1 /* 2 * Copyright (C) 1995-2003 by Darren Reed. 3 * 4 * See the IPFILTER.LICENCE file for details on licencing. 5 * 6 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 7 * Use is subject to license terms. 8 */ 9 10 #pragma ident "%Z%%M% %I% %E% SMI"$ 11 12 #if defined(KERNEL) || defined(_KERNEL) 13 # undef KERNEL 14 # undef _KERNEL 15 # define KERNEL 1 16 # define _KERNEL 1 17 #endif 18 #include <sys/errno.h> 19 #include <sys/types.h> 20 #include <sys/param.h> 21 #include <sys/time.h> 22 #include <sys/file.h> 23 #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \ 24 defined(_KERNEL) 25 # include "opt_ipfilter_log.h" 26 #endif 27 #if !defined(_KERNEL) 28 # include <stdio.h> 29 # include <string.h> 30 # include <stdlib.h> 31 # define _KERNEL 32 # ifdef __OpenBSD__ 33 struct file; 34 # endif 35 # include <sys/uio.h> 36 # undef _KERNEL 37 #endif 38 #if defined(_KERNEL) && (__FreeBSD_version >= 220000) 39 # include <sys/filio.h> 40 # include <sys/fcntl.h> 41 #else 42 # include <sys/ioctl.h> 43 #endif 44 #if !defined(AIX) 45 # include <sys/fcntl.h> 46 #endif 47 #if !defined(linux) 48 # include <sys/protosw.h> 49 #endif 50 #include <sys/socket.h> 51 #if defined(_KERNEL) 52 # include <sys/systm.h> 53 # if !defined(__SVR4) && !defined(__svr4__) 54 # include <sys/mbuf.h> 55 # endif 56 #endif 57 #if defined(__SVR4) || defined(__svr4__) 58 # include <sys/filio.h> 59 # include <sys/byteorder.h> 60 # ifdef _KERNEL 61 # include <sys/dditypes.h> 62 # endif 63 # include <sys/stream.h> 64 # include <sys/kmem.h> 65 #endif 66 #if __FreeBSD_version >= 300000 67 # include <sys/queue.h> 68 #endif 69 #include <net/if.h> 70 #if __FreeBSD_version >= 300000 71 # include <net/if_var.h> 72 # if defined(_KERNEL) && !defined(IPFILTER_LKM) 73 # include "opt_ipfilter.h" 74 # endif 75 #endif 76 #ifdef sun 77 # include <net/af.h> 78 #endif 79 #include <net/route.h> 80 #include <netinet/in.h> 81 #include <netinet/in_systm.h> 82 #include <netinet/ip.h> 83 84 #ifdef RFC1825 85 # include <vpn/md5.h> 86 # include <vpn/ipsec.h> 87 extern struct ifnet vpnif; 88 #endif 89 90 #if !defined(linux) 91 # include <netinet/ip_var.h> 92 #endif 93 #include <netinet/tcp.h> 94 #include <netinet/udp.h> 95 #include <netinet/ip_icmp.h> 96 #include "netinet/ip_compat.h" 97 #include <netinet/tcpip.h> 98 #include "netinet/ip_fil.h" 99 #include "netinet/ip_nat.h" 100 #include "netinet/ip_frag.h" 101 #include "netinet/ip_state.h" 102 #include "netinet/ip_proxy.h" 103 #include "netinet/ipf_stack.h" 104 #ifdef IPFILTER_SYNC 105 #include "netinet/ip_sync.h" 106 #endif 107 #if (__FreeBSD_version >= 300000) 108 # include <sys/malloc.h> 109 #endif 110 /* END OF INCLUDES */ 111 112 #undef SOCKADDR_IN 113 #define SOCKADDR_IN struct sockaddr_in 114 115 #if !defined(lint) 116 static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed"; 117 static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.195.2.42 2005/08/11 19:51:36 darrenr Exp $"; 118 #endif 119 120 121 /* ======================================================================== */ 122 /* How the NAT is organised and works. */ 123 /* */ 124 /* Inside (interface y) NAT Outside (interface x) */ 125 /* -------------------- -+- ------------------------------------- */ 126 /* Packet going | out, processsed by fr_checknatout() for x */ 127 /* ------------> | ------------> */ 128 /* src=10.1.1.1 | src=192.1.1.1 */ 129 /* | */ 130 /* | in, processed by fr_checknatin() for x */ 131 /* <------------ | <------------ */ 132 /* dst=10.1.1.1 | dst=192.1.1.1 */ 133 /* -------------------- -+- ------------------------------------- */ 134 /* fr_checknatout() - changes ip_src and if required, sport */ 135 /* - creates a new mapping, if required. */ 136 /* fr_checknatin() - changes ip_dst and if required, dport */ 137 /* */ 138 /* In the NAT table, internal source is recorded as "in" and externally */ 139 /* seen as "out". */ 140 /* ======================================================================== */ 141 142 143 144 static int nat_flushtable __P((ipf_stack_t *)); 145 static int nat_clearlist __P((ipf_stack_t *)); 146 static void nat_addnat __P((struct ipnat *, ipf_stack_t *)); 147 static void nat_addrdr __P((struct ipnat *, ipf_stack_t *)); 148 static void nat_delete __P((struct nat *, int, ipf_stack_t *)); 149 static void nat_delrdr __P((struct ipnat *)); 150 static void nat_delnat __P((struct ipnat *)); 151 static int fr_natgetent __P((caddr_t, ipf_stack_t *)); 152 static int fr_natgetsz __P((caddr_t, ipf_stack_t *)); 153 static int fr_natputent __P((caddr_t, int, ipf_stack_t *)); 154 static void nat_tabmove __P((nat_t *, ipf_stack_t *)); 155 static int nat_match __P((fr_info_t *, ipnat_t *)); 156 static INLINE int nat_newmap __P((fr_info_t *, nat_t *, natinfo_t *)); 157 static INLINE int nat_newrdr __P((fr_info_t *, nat_t *, natinfo_t *)); 158 static hostmap_t *nat_hostmap __P((ipnat_t *, struct in_addr, 159 struct in_addr, struct in_addr, u_32_t, 160 ipf_stack_t *)); 161 static void nat_hostmapdel __P((struct hostmap *)); 162 static INLINE int nat_icmpquerytype4 __P((int)); 163 static int nat_siocaddnat __P((ipnat_t *, ipnat_t **, int, 164 ipf_stack_t *)); 165 static void nat_siocdelnat __P((ipnat_t *, ipnat_t **, int, 166 ipf_stack_t *)); 167 static INLINE int nat_icmperrortype4 __P((int)); 168 static INLINE int nat_finalise __P((fr_info_t *, nat_t *, natinfo_t *, 169 tcphdr_t *, nat_t **, int)); 170 static INLINE int nat_resolverule __P((ipnat_t *, ipf_stack_t *)); 171 static nat_t *fr_natclone __P((fr_info_t *, nat_t *)); 172 static void nat_mssclamp __P((tcphdr_t *, u_32_t, u_short *)); 173 static INLINE int nat_wildok __P((nat_t *, int, int, int, int)); 174 static int nat_getnext __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *)); 175 static int nat_iterator __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *)); 176 177 178 /* ------------------------------------------------------------------------ */ 179 /* Function: fr_natinit */ 180 /* Returns: int - 0 == success, -1 == failure */ 181 /* Parameters: Nil */ 182 /* */ 183 /* Initialise all of the NAT locks, tables and other structures. */ 184 /* ------------------------------------------------------------------------ */ 185 int fr_natinit(ifs) 186 ipf_stack_t *ifs; 187 { 188 int i; 189 190 KMALLOCS(ifs->ifs_nat_table[0], nat_t **, 191 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 192 if (ifs->ifs_nat_table[0] != NULL) 193 bzero((char *)ifs->ifs_nat_table[0], 194 ifs->ifs_ipf_nattable_sz * sizeof(nat_t *)); 195 else 196 return -1; 197 198 KMALLOCS(ifs->ifs_nat_table[1], nat_t **, 199 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 200 if (ifs->ifs_nat_table[1] != NULL) 201 bzero((char *)ifs->ifs_nat_table[1], 202 ifs->ifs_ipf_nattable_sz * sizeof(nat_t *)); 203 else 204 return -2; 205 206 KMALLOCS(ifs->ifs_nat_rules, ipnat_t **, 207 sizeof(ipnat_t *) * ifs->ifs_ipf_natrules_sz); 208 if (ifs->ifs_nat_rules != NULL) 209 bzero((char *)ifs->ifs_nat_rules, 210 ifs->ifs_ipf_natrules_sz * sizeof(ipnat_t *)); 211 else 212 return -3; 213 214 KMALLOCS(ifs->ifs_rdr_rules, ipnat_t **, 215 sizeof(ipnat_t *) * ifs->ifs_ipf_rdrrules_sz); 216 if (ifs->ifs_rdr_rules != NULL) 217 bzero((char *)ifs->ifs_rdr_rules, 218 ifs->ifs_ipf_rdrrules_sz * sizeof(ipnat_t *)); 219 else 220 return -4; 221 222 KMALLOCS(ifs->ifs_maptable, hostmap_t **, 223 sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz); 224 if (ifs->ifs_maptable != NULL) 225 bzero((char *)ifs->ifs_maptable, 226 sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz); 227 else 228 return -5; 229 230 ifs->ifs_ipf_hm_maplist = NULL; 231 232 KMALLOCS(ifs->ifs_nat_stats.ns_bucketlen[0], u_long *, 233 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 234 if (ifs->ifs_nat_stats.ns_bucketlen[0] == NULL) 235 return -1; 236 bzero((char *)ifs->ifs_nat_stats.ns_bucketlen[0], 237 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 238 239 KMALLOCS(ifs->ifs_nat_stats.ns_bucketlen[1], u_long *, 240 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 241 if (ifs->ifs_nat_stats.ns_bucketlen[1] == NULL) 242 return -1; 243 bzero((char *)ifs->ifs_nat_stats.ns_bucketlen[1], 244 ifs->ifs_ipf_nattable_sz * sizeof(u_long)); 245 246 if (ifs->ifs_fr_nat_maxbucket == 0) { 247 for (i = ifs->ifs_ipf_nattable_sz; i > 0; i >>= 1) 248 ifs->ifs_fr_nat_maxbucket++; 249 ifs->ifs_fr_nat_maxbucket *= 2; 250 } 251 252 fr_sttab_init(ifs->ifs_nat_tqb, ifs); 253 /* 254 * Increase this because we may have "keep state" following this too 255 * and packet storms can occur if this is removed too quickly. 256 */ 257 ifs->ifs_nat_tqb[IPF_TCPS_CLOSED].ifq_ttl = ifs->ifs_fr_tcplastack; 258 ifs->ifs_nat_tqb[IPF_TCP_NSTATES - 1].ifq_next = &ifs->ifs_nat_udptq; 259 ifs->ifs_nat_udptq.ifq_ttl = ifs->ifs_fr_defnatage; 260 ifs->ifs_nat_udptq.ifq_ref = 1; 261 ifs->ifs_nat_udptq.ifq_head = NULL; 262 ifs->ifs_nat_udptq.ifq_tail = &ifs->ifs_nat_udptq.ifq_head; 263 MUTEX_INIT(&ifs->ifs_nat_udptq.ifq_lock, "nat ipftq udp tab"); 264 ifs->ifs_nat_udptq.ifq_next = &ifs->ifs_nat_icmptq; 265 ifs->ifs_nat_icmptq.ifq_ttl = ifs->ifs_fr_defnaticmpage; 266 ifs->ifs_nat_icmptq.ifq_ref = 1; 267 ifs->ifs_nat_icmptq.ifq_head = NULL; 268 ifs->ifs_nat_icmptq.ifq_tail = &ifs->ifs_nat_icmptq.ifq_head; 269 MUTEX_INIT(&ifs->ifs_nat_icmptq.ifq_lock, "nat icmp ipftq tab"); 270 ifs->ifs_nat_icmptq.ifq_next = &ifs->ifs_nat_iptq; 271 ifs->ifs_nat_iptq.ifq_ttl = ifs->ifs_fr_defnatipage; 272 ifs->ifs_nat_iptq.ifq_ref = 1; 273 ifs->ifs_nat_iptq.ifq_head = NULL; 274 ifs->ifs_nat_iptq.ifq_tail = &ifs->ifs_nat_iptq.ifq_head; 275 MUTEX_INIT(&ifs->ifs_nat_iptq.ifq_lock, "nat ip ipftq tab"); 276 ifs->ifs_nat_iptq.ifq_next = NULL; 277 278 for (i = 0; i < IPF_TCP_NSTATES; i++) { 279 if (ifs->ifs_nat_tqb[i].ifq_ttl < ifs->ifs_fr_defnaticmpage) 280 ifs->ifs_nat_tqb[i].ifq_ttl = ifs->ifs_fr_defnaticmpage; 281 #ifdef LARGE_NAT 282 else if (ifs->ifs_nat_tqb[i].ifq_ttl > ifs->ifs_fr_defnatage) 283 ifs->ifs_nat_tqb[i].ifq_ttl = ifs->ifs_fr_defnatage; 284 #endif 285 } 286 287 /* 288 * Increase this because we may have "keep state" following 289 * this too and packet storms can occur if this is removed 290 * too quickly. 291 */ 292 ifs->ifs_nat_tqb[IPF_TCPS_CLOSED].ifq_ttl = 293 ifs->ifs_nat_tqb[IPF_TCPS_LAST_ACK].ifq_ttl; 294 295 RWLOCK_INIT(&ifs->ifs_ipf_nat, "ipf IP NAT rwlock"); 296 RWLOCK_INIT(&ifs->ifs_ipf_natfrag, "ipf IP NAT-Frag rwlock"); 297 MUTEX_INIT(&ifs->ifs_ipf_nat_new, "ipf nat new mutex"); 298 MUTEX_INIT(&ifs->ifs_ipf_natio, "ipf nat io mutex"); 299 300 ifs->ifs_fr_nat_init = 1; 301 302 return 0; 303 } 304 305 306 /* ------------------------------------------------------------------------ */ 307 /* Function: nat_addrdr */ 308 /* Returns: Nil */ 309 /* Parameters: n(I) - pointer to NAT rule to add */ 310 /* */ 311 /* Adds a redirect rule to the hash table of redirect rules and the list of */ 312 /* loaded NAT rules. Updates the bitmask indicating which netmasks are in */ 313 /* use by redirect rules. */ 314 /* ------------------------------------------------------------------------ */ 315 static void nat_addrdr(n, ifs) 316 ipnat_t *n; 317 ipf_stack_t *ifs; 318 { 319 ipnat_t **np; 320 u_32_t j; 321 u_int hv; 322 int k; 323 324 k = count4bits(n->in_outmsk); 325 if ((k >= 0) && (k != 32)) 326 ifs->ifs_rdr_masks |= 1 << k; 327 j = (n->in_outip & n->in_outmsk); 328 hv = NAT_HASH_FN(j, 0, ifs->ifs_ipf_rdrrules_sz); 329 np = ifs->ifs_rdr_rules + hv; 330 while (*np != NULL) 331 np = &(*np)->in_rnext; 332 n->in_rnext = NULL; 333 n->in_prnext = np; 334 n->in_hv = hv; 335 *np = n; 336 } 337 338 339 /* ------------------------------------------------------------------------ */ 340 /* Function: nat_addnat */ 341 /* Returns: Nil */ 342 /* Parameters: n(I) - pointer to NAT rule to add */ 343 /* */ 344 /* Adds a NAT map rule to the hash table of rules and the list of loaded */ 345 /* NAT rules. Updates the bitmask indicating which netmasks are in use by */ 346 /* redirect rules. */ 347 /* ------------------------------------------------------------------------ */ 348 static void nat_addnat(n, ifs) 349 ipnat_t *n; 350 ipf_stack_t *ifs; 351 { 352 ipnat_t **np; 353 u_32_t j; 354 u_int hv; 355 int k; 356 357 k = count4bits(n->in_inmsk); 358 if ((k >= 0) && (k != 32)) 359 ifs->ifs_nat_masks |= 1 << k; 360 j = (n->in_inip & n->in_inmsk); 361 hv = NAT_HASH_FN(j, 0, ifs->ifs_ipf_natrules_sz); 362 np = ifs->ifs_nat_rules + hv; 363 while (*np != NULL) 364 np = &(*np)->in_mnext; 365 n->in_mnext = NULL; 366 n->in_pmnext = np; 367 n->in_hv = hv; 368 *np = n; 369 } 370 371 372 /* ------------------------------------------------------------------------ */ 373 /* Function: nat_delrdr */ 374 /* Returns: Nil */ 375 /* Parameters: n(I) - pointer to NAT rule to delete */ 376 /* */ 377 /* Removes a redirect rule from the hash table of redirect rules. */ 378 /* ------------------------------------------------------------------------ */ 379 static void nat_delrdr(n) 380 ipnat_t *n; 381 { 382 if (n->in_rnext) 383 n->in_rnext->in_prnext = n->in_prnext; 384 *n->in_prnext = n->in_rnext; 385 } 386 387 388 /* ------------------------------------------------------------------------ */ 389 /* Function: nat_delnat */ 390 /* Returns: Nil */ 391 /* Parameters: n(I) - pointer to NAT rule to delete */ 392 /* */ 393 /* Removes a NAT map rule from the hash table of NAT map rules. */ 394 /* ------------------------------------------------------------------------ */ 395 static void nat_delnat(n) 396 ipnat_t *n; 397 { 398 if (n->in_mnext != NULL) 399 n->in_mnext->in_pmnext = n->in_pmnext; 400 *n->in_pmnext = n->in_mnext; 401 } 402 403 404 /* ------------------------------------------------------------------------ */ 405 /* Function: nat_hostmap */ 406 /* Returns: struct hostmap* - NULL if no hostmap could be created, */ 407 /* else a pointer to the hostmapping to use */ 408 /* Parameters: np(I) - pointer to NAT rule */ 409 /* real(I) - real IP address */ 410 /* map(I) - mapped IP address */ 411 /* port(I) - destination port number */ 412 /* Write Locks: ipf_nat */ 413 /* */ 414 /* Check if an ip address has already been allocated for a given mapping */ 415 /* that is not doing port based translation. If is not yet allocated, then */ 416 /* create a new entry if a non-NULL NAT rule pointer has been supplied. */ 417 /* ------------------------------------------------------------------------ */ 418 static struct hostmap *nat_hostmap(np, src, dst, map, port, ifs) 419 ipnat_t *np; 420 struct in_addr src; 421 struct in_addr dst; 422 struct in_addr map; 423 u_32_t port; 424 ipf_stack_t *ifs; 425 { 426 hostmap_t *hm; 427 u_int hv; 428 429 hv = (src.s_addr ^ dst.s_addr); 430 hv += src.s_addr; 431 hv += dst.s_addr; 432 hv %= HOSTMAP_SIZE; 433 for (hm = ifs->ifs_maptable[hv]; hm; hm = hm->hm_next) 434 if ((hm->hm_srcip.s_addr == src.s_addr) && 435 (hm->hm_dstip.s_addr == dst.s_addr) && 436 ((np == NULL) || (np == hm->hm_ipnat)) && 437 ((port == 0) || (port == hm->hm_port))) { 438 hm->hm_ref++; 439 return hm; 440 } 441 442 if (np == NULL) 443 return NULL; 444 445 KMALLOC(hm, hostmap_t *); 446 if (hm) { 447 hm->hm_hnext = ifs->ifs_ipf_hm_maplist; 448 hm->hm_phnext = &ifs->ifs_ipf_hm_maplist; 449 if (ifs->ifs_ipf_hm_maplist != NULL) 450 ifs->ifs_ipf_hm_maplist->hm_phnext = &hm->hm_hnext; 451 ifs->ifs_ipf_hm_maplist = hm; 452 453 hm->hm_next = ifs->ifs_maptable[hv]; 454 hm->hm_pnext = ifs->ifs_maptable + hv; 455 if (ifs->ifs_maptable[hv] != NULL) 456 ifs->ifs_maptable[hv]->hm_pnext = &hm->hm_next; 457 ifs->ifs_maptable[hv] = hm; 458 hm->hm_ipnat = np; 459 hm->hm_srcip = src; 460 hm->hm_dstip = dst; 461 hm->hm_mapip = map; 462 hm->hm_ref = 1; 463 hm->hm_port = port; 464 } 465 return hm; 466 } 467 468 469 /* ------------------------------------------------------------------------ */ 470 /* Function: nat_hostmapdel */ 471 /* Returns: Nil */ 472 /* Parameters: hm(I) - pointer to hostmap structure */ 473 /* Write Locks: ipf_nat */ 474 /* */ 475 /* Decrement the references to this hostmap structure by one. If this */ 476 /* reaches zero then remove it and free it. */ 477 /* ------------------------------------------------------------------------ */ 478 static void nat_hostmapdel(hm) 479 struct hostmap *hm; 480 { 481 hm->hm_ref--; 482 if (hm->hm_ref == 0) { 483 if (hm->hm_next) 484 hm->hm_next->hm_pnext = hm->hm_pnext; 485 *hm->hm_pnext = hm->hm_next; 486 if (hm->hm_hnext) 487 hm->hm_hnext->hm_phnext = hm->hm_phnext; 488 *hm->hm_phnext = hm->hm_hnext; 489 KFREE(hm); 490 } 491 } 492 493 void fr_hostmapderef(hmp) 494 struct hostmap **hmp; 495 { 496 struct hostmap *hm; 497 498 hm = *hmp; 499 *hmp = NULL; 500 hm->hm_ref--; 501 if (hm->hm_ref == 0) 502 nat_hostmapdel(hm); 503 } 504 505 506 /* ------------------------------------------------------------------------ */ 507 /* Function: fix_outcksum */ 508 /* Returns: Nil */ 509 /* Parameters: sp(I) - location of 16bit checksum to update */ 510 /* n((I) - amount to adjust checksum by */ 511 /* */ 512 /* Adjusts the 16bit checksum by "n" for packets going out. */ 513 /* ------------------------------------------------------------------------ */ 514 void fix_outcksum(sp, n) 515 u_short *sp; 516 u_32_t n; 517 { 518 u_short sumshort; 519 u_32_t sum1; 520 521 if (n == 0) 522 return; 523 524 sum1 = (~ntohs(*sp)) & 0xffff; 525 sum1 += (n); 526 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 527 /* Again */ 528 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 529 sumshort = ~(u_short)sum1; 530 *(sp) = htons(sumshort); 531 } 532 533 534 /* ------------------------------------------------------------------------ */ 535 /* Function: fix_incksum */ 536 /* Returns: Nil */ 537 /* Parameters: sp(I) - location of 16bit checksum to update */ 538 /* n((I) - amount to adjust checksum by */ 539 /* */ 540 /* Adjusts the 16bit checksum by "n" for packets going in. */ 541 /* ------------------------------------------------------------------------ */ 542 void fix_incksum(sp, n) 543 u_short *sp; 544 u_32_t n; 545 { 546 u_short sumshort; 547 u_32_t sum1; 548 549 if (n == 0) 550 return; 551 552 sum1 = (~ntohs(*sp)) & 0xffff; 553 sum1 += ~(n) & 0xffff; 554 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 555 /* Again */ 556 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 557 sumshort = ~(u_short)sum1; 558 *(sp) = htons(sumshort); 559 } 560 561 562 /* ------------------------------------------------------------------------ */ 563 /* Function: fix_datacksum */ 564 /* Returns: Nil */ 565 /* Parameters: sp(I) - location of 16bit checksum to update */ 566 /* n((I) - amount to adjust checksum by */ 567 /* */ 568 /* Fix_datacksum is used *only* for the adjustments of checksums in the */ 569 /* data section of an IP packet. */ 570 /* */ 571 /* The only situation in which you need to do this is when NAT'ing an */ 572 /* ICMP error message. Such a message, contains in its body the IP header */ 573 /* of the original IP packet, that causes the error. */ 574 /* */ 575 /* You can't use fix_incksum or fix_outcksum in that case, because for the */ 576 /* kernel the data section of the ICMP error is just data, and no special */ 577 /* processing like hardware cksum or ntohs processing have been done by the */ 578 /* kernel on the data section. */ 579 /* ------------------------------------------------------------------------ */ 580 void fix_datacksum(sp, n) 581 u_short *sp; 582 u_32_t n; 583 { 584 u_short sumshort; 585 u_32_t sum1; 586 587 if (n == 0) 588 return; 589 590 sum1 = (~ntohs(*sp)) & 0xffff; 591 sum1 += (n); 592 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 593 /* Again */ 594 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 595 sumshort = ~(u_short)sum1; 596 *(sp) = htons(sumshort); 597 } 598 599 600 /* ------------------------------------------------------------------------ */ 601 /* Function: fr_nat_ioctl */ 602 /* Returns: int - 0 == success, != 0 == failure */ 603 /* Parameters: data(I) - pointer to ioctl data */ 604 /* cmd(I) - ioctl command integer */ 605 /* mode(I) - file mode bits used with open */ 606 /* */ 607 /* Processes an ioctl call made to operate on the IP Filter NAT device. */ 608 /* ------------------------------------------------------------------------ */ 609 int fr_nat_ioctl(data, cmd, mode, uid, ctx, ifs) 610 ioctlcmd_t cmd; 611 caddr_t data; 612 int mode, uid; 613 void *ctx; 614 ipf_stack_t *ifs; 615 { 616 ipnat_t *nat, *nt, *n = NULL, **np = NULL; 617 int error = 0, ret, arg, getlock; 618 ipnat_t natd; 619 620 #if (BSD >= 199306) && defined(_KERNEL) 621 if ((securelevel >= 2) && (mode & FWRITE)) 622 return EPERM; 623 #endif 624 625 #if defined(__osf__) && defined(_KERNEL) 626 getlock = 0; 627 #else 628 getlock = (mode & NAT_LOCKHELD) ? 0 : 1; 629 #endif 630 631 nat = NULL; /* XXX gcc -Wuninitialized */ 632 if (cmd == (ioctlcmd_t)SIOCADNAT) { 633 KMALLOC(nt, ipnat_t *); 634 } else { 635 nt = NULL; 636 } 637 638 if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) { 639 if (mode & NAT_SYSSPACE) { 640 bcopy(data, (char *)&natd, sizeof(natd)); 641 error = 0; 642 } else { 643 error = fr_inobj(data, &natd, IPFOBJ_IPNAT); 644 } 645 646 } else if (cmd == (ioctlcmd_t)SIOCIPFFL) { /* SIOCFLNAT & SIOCCNATL */ 647 BCOPYIN(data, &arg, sizeof(arg)); 648 } 649 650 if (error != 0) 651 goto done; 652 653 /* 654 * For add/delete, look to see if the NAT entry is already present 655 */ 656 if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) { 657 nat = &natd; 658 if (nat->in_v == 0) /* For backward compat. */ 659 nat->in_v = 4; 660 nat->in_flags &= IPN_USERFLAGS; 661 if ((nat->in_redir & NAT_MAPBLK) == 0) { 662 if ((nat->in_flags & IPN_SPLIT) == 0) 663 nat->in_inip &= nat->in_inmsk; 664 if ((nat->in_flags & IPN_IPRANGE) == 0) 665 nat->in_outip &= nat->in_outmsk; 666 } 667 MUTEX_ENTER(&ifs->ifs_ipf_natio); 668 for (np = &ifs->ifs_nat_list; ((n = *np) != NULL); 669 np = &n->in_next) 670 if (!bcmp((char *)&nat->in_flags, (char *)&n->in_flags, 671 IPN_CMPSIZ)) 672 break; 673 } 674 675 switch (cmd) 676 { 677 case SIOCGENITER : 678 { 679 ipfgeniter_t iter; 680 ipftoken_t *token; 681 682 error = fr_inobj(data, &iter, IPFOBJ_GENITER); 683 if (error != 0) 684 break; 685 686 token = ipf_findtoken(iter.igi_type, uid, ctx, ifs); 687 if (token != NULL) 688 error = nat_iterator(token, &iter, ifs); 689 else 690 error = ESRCH; 691 RWLOCK_EXIT(&ifs->ifs_ipf_tokens); 692 break; 693 } 694 #ifdef IPFILTER_LOG 695 case SIOCIPFFB : 696 { 697 int tmp; 698 699 if (!(mode & FWRITE)) 700 error = EPERM; 701 else { 702 tmp = ipflog_clear(IPL_LOGNAT, ifs); 703 BCOPYOUT((char *)&tmp, (char *)data, sizeof(tmp)); 704 } 705 break; 706 } 707 case SIOCSETLG : 708 if (!(mode & FWRITE)) 709 error = EPERM; 710 else { 711 BCOPYIN((char *)data, 712 (char *)&ifs->ifs_nat_logging, 713 sizeof(ifs->ifs_nat_logging)); 714 } 715 break; 716 case SIOCGETLG : 717 BCOPYOUT((char *)&ifs->ifs_nat_logging, (char *)data, 718 sizeof(ifs->ifs_nat_logging)); 719 break; 720 case FIONREAD : 721 arg = ifs->ifs_iplused[IPL_LOGNAT]; 722 BCOPYOUT(&arg, data, sizeof(arg)); 723 break; 724 #endif 725 case SIOCADNAT : 726 if (!(mode & FWRITE)) { 727 error = EPERM; 728 } else if (n != NULL) { 729 error = EEXIST; 730 } else if (nt == NULL) { 731 error = ENOMEM; 732 } 733 if (error != 0) { 734 MUTEX_EXIT(&ifs->ifs_ipf_natio); 735 break; 736 } 737 bcopy((char *)nat, (char *)nt, sizeof(*n)); 738 error = nat_siocaddnat(nt, np, getlock, ifs); 739 MUTEX_EXIT(&ifs->ifs_ipf_natio); 740 if (error == 0) 741 nt = NULL; 742 break; 743 case SIOCRMNAT : 744 if (!(mode & FWRITE)) { 745 error = EPERM; 746 n = NULL; 747 } else if (n == NULL) { 748 error = ESRCH; 749 } 750 751 if (error != 0) { 752 MUTEX_EXIT(&ifs->ifs_ipf_natio); 753 break; 754 } 755 nat_siocdelnat(n, np, getlock, ifs); 756 757 MUTEX_EXIT(&ifs->ifs_ipf_natio); 758 n = NULL; 759 break; 760 case SIOCGNATS : 761 ifs->ifs_nat_stats.ns_table[0] = ifs->ifs_nat_table[0]; 762 ifs->ifs_nat_stats.ns_table[1] = ifs->ifs_nat_table[1]; 763 ifs->ifs_nat_stats.ns_list = ifs->ifs_nat_list; 764 ifs->ifs_nat_stats.ns_maptable = ifs->ifs_maptable; 765 ifs->ifs_nat_stats.ns_maplist = ifs->ifs_ipf_hm_maplist; 766 ifs->ifs_nat_stats.ns_nattab_max = ifs->ifs_ipf_nattable_max; 767 ifs->ifs_nat_stats.ns_nattab_sz = ifs->ifs_ipf_nattable_sz; 768 ifs->ifs_nat_stats.ns_rultab_sz = ifs->ifs_ipf_natrules_sz; 769 ifs->ifs_nat_stats.ns_rdrtab_sz = ifs->ifs_ipf_rdrrules_sz; 770 ifs->ifs_nat_stats.ns_hostmap_sz = ifs->ifs_ipf_hostmap_sz; 771 ifs->ifs_nat_stats.ns_instances = ifs->ifs_nat_instances; 772 ifs->ifs_nat_stats.ns_apslist = ifs->ifs_ap_sess_list; 773 error = fr_outobj(data, &ifs->ifs_nat_stats, IPFOBJ_NATSTAT); 774 break; 775 case SIOCGNATL : 776 { 777 natlookup_t nl; 778 779 if (getlock) { 780 READ_ENTER(&ifs->ifs_ipf_nat); 781 } 782 error = fr_inobj(data, &nl, IPFOBJ_NATLOOKUP); 783 if (error == 0) { 784 if (nat_lookupredir(&nl, ifs) != NULL) { 785 error = fr_outobj(data, &nl, IPFOBJ_NATLOOKUP); 786 } else { 787 error = ESRCH; 788 } 789 } 790 if (getlock) { 791 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 792 } 793 break; 794 } 795 case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */ 796 if (!(mode & FWRITE)) { 797 error = EPERM; 798 break; 799 } 800 if (getlock) { 801 WRITE_ENTER(&ifs->ifs_ipf_nat); 802 } 803 error = 0; 804 if (arg == 0) 805 ret = nat_flushtable(ifs); 806 else if (arg == 1) 807 ret = nat_clearlist(ifs); 808 else 809 error = EINVAL; 810 if (getlock) { 811 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 812 } 813 if (error == 0) { 814 BCOPYOUT(&ret, data, sizeof(ret)); 815 } 816 break; 817 case SIOCPROXY : 818 error = appr_ioctl(data, cmd, mode, ifs); 819 break; 820 case SIOCSTLCK : 821 if (!(mode & FWRITE)) { 822 error = EPERM; 823 } else { 824 fr_lock(data, &ifs->ifs_fr_nat_lock); 825 } 826 break; 827 case SIOCSTPUT : 828 if ((mode & FWRITE) != 0) { 829 error = fr_natputent(data, getlock, ifs); 830 } else { 831 error = EACCES; 832 } 833 break; 834 case SIOCSTGSZ : 835 if (ifs->ifs_fr_nat_lock) { 836 if (getlock) { 837 READ_ENTER(&ifs->ifs_ipf_nat); 838 } 839 error = fr_natgetsz(data, ifs); 840 if (getlock) { 841 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 842 } 843 } else 844 error = EACCES; 845 break; 846 case SIOCSTGET : 847 if (ifs->ifs_fr_nat_lock) { 848 if (getlock) { 849 READ_ENTER(&ifs->ifs_ipf_nat); 850 } 851 error = fr_natgetent(data, ifs); 852 if (getlock) { 853 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 854 } 855 } else 856 error = EACCES; 857 break; 858 case SIOCIPFDELTOK : 859 (void) BCOPYIN((caddr_t)data, (caddr_t)&arg, sizeof(arg)); 860 error = ipf_deltoken(arg, uid, ctx, ifs); 861 break; 862 default : 863 error = EINVAL; 864 break; 865 } 866 done: 867 if (nt) 868 KFREE(nt); 869 return error; 870 } 871 872 873 /* ------------------------------------------------------------------------ */ 874 /* Function: nat_siocaddnat */ 875 /* Returns: int - 0 == success, != 0 == failure */ 876 /* Parameters: n(I) - pointer to new NAT rule */ 877 /* np(I) - pointer to where to insert new NAT rule */ 878 /* getlock(I) - flag indicating if lock on ipf_nat is held */ 879 /* Mutex Locks: ipf_natio */ 880 /* */ 881 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */ 882 /* from information passed to the kernel, then add it to the appropriate */ 883 /* NAT rule table(s). */ 884 /* ------------------------------------------------------------------------ */ 885 static int nat_siocaddnat(n, np, getlock, ifs) 886 ipnat_t *n, **np; 887 int getlock; 888 ipf_stack_t *ifs; 889 { 890 int error = 0, i, j; 891 892 if (nat_resolverule(n, ifs) != 0) 893 return ENOENT; 894 895 if ((n->in_age[0] == 0) && (n->in_age[1] != 0)) 896 return EINVAL; 897 898 n->in_use = 0; 899 if (n->in_redir & NAT_MAPBLK) 900 n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk); 901 else if (n->in_flags & IPN_AUTOPORTMAP) 902 n->in_space = USABLE_PORTS * ~ntohl(n->in_inmsk); 903 else if (n->in_flags & IPN_IPRANGE) 904 n->in_space = ntohl(n->in_outmsk) - ntohl(n->in_outip); 905 else if (n->in_flags & IPN_SPLIT) 906 n->in_space = 2; 907 else if (n->in_outmsk != 0) 908 n->in_space = ~ntohl(n->in_outmsk); 909 else 910 n->in_space = 1; 911 912 /* 913 * Calculate the number of valid IP addresses in the output 914 * mapping range. In all cases, the range is inclusive of 915 * the start and ending IP addresses. 916 * If to a CIDR address, lose 2: broadcast + network address 917 * (so subtract 1) 918 * If to a range, add one. 919 * If to a single IP address, set to 1. 920 */ 921 if (n->in_space) { 922 if ((n->in_flags & IPN_IPRANGE) != 0) 923 n->in_space += 1; 924 else 925 n->in_space -= 1; 926 } else 927 n->in_space = 1; 928 929 if ((n->in_outmsk != 0xffffffff) && (n->in_outmsk != 0) && 930 ((n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0)) 931 n->in_nip = ntohl(n->in_outip) + 1; 932 else if ((n->in_flags & IPN_SPLIT) && 933 (n->in_redir & NAT_REDIRECT)) 934 n->in_nip = ntohl(n->in_inip); 935 else 936 n->in_nip = ntohl(n->in_outip); 937 if (n->in_redir & NAT_MAP) { 938 n->in_pnext = ntohs(n->in_pmin); 939 /* 940 * Multiply by the number of ports made available. 941 */ 942 if (ntohs(n->in_pmax) >= ntohs(n->in_pmin)) { 943 n->in_space *= (ntohs(n->in_pmax) - 944 ntohs(n->in_pmin) + 1); 945 /* 946 * Because two different sources can map to 947 * different destinations but use the same 948 * local IP#/port #. 949 * If the result is smaller than in_space, then 950 * we may have wrapped around 32bits. 951 */ 952 i = n->in_inmsk; 953 if ((i != 0) && (i != 0xffffffff)) { 954 j = n->in_space * (~ntohl(i) + 1); 955 if (j >= n->in_space) 956 n->in_space = j; 957 else 958 n->in_space = 0xffffffff; 959 } 960 } 961 /* 962 * If no protocol is specified, multiple by 256 to allow for 963 * at least one IP:IP mapping per protocol. 964 */ 965 if ((n->in_flags & IPN_TCPUDPICMP) == 0) { 966 j = n->in_space * 256; 967 if (j >= n->in_space) 968 n->in_space = j; 969 else 970 n->in_space = 0xffffffff; 971 } 972 } 973 974 /* Otherwise, these fields are preset */ 975 976 if (getlock) { 977 WRITE_ENTER(&ifs->ifs_ipf_nat); 978 } 979 n->in_next = NULL; 980 *np = n; 981 982 if (n->in_age[0] != 0) 983 n->in_tqehead[0] = fr_addtimeoutqueue(&ifs->ifs_nat_utqe, 984 n->in_age[0], ifs); 985 986 if (n->in_age[1] != 0) 987 n->in_tqehead[1] = fr_addtimeoutqueue(&ifs->ifs_nat_utqe, 988 n->in_age[1], ifs); 989 990 if (n->in_redir & NAT_REDIRECT) { 991 n->in_flags &= ~IPN_NOTDST; 992 nat_addrdr(n, ifs); 993 } 994 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) { 995 n->in_flags &= ~IPN_NOTSRC; 996 nat_addnat(n, ifs); 997 } 998 n = NULL; 999 ifs->ifs_nat_stats.ns_rules++; 1000 if (getlock) { 1001 RWLOCK_EXIT(&ifs->ifs_ipf_nat); /* WRITE */ 1002 } 1003 1004 return error; 1005 } 1006 1007 1008 /* ------------------------------------------------------------------------ */ 1009 /* Function: nat_resolvrule */ 1010 /* Returns: int - 0 == success, -1 == failure */ 1011 /* Parameters: n(I) - pointer to NAT rule */ 1012 /* */ 1013 /* Resolve some of the details inside the NAT rule. Includes resolving */ 1014 /* any specified interfaces and proxy labels, and determines whether or not */ 1015 /* all proxy labels are correctly specified. */ 1016 /* */ 1017 /* Called by nat_siocaddnat() (SIOCADNAT) and fr_natputent (SIOCSTPUT). */ 1018 /* ------------------------------------------------------------------------ */ 1019 static int nat_resolverule(n, ifs) 1020 ipnat_t *n; 1021 ipf_stack_t *ifs; 1022 { 1023 n->in_ifnames[0][LIFNAMSIZ - 1] = '\0'; 1024 n->in_ifps[0] = fr_resolvenic(n->in_ifnames[0], 4, ifs); 1025 1026 n->in_ifnames[1][LIFNAMSIZ - 1] = '\0'; 1027 if (n->in_ifnames[1][0] == '\0') { 1028 (void) strncpy(n->in_ifnames[1], n->in_ifnames[0], LIFNAMSIZ); 1029 n->in_ifps[1] = n->in_ifps[0]; 1030 } else { 1031 n->in_ifps[1] = fr_resolvenic(n->in_ifnames[1], 4, ifs); 1032 } 1033 1034 if (n->in_plabel[0] != '\0') { 1035 n->in_apr = appr_lookup(n->in_p, n->in_plabel, ifs); 1036 if (n->in_apr == NULL) 1037 return -1; 1038 } 1039 return 0; 1040 } 1041 1042 1043 /* ------------------------------------------------------------------------ */ 1044 /* Function: nat_siocdelnat */ 1045 /* Returns: int - 0 == success, != 0 == failure */ 1046 /* Parameters: n(I) - pointer to new NAT rule */ 1047 /* np(I) - pointer to where to insert new NAT rule */ 1048 /* getlock(I) - flag indicating if lock on ipf_nat is held */ 1049 /* Mutex Locks: ipf_natio */ 1050 /* */ 1051 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */ 1052 /* from information passed to the kernel, then add it to the appropriate */ 1053 /* NAT rule table(s). */ 1054 /* ------------------------------------------------------------------------ */ 1055 static void nat_siocdelnat(n, np, getlock, ifs) 1056 ipnat_t *n, **np; 1057 int getlock; 1058 ipf_stack_t *ifs; 1059 { 1060 if (getlock) { 1061 WRITE_ENTER(&ifs->ifs_ipf_nat); 1062 } 1063 if (n->in_redir & NAT_REDIRECT) 1064 nat_delrdr(n); 1065 if (n->in_redir & (NAT_MAPBLK|NAT_MAP)) 1066 nat_delnat(n); 1067 if (ifs->ifs_nat_list == NULL) { 1068 ifs->ifs_nat_masks = 0; 1069 ifs->ifs_rdr_masks = 0; 1070 } 1071 1072 if (n->in_tqehead[0] != NULL) { 1073 if (fr_deletetimeoutqueue(n->in_tqehead[0]) == 0) { 1074 fr_freetimeoutqueue(n->in_tqehead[1], ifs); 1075 } 1076 } 1077 1078 if (n->in_tqehead[1] != NULL) { 1079 if (fr_deletetimeoutqueue(n->in_tqehead[1]) == 0) { 1080 fr_freetimeoutqueue(n->in_tqehead[1], ifs); 1081 } 1082 } 1083 1084 *np = n->in_next; 1085 1086 if (n->in_use == 0) { 1087 if (n->in_apr) 1088 appr_free(n->in_apr); 1089 KFREE(n); 1090 ifs->ifs_nat_stats.ns_rules--; 1091 } else { 1092 n->in_flags |= IPN_DELETE; 1093 n->in_next = NULL; 1094 } 1095 if (getlock) { 1096 RWLOCK_EXIT(&ifs->ifs_ipf_nat); /* READ/WRITE */ 1097 } 1098 } 1099 1100 1101 /* ------------------------------------------------------------------------ */ 1102 /* Function: fr_natgetsz */ 1103 /* Returns: int - 0 == success, != 0 is the error value. */ 1104 /* Parameters: data(I) - pointer to natget structure with kernel pointer */ 1105 /* get the size of. */ 1106 /* */ 1107 /* Handle SIOCSTGSZ. */ 1108 /* Return the size of the nat list entry to be copied back to user space. */ 1109 /* The size of the entry is stored in the ng_sz field and the enture natget */ 1110 /* structure is copied back to the user. */ 1111 /* ------------------------------------------------------------------------ */ 1112 static int fr_natgetsz(data, ifs) 1113 caddr_t data; 1114 ipf_stack_t *ifs; 1115 { 1116 ap_session_t *aps; 1117 nat_t *nat, *n; 1118 natget_t ng; 1119 1120 BCOPYIN(data, &ng, sizeof(ng)); 1121 1122 nat = ng.ng_ptr; 1123 if (!nat) { 1124 nat = ifs->ifs_nat_instances; 1125 ng.ng_sz = 0; 1126 /* 1127 * Empty list so the size returned is 0. Simple. 1128 */ 1129 if (nat == NULL) { 1130 BCOPYOUT(&ng, data, sizeof(ng)); 1131 return 0; 1132 } 1133 } else { 1134 /* 1135 * Make sure the pointer we're copying from exists in the 1136 * current list of entries. Security precaution to prevent 1137 * copying of random kernel data. 1138 */ 1139 for (n = ifs->ifs_nat_instances; n; n = n->nat_next) 1140 if (n == nat) 1141 break; 1142 if (!n) 1143 return ESRCH; 1144 } 1145 1146 /* 1147 * Incluse any space required for proxy data structures. 1148 */ 1149 ng.ng_sz = sizeof(nat_save_t); 1150 aps = nat->nat_aps; 1151 if (aps != NULL) { 1152 ng.ng_sz += sizeof(ap_session_t) - 4; 1153 if (aps->aps_data != 0) 1154 ng.ng_sz += aps->aps_psiz; 1155 } 1156 1157 BCOPYOUT(&ng, data, sizeof(ng)); 1158 return 0; 1159 } 1160 1161 1162 /* ------------------------------------------------------------------------ */ 1163 /* Function: fr_natgetent */ 1164 /* Returns: int - 0 == success, != 0 is the error value. */ 1165 /* Parameters: data(I) - pointer to natget structure with kernel pointer */ 1166 /* to NAT structure to copy out. */ 1167 /* */ 1168 /* Handle SIOCSTGET. */ 1169 /* Copies out NAT entry to user space. Any additional data held for a */ 1170 /* proxy is also copied, as to is the NAT rule which was responsible for it */ 1171 /* ------------------------------------------------------------------------ */ 1172 static int fr_natgetent(data, ifs) 1173 caddr_t data; 1174 ipf_stack_t *ifs; 1175 { 1176 int error, outsize; 1177 ap_session_t *aps; 1178 nat_save_t *ipn, ipns; 1179 nat_t *n, *nat; 1180 1181 error = fr_inobj(data, &ipns, IPFOBJ_NATSAVE); 1182 if (error != 0) 1183 return error; 1184 1185 if ((ipns.ipn_dsize < sizeof(ipns)) || (ipns.ipn_dsize > 81920)) 1186 return EINVAL; 1187 1188 KMALLOCS(ipn, nat_save_t *, ipns.ipn_dsize); 1189 if (ipn == NULL) 1190 return ENOMEM; 1191 1192 ipn->ipn_dsize = ipns.ipn_dsize; 1193 nat = ipns.ipn_next; 1194 if (nat == NULL) { 1195 nat = ifs->ifs_nat_instances; 1196 if (nat == NULL) { 1197 if (ifs->ifs_nat_instances == NULL) 1198 error = ENOENT; 1199 goto finished; 1200 } 1201 } else { 1202 /* 1203 * Make sure the pointer we're copying from exists in the 1204 * current list of entries. Security precaution to prevent 1205 * copying of random kernel data. 1206 */ 1207 for (n = ifs->ifs_nat_instances; n; n = n->nat_next) 1208 if (n == nat) 1209 break; 1210 if (n == NULL) { 1211 error = ESRCH; 1212 goto finished; 1213 } 1214 } 1215 ipn->ipn_next = nat->nat_next; 1216 1217 /* 1218 * Copy the NAT structure. 1219 */ 1220 bcopy((char *)nat, &ipn->ipn_nat, sizeof(*nat)); 1221 1222 /* 1223 * If we have a pointer to the NAT rule it belongs to, save that too. 1224 */ 1225 if (nat->nat_ptr != NULL) 1226 bcopy((char *)nat->nat_ptr, (char *)&ipn->ipn_ipnat, 1227 sizeof(ipn->ipn_ipnat)); 1228 1229 /* 1230 * If we also know the NAT entry has an associated filter rule, 1231 * save that too. 1232 */ 1233 if (nat->nat_fr != NULL) 1234 bcopy((char *)nat->nat_fr, (char *)&ipn->ipn_fr, 1235 sizeof(ipn->ipn_fr)); 1236 1237 /* 1238 * Last but not least, if there is an application proxy session set 1239 * up for this NAT entry, then copy that out too, including any 1240 * private data saved along side it by the proxy. 1241 */ 1242 aps = nat->nat_aps; 1243 outsize = ipn->ipn_dsize - sizeof(*ipn) + sizeof(ipn->ipn_data); 1244 if (aps != NULL) { 1245 char *s; 1246 1247 if (outsize < sizeof(*aps)) { 1248 error = ENOBUFS; 1249 goto finished; 1250 } 1251 1252 s = ipn->ipn_data; 1253 bcopy((char *)aps, s, sizeof(*aps)); 1254 s += sizeof(*aps); 1255 outsize -= sizeof(*aps); 1256 if ((aps->aps_data != NULL) && (outsize >= aps->aps_psiz)) 1257 bcopy(aps->aps_data, s, aps->aps_psiz); 1258 else 1259 error = ENOBUFS; 1260 } 1261 if (error == 0) { 1262 error = fr_outobjsz(data, ipn, IPFOBJ_NATSAVE, ipns.ipn_dsize); 1263 } 1264 1265 finished: 1266 if (ipn != NULL) { 1267 KFREES(ipn, ipns.ipn_dsize); 1268 } 1269 return error; 1270 } 1271 1272 1273 /* ------------------------------------------------------------------------ */ 1274 /* Function: fr_natputent */ 1275 /* Returns: int - 0 == success, != 0 is the error value. */ 1276 /* Parameters: data(I) - pointer to natget structure with NAT */ 1277 /* structure information to load into the kernel */ 1278 /* getlock(I) - flag indicating whether or not a write lock */ 1279 /* on ipf_nat is already held. */ 1280 /* */ 1281 /* Handle SIOCSTPUT. */ 1282 /* Loads a NAT table entry from user space, including a NAT rule, proxy and */ 1283 /* firewall rule data structures, if pointers to them indicate so. */ 1284 /* ------------------------------------------------------------------------ */ 1285 static int fr_natputent(data, getlock, ifs) 1286 caddr_t data; 1287 int getlock; 1288 ipf_stack_t *ifs; 1289 { 1290 nat_save_t ipn, *ipnn; 1291 ap_session_t *aps; 1292 nat_t *n, *nat; 1293 frentry_t *fr; 1294 fr_info_t fin; 1295 ipnat_t *in; 1296 int error; 1297 1298 error = fr_inobj(data, &ipn, IPFOBJ_NATSAVE); 1299 if (error != 0) 1300 return error; 1301 1302 /* 1303 * Initialise early because of code at junkput label. 1304 */ 1305 in = NULL; 1306 aps = NULL; 1307 nat = NULL; 1308 ipnn = NULL; 1309 1310 /* 1311 * New entry, copy in the rest of the NAT entry if it's size is more 1312 * than just the nat_t structure. 1313 */ 1314 fr = NULL; 1315 if (ipn.ipn_dsize > sizeof(ipn)) { 1316 if (ipn.ipn_dsize > 81920) { 1317 error = ENOMEM; 1318 goto junkput; 1319 } 1320 1321 KMALLOCS(ipnn, nat_save_t *, ipn.ipn_dsize); 1322 if (ipnn == NULL) 1323 return ENOMEM; 1324 1325 error = fr_inobjsz(data, ipnn, IPFOBJ_NATSAVE, ipn.ipn_dsize); 1326 if (error != 0) { 1327 error = EFAULT; 1328 goto junkput; 1329 } 1330 } else 1331 ipnn = &ipn; 1332 1333 KMALLOC(nat, nat_t *); 1334 if (nat == NULL) { 1335 error = ENOMEM; 1336 goto junkput; 1337 } 1338 1339 bcopy((char *)&ipnn->ipn_nat, (char *)nat, sizeof(*nat)); 1340 /* 1341 * Initialize all these so that nat_delete() doesn't cause a crash. 1342 */ 1343 bzero((char *)nat, offsetof(struct nat, nat_tqe)); 1344 nat->nat_tqe.tqe_pnext = NULL; 1345 nat->nat_tqe.tqe_next = NULL; 1346 nat->nat_tqe.tqe_ifq = NULL; 1347 nat->nat_tqe.tqe_parent = nat; 1348 1349 /* 1350 * Restore the rule associated with this nat session 1351 */ 1352 in = ipnn->ipn_nat.nat_ptr; 1353 if (in != NULL) { 1354 KMALLOC(in, ipnat_t *); 1355 nat->nat_ptr = in; 1356 if (in == NULL) { 1357 error = ENOMEM; 1358 goto junkput; 1359 } 1360 bzero((char *)in, offsetof(struct ipnat, in_next6)); 1361 bcopy((char *)&ipnn->ipn_ipnat, (char *)in, sizeof(*in)); 1362 in->in_use = 1; 1363 in->in_flags |= IPN_DELETE; 1364 1365 ATOMIC_INC(ifs->ifs_nat_stats.ns_rules); 1366 1367 if (nat_resolverule(in, ifs) != 0) { 1368 error = ESRCH; 1369 goto junkput; 1370 } 1371 } 1372 1373 /* 1374 * Check that the NAT entry doesn't already exist in the kernel. 1375 */ 1376 bzero((char *)&fin, sizeof(fin)); 1377 fin.fin_p = nat->nat_p; 1378 fin.fin_ifs = ifs; 1379 if (nat->nat_dir == NAT_OUTBOUND) { 1380 fin.fin_data[0] = ntohs(nat->nat_oport); 1381 fin.fin_data[1] = ntohs(nat->nat_outport); 1382 fin.fin_ifp = nat->nat_ifps[0]; 1383 if (getlock) { 1384 READ_ENTER(&ifs->ifs_ipf_nat); 1385 } 1386 n = nat_inlookup(&fin, nat->nat_flags, fin.fin_p, 1387 nat->nat_oip, nat->nat_outip); 1388 if (getlock) { 1389 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1390 } 1391 if (n != NULL) { 1392 error = EEXIST; 1393 goto junkput; 1394 } 1395 } else if (nat->nat_dir == NAT_INBOUND) { 1396 fin.fin_data[0] = ntohs(nat->nat_inport); 1397 fin.fin_data[1] = ntohs(nat->nat_oport); 1398 fin.fin_ifp = nat->nat_ifps[1]; 1399 if (getlock) { 1400 READ_ENTER(&ifs->ifs_ipf_nat); 1401 } 1402 n = nat_outlookup(&fin, nat->nat_flags, fin.fin_p, 1403 nat->nat_inip, nat->nat_oip); 1404 if (getlock) { 1405 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1406 } 1407 if (n != NULL) { 1408 error = EEXIST; 1409 goto junkput; 1410 } 1411 } else { 1412 error = EINVAL; 1413 goto junkput; 1414 } 1415 1416 /* 1417 * Restore ap_session_t structure. Include the private data allocated 1418 * if it was there. 1419 */ 1420 aps = nat->nat_aps; 1421 if (aps != NULL) { 1422 KMALLOC(aps, ap_session_t *); 1423 nat->nat_aps = aps; 1424 if (aps == NULL) { 1425 error = ENOMEM; 1426 goto junkput; 1427 } 1428 bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps)); 1429 if (in != NULL) 1430 aps->aps_apr = in->in_apr; 1431 else 1432 aps->aps_apr = NULL; 1433 if (aps->aps_psiz != 0) { 1434 if (aps->aps_psiz > 81920) { 1435 error = ENOMEM; 1436 goto junkput; 1437 } 1438 KMALLOCS(aps->aps_data, void *, aps->aps_psiz); 1439 if (aps->aps_data == NULL) { 1440 error = ENOMEM; 1441 goto junkput; 1442 } 1443 bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data, 1444 aps->aps_psiz); 1445 } else { 1446 aps->aps_psiz = 0; 1447 aps->aps_data = NULL; 1448 } 1449 } 1450 1451 /* 1452 * If there was a filtering rule associated with this entry then 1453 * build up a new one. 1454 */ 1455 fr = nat->nat_fr; 1456 if (fr != NULL) { 1457 if ((nat->nat_flags & SI_NEWFR) != 0) { 1458 KMALLOC(fr, frentry_t *); 1459 nat->nat_fr = fr; 1460 if (fr == NULL) { 1461 error = ENOMEM; 1462 goto junkput; 1463 } 1464 ipnn->ipn_nat.nat_fr = fr; 1465 (void) fr_outobj(data, ipnn, IPFOBJ_NATSAVE); 1466 bcopy((char *)&ipnn->ipn_fr, (char *)fr, sizeof(*fr)); 1467 1468 fr->fr_ref = 1; 1469 fr->fr_dsize = 0; 1470 fr->fr_data = NULL; 1471 fr->fr_type = FR_T_NONE; 1472 1473 MUTEX_NUKE(&fr->fr_lock); 1474 MUTEX_INIT(&fr->fr_lock, "nat-filter rule lock"); 1475 } else { 1476 if (getlock) { 1477 READ_ENTER(&ifs->ifs_ipf_nat); 1478 } 1479 for (n = ifs->ifs_nat_instances; n; n = n->nat_next) 1480 if (n->nat_fr == fr) 1481 break; 1482 1483 if (n != NULL) { 1484 MUTEX_ENTER(&fr->fr_lock); 1485 fr->fr_ref++; 1486 MUTEX_EXIT(&fr->fr_lock); 1487 } 1488 if (getlock) { 1489 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1490 } 1491 if (!n) { 1492 error = ESRCH; 1493 goto junkput; 1494 } 1495 } 1496 } 1497 1498 if (ipnn != &ipn) { 1499 KFREES(ipnn, ipn.ipn_dsize); 1500 ipnn = NULL; 1501 } 1502 1503 if (getlock) { 1504 WRITE_ENTER(&ifs->ifs_ipf_nat); 1505 } 1506 error = nat_insert(nat, nat->nat_rev, ifs); 1507 if ((error == 0) && (aps != NULL)) { 1508 aps->aps_next = ifs->ifs_ap_sess_list; 1509 ifs->ifs_ap_sess_list = aps; 1510 } 1511 if (getlock) { 1512 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 1513 } 1514 1515 if (error == 0) 1516 return 0; 1517 1518 error = ENOMEM; 1519 1520 junkput: 1521 if (fr != NULL) 1522 (void) fr_derefrule(&fr, ifs); 1523 1524 if ((ipnn != NULL) && (ipnn != &ipn)) { 1525 KFREES(ipnn, ipn.ipn_dsize); 1526 } 1527 if (nat != NULL) { 1528 if (aps != NULL) { 1529 if (aps->aps_data != NULL) { 1530 KFREES(aps->aps_data, aps->aps_psiz); 1531 } 1532 KFREE(aps); 1533 } 1534 if (in != NULL) { 1535 if (in->in_apr) 1536 appr_free(in->in_apr); 1537 KFREE(in); 1538 } 1539 KFREE(nat); 1540 } 1541 return error; 1542 } 1543 1544 1545 /* ------------------------------------------------------------------------ */ 1546 /* Function: nat_delete */ 1547 /* Returns: Nil */ 1548 /* Parameters: natd(I) - pointer to NAT structure to delete */ 1549 /* logtype(I) - type of LOG record to create before deleting */ 1550 /* Write Lock: ipf_nat */ 1551 /* */ 1552 /* Delete a nat entry from the various lists and table. If NAT logging is */ 1553 /* enabled then generate a NAT log record for this event. */ 1554 /* ------------------------------------------------------------------------ */ 1555 static void nat_delete(nat, logtype, ifs) 1556 struct nat *nat; 1557 int logtype; 1558 ipf_stack_t *ifs; 1559 { 1560 struct ipnat *ipn; 1561 1562 if (logtype != 0 && ifs->ifs_nat_logging != 0) 1563 nat_log(nat, logtype, ifs); 1564 1565 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 1566 1567 /* 1568 * Take it as a general indication that all the pointers are set if 1569 * nat_pnext is set. 1570 */ 1571 if (nat->nat_pnext != NULL) { 1572 ifs->ifs_nat_stats.ns_bucketlen[0][nat->nat_hv[0]]--; 1573 ifs->ifs_nat_stats.ns_bucketlen[1][nat->nat_hv[1]]--; 1574 1575 *nat->nat_pnext = nat->nat_next; 1576 if (nat->nat_next != NULL) { 1577 nat->nat_next->nat_pnext = nat->nat_pnext; 1578 nat->nat_next = NULL; 1579 } 1580 nat->nat_pnext = NULL; 1581 1582 *nat->nat_phnext[0] = nat->nat_hnext[0]; 1583 if (nat->nat_hnext[0] != NULL) { 1584 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; 1585 nat->nat_hnext[0] = NULL; 1586 } 1587 nat->nat_phnext[0] = NULL; 1588 1589 *nat->nat_phnext[1] = nat->nat_hnext[1]; 1590 if (nat->nat_hnext[1] != NULL) { 1591 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; 1592 nat->nat_hnext[1] = NULL; 1593 } 1594 nat->nat_phnext[1] = NULL; 1595 1596 if ((nat->nat_flags & SI_WILDP) != 0) 1597 ifs->ifs_nat_stats.ns_wilds--; 1598 } 1599 1600 if (nat->nat_me != NULL) { 1601 *nat->nat_me = NULL; 1602 nat->nat_me = NULL; 1603 } 1604 1605 fr_deletequeueentry(&nat->nat_tqe); 1606 1607 nat->nat_ref--; 1608 if (nat->nat_ref > 0) { 1609 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 1610 return; 1611 } 1612 1613 #ifdef IPFILTER_SYNC 1614 if (nat->nat_sync) 1615 ipfsync_del(nat->nat_sync); 1616 #endif 1617 1618 if (nat->nat_fr != NULL) 1619 (void)fr_derefrule(&nat->nat_fr, ifs); 1620 1621 if (nat->nat_hm != NULL) 1622 nat_hostmapdel(nat->nat_hm); 1623 1624 /* 1625 * If there is an active reference from the nat entry to its parent 1626 * rule, decrement the rule's reference count and free it too if no 1627 * longer being used. 1628 */ 1629 ipn = nat->nat_ptr; 1630 if (ipn != NULL) { 1631 ipn->in_space++; 1632 ipn->in_use--; 1633 if (ipn->in_use == 0 && (ipn->in_flags & IPN_DELETE)) { 1634 if (ipn->in_apr) 1635 appr_free(ipn->in_apr); 1636 KFREE(ipn); 1637 ifs->ifs_nat_stats.ns_rules--; 1638 } 1639 } 1640 1641 MUTEX_DESTROY(&nat->nat_lock); 1642 1643 aps_free(nat->nat_aps, ifs); 1644 ifs->ifs_nat_stats.ns_inuse--; 1645 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 1646 1647 /* 1648 * If there's a fragment table entry too for this nat entry, then 1649 * dereference that as well. This is after nat_lock is released 1650 * because of Tru64. 1651 */ 1652 fr_forgetnat((void *)nat, ifs); 1653 1654 KFREE(nat); 1655 } 1656 1657 1658 /* ------------------------------------------------------------------------ */ 1659 /* Function: nat_flushtable */ 1660 /* Returns: int - number of NAT rules deleted */ 1661 /* Parameters: Nil */ 1662 /* */ 1663 /* Deletes all currently active NAT sessions. In deleting each NAT entry a */ 1664 /* log record should be emitted in nat_delete() if NAT logging is enabled. */ 1665 /* ------------------------------------------------------------------------ */ 1666 /* 1667 * nat_flushtable - clear the NAT table of all mapping entries. 1668 */ 1669 static int nat_flushtable(ifs) 1670 ipf_stack_t *ifs; 1671 { 1672 nat_t *nat; 1673 int j = 0; 1674 1675 /* 1676 * ALL NAT mappings deleted, so lets just make the deletions 1677 * quicker. 1678 */ 1679 if (ifs->ifs_nat_table[0] != NULL) 1680 bzero((char *)ifs->ifs_nat_table[0], 1681 sizeof(ifs->ifs_nat_table[0]) * ifs->ifs_ipf_nattable_sz); 1682 if (ifs->ifs_nat_table[1] != NULL) 1683 bzero((char *)ifs->ifs_nat_table[1], 1684 sizeof(ifs->ifs_nat_table[1]) * ifs->ifs_ipf_nattable_sz); 1685 1686 while ((nat = ifs->ifs_nat_instances) != NULL) { 1687 nat_delete(nat, NL_FLUSH, ifs); 1688 j++; 1689 } 1690 1691 ifs->ifs_nat_stats.ns_inuse = 0; 1692 return j; 1693 } 1694 1695 1696 /* ------------------------------------------------------------------------ */ 1697 /* Function: nat_clearlist */ 1698 /* Returns: int - number of NAT/RDR rules deleted */ 1699 /* Parameters: Nil */ 1700 /* */ 1701 /* Delete all rules in the current list of rules. There is nothing elegant */ 1702 /* about this cleanup: simply free all entries on the list of rules and */ 1703 /* clear out the tables used for hashed NAT rule lookups. */ 1704 /* ------------------------------------------------------------------------ */ 1705 static int nat_clearlist(ifs) 1706 ipf_stack_t *ifs; 1707 { 1708 ipnat_t *n, **np = &ifs->ifs_nat_list; 1709 int i = 0; 1710 1711 if (ifs->ifs_nat_rules != NULL) 1712 bzero((char *)ifs->ifs_nat_rules, 1713 sizeof(*ifs->ifs_nat_rules) * ifs->ifs_ipf_natrules_sz); 1714 if (ifs->ifs_rdr_rules != NULL) 1715 bzero((char *)ifs->ifs_rdr_rules, 1716 sizeof(*ifs->ifs_rdr_rules) * ifs->ifs_ipf_rdrrules_sz); 1717 1718 while ((n = *np) != NULL) { 1719 *np = n->in_next; 1720 if (n->in_use == 0) { 1721 if (n->in_apr != NULL) 1722 appr_free(n->in_apr); 1723 KFREE(n); 1724 ifs->ifs_nat_stats.ns_rules--; 1725 } else { 1726 n->in_flags |= IPN_DELETE; 1727 n->in_next = NULL; 1728 } 1729 i++; 1730 } 1731 ifs->ifs_nat_masks = 0; 1732 ifs->ifs_rdr_masks = 0; 1733 return i; 1734 } 1735 1736 1737 /* ------------------------------------------------------------------------ */ 1738 /* Function: nat_newmap */ 1739 /* Returns: int - -1 == error, 0 == success */ 1740 /* Parameters: fin(I) - pointer to packet information */ 1741 /* nat(I) - pointer to NAT entry */ 1742 /* ni(I) - pointer to structure with misc. information needed */ 1743 /* to create new NAT entry. */ 1744 /* */ 1745 /* Given an empty NAT structure, populate it with new information about a */ 1746 /* new NAT session, as defined by the matching NAT rule. */ 1747 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/ 1748 /* to the new IP address for the translation. */ 1749 /* ------------------------------------------------------------------------ */ 1750 static INLINE int nat_newmap(fin, nat, ni) 1751 fr_info_t *fin; 1752 nat_t *nat; 1753 natinfo_t *ni; 1754 { 1755 u_short st_port, dport, sport, port, sp, dp; 1756 struct in_addr in, inb; 1757 hostmap_t *hm; 1758 u_32_t flags; 1759 u_32_t st_ip; 1760 ipnat_t *np; 1761 nat_t *natl; 1762 int l; 1763 ipf_stack_t *ifs = fin->fin_ifs; 1764 1765 /* 1766 * If it's an outbound packet which doesn't match any existing 1767 * record, then create a new port 1768 */ 1769 l = 0; 1770 hm = NULL; 1771 np = ni->nai_np; 1772 st_ip = np->in_nip; 1773 st_port = np->in_pnext; 1774 flags = ni->nai_flags; 1775 sport = ni->nai_sport; 1776 dport = ni->nai_dport; 1777 1778 /* 1779 * Do a loop until we either run out of entries to try or we find 1780 * a NAT mapping that isn't currently being used. This is done 1781 * because the change to the source is not (usually) being fixed. 1782 */ 1783 do { 1784 port = 0; 1785 in.s_addr = htonl(np->in_nip); 1786 if (l == 0) { 1787 /* 1788 * Check to see if there is an existing NAT 1789 * setup for this IP address pair. 1790 */ 1791 hm = nat_hostmap(np, fin->fin_src, fin->fin_dst, 1792 in, 0, ifs); 1793 if (hm != NULL) 1794 in.s_addr = hm->hm_mapip.s_addr; 1795 } else if ((l == 1) && (hm != NULL)) { 1796 nat_hostmapdel(hm); 1797 hm = NULL; 1798 } 1799 in.s_addr = ntohl(in.s_addr); 1800 1801 nat->nat_hm = hm; 1802 1803 if ((np->in_outmsk == 0xffffffff) && (np->in_pnext == 0)) { 1804 if (l > 0) 1805 return -1; 1806 } 1807 1808 if (np->in_redir == NAT_BIMAP && 1809 np->in_inmsk == np->in_outmsk) { 1810 /* 1811 * map the address block in a 1:1 fashion 1812 */ 1813 in.s_addr = np->in_outip; 1814 in.s_addr |= fin->fin_saddr & ~np->in_inmsk; 1815 in.s_addr = ntohl(in.s_addr); 1816 1817 } else if (np->in_redir & NAT_MAPBLK) { 1818 if ((l >= np->in_ppip) || ((l > 0) && 1819 !(flags & IPN_TCPUDP))) 1820 return -1; 1821 /* 1822 * map-block - Calculate destination address. 1823 */ 1824 in.s_addr = ntohl(fin->fin_saddr); 1825 in.s_addr &= ntohl(~np->in_inmsk); 1826 inb.s_addr = in.s_addr; 1827 in.s_addr /= np->in_ippip; 1828 in.s_addr &= ntohl(~np->in_outmsk); 1829 in.s_addr += ntohl(np->in_outip); 1830 /* 1831 * Calculate destination port. 1832 */ 1833 if ((flags & IPN_TCPUDP) && 1834 (np->in_ppip != 0)) { 1835 port = ntohs(sport) + l; 1836 port %= np->in_ppip; 1837 port += np->in_ppip * 1838 (inb.s_addr % np->in_ippip); 1839 port += MAPBLK_MINPORT; 1840 port = htons(port); 1841 } 1842 1843 } else if ((np->in_outip == 0) && 1844 (np->in_outmsk == 0xffffffff)) { 1845 /* 1846 * 0/32 - use the interface's IP address. 1847 */ 1848 if ((l > 0) || 1849 fr_ifpaddr(4, FRI_NORMAL, fin->fin_ifp, 1850 &in, NULL, fin->fin_ifs) == -1) 1851 return -1; 1852 in.s_addr = ntohl(in.s_addr); 1853 1854 } else if ((np->in_outip == 0) && (np->in_outmsk == 0)) { 1855 /* 1856 * 0/0 - use the original source address/port. 1857 */ 1858 if (l > 0) 1859 return -1; 1860 in.s_addr = ntohl(fin->fin_saddr); 1861 1862 } else if ((np->in_outmsk != 0xffffffff) && 1863 (np->in_pnext == 0) && ((l > 0) || (hm == NULL))) 1864 np->in_nip++; 1865 1866 natl = NULL; 1867 1868 if ((flags & IPN_TCPUDP) && 1869 ((np->in_redir & NAT_MAPBLK) == 0) && 1870 (np->in_flags & IPN_AUTOPORTMAP)) { 1871 /* 1872 * "ports auto" (without map-block) 1873 */ 1874 if ((l > 0) && (l % np->in_ppip == 0)) { 1875 if (l > np->in_space) { 1876 return -1; 1877 } else if ((l > np->in_ppip) && 1878 np->in_outmsk != 0xffffffff) 1879 np->in_nip++; 1880 } 1881 if (np->in_ppip != 0) { 1882 port = ntohs(sport); 1883 port += (l % np->in_ppip); 1884 port %= np->in_ppip; 1885 port += np->in_ppip * 1886 (ntohl(fin->fin_saddr) % 1887 np->in_ippip); 1888 port += MAPBLK_MINPORT; 1889 port = htons(port); 1890 } 1891 1892 } else if (((np->in_redir & NAT_MAPBLK) == 0) && 1893 (flags & IPN_TCPUDPICMP) && (np->in_pnext != 0)) { 1894 /* 1895 * Standard port translation. Select next port. 1896 */ 1897 port = htons(np->in_pnext++); 1898 1899 if (np->in_pnext > ntohs(np->in_pmax)) { 1900 np->in_pnext = ntohs(np->in_pmin); 1901 if (np->in_outmsk != 0xffffffff) 1902 np->in_nip++; 1903 } 1904 } 1905 1906 if (np->in_flags & IPN_IPRANGE) { 1907 if (np->in_nip > ntohl(np->in_outmsk)) 1908 np->in_nip = ntohl(np->in_outip); 1909 } else { 1910 if ((np->in_outmsk != 0xffffffff) && 1911 ((np->in_nip + 1) & ntohl(np->in_outmsk)) > 1912 ntohl(np->in_outip)) 1913 np->in_nip = ntohl(np->in_outip) + 1; 1914 } 1915 1916 if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY))) 1917 port = sport; 1918 1919 /* 1920 * Here we do a lookup of the connection as seen from 1921 * the outside. If an IP# pair already exists, try 1922 * again. So if you have A->B becomes C->B, you can 1923 * also have D->E become C->E but not D->B causing 1924 * another C->B. Also take protocol and ports into 1925 * account when determining whether a pre-existing 1926 * NAT setup will cause an external conflict where 1927 * this is appropriate. 1928 */ 1929 inb.s_addr = htonl(in.s_addr); 1930 sp = fin->fin_data[0]; 1931 dp = fin->fin_data[1]; 1932 fin->fin_data[0] = fin->fin_data[1]; 1933 fin->fin_data[1] = htons(port); 1934 natl = nat_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH), 1935 (u_int)fin->fin_p, fin->fin_dst, inb); 1936 fin->fin_data[0] = sp; 1937 fin->fin_data[1] = dp; 1938 1939 /* 1940 * Has the search wrapped around and come back to the 1941 * start ? 1942 */ 1943 if ((natl != NULL) && 1944 (np->in_pnext != 0) && (st_port == np->in_pnext) && 1945 (np->in_nip != 0) && (st_ip == np->in_nip)) 1946 return -1; 1947 l++; 1948 } while (natl != NULL); 1949 1950 if (np->in_space > 0) 1951 np->in_space--; 1952 1953 /* Setup the NAT table */ 1954 nat->nat_inip = fin->fin_src; 1955 nat->nat_outip.s_addr = htonl(in.s_addr); 1956 nat->nat_oip = fin->fin_dst; 1957 if (nat->nat_hm == NULL) 1958 nat->nat_hm = nat_hostmap(np, fin->fin_src, fin->fin_dst, 1959 nat->nat_outip, 0, ifs); 1960 1961 /* 1962 * The ICMP checksum does not have a pseudo header containing 1963 * the IP addresses 1964 */ 1965 ni->nai_sum1 = LONG_SUM(ntohl(fin->fin_saddr)); 1966 ni->nai_sum2 = LONG_SUM(in.s_addr); 1967 if ((flags & IPN_TCPUDP)) { 1968 ni->nai_sum1 += ntohs(sport); 1969 ni->nai_sum2 += ntohs(port); 1970 } 1971 1972 if (flags & IPN_TCPUDP) { 1973 nat->nat_inport = sport; 1974 nat->nat_outport = port; /* sport */ 1975 nat->nat_oport = dport; 1976 ((tcphdr_t *)fin->fin_dp)->th_sport = port; 1977 } else if (flags & IPN_ICMPQUERY) { 1978 ((icmphdr_t *)fin->fin_dp)->icmp_id = port; 1979 nat->nat_inport = port; 1980 nat->nat_outport = port; 1981 } 1982 1983 ni->nai_ip.s_addr = in.s_addr; 1984 ni->nai_port = port; 1985 ni->nai_nport = dport; 1986 return 0; 1987 } 1988 1989 1990 /* ------------------------------------------------------------------------ */ 1991 /* Function: nat_newrdr */ 1992 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */ 1993 /* allow rule to be moved if IPN_ROUNDR is set. */ 1994 /* Parameters: fin(I) - pointer to packet information */ 1995 /* nat(I) - pointer to NAT entry */ 1996 /* ni(I) - pointer to structure with misc. information needed */ 1997 /* to create new NAT entry. */ 1998 /* */ 1999 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/ 2000 /* to the new IP address for the translation. */ 2001 /* ------------------------------------------------------------------------ */ 2002 static INLINE int nat_newrdr(fin, nat, ni) 2003 fr_info_t *fin; 2004 nat_t *nat; 2005 natinfo_t *ni; 2006 { 2007 u_short nport, dport, sport; 2008 struct in_addr in; 2009 hostmap_t *hm; 2010 u_32_t flags; 2011 ipnat_t *np; 2012 int move; 2013 ipf_stack_t *ifs = fin->fin_ifs; 2014 2015 move = 1; 2016 hm = NULL; 2017 in.s_addr = 0; 2018 np = ni->nai_np; 2019 flags = ni->nai_flags; 2020 sport = ni->nai_sport; 2021 dport = ni->nai_dport; 2022 2023 /* 2024 * If the matching rule has IPN_STICKY set, then we want to have the 2025 * same rule kick in as before. Why would this happen? If you have 2026 * a collection of rdr rules with "round-robin sticky", the current 2027 * packet might match a different one to the previous connection but 2028 * we want the same destination to be used. 2029 */ 2030 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == 2031 (IPN_ROUNDR|IPN_STICKY)) { 2032 hm = nat_hostmap(NULL, fin->fin_src, fin->fin_dst, in, 2033 (u_32_t)dport, ifs); 2034 if (hm != NULL) { 2035 in.s_addr = ntohl(hm->hm_mapip.s_addr); 2036 np = hm->hm_ipnat; 2037 ni->nai_np = np; 2038 move = 0; 2039 } 2040 } 2041 2042 /* 2043 * Otherwise, it's an inbound packet. Most likely, we don't 2044 * want to rewrite source ports and source addresses. Instead, 2045 * we want to rewrite to a fixed internal address and fixed 2046 * internal port. 2047 */ 2048 if (np->in_flags & IPN_SPLIT) { 2049 in.s_addr = np->in_nip; 2050 2051 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) { 2052 hm = nat_hostmap(np, fin->fin_src, fin->fin_dst, 2053 in, (u_32_t)dport, ifs); 2054 if (hm != NULL) { 2055 in.s_addr = hm->hm_mapip.s_addr; 2056 move = 0; 2057 } 2058 } 2059 2060 if (hm == NULL || hm->hm_ref == 1) { 2061 if (np->in_inip == htonl(in.s_addr)) { 2062 np->in_nip = ntohl(np->in_inmsk); 2063 move = 0; 2064 } else { 2065 np->in_nip = ntohl(np->in_inip); 2066 } 2067 } 2068 2069 } else if ((np->in_inip == 0) && (np->in_inmsk == 0xffffffff)) { 2070 /* 2071 * 0/32 - use the interface's IP address. 2072 */ 2073 if (fr_ifpaddr(4, FRI_NORMAL, fin->fin_ifp, &in, NULL, 2074 fin->fin_ifs) == -1) 2075 return -1; 2076 in.s_addr = ntohl(in.s_addr); 2077 2078 } else if ((np->in_inip == 0) && (np->in_inmsk== 0)) { 2079 /* 2080 * 0/0 - use the original destination address/port. 2081 */ 2082 in.s_addr = ntohl(fin->fin_daddr); 2083 2084 } else if (np->in_redir == NAT_BIMAP && 2085 np->in_inmsk == np->in_outmsk) { 2086 /* 2087 * map the address block in a 1:1 fashion 2088 */ 2089 in.s_addr = np->in_inip; 2090 in.s_addr |= fin->fin_daddr & ~np->in_inmsk; 2091 in.s_addr = ntohl(in.s_addr); 2092 } else { 2093 in.s_addr = ntohl(np->in_inip); 2094 } 2095 2096 if ((np->in_pnext == 0) || ((flags & NAT_NOTRULEPORT) != 0)) 2097 nport = dport; 2098 else { 2099 /* 2100 * Whilst not optimized for the case where 2101 * pmin == pmax, the gain is not significant. 2102 */ 2103 if (((np->in_flags & IPN_FIXEDDPORT) == 0) && 2104 (np->in_pmin != np->in_pmax)) { 2105 nport = ntohs(dport) - ntohs(np->in_pmin) + 2106 ntohs(np->in_pnext); 2107 nport = htons(nport); 2108 } else 2109 nport = np->in_pnext; 2110 } 2111 2112 /* 2113 * When the redirect-to address is set to 0.0.0.0, just 2114 * assume a blank `forwarding' of the packet. We don't 2115 * setup any translation for this either. 2116 */ 2117 if (in.s_addr == 0) { 2118 if (nport == dport) 2119 return -1; 2120 in.s_addr = ntohl(fin->fin_daddr); 2121 } 2122 2123 nat->nat_inip.s_addr = htonl(in.s_addr); 2124 nat->nat_outip = fin->fin_dst; 2125 nat->nat_oip = fin->fin_src; 2126 2127 ni->nai_sum1 = LONG_SUM(ntohl(fin->fin_daddr)) + ntohs(dport); 2128 ni->nai_sum2 = LONG_SUM(in.s_addr) + ntohs(nport); 2129 2130 ni->nai_ip.s_addr = in.s_addr; 2131 ni->nai_nport = nport; 2132 ni->nai_port = sport; 2133 2134 if (flags & IPN_TCPUDP) { 2135 nat->nat_inport = nport; 2136 nat->nat_outport = dport; 2137 nat->nat_oport = sport; 2138 ((tcphdr_t *)fin->fin_dp)->th_dport = nport; 2139 } else if (flags & IPN_ICMPQUERY) { 2140 ((icmphdr_t *)fin->fin_dp)->icmp_id = nport; 2141 nat->nat_inport = nport; 2142 nat->nat_outport = nport; 2143 } 2144 2145 return move; 2146 } 2147 2148 /* ------------------------------------------------------------------------ */ 2149 /* Function: nat_new */ 2150 /* Returns: nat_t* - NULL == failure to create new NAT structure, */ 2151 /* else pointer to new NAT structure */ 2152 /* Parameters: fin(I) - pointer to packet information */ 2153 /* np(I) - pointer to NAT rule */ 2154 /* natsave(I) - pointer to where to store NAT struct pointer */ 2155 /* flags(I) - flags describing the current packet */ 2156 /* direction(I) - direction of packet (in/out) */ 2157 /* Write Lock: ipf_nat */ 2158 /* */ 2159 /* Attempts to create a new NAT entry. Does not actually change the packet */ 2160 /* in any way. */ 2161 /* */ 2162 /* This fucntion is in three main parts: (1) deal with creating a new NAT */ 2163 /* structure for a "MAP" rule (outgoing NAT translation); (2) deal with */ 2164 /* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */ 2165 /* and (3) building that structure and putting it into the NAT table(s). */ 2166 /* ------------------------------------------------------------------------ */ 2167 nat_t *nat_new(fin, np, natsave, flags, direction) 2168 fr_info_t *fin; 2169 ipnat_t *np; 2170 nat_t **natsave; 2171 u_int flags; 2172 int direction; 2173 { 2174 u_short port = 0, sport = 0, dport = 0, nport = 0; 2175 tcphdr_t *tcp = NULL; 2176 hostmap_t *hm = NULL; 2177 struct in_addr in; 2178 nat_t *nat, *natl; 2179 u_int nflags; 2180 natinfo_t ni; 2181 u_32_t sumd; 2182 int move; 2183 ipf_stack_t *ifs = fin->fin_ifs; 2184 2185 if (ifs->ifs_nat_stats.ns_inuse >= ifs->ifs_ipf_nattable_max) { 2186 ifs->ifs_nat_stats.ns_memfail++; 2187 return NULL; 2188 } 2189 2190 move = 1; 2191 nflags = np->in_flags & flags; 2192 nflags &= NAT_FROMRULE; 2193 2194 ni.nai_np = np; 2195 ni.nai_nflags = nflags; 2196 ni.nai_flags = flags; 2197 2198 /* Give me a new nat */ 2199 KMALLOC(nat, nat_t *); 2200 if (nat == NULL) { 2201 ifs->ifs_nat_stats.ns_memfail++; 2202 /* 2203 * Try to automatically tune the max # of entries in the 2204 * table allowed to be less than what will cause kmem_alloc() 2205 * to fail and try to eliminate panics due to out of memory 2206 * conditions arising. 2207 */ 2208 if (ifs->ifs_ipf_nattable_max > ifs->ifs_ipf_nattable_sz) { 2209 ifs->ifs_ipf_nattable_max = ifs->ifs_nat_stats.ns_inuse - 100; 2210 printf("ipf_nattable_max reduced to %d\n", 2211 ifs->ifs_ipf_nattable_max); 2212 } 2213 return NULL; 2214 } 2215 2216 if (flags & IPN_TCPUDP) { 2217 tcp = fin->fin_dp; 2218 ni.nai_sport = htons(fin->fin_sport); 2219 ni.nai_dport = htons(fin->fin_dport); 2220 } else if (flags & IPN_ICMPQUERY) { 2221 /* 2222 * In the ICMP query NAT code, we translate the ICMP id fields 2223 * to make them unique. This is indepedent of the ICMP type 2224 * (e.g. in the unlikely event that a host sends an echo and 2225 * an tstamp request with the same id, both packets will have 2226 * their ip address/id field changed in the same way). 2227 */ 2228 /* The icmp_id field is used by the sender to identify the 2229 * process making the icmp request. (the receiver justs 2230 * copies it back in its response). So, it closely matches 2231 * the concept of source port. We overlay sport, so we can 2232 * maximally reuse the existing code. 2233 */ 2234 ni.nai_sport = ((icmphdr_t *)fin->fin_dp)->icmp_id; 2235 ni.nai_dport = ni.nai_sport; 2236 } 2237 2238 bzero((char *)nat, sizeof(*nat)); 2239 nat->nat_flags = flags; 2240 nat->nat_redir = np->in_redir; 2241 2242 if ((flags & NAT_SLAVE) == 0) { 2243 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 2244 } 2245 2246 /* 2247 * Search the current table for a match. 2248 */ 2249 if (direction == NAT_OUTBOUND) { 2250 /* 2251 * We can now arrange to call this for the same connection 2252 * because ipf_nat_new doesn't protect the code path into 2253 * this function. 2254 */ 2255 natl = nat_outlookup(fin, nflags, (u_int)fin->fin_p, 2256 fin->fin_src, fin->fin_dst); 2257 if (natl != NULL) { 2258 KFREE(nat); 2259 nat = natl; 2260 goto done; 2261 } 2262 2263 move = nat_newmap(fin, nat, &ni); 2264 if (move == -1) 2265 goto badnat; 2266 2267 np = ni.nai_np; 2268 in = ni.nai_ip; 2269 } else { 2270 /* 2271 * NAT_INBOUND is used only for redirects rules 2272 */ 2273 natl = nat_inlookup(fin, nflags, (u_int)fin->fin_p, 2274 fin->fin_src, fin->fin_dst); 2275 if (natl != NULL) { 2276 KFREE(nat); 2277 nat = natl; 2278 goto done; 2279 } 2280 2281 move = nat_newrdr(fin, nat, &ni); 2282 if (move == -1) 2283 goto badnat; 2284 2285 np = ni.nai_np; 2286 in = ni.nai_ip; 2287 } 2288 port = ni.nai_port; 2289 nport = ni.nai_nport; 2290 2291 if ((move == 1) && (np->in_flags & IPN_ROUNDR)) { 2292 if (np->in_redir == NAT_REDIRECT) { 2293 nat_delrdr(np); 2294 nat_addrdr(np, ifs); 2295 } else if (np->in_redir == NAT_MAP) { 2296 nat_delnat(np); 2297 nat_addnat(np, ifs); 2298 } 2299 } 2300 2301 if (flags & IPN_TCPUDP) { 2302 sport = ni.nai_sport; 2303 dport = ni.nai_dport; 2304 } else if (flags & IPN_ICMPQUERY) { 2305 sport = ni.nai_sport; 2306 dport = 0; 2307 } 2308 2309 /* 2310 * nat_sumd[0] stores adjustment value including both IP address and 2311 * port number changes. nat_sumd[1] stores adjustment value only for 2312 * IP address changes, to be used for pseudo header adjustment, in 2313 * case hardware partial checksum offload is offered. 2314 */ 2315 CALC_SUMD(ni.nai_sum1, ni.nai_sum2, sumd); 2316 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 2317 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) 2318 if (flags & IPN_TCPUDP) { 2319 ni.nai_sum1 = LONG_SUM(in.s_addr); 2320 if (direction == NAT_OUTBOUND) 2321 ni.nai_sum2 = LONG_SUM(ntohl(fin->fin_saddr)); 2322 else 2323 ni.nai_sum2 = LONG_SUM(ntohl(fin->fin_daddr)); 2324 2325 CALC_SUMD(ni.nai_sum1, ni.nai_sum2, sumd); 2326 nat->nat_sumd[1] = (sumd & 0xffff) + (sumd >> 16); 2327 } else 2328 #endif 2329 nat->nat_sumd[1] = nat->nat_sumd[0]; 2330 2331 if ((flags & IPN_TCPUDPICMP) && ((sport != port) || (dport != nport))) { 2332 if (direction == NAT_OUTBOUND) 2333 ni.nai_sum1 = LONG_SUM(ntohl(fin->fin_saddr)); 2334 else 2335 ni.nai_sum1 = LONG_SUM(ntohl(fin->fin_daddr)); 2336 2337 ni.nai_sum2 = LONG_SUM(in.s_addr); 2338 2339 CALC_SUMD(ni.nai_sum1, ni.nai_sum2, sumd); 2340 nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16); 2341 } else { 2342 nat->nat_ipsumd = nat->nat_sumd[0]; 2343 if (!(flags & IPN_TCPUDPICMP)) { 2344 nat->nat_sumd[0] = 0; 2345 nat->nat_sumd[1] = 0; 2346 } 2347 } 2348 2349 if (nat_finalise(fin, nat, &ni, tcp, natsave, direction) == -1) { 2350 goto badnat; 2351 } 2352 if (flags & SI_WILDP) 2353 ifs->ifs_nat_stats.ns_wilds++; 2354 goto done; 2355 badnat: 2356 ifs->ifs_nat_stats.ns_badnat++; 2357 if ((hm = nat->nat_hm) != NULL) 2358 nat_hostmapdel(hm); 2359 KFREE(nat); 2360 nat = NULL; 2361 done: 2362 if ((flags & NAT_SLAVE) == 0) { 2363 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 2364 } 2365 return nat; 2366 } 2367 2368 2369 /* ------------------------------------------------------------------------ */ 2370 /* Function: nat_finalise */ 2371 /* Returns: int - 0 == sucess, -1 == failure */ 2372 /* Parameters: fin(I) - pointer to packet information */ 2373 /* nat(I) - pointer to NAT entry */ 2374 /* ni(I) - pointer to structure with misc. information needed */ 2375 /* to create new NAT entry. */ 2376 /* Write Lock: ipf_nat */ 2377 /* */ 2378 /* This is the tail end of constructing a new NAT entry and is the same */ 2379 /* for both IPv4 and IPv6. */ 2380 /* ------------------------------------------------------------------------ */ 2381 /*ARGSUSED*/ 2382 static INLINE int nat_finalise(fin, nat, ni, tcp, natsave, direction) 2383 fr_info_t *fin; 2384 nat_t *nat; 2385 natinfo_t *ni; 2386 tcphdr_t *tcp; 2387 nat_t **natsave; 2388 int direction; 2389 { 2390 frentry_t *fr; 2391 ipnat_t *np; 2392 ipf_stack_t *ifs = fin->fin_ifs; 2393 2394 np = ni->nai_np; 2395 2396 COPYIFNAME(fin->fin_ifp, nat->nat_ifnames[0], fin->fin_v); 2397 2398 #ifdef IPFILTER_SYNC 2399 if ((nat->nat_flags & SI_CLONE) == 0) 2400 nat->nat_sync = ipfsync_new(SMC_NAT, fin, nat); 2401 #endif 2402 2403 nat->nat_me = natsave; 2404 nat->nat_dir = direction; 2405 nat->nat_ifps[0] = np->in_ifps[0]; 2406 nat->nat_ifps[1] = np->in_ifps[1]; 2407 nat->nat_ptr = np; 2408 nat->nat_p = fin->fin_p; 2409 nat->nat_mssclamp = np->in_mssclamp; 2410 fr = fin->fin_fr; 2411 nat->nat_fr = fr; 2412 2413 if ((np->in_apr != NULL) && ((ni->nai_flags & NAT_SLAVE) == 0)) 2414 if (appr_new(fin, nat) == -1) 2415 return -1; 2416 2417 if (nat_insert(nat, fin->fin_rev, ifs) == 0) { 2418 if (ifs->ifs_nat_logging) 2419 nat_log(nat, (u_int)np->in_redir, ifs); 2420 np->in_use++; 2421 if (fr != NULL) { 2422 MUTEX_ENTER(&fr->fr_lock); 2423 fr->fr_ref++; 2424 MUTEX_EXIT(&fr->fr_lock); 2425 } 2426 return 0; 2427 } 2428 2429 /* 2430 * nat_insert failed, so cleanup time... 2431 */ 2432 return -1; 2433 } 2434 2435 2436 /* ------------------------------------------------------------------------ */ 2437 /* Function: nat_insert */ 2438 /* Returns: int - 0 == sucess, -1 == failure */ 2439 /* Parameters: nat(I) - pointer to NAT structure */ 2440 /* rev(I) - flag indicating forward/reverse direction of packet */ 2441 /* Write Lock: ipf_nat */ 2442 /* */ 2443 /* Insert a NAT entry into the hash tables for searching and add it to the */ 2444 /* list of active NAT entries. Adjust global counters when complete. */ 2445 /* ------------------------------------------------------------------------ */ 2446 int nat_insert(nat, rev, ifs) 2447 nat_t *nat; 2448 int rev; 2449 ipf_stack_t *ifs; 2450 { 2451 u_int hv1, hv2; 2452 nat_t **natp; 2453 2454 /* 2455 * Try and return an error as early as possible, so calculate the hash 2456 * entry numbers first and then proceed. 2457 */ 2458 if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) { 2459 hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport, 2460 0xffffffff); 2461 hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1 + nat->nat_oport, 2462 ifs->ifs_ipf_nattable_sz); 2463 hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport, 2464 0xffffffff); 2465 hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2 + nat->nat_oport, 2466 ifs->ifs_ipf_nattable_sz); 2467 } else { 2468 hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, 0, 0xffffffff); 2469 hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1, 2470 ifs->ifs_ipf_nattable_sz); 2471 hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, 0, 0xffffffff); 2472 hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2, 2473 ifs->ifs_ipf_nattable_sz); 2474 } 2475 2476 if (ifs->ifs_nat_stats.ns_bucketlen[0][hv1] >= ifs->ifs_fr_nat_maxbucket || 2477 ifs->ifs_nat_stats.ns_bucketlen[1][hv2] >= ifs->ifs_fr_nat_maxbucket) { 2478 return -1; 2479 } 2480 2481 nat->nat_hv[0] = hv1; 2482 nat->nat_hv[1] = hv2; 2483 2484 MUTEX_INIT(&nat->nat_lock, "nat entry lock"); 2485 2486 nat->nat_rev = rev; 2487 nat->nat_ref = 1; 2488 nat->nat_bytes[0] = 0; 2489 nat->nat_pkts[0] = 0; 2490 nat->nat_bytes[1] = 0; 2491 nat->nat_pkts[1] = 0; 2492 2493 nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0'; 2494 nat->nat_ifps[0] = fr_resolvenic(nat->nat_ifnames[0], 4, ifs); 2495 2496 if (nat->nat_ifnames[1][0] !='\0') { 2497 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0'; 2498 nat->nat_ifps[1] = fr_resolvenic(nat->nat_ifnames[1], 4, ifs); 2499 } else { 2500 (void) strncpy(nat->nat_ifnames[1], nat->nat_ifnames[0], 2501 LIFNAMSIZ); 2502 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0'; 2503 nat->nat_ifps[1] = nat->nat_ifps[0]; 2504 } 2505 2506 nat->nat_next = ifs->ifs_nat_instances; 2507 nat->nat_pnext = &ifs->ifs_nat_instances; 2508 if (ifs->ifs_nat_instances) 2509 ifs->ifs_nat_instances->nat_pnext = &nat->nat_next; 2510 ifs->ifs_nat_instances = nat; 2511 2512 natp = &ifs->ifs_nat_table[0][hv1]; 2513 if (*natp) 2514 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 2515 nat->nat_phnext[0] = natp; 2516 nat->nat_hnext[0] = *natp; 2517 *natp = nat; 2518 ifs->ifs_nat_stats.ns_bucketlen[0][hv1]++; 2519 2520 natp = &ifs->ifs_nat_table[1][hv2]; 2521 if (*natp) 2522 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 2523 nat->nat_phnext[1] = natp; 2524 nat->nat_hnext[1] = *natp; 2525 *natp = nat; 2526 ifs->ifs_nat_stats.ns_bucketlen[1][hv2]++; 2527 2528 fr_setnatqueue(nat, rev, ifs); 2529 2530 ifs->ifs_nat_stats.ns_added++; 2531 ifs->ifs_nat_stats.ns_inuse++; 2532 return 0; 2533 } 2534 2535 2536 /* ------------------------------------------------------------------------ */ 2537 /* Function: nat_icmperrorlookup */ 2538 /* Returns: nat_t* - point to matching NAT structure */ 2539 /* Parameters: fin(I) - pointer to packet information */ 2540 /* dir(I) - direction of packet (in/out) */ 2541 /* */ 2542 /* Check if the ICMP error message is related to an existing TCP, UDP or */ 2543 /* ICMP query nat entry. It is assumed that the packet is already of the */ 2544 /* the required length. */ 2545 /* ------------------------------------------------------------------------ */ 2546 nat_t *nat_icmperrorlookup(fin, dir) 2547 fr_info_t *fin; 2548 int dir; 2549 { 2550 int flags = 0, minlen; 2551 icmphdr_t *orgicmp; 2552 tcphdr_t *tcp = NULL; 2553 u_short data[2]; 2554 nat_t *nat; 2555 ip_t *oip; 2556 u_int p; 2557 2558 /* 2559 * Does it at least have the return (basic) IP header ? 2560 * Only a basic IP header (no options) should be with an ICMP error 2561 * header. Also, if it's not an error type, then return. 2562 */ 2563 if ((fin->fin_hlen != sizeof(ip_t)) || !(fin->fin_flx & FI_ICMPERR)) 2564 return NULL; 2565 2566 /* 2567 * Check packet size 2568 */ 2569 oip = (ip_t *)((char *)fin->fin_dp + 8); 2570 minlen = IP_HL(oip) << 2; 2571 if ((minlen < sizeof(ip_t)) || 2572 (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen)) 2573 return NULL; 2574 /* 2575 * Is the buffer big enough for all of it ? It's the size of the IP 2576 * header claimed in the encapsulated part which is of concern. It 2577 * may be too big to be in this buffer but not so big that it's 2578 * outside the ICMP packet, leading to TCP deref's causing problems. 2579 * This is possible because we don't know how big oip_hl is when we 2580 * do the pullup early in fr_check() and thus can't gaurantee it is 2581 * all here now. 2582 */ 2583 #ifdef _KERNEL 2584 { 2585 mb_t *m; 2586 2587 m = fin->fin_m; 2588 # if defined(MENTAT) 2589 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > (char *)m->b_wptr) 2590 return NULL; 2591 # else 2592 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > 2593 (char *)fin->fin_ip + M_LEN(m)) 2594 return NULL; 2595 # endif 2596 } 2597 #endif 2598 2599 if (fin->fin_daddr != oip->ip_src.s_addr) 2600 return NULL; 2601 2602 p = oip->ip_p; 2603 if (p == IPPROTO_TCP) 2604 flags = IPN_TCP; 2605 else if (p == IPPROTO_UDP) 2606 flags = IPN_UDP; 2607 else if (p == IPPROTO_ICMP) { 2608 orgicmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 2609 2610 /* see if this is related to an ICMP query */ 2611 if (nat_icmpquerytype4(orgicmp->icmp_type)) { 2612 data[0] = fin->fin_data[0]; 2613 data[1] = fin->fin_data[1]; 2614 fin->fin_data[0] = 0; 2615 fin->fin_data[1] = orgicmp->icmp_id; 2616 2617 flags = IPN_ICMPERR|IPN_ICMPQUERY; 2618 /* 2619 * NOTE : dir refers to the direction of the original 2620 * ip packet. By definition the icmp error 2621 * message flows in the opposite direction. 2622 */ 2623 if (dir == NAT_INBOUND) 2624 nat = nat_inlookup(fin, flags, p, oip->ip_dst, 2625 oip->ip_src); 2626 else 2627 nat = nat_outlookup(fin, flags, p, oip->ip_dst, 2628 oip->ip_src); 2629 fin->fin_data[0] = data[0]; 2630 fin->fin_data[1] = data[1]; 2631 return nat; 2632 } 2633 } 2634 2635 if (flags & IPN_TCPUDP) { 2636 minlen += 8; /* + 64bits of data to get ports */ 2637 if (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen) 2638 return NULL; 2639 2640 data[0] = fin->fin_data[0]; 2641 data[1] = fin->fin_data[1]; 2642 tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 2643 fin->fin_data[0] = ntohs(tcp->th_dport); 2644 fin->fin_data[1] = ntohs(tcp->th_sport); 2645 2646 if (dir == NAT_INBOUND) { 2647 nat = nat_inlookup(fin, flags, p, oip->ip_dst, 2648 oip->ip_src); 2649 } else { 2650 nat = nat_outlookup(fin, flags, p, oip->ip_dst, 2651 oip->ip_src); 2652 } 2653 fin->fin_data[0] = data[0]; 2654 fin->fin_data[1] = data[1]; 2655 return nat; 2656 } 2657 if (dir == NAT_INBOUND) 2658 return nat_inlookup(fin, 0, p, oip->ip_dst, oip->ip_src); 2659 else 2660 return nat_outlookup(fin, 0, p, oip->ip_dst, oip->ip_src); 2661 } 2662 2663 2664 /* ------------------------------------------------------------------------ */ 2665 /* Function: nat_icmperror */ 2666 /* Returns: nat_t* - point to matching NAT structure */ 2667 /* Parameters: fin(I) - pointer to packet information */ 2668 /* nflags(I) - NAT flags for this packet */ 2669 /* dir(I) - direction of packet (in/out) */ 2670 /* */ 2671 /* Fix up an ICMP packet which is an error message for an existing NAT */ 2672 /* session. This will correct both packet header data and checksums. */ 2673 /* */ 2674 /* This should *ONLY* be used for incoming ICMP error packets to make sure */ 2675 /* a NAT'd ICMP packet gets correctly recognised. */ 2676 /* ------------------------------------------------------------------------ */ 2677 nat_t *nat_icmperror(fin, nflags, dir) 2678 fr_info_t *fin; 2679 u_int *nflags; 2680 int dir; 2681 { 2682 u_32_t sum1, sum2, sumd, psum1, psum2, psumd, sumd2; 2683 struct in_addr in; 2684 icmphdr_t *icmp, *orgicmp; 2685 int dlen; 2686 udphdr_t *udp; 2687 tcphdr_t *tcp; 2688 nat_t *nat; 2689 ip_t *oip; 2690 if ((fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) 2691 return NULL; 2692 2693 /* 2694 * nat_icmperrorlookup() looks up nat entry associated with the 2695 * offending IP packet and returns pointer to the entry, or NULL 2696 * if packet wasn't natted or for `defective' packets. 2697 */ 2698 2699 if ((fin->fin_v != 4) || !(nat = nat_icmperrorlookup(fin, dir))) 2700 return NULL; 2701 2702 sumd2 = 0; 2703 *nflags = IPN_ICMPERR; 2704 icmp = fin->fin_dp; 2705 oip = (ip_t *)&icmp->icmp_ip; 2706 udp = (udphdr_t *)((((char *)oip) + (IP_HL(oip) << 2))); 2707 tcp = (tcphdr_t *)udp; 2708 dlen = fin->fin_plen - ((char *)udp - (char *)fin->fin_ip); 2709 2710 /* 2711 * Need to adjust ICMP header to include the real IP#'s and 2712 * port #'s. There are three steps required. 2713 * 2714 * Step 1 2715 * Fix the IP addresses in the offending IP packet and update 2716 * ip header checksum to compensate for the change. 2717 * 2718 * No update needed here for icmp_cksum because the ICMP checksum 2719 * is calculated over the complete ICMP packet, which includes the 2720 * changed oip IP addresses and oip->ip_sum. These two changes 2721 * cancel each other out (if the delta for the IP address is x, 2722 * then the delta for ip_sum is minus x). 2723 */ 2724 2725 if (oip->ip_dst.s_addr == nat->nat_oip.s_addr) { 2726 sum1 = LONG_SUM(ntohl(oip->ip_src.s_addr)); 2727 in = nat->nat_inip; 2728 oip->ip_src = in; 2729 } else { 2730 sum1 = LONG_SUM(ntohl(oip->ip_dst.s_addr)); 2731 in = nat->nat_outip; 2732 oip->ip_dst = in; 2733 } 2734 2735 sum2 = LONG_SUM(ntohl(in.s_addr)); 2736 CALC_SUMD(sum1, sum2, sumd); 2737 fix_datacksum(&oip->ip_sum, sumd); 2738 2739 /* 2740 * Step 2 2741 * Perform other adjustments based on protocol of offending packet. 2742 */ 2743 2744 switch (oip->ip_p) { 2745 case IPPROTO_TCP : 2746 case IPPROTO_UDP : 2747 2748 /* 2749 * For offending TCP/UDP IP packets, translate the ports 2750 * based on the NAT specification. 2751 * 2752 * Advance notice : Now it becomes complicated :-) 2753 * 2754 * Since the port and IP addresse fields are both part 2755 * of the TCP/UDP checksum of the offending IP packet, 2756 * we need to adjust that checksum as well. 2757 * 2758 * To further complicate things, the TCP/UDP checksum 2759 * may not be present. We must check to see if the 2760 * length of the data portion is big enough to hold 2761 * the checksum. In the UDP case, a test to determine 2762 * if the checksum is even set is also required. 2763 * 2764 * Any changes to an IP address, port or checksum within 2765 * the ICMP packet requires a change to icmp_cksum. 2766 * 2767 * Be extremely careful here ... The change is dependent 2768 * upon whether or not the TCP/UPD checksum is present. 2769 * 2770 * If TCP/UPD checksum is present, the icmp_cksum must 2771 * compensate for checksum modification resulting from 2772 * IP address change only. Port change and resulting 2773 * data checksum adjustments cancel each other out. 2774 * 2775 * If TCP/UDP checksum is not present, icmp_cksum must 2776 * compensate for port change only. The IP address 2777 * change does not modify anything else in this case. 2778 */ 2779 2780 psum1 = 0; 2781 psum2 = 0; 2782 psumd = 0; 2783 2784 if ((tcp->th_dport == nat->nat_oport) && 2785 (tcp->th_sport != nat->nat_inport)) { 2786 2787 /* 2788 * Translate the source port. 2789 */ 2790 2791 psum1 = ntohs(tcp->th_sport); 2792 psum2 = ntohs(nat->nat_inport); 2793 tcp->th_sport = nat->nat_inport; 2794 2795 } else if ((tcp->th_sport == nat->nat_oport) && 2796 (tcp->th_dport != nat->nat_outport)) { 2797 2798 /* 2799 * Translate the destination port. 2800 */ 2801 2802 psum1 = ntohs(tcp->th_dport); 2803 psum2 = ntohs(nat->nat_outport); 2804 tcp->th_dport = nat->nat_outport; 2805 } 2806 2807 if ((oip->ip_p == IPPROTO_TCP) && (dlen >= 18)) { 2808 2809 /* 2810 * TCP checksum present. 2811 * 2812 * Adjust data checksum and icmp checksum to 2813 * compensate for any IP address change. 2814 */ 2815 2816 sum1 = ntohs(tcp->th_sum); 2817 fix_datacksum(&tcp->th_sum, sumd); 2818 sum2 = ntohs(tcp->th_sum); 2819 sumd2 = sumd << 1; 2820 CALC_SUMD(sum1, sum2, sumd); 2821 sumd2 += sumd; 2822 2823 /* 2824 * Also make data checksum adjustment to 2825 * compensate for any port change. 2826 */ 2827 2828 if (psum1 != psum2) { 2829 CALC_SUMD(psum1, psum2, psumd); 2830 fix_datacksum(&tcp->th_sum, psumd); 2831 } 2832 2833 } else if ((oip->ip_p == IPPROTO_UDP) && 2834 (dlen >= 8) && (udp->uh_sum != 0)) { 2835 2836 /* 2837 * The UDP checksum is present and set. 2838 * 2839 * Adjust data checksum and icmp checksum to 2840 * compensate for any IP address change. 2841 */ 2842 2843 sum1 = ntohs(udp->uh_sum); 2844 fix_datacksum(&udp->uh_sum, sumd); 2845 sum2 = ntohs(udp->uh_sum); 2846 sumd2 = sumd << 1; 2847 CALC_SUMD(sum1, sum2, sumd); 2848 sumd2 += sumd; 2849 2850 /* 2851 * Also make data checksum adjustment to 2852 * compensate for any port change. 2853 */ 2854 2855 if (psum1 != psum2) { 2856 CALC_SUMD(psum1, psum2, psumd); 2857 fix_datacksum(&udp->uh_sum, psumd); 2858 } 2859 2860 } else { 2861 2862 /* 2863 * Data checksum was not present. 2864 * 2865 * Compensate for any port change. 2866 */ 2867 2868 CALC_SUMD(psum2, psum1, psumd); 2869 sumd2 += psumd; 2870 } 2871 break; 2872 2873 case IPPROTO_ICMP : 2874 2875 orgicmp = (icmphdr_t *)udp; 2876 2877 if ((nat->nat_dir == NAT_OUTBOUND) && 2878 (orgicmp->icmp_id != nat->nat_inport) && 2879 (dlen >= 8)) { 2880 2881 /* 2882 * Fix ICMP checksum (of the offening ICMP 2883 * query packet) to compensate the change 2884 * in the ICMP id of the offending ICMP 2885 * packet. 2886 * 2887 * Since you modify orgicmp->icmp_id with 2888 * a delta (say x) and you compensate that 2889 * in origicmp->icmp_cksum with a delta 2890 * minus x, you don't have to adjust the 2891 * overall icmp->icmp_cksum 2892 */ 2893 2894 sum1 = ntohs(orgicmp->icmp_id); 2895 sum2 = ntohs(nat->nat_inport); 2896 CALC_SUMD(sum1, sum2, sumd); 2897 orgicmp->icmp_id = nat->nat_inport; 2898 fix_datacksum(&orgicmp->icmp_cksum, sumd); 2899 2900 } /* nat_dir can't be NAT_INBOUND for icmp queries */ 2901 2902 break; 2903 2904 default : 2905 2906 break; 2907 2908 } /* switch (oip->ip_p) */ 2909 2910 /* 2911 * Step 3 2912 * Make the adjustments to icmp checksum. 2913 */ 2914 2915 if (sumd2 != 0) { 2916 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 2917 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 2918 fix_incksum(&icmp->icmp_cksum, sumd2); 2919 } 2920 return nat; 2921 } 2922 2923 2924 /* 2925 * NB: these lookups don't lock access to the list, it assumed that it has 2926 * already been done! 2927 */ 2928 2929 /* ------------------------------------------------------------------------ */ 2930 /* Function: nat_inlookup */ 2931 /* Returns: nat_t* - NULL == no match, */ 2932 /* else pointer to matching NAT entry */ 2933 /* Parameters: fin(I) - pointer to packet information */ 2934 /* flags(I) - NAT flags for this packet */ 2935 /* p(I) - protocol for this packet */ 2936 /* src(I) - source IP address */ 2937 /* mapdst(I) - destination IP address */ 2938 /* */ 2939 /* Lookup a nat entry based on the mapped destination ip address/port and */ 2940 /* real source address/port. We use this lookup when receiving a packet, */ 2941 /* we're looking for a table entry, based on the destination address. */ 2942 /* */ 2943 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */ 2944 /* */ 2945 /* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN */ 2946 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */ 2947 /* */ 2948 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */ 2949 /* the packet is of said protocol */ 2950 /* ------------------------------------------------------------------------ */ 2951 nat_t *nat_inlookup(fin, flags, p, src, mapdst) 2952 fr_info_t *fin; 2953 u_int flags, p; 2954 struct in_addr src , mapdst; 2955 { 2956 u_short sport, dport; 2957 ipnat_t *ipn; 2958 u_int sflags; 2959 nat_t *nat; 2960 int nflags; 2961 u_32_t dst; 2962 void *ifp; 2963 u_int hv; 2964 ipf_stack_t *ifs = fin->fin_ifs; 2965 2966 if (fin != NULL) 2967 ifp = fin->fin_ifp; 2968 else 2969 ifp = NULL; 2970 sport = 0; 2971 dport = 0; 2972 dst = mapdst.s_addr; 2973 sflags = flags & NAT_TCPUDPICMP; 2974 2975 switch (p) 2976 { 2977 case IPPROTO_TCP : 2978 case IPPROTO_UDP : 2979 sport = htons(fin->fin_data[0]); 2980 dport = htons(fin->fin_data[1]); 2981 break; 2982 case IPPROTO_ICMP : 2983 if (flags & IPN_ICMPERR) 2984 sport = fin->fin_data[1]; 2985 else 2986 dport = fin->fin_data[1]; 2987 break; 2988 default : 2989 break; 2990 } 2991 2992 2993 if ((flags & SI_WILDP) != 0) 2994 goto find_in_wild_ports; 2995 2996 hv = NAT_HASH_FN(dst, dport, 0xffffffff); 2997 hv = NAT_HASH_FN(src.s_addr, hv + sport, ifs->ifs_ipf_nattable_sz); 2998 nat = ifs->ifs_nat_table[1][hv]; 2999 for (; nat; nat = nat->nat_hnext[1]) { 3000 if (nat->nat_ifps[0] != NULL) { 3001 if ((ifp != NULL) && (ifp != nat->nat_ifps[0])) 3002 continue; 3003 } else if (ifp != NULL) 3004 nat->nat_ifps[0] = ifp; 3005 3006 nflags = nat->nat_flags; 3007 3008 if (nat->nat_oip.s_addr == src.s_addr && 3009 nat->nat_outip.s_addr == dst && 3010 (((p == 0) && 3011 (sflags == (nat->nat_flags & IPN_TCPUDPICMP))) 3012 || (p == nat->nat_p))) { 3013 switch (p) 3014 { 3015 #if 0 3016 case IPPROTO_GRE : 3017 if (nat->nat_call[1] != fin->fin_data[0]) 3018 continue; 3019 break; 3020 #endif 3021 case IPPROTO_ICMP : 3022 if ((flags & IPN_ICMPERR) != 0) { 3023 if (nat->nat_outport != sport) 3024 continue; 3025 } else { 3026 if (nat->nat_outport != dport) 3027 continue; 3028 } 3029 break; 3030 case IPPROTO_TCP : 3031 case IPPROTO_UDP : 3032 if (nat->nat_oport != sport) 3033 continue; 3034 if (nat->nat_outport != dport) 3035 continue; 3036 break; 3037 default : 3038 break; 3039 } 3040 3041 ipn = nat->nat_ptr; 3042 if ((ipn != NULL) && (nat->nat_aps != NULL)) 3043 if (appr_match(fin, nat) != 0) 3044 continue; 3045 return nat; 3046 } 3047 } 3048 3049 /* 3050 * So if we didn't find it but there are wildcard members in the hash 3051 * table, go back and look for them. We do this search and update here 3052 * because it is modifying the NAT table and we want to do this only 3053 * for the first packet that matches. The exception, of course, is 3054 * for "dummy" (FI_IGNORE) lookups. 3055 */ 3056 find_in_wild_ports: 3057 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) 3058 return NULL; 3059 if (ifs->ifs_nat_stats.ns_wilds == 0) 3060 return NULL; 3061 3062 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3063 3064 hv = NAT_HASH_FN(dst, 0, 0xffffffff); 3065 hv = NAT_HASH_FN(src.s_addr, hv, ifs->ifs_ipf_nattable_sz); 3066 3067 WRITE_ENTER(&ifs->ifs_ipf_nat); 3068 3069 nat = ifs->ifs_nat_table[1][hv]; 3070 for (; nat; nat = nat->nat_hnext[1]) { 3071 if (nat->nat_ifps[0] != NULL) { 3072 if ((ifp != NULL) && (ifp != nat->nat_ifps[0])) 3073 continue; 3074 } else if (ifp != NULL) 3075 nat->nat_ifps[0] = ifp; 3076 3077 if (nat->nat_p != fin->fin_p) 3078 continue; 3079 if (nat->nat_oip.s_addr != src.s_addr || 3080 nat->nat_outip.s_addr != dst) 3081 continue; 3082 3083 nflags = nat->nat_flags; 3084 if (!(nflags & (NAT_TCPUDP|SI_WILDP))) 3085 continue; 3086 3087 if (nat_wildok(nat, (int)sport, (int)dport, nflags, 3088 NAT_INBOUND) == 1) { 3089 if ((fin->fin_flx & FI_IGNORE) != 0) 3090 break; 3091 if ((nflags & SI_CLONE) != 0) { 3092 nat = fr_natclone(fin, nat); 3093 if (nat == NULL) 3094 break; 3095 } else { 3096 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 3097 ifs->ifs_nat_stats.ns_wilds--; 3098 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 3099 } 3100 nat->nat_oport = sport; 3101 nat->nat_outport = dport; 3102 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT); 3103 nat_tabmove(nat, ifs); 3104 break; 3105 } 3106 } 3107 3108 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 3109 3110 return nat; 3111 } 3112 3113 3114 /* ------------------------------------------------------------------------ */ 3115 /* Function: nat_tabmove */ 3116 /* Returns: Nil */ 3117 /* Parameters: nat(I) - pointer to NAT structure */ 3118 /* Write Lock: ipf_nat */ 3119 /* */ 3120 /* This function is only called for TCP/UDP NAT table entries where the */ 3121 /* original was placed in the table without hashing on the ports and we now */ 3122 /* want to include hashing on port numbers. */ 3123 /* ------------------------------------------------------------------------ */ 3124 static void nat_tabmove(nat, ifs) 3125 nat_t *nat; 3126 ipf_stack_t *ifs; 3127 { 3128 nat_t **natp; 3129 u_int hv; 3130 3131 if (nat->nat_flags & SI_CLONE) 3132 return; 3133 3134 /* 3135 * Remove the NAT entry from the old location 3136 */ 3137 if (nat->nat_hnext[0]) 3138 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; 3139 *nat->nat_phnext[0] = nat->nat_hnext[0]; 3140 ifs->ifs_nat_stats.ns_bucketlen[0][nat->nat_hv[0]]--; 3141 3142 if (nat->nat_hnext[1]) 3143 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; 3144 *nat->nat_phnext[1] = nat->nat_hnext[1]; 3145 ifs->ifs_nat_stats.ns_bucketlen[1][nat->nat_hv[1]]--; 3146 3147 /* 3148 * Add into the NAT table in the new position 3149 */ 3150 hv = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport, 0xffffffff); 3151 hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + nat->nat_oport, 3152 ifs->ifs_ipf_nattable_sz); 3153 nat->nat_hv[0] = hv; 3154 natp = &ifs->ifs_nat_table[0][hv]; 3155 if (*natp) 3156 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 3157 nat->nat_phnext[0] = natp; 3158 nat->nat_hnext[0] = *natp; 3159 *natp = nat; 3160 ifs->ifs_nat_stats.ns_bucketlen[0][hv]++; 3161 3162 hv = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport, 0xffffffff); 3163 hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + nat->nat_oport, 3164 ifs->ifs_ipf_nattable_sz); 3165 nat->nat_hv[1] = hv; 3166 natp = &ifs->ifs_nat_table[1][hv]; 3167 if (*natp) 3168 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 3169 nat->nat_phnext[1] = natp; 3170 nat->nat_hnext[1] = *natp; 3171 *natp = nat; 3172 ifs->ifs_nat_stats.ns_bucketlen[1][hv]++; 3173 } 3174 3175 3176 /* ------------------------------------------------------------------------ */ 3177 /* Function: nat_outlookup */ 3178 /* Returns: nat_t* - NULL == no match, */ 3179 /* else pointer to matching NAT entry */ 3180 /* Parameters: fin(I) - pointer to packet information */ 3181 /* flags(I) - NAT flags for this packet */ 3182 /* p(I) - protocol for this packet */ 3183 /* src(I) - source IP address */ 3184 /* dst(I) - destination IP address */ 3185 /* rw(I) - 1 == write lock on ipf_nat held, 0 == read lock. */ 3186 /* */ 3187 /* Lookup a nat entry based on the source 'real' ip address/port and */ 3188 /* destination address/port. We use this lookup when sending a packet out, */ 3189 /* we're looking for a table entry, based on the source address. */ 3190 /* */ 3191 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */ 3192 /* */ 3193 /* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN */ 3194 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */ 3195 /* */ 3196 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */ 3197 /* the packet is of said protocol */ 3198 /* ------------------------------------------------------------------------ */ 3199 nat_t *nat_outlookup(fin, flags, p, src, dst) 3200 fr_info_t *fin; 3201 u_int flags, p; 3202 struct in_addr src , dst; 3203 { 3204 u_short sport, dport; 3205 u_int sflags; 3206 ipnat_t *ipn; 3207 u_32_t srcip; 3208 nat_t *nat; 3209 int nflags; 3210 void *ifp; 3211 u_int hv; 3212 ipf_stack_t *ifs = fin->fin_ifs; 3213 3214 ifp = fin->fin_ifp; 3215 3216 srcip = src.s_addr; 3217 sflags = flags & IPN_TCPUDPICMP; 3218 sport = 0; 3219 dport = 0; 3220 3221 switch (p) 3222 { 3223 case IPPROTO_TCP : 3224 case IPPROTO_UDP : 3225 sport = htons(fin->fin_data[0]); 3226 dport = htons(fin->fin_data[1]); 3227 break; 3228 case IPPROTO_ICMP : 3229 if (flags & IPN_ICMPERR) 3230 sport = fin->fin_data[1]; 3231 else 3232 dport = fin->fin_data[1]; 3233 break; 3234 default : 3235 break; 3236 } 3237 3238 if ((flags & SI_WILDP) != 0) 3239 goto find_out_wild_ports; 3240 3241 hv = NAT_HASH_FN(srcip, sport, 0xffffffff); 3242 hv = NAT_HASH_FN(dst.s_addr, hv + dport, ifs->ifs_ipf_nattable_sz); 3243 nat = ifs->ifs_nat_table[0][hv]; 3244 for (; nat; nat = nat->nat_hnext[0]) { 3245 if (nat->nat_ifps[1] != NULL) { 3246 if ((ifp != NULL) && (ifp != nat->nat_ifps[1])) 3247 continue; 3248 } else if (ifp != NULL) 3249 nat->nat_ifps[1] = ifp; 3250 3251 nflags = nat->nat_flags; 3252 3253 if (nat->nat_inip.s_addr == srcip && 3254 nat->nat_oip.s_addr == dst.s_addr && 3255 (((p == 0) && (sflags == (nflags & NAT_TCPUDPICMP))) 3256 || (p == nat->nat_p))) { 3257 switch (p) 3258 { 3259 #if 0 3260 case IPPROTO_GRE : 3261 if (nat->nat_call[1] != fin->fin_data[0]) 3262 continue; 3263 break; 3264 #endif 3265 case IPPROTO_TCP : 3266 case IPPROTO_UDP : 3267 if (nat->nat_oport != dport) 3268 continue; 3269 if (nat->nat_inport != sport) 3270 continue; 3271 break; 3272 default : 3273 break; 3274 } 3275 3276 ipn = nat->nat_ptr; 3277 if ((ipn != NULL) && (nat->nat_aps != NULL)) 3278 if (appr_match(fin, nat) != 0) 3279 continue; 3280 return nat; 3281 } 3282 } 3283 3284 /* 3285 * So if we didn't find it but there are wildcard members in the hash 3286 * table, go back and look for them. We do this search and update here 3287 * because it is modifying the NAT table and we want to do this only 3288 * for the first packet that matches. The exception, of course, is 3289 * for "dummy" (FI_IGNORE) lookups. 3290 */ 3291 find_out_wild_ports: 3292 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) 3293 return NULL; 3294 if (ifs->ifs_nat_stats.ns_wilds == 0) 3295 return NULL; 3296 3297 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3298 3299 hv = NAT_HASH_FN(srcip, 0, 0xffffffff); 3300 hv = NAT_HASH_FN(dst.s_addr, hv, ifs->ifs_ipf_nattable_sz); 3301 3302 WRITE_ENTER(&ifs->ifs_ipf_nat); 3303 3304 nat = ifs->ifs_nat_table[0][hv]; 3305 for (; nat; nat = nat->nat_hnext[0]) { 3306 if (nat->nat_ifps[1] != NULL) { 3307 if ((ifp != NULL) && (ifp != nat->nat_ifps[1])) 3308 continue; 3309 } else if (ifp != NULL) 3310 nat->nat_ifps[1] = ifp; 3311 3312 if (nat->nat_p != fin->fin_p) 3313 continue; 3314 if ((nat->nat_inip.s_addr != srcip) || 3315 (nat->nat_oip.s_addr != dst.s_addr)) 3316 continue; 3317 3318 nflags = nat->nat_flags; 3319 if (!(nflags & (NAT_TCPUDP|SI_WILDP))) 3320 continue; 3321 3322 if (nat_wildok(nat, (int)sport, (int)dport, nflags, 3323 NAT_OUTBOUND) == 1) { 3324 if ((fin->fin_flx & FI_IGNORE) != 0) 3325 break; 3326 if ((nflags & SI_CLONE) != 0) { 3327 nat = fr_natclone(fin, nat); 3328 if (nat == NULL) 3329 break; 3330 } else { 3331 MUTEX_ENTER(&ifs->ifs_ipf_nat_new); 3332 ifs->ifs_nat_stats.ns_wilds--; 3333 MUTEX_EXIT(&ifs->ifs_ipf_nat_new); 3334 } 3335 nat->nat_inport = sport; 3336 nat->nat_oport = dport; 3337 if (nat->nat_outport == 0) 3338 nat->nat_outport = sport; 3339 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT); 3340 nat_tabmove(nat, ifs); 3341 break; 3342 } 3343 } 3344 3345 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 3346 3347 return nat; 3348 } 3349 3350 3351 /* ------------------------------------------------------------------------ */ 3352 /* Function: nat_lookupredir */ 3353 /* Returns: nat_t* - NULL == no match, */ 3354 /* else pointer to matching NAT entry */ 3355 /* Parameters: np(I) - pointer to description of packet to find NAT table */ 3356 /* entry for. */ 3357 /* */ 3358 /* Lookup the NAT tables to search for a matching redirect */ 3359 /* ------------------------------------------------------------------------ */ 3360 nat_t *nat_lookupredir(np, ifs) 3361 natlookup_t *np; 3362 ipf_stack_t *ifs; 3363 { 3364 fr_info_t fi; 3365 nat_t *nat; 3366 3367 bzero((char *)&fi, sizeof(fi)); 3368 if (np->nl_flags & IPN_IN) { 3369 fi.fin_data[0] = ntohs(np->nl_realport); 3370 fi.fin_data[1] = ntohs(np->nl_outport); 3371 } else { 3372 fi.fin_data[0] = ntohs(np->nl_inport); 3373 fi.fin_data[1] = ntohs(np->nl_outport); 3374 } 3375 if (np->nl_flags & IPN_TCP) 3376 fi.fin_p = IPPROTO_TCP; 3377 else if (np->nl_flags & IPN_UDP) 3378 fi.fin_p = IPPROTO_UDP; 3379 else if (np->nl_flags & (IPN_ICMPERR|IPN_ICMPQUERY)) 3380 fi.fin_p = IPPROTO_ICMP; 3381 3382 fi.fin_ifs = ifs; 3383 /* 3384 * We can do two sorts of lookups: 3385 * - IPN_IN: we have the `real' and `out' address, look for `in'. 3386 * - default: we have the `in' and `out' address, look for `real'. 3387 */ 3388 if (np->nl_flags & IPN_IN) { 3389 if ((nat = nat_inlookup(&fi, np->nl_flags, fi.fin_p, 3390 np->nl_realip, np->nl_outip))) { 3391 np->nl_inip = nat->nat_inip; 3392 np->nl_inport = nat->nat_inport; 3393 } 3394 } else { 3395 /* 3396 * If nl_inip is non null, this is a lookup based on the real 3397 * ip address. Else, we use the fake. 3398 */ 3399 if ((nat = nat_outlookup(&fi, np->nl_flags, fi.fin_p, 3400 np->nl_inip, np->nl_outip))) { 3401 3402 if ((np->nl_flags & IPN_FINDFORWARD) != 0) { 3403 fr_info_t fin; 3404 bzero((char *)&fin, sizeof(fin)); 3405 fin.fin_p = nat->nat_p; 3406 fin.fin_data[0] = ntohs(nat->nat_outport); 3407 fin.fin_data[1] = ntohs(nat->nat_oport); 3408 fin.fin_ifs = ifs; 3409 if (nat_inlookup(&fin, np->nl_flags, fin.fin_p, 3410 nat->nat_outip, 3411 nat->nat_oip) != NULL) { 3412 np->nl_flags &= ~IPN_FINDFORWARD; 3413 } 3414 } 3415 3416 np->nl_realip = nat->nat_outip; 3417 np->nl_realport = nat->nat_outport; 3418 } 3419 } 3420 3421 return nat; 3422 } 3423 3424 3425 /* ------------------------------------------------------------------------ */ 3426 /* Function: nat_match */ 3427 /* Returns: int - 0 == no match, 1 == match */ 3428 /* Parameters: fin(I) - pointer to packet information */ 3429 /* np(I) - pointer to NAT rule */ 3430 /* */ 3431 /* Pull the matching of a packet against a NAT rule out of that complex */ 3432 /* loop inside fr_checknatin() and lay it out properly in its own function. */ 3433 /* ------------------------------------------------------------------------ */ 3434 static int nat_match(fin, np) 3435 fr_info_t *fin; 3436 ipnat_t *np; 3437 { 3438 frtuc_t *ft; 3439 3440 if (fin->fin_v != 4) 3441 return 0; 3442 3443 if (np->in_p && fin->fin_p != np->in_p) 3444 return 0; 3445 3446 if (fin->fin_out) { 3447 if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK))) 3448 return 0; 3449 if (((fin->fin_fi.fi_saddr & np->in_inmsk) != np->in_inip) 3450 ^ ((np->in_flags & IPN_NOTSRC) != 0)) 3451 return 0; 3452 if (((fin->fin_fi.fi_daddr & np->in_srcmsk) != np->in_srcip) 3453 ^ ((np->in_flags & IPN_NOTDST) != 0)) 3454 return 0; 3455 } else { 3456 if (!(np->in_redir & NAT_REDIRECT)) 3457 return 0; 3458 if (((fin->fin_fi.fi_saddr & np->in_srcmsk) != np->in_srcip) 3459 ^ ((np->in_flags & IPN_NOTSRC) != 0)) 3460 return 0; 3461 if (((fin->fin_fi.fi_daddr & np->in_outmsk) != np->in_outip) 3462 ^ ((np->in_flags & IPN_NOTDST) != 0)) 3463 return 0; 3464 } 3465 3466 ft = &np->in_tuc; 3467 if (!(fin->fin_flx & FI_TCPUDP) || 3468 (fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) { 3469 if (ft->ftu_scmp || ft->ftu_dcmp) 3470 return 0; 3471 return 1; 3472 } 3473 3474 return fr_tcpudpchk(fin, ft); 3475 } 3476 3477 3478 /* ------------------------------------------------------------------------ */ 3479 /* Function: nat_update */ 3480 /* Returns: Nil */ 3481 /* Parameters: nat(I) - pointer to NAT structure */ 3482 /* np(I) - pointer to NAT rule */ 3483 /* */ 3484 /* Updates the lifetime of a NAT table entry for non-TCP packets. Must be */ 3485 /* called with fin_rev updated - i.e. after calling nat_proto(). */ 3486 /* ------------------------------------------------------------------------ */ 3487 void nat_update(fin, nat, np) 3488 fr_info_t *fin; 3489 nat_t *nat; 3490 ipnat_t *np; 3491 { 3492 ipftq_t *ifq, *ifq2; 3493 ipftqent_t *tqe; 3494 ipf_stack_t *ifs = fin->fin_ifs; 3495 3496 MUTEX_ENTER(&nat->nat_lock); 3497 tqe = &nat->nat_tqe; 3498 ifq = tqe->tqe_ifq; 3499 3500 /* 3501 * We allow over-riding of NAT timeouts from NAT rules, even for 3502 * TCP, however, if it is TCP and there is no rule timeout set, 3503 * then do not update the timeout here. 3504 */ 3505 if (np != NULL) 3506 ifq2 = np->in_tqehead[fin->fin_rev]; 3507 else 3508 ifq2 = NULL; 3509 3510 if (nat->nat_p == IPPROTO_TCP && ifq2 == NULL) { 3511 (void) fr_tcp_age(&nat->nat_tqe, fin, ifs->ifs_nat_tqb, 0); 3512 } else { 3513 if (ifq2 == NULL) { 3514 if (nat->nat_p == IPPROTO_UDP) 3515 ifq2 = &ifs->ifs_nat_udptq; 3516 else if (nat->nat_p == IPPROTO_ICMP) 3517 ifq2 = &ifs->ifs_nat_icmptq; 3518 else 3519 ifq2 = &ifs->ifs_nat_iptq; 3520 } 3521 3522 fr_movequeue(tqe, ifq, ifq2, ifs); 3523 } 3524 MUTEX_EXIT(&nat->nat_lock); 3525 } 3526 3527 3528 /* ------------------------------------------------------------------------ */ 3529 /* Function: fr_checknatout */ 3530 /* Returns: int - -1 == packet failed NAT checks so block it, */ 3531 /* 0 == no packet translation occurred, */ 3532 /* 1 == packet was successfully translated. */ 3533 /* Parameters: fin(I) - pointer to packet information */ 3534 /* passp(I) - pointer to filtering result flags */ 3535 /* */ 3536 /* Check to see if an outcoming packet should be changed. ICMP packets are */ 3537 /* first checked to see if they match an existing entry (if an error), */ 3538 /* otherwise a search of the current NAT table is made. If neither results */ 3539 /* in a match then a search for a matching NAT rule is made. Create a new */ 3540 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */ 3541 /* packet header(s) as required. */ 3542 /* ------------------------------------------------------------------------ */ 3543 int fr_checknatout(fin, passp) 3544 fr_info_t *fin; 3545 u_32_t *passp; 3546 { 3547 struct ifnet *ifp, *sifp; 3548 icmphdr_t *icmp = NULL; 3549 tcphdr_t *tcp = NULL; 3550 int rval, natfailed; 3551 ipnat_t *np = NULL; 3552 u_int nflags = 0; 3553 u_32_t ipa, iph; 3554 int natadd = 1; 3555 frentry_t *fr; 3556 nat_t *nat; 3557 ipf_stack_t *ifs = fin->fin_ifs; 3558 3559 if (ifs->ifs_nat_stats.ns_rules == 0 || ifs->ifs_fr_nat_lock != 0) 3560 return 0; 3561 3562 natfailed = 0; 3563 fr = fin->fin_fr; 3564 sifp = fin->fin_ifp; 3565 if ((fr != NULL) && !(fr->fr_flags & FR_DUP) && 3566 fr->fr_tifs[fin->fin_rev].fd_ifp && 3567 fr->fr_tifs[fin->fin_rev].fd_ifp != (void *)-1) 3568 fin->fin_ifp = fr->fr_tifs[fin->fin_rev].fd_ifp; 3569 ifp = fin->fin_ifp; 3570 3571 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 3572 switch (fin->fin_p) 3573 { 3574 case IPPROTO_TCP : 3575 nflags = IPN_TCP; 3576 break; 3577 case IPPROTO_UDP : 3578 nflags = IPN_UDP; 3579 break; 3580 case IPPROTO_ICMP : 3581 icmp = fin->fin_dp; 3582 3583 /* 3584 * This is an incoming packet, so the destination is 3585 * the icmp_id and the source port equals 0 3586 */ 3587 if (nat_icmpquerytype4(icmp->icmp_type)) 3588 nflags = IPN_ICMPQUERY; 3589 break; 3590 default : 3591 break; 3592 } 3593 3594 if ((nflags & IPN_TCPUDP)) 3595 tcp = fin->fin_dp; 3596 } 3597 3598 ipa = fin->fin_saddr; 3599 3600 READ_ENTER(&ifs->ifs_ipf_nat); 3601 3602 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) && 3603 (nat = nat_icmperror(fin, &nflags, NAT_OUTBOUND))) 3604 /*EMPTY*/; 3605 else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin))) 3606 natadd = 0; 3607 else if ((nat = nat_outlookup(fin, nflags|NAT_SEARCH, (u_int)fin->fin_p, 3608 fin->fin_src, fin->fin_dst))) { 3609 nflags = nat->nat_flags; 3610 } else { 3611 u_32_t hv, msk, nmsk; 3612 3613 /* 3614 * If there is no current entry in the nat table for this IP#, 3615 * create one for it (if there is a matching rule). 3616 */ 3617 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3618 msk = 0xffffffff; 3619 nmsk = ifs->ifs_nat_masks; 3620 WRITE_ENTER(&ifs->ifs_ipf_nat); 3621 maskloop: 3622 iph = ipa & htonl(msk); 3623 hv = NAT_HASH_FN(iph, 0, ifs->ifs_ipf_natrules_sz); 3624 for (np = ifs->ifs_nat_rules[hv]; np; np = np->in_mnext) 3625 { 3626 if ((np->in_ifps[1] && (np->in_ifps[1] != ifp))) 3627 continue; 3628 if (np->in_v != fin->fin_v) 3629 continue; 3630 if (np->in_p && (np->in_p != fin->fin_p)) 3631 continue; 3632 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags)) 3633 continue; 3634 if (np->in_flags & IPN_FILTER) { 3635 if (!nat_match(fin, np)) 3636 continue; 3637 } else if ((ipa & np->in_inmsk) != np->in_inip) 3638 continue; 3639 3640 if ((fr != NULL) && 3641 !fr_matchtag(&np->in_tag, &fr->fr_nattag)) 3642 continue; 3643 3644 if (*np->in_plabel != '\0') { 3645 if (((np->in_flags & IPN_FILTER) == 0) && 3646 (np->in_dport != tcp->th_dport)) 3647 continue; 3648 if (appr_ok(fin, tcp, np) == 0) 3649 continue; 3650 } 3651 3652 if ((nat = nat_new(fin, np, NULL, nflags, 3653 NAT_OUTBOUND))) { 3654 np->in_hits++; 3655 break; 3656 } else 3657 natfailed = -1; 3658 } 3659 if ((np == NULL) && (nmsk != 0)) { 3660 while (nmsk) { 3661 msk <<= 1; 3662 if (nmsk & 0x80000000) 3663 break; 3664 nmsk <<= 1; 3665 } 3666 if (nmsk != 0) { 3667 nmsk <<= 1; 3668 goto maskloop; 3669 } 3670 } 3671 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 3672 } 3673 3674 if (nat != NULL) { 3675 rval = fr_natout(fin, nat, natadd, nflags); 3676 if (rval == 1) { 3677 MUTEX_ENTER(&nat->nat_lock); 3678 nat->nat_ref++; 3679 MUTEX_EXIT(&nat->nat_lock); 3680 fin->fin_nat = nat; 3681 } 3682 } else 3683 rval = natfailed; 3684 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3685 3686 if (rval == -1) { 3687 if (passp != NULL) 3688 *passp = FR_BLOCK; 3689 fin->fin_flx |= FI_BADNAT; 3690 } 3691 fin->fin_ifp = sifp; 3692 return rval; 3693 } 3694 3695 /* ------------------------------------------------------------------------ */ 3696 /* Function: fr_natout */ 3697 /* Returns: int - -1 == packet failed NAT checks so block it, */ 3698 /* 1 == packet was successfully translated. */ 3699 /* Parameters: fin(I) - pointer to packet information */ 3700 /* nat(I) - pointer to NAT structure */ 3701 /* natadd(I) - flag indicating if it is safe to add frag cache */ 3702 /* nflags(I) - NAT flags set for this packet */ 3703 /* */ 3704 /* Translate a packet coming "out" on an interface. */ 3705 /* ------------------------------------------------------------------------ */ 3706 int fr_natout(fin, nat, natadd, nflags) 3707 fr_info_t *fin; 3708 nat_t *nat; 3709 int natadd; 3710 u_32_t nflags; 3711 { 3712 icmphdr_t *icmp; 3713 u_short *csump; 3714 u_32_t sumd; 3715 tcphdr_t *tcp; 3716 ipnat_t *np; 3717 int i; 3718 ipf_stack_t *ifs = fin->fin_ifs; 3719 3720 #if SOLARIS && defined(_KERNEL) 3721 net_data_t net_data_p; 3722 if (fin->fin_v == 4) 3723 net_data_p = ifs->ifs_ipf_ipv4; 3724 else 3725 net_data_p = ifs->ifs_ipf_ipv6; 3726 #endif 3727 3728 tcp = NULL; 3729 icmp = NULL; 3730 csump = NULL; 3731 np = nat->nat_ptr; 3732 3733 if ((natadd != 0) && (fin->fin_flx & FI_FRAG)) 3734 (void) fr_nat_newfrag(fin, 0, nat); 3735 3736 MUTEX_ENTER(&nat->nat_lock); 3737 nat->nat_bytes[1] += fin->fin_plen; 3738 nat->nat_pkts[1]++; 3739 MUTEX_EXIT(&nat->nat_lock); 3740 3741 /* 3742 * Fix up checksums, not by recalculating them, but 3743 * simply computing adjustments. 3744 * This is only done for STREAMS based IP implementations where the 3745 * checksum has already been calculated by IP. In all other cases, 3746 * IPFilter is called before the checksum needs calculating so there 3747 * is no call to modify whatever is in the header now. 3748 */ 3749 ASSERT(fin->fin_m != NULL); 3750 if (fin->fin_v == 4 && !NET_IS_HCK_L3_FULL(net_data_p, fin->fin_m)) { 3751 if (nflags == IPN_ICMPERR) { 3752 u_32_t s1, s2; 3753 3754 s1 = LONG_SUM(ntohl(fin->fin_saddr)); 3755 s2 = LONG_SUM(ntohl(nat->nat_outip.s_addr)); 3756 CALC_SUMD(s1, s2, sumd); 3757 3758 fix_outcksum(&fin->fin_ip->ip_sum, sumd); 3759 } 3760 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 3761 defined(linux) || defined(BRIDGE_IPF) 3762 else { 3763 /* 3764 * Strictly speaking, this isn't necessary on BSD 3765 * kernels because they do checksum calculation after 3766 * this code has run BUT if ipfilter is being used 3767 * to do NAT as a bridge, that code doesn't exist. 3768 */ 3769 if (nat->nat_dir == NAT_OUTBOUND) 3770 fix_outcksum(&fin->fin_ip->ip_sum, 3771 nat->nat_ipsumd); 3772 else 3773 fix_incksum(&fin->fin_ip->ip_sum, 3774 nat->nat_ipsumd); 3775 } 3776 #endif 3777 } 3778 3779 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 3780 if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) { 3781 tcp = fin->fin_dp; 3782 3783 tcp->th_sport = nat->nat_outport; 3784 fin->fin_data[0] = ntohs(nat->nat_outport); 3785 } 3786 3787 if ((nat->nat_outport != 0) && (nflags & IPN_ICMPQUERY)) { 3788 icmp = fin->fin_dp; 3789 icmp->icmp_id = nat->nat_outport; 3790 } 3791 3792 csump = nat_proto(fin, nat, nflags); 3793 } 3794 3795 fin->fin_ip->ip_src = nat->nat_outip; 3796 3797 nat_update(fin, nat, np); 3798 3799 /* 3800 * The above comments do not hold for layer 4 (or higher) checksums... 3801 */ 3802 if (csump != NULL && !NET_IS_HCK_L4_FULL(net_data_p, fin->fin_m)) { 3803 if (nflags & IPN_TCPUDP && 3804 NET_IS_HCK_L4_PART(net_data_p, fin->fin_m)) 3805 sumd = nat->nat_sumd[1]; 3806 else 3807 sumd = nat->nat_sumd[0]; 3808 3809 if (nat->nat_dir == NAT_OUTBOUND) 3810 fix_outcksum(csump, sumd); 3811 else 3812 fix_incksum(csump, sumd); 3813 } 3814 #ifdef IPFILTER_SYNC 3815 ipfsync_update(SMC_NAT, fin, nat->nat_sync); 3816 #endif 3817 /* ------------------------------------------------------------- */ 3818 /* A few quick notes: */ 3819 /* Following are test conditions prior to calling the */ 3820 /* appr_check routine. */ 3821 /* */ 3822 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ 3823 /* with a redirect rule, we attempt to match the packet's */ 3824 /* source port against in_dport, otherwise we'd compare the */ 3825 /* packet's destination. */ 3826 /* ------------------------------------------------------------- */ 3827 if ((np != NULL) && (np->in_apr != NULL)) { 3828 i = appr_check(fin, nat); 3829 if (i == 0) 3830 i = 1; 3831 } else 3832 i = 1; 3833 ATOMIC_INCL(ifs->ifs_nat_stats.ns_mapped[1]); 3834 fin->fin_flx |= FI_NATED; 3835 return i; 3836 } 3837 3838 3839 /* ------------------------------------------------------------------------ */ 3840 /* Function: fr_checknatin */ 3841 /* Returns: int - -1 == packet failed NAT checks so block it, */ 3842 /* 0 == no packet translation occurred, */ 3843 /* 1 == packet was successfully translated. */ 3844 /* Parameters: fin(I) - pointer to packet information */ 3845 /* passp(I) - pointer to filtering result flags */ 3846 /* */ 3847 /* Check to see if an incoming packet should be changed. ICMP packets are */ 3848 /* first checked to see if they match an existing entry (if an error), */ 3849 /* otherwise a search of the current NAT table is made. If neither results */ 3850 /* in a match then a search for a matching NAT rule is made. Create a new */ 3851 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */ 3852 /* packet header(s) as required. */ 3853 /* ------------------------------------------------------------------------ */ 3854 int fr_checknatin(fin, passp) 3855 fr_info_t *fin; 3856 u_32_t *passp; 3857 { 3858 u_int nflags, natadd; 3859 int rval, natfailed; 3860 struct ifnet *ifp; 3861 struct in_addr in; 3862 icmphdr_t *icmp; 3863 tcphdr_t *tcp; 3864 u_short dport; 3865 ipnat_t *np; 3866 nat_t *nat; 3867 u_32_t iph; 3868 ipf_stack_t *ifs = fin->fin_ifs; 3869 3870 if (ifs->ifs_nat_stats.ns_rules == 0 || ifs->ifs_fr_nat_lock != 0) 3871 return 0; 3872 3873 tcp = NULL; 3874 icmp = NULL; 3875 dport = 0; 3876 natadd = 1; 3877 nflags = 0; 3878 natfailed = 0; 3879 ifp = fin->fin_ifp; 3880 3881 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 3882 switch (fin->fin_p) 3883 { 3884 case IPPROTO_TCP : 3885 nflags = IPN_TCP; 3886 break; 3887 case IPPROTO_UDP : 3888 nflags = IPN_UDP; 3889 break; 3890 case IPPROTO_ICMP : 3891 icmp = fin->fin_dp; 3892 3893 /* 3894 * This is an incoming packet, so the destination is 3895 * the icmp_id and the source port equals 0 3896 */ 3897 if (nat_icmpquerytype4(icmp->icmp_type)) { 3898 nflags = IPN_ICMPQUERY; 3899 dport = icmp->icmp_id; 3900 } break; 3901 default : 3902 break; 3903 } 3904 3905 if ((nflags & IPN_TCPUDP)) { 3906 tcp = fin->fin_dp; 3907 dport = tcp->th_dport; 3908 } 3909 } 3910 3911 in = fin->fin_dst; 3912 3913 READ_ENTER(&ifs->ifs_ipf_nat); 3914 3915 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) && 3916 (nat = nat_icmperror(fin, &nflags, NAT_INBOUND))) 3917 /*EMPTY*/; 3918 else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin))) 3919 natadd = 0; 3920 else if ((nat = nat_inlookup(fin, nflags|NAT_SEARCH, (u_int)fin->fin_p, 3921 fin->fin_src, in))) { 3922 nflags = nat->nat_flags; 3923 } else { 3924 u_32_t hv, msk, rmsk; 3925 3926 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3927 rmsk = ifs->ifs_rdr_masks; 3928 msk = 0xffffffff; 3929 WRITE_ENTER(&ifs->ifs_ipf_nat); 3930 /* 3931 * If there is no current entry in the nat table for this IP#, 3932 * create one for it (if there is a matching rule). 3933 */ 3934 maskloop: 3935 iph = in.s_addr & htonl(msk); 3936 hv = NAT_HASH_FN(iph, 0, ifs->ifs_ipf_rdrrules_sz); 3937 for (np = ifs->ifs_rdr_rules[hv]; np; np = np->in_rnext) { 3938 if (np->in_ifps[0] && (np->in_ifps[0] != ifp)) 3939 continue; 3940 if (np->in_v != fin->fin_v) 3941 continue; 3942 if (np->in_p && (np->in_p != fin->fin_p)) 3943 continue; 3944 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags)) 3945 continue; 3946 if (np->in_flags & IPN_FILTER) { 3947 if (!nat_match(fin, np)) 3948 continue; 3949 } else { 3950 if ((in.s_addr & np->in_outmsk) != np->in_outip) 3951 continue; 3952 if (np->in_pmin && 3953 ((ntohs(np->in_pmax) < ntohs(dport)) || 3954 (ntohs(dport) < ntohs(np->in_pmin)))) 3955 continue; 3956 } 3957 3958 if (*np->in_plabel != '\0') { 3959 if (!appr_ok(fin, tcp, np)) { 3960 continue; 3961 } 3962 } 3963 3964 nat = nat_new(fin, np, NULL, nflags, NAT_INBOUND); 3965 if (nat != NULL) { 3966 np->in_hits++; 3967 break; 3968 } else 3969 natfailed = -1; 3970 } 3971 3972 if ((np == NULL) && (rmsk != 0)) { 3973 while (rmsk) { 3974 msk <<= 1; 3975 if (rmsk & 0x80000000) 3976 break; 3977 rmsk <<= 1; 3978 } 3979 if (rmsk != 0) { 3980 rmsk <<= 1; 3981 goto maskloop; 3982 } 3983 } 3984 MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat); 3985 } 3986 if (nat != NULL) { 3987 rval = fr_natin(fin, nat, natadd, nflags); 3988 if (rval == 1) { 3989 MUTEX_ENTER(&nat->nat_lock); 3990 nat->nat_ref++; 3991 MUTEX_EXIT(&nat->nat_lock); 3992 fin->fin_nat = nat; 3993 fin->fin_state = nat->nat_state; 3994 } 3995 } else 3996 rval = natfailed; 3997 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 3998 3999 if (rval == -1) { 4000 if (passp != NULL) 4001 *passp = FR_BLOCK; 4002 fin->fin_flx |= FI_BADNAT; 4003 } 4004 return rval; 4005 } 4006 4007 4008 /* ------------------------------------------------------------------------ */ 4009 /* Function: fr_natin */ 4010 /* Returns: int - -1 == packet failed NAT checks so block it, */ 4011 /* 1 == packet was successfully translated. */ 4012 /* Parameters: fin(I) - pointer to packet information */ 4013 /* nat(I) - pointer to NAT structure */ 4014 /* natadd(I) - flag indicating if it is safe to add frag cache */ 4015 /* nflags(I) - NAT flags set for this packet */ 4016 /* Locks Held: ipf_nat (READ) */ 4017 /* */ 4018 /* Translate a packet coming "in" on an interface. */ 4019 /* ------------------------------------------------------------------------ */ 4020 int fr_natin(fin, nat, natadd, nflags) 4021 fr_info_t *fin; 4022 nat_t *nat; 4023 int natadd; 4024 u_32_t nflags; 4025 { 4026 icmphdr_t *icmp; 4027 u_short *csump, *csump1; 4028 u_32_t sumd; 4029 tcphdr_t *tcp; 4030 ipnat_t *np; 4031 int i; 4032 ipf_stack_t *ifs = fin->fin_ifs; 4033 4034 #if SOLARIS && defined(_KERNEL) 4035 net_data_t net_data_p; 4036 if (fin->fin_v == 4) 4037 net_data_p = ifs->ifs_ipf_ipv4; 4038 else 4039 net_data_p = ifs->ifs_ipf_ipv6; 4040 #endif 4041 4042 tcp = NULL; 4043 csump = NULL; 4044 np = nat->nat_ptr; 4045 fin->fin_fr = nat->nat_fr; 4046 4047 if ((natadd != 0) && (fin->fin_flx & FI_FRAG)) 4048 (void) fr_nat_newfrag(fin, 0, nat); 4049 4050 if (np != NULL) { 4051 4052 /* ------------------------------------------------------------- */ 4053 /* A few quick notes: */ 4054 /* Following are test conditions prior to calling the */ 4055 /* appr_check routine. */ 4056 /* */ 4057 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ 4058 /* with a map rule, we attempt to match the packet's */ 4059 /* source port against in_dport, otherwise we'd compare the */ 4060 /* packet's destination. */ 4061 /* ------------------------------------------------------------- */ 4062 if (np->in_apr != NULL) { 4063 i = appr_check(fin, nat); 4064 if (i == -1) { 4065 return -1; 4066 } 4067 } 4068 } 4069 4070 #ifdef IPFILTER_SYNC 4071 ipfsync_update(SMC_NAT, fin, nat->nat_sync); 4072 #endif 4073 4074 MUTEX_ENTER(&nat->nat_lock); 4075 nat->nat_bytes[0] += fin->fin_plen; 4076 nat->nat_pkts[0]++; 4077 MUTEX_EXIT(&nat->nat_lock); 4078 4079 fin->fin_ip->ip_dst = nat->nat_inip; 4080 fin->fin_fi.fi_daddr = nat->nat_inip.s_addr; 4081 if (nflags & IPN_TCPUDP) 4082 tcp = fin->fin_dp; 4083 4084 /* 4085 * Fix up checksums, not by recalculating them, but 4086 * simply computing adjustments. 4087 * Why only do this for some platforms on inbound packets ? 4088 * Because for those that it is done, IP processing is yet to happen 4089 * and so the IPv4 header checksum has not yet been evaluated. 4090 * Perhaps it should always be done for the benefit of things like 4091 * fast forwarding (so that it doesn't need to be recomputed) but with 4092 * header checksum offloading, perhaps it is a moot point. 4093 */ 4094 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 4095 defined(__osf__) || defined(linux) 4096 if (nat->nat_dir == NAT_OUTBOUND) 4097 fix_incksum(&fin->fin_ip->ip_sum, nat->nat_ipsumd); 4098 else 4099 fix_outcksum(&fin->fin_ip->ip_sum, nat->nat_ipsumd); 4100 #endif 4101 4102 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 4103 if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) { 4104 tcp->th_dport = nat->nat_inport; 4105 fin->fin_data[1] = ntohs(nat->nat_inport); 4106 } 4107 4108 4109 if ((nat->nat_inport != 0) && (nflags & IPN_ICMPQUERY)) { 4110 icmp = fin->fin_dp; 4111 4112 icmp->icmp_id = nat->nat_inport; 4113 } 4114 4115 csump = nat_proto(fin, nat, nflags); 4116 } 4117 4118 nat_update(fin, nat, np); 4119 4120 #if SOLARIS && defined(_KERNEL) 4121 if (nflags & IPN_TCPUDP && 4122 NET_IS_HCK_L4_PART(net_data_p, fin->fin_m)) { 4123 sumd = nat->nat_sumd[1]; 4124 csump1 = &(fin->fin_m->b_datap->db_struioun.cksum.cksum_val.u16); 4125 if (csump1 != NULL) { 4126 if (nat->nat_dir == NAT_OUTBOUND) 4127 fix_incksum(csump1, sumd); 4128 else 4129 fix_outcksum(csump1, sumd); 4130 } 4131 } else 4132 #endif 4133 sumd = nat->nat_sumd[0]; 4134 4135 /* 4136 * Inbound packets always need to have their address adjusted in case 4137 * code following this validates it. 4138 */ 4139 if (csump != NULL) { 4140 if (nat->nat_dir == NAT_OUTBOUND) 4141 fix_incksum(csump, sumd); 4142 else 4143 fix_outcksum(csump, sumd); 4144 } 4145 ATOMIC_INCL(ifs->ifs_nat_stats.ns_mapped[0]); 4146 fin->fin_flx |= FI_NATED; 4147 if (np != NULL && np->in_tag.ipt_num[0] != 0) 4148 fin->fin_nattag = &np->in_tag; 4149 return 1; 4150 } 4151 4152 4153 /* ------------------------------------------------------------------------ */ 4154 /* Function: nat_proto */ 4155 /* Returns: u_short* - pointer to transport header checksum to update, */ 4156 /* NULL if the transport protocol is not recognised */ 4157 /* as needing a checksum update. */ 4158 /* Parameters: fin(I) - pointer to packet information */ 4159 /* nat(I) - pointer to NAT structure */ 4160 /* nflags(I) - NAT flags set for this packet */ 4161 /* */ 4162 /* Return the pointer to the checksum field for each protocol so understood.*/ 4163 /* If support for making other changes to a protocol header is required, */ 4164 /* that is not strictly 'address' translation, such as clamping the MSS in */ 4165 /* TCP down to a specific value, then do it from here. */ 4166 /* ------------------------------------------------------------------------ */ 4167 u_short *nat_proto(fin, nat, nflags) 4168 fr_info_t *fin; 4169 nat_t *nat; 4170 u_int nflags; 4171 { 4172 icmphdr_t *icmp; 4173 u_short *csump; 4174 tcphdr_t *tcp; 4175 udphdr_t *udp; 4176 4177 csump = NULL; 4178 if (fin->fin_out == 0) { 4179 fin->fin_rev = (nat->nat_dir == NAT_OUTBOUND); 4180 } else { 4181 fin->fin_rev = (nat->nat_dir == NAT_INBOUND); 4182 } 4183 4184 switch (fin->fin_p) 4185 { 4186 case IPPROTO_TCP : 4187 tcp = fin->fin_dp; 4188 4189 csump = &tcp->th_sum; 4190 4191 /* 4192 * Do a MSS CLAMPING on a SYN packet, 4193 * only deal IPv4 for now. 4194 */ 4195 if ((nat->nat_mssclamp != 0) && (tcp->th_flags & TH_SYN) != 0) 4196 nat_mssclamp(tcp, nat->nat_mssclamp, csump); 4197 4198 break; 4199 4200 case IPPROTO_UDP : 4201 udp = fin->fin_dp; 4202 4203 if (udp->uh_sum) 4204 csump = &udp->uh_sum; 4205 break; 4206 4207 case IPPROTO_ICMP : 4208 icmp = fin->fin_dp; 4209 4210 if ((nflags & IPN_ICMPQUERY) != 0) { 4211 if (icmp->icmp_cksum != 0) 4212 csump = &icmp->icmp_cksum; 4213 } 4214 break; 4215 } 4216 return csump; 4217 } 4218 4219 4220 /* ------------------------------------------------------------------------ */ 4221 /* Function: fr_natunload */ 4222 /* Returns: Nil */ 4223 /* Parameters: Nil */ 4224 /* */ 4225 /* Free all memory used by NAT structures allocated at runtime. */ 4226 /* ------------------------------------------------------------------------ */ 4227 void fr_natunload(ifs) 4228 ipf_stack_t *ifs; 4229 { 4230 ipftq_t *ifq, *ifqnext; 4231 4232 (void) nat_clearlist(ifs); 4233 (void) nat_flushtable(ifs); 4234 4235 /* 4236 * Proxy timeout queues are not cleaned here because although they 4237 * exist on the NAT list, appr_unload is called after fr_natunload 4238 * and the proxies actually are responsible for them being created. 4239 * Should the proxy timeouts have their own list? There's no real 4240 * justification as this is the only complication. 4241 */ 4242 for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) { 4243 ifqnext = ifq->ifq_next; 4244 if (((ifq->ifq_flags & IFQF_PROXY) == 0) && 4245 (fr_deletetimeoutqueue(ifq) == 0)) 4246 fr_freetimeoutqueue(ifq, ifs); 4247 } 4248 4249 if (ifs->ifs_nat_table[0] != NULL) { 4250 KFREES(ifs->ifs_nat_table[0], 4251 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 4252 ifs->ifs_nat_table[0] = NULL; 4253 } 4254 if (ifs->ifs_nat_table[1] != NULL) { 4255 KFREES(ifs->ifs_nat_table[1], 4256 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz); 4257 ifs->ifs_nat_table[1] = NULL; 4258 } 4259 if (ifs->ifs_nat_rules != NULL) { 4260 KFREES(ifs->ifs_nat_rules, 4261 sizeof(ipnat_t *) * ifs->ifs_ipf_natrules_sz); 4262 ifs->ifs_nat_rules = NULL; 4263 } 4264 if (ifs->ifs_rdr_rules != NULL) { 4265 KFREES(ifs->ifs_rdr_rules, 4266 sizeof(ipnat_t *) * ifs->ifs_ipf_rdrrules_sz); 4267 ifs->ifs_rdr_rules = NULL; 4268 } 4269 if (ifs->ifs_maptable != NULL) { 4270 KFREES(ifs->ifs_maptable, 4271 sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz); 4272 ifs->ifs_maptable = NULL; 4273 } 4274 if (ifs->ifs_nat_stats.ns_bucketlen[0] != NULL) { 4275 KFREES(ifs->ifs_nat_stats.ns_bucketlen[0], 4276 sizeof(u_long *) * ifs->ifs_ipf_nattable_sz); 4277 ifs->ifs_nat_stats.ns_bucketlen[0] = NULL; 4278 } 4279 if (ifs->ifs_nat_stats.ns_bucketlen[1] != NULL) { 4280 KFREES(ifs->ifs_nat_stats.ns_bucketlen[1], 4281 sizeof(u_long *) * ifs->ifs_ipf_nattable_sz); 4282 ifs->ifs_nat_stats.ns_bucketlen[1] = NULL; 4283 } 4284 4285 if (ifs->ifs_fr_nat_maxbucket_reset == 1) 4286 ifs->ifs_fr_nat_maxbucket = 0; 4287 4288 if (ifs->ifs_fr_nat_init == 1) { 4289 ifs->ifs_fr_nat_init = 0; 4290 fr_sttab_destroy(ifs->ifs_nat_tqb); 4291 4292 RW_DESTROY(&ifs->ifs_ipf_natfrag); 4293 RW_DESTROY(&ifs->ifs_ipf_nat); 4294 4295 MUTEX_DESTROY(&ifs->ifs_ipf_nat_new); 4296 MUTEX_DESTROY(&ifs->ifs_ipf_natio); 4297 4298 MUTEX_DESTROY(&ifs->ifs_nat_udptq.ifq_lock); 4299 MUTEX_DESTROY(&ifs->ifs_nat_icmptq.ifq_lock); 4300 MUTEX_DESTROY(&ifs->ifs_nat_iptq.ifq_lock); 4301 } 4302 } 4303 4304 4305 /* ------------------------------------------------------------------------ */ 4306 /* Function: fr_natexpire */ 4307 /* Returns: Nil */ 4308 /* Parameters: Nil */ 4309 /* */ 4310 /* Check all of the timeout queues for entries at the top which need to be */ 4311 /* expired. */ 4312 /* ------------------------------------------------------------------------ */ 4313 void fr_natexpire(ifs) 4314 ipf_stack_t *ifs; 4315 { 4316 ipftq_t *ifq, *ifqnext; 4317 ipftqent_t *tqe, *tqn; 4318 int i; 4319 SPL_INT(s); 4320 4321 SPL_NET(s); 4322 WRITE_ENTER(&ifs->ifs_ipf_nat); 4323 for (ifq = ifs->ifs_nat_tqb, i = 0; ifq != NULL; ifq = ifq->ifq_next) { 4324 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) { 4325 if (tqe->tqe_die > ifs->ifs_fr_ticks) 4326 break; 4327 tqn = tqe->tqe_next; 4328 nat_delete(tqe->tqe_parent, NL_EXPIRE, ifs); 4329 } 4330 } 4331 4332 for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) { 4333 ifqnext = ifq->ifq_next; 4334 4335 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) { 4336 if (tqe->tqe_die > ifs->ifs_fr_ticks) 4337 break; 4338 tqn = tqe->tqe_next; 4339 nat_delete(tqe->tqe_parent, NL_EXPIRE, ifs); 4340 } 4341 } 4342 4343 for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) { 4344 ifqnext = ifq->ifq_next; 4345 4346 if (((ifq->ifq_flags & IFQF_DELETE) != 0) && 4347 (ifq->ifq_ref == 0)) { 4348 fr_freetimeoutqueue(ifq, ifs); 4349 } 4350 } 4351 4352 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4353 SPL_X(s); 4354 } 4355 4356 4357 /* ------------------------------------------------------------------------ */ 4358 /* Function: fr_nataddrsync */ 4359 /* Returns: Nil */ 4360 /* Parameters: ifp(I) - pointer to network interface */ 4361 /* addr(I) - pointer to new network address */ 4362 /* */ 4363 /* Walk through all of the currently active NAT sessions, looking for those */ 4364 /* which need to have their translated address updated (where the interface */ 4365 /* matches the one passed in) and change it, recalculating the checksum sum */ 4366 /* difference too. */ 4367 /* ------------------------------------------------------------------------ */ 4368 void fr_nataddrsync(ifp, addr, ifs) 4369 void *ifp; 4370 struct in_addr *addr; 4371 ipf_stack_t *ifs; 4372 { 4373 u_32_t sum1, sum2, sumd; 4374 nat_t *nat; 4375 ipnat_t *np; 4376 SPL_INT(s); 4377 4378 if (ifs->ifs_fr_running <= 0) 4379 return; 4380 4381 SPL_NET(s); 4382 WRITE_ENTER(&ifs->ifs_ipf_nat); 4383 4384 if (ifs->ifs_fr_running <= 0) { 4385 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4386 return; 4387 } 4388 4389 /* 4390 * Change IP addresses for NAT sessions for any protocol except TCP 4391 * since it will break the TCP connection anyway. The only rules 4392 * which will get changed are those which are "map ... -> 0/32", 4393 * where the rule specifies the address is taken from the interface. 4394 */ 4395 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4396 if (addr != NULL) { 4397 if (((ifp != NULL) && ifp != (nat->nat_ifps[0])) || 4398 ((nat->nat_flags & IPN_TCP) != 0)) 4399 continue; 4400 if (((np = nat->nat_ptr) == NULL) || 4401 (np->in_nip || (np->in_outmsk != 0xffffffff))) 4402 continue; 4403 4404 /* 4405 * Change the map-to address to be the same as the 4406 * new one. 4407 */ 4408 sum1 = nat->nat_outip.s_addr; 4409 nat->nat_outip = *addr; 4410 sum2 = nat->nat_outip.s_addr; 4411 4412 } else if (((ifp == NULL) || (ifp == nat->nat_ifps[0])) && 4413 !(nat->nat_flags & IPN_TCP) && (np = nat->nat_ptr) && 4414 (np->in_outmsk == 0xffffffff) && !np->in_nip) { 4415 struct in_addr in; 4416 4417 /* 4418 * Change the map-to address to be the same as the 4419 * new one. 4420 */ 4421 sum1 = nat->nat_outip.s_addr; 4422 if (fr_ifpaddr(4, FRI_NORMAL, nat->nat_ifps[0], 4423 &in, NULL, ifs) != -1) 4424 nat->nat_outip = in; 4425 sum2 = nat->nat_outip.s_addr; 4426 } else { 4427 continue; 4428 } 4429 4430 if (sum1 == sum2) 4431 continue; 4432 /* 4433 * Readjust the checksum adjustment to take into 4434 * account the new IP#. 4435 */ 4436 CALC_SUMD(sum1, sum2, sumd); 4437 /* XXX - dont change for TCP when solaris does 4438 * hardware checksumming. 4439 */ 4440 sumd += nat->nat_sumd[0]; 4441 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 4442 nat->nat_sumd[1] = nat->nat_sumd[0]; 4443 } 4444 4445 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4446 SPL_X(s); 4447 } 4448 4449 4450 /* ------------------------------------------------------------------------ */ 4451 /* Function: fr_natifpsync */ 4452 /* Returns: Nil */ 4453 /* Parameters: action(I) - how we are syncing */ 4454 /* ifp(I) - pointer to network interface */ 4455 /* name(I) - name of interface to sync to */ 4456 /* */ 4457 /* This function is used to resync the mapping of interface names and their */ 4458 /* respective 'pointers'. For "action == IPFSYNC_RESYNC", resync all */ 4459 /* interfaces by doing a new lookup of name to 'pointer'. For "action == */ 4460 /* IPFSYNC_NEWIFP", treat ifp as the new pointer value associated with */ 4461 /* "name" and for "action == IPFSYNC_OLDIFP", ifp is a pointer for which */ 4462 /* there is no longer any interface associated with it. */ 4463 /* ------------------------------------------------------------------------ */ 4464 void fr_natifpsync(action, ifp, name, ifs) 4465 int action; 4466 void *ifp; 4467 char *name; 4468 ipf_stack_t *ifs; 4469 { 4470 #if defined(_KERNEL) && !defined(MENTAT) && defined(USE_SPL) 4471 int s; 4472 #endif 4473 nat_t *nat; 4474 ipnat_t *n; 4475 4476 if (ifs->ifs_fr_running <= 0) 4477 return; 4478 4479 SPL_NET(s); 4480 WRITE_ENTER(&ifs->ifs_ipf_nat); 4481 4482 if (ifs->ifs_fr_running <= 0) { 4483 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4484 return; 4485 } 4486 4487 switch (action) 4488 { 4489 case IPFSYNC_RESYNC : 4490 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4491 if ((ifp == nat->nat_ifps[0]) || 4492 (nat->nat_ifps[0] == (void *)-1)) { 4493 nat->nat_ifps[0] = 4494 fr_resolvenic(nat->nat_ifnames[0], 4, ifs); 4495 } 4496 4497 if ((ifp == nat->nat_ifps[1]) || 4498 (nat->nat_ifps[1] == (void *)-1)) { 4499 nat->nat_ifps[1] = 4500 fr_resolvenic(nat->nat_ifnames[1], 4, ifs); 4501 } 4502 } 4503 4504 for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) { 4505 if (n->in_ifps[0] == ifp || 4506 n->in_ifps[0] == (void *)-1) { 4507 n->in_ifps[0] = 4508 fr_resolvenic(n->in_ifnames[0], 4, ifs); 4509 } 4510 if (n->in_ifps[1] == ifp || 4511 n->in_ifps[1] == (void *)-1) { 4512 n->in_ifps[1] = 4513 fr_resolvenic(n->in_ifnames[1], 4, ifs); 4514 } 4515 } 4516 break; 4517 case IPFSYNC_NEWIFP : 4518 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4519 if (!strncmp(name, nat->nat_ifnames[0], 4520 sizeof(nat->nat_ifnames[0]))) 4521 nat->nat_ifps[0] = ifp; 4522 if (!strncmp(name, nat->nat_ifnames[1], 4523 sizeof(nat->nat_ifnames[1]))) 4524 nat->nat_ifps[1] = ifp; 4525 } 4526 for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) { 4527 if (!strncmp(name, n->in_ifnames[0], 4528 sizeof(n->in_ifnames[0]))) 4529 n->in_ifps[0] = ifp; 4530 if (!strncmp(name, n->in_ifnames[1], 4531 sizeof(n->in_ifnames[1]))) 4532 n->in_ifps[1] = ifp; 4533 } 4534 break; 4535 case IPFSYNC_OLDIFP : 4536 for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) { 4537 if (ifp == nat->nat_ifps[0]) 4538 nat->nat_ifps[0] = (void *)-1; 4539 if (ifp == nat->nat_ifps[1]) 4540 nat->nat_ifps[1] = (void *)-1; 4541 } 4542 for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) { 4543 if (n->in_ifps[0] == ifp) 4544 n->in_ifps[0] = (void *)-1; 4545 if (n->in_ifps[1] == ifp) 4546 n->in_ifps[1] = (void *)-1; 4547 } 4548 break; 4549 } 4550 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4551 SPL_X(s); 4552 } 4553 4554 4555 /* ------------------------------------------------------------------------ */ 4556 /* Function: nat_icmpquerytype4 */ 4557 /* Returns: int - 1 == success, 0 == failure */ 4558 /* Parameters: icmptype(I) - ICMP type number */ 4559 /* */ 4560 /* Tests to see if the ICMP type number passed is a query/response type or */ 4561 /* not. */ 4562 /* ------------------------------------------------------------------------ */ 4563 static INLINE int nat_icmpquerytype4(icmptype) 4564 int icmptype; 4565 { 4566 4567 /* 4568 * For the ICMP query NAT code, it is essential that both the query 4569 * and the reply match on the NAT rule. Because the NAT structure 4570 * does not keep track of the icmptype, and a single NAT structure 4571 * is used for all icmp types with the same src, dest and id, we 4572 * simply define the replies as queries as well. The funny thing is, 4573 * altough it seems silly to call a reply a query, this is exactly 4574 * as it is defined in the IPv4 specification 4575 */ 4576 4577 switch (icmptype) 4578 { 4579 4580 case ICMP_ECHOREPLY: 4581 case ICMP_ECHO: 4582 /* route aedvertisement/solliciation is currently unsupported: */ 4583 /* it would require rewriting the ICMP data section */ 4584 case ICMP_TSTAMP: 4585 case ICMP_TSTAMPREPLY: 4586 case ICMP_IREQ: 4587 case ICMP_IREQREPLY: 4588 case ICMP_MASKREQ: 4589 case ICMP_MASKREPLY: 4590 return 1; 4591 default: 4592 return 0; 4593 } 4594 } 4595 4596 4597 /* ------------------------------------------------------------------------ */ 4598 /* Function: nat_log */ 4599 /* Returns: Nil */ 4600 /* Parameters: nat(I) - pointer to NAT structure */ 4601 /* type(I) - type of log entry to create */ 4602 /* */ 4603 /* Creates a NAT log entry. */ 4604 /* ------------------------------------------------------------------------ */ 4605 void nat_log(nat, type, ifs) 4606 struct nat *nat; 4607 u_int type; 4608 ipf_stack_t *ifs; 4609 { 4610 #ifdef IPFILTER_LOG 4611 # ifndef LARGE_NAT 4612 struct ipnat *np; 4613 int rulen; 4614 # endif 4615 struct natlog natl; 4616 void *items[1]; 4617 size_t sizes[1]; 4618 int types[1]; 4619 4620 natl.nl_inip = nat->nat_inip; 4621 natl.nl_outip = nat->nat_outip; 4622 natl.nl_origip = nat->nat_oip; 4623 natl.nl_bytes[0] = nat->nat_bytes[0]; 4624 natl.nl_bytes[1] = nat->nat_bytes[1]; 4625 natl.nl_pkts[0] = nat->nat_pkts[0]; 4626 natl.nl_pkts[1] = nat->nat_pkts[1]; 4627 natl.nl_origport = nat->nat_oport; 4628 natl.nl_inport = nat->nat_inport; 4629 natl.nl_outport = nat->nat_outport; 4630 natl.nl_p = nat->nat_p; 4631 natl.nl_type = type; 4632 natl.nl_rule = -1; 4633 # ifndef LARGE_NAT 4634 if (nat->nat_ptr != NULL) { 4635 for (rulen = 0, np = ifs->ifs_nat_list; np; 4636 np = np->in_next, rulen++) 4637 if (np == nat->nat_ptr) { 4638 natl.nl_rule = rulen; 4639 break; 4640 } 4641 } 4642 # endif 4643 items[0] = &natl; 4644 sizes[0] = sizeof(natl); 4645 types[0] = 0; 4646 4647 (void) ipllog(IPL_LOGNAT, NULL, items, sizes, types, 1, ifs); 4648 #endif 4649 } 4650 4651 4652 #if defined(__OpenBSD__) 4653 /* ------------------------------------------------------------------------ */ 4654 /* Function: nat_ifdetach */ 4655 /* Returns: Nil */ 4656 /* Parameters: ifp(I) - pointer to network interface */ 4657 /* */ 4658 /* Compatibility interface for OpenBSD to trigger the correct updating of */ 4659 /* interface references within IPFilter. */ 4660 /* ------------------------------------------------------------------------ */ 4661 void nat_ifdetach(ifp, ifs) 4662 void *ifp; 4663 ipf_stack_t *ifs; 4664 { 4665 frsync(ifp, ifs); 4666 return; 4667 } 4668 #endif 4669 4670 4671 /* ------------------------------------------------------------------------ */ 4672 /* Function: fr_ipnatderef */ 4673 /* Returns: Nil */ 4674 /* Parameters: isp(I) - pointer to pointer to NAT rule */ 4675 /* Write Locks: ipf_nat */ 4676 /* */ 4677 /* ------------------------------------------------------------------------ */ 4678 void fr_ipnatderef(inp, ifs) 4679 ipnat_t **inp; 4680 ipf_stack_t *ifs; 4681 { 4682 ipnat_t *in; 4683 4684 in = *inp; 4685 *inp = NULL; 4686 in->in_space++; 4687 in->in_use--; 4688 if (in->in_use == 0 && (in->in_flags & IPN_DELETE)) { 4689 if (in->in_apr) 4690 appr_free(in->in_apr); 4691 KFREE(in); 4692 ifs->ifs_nat_stats.ns_rules--; 4693 #ifdef notdef 4694 #if SOLARIS 4695 if (ifs->ifs_nat_stats.ns_rules == 0) 4696 ifs->ifs_pfil_delayed_copy = 1; 4697 #endif 4698 #endif 4699 } 4700 } 4701 4702 4703 /* ------------------------------------------------------------------------ */ 4704 /* Function: fr_natderef */ 4705 /* Returns: Nil */ 4706 /* Parameters: isp(I) - pointer to pointer to NAT table entry */ 4707 /* */ 4708 /* Decrement the reference counter for this NAT table entry and free it if */ 4709 /* there are no more things using it. */ 4710 /* ------------------------------------------------------------------------ */ 4711 void fr_natderef(natp, ifs) 4712 nat_t **natp; 4713 ipf_stack_t *ifs; 4714 { 4715 nat_t *nat; 4716 4717 nat = *natp; 4718 *natp = NULL; 4719 WRITE_ENTER(&ifs->ifs_ipf_nat); 4720 nat->nat_ref--; 4721 if (nat->nat_ref == 0) 4722 nat_delete(nat, NL_EXPIRE, ifs); 4723 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 4724 } 4725 4726 4727 /* ------------------------------------------------------------------------ */ 4728 /* Function: fr_natclone */ 4729 /* Returns: ipstate_t* - NULL == cloning failed, */ 4730 /* else pointer to new state structure */ 4731 /* Parameters: fin(I) - pointer to packet information */ 4732 /* is(I) - pointer to master state structure */ 4733 /* Write Lock: ipf_nat */ 4734 /* */ 4735 /* Create a "duplcate" state table entry from the master. */ 4736 /* ------------------------------------------------------------------------ */ 4737 static nat_t *fr_natclone(fin, nat) 4738 fr_info_t *fin; 4739 nat_t *nat; 4740 { 4741 frentry_t *fr; 4742 nat_t *clone; 4743 ipnat_t *np; 4744 ipf_stack_t *ifs = fin->fin_ifs; 4745 4746 KMALLOC(clone, nat_t *); 4747 if (clone == NULL) 4748 return NULL; 4749 bcopy((char *)nat, (char *)clone, sizeof(*clone)); 4750 4751 MUTEX_NUKE(&clone->nat_lock); 4752 4753 clone->nat_aps = NULL; 4754 /* 4755 * Initialize all these so that nat_delete() doesn't cause a crash. 4756 */ 4757 clone->nat_tqe.tqe_pnext = NULL; 4758 clone->nat_tqe.tqe_next = NULL; 4759 clone->nat_tqe.tqe_ifq = NULL; 4760 clone->nat_tqe.tqe_parent = clone; 4761 4762 clone->nat_flags &= ~SI_CLONE; 4763 clone->nat_flags |= SI_CLONED; 4764 4765 if (clone->nat_hm) 4766 clone->nat_hm->hm_ref++; 4767 4768 if (nat_insert(clone, fin->fin_rev, ifs) == -1) { 4769 KFREE(clone); 4770 return NULL; 4771 } 4772 np = clone->nat_ptr; 4773 if (np != NULL) { 4774 if (ifs->ifs_nat_logging) 4775 nat_log(clone, (u_int)np->in_redir, ifs); 4776 np->in_use++; 4777 } 4778 fr = clone->nat_fr; 4779 if (fr != NULL) { 4780 MUTEX_ENTER(&fr->fr_lock); 4781 fr->fr_ref++; 4782 MUTEX_EXIT(&fr->fr_lock); 4783 } 4784 4785 /* 4786 * Because the clone is created outside the normal loop of things and 4787 * TCP has special needs in terms of state, initialise the timeout 4788 * state of the new NAT from here. 4789 */ 4790 if (clone->nat_p == IPPROTO_TCP) { 4791 (void) fr_tcp_age(&clone->nat_tqe, fin, ifs->ifs_nat_tqb, 4792 clone->nat_flags); 4793 } 4794 #ifdef IPFILTER_SYNC 4795 clone->nat_sync = ipfsync_new(SMC_NAT, fin, clone); 4796 #endif 4797 if (ifs->ifs_nat_logging) 4798 nat_log(clone, NL_CLONE, ifs); 4799 return clone; 4800 } 4801 4802 4803 /* ------------------------------------------------------------------------ */ 4804 /* Function: nat_wildok */ 4805 /* Returns: int - 1 == packet's ports match wildcards */ 4806 /* 0 == packet's ports don't match wildcards */ 4807 /* Parameters: nat(I) - NAT entry */ 4808 /* sport(I) - source port */ 4809 /* dport(I) - destination port */ 4810 /* flags(I) - wildcard flags */ 4811 /* dir(I) - packet direction */ 4812 /* */ 4813 /* Use NAT entry and packet direction to determine which combination of */ 4814 /* wildcard flags should be used. */ 4815 /* ------------------------------------------------------------------------ */ 4816 static INLINE int nat_wildok(nat, sport, dport, flags, dir) 4817 nat_t *nat; 4818 int sport; 4819 int dport; 4820 int flags; 4821 int dir; 4822 { 4823 /* 4824 * When called by dir is set to 4825 * nat_inlookup NAT_INBOUND (0) 4826 * nat_outlookup NAT_OUTBOUND (1) 4827 * 4828 * We simply combine the packet's direction in dir with the original 4829 * "intended" direction of that NAT entry in nat->nat_dir to decide 4830 * which combination of wildcard flags to allow. 4831 */ 4832 4833 switch ((dir << 1) | nat->nat_dir) 4834 { 4835 case 3: /* outbound packet / outbound entry */ 4836 if (((nat->nat_inport == sport) || 4837 (flags & SI_W_SPORT)) && 4838 ((nat->nat_oport == dport) || 4839 (flags & SI_W_DPORT))) 4840 return 1; 4841 break; 4842 case 2: /* outbound packet / inbound entry */ 4843 if (((nat->nat_outport == sport) || 4844 (flags & SI_W_DPORT)) && 4845 ((nat->nat_oport == dport) || 4846 (flags & SI_W_SPORT))) 4847 return 1; 4848 break; 4849 case 1: /* inbound packet / outbound entry */ 4850 if (((nat->nat_oport == sport) || 4851 (flags & SI_W_DPORT)) && 4852 ((nat->nat_outport == dport) || 4853 (flags & SI_W_SPORT))) 4854 return 1; 4855 break; 4856 case 0: /* inbound packet / inbound entry */ 4857 if (((nat->nat_oport == sport) || 4858 (flags & SI_W_SPORT)) && 4859 ((nat->nat_outport == dport) || 4860 (flags & SI_W_DPORT))) 4861 return 1; 4862 break; 4863 default: 4864 break; 4865 } 4866 4867 return(0); 4868 } 4869 4870 4871 /* ------------------------------------------------------------------------ */ 4872 /* Function: nat_mssclamp */ 4873 /* Returns: Nil */ 4874 /* Parameters: tcp(I) - pointer to TCP header */ 4875 /* maxmss(I) - value to clamp the TCP MSS to */ 4876 /* csump(I) - pointer to TCP checksum */ 4877 /* */ 4878 /* Check for MSS option and clamp it if necessary. If found and changed, */ 4879 /* then the TCP header checksum will be updated to reflect the change in */ 4880 /* the MSS. */ 4881 /* ------------------------------------------------------------------------ */ 4882 static void nat_mssclamp(tcp, maxmss, csump) 4883 tcphdr_t *tcp; 4884 u_32_t maxmss; 4885 u_short *csump; 4886 { 4887 u_char *cp, *ep, opt; 4888 int hlen, advance; 4889 u_32_t mss, sumd; 4890 4891 hlen = TCP_OFF(tcp) << 2; 4892 if (hlen > sizeof(*tcp)) { 4893 cp = (u_char *)tcp + sizeof(*tcp); 4894 ep = (u_char *)tcp + hlen; 4895 4896 while (cp < ep) { 4897 opt = cp[0]; 4898 if (opt == TCPOPT_EOL) 4899 break; 4900 else if (opt == TCPOPT_NOP) { 4901 cp++; 4902 continue; 4903 } 4904 4905 if (cp + 1 >= ep) 4906 break; 4907 advance = cp[1]; 4908 if ((cp + advance > ep) || (advance <= 0)) 4909 break; 4910 switch (opt) 4911 { 4912 case TCPOPT_MAXSEG: 4913 if (advance != 4) 4914 break; 4915 mss = cp[2] * 256 + cp[3]; 4916 if (mss > maxmss) { 4917 cp[2] = maxmss / 256; 4918 cp[3] = maxmss & 0xff; 4919 CALC_SUMD(mss, maxmss, sumd); 4920 fix_outcksum(csump, sumd); 4921 } 4922 break; 4923 default: 4924 /* ignore unknown options */ 4925 break; 4926 } 4927 4928 cp += advance; 4929 } 4930 } 4931 } 4932 4933 4934 /* ------------------------------------------------------------------------ */ 4935 /* Function: fr_setnatqueue */ 4936 /* Returns: Nil */ 4937 /* Parameters: nat(I)- pointer to NAT structure */ 4938 /* rev(I) - forward(0) or reverse(1) direction */ 4939 /* Locks: ipf_nat (read or write) */ 4940 /* */ 4941 /* Put the NAT entry on its default queue entry, using rev as a helped in */ 4942 /* determining which queue it should be placed on. */ 4943 /* ------------------------------------------------------------------------ */ 4944 void fr_setnatqueue(nat, rev, ifs) 4945 nat_t *nat; 4946 int rev; 4947 ipf_stack_t *ifs; 4948 { 4949 ipftq_t *oifq, *nifq; 4950 4951 if (nat->nat_ptr != NULL) 4952 nifq = nat->nat_ptr->in_tqehead[rev]; 4953 else 4954 nifq = NULL; 4955 4956 if (nifq == NULL) { 4957 switch (nat->nat_p) 4958 { 4959 case IPPROTO_UDP : 4960 nifq = &ifs->ifs_nat_udptq; 4961 break; 4962 case IPPROTO_ICMP : 4963 nifq = &ifs->ifs_nat_icmptq; 4964 break; 4965 case IPPROTO_TCP : 4966 nifq = ifs->ifs_nat_tqb + nat->nat_tqe.tqe_state[rev]; 4967 break; 4968 default : 4969 nifq = &ifs->ifs_nat_iptq; 4970 break; 4971 } 4972 } 4973 4974 oifq = nat->nat_tqe.tqe_ifq; 4975 /* 4976 * If it's currently on a timeout queue, move it from one queue to 4977 * another, else put it on the end of the newly determined queue. 4978 */ 4979 if (oifq != NULL) 4980 fr_movequeue(&nat->nat_tqe, oifq, nifq, ifs); 4981 else 4982 fr_queueappend(&nat->nat_tqe, nifq, nat, ifs); 4983 return; 4984 } 4985 4986 /* Function: nat_getnext */ 4987 /* Returns: int - 0 == ok, else error */ 4988 /* Parameters: t(I) - pointer to ipftoken structure */ 4989 /* itp(I) - pointer to ipfgeniter_t structure */ 4990 /* */ 4991 /* Fetch the next nat/ipnat structure pointer from the linked list and */ 4992 /* copy it out to the storage space pointed to by itp_data. The next item */ 4993 /* in the list to look at is put back in the ipftoken struture. */ 4994 /* If we call ipf_freetoken, the accompanying pointer is set to NULL because*/ 4995 /* ipf_freetoken will call a deref function for us and we dont want to call */ 4996 /* that twice (second time would be in the second switch statement below. */ 4997 /* ------------------------------------------------------------------------ */ 4998 static int nat_getnext(t, itp, ifs) 4999 ipftoken_t *t; 5000 ipfgeniter_t *itp; 5001 ipf_stack_t *ifs; 5002 { 5003 hostmap_t *hm, *nexthm = NULL, zerohm; 5004 ipnat_t *ipn, *nextipnat = NULL, zeroipn; 5005 nat_t *nat, *nextnat = NULL, zeronat; 5006 int error = 0; 5007 5008 READ_ENTER(&ifs->ifs_ipf_nat); 5009 switch (itp->igi_type) 5010 { 5011 case IPFGENITER_HOSTMAP : 5012 hm = t->ipt_data; 5013 if (hm == NULL) { 5014 nexthm = ifs->ifs_ipf_hm_maplist; 5015 } else { 5016 nexthm = hm->hm_hnext; 5017 } 5018 if (nexthm != NULL) { 5019 if (nexthm->hm_hnext == NULL) { 5020 t->ipt_alive = 0; 5021 ipf_unlinktoken(t, ifs); 5022 KFREE(t); 5023 } else { 5024 /*MUTEX_ENTER(&nexthm->hm_lock);*/ 5025 nexthm->hm_ref++; 5026 /*MUTEX_EXIT(&nextipnat->hm_lock);*/ 5027 } 5028 5029 } else { 5030 bzero(&zerohm, sizeof(zerohm)); 5031 nexthm = &zerohm; 5032 ipf_freetoken(t, ifs); 5033 } 5034 break; 5035 5036 case IPFGENITER_IPNAT : 5037 ipn = t->ipt_data; 5038 if (ipn == NULL) { 5039 nextipnat = ifs->ifs_nat_list; 5040 } else { 5041 nextipnat = ipn->in_next; 5042 } 5043 if (nextipnat != NULL) { 5044 if (nextipnat->in_next == NULL) { 5045 t->ipt_alive = 0; 5046 ipf_unlinktoken(t, ifs); 5047 KFREE(t); 5048 } else { 5049 /* MUTEX_ENTER(&nextipnat->in_lock); */ 5050 nextipnat->in_use++; 5051 /* MUTEX_EXIT(&nextipnat->in_lock); */ 5052 } 5053 } else { 5054 bzero(&zeroipn, sizeof(zeroipn)); 5055 nextipnat = &zeroipn; 5056 ipf_freetoken(t, ifs); 5057 } 5058 break; 5059 5060 case IPFGENITER_NAT : 5061 nat = t->ipt_data; 5062 if (nat == NULL) { 5063 nextnat = ifs->ifs_nat_instances; 5064 } else { 5065 nextnat = nat->nat_next; 5066 } 5067 if (nextnat != NULL) { 5068 if (nextnat->nat_next == NULL) { 5069 t->ipt_alive = 0; 5070 ipf_unlinktoken(t, ifs); 5071 KFREE(t); 5072 } else { 5073 MUTEX_ENTER(&nextnat->nat_lock); 5074 nextnat->nat_ref++; 5075 MUTEX_EXIT(&nextnat->nat_lock); 5076 } 5077 } else { 5078 bzero(&zeronat, sizeof(zeronat)); 5079 nextnat = &zeronat; 5080 ipf_freetoken(t, ifs); 5081 } 5082 break; 5083 } 5084 5085 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 5086 5087 switch (itp->igi_type) 5088 { 5089 case IPFGENITER_HOSTMAP : 5090 if (hm != NULL) { 5091 WRITE_ENTER(&ifs->ifs_ipf_nat); 5092 fr_hostmapderef(&hm); 5093 RWLOCK_EXIT(&ifs->ifs_ipf_nat); 5094 } 5095 if (nexthm->hm_hnext != NULL) 5096 t->ipt_data = nexthm; 5097 error = COPYOUT(nexthm, itp->igi_data, sizeof(*nexthm)); 5098 if (error != 0) 5099 error = EFAULT; 5100 break; 5101 5102 case IPFGENITER_IPNAT : 5103 if (ipn != NULL) 5104 fr_ipnatderef(&ipn, ifs); 5105 if (nextipnat->in_next != NULL) 5106 t->ipt_data = nextipnat; 5107 error = COPYOUT(nextipnat, itp->igi_data, sizeof(*nextipnat)); 5108 if (error != 0) 5109 error = EFAULT; 5110 break; 5111 5112 case IPFGENITER_NAT : 5113 if (nat != NULL) 5114 fr_natderef(&nat, ifs); 5115 if (nextnat->nat_next != NULL) 5116 t->ipt_data = nextnat; 5117 error = COPYOUT(nextnat, itp->igi_data, sizeof(*nextnat)); 5118 if (error != 0) 5119 error = EFAULT; 5120 break; 5121 } 5122 5123 return error; 5124 } 5125 5126 5127 /* ------------------------------------------------------------------------ */ 5128 /* Function: nat_iterator */ 5129 /* Returns: int - 0 == ok, else error */ 5130 /* Parameters: token(I) - pointer to ipftoken structure */ 5131 /* itp(I) - pointer to ipfgeniter_t structure */ 5132 /* */ 5133 /* This function acts as a handler for the SIOCGENITER ioctls that use a */ 5134 /* generic structure to iterate through a list. There are three different */ 5135 /* linked lists of NAT related information to go through: NAT rules, active */ 5136 /* NAT mappings and the NAT fragment cache. */ 5137 /* ------------------------------------------------------------------------ */ 5138 static int nat_iterator(token, itp, ifs) 5139 ipftoken_t *token; 5140 ipfgeniter_t *itp; 5141 ipf_stack_t *ifs; 5142 { 5143 int error; 5144 5145 if (itp->igi_data == NULL) 5146 return EFAULT; 5147 5148 token->ipt_subtype = itp->igi_type; 5149 5150 switch (itp->igi_type) 5151 { 5152 case IPFGENITER_HOSTMAP : 5153 case IPFGENITER_IPNAT : 5154 case IPFGENITER_NAT : 5155 error = nat_getnext(token, itp, ifs); 5156 break; 5157 case IPFGENITER_NATFRAG : 5158 error = fr_nextfrag(token, itp, &ifs->ifs_ipfr_natlist, 5159 &ifs->ifs_ipfr_nattail, 5160 &ifs->ifs_ipf_natfrag, ifs); 5161 break; 5162 default : 5163 error = EINVAL; 5164 break; 5165 } 5166 5167 return error; 5168 } 5169