') { 1028 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0'; 1029 nat->nat_ifps[1] = fr_resolvenic(nat->nat_ifnames[1], 6, ifs); 1030 } else { 1031 (void) strncpy(nat->nat_ifnames[1], nat->nat_ifnames[0], 1032 LIFNAMSIZ); 1033 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0'; 1034 nat->nat_ifps[1] = nat->nat_ifps[0]; 1035 } 1036 1037 nat->nat_next = ifs->ifs_nat_instances; 1038 nat->nat_pnext = &ifs->ifs_nat_instances; 1039 if (ifs->ifs_nat_instances) 1040 ifs->ifs_nat_instances->nat_pnext = &nat->nat_next; 1041 ifs->ifs_nat_instances = nat; 1042 1043 natp = &ifs->ifs_nat_table[0][hv1]; 1044 if (*natp) 1045 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 1046 nat->nat_phnext[0] = natp; 1047 nat->nat_hnext[0] = *natp; 1048 *natp = nat; 1049 ifs->ifs_nat_stats.ns_bucketlen[0][hv1]++; 1050 1051 natp = &ifs->ifs_nat_table[1][hv2]; 1052 if (*natp) 1053 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 1054 nat->nat_phnext[1] = natp; 1055 nat->nat_hnext[1] = *natp; 1056 *natp = nat; 1057 ifs->ifs_nat_stats.ns_bucketlen[1][hv2]++; 1058 1059 fr_setnatqueue(nat, rev, ifs); 1060 1061 ifs->ifs_nat_stats.ns_added++; 1062 ifs->ifs_nat_stats.ns_inuse++; 1063 return 0; 1064 } 1065 1066 1067 /* ------------------------------------------------------------------------ */ 1068 /* Function: nat6_icmperrorlookup */ 1069 /* Returns: nat_t* - point to matching NAT structure */ 1070 /* Parameters: fin(I) - pointer to packet information */ 1071 /* dir(I) - direction of packet (in/out) */ 1072 /* */ 1073 /* Check if the ICMP error message is related to an existing TCP, UDP or */ 1074 /* ICMP query nat entry. It is assumed that the packet is already of the */ 1075 /* the required length. */ 1076 /* ------------------------------------------------------------------------ */ 1077 nat_t *nat6_icmperrorlookup(fin, dir) 1078 fr_info_t *fin; 1079 int dir; 1080 { 1081 int flags = 0, minlen; 1082 struct icmp6_hdr *orgicmp; 1083 tcphdr_t *tcp = NULL; 1084 u_short data[2]; 1085 nat_t *nat; 1086 ip6_t *oip6; 1087 u_int p; 1088 1089 minlen = 40; 1090 /* 1091 * Does it at least have the return (basic) IP header ? 1092 * Only a basic IP header (no options) should be with an ICMP error 1093 * header. Also, if it's not an error type, then return. 1094 */ 1095 if (!(fin->fin_flx & FI_ICMPERR)) 1096 return NULL; 1097 1098 /* 1099 * Check packet size 1100 */ 1101 if (fin->fin_plen < ICMP6ERR_IPICMPHLEN) 1102 return NULL; 1103 oip6 = (ip6_t *)((char *)fin->fin_dp + 8); 1104 1105 /* 1106 * Is the buffer big enough for all of it ? It's the size of the IP 1107 * header claimed in the encapsulated part which is of concern. It 1108 * may be too big to be in this buffer but not so big that it's 1109 * outside the ICMP packet, leading to TCP deref's causing problems. 1110 * This is possible because we don't know how big oip_hl is when we 1111 * do the pullup early in fr_check() and thus can't gaurantee it is 1112 * all here now. 1113 */ 1114 #ifdef _KERNEL 1115 { 1116 mb_t *m; 1117 1118 m = fin->fin_m; 1119 # if defined(MENTAT) 1120 if ((char *)oip6 + fin->fin_dlen - ICMPERR_ICMPHLEN > (char *)m->b_wptr) 1121 return NULL; 1122 # else 1123 if ((char *)oip6 + fin->fin_dlen - ICMPERR_ICMPHLEN > 1124 (char *)fin->fin_ip + M_LEN(m)) 1125 return NULL; 1126 # endif 1127 } 1128 #endif 1129 1130 if (IP6_NEQ(&fin->fin_dst6, &oip6->ip6_src)) 1131 return NULL; 1132 1133 p = oip6->ip6_nxt; 1134 if (p == IPPROTO_TCP) 1135 flags = IPN_TCP; 1136 else if (p == IPPROTO_UDP) 1137 flags = IPN_UDP; 1138 else if (p == IPPROTO_ICMPV6) { 1139 orgicmp = (struct icmp6_hdr *)(oip6 + 1); 1140 1141 /* see if this is related to an ICMP query */ 1142 if (nat_icmpquerytype6(orgicmp->icmp6_type)) { 1143 data[0] = fin->fin_data[0]; 1144 data[1] = fin->fin_data[1]; 1145 fin->fin_data[0] = 0; 1146 fin->fin_data[1] = orgicmp->icmp6_id; 1147 1148 flags = IPN_ICMPERR|IPN_ICMPQUERY; 1149 /* 1150 * NOTE : dir refers to the direction of the original 1151 * ip packet. By definition the icmp error 1152 * message flows in the opposite direction. 1153 */ 1154 if (dir == NAT_INBOUND) 1155 nat = nat6_inlookup(fin, flags, p, 1156 &oip6->ip6_dst, &oip6->ip6_src); 1157 else 1158 nat = nat6_outlookup(fin, flags, p, 1159 &oip6->ip6_dst, &oip6->ip6_src); 1160 fin->fin_data[0] = data[0]; 1161 fin->fin_data[1] = data[1]; 1162 return nat; 1163 } 1164 } 1165 1166 if (flags & IPN_TCPUDP) { 1167 minlen += 8; /* + 64bits of data to get ports */ 1168 if (fin->fin_plen < ICMPERR_ICMPHLEN + minlen) 1169 return NULL; 1170 1171 data[0] = fin->fin_data[0]; 1172 data[1] = fin->fin_data[1]; 1173 tcp = (tcphdr_t *)(oip6 + 1); 1174 fin->fin_data[0] = ntohs(tcp->th_dport); 1175 fin->fin_data[1] = ntohs(tcp->th_sport); 1176 1177 if (dir == NAT_INBOUND) { 1178 nat = nat6_inlookup(fin, flags, p, 1179 &oip6->ip6_dst, &oip6->ip6_src); 1180 } else { 1181 nat = nat6_outlookup(fin, flags, p, 1182 &oip6->ip6_dst, &oip6->ip6_src); 1183 } 1184 fin->fin_data[0] = data[0]; 1185 fin->fin_data[1] = data[1]; 1186 return nat; 1187 } 1188 if (dir == NAT_INBOUND) 1189 return nat6_inlookup(fin, 0, p, &oip6->ip6_dst, &oip6->ip6_src); 1190 else 1191 return nat6_outlookup(fin, 0, p, &oip6->ip6_dst, 1192 &oip6->ip6_src); 1193 } 1194 1195 1196 /* ------------------------------------------------------------------------ */ 1197 /* Function: nat6_icmperror */ 1198 /* Returns: nat_t* - point to matching NAT structure */ 1199 /* Parameters: fin(I) - pointer to packet information */ 1200 /* nflags(I) - NAT flags for this packet */ 1201 /* dir(I) - direction of packet (in/out) */ 1202 /* */ 1203 /* Fix up an ICMP packet which is an error message for an existing NAT */ 1204 /* session. This will correct both packet header data and checksums. */ 1205 /* */ 1206 /* This should *ONLY* be used for incoming ICMP error packets to make sure */ 1207 /* a NAT'd ICMP packet gets correctly recognised. */ 1208 /* ------------------------------------------------------------------------ */ 1209 nat_t *nat6_icmperror(fin, nflags, dir) 1210 fr_info_t *fin; 1211 u_int *nflags; 1212 int dir; 1213 { 1214 u_32_t sum1, sum2, sumd, psum1, psum2, psumd, sumd1; 1215 i6addr_t in; 1216 struct icmp6_hdr *icmp6, *orgicmp; 1217 int dlen; 1218 udphdr_t *udp; 1219 tcphdr_t *tcp; 1220 nat_t *nat; 1221 ip6_t *oip6; 1222 if ((fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) 1223 return NULL; 1224 1225 /* 1226 * nat6_icmperrorlookup() looks up nat entry associated with the 1227 * offending IP packet and returns pointer to the entry, or NULL 1228 * if packet wasn't natted or for `defective' packets. 1229 */ 1230 1231 if ((fin->fin_v != 6) || !(nat = nat6_icmperrorlookup(fin, dir))) 1232 return NULL; 1233 1234 sumd1 = 0; 1235 *nflags = IPN_ICMPERR; 1236 icmp6 = fin->fin_dp; 1237 oip6 = (ip6_t *)((char *)icmp6 + sizeof (*icmp6)); 1238 udp = (udphdr_t *)(((char *)oip6) + sizeof (*oip6)); 1239 tcp = (tcphdr_t *)udp; 1240 dlen = fin->fin_plen - ((char *)udp - (char *)fin->fin_ip); 1241 1242 /* 1243 * Need to adjust ICMP header to include the real IP#'s and 1244 * port #'s. There are three steps required. 1245 * 1246 * Step 1 1247 * No update needed for ip6 header checksum. 1248 * 1249 * Unlike IPv4, we need to update icmp_cksum for IPv6 address 1250 * changes because there's no ip_sum change to cancel it. 1251 */ 1252 1253 if (IP6_EQ((i6addr_t *)&oip6->ip6_dst, &nat->nat_oip6)) { 1254 sum1 = LONG_SUM6((i6addr_t *)&oip6->ip6_src); 1255 in = nat->nat_inip6; 1256 oip6->ip6_src = in.in6; 1257 } else { 1258 sum1 = LONG_SUM6((i6addr_t *)&oip6->ip6_dst); 1259 in = nat->nat_outip6; 1260 oip6->ip6_dst = in.in6; 1261 } 1262 1263 sum2 = LONG_SUM6(&in); 1264 CALC_SUMD(sum1, sum2, sumd); 1265 1266 /* 1267 * Step 2 1268 * Perform other adjustments based on protocol of offending packet. 1269 */ 1270 1271 switch (oip6->ip6_nxt) { 1272 case IPPROTO_TCP : 1273 case IPPROTO_UDP : 1274 1275 /* 1276 * For offending TCP/UDP IP packets, translate the ports 1277 * based on the NAT specification. 1278 * 1279 * Advance notice : Now it becomes complicated :-) 1280 * 1281 * Since the port and IP addresse fields are both part 1282 * of the TCP/UDP checksum of the offending IP packet, 1283 * we need to adjust that checksum as well. 1284 * 1285 * To further complicate things, the TCP/UDP checksum 1286 * may not be present. We must check to see if the 1287 * length of the data portion is big enough to hold 1288 * the checksum. In the UDP case, a test to determine 1289 * if the checksum is even set is also required. 1290 * 1291 * Any changes to an IP address, port or checksum within 1292 * the ICMP packet requires a change to icmp_cksum. 1293 * 1294 * Be extremely careful here ... The change is dependent 1295 * upon whether or not the TCP/UPD checksum is present. 1296 * 1297 * If TCP/UPD checksum is present, the icmp_cksum must 1298 * compensate for checksum modification resulting from 1299 * IP address change only. Port change and resulting 1300 * data checksum adjustments cancel each other out. 1301 * 1302 * If TCP/UDP checksum is not present, icmp_cksum must 1303 * compensate for port change only. The IP address 1304 * change does not modify anything else in this case. 1305 */ 1306 1307 psum1 = 0; 1308 psum2 = 0; 1309 psumd = 0; 1310 1311 if ((tcp->th_dport == nat->nat_oport) && 1312 (tcp->th_sport != nat->nat_inport)) { 1313 1314 /* 1315 * Translate the source port. 1316 */ 1317 1318 psum1 = ntohs(tcp->th_sport); 1319 psum2 = ntohs(nat->nat_inport); 1320 tcp->th_sport = nat->nat_inport; 1321 1322 } else if ((tcp->th_sport == nat->nat_oport) && 1323 (tcp->th_dport != nat->nat_outport)) { 1324 1325 /* 1326 * Translate the destination port. 1327 */ 1328 1329 psum1 = ntohs(tcp->th_dport); 1330 psum2 = ntohs(nat->nat_outport); 1331 tcp->th_dport = nat->nat_outport; 1332 } 1333 1334 if ((oip6->ip6_nxt == IPPROTO_TCP) && (dlen >= 18)) { 1335 1336 /* 1337 * TCP checksum present. 1338 * 1339 * Adjust data checksum and icmp checksum to 1340 * compensate for any IP address change. 1341 */ 1342 1343 sum1 = ntohs(tcp->th_sum); 1344 fix_datacksum(&tcp->th_sum, sumd); 1345 sum2 = ntohs(tcp->th_sum); 1346 CALC_SUMD(sum1, sum2, sumd); 1347 sumd1 += sumd; 1348 1349 /* 1350 * Also make data checksum adjustment to 1351 * compensate for any port change. 1352 */ 1353 1354 if (psum1 != psum2) { 1355 CALC_SUMD(psum1, psum2, psumd); 1356 fix_datacksum(&tcp->th_sum, psumd); 1357 } 1358 1359 } else if ((oip6->ip6_nxt == IPPROTO_UDP) && 1360 (dlen >= 8) && (udp->uh_sum != 0)) { 1361 1362 /* 1363 * The UDP checksum is present and set. 1364 * 1365 * Adjust data checksum and icmp checksum to 1366 * compensate for any IP address change. 1367 */ 1368 1369 sum1 = ntohs(udp->uh_sum); 1370 fix_datacksum(&udp->uh_sum, sumd); 1371 sum2 = ntohs(udp->uh_sum); 1372 CALC_SUMD(sum1, sum2, sumd); 1373 sumd1 += sumd; 1374 1375 /* 1376 * Also make data checksum adjustment to 1377 * compensate for any port change. 1378 */ 1379 1380 if (psum1 != psum2) { 1381 CALC_SUMD(psum1, psum2, psumd); 1382 fix_datacksum(&udp->uh_sum, psumd); 1383 } 1384 1385 } else { 1386 1387 /* 1388 * Data checksum was not present. 1389 * 1390 * Compensate for any port change. 1391 */ 1392 1393 CALC_SUMD(psum2, psum1, psumd); 1394 sumd1 += psumd; 1395 } 1396 break; 1397 1398 case IPPROTO_ICMPV6 : 1399 1400 orgicmp = (struct icmp6_hdr *)udp; 1401 1402 if ((nat->nat_dir == NAT_OUTBOUND) && 1403 (orgicmp->icmp6_id != nat->nat_inport) && 1404 (dlen >= 8)) { 1405 1406 /* 1407 * Fix ICMP checksum (of the offening ICMP 1408 * query packet) to compensate the change 1409 * in the ICMP id of the offending ICMP 1410 * packet. 1411 * 1412 * Since you modify orgicmp->icmp_id with 1413 * a delta (say x) and you compensate that 1414 * in origicmp->icmp_cksum with a delta 1415 * minus x, you don't have to adjust the 1416 * overall icmp->icmp_cksum 1417 */ 1418 1419 sum1 = ntohs(orgicmp->icmp6_id); 1420 sum2 = ntohs(nat->nat_inport); 1421 CALC_SUMD(sum1, sum2, sumd); 1422 orgicmp->icmp6_id = nat->nat_inport; 1423 fix_datacksum(&orgicmp->icmp6_cksum, sumd); 1424 1425 } /* nat_dir can't be NAT_INBOUND for icmp queries */ 1426 1427 break; 1428 1429 default : 1430 1431 break; 1432 1433 } /* switch (oip6->ip6_nxt) */ 1434 1435 /* 1436 * Step 3 1437 * Make the adjustments to icmp checksum. 1438 */ 1439 1440 if (sumd1 != 0) { 1441 sumd1 = (sumd1 & 0xffff) + (sumd1 >> 16); 1442 sumd1 = (sumd1 & 0xffff) + (sumd1 >> 16); 1443 fix_incksum(&icmp6->icmp6_cksum, sumd1); 1444 } 1445 return nat; 1446 } 1447 1448 1449 /* 1450 * NB: these lookups don't lock access to the list, it assumed that it has 1451 * already been done! 1452 */ 1453 1454 /* ------------------------------------------------------------------------ */ 1455 /* Function: nat6_inlookup */ 1456 /* Returns: nat_t* - NULL == no match, */ 1457 /* else pointer to matching NAT entry */ 1458 /* Parameters: fin(I) - pointer to packet information */ 1459 /* flags(I) - NAT flags for this packet */ 1460 /* p(I) - protocol for this packet */ 1461 /* src(I) - source IP address */ 1462 /* mapdst(I) - destination IP address */ 1463 /* */ 1464 /* Lookup a nat entry based on the mapped destination ip address/port and */ 1465 /* real source address/port. We use this lookup when receiving a packet, */ 1466 /* we're looking for a table entry, based on the destination address. */ 1467 /* */ 1468 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */ 1469 /* */ 1470 /* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN */ 1471 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */ 1472 /* */ 1473 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */ 1474 /* the packet is of said protocol */ 1475 /* ------------------------------------------------------------------------ */ 1476 nat_t *nat6_inlookup(fin, flags, p, src, mapdst) 1477 fr_info_t *fin; 1478 u_int flags, p; 1479 struct in6_addr *src, *mapdst; 1480 { 1481 u_short sport, dport; 1482 u_int sflags; 1483 nat_t *nat; 1484 int nflags; 1485 i6addr_t dst; 1486 void *ifp; 1487 u_int hv; 1488 ipf_stack_t *ifs = fin->fin_ifs; 1489 1490 if (fin != NULL) 1491 ifp = fin->fin_ifp; 1492 else 1493 ifp = NULL; 1494 sport = 0; 1495 dport = 0; 1496 dst.in6 = *mapdst; 1497 sflags = flags & NAT_TCPUDPICMP; 1498 1499 switch (p) 1500 { 1501 case IPPROTO_TCP : 1502 case IPPROTO_UDP : 1503 sport = htons(fin->fin_data[0]); 1504 dport = htons(fin->fin_data[1]); 1505 break; 1506 case IPPROTO_ICMPV6 : 1507 if (flags & IPN_ICMPERR) 1508 sport = fin->fin_data[1]; 1509 else 1510 dport = fin->fin_data[1]; 1511 break; 1512 default : 1513 break; 1514 } 1515 1516 1517 if ((flags & SI_WILDP) != 0) 1518 goto find_in_wild_ports; 1519 1520 hv = NAT_HASH_FN6(&dst, dport, 0xffffffff); 1521 hv = NAT_HASH_FN6(src, hv + sport, ifs->ifs_ipf_nattable_sz); 1522 nat = ifs->ifs_nat_table[1][hv]; 1523 for (; nat; nat = nat->nat_hnext[1]) { 1524 if (nat->nat_v != 6) 1525 continue; 1526 1527 if (nat->nat_ifps[0] != NULL) { 1528 if ((ifp != NULL) && (ifp != nat->nat_ifps[0])) 1529 continue; 1530 } else if (ifp != NULL) 1531 nat->nat_ifps[0] = ifp; 1532 1533 nflags = nat->nat_flags; 1534 1535 if (IP6_EQ(&nat->nat_oip6, src) && 1536 IP6_EQ(&nat->nat_outip6, &dst) && 1537 (((p == 0) && 1538 (sflags == (nat->nat_flags & IPN_TCPUDPICMP))) || 1539 (p == nat->nat_p))) { 1540 switch (p) 1541 { 1542 #if 0 1543 case IPPROTO_GRE : 1544 if (nat->nat_call[1] != fin->fin_data[0]) 1545 continue; 1546 break; 1547 #endif 1548 case IPPROTO_ICMPV6 : 1549 if ((flags & IPN_ICMPERR) != 0) { 1550 if (nat->nat_outport != sport) 1551 continue; 1552 } else { 1553 if (nat->nat_outport != dport) 1554 continue; 1555 } 1556 break; 1557 case IPPROTO_TCP : 1558 case IPPROTO_UDP : 1559 if (nat->nat_oport != sport) 1560 continue; 1561 if (nat->nat_outport != dport) 1562 continue; 1563 break; 1564 default : 1565 break; 1566 } 1567 1568 #ifdef IPF_V6_PROXIES 1569 ipn = nat->nat_ptr; 1570 if ((ipn != NULL) && (nat->nat_aps != NULL)) 1571 if (appr_match(fin, nat) != 0) 1572 continue; 1573 #endif 1574 return nat; 1575 } 1576 } 1577 1578 /* 1579 * So if we didn't find it but there are wildcard members in the hash 1580 * table, go back and look for them. We do this search and update here 1581 * because it is modifying the NAT table and we want to do this only 1582 * for the first packet that matches. The exception, of course, is 1583 * for "dummy" (FI_IGNORE) lookups. 1584 */ 1585 find_in_wild_ports: 1586 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) 1587 return NULL; 1588 if (ifs->ifs_nat_stats.ns_wilds == 0) 1589 return NULL; 1590 1591 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1592 1593 hv = NAT_HASH_FN6(&dst, 0, 0xffffffff); 1594 hv = NAT_HASH_FN6(src, hv, ifs->ifs_ipf_nattable_sz); 1595 1596 WRITE_ENTER(&ifs->ifs_ipf_nat); 1597 1598 nat = ifs->ifs_nat_table[1][hv]; 1599 for (; nat; nat = nat->nat_hnext[1]) { 1600 if (nat->nat_v != 6) 1601 continue; 1602 1603 if (nat->nat_ifps[0] != NULL) { 1604 if ((ifp != NULL) && (ifp != nat->nat_ifps[0])) 1605 continue; 1606 } else if (ifp != NULL) 1607 nat->nat_ifps[0] = ifp; 1608 1609 if (nat->nat_p != fin->fin_p) 1610 continue; 1611 if (IP6_NEQ(&nat->nat_oip6, src) || 1612 IP6_NEQ(&nat->nat_outip6, &dst)) 1613 continue; 1614 1615 nflags = nat->nat_flags; 1616 if (!(nflags & (NAT_TCPUDP|SI_WILDP))) 1617 continue; 1618 1619 if (nat_wildok(nat, (int)sport, (int)dport, nflags, 1620 NAT_INBOUND) == 1) { 1621 if ((fin->fin_flx & FI_IGNORE) != 0) 1622 break; 1623 if ((nflags & SI_CLONE) != 0) { 1624 nat = fr_natclone(fin, nat); 1625 if (nat == NULL) 1626 break; 1627 } else { 1628 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 1629 ifs->ifs_nat_stats.ns_wilds--; 1630 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 1631 } 1632 nat->nat_oport = sport; 1633 nat->nat_outport = dport; 1634 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT); 1635 nat6_tabmove(nat, ifs); 1636 break; 1637 } 1638 } 1639 1640 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 1641 1642 return nat; 1643 } 1644 1645 1646 /* ------------------------------------------------------------------------ */ 1647 /* Function: nat6_tabmove */ 1648 /* Returns: Nil */ 1649 /* Parameters: nat(I) - pointer to NAT structure */ 1650 /* Write Lock: ipf_nat */ 1651 /* */ 1652 /* This function is only called for TCP/UDP NAT table entries where the */ 1653 /* original was placed in the table without hashing on the ports and we now */ 1654 /* want to include hashing on port numbers. */ 1655 /* ------------------------------------------------------------------------ */ 1656 static void nat6_tabmove(nat, ifs) 1657 nat_t *nat; 1658 ipf_stack_t *ifs; 1659 { 1660 nat_t **natp; 1661 u_int hv; 1662 1663 if (nat->nat_flags & SI_CLONE) 1664 return; 1665 1666 /* 1667 * Remove the NAT entry from the old location 1668 */ 1669 if (nat->nat_hnext[0]) 1670 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; 1671 *nat->nat_phnext[0] = nat->nat_hnext[0]; 1672 ifs->ifs_nat_stats.ns_bucketlen[0][nat->nat_hv[0]]--; 1673 1674 if (nat->nat_hnext[1]) 1675 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; 1676 *nat->nat_phnext[1] = nat->nat_hnext[1]; 1677 ifs->ifs_nat_stats.ns_bucketlen[1][nat->nat_hv[1]]--; 1678 1679 /* 1680 * Add into the NAT table in the new position 1681 */ 1682 hv = NAT_HASH_FN6(&nat->nat_inip6, nat->nat_inport, 0xffffffff); 1683 hv = NAT_HASH_FN6(&nat->nat_oip6, hv + nat->nat_oport, 1684 ifs->ifs_ipf_nattable_sz); 1685 nat->nat_hv[0] = hv; 1686 natp = &ifs->ifs_nat_table[0][hv]; 1687 if (*natp) 1688 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 1689 nat->nat_phnext[0] = natp; 1690 nat->nat_hnext[0] = *natp; 1691 *natp = nat; 1692 ifs->ifs_nat_stats.ns_bucketlen[0][hv]++; 1693 1694 hv = NAT_HASH_FN6(&nat->nat_outip6, nat->nat_outport, 0xffffffff); 1695 hv = NAT_HASH_FN6(&nat->nat_oip6, hv + nat->nat_oport, 1696 ifs->ifs_ipf_nattable_sz); 1697 nat->nat_hv[1] = hv; 1698 natp = &ifs->ifs_nat_table[1][hv]; 1699 if (*natp) 1700 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 1701 nat->nat_phnext[1] = natp; 1702 nat->nat_hnext[1] = *natp; 1703 *natp = nat; 1704 ifs->ifs_nat_stats.ns_bucketlen[1][hv]++; 1705 } 1706 1707 1708 /* ------------------------------------------------------------------------ */ 1709 /* Function: nat6_outlookup */ 1710 /* Returns: nat_t* - NULL == no match, */ 1711 /* else pointer to matching NAT entry */ 1712 /* Parameters: fin(I) - pointer to packet information */ 1713 /* flags(I) - NAT flags for this packet */ 1714 /* p(I) - protocol for this packet */ 1715 /* src(I) - source IP address */ 1716 /* dst(I) - destination IP address */ 1717 /* rw(I) - 1 == write lock on ipf_nat held, 0 == read lock. */ 1718 /* */ 1719 /* Lookup a nat entry based on the source 'real' ip address/port and */ 1720 /* destination address/port. We use this lookup when sending a packet out, */ 1721 /* we're looking for a table entry, based on the source address. */ 1722 /* */ 1723 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */ 1724 /* */ 1725 /* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN */ 1726 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */ 1727 /* */ 1728 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */ 1729 /* the packet is of said protocol */ 1730 /* ------------------------------------------------------------------------ */ 1731 nat_t *nat6_outlookup(fin, flags, p, src, dst) 1732 fr_info_t *fin; 1733 u_int flags, p; 1734 struct in6_addr *src , *dst; 1735 { 1736 u_short sport, dport; 1737 u_int sflags; 1738 nat_t *nat; 1739 int nflags; 1740 void *ifp; 1741 u_int hv; 1742 ipf_stack_t *ifs = fin->fin_ifs; 1743 1744 ifp = fin->fin_ifp; 1745 1746 sflags = flags & IPN_TCPUDPICMP; 1747 sport = 0; 1748 dport = 0; 1749 1750 switch (p) 1751 { 1752 case IPPROTO_TCP : 1753 case IPPROTO_UDP : 1754 sport = htons(fin->fin_data[0]); 1755 dport = htons(fin->fin_data[1]); 1756 break; 1757 case IPPROTO_ICMPV6 : 1758 if (flags & IPN_ICMPERR) 1759 sport = fin->fin_data[1]; 1760 else 1761 dport = fin->fin_data[1]; 1762 break; 1763 default : 1764 break; 1765 } 1766 1767 if ((flags & SI_WILDP) != 0) 1768 goto find_out_wild_ports; 1769 1770 hv = NAT_HASH_FN6(src, sport, 0xffffffff); 1771 hv = NAT_HASH_FN6(dst, hv + dport, ifs->ifs_ipf_nattable_sz); 1772 nat = ifs->ifs_nat_table[0][hv]; 1773 for (; nat; nat = nat->nat_hnext[0]) { 1774 if (nat->nat_v != 6) 1775 continue; 1776 1777 if (nat->nat_ifps[1] != NULL) { 1778 if ((ifp != NULL) && (ifp != nat->nat_ifps[1])) 1779 continue; 1780 } else if (ifp != NULL) 1781 nat->nat_ifps[1] = ifp; 1782 1783 nflags = nat->nat_flags; 1784 1785 if (IP6_EQ(&nat->nat_inip6, src) && 1786 IP6_EQ(&nat->nat_oip6, dst) && 1787 (((p == 0) && (sflags == (nflags & NAT_TCPUDPICMP))) || 1788 (p == nat->nat_p))) { 1789 switch (p) 1790 { 1791 #if 0 1792 case IPPROTO_GRE : 1793 if (nat->nat_call[1] != fin->fin_data[0]) 1794 continue; 1795 break; 1796 #endif 1797 case IPPROTO_TCP : 1798 case IPPROTO_UDP : 1799 if (nat->nat_oport != dport) 1800 continue; 1801 if (nat->nat_inport != sport) 1802 continue; 1803 break; 1804 default : 1805 break; 1806 } 1807 1808 #ifdef IPF_V6_PROXIES 1809 ipn = nat->nat_ptr; 1810 if ((ipn != NULL) && (nat->nat_aps != NULL)) 1811 if (appr_match(fin, nat) != 0) 1812 continue; 1813 #endif 1814 return nat; 1815 } 1816 } 1817 1818 /* 1819 * So if we didn't find it but there are wildcard members in the hash 1820 * table, go back and look for them. We do this search and update here 1821 * because it is modifying the NAT table and we want to do this only 1822 * for the first packet that matches. The exception, of course, is 1823 * for "dummy" (FI_IGNORE) lookups. 1824 */ 1825 find_out_wild_ports: 1826 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) 1827 return NULL; 1828 if (ifs->ifs_nat_stats.ns_wilds == 0) 1829 return NULL; 1830 1831 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1832 1833 hv = NAT_HASH_FN6(src, 0, 0xffffffff); 1834 hv = NAT_HASH_FN6(dst, hv, ifs->ifs_ipf_nattable_sz); 1835 1836 WRITE_ENTER(&ifs->ifs_ipf_nat); 1837 1838 nat = ifs->ifs_nat_table[0][hv]; 1839 for (; nat; nat = nat->nat_hnext[0]) { 1840 if (nat->nat_v != 6) 1841 continue; 1842 1843 if (nat->nat_ifps[1] != NULL) { 1844 if ((ifp != NULL) && (ifp != nat->nat_ifps[1])) 1845 continue; 1846 } else if (ifp != NULL) 1847 nat->nat_ifps[1] = ifp; 1848 1849 if (nat->nat_p != fin->fin_p) 1850 continue; 1851 if (IP6_NEQ(&nat->nat_inip6, src) || 1852 IP6_NEQ(&nat->nat_oip6, dst)) 1853 continue; 1854 1855 nflags = nat->nat_flags; 1856 if (!(nflags & (NAT_TCPUDP|SI_WILDP))) 1857 continue; 1858 1859 if (nat_wildok(nat, (int)sport, (int)dport, nflags, 1860 NAT_OUTBOUND) == 1) { 1861 if ((fin->fin_flx & FI_IGNORE) != 0) 1862 break; 1863 if ((nflags & SI_CLONE) != 0) { 1864 nat = fr_natclone(fin, nat); 1865 if (nat == NULL) 1866 break; 1867 } else { 1868 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 1869 ifs->ifs_nat_stats.ns_wilds--; 1870 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 1871 } 1872 nat->nat_inport = sport; 1873 nat->nat_oport = dport; 1874 if (nat->nat_outport == 0) 1875 nat->nat_outport = sport; 1876 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT); 1877 nat6_tabmove(nat, ifs); 1878 break; 1879 } 1880 } 1881 1882 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 1883 1884 return nat; 1885 } 1886 1887 1888 /* ------------------------------------------------------------------------ */ 1889 /* Function: nat6_lookupredir */ 1890 /* Returns: nat_t* - NULL == no match, */ 1891 /* else pointer to matching NAT entry */ 1892 /* Parameters: np(I) - pointer to description of packet to find NAT table */ 1893 /* entry for. */ 1894 /* */ 1895 /* Lookup the NAT tables to search for a matching redirect */ 1896 /* ------------------------------------------------------------------------ */ 1897 nat_t *nat6_lookupredir(np, ifs) 1898 natlookup_t *np; 1899 ipf_stack_t *ifs; 1900 { 1901 fr_info_t fi; 1902 nat_t *nat; 1903 1904 bzero((char *)&fi, sizeof (fi)); 1905 if (np->nl_flags & IPN_IN) { 1906 fi.fin_data[0] = ntohs(np->nl_realport); 1907 fi.fin_data[1] = ntohs(np->nl_outport); 1908 } else { 1909 fi.fin_data[0] = ntohs(np->nl_inport); 1910 fi.fin_data[1] = ntohs(np->nl_outport); 1911 } 1912 if (np->nl_flags & IPN_TCP) 1913 fi.fin_p = IPPROTO_TCP; 1914 else if (np->nl_flags & IPN_UDP) 1915 fi.fin_p = IPPROTO_UDP; 1916 else if (np->nl_flags & (IPN_ICMPERR|IPN_ICMPQUERY)) 1917 fi.fin_p = IPPROTO_ICMPV6; 1918 1919 fi.fin_ifs = ifs; 1920 /* 1921 * We can do two sorts of lookups: 1922 * - IPN_IN: we have the `real' and `out' address, look for `in'. 1923 * - default: we have the `in' and `out' address, look for `real'. 1924 */ 1925 if (np->nl_flags & IPN_IN) { 1926 if ((nat = nat6_inlookup(&fi, np->nl_flags, fi.fin_p, 1927 &np->nl_realip6, &np->nl_outip6))) { 1928 np->nl_inipaddr = nat->nat_inip6; 1929 np->nl_inport = nat->nat_inport; 1930 } 1931 } else { 1932 /* 1933 * If nl_inip is non null, this is a lookup based on the real 1934 * ip address. Else, we use the fake. 1935 */ 1936 if ((nat = nat6_outlookup(&fi, np->nl_flags, fi.fin_p, 1937 &np->nl_inip6, &np->nl_outip6))) { 1938 if ((np->nl_flags & IPN_FINDFORWARD) != 0) { 1939 fr_info_t fin; 1940 bzero((char *)&fin, sizeof (fin)); 1941 fin.fin_p = nat->nat_p; 1942 fin.fin_data[0] = ntohs(nat->nat_outport); 1943 fin.fin_data[1] = ntohs(nat->nat_oport); 1944 fin.fin_ifs = ifs; 1945 if (nat6_inlookup(&fin, np->nl_flags, fin.fin_p, 1946 &nat->nat_outip6.in6, 1947 &nat->nat_oip6.in6) != NULL) { 1948 np->nl_flags &= ~IPN_FINDFORWARD; 1949 } 1950 } 1951 1952 np->nl_realip6 = nat->nat_outip6.in6; 1953 np->nl_realport = nat->nat_outport; 1954 } 1955 } 1956 1957 return nat; 1958 } 1959 1960 1961 /* ------------------------------------------------------------------------ */ 1962 /* Function: nat6_match */ 1963 /* Returns: int - 0 == no match, 1 == match */ 1964 /* Parameters: fin(I) - pointer to packet information */ 1965 /* np(I) - pointer to NAT rule */ 1966 /* */ 1967 /* Pull the matching of a packet against a NAT rule out of that complex */ 1968 /* loop inside fr_checknat6in() and lay it out properly in its own function.*/ 1969 /* ------------------------------------------------------------------------ */ 1970 static int nat6_match(fin, np) 1971 fr_info_t *fin; 1972 ipnat_t *np; 1973 { 1974 frtuc_t *ft; 1975 1976 if (fin->fin_v != 6) 1977 return 0; 1978 1979 if (np->in_p && fin->fin_p != np->in_p) 1980 return 0; 1981 1982 if (fin->fin_out) { 1983 if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK))) 1984 return 0; 1985 if (IP6_MASKNEQ(&fin->fin_src6, &np->in_in[1], &np->in_in[0]) 1986 ^ ((np->in_flags & IPN_NOTSRC) != 0)) 1987 return 0; 1988 if (IP6_MASKNEQ(&fin->fin_dst6, &np->in_src[1], &np->in_src[0]) 1989 ^ ((np->in_flags & IPN_NOTDST) != 0)) 1990 return 0; 1991 } else { 1992 if (!(np->in_redir & NAT_REDIRECT)) 1993 return 0; 1994 if (IP6_MASKNEQ(&fin->fin_src6, &np->in_src[1], &np->in_src[0]) 1995 ^ ((np->in_flags & IPN_NOTSRC) != 0)) 1996 return 0; 1997 if (IP6_MASKNEQ(&fin->fin_dst6, &np->in_out[1], &np->in_out[0]) 1998 ^ ((np->in_flags & IPN_NOTDST) != 0)) 1999 return 0; 2000 } 2001 2002 ft = &np->in_tuc; 2003 if (!(fin->fin_flx & FI_TCPUDP) || 2004 (fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) { 2005 if (ft->ftu_scmp || ft->ftu_dcmp) 2006 return 0; 2007 return 1; 2008 } 2009 2010 return fr_tcpudpchk(fin, ft); 2011 } 2012 2013 2014 /* ------------------------------------------------------------------------ */ 2015 /* Function: fr_checknat6out */ 2016 /* Returns: int - -1 == packet failed NAT checks so block it, */ 2017 /* 0 == no packet translation occurred, */ 2018 /* 1 == packet was successfully translated. */ 2019 /* Parameters: fin(I) - pointer to packet information */ 2020 /* passp(I) - pointer to filtering result flags */ 2021 /* */ 2022 /* Check to see if an outcoming packet should be changed. ICMP packets are */ 2023 /* first checked to see if they match an existing entry (if an error), */ 2024 /* otherwise a search of the current NAT table is made. If neither results */ 2025 /* in a match then a search for a matching NAT rule is made. Create a new */ 2026 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */ 2027 /* packet header(s) as required. */ 2028 /* ------------------------------------------------------------------------ */ 2029 int fr_checknat6out(fin, passp) 2030 fr_info_t *fin; 2031 u_32_t *passp; 2032 { 2033 struct ifnet *ifp, *sifp; 2034 int rval, natfailed; 2035 ipnat_t *np = NULL; 2036 u_int nflags = 0; 2037 i6addr_t ipa, iph; 2038 int natadd = 1; 2039 frentry_t *fr; 2040 nat_t *nat; 2041 ipf_stack_t *ifs = fin->fin_ifs; 2042 2043 if (ifs->ifs_nat_stats.ns_rules == 0 || ifs->ifs_fr_nat_lock != 0) 2044 return 0; 2045 2046 natfailed = 0; 2047 fr = fin->fin_fr; 2048 sifp = fin->fin_ifp; 2049 if ((fr != NULL) && !(fr->fr_flags & FR_DUP) && 2050 fr->fr_tifs[fin->fin_rev].fd_ifp && 2051 fr->fr_tifs[fin->fin_rev].fd_ifp != (void *)-1) 2052 fin->fin_ifp = fr->fr_tifs[fin->fin_rev].fd_ifp; 2053 ifp = fin->fin_ifp; 2054 2055 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 2056 switch (fin->fin_p) 2057 { 2058 case IPPROTO_TCP : 2059 nflags = IPN_TCP; 2060 break; 2061 case IPPROTO_UDP : 2062 nflags = IPN_UDP; 2063 break; 2064 case IPPROTO_ICMPV6 : 2065 /* 2066 * This is an incoming packet, so the destination is 2067 * the icmp6_id and the source port equals 0 2068 */ 2069 if ((fin->fin_flx & FI_ICMPQUERY) != 0) 2070 nflags = IPN_ICMPQUERY; 2071 break; 2072 default : 2073 break; 2074 } 2075 2076 #ifdef IPF_V6_PROXIES 2077 if ((nflags & IPN_TCPUDP)) 2078 tcp = fin->fin_dp; 2079 #endif 2080 } 2081 2082 ipa = fin->fin_src6; 2083 2084 READ_ENTER(&ifs->ifs_ipf_nat); 2085 2086 if ((fin->fin_p == IPPROTO_ICMPV6) && !(nflags & IPN_ICMPQUERY) && 2087 (nat = nat6_icmperror(fin, &nflags, NAT_OUTBOUND))) 2088 /*EMPTY*/; 2089 else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin))) 2090 natadd = 0; 2091 else if ((nat = nat6_outlookup(fin, nflags|NAT_SEARCH, 2092 (u_int)fin->fin_p, &fin->fin_src6.in6, 2093 &fin->fin_dst6.in6))) { 2094 nflags = nat->nat_flags; 2095 } else { 2096 u_32_t hv, nmsk; 2097 i6addr_t msk; 2098 int i; 2099 2100 /* 2101 * If there is no current entry in the nat table for this IP#, 2102 * create one for it (if there is a matching rule). 2103 */ 2104 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 2105 i = 3; 2106 msk.i6[0] = 0xffffffff; 2107 msk.i6[1] = 0xffffffff; 2108 msk.i6[2] = 0xffffffff; 2109 msk.i6[3] = 0xffffffff; 2110 nmsk = ifs->ifs_nat6_masks[3]; 2111 WRITE_ENTER(&ifs->ifs_ipf_nat); 2112 maskloop: 2113 IP6_AND(&ipa, &msk, &iph); 2114 hv = NAT_HASH_FN6(&iph, 0, ifs->ifs_ipf_natrules_sz); 2115 for (np = ifs->ifs_nat_rules[hv]; np; np = np->in_mnext) 2116 { 2117 if ((np->in_ifps[1] && (np->in_ifps[1] != ifp))) 2118 continue; 2119 if (np->in_v != 6) 2120 continue; 2121 if (np->in_p && (np->in_p != fin->fin_p)) 2122 continue; 2123 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags)) 2124 continue; 2125 if (np->in_flags & IPN_FILTER) { 2126 if (!nat6_match(fin, np)) 2127 continue; 2128 } else if (!IP6_MASKEQ(&ipa, &np->in_in[1], 2129 &np->in_in[0])) 2130 continue; 2131 2132 if ((fr != NULL) && 2133 !fr_matchtag(&np->in_tag, &fr->fr_nattag)) 2134 continue; 2135 2136 #ifdef IPF_V6_PROXIES 2137 if (*np->in_plabel != '\0') { 2138 if (((np->in_flags & IPN_FILTER) == 0) && 2139 (np->in_dport != tcp->th_dport)) 2140 continue; 2141 if (appr_ok(fin, tcp, np) == 0) 2142 continue; 2143 } 2144 #endif 2145 2146 if (nat = nat6_new(fin, np, NULL, nflags, 2147 NAT_OUTBOUND)) { 2148 np->in_hits++; 2149 break; 2150 } else 2151 natfailed = -1; 2152 } 2153 if ((np == NULL) && (i >= 0)) { 2154 while (i >= 0) { 2155 while (nmsk) { 2156 msk.i6[i] = htonl(ntohl(msk.i6[i])<<1); 2157 if ((nmsk & 0x80000000) != 0) { 2158 nmsk <<= 1; 2159 goto maskloop; 2160 } 2161 nmsk <<= 1; 2162 } 2163 msk.i6[i--] = 0; 2164 if (i >= 0) { 2165 nmsk = ifs->ifs_nat6_masks[i]; 2166 if (nmsk != 0) 2167 goto maskloop; 2168 } 2169 } 2170 } 2171 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 2172 } 2173 2174 if (nat != NULL) { 2175 rval = fr_nat6out(fin, nat, natadd, nflags); 2176 } else { 2177 rval = natfailed; 2178 } 2179 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 2180 2181 if (rval == -1) { 2182 if (passp != NULL) 2183 *passp = FR_BLOCK; 2184 fin->fin_flx |= FI_BADNAT; 2185 } 2186 fin->fin_ifp = sifp; 2187 return rval; 2188 } 2189 2190 /* ------------------------------------------------------------------------ */ 2191 /* Function: fr_nat6out */ 2192 /* Returns: int - -1 == packet failed NAT checks so block it, */ 2193 /* 1 == packet was successfully translated. */ 2194 /* Parameters: fin(I) - pointer to packet information */ 2195 /* nat(I) - pointer to NAT structure */ 2196 /* natadd(I) - flag indicating if it is safe to add frag cache */ 2197 /* nflags(I) - NAT flags set for this packet */ 2198 /* */ 2199 /* Translate a packet coming "out" on an interface. */ 2200 /* ------------------------------------------------------------------------ */ 2201 int fr_nat6out(fin, nat, natadd, nflags) 2202 fr_info_t *fin; 2203 nat_t *nat; 2204 int natadd; 2205 u_32_t nflags; 2206 { 2207 struct icmp6_hdr *icmp6; 2208 u_short *csump; 2209 tcphdr_t *tcp; 2210 ipnat_t *np; 2211 int i; 2212 ipf_stack_t *ifs = fin->fin_ifs; 2213 2214 #if defined(SOLARIS) && defined(_KERNEL) 2215 net_handle_t net_data_p = ifs->ifs_ipf_ipv6; 2216 #endif 2217 2218 tcp = NULL; 2219 icmp6 = NULL; 2220 csump = NULL; 2221 np = nat->nat_ptr; 2222 2223 if ((natadd != 0) && (fin->fin_flx & FI_FRAG)) 2224 (void) fr_nat_newfrag(fin, 0, nat); 2225 2226 MUTEX_ENTER(&nat->nat_lock); 2227 nat->nat_bytes[1] += fin->fin_plen; 2228 nat->nat_pkts[1]++; 2229 MUTEX_EXIT(&nat->nat_lock); 2230 2231 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 2232 if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) { 2233 tcp = fin->fin_dp; 2234 2235 tcp->th_sport = nat->nat_outport; 2236 fin->fin_data[0] = ntohs(nat->nat_outport); 2237 } 2238 2239 if ((nat->nat_outport != 0) && (nflags & IPN_ICMPQUERY)) { 2240 icmp6 = fin->fin_dp; 2241 icmp6->icmp6_id = nat->nat_outport; 2242 } 2243 2244 csump = nat_proto(fin, nat, nflags); 2245 } 2246 2247 fin->fin_ip6->ip6_src = nat->nat_outip6.in6; 2248 fin->fin_src6 = nat->nat_outip6; 2249 2250 nat_update(fin, nat, np); 2251 2252 /* 2253 * TCP/UDP/ICMPv6 checksum needs to be adjusted. 2254 */ 2255 if (csump != NULL && (!(nflags & IPN_TCPUDP) || 2256 !NET_IS_HCK_L4_FULL(net_data_p, fin->fin_m))) { 2257 if (nflags & IPN_TCPUDP && 2258 NET_IS_HCK_L4_PART(net_data_p, fin->fin_m)) { 2259 if (nat->nat_dir == NAT_OUTBOUND) 2260 fix_outcksum(csump, nat->nat_sumd[1]); 2261 else 2262 fix_incksum(csump, nat->nat_sumd[1]); 2263 } else { 2264 if (nat->nat_dir == NAT_OUTBOUND) 2265 fix_outcksum(csump, nat->nat_sumd[0]); 2266 else 2267 fix_incksum(csump, nat->nat_sumd[0]); 2268 } 2269 } 2270 #ifdef IPFILTER_SYNC 2271 ipfsync_update(SMC_NAT, fin, nat->nat_sync); 2272 #endif 2273 /* ------------------------------------------------------------- */ 2274 /* A few quick notes: */ 2275 /* Following are test conditions prior to calling the */ 2276 /* appr_check routine. */ 2277 /* */ 2278 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ 2279 /* with a redirect rule, we attempt to match the packet's */ 2280 /* source port against in_dport, otherwise we'd compare the */ 2281 /* packet's destination. */ 2282 /* ------------------------------------------------------------- */ 2283 if ((np != NULL) && (np->in_apr != NULL)) { 2284 i = appr_check(fin, nat); 2285 if (i == 0) 2286 i = 1; 2287 } else 2288 i = 1; 2289 ATOMIC_INCL(ifs->ifs_nat_stats.ns_mapped[1]); 2290 fin->fin_flx |= FI_NATED; 2291 return i; 2292 } 2293 2294 2295 /* ------------------------------------------------------------------------ */ 2296 /* Function: fr_checknat6in */ 2297 /* Returns: int - -1 == packet failed NAT checks so block it, */ 2298 /* 0 == no packet translation occurred, */ 2299 /* 1 == packet was successfully translated. */ 2300 /* Parameters: fin(I) - pointer to packet information */ 2301 /* passp(I) - pointer to filtering result flags */ 2302 /* */ 2303 /* Check to see if an incoming packet should be changed. ICMP packets are */ 2304 /* first checked to see if they match an existing entry (if an error), */ 2305 /* otherwise a search of the current NAT table is made. If neither results */ 2306 /* in a match then a search for a matching NAT rule is made. Create a new */ 2307 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */ 2308 /* packet header(s) as required. */ 2309 /* ------------------------------------------------------------------------ */ 2310 int fr_checknat6in(fin, passp) 2311 fr_info_t *fin; 2312 u_32_t *passp; 2313 { 2314 u_int nflags, natadd; 2315 int rval, natfailed; 2316 struct ifnet *ifp; 2317 struct icmp6_hdr *icmp6; 2318 tcphdr_t *tcp; 2319 u_short dport; 2320 ipnat_t *np; 2321 nat_t *nat; 2322 i6addr_t ipa, iph; 2323 ipf_stack_t *ifs = fin->fin_ifs; 2324 2325 if (ifs->ifs_nat_stats.ns_rules == 0 || ifs->ifs_fr_nat_lock != 0) 2326 return 0; 2327 2328 tcp = NULL; 2329 icmp6 = NULL; 2330 dport = 0; 2331 natadd = 1; 2332 nflags = 0; 2333 natfailed = 0; 2334 ifp = fin->fin_ifp; 2335 2336 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 2337 switch (fin->fin_p) 2338 { 2339 case IPPROTO_TCP : 2340 nflags = IPN_TCP; 2341 break; 2342 case IPPROTO_UDP : 2343 nflags = IPN_UDP; 2344 break; 2345 case IPPROTO_ICMPV6 : 2346 icmp6 = fin->fin_dp; 2347 2348 /* 2349 * This is an incoming packet, so the destination is 2350 * the icmp_id and the source port equals 0 2351 */ 2352 if ((fin->fin_flx & FI_ICMPQUERY) != 0) { 2353 nflags = IPN_ICMPQUERY; 2354 dport = icmp6->icmp6_id; 2355 } break; 2356 default : 2357 break; 2358 } 2359 2360 if ((nflags & IPN_TCPUDP)) { 2361 tcp = fin->fin_dp; 2362 dport = tcp->th_dport; 2363 } 2364 } 2365 2366 ipa = fin->fin_dst6; 2367 2368 READ_ENTER(&ifs->ifs_ipf_nat); 2369 2370 if ((fin->fin_p == IPPROTO_ICMPV6) && !(nflags & IPN_ICMPQUERY) && 2371 (nat = nat6_icmperror(fin, &nflags, NAT_INBOUND))) 2372 /*EMPTY*/; 2373 else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin))) 2374 natadd = 0; 2375 else if ((nat = nat6_inlookup(fin, nflags|NAT_SEARCH, (u_int)fin->fin_p, 2376 &fin->fin_src6.in6, &ipa.in6))) { 2377 nflags = nat->nat_flags; 2378 } else { 2379 u_32_t hv, rmsk; 2380 i6addr_t msk; 2381 int i; 2382 2383 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 2384 i = 3; 2385 msk.i6[0] = 0xffffffff; 2386 msk.i6[1] = 0xffffffff; 2387 msk.i6[2] = 0xffffffff; 2388 msk.i6[3] = 0xffffffff; 2389 rmsk = ifs->ifs_rdr6_masks[3]; 2390 WRITE_ENTER(&ifs->ifs_ipf_nat); 2391 /* 2392 * If there is no current entry in the nat table for this IP#, 2393 * create one for it (if there is a matching rule). 2394 */ 2395 maskloop: 2396 IP6_AND(&ipa, &msk, &iph); 2397 hv = NAT_HASH_FN6(&iph, 0, ifs->ifs_ipf_rdrrules_sz); 2398 for (np = ifs->ifs_rdr_rules[hv]; np; np = np->in_rnext) { 2399 if (np->in_ifps[0] && (np->in_ifps[0] != ifp)) 2400 continue; 2401 if (np->in_v != fin->fin_v) 2402 continue; 2403 if (np->in_p && (np->in_p != fin->fin_p)) 2404 continue; 2405 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags)) 2406 continue; 2407 if (np->in_flags & IPN_FILTER) { 2408 if (!nat6_match(fin, np)) 2409 continue; 2410 } else { 2411 if (!IP6_MASKEQ(&ipa, &np->in_out[1], 2412 &np->in_out[0])) 2413 continue; 2414 if (np->in_pmin && 2415 ((ntohs(np->in_pmax) < ntohs(dport)) || 2416 (ntohs(dport) < ntohs(np->in_pmin)))) 2417 continue; 2418 } 2419 2420 #ifdef IPF_V6_PROXIES 2421 if (*np->in_plabel != '\0') { 2422 if (!appr_ok(fin, tcp, np)) { 2423 continue; 2424 } 2425 } 2426 #endif 2427 2428 nat = nat6_new(fin, np, NULL, nflags, NAT_INBOUND); 2429 if (nat != NULL) { 2430 np->in_hits++; 2431 break; 2432 } else 2433 natfailed = -1; 2434 } 2435 2436 if ((np == NULL) && (i >= 0)) { 2437 while (i >= 0) { 2438 while (rmsk) { 2439 msk.i6[i] = htonl(ntohl(msk.i6[i])<<1); 2440 if ((rmsk & 0x80000000) != 0) { 2441 rmsk <<= 1; 2442 goto maskloop; 2443 } 2444 rmsk <<= 1; 2445 } 2446 msk.i6[i--] = 0; 2447 if (i >= 0) { 2448 rmsk = ifs->ifs_rdr6_masks[i]; 2449 if (rmsk != 0) 2450 goto maskloop; 2451 } 2452 } 2453 } 2454 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 2455 } 2456 if (nat != NULL) { 2457 rval = fr_nat6in(fin, nat, natadd, nflags); 2458 } else { 2459 rval = natfailed; 2460 } 2461 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 2462 2463 if (rval == -1) { 2464 if (passp != NULL) 2465 *passp = FR_BLOCK; 2466 fin->fin_flx |= FI_BADNAT; 2467 } 2468 return rval; 2469 } 2470 2471 2472 /* ------------------------------------------------------------------------ */ 2473 /* Function: fr_nat6in */ 2474 /* Returns: int - -1 == packet failed NAT checks so block it, */ 2475 /* 1 == packet was successfully translated. */ 2476 /* Parameters: fin(I) - pointer to packet information */ 2477 /* nat(I) - pointer to NAT structure */ 2478 /* natadd(I) - flag indicating if it is safe to add frag cache */ 2479 /* nflags(I) - NAT flags set for this packet */ 2480 /* Locks Held: ipf_nat (READ) */ 2481 /* */ 2482 /* Translate a packet coming "in" on an interface. */ 2483 /* ------------------------------------------------------------------------ */ 2484 int fr_nat6in(fin, nat, natadd, nflags) 2485 fr_info_t *fin; 2486 nat_t *nat; 2487 int natadd; 2488 u_32_t nflags; 2489 { 2490 struct icmp6_hdr *icmp6; 2491 u_short *csump; 2492 tcphdr_t *tcp; 2493 ipnat_t *np; 2494 ipf_stack_t *ifs = fin->fin_ifs; 2495 2496 #if defined(SOLARIS) && defined(_KERNEL) 2497 net_handle_t net_data_p = ifs->ifs_ipf_ipv6; 2498 #endif 2499 2500 tcp = NULL; 2501 csump = NULL; 2502 np = nat->nat_ptr; 2503 fin->fin_fr = nat->nat_fr; 2504 2505 if ((natadd != 0) && (fin->fin_flx & FI_FRAG)) 2506 (void) fr_nat_newfrag(fin, 0, nat); 2507 2508 #ifdef IPF_V6_PROXIES 2509 if (np != NULL) { 2510 2511 /* ------------------------------------------------------------- */ 2512 /* A few quick notes: */ 2513 /* Following are test conditions prior to calling the */ 2514 /* appr_check routine. */ 2515 /* */ 2516 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ 2517 /* with a map rule, we attempt to match the packet's */ 2518 /* source port against in_dport, otherwise we'd compare the */ 2519 /* packet's destination. */ 2520 /* ------------------------------------------------------------- */ 2521 if (np->in_apr != NULL) { 2522 i = appr_check(fin, nat); 2523 if (i == -1) { 2524 return -1; 2525 } 2526 } 2527 } 2528 #endif 2529 2530 #ifdef IPFILTER_SYNC 2531 ipfsync_update(SMC_NAT, fin, nat->nat_sync); 2532 #endif 2533 2534 MUTEX_ENTER(&nat->nat_lock); 2535 nat->nat_bytes[0] += fin->fin_plen; 2536 nat->nat_pkts[0]++; 2537 MUTEX_EXIT(&nat->nat_lock); 2538 2539 fin->fin_ip6->ip6_dst = nat->nat_inip6.in6; 2540 fin->fin_dst6 = nat->nat_inip6; 2541 2542 if (nflags & IPN_TCPUDP) 2543 tcp = fin->fin_dp; 2544 2545 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 2546 if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) { 2547 tcp->th_dport = nat->nat_inport; 2548 fin->fin_data[1] = ntohs(nat->nat_inport); 2549 } 2550 2551 2552 if ((nat->nat_inport != 0) && (nflags & IPN_ICMPQUERY)) { 2553 icmp6 = fin->fin_dp; 2554 2555 icmp6->icmp6_id = nat->nat_inport; 2556 } 2557 2558 csump = nat_proto(fin, nat, nflags); 2559 } 2560 2561 nat_update(fin, nat, np); 2562 2563 /* 2564 * In case they are being forwarded, inbound packets always need to have 2565 * their checksum adjusted even if hardware checksum validation said OK. 2566 */ 2567 if (csump != NULL) { 2568 if (nat->nat_dir == NAT_OUTBOUND) 2569 fix_incksum(csump, nat->nat_sumd[0]); 2570 else 2571 fix_outcksum(csump, nat->nat_sumd[0]); 2572 } 2573 2574 #if defined(SOLARIS) && defined(_KERNEL) 2575 if (nflags & IPN_TCPUDP && 2576 NET_IS_HCK_L4_PART(net_data_p, fin->fin_m)) { 2577 /* 2578 * Need to adjust the partial checksum result stored in 2579 * db_cksum16, which will be used for validation in IP. 2580 * See IP_CKSUM_RECV(). 2581 * Adjustment data should be the inverse of the IP address 2582 * changes, because db_cksum16 is supposed to be the complement 2583 * of the pesudo header. 2584 */ 2585 csump = &fin->fin_m->b_datap->db_cksum16; 2586 if (nat->nat_dir == NAT_OUTBOUND) 2587 fix_outcksum(csump, nat->nat_sumd[1]); 2588 else 2589 fix_incksum(csump, nat->nat_sumd[1]); 2590 } 2591 #endif 2592 2593 ATOMIC_INCL(ifs->ifs_nat_stats.ns_mapped[0]); 2594 fin->fin_flx |= FI_NATED; 2595 if (np != NULL && np->in_tag.ipt_num[0] != 0) 2596 fin->fin_nattag = &np->in_tag; 2597 return 1; 2598 } 2599 2600 2601 /* ------------------------------------------------------------------------ */ 2602 /* Function: nat_icmpquerytype6 */ 2603 /* Returns: int - 1 == success, 0 == failure */ 2604 /* Parameters: icmptype(I) - ICMP type number */ 2605 /* */ 2606 /* Tests to see if the ICMP type number passed is a query/response type or */ 2607 /* not. */ 2608 /* ------------------------------------------------------------------------ */ 2609 static INLINE int nat_icmpquerytype6(icmptype) 2610 int icmptype; 2611 { 2612 2613 /* 2614 * For the ICMP query NAT code, it is essential that both the query 2615 * and the reply match on the NAT rule. Because the NAT structure 2616 * does not keep track of the icmptype, and a single NAT structure 2617 * is used for all icmp types with the same src, dest and id, we 2618 * simply define the replies as queries as well. The funny thing is, 2619 * altough it seems silly to call a reply a query, this is exactly 2620 * as it is defined in the IPv4 specification 2621 */ 2622 2623 switch (icmptype) 2624 { 2625 2626 case ICMP6_ECHO_REPLY: 2627 case ICMP6_ECHO_REQUEST: 2628 /* route aedvertisement/solliciation is currently unsupported: */ 2629 /* it would require rewriting the ICMP data section */ 2630 case ICMP6_MEMBERSHIP_QUERY: 2631 case ICMP6_MEMBERSHIP_REPORT: 2632 case ICMP6_MEMBERSHIP_REDUCTION: 2633 case ICMP6_WRUREQUEST: 2634 case ICMP6_WRUREPLY: 2635 case MLD6_MTRACE_RESP: 2636 case MLD6_MTRACE: 2637 return 1; 2638 default: 2639 return 0; 2640 } 2641 } 2642