xref: /titanic_41/usr/src/uts/common/inet/ipf/ip_nat.c (revision 391647d5ee9b25dc5307abb55f583388e08b2dd7)
1 /*
2  * Copyright (C) 1995-2004 by Darren Reed.
3  *
4  * See the IPFILTER.LICENCE file for details on licencing.
5  *
6  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
7  * Use is subject to license terms.
8  */
9 
10 #if defined(KERNEL) || defined(_KERNEL)
11 # undef KERNEL
12 # undef _KERNEL
13 # define        KERNEL	1
14 # define        _KERNEL	1
15 #endif
16 #include <sys/errno.h>
17 #include <sys/types.h>
18 #include <sys/param.h>
19 #include <sys/time.h>
20 #include <sys/file.h>
21 #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
22     defined(_KERNEL)
23 # include "opt_ipfilter_log.h"
24 #endif
25 #if !defined(_KERNEL)
26 # include <stdio.h>
27 # include <string.h>
28 # include <stdlib.h>
29 # define _KERNEL
30 # ifdef __OpenBSD__
31 struct file;
32 # endif
33 # include <sys/uio.h>
34 # undef _KERNEL
35 #endif
36 #if defined(_KERNEL) && (__FreeBSD_version >= 220000)
37 # include <sys/filio.h>
38 # include <sys/fcntl.h>
39 #else
40 # include <sys/ioctl.h>
41 #endif
42 #if !defined(AIX)
43 # include <sys/fcntl.h>
44 #endif
45 #if !defined(linux)
46 # include <sys/protosw.h>
47 #endif
48 #include <sys/socket.h>
49 #if defined(_KERNEL)
50 # include <sys/systm.h>
51 # if !defined(__SVR4) && !defined(__svr4__)
52 #  include <sys/mbuf.h>
53 # endif
54 #endif
55 #if defined(__SVR4) || defined(__svr4__)
56 # include <sys/filio.h>
57 # include <sys/byteorder.h>
58 # ifdef _KERNEL
59 #  include <sys/dditypes.h>
60 # endif
61 # include <sys/stream.h>
62 # include <sys/kmem.h>
63 #endif
64 #if __FreeBSD_version >= 300000
65 # include <sys/queue.h>
66 #endif
67 #include <net/if.h>
68 #if __FreeBSD_version >= 300000
69 # include <net/if_var.h>
70 # if defined(_KERNEL) && !defined(IPFILTER_LKM)
71 #  include "opt_ipfilter.h"
72 # endif
73 #endif
74 #ifdef sun
75 # include <net/af.h>
76 #endif
77 #include <net/route.h>
78 #include <netinet/in.h>
79 #include <netinet/in_systm.h>
80 #include <netinet/ip.h>
81 
82 #ifdef RFC1825
83 # include <vpn/md5.h>
84 # include <vpn/ipsec.h>
85 extern struct ifnet vpnif;
86 #endif
87 
88 #if !defined(linux)
89 # include <netinet/ip_var.h>
90 #endif
91 #include <netinet/tcp.h>
92 #include <netinet/udp.h>
93 #include <netinet/ip_icmp.h>
94 #include "netinet/ip_compat.h"
95 #include <netinet/tcpip.h>
96 #include "netinet/ip_fil.h"
97 #include "netinet/ip_nat.h"
98 #include "netinet/ip_frag.h"
99 #include "netinet/ip_state.h"
100 #include "netinet/ip_proxy.h"
101 #include "netinet/ipf_stack.h"
102 #ifdef	IPFILTER_SYNC
103 #include "netinet/ip_sync.h"
104 #endif
105 #if (__FreeBSD_version >= 300000)
106 # include <sys/malloc.h>
107 #endif
108 /* END OF INCLUDES */
109 
110 #undef	SOCKADDR_IN
111 #define	SOCKADDR_IN	struct sockaddr_in
112 
113 #if !defined(lint)
114 static const char sccsid[] = "@(#)ip_nat.c	1.11 6/5/96 (C) 1995 Darren Reed";
115 static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.195.2.42 2005/08/11 19:51:36 darrenr Exp $";
116 #endif
117 
118 
119 /* ======================================================================== */
120 /* How the NAT is organised and works.                                      */
121 /*                                                                          */
122 /* Inside (interface y) NAT       Outside (interface x)                     */
123 /* -------------------- -+- -------------------------------------           */
124 /* Packet going          |   out, processsed by fr_checknatout() for x      */
125 /* ------------>         |   ------------>                                  */
126 /* src=10.1.1.1          |   src=192.1.1.1                                  */
127 /*                       |                                                  */
128 /*                       |   in, processed by fr_checknatin() for x         */
129 /* <------------         |   <------------                                  */
130 /* dst=10.1.1.1          |   dst=192.1.1.1                                  */
131 /* -------------------- -+- -------------------------------------           */
132 /* fr_checknatout() - changes ip_src and if required, sport                 */
133 /*             - creates a new mapping, if required.                        */
134 /* fr_checknatin()  - changes ip_dst and if required, dport                 */
135 /*                                                                          */
136 /* In the NAT table, internal source is recorded as "in" and externally     */
137 /* seen as "out".                                                           */
138 /* ======================================================================== */
139 
140 
141 static	int	nat_flushtable __P((ipf_stack_t *));
142 static	int	nat_clearlist __P((ipf_stack_t *));
143 static	void	nat_addnat __P((struct ipnat *, ipf_stack_t *));
144 static	void	nat_addrdr __P((struct ipnat *, ipf_stack_t *));
145 static	int	fr_natgetent __P((caddr_t, ipf_stack_t *));
146 static	int	fr_natgetsz __P((caddr_t, ipf_stack_t *));
147 static	int	fr_natputent __P((caddr_t, int, ipf_stack_t *));
148 static	void	nat_tabmove __P((nat_t *, ipf_stack_t *));
149 static	int	nat_match __P((fr_info_t *, ipnat_t *));
150 static	INLINE	int nat_newmap __P((fr_info_t *, nat_t *, natinfo_t *));
151 static	INLINE	int nat_newrdr __P((fr_info_t *, nat_t *, natinfo_t *));
152 static	hostmap_t *nat_hostmap __P((ipnat_t *, struct in_addr,
153 				    struct in_addr, struct in_addr, u_32_t,
154 				    ipf_stack_t *));
155 static	INLINE	int nat_icmpquerytype4 __P((int));
156 static	int	nat_ruleaddrinit __P((ipnat_t *));
157 static	int	nat_siocaddnat __P((ipnat_t *, ipnat_t **, int, ipf_stack_t *));
158 static	void	nat_siocdelnat __P((ipnat_t *, ipnat_t **, int, ipf_stack_t *));
159 static	INLINE	int nat_icmperrortype4 __P((int));
160 static	INLINE	int nat_finalise __P((fr_info_t *, nat_t *, natinfo_t *,
161 				      tcphdr_t *, nat_t **, int));
162 static	INLINE	int nat_resolverule __P((ipnat_t *, ipf_stack_t *));
163 static	void	nat_mssclamp __P((tcphdr_t *, u_32_t, u_short *));
164 static	int	nat_getnext __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *));
165 static	int	nat_iterator __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *));
166 static	int	nat_extraflush __P((int, ipf_stack_t *));
167 static	int	nat_earlydrop __P((ipftq_t *, int, ipf_stack_t *));
168 static	int	nat_flushclosing __P((int, ipf_stack_t *));
169 
170 
171 /*
172  * Below we declare a list of constants used only in the nat_extraflush()
173  * routine.  We are placing it here, instead of in nat_extraflush() itself,
174  * because we want to make it visible to tools such as mdb, nm etc., so the
175  * values can easily be altered during debugging.
176  */
177 static	const int	idletime_tab[] = {
178 	IPF_TTLVAL(30),		/* 30 seconds */
179 	IPF_TTLVAL(1800),	/* 30 minutes */
180 	IPF_TTLVAL(43200),	/* 12 hours */
181 	IPF_TTLVAL(345600),	/* 4 days */
182 };
183 
184 #define NAT_HAS_L4_CHANGED(n)	\
185  	(((n)->nat_flags & (IPN_TCPUDPICMP)) && \
186  	(n)->nat_inport != (n)->nat_outport)
187 
188 /* ------------------------------------------------------------------------ */
189 /* Function:    fr_natinit                                                  */
190 /* Returns:     int - 0 == success, -1 == failure                           */
191 /* Parameters:  Nil                                                         */
192 /*                                                                          */
193 /* Initialise all of the NAT locks, tables and other structures.            */
194 /* ------------------------------------------------------------------------ */
195 int fr_natinit(ifs)
196 ipf_stack_t *ifs;
197 {
198 	int i;
199 
200 	KMALLOCS(ifs->ifs_nat_table[0], nat_t **,
201 		 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz);
202 	if (ifs->ifs_nat_table[0] != NULL)
203 		bzero((char *)ifs->ifs_nat_table[0],
204 		      ifs->ifs_ipf_nattable_sz * sizeof(nat_t *));
205 	else
206 		return -1;
207 
208 	KMALLOCS(ifs->ifs_nat_table[1], nat_t **,
209 		 sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz);
210 	if (ifs->ifs_nat_table[1] != NULL)
211 		bzero((char *)ifs->ifs_nat_table[1],
212 		      ifs->ifs_ipf_nattable_sz * sizeof(nat_t *));
213 	else
214 		return -2;
215 
216 	KMALLOCS(ifs->ifs_nat_rules, ipnat_t **,
217 		 sizeof(ipnat_t *) * ifs->ifs_ipf_natrules_sz);
218 	if (ifs->ifs_nat_rules != NULL)
219 		bzero((char *)ifs->ifs_nat_rules,
220 		      ifs->ifs_ipf_natrules_sz * sizeof(ipnat_t *));
221 	else
222 		return -3;
223 
224 	KMALLOCS(ifs->ifs_rdr_rules, ipnat_t **,
225 		 sizeof(ipnat_t *) * ifs->ifs_ipf_rdrrules_sz);
226 	if (ifs->ifs_rdr_rules != NULL)
227 		bzero((char *)ifs->ifs_rdr_rules,
228 		      ifs->ifs_ipf_rdrrules_sz * sizeof(ipnat_t *));
229 	else
230 		return -4;
231 
232 	KMALLOCS(ifs->ifs_maptable, hostmap_t **,
233 		 sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz);
234 	if (ifs->ifs_maptable != NULL)
235 		bzero((char *)ifs->ifs_maptable,
236 		      sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz);
237 	else
238 		return -5;
239 
240 	ifs->ifs_ipf_hm_maplist = NULL;
241 
242 	KMALLOCS(ifs->ifs_nat_stats.ns_bucketlen[0], u_long *,
243 		 ifs->ifs_ipf_nattable_sz * sizeof(u_long));
244 	if (ifs->ifs_nat_stats.ns_bucketlen[0] == NULL)
245 		return -1;
246 	bzero((char *)ifs->ifs_nat_stats.ns_bucketlen[0],
247 	      ifs->ifs_ipf_nattable_sz * sizeof(u_long));
248 
249 	KMALLOCS(ifs->ifs_nat_stats.ns_bucketlen[1], u_long *,
250 		 ifs->ifs_ipf_nattable_sz * sizeof(u_long));
251 	if (ifs->ifs_nat_stats.ns_bucketlen[1] == NULL)
252 		return -1;
253 	bzero((char *)ifs->ifs_nat_stats.ns_bucketlen[1],
254 	      ifs->ifs_ipf_nattable_sz * sizeof(u_long));
255 
256 	if (ifs->ifs_fr_nat_maxbucket == 0) {
257 		for (i = ifs->ifs_ipf_nattable_sz; i > 0; i >>= 1)
258 			ifs->ifs_fr_nat_maxbucket++;
259 		ifs->ifs_fr_nat_maxbucket *= 2;
260 	}
261 
262 	fr_sttab_init(ifs->ifs_nat_tqb, ifs);
263 	/*
264 	 * Increase this because we may have "keep state" following this too
265 	 * and packet storms can occur if this is removed too quickly.
266 	 */
267 	ifs->ifs_nat_tqb[IPF_TCPS_CLOSED].ifq_ttl = ifs->ifs_fr_tcplastack;
268 	ifs->ifs_nat_tqb[IPF_TCP_NSTATES - 1].ifq_next = &ifs->ifs_nat_udptq;
269 	ifs->ifs_nat_udptq.ifq_ttl = ifs->ifs_fr_defnatage;
270 	ifs->ifs_nat_udptq.ifq_ref = 1;
271 	ifs->ifs_nat_udptq.ifq_head = NULL;
272 	ifs->ifs_nat_udptq.ifq_tail = &ifs->ifs_nat_udptq.ifq_head;
273 	MUTEX_INIT(&ifs->ifs_nat_udptq.ifq_lock, "nat ipftq udp tab");
274 	ifs->ifs_nat_udptq.ifq_next = &ifs->ifs_nat_icmptq;
275 	ifs->ifs_nat_icmptq.ifq_ttl = ifs->ifs_fr_defnaticmpage;
276 	ifs->ifs_nat_icmptq.ifq_ref = 1;
277 	ifs->ifs_nat_icmptq.ifq_head = NULL;
278 	ifs->ifs_nat_icmptq.ifq_tail = &ifs->ifs_nat_icmptq.ifq_head;
279 	MUTEX_INIT(&ifs->ifs_nat_icmptq.ifq_lock, "nat icmp ipftq tab");
280 	ifs->ifs_nat_icmptq.ifq_next = &ifs->ifs_nat_iptq;
281 	ifs->ifs_nat_iptq.ifq_ttl = ifs->ifs_fr_defnatipage;
282 	ifs->ifs_nat_iptq.ifq_ref = 1;
283 	ifs->ifs_nat_iptq.ifq_head = NULL;
284 	ifs->ifs_nat_iptq.ifq_tail = &ifs->ifs_nat_iptq.ifq_head;
285 	MUTEX_INIT(&ifs->ifs_nat_iptq.ifq_lock, "nat ip ipftq tab");
286 	ifs->ifs_nat_iptq.ifq_next = NULL;
287 
288 	for (i = 0; i < IPF_TCP_NSTATES; i++) {
289 		if (ifs->ifs_nat_tqb[i].ifq_ttl < ifs->ifs_fr_defnaticmpage)
290 			ifs->ifs_nat_tqb[i].ifq_ttl = ifs->ifs_fr_defnaticmpage;
291 #ifdef LARGE_NAT
292 		else if (ifs->ifs_nat_tqb[i].ifq_ttl > ifs->ifs_fr_defnatage)
293 			ifs->ifs_nat_tqb[i].ifq_ttl = ifs->ifs_fr_defnatage;
294 #endif
295 	}
296 
297 	/*
298 	 * Increase this because we may have "keep state" following
299 	 * this too and packet storms can occur if this is removed
300 	 * too quickly.
301 	 */
302 	ifs->ifs_nat_tqb[IPF_TCPS_CLOSED].ifq_ttl =
303 	    ifs->ifs_nat_tqb[IPF_TCPS_LAST_ACK].ifq_ttl;
304 
305 	RWLOCK_INIT(&ifs->ifs_ipf_nat, "ipf IP NAT rwlock");
306 	RWLOCK_INIT(&ifs->ifs_ipf_natfrag, "ipf IP NAT-Frag rwlock");
307 	MUTEX_INIT(&ifs->ifs_ipf_nat_new, "ipf nat new mutex");
308 	MUTEX_INIT(&ifs->ifs_ipf_natio, "ipf nat io mutex");
309 
310 	ifs->ifs_fr_nat_init = 1;
311 
312 	return 0;
313 }
314 
315 
316 /* ------------------------------------------------------------------------ */
317 /* Function:    nat_addrdr                                                  */
318 /* Returns:     Nil                                                         */
319 /* Parameters:  n(I) - pointer to NAT rule to add                           */
320 /*                                                                          */
321 /* Adds a redirect rule to the hash table of redirect rules and the list of */
322 /* loaded NAT rules.  Updates the bitmask indicating which netmasks are in  */
323 /* use by redirect rules.                                                   */
324 /* ------------------------------------------------------------------------ */
325 static void nat_addrdr(n, ifs)
326 ipnat_t *n;
327 ipf_stack_t *ifs;
328 {
329 	ipnat_t **np;
330 	u_32_t j;
331 	u_int hv;
332 	int k;
333 
334 	k = count4bits(n->in_outmsk);
335 	if ((k >= 0) && (k != 32))
336 		ifs->ifs_rdr_masks |= 1 << k;
337 	j = (n->in_outip & n->in_outmsk);
338 	hv = NAT_HASH_FN(j, 0, ifs->ifs_ipf_rdrrules_sz);
339 	np = ifs->ifs_rdr_rules + hv;
340 	while (*np != NULL)
341 		np = &(*np)->in_rnext;
342 	n->in_rnext = NULL;
343 	n->in_prnext = np;
344 	n->in_hv = hv;
345 	*np = n;
346 }
347 
348 
349 /* ------------------------------------------------------------------------ */
350 /* Function:    nat_addnat                                                  */
351 /* Returns:     Nil                                                         */
352 /* Parameters:  n(I) - pointer to NAT rule to add                           */
353 /*                                                                          */
354 /* Adds a NAT map rule to the hash table of rules and the list of  loaded   */
355 /* NAT rules.  Updates the bitmask indicating which netmasks are in use by  */
356 /* redirect rules.                                                          */
357 /* ------------------------------------------------------------------------ */
358 static void nat_addnat(n, ifs)
359 ipnat_t *n;
360 ipf_stack_t *ifs;
361 {
362 	ipnat_t **np;
363 	u_32_t j;
364 	u_int hv;
365 	int k;
366 
367 	k = count4bits(n->in_inmsk);
368 	if ((k >= 0) && (k != 32))
369 		ifs->ifs_nat_masks |= 1 << k;
370 	j = (n->in_inip & n->in_inmsk);
371 	hv = NAT_HASH_FN(j, 0, ifs->ifs_ipf_natrules_sz);
372 	np = ifs->ifs_nat_rules + hv;
373 	while (*np != NULL)
374 		np = &(*np)->in_mnext;
375 	n->in_mnext = NULL;
376 	n->in_pmnext = np;
377 	n->in_hv = hv;
378 	*np = n;
379 }
380 
381 
382 /* ------------------------------------------------------------------------ */
383 /* Function:    nat_delrdr                                                  */
384 /* Returns:     Nil                                                         */
385 /* Parameters:  n(I) - pointer to NAT rule to delete                        */
386 /*                                                                          */
387 /* Removes a redirect rule from the hash table of redirect rules.           */
388 /* ------------------------------------------------------------------------ */
389 void nat_delrdr(n)
390 ipnat_t *n;
391 {
392 	if (n->in_rnext)
393 		n->in_rnext->in_prnext = n->in_prnext;
394 	*n->in_prnext = n->in_rnext;
395 }
396 
397 
398 /* ------------------------------------------------------------------------ */
399 /* Function:    nat_delnat                                                  */
400 /* Returns:     Nil                                                         */
401 /* Parameters:  n(I) - pointer to NAT rule to delete                        */
402 /*                                                                          */
403 /* Removes a NAT map rule from the hash table of NAT map rules.             */
404 /* ------------------------------------------------------------------------ */
405 void nat_delnat(n)
406 ipnat_t *n;
407 {
408 	if (n->in_mnext != NULL)
409 		n->in_mnext->in_pmnext = n->in_pmnext;
410 	*n->in_pmnext = n->in_mnext;
411 }
412 
413 
414 /* ------------------------------------------------------------------------ */
415 /* Function:    nat_hostmap                                                 */
416 /* Returns:     struct hostmap* - NULL if no hostmap could be created,      */
417 /*                                else a pointer to the hostmapping to use  */
418 /* Parameters:  np(I)   - pointer to NAT rule                               */
419 /*              real(I) - real IP address                                   */
420 /*              map(I)  - mapped IP address                                 */
421 /*              port(I) - destination port number                           */
422 /* Write Locks: ipf_nat                                                     */
423 /*                                                                          */
424 /* Check if an ip address has already been allocated for a given mapping    */
425 /* that is not doing port based translation.  If is not yet allocated, then */
426 /* create a new entry if a non-NULL NAT rule pointer has been supplied.     */
427 /* ------------------------------------------------------------------------ */
428 static struct hostmap *nat_hostmap(np, src, dst, map, port, ifs)
429 ipnat_t *np;
430 struct in_addr src;
431 struct in_addr dst;
432 struct in_addr map;
433 u_32_t port;
434 ipf_stack_t *ifs;
435 {
436 	hostmap_t *hm;
437 	u_int hv;
438 
439 	hv = (src.s_addr ^ dst.s_addr);
440 	hv += src.s_addr;
441 	hv += dst.s_addr;
442 	hv %= HOSTMAP_SIZE;
443 	for (hm = ifs->ifs_maptable[hv]; hm; hm = hm->hm_next)
444 		if ((hm->hm_srcip.s_addr == src.s_addr) &&
445 		    (hm->hm_dstip.s_addr == dst.s_addr) &&
446 		    ((np == NULL) || (np == hm->hm_ipnat)) &&
447 		    ((port == 0) || (port == hm->hm_port))) {
448 			hm->hm_ref++;
449 			return hm;
450 		}
451 
452 	if (np == NULL)
453 		return NULL;
454 
455 	KMALLOC(hm, hostmap_t *);
456 	if (hm) {
457 		hm->hm_hnext = ifs->ifs_ipf_hm_maplist;
458 		hm->hm_phnext = &ifs->ifs_ipf_hm_maplist;
459 		if (ifs->ifs_ipf_hm_maplist != NULL)
460 			ifs->ifs_ipf_hm_maplist->hm_phnext = &hm->hm_hnext;
461 		ifs->ifs_ipf_hm_maplist = hm;
462 
463 		hm->hm_next = ifs->ifs_maptable[hv];
464 		hm->hm_pnext = ifs->ifs_maptable + hv;
465 		if (ifs->ifs_maptable[hv] != NULL)
466 			ifs->ifs_maptable[hv]->hm_pnext = &hm->hm_next;
467 		ifs->ifs_maptable[hv] = hm;
468 		hm->hm_ipnat = np;
469 		hm->hm_srcip = src;
470 		hm->hm_dstip = dst;
471 		hm->hm_mapip = map;
472 		hm->hm_ref = 1;
473 		hm->hm_port = port;
474 		hm->hm_v = 4;
475 	}
476 	return hm;
477 }
478 
479 
480 /* ------------------------------------------------------------------------ */
481 /* Function:    fr_hostmapdel                                              */
482 /* Returns:     Nil                                                         */
483 /* Parameters:  hmp(I) - pointer to pointer to hostmap structure            */
484 /* Write Locks: ipf_nat                                                     */
485 /*                                                                          */
486 /* Decrement the references to this hostmap structure by one.  If this      */
487 /* reaches zero then remove it and free it.                                 */
488 /* ------------------------------------------------------------------------ */
489 void fr_hostmapdel(hmp)
490 struct hostmap **hmp;
491 {
492 	struct hostmap *hm;
493 
494 	hm = *hmp;
495 	*hmp = NULL;
496 
497 	hm->hm_ref--;
498 	if (hm->hm_ref == 0) {
499 		if (hm->hm_next)
500 			hm->hm_next->hm_pnext = hm->hm_pnext;
501 		*hm->hm_pnext = hm->hm_next;
502 		if (hm->hm_hnext)
503 			hm->hm_hnext->hm_phnext = hm->hm_phnext;
504 		*hm->hm_phnext = hm->hm_hnext;
505 		KFREE(hm);
506 	}
507 }
508 
509 
510 /* ------------------------------------------------------------------------ */
511 /* Function:    fix_outcksum                                                */
512 /* Returns:     Nil                                                         */
513 /* Parameters:  sp(I)  - location of 16bit checksum to update               */
514 /*              n((I)  - amount to adjust checksum by                       */
515 /*                                                                          */
516 /* Adjusts the 16bit checksum by "n" for packets going out.                 */
517 /* ------------------------------------------------------------------------ */
518 void fix_outcksum(sp, n)
519 u_short *sp;
520 u_32_t n;
521 {
522 	u_short sumshort;
523 	u_32_t sum1;
524 
525 	if (n == 0)
526 		return;
527 
528 	sum1 = (~ntohs(*sp)) & 0xffff;
529 	sum1 += (n);
530 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
531 	/* Again */
532 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
533 	sumshort = ~(u_short)sum1;
534 	*(sp) = htons(sumshort);
535 }
536 
537 
538 /* ------------------------------------------------------------------------ */
539 /* Function:    fix_incksum                                                 */
540 /* Returns:     Nil                                                         */
541 /* Parameters:  sp(I)  - location of 16bit checksum to update               */
542 /*              n((I)  - amount to adjust checksum by                       */
543 /*                                                                          */
544 /* Adjusts the 16bit checksum by "n" for packets going in.                  */
545 /* ------------------------------------------------------------------------ */
546 void fix_incksum(sp, n)
547 u_short *sp;
548 u_32_t n;
549 {
550 	u_short sumshort;
551 	u_32_t sum1;
552 
553 	if (n == 0)
554 		return;
555 
556 	sum1 = (~ntohs(*sp)) & 0xffff;
557 	sum1 += ~(n) & 0xffff;
558 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
559 	/* Again */
560 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
561 	sumshort = ~(u_short)sum1;
562 	*(sp) = htons(sumshort);
563 }
564 
565 
566 /* ------------------------------------------------------------------------ */
567 /* Function:    fix_datacksum                                               */
568 /* Returns:     Nil                                                         */
569 /* Parameters:  sp(I)  - location of 16bit checksum to update               */
570 /*              n((I)  - amount to adjust checksum by                       */
571 /*                                                                          */
572 /* Fix_datacksum is used *only* for the adjustments of checksums in the     */
573 /* data section of an IP packet.                                            */
574 /*                                                                          */
575 /* The only situation in which you need to do this is when NAT'ing an       */
576 /* ICMP error message. Such a message, contains in its body the IP header   */
577 /* of the original IP packet, that causes the error.                        */
578 /*                                                                          */
579 /* You can't use fix_incksum or fix_outcksum in that case, because for the  */
580 /* kernel the data section of the ICMP error is just data, and no special   */
581 /* processing like hardware cksum or ntohs processing have been done by the */
582 /* kernel on the data section.                                              */
583 /* ------------------------------------------------------------------------ */
584 void fix_datacksum(sp, n)
585 u_short *sp;
586 u_32_t n;
587 {
588 	u_short sumshort;
589 	u_32_t sum1;
590 
591 	if (n == 0)
592 		return;
593 
594 	sum1 = (~ntohs(*sp)) & 0xffff;
595 	sum1 += (n);
596 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
597 	/* Again */
598 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
599 	sumshort = ~(u_short)sum1;
600 	*(sp) = htons(sumshort);
601 }
602 
603 
604 /* ------------------------------------------------------------------------ */
605 /* Function:    fr_nat_ioctl                                                */
606 /* Returns:     int - 0 == success, != 0 == failure                         */
607 /* Parameters:  data(I) - pointer to ioctl data                             */
608 /*              cmd(I)  - ioctl command integer                             */
609 /*              mode(I) - file mode bits used with open                     */
610 /*                                                                          */
611 /* Processes an ioctl call made to operate on the IP Filter NAT device.     */
612 /* ------------------------------------------------------------------------ */
613 int fr_nat_ioctl(data, cmd, mode, uid, ctx, ifs)
614 ioctlcmd_t cmd;
615 caddr_t data;
616 int mode, uid;
617 void *ctx;
618 ipf_stack_t *ifs;
619 {
620 	ipnat_t *nat, *nt, *n = NULL, **np = NULL;
621 	int error = 0, ret, arg, getlock;
622 	ipnat_t natd;
623 
624 #if (BSD >= 199306) && defined(_KERNEL)
625 	if ((securelevel >= 2) && (mode & FWRITE))
626 		return EPERM;
627 #endif
628 
629 #if defined(__osf__) && defined(_KERNEL)
630 	getlock = 0;
631 #else
632 	getlock = (mode & NAT_LOCKHELD) ? 0 : 1;
633 #endif
634 
635 	nat = NULL;     /* XXX gcc -Wuninitialized */
636 	if (cmd == (ioctlcmd_t)SIOCADNAT) {
637 		KMALLOC(nt, ipnat_t *);
638 	} else {
639 		nt = NULL;
640 	}
641 
642 	if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) {
643 		if (mode & NAT_SYSSPACE) {
644 			bcopy(data, (char *)&natd, sizeof(natd));
645 			error = 0;
646 		} else {
647 			error = fr_inobj(data, &natd, IPFOBJ_IPNAT);
648 		}
649 
650 	}
651 
652 	if (error != 0)
653 		goto done;
654 
655 	/*
656 	 * For add/delete, look to see if the NAT entry is already present
657 	 */
658 	if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) {
659 		nat = &natd;
660 		if (nat->in_v == 0)	/* For backward compat. */
661 			nat->in_v = 4;
662 		nat->in_flags &= IPN_USERFLAGS;
663 		if ((nat->in_redir & NAT_MAPBLK) == 0) {
664 			if ((nat->in_flags & IPN_SPLIT) == 0)
665 				nat->in_inip &= nat->in_inmsk;
666 			if ((nat->in_flags & IPN_IPRANGE) == 0)
667 				nat->in_outip &= nat->in_outmsk;
668 		}
669 		MUTEX_ENTER(&ifs->ifs_ipf_natio);
670 		for (np = &ifs->ifs_nat_list; ((n = *np) != NULL);
671 		     np = &n->in_next)
672 			if (bcmp((char *)&nat->in_flags, (char *)&n->in_flags,
673 			    IPN_CMPSIZ) == 0) {
674 				if (nat->in_redir == NAT_REDIRECT &&
675 				    nat->in_pnext != n->in_pnext)
676 					continue;
677 				break;
678 			}
679 	}
680 
681 	switch (cmd)
682 	{
683 	case SIOCGENITER :
684 	    {
685 		ipfgeniter_t iter;
686 		ipftoken_t *token;
687 
688 		error = fr_inobj(data, &iter, IPFOBJ_GENITER);
689 		if (error != 0)
690 			break;
691 
692 		token = ipf_findtoken(iter.igi_type, uid, ctx, ifs);
693 		if (token != NULL)
694 			error  = nat_iterator(token, &iter, ifs);
695 		else
696 			error = ESRCH;
697 		RWLOCK_EXIT(&ifs->ifs_ipf_tokens);
698 		break;
699 	    }
700 #ifdef  IPFILTER_LOG
701 	case SIOCIPFFB :
702 	{
703 		int tmp;
704 
705 		if (!(mode & FWRITE))
706 			error = EPERM;
707 		else {
708 			tmp = ipflog_clear(IPL_LOGNAT, ifs);
709 			error = BCOPYOUT((char *)&tmp, (char *)data,
710 					sizeof(tmp));
711 			if (error != 0)
712 				error = EFAULT;
713 		}
714 		break;
715 	}
716 	case SIOCSETLG :
717 		if (!(mode & FWRITE)) {
718 			error = EPERM;
719 		} else {
720 			error = BCOPYIN((char *)data,
721 					(char *)&ifs->ifs_nat_logging,
722 					sizeof(ifs->ifs_nat_logging));
723 			if (error != 0)
724 				error = EFAULT;
725 		}
726 		break;
727 	case SIOCGETLG :
728 		error = BCOPYOUT((char *)&ifs->ifs_nat_logging, (char *)data,
729 				sizeof(ifs->ifs_nat_logging));
730 		if (error != 0)
731 			error = EFAULT;
732 		break;
733 	case FIONREAD :
734 		arg = ifs->ifs_iplused[IPL_LOGNAT];
735 		error = BCOPYOUT(&arg, data, sizeof(arg));
736 		if (error != 0)
737 			error = EFAULT;
738 		break;
739 #endif
740 	case SIOCADNAT :
741 		if (!(mode & FWRITE)) {
742 			error = EPERM;
743 		} else if (n != NULL) {
744 			error = EEXIST;
745 		} else if (nt == NULL) {
746 			error = ENOMEM;
747 		}
748 		if (error != 0) {
749 			MUTEX_EXIT(&ifs->ifs_ipf_natio);
750 			break;
751 		}
752 		bcopy((char *)nat, (char *)nt, sizeof(*n));
753 		error = nat_siocaddnat(nt, np, getlock, ifs);
754 		MUTEX_EXIT(&ifs->ifs_ipf_natio);
755 		if (error == 0)
756 			nt = NULL;
757 		break;
758 	case SIOCRMNAT :
759 		if (!(mode & FWRITE)) {
760 			error = EPERM;
761 			n = NULL;
762 		} else if (n == NULL) {
763 			error = ESRCH;
764 		}
765 
766 		if (error != 0) {
767 			MUTEX_EXIT(&ifs->ifs_ipf_natio);
768 			break;
769 		}
770 		nat_siocdelnat(n, np, getlock, ifs);
771 
772 		MUTEX_EXIT(&ifs->ifs_ipf_natio);
773 		n = NULL;
774 		break;
775 	case SIOCGNATS :
776 		ifs->ifs_nat_stats.ns_table[0] = ifs->ifs_nat_table[0];
777 		ifs->ifs_nat_stats.ns_table[1] = ifs->ifs_nat_table[1];
778 		ifs->ifs_nat_stats.ns_list = ifs->ifs_nat_list;
779 		ifs->ifs_nat_stats.ns_maptable = ifs->ifs_maptable;
780 		ifs->ifs_nat_stats.ns_maplist = ifs->ifs_ipf_hm_maplist;
781 		ifs->ifs_nat_stats.ns_nattab_max = ifs->ifs_ipf_nattable_max;
782 		ifs->ifs_nat_stats.ns_nattab_sz = ifs->ifs_ipf_nattable_sz;
783 		ifs->ifs_nat_stats.ns_rultab_sz = ifs->ifs_ipf_natrules_sz;
784 		ifs->ifs_nat_stats.ns_rdrtab_sz = ifs->ifs_ipf_rdrrules_sz;
785 		ifs->ifs_nat_stats.ns_hostmap_sz = ifs->ifs_ipf_hostmap_sz;
786 		ifs->ifs_nat_stats.ns_instances = ifs->ifs_nat_instances;
787 		ifs->ifs_nat_stats.ns_apslist = ifs->ifs_ap_sess_list;
788 		error = fr_outobj(data, &ifs->ifs_nat_stats, IPFOBJ_NATSTAT);
789 		break;
790 	case SIOCGNATL :
791 	    {
792 		natlookup_t nl;
793 
794 		if (getlock) {
795 			READ_ENTER(&ifs->ifs_ipf_nat);
796 		}
797 		error = fr_inobj(data, &nl, IPFOBJ_NATLOOKUP);
798 		if (nl.nl_v != 6)
799 			nl.nl_v = 4;
800 		if (error == 0) {
801 			void *ptr;
802 
803 			switch (nl.nl_v)
804 			{
805 			case 4:
806 				ptr = nat_lookupredir(&nl, ifs);
807 				break;
808 #ifdef	USE_INET6
809 			case 6:
810 				ptr = nat6_lookupredir(&nl, ifs);
811 				break;
812 #endif
813 			default:
814 				ptr = NULL;
815 				break;
816 			}
817 
818 			if (ptr != NULL) {
819 				error = fr_outobj(data, &nl, IPFOBJ_NATLOOKUP);
820 			} else {
821 				error = ESRCH;
822 			}
823 		}
824 		if (getlock) {
825 			RWLOCK_EXIT(&ifs->ifs_ipf_nat);
826 		}
827 		break;
828 	    }
829 	case SIOCIPFFL :	/* old SIOCFLNAT & SIOCCNATL */
830 		if (!(mode & FWRITE)) {
831 			error = EPERM;
832 			break;
833 		}
834 		if (getlock) {
835 			WRITE_ENTER(&ifs->ifs_ipf_nat);
836 		}
837 		error = BCOPYIN(data, &arg, sizeof(arg));
838 		if (error != 0) {
839 			error = EFAULT;
840 		} else {
841 			if (arg == 0)
842 				ret = nat_flushtable(ifs);
843 			else if (arg == 1)
844 				ret = nat_clearlist(ifs);
845 			else if (arg >= 2 && arg <= 4)
846 				ret = nat_extraflush(arg - 2, ifs);
847 			else
848 				error = EINVAL;
849 		}
850 		if (getlock) {
851 			RWLOCK_EXIT(&ifs->ifs_ipf_nat);
852 		}
853 		if (error == 0) {
854 			error = BCOPYOUT(&ret, data, sizeof(ret));
855 			if (error != 0)
856 				error = EFAULT;
857 		}
858 		break;
859 	case SIOCPROXY :
860 		error = appr_ioctl(data, cmd, mode, ifs);
861 		break;
862 	case SIOCSTLCK :
863 		if (!(mode & FWRITE)) {
864 			error = EPERM;
865 		} else {
866 			error = fr_lock(data, &ifs->ifs_fr_nat_lock);
867 		}
868 		break;
869 	case SIOCSTPUT :
870 		if ((mode & FWRITE) != 0) {
871 			error = fr_natputent(data, getlock, ifs);
872 		} else {
873 			error = EACCES;
874 		}
875 		break;
876 	case SIOCSTGSZ :
877 		if (ifs->ifs_fr_nat_lock) {
878 			if (getlock) {
879 				READ_ENTER(&ifs->ifs_ipf_nat);
880 			}
881 			error = fr_natgetsz(data, ifs);
882 			if (getlock) {
883 				RWLOCK_EXIT(&ifs->ifs_ipf_nat);
884 			}
885 		} else
886 			error = EACCES;
887 		break;
888 	case SIOCSTGET :
889 		if (ifs->ifs_fr_nat_lock) {
890 			if (getlock) {
891 				READ_ENTER(&ifs->ifs_ipf_nat);
892 			}
893 			error = fr_natgetent(data, ifs);
894 			if (getlock) {
895 				RWLOCK_EXIT(&ifs->ifs_ipf_nat);
896 			}
897 		} else
898 			error = EACCES;
899 		break;
900 	case SIOCIPFDELTOK :
901 		error = BCOPYIN((caddr_t)data, (caddr_t)&arg, sizeof(arg));
902 		if (error != 0) {
903 			error = EFAULT;
904 		} else {
905 			error = ipf_deltoken(arg, uid, ctx, ifs);
906 		}
907 		break;
908 	default :
909 		error = EINVAL;
910 		break;
911 	}
912 done:
913 	if (nt)
914 		KFREE(nt);
915 	return error;
916 }
917 
918 
919 /* ------------------------------------------------------------------------ */
920 /* Function:    nat_siocaddnat                                              */
921 /* Returns:     int - 0 == success, != 0 == failure                         */
922 /* Parameters:  n(I)       - pointer to new NAT rule                        */
923 /*              np(I)      - pointer to where to insert new NAT rule        */
924 /*              getlock(I) - flag indicating if lock on ipf_nat is held     */
925 /* Mutex Locks: ipf_natio                                                   */
926 /*                                                                          */
927 /* Handle SIOCADNAT.  Resolve and calculate details inside the NAT rule     */
928 /* from information passed to the kernel, then add it  to the appropriate   */
929 /* NAT rule table(s).                                                       */
930 /* ------------------------------------------------------------------------ */
931 static int nat_siocaddnat(n, np, getlock, ifs)
932 ipnat_t *n, **np;
933 int getlock;
934 ipf_stack_t *ifs;
935 {
936 	int error = 0, i, j;
937 
938 	if (nat_resolverule(n, ifs) != 0)
939 		return ENOENT;
940 
941 	if ((n->in_age[0] == 0) && (n->in_age[1] != 0))
942 		return EINVAL;
943 
944 	n->in_use = 0;
945 	if (n->in_redir & NAT_MAPBLK)
946 		n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk);
947 	else if (n->in_flags & IPN_AUTOPORTMAP)
948 		n->in_space = USABLE_PORTS * ~ntohl(n->in_inmsk);
949 	else if (n->in_flags & IPN_IPRANGE)
950 		n->in_space = ntohl(n->in_outmsk) - ntohl(n->in_outip);
951 	else if (n->in_flags & IPN_SPLIT)
952 		n->in_space = 2;
953 	else if (n->in_outmsk != 0)
954 		n->in_space = ~ntohl(n->in_outmsk);
955 	else
956 		n->in_space = 1;
957 
958 	/*
959 	 * Calculate the number of valid IP addresses in the output
960 	 * mapping range.  In all cases, the range is inclusive of
961 	 * the start and ending IP addresses.
962 	 * If to a CIDR address, lose 2: broadcast + network address
963 	 *                               (so subtract 1)
964 	 * If to a range, add one.
965 	 * If to a single IP address, set to 1.
966 	 */
967 	if (n->in_space) {
968 		if ((n->in_flags & IPN_IPRANGE) != 0)
969 			n->in_space += 1;
970 		else
971 			n->in_space -= 1;
972 	} else
973 		n->in_space = 1;
974 
975 #ifdef	USE_INET6
976 	if (n->in_v == 6 && (n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0 &&
977 	    !IP6_ISONES(&n->in_out[1]) && !IP6_ISZERO(&n->in_out[1]))
978 		IP6_ADD(&n->in_out[0], 1, &n->in_next6)
979 	else if (n->in_v == 6 &&
980 	    (n->in_flags & IPN_SPLIT) && (n->in_redir & NAT_REDIRECT))
981 		n->in_next6 = n->in_in[0];
982 	else if (n->in_v == 6)
983 		n->in_next6 = n->in_out[0];
984 	else
985 #endif
986 	if ((n->in_outmsk != 0xffffffff) && (n->in_outmsk != 0) &&
987 	    ((n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0))
988 		n->in_nip = ntohl(n->in_outip) + 1;
989 	else if ((n->in_flags & IPN_SPLIT) &&
990 		 (n->in_redir & NAT_REDIRECT))
991 		n->in_nip = ntohl(n->in_inip);
992 	else
993 		n->in_nip = ntohl(n->in_outip);
994 
995 	if (n->in_redir & NAT_MAP) {
996 		n->in_pnext = ntohs(n->in_pmin);
997 		/*
998 		 * Multiply by the number of ports made available.
999 		 */
1000 		if (ntohs(n->in_pmax) >= ntohs(n->in_pmin)) {
1001 			n->in_space *= (ntohs(n->in_pmax) -
1002 					ntohs(n->in_pmin) + 1);
1003 			/*
1004 			 * Because two different sources can map to
1005 			 * different destinations but use the same
1006 			 * local IP#/port #.
1007 			 * If the result is smaller than in_space, then
1008 			 * we may have wrapped around 32bits.
1009 			 */
1010 			i = n->in_inmsk;
1011 			if ((i != 0) && (i != 0xffffffff)) {
1012 				j = n->in_space * (~ntohl(i) + 1);
1013 				if (j >= n->in_space)
1014 					n->in_space = j;
1015 				else
1016 					n->in_space = 0xffffffff;
1017 			}
1018 		}
1019 		/*
1020 		 * If no protocol is specified, multiple by 256 to allow for
1021 		 * at least one IP:IP mapping per protocol.
1022 		 */
1023 		if ((n->in_flags & IPN_TCPUDPICMP) == 0) {
1024 				j = n->in_space * 256;
1025 				if (j >= n->in_space)
1026 					n->in_space = j;
1027 				else
1028 					n->in_space = 0xffffffff;
1029 		}
1030 	}
1031 
1032 	/* Otherwise, these fields are preset */
1033 
1034 	if (getlock) {
1035 		WRITE_ENTER(&ifs->ifs_ipf_nat);
1036 	}
1037 	n->in_next = NULL;
1038 	*np = n;
1039 
1040 	if (n->in_age[0] != 0)
1041 	    n->in_tqehead[0] = fr_addtimeoutqueue(&ifs->ifs_nat_utqe,
1042 						  n->in_age[0], ifs);
1043 
1044 	if (n->in_age[1] != 0)
1045 	    n->in_tqehead[1] = fr_addtimeoutqueue(&ifs->ifs_nat_utqe,
1046 						  n->in_age[1], ifs);
1047 
1048 	if (n->in_redir & NAT_REDIRECT) {
1049 		n->in_flags &= ~IPN_NOTDST;
1050 		switch (n->in_v)
1051 		{
1052 		case 4 :
1053 			nat_addrdr(n, ifs);
1054 			break;
1055 #ifdef	USE_INET6
1056 		case 6 :
1057 			nat6_addrdr(n, ifs);
1058 			break;
1059 #endif
1060 		default :
1061 			break;
1062 		}
1063 	}
1064 	if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
1065 		n->in_flags &= ~IPN_NOTSRC;
1066 		switch (n->in_v)
1067 		{
1068 		case 4 :
1069 			nat_addnat(n, ifs);
1070 			break;
1071 #ifdef	USE_INET6
1072 		case 6 :
1073 			nat6_addnat(n, ifs);
1074 			break;
1075 #endif
1076 		default :
1077 			break;
1078 		}
1079 	}
1080 	n = NULL;
1081 	ifs->ifs_nat_stats.ns_rules++;
1082 	if (getlock) {
1083 		RWLOCK_EXIT(&ifs->ifs_ipf_nat);			/* WRITE */
1084 	}
1085 
1086 	return error;
1087 }
1088 
1089 
1090 /* ------------------------------------------------------------------------ */
1091 /* Function:    nat_resolvrule                                              */
1092 /* Returns:     int - 0 == success, -1 == failure                           */
1093 /* Parameters:  n(I)  - pointer to NAT rule                                 */
1094 /*                                                                          */
1095 /* Resolve some of the details inside the NAT rule.  Includes resolving	    */
1096 /* any specified interfaces and proxy labels, and determines whether or not */
1097 /* all proxy labels are correctly specified.				    */
1098 /*									    */
1099 /* Called by nat_siocaddnat() (SIOCADNAT) and fr_natputent (SIOCSTPUT).     */
1100 /* ------------------------------------------------------------------------ */
1101 static int nat_resolverule(n, ifs)
1102 ipnat_t *n;
1103 ipf_stack_t *ifs;
1104 {
1105 	n->in_ifnames[0][LIFNAMSIZ - 1] = '\0';
1106 	n->in_ifps[0] = fr_resolvenic(n->in_ifnames[0], n->in_v, ifs);
1107 
1108 	n->in_ifnames[1][LIFNAMSIZ - 1] = '\0';
1109 	if (n->in_ifnames[1][0] == '\0') {
1110 		(void) strncpy(n->in_ifnames[1], n->in_ifnames[0], LIFNAMSIZ);
1111 		n->in_ifps[1] = n->in_ifps[0];
1112 	} else {
1113 		n->in_ifps[1] = fr_resolvenic(n->in_ifnames[1], n->in_v, ifs);
1114 	}
1115 
1116 	if (n->in_plabel[0] != '\0') {
1117 		n->in_apr = appr_lookup(n->in_p, n->in_plabel, ifs);
1118 		if (n->in_apr == NULL)
1119 			return -1;
1120 	}
1121 	return 0;
1122 }
1123 
1124 
1125 /* ------------------------------------------------------------------------ */
1126 /* Function:    nat_siocdelnat                                              */
1127 /* Returns:     int - 0 == success, != 0 == failure                         */
1128 /* Parameters:  n(I)       - pointer to new NAT rule                        */
1129 /*              np(I)      - pointer to where to insert new NAT rule        */
1130 /*              getlock(I) - flag indicating if lock on ipf_nat is held     */
1131 /* Mutex Locks: ipf_natio                                                   */
1132 /*                                                                          */
1133 /* Handle SIOCADNAT.  Resolve and calculate details inside the NAT rule     */
1134 /* from information passed to the kernel, then add it  to the appropriate   */
1135 /* NAT rule table(s).                                                       */
1136 /* ------------------------------------------------------------------------ */
1137 static void nat_siocdelnat(n, np, getlock, ifs)
1138 ipnat_t *n, **np;
1139 int getlock;
1140 ipf_stack_t *ifs;
1141 {
1142 	int i;
1143 
1144 	if (getlock) {
1145 		WRITE_ENTER(&ifs->ifs_ipf_nat);
1146 	}
1147 	if (n->in_redir & NAT_REDIRECT)
1148 		nat_delrdr(n);
1149 	if (n->in_redir & (NAT_MAPBLK|NAT_MAP))
1150 		nat_delnat(n);
1151 	if (ifs->ifs_nat_list == NULL) {
1152 		ifs->ifs_nat_masks = 0;
1153 		ifs->ifs_rdr_masks = 0;
1154 		for (i = 0; i < 4; i++) {
1155 			ifs->ifs_nat6_masks[i] = 0;
1156 			ifs->ifs_rdr6_masks[i] = 0;
1157 		}
1158 	}
1159 
1160 	if (n->in_tqehead[0] != NULL) {
1161 		if (fr_deletetimeoutqueue(n->in_tqehead[0]) == 0) {
1162 			fr_freetimeoutqueue(n->in_tqehead[0], ifs);
1163 		}
1164 	}
1165 
1166 	if (n->in_tqehead[1] != NULL) {
1167 		if (fr_deletetimeoutqueue(n->in_tqehead[1]) == 0) {
1168 			fr_freetimeoutqueue(n->in_tqehead[1], ifs);
1169 		}
1170 	}
1171 
1172 	*np = n->in_next;
1173 
1174 	if (n->in_use == 0) {
1175 		if (n->in_apr)
1176 			appr_free(n->in_apr);
1177 		KFREE(n);
1178 		ifs->ifs_nat_stats.ns_rules--;
1179 	} else {
1180 		n->in_flags |= IPN_DELETE;
1181 		n->in_next = NULL;
1182 	}
1183 	if (getlock) {
1184 		RWLOCK_EXIT(&ifs->ifs_ipf_nat);			/* READ/WRITE */
1185 	}
1186 }
1187 
1188 
1189 /* ------------------------------------------------------------------------ */
1190 /* Function:    fr_natgetsz                                                 */
1191 /* Returns:     int - 0 == success, != 0 is the error value.                */
1192 /* Parameters:  data(I) - pointer to natget structure with kernel pointer   */
1193 /*                        get the size of.                                  */
1194 /*                                                                          */
1195 /* Handle SIOCSTGSZ.                                                        */
1196 /* Return the size of the nat list entry to be copied back to user space.   */
1197 /* The size of the entry is stored in the ng_sz field and the enture natget */
1198 /* structure is copied back to the user.                                    */
1199 /* ------------------------------------------------------------------------ */
1200 static int fr_natgetsz(data, ifs)
1201 caddr_t data;
1202 ipf_stack_t *ifs;
1203 {
1204 	ap_session_t *aps;
1205 	nat_t *nat, *n;
1206 	natget_t ng;
1207 	int err;
1208 
1209 	err = BCOPYIN(data, &ng, sizeof(ng));
1210 	if (err != 0)
1211 		return EFAULT;
1212 
1213 	nat = ng.ng_ptr;
1214 	if (!nat) {
1215 		nat = ifs->ifs_nat_instances;
1216 		ng.ng_sz = 0;
1217 		/*
1218 		 * Empty list so the size returned is 0.  Simple.
1219 		 */
1220 		if (nat == NULL) {
1221 			err = BCOPYOUT(&ng, data, sizeof(ng));
1222 			if (err != 0) {
1223 				return EFAULT;
1224 			} else {
1225 				return 0;
1226 			}
1227 		}
1228 	} else {
1229 		/*
1230 		 * Make sure the pointer we're copying from exists in the
1231 		 * current list of entries.  Security precaution to prevent
1232 		 * copying of random kernel data.
1233 		 */
1234 		for (n = ifs->ifs_nat_instances; n; n = n->nat_next)
1235 			if (n == nat)
1236 				break;
1237 		if (!n)
1238 			return ESRCH;
1239 	}
1240 
1241 	/*
1242 	 * Incluse any space required for proxy data structures.
1243 	 */
1244 	ng.ng_sz = sizeof(nat_save_t);
1245 	aps = nat->nat_aps;
1246 	if (aps != NULL) {
1247 		ng.ng_sz += sizeof(ap_session_t) - 4;
1248 		if (aps->aps_data != 0)
1249 			ng.ng_sz += aps->aps_psiz;
1250 	}
1251 
1252 	err = BCOPYOUT(&ng, data, sizeof(ng));
1253 	if (err != 0)
1254 		return EFAULT;
1255 	return 0;
1256 }
1257 
1258 
1259 /* ------------------------------------------------------------------------ */
1260 /* Function:    fr_natgetent                                                */
1261 /* Returns:     int - 0 == success, != 0 is the error value.                */
1262 /* Parameters:  data(I) - pointer to natget structure with kernel pointer   */
1263 /*                        to NAT structure to copy out.                     */
1264 /*                                                                          */
1265 /* Handle SIOCSTGET.                                                        */
1266 /* Copies out NAT entry to user space.  Any additional data held for a      */
1267 /* proxy is also copied, as to is the NAT rule which was responsible for it */
1268 /* ------------------------------------------------------------------------ */
1269 static int fr_natgetent(data, ifs)
1270 caddr_t data;
1271 ipf_stack_t *ifs;
1272 {
1273 	int error, outsize;
1274 	ap_session_t *aps;
1275 	nat_save_t *ipn, ipns;
1276 	nat_t *n, *nat;
1277 
1278 	error = fr_inobj(data, &ipns, IPFOBJ_NATSAVE);
1279 	if (error != 0)
1280 		return error;
1281 
1282 	if ((ipns.ipn_dsize < sizeof(ipns)) || (ipns.ipn_dsize > 81920))
1283 		return EINVAL;
1284 
1285 	KMALLOCS(ipn, nat_save_t *, ipns.ipn_dsize);
1286 	if (ipn == NULL)
1287 		return ENOMEM;
1288 
1289 	ipn->ipn_dsize = ipns.ipn_dsize;
1290 	nat = ipns.ipn_next;
1291 	if (nat == NULL) {
1292 		nat = ifs->ifs_nat_instances;
1293 		if (nat == NULL) {
1294 			if (ifs->ifs_nat_instances == NULL)
1295 				error = ENOENT;
1296 			goto finished;
1297 		}
1298 	} else {
1299 		/*
1300 		 * Make sure the pointer we're copying from exists in the
1301 		 * current list of entries.  Security precaution to prevent
1302 		 * copying of random kernel data.
1303 		 */
1304 		for (n = ifs->ifs_nat_instances; n; n = n->nat_next)
1305 			if (n == nat)
1306 				break;
1307 		if (n == NULL) {
1308 			error = ESRCH;
1309 			goto finished;
1310 		}
1311 	}
1312 	ipn->ipn_next = nat->nat_next;
1313 
1314 	/*
1315 	 * Copy the NAT structure.
1316 	 */
1317 	bcopy((char *)nat, &ipn->ipn_nat, sizeof(*nat));
1318 
1319 	/*
1320 	 * If we have a pointer to the NAT rule it belongs to, save that too.
1321 	 */
1322 	if (nat->nat_ptr != NULL)
1323 		bcopy((char *)nat->nat_ptr, (char *)&ipn->ipn_ipnat,
1324 		      sizeof(ipn->ipn_ipnat));
1325 
1326 	/*
1327 	 * If we also know the NAT entry has an associated filter rule,
1328 	 * save that too.
1329 	 */
1330 	if (nat->nat_fr != NULL)
1331 		bcopy((char *)nat->nat_fr, (char *)&ipn->ipn_fr,
1332 		      sizeof(ipn->ipn_fr));
1333 
1334 	/*
1335 	 * Last but not least, if there is an application proxy session set
1336 	 * up for this NAT entry, then copy that out too, including any
1337 	 * private data saved along side it by the proxy.
1338 	 */
1339 	aps = nat->nat_aps;
1340 	outsize = ipn->ipn_dsize - sizeof(*ipn) + sizeof(ipn->ipn_data);
1341 	if (aps != NULL) {
1342 		char *s;
1343 
1344 		if (outsize < sizeof(*aps)) {
1345 			error = ENOBUFS;
1346 			goto finished;
1347 		}
1348 
1349 		s = ipn->ipn_data;
1350 		bcopy((char *)aps, s, sizeof(*aps));
1351 		s += sizeof(*aps);
1352 		outsize -= sizeof(*aps);
1353 		if ((aps->aps_data != NULL) && (outsize >= aps->aps_psiz))
1354 			bcopy(aps->aps_data, s, aps->aps_psiz);
1355 		else
1356 			error = ENOBUFS;
1357 	}
1358 	if (error == 0) {
1359 		error = fr_outobjsz(data, ipn, IPFOBJ_NATSAVE, ipns.ipn_dsize);
1360 	}
1361 
1362 finished:
1363 	if (ipn != NULL) {
1364 		KFREES(ipn, ipns.ipn_dsize);
1365 	}
1366 	return error;
1367 }
1368 
1369 /* ------------------------------------------------------------------------ */
1370 /* Function:    nat_calc_chksum_diffs					    */
1371 /* Returns:     void							    */
1372 /* Parameters:  nat	-	pointer to NAT table entry		    */
1373 /*                                                                          */
1374 /* Function calculates chksum deltas for IP header (nat_ipsumd) and TCP/UDP */
1375 /* headers (nat_sumd). The things for L4 (UDP/TCP) get complicated when     */
1376 /* we are dealing with partial chksum offload. For these cases we need to   */
1377 /* compute a 'partial chksum delta'. The 'partial chksum delta'is stored    */
1378 /* into nat_sumd[1], while ordinary chksum delta for TCP/UDP is in 	    */
1379 /* nat_sumd[0]. 							    */
1380 /*									    */
1381 /* The function accepts initialized NAT table entry and computes the deltas */
1382 /* from nat_inip/nat_outip members. The function is called right before	    */
1383 /* the new entry is inserted into the table.				    */
1384 /*									    */
1385 /* The ipsumd (IP hedaer chksum delta adjustment) is computed as a chksum   */
1386 /* of delta between original and new IP addresses.			    */
1387 /*									    */
1388 /* the nat_sumd[0] (TCP/UDP header chksum delta adjustment) is computed as  */
1389 /* a chkusm of delta between original an new IP addrress:port tupples.	    */
1390 /*									    */
1391 /* Some facts about chksum, we should remember:				    */
1392 /*	IP header chksum covers IP header only				    */
1393 /*									    */
1394 /*	TCP/UDP chksum covers data payload and so called pseudo header	    */
1395 /*		SRC, DST IP address					    */
1396 /*		SRC, DST Port						    */
1397 /*		length of payload					    */
1398 /*									    */
1399 /* The partial chksum delta (nat_sumd[1] is used to adjust db_ckusm16	    */
1400 /* member of dblk_t structure. The db_ckusm16 member is not part of 	    */
1401 /* IP/UDP/TCP header it is 16 bit value computed by NIC driver with partial */
1402 /* chksum offload capacbility for every inbound packet. The db_cksum16 is   */
1403 /* stored along with other IP packet data in dblk_t structure and used in   */
1404 /* for IP/UDP/TCP chksum validation later in ip.c. 			    */
1405 /*									    */
1406 /* The partial chksum delta (adjustment, nat_sumd[1]) is computed as chksum */
1407 /* of delta between new and orig address. NOTE: the order of operands for   */
1408 /* partial delta operation is swapped compared to computing the IP/TCP/UDP  */
1409 /* header adjustment. It is by design see (IP_CKSUM_RECV() macro in ip.c).  */
1410 /*									    */
1411 /* ------------------------------------------------------------------------ */
1412 void nat_calc_chksum_diffs(nat)
1413 nat_t *nat;
1414 {
1415 	u_32_t	sum_orig = 0;
1416 	u_32_t	sum_changed = 0;
1417 	u_32_t	sumd;
1418 	u_32_t	ipsum_orig = 0;
1419 	u_32_t	ipsum_changed = 0;
1420 
1421 	if (nat->nat_v != 4 && nat->nat_v != 6)
1422 		return;
1423 
1424 	/*
1425 	 * the switch calculates operands for CALC_SUMD(),
1426 	 * which will compute the partial chksum delta.
1427 	 */
1428 	switch (nat->nat_dir)
1429 	{
1430 	case NAT_INBOUND:
1431 		/*
1432 		 * we are dealing with RDR rule (DST address gets
1433 		 * modified on packet from client)
1434 		 */
1435 		if (nat->nat_v == 4) {
1436 			sum_changed = LONG_SUM(ntohl(nat->nat_inip.s_addr));
1437 			sum_orig = LONG_SUM(ntohl(nat->nat_outip.s_addr));
1438 		} else {
1439 			sum_changed = LONG_SUM6(&nat->nat_inip6);
1440 			sum_orig = LONG_SUM6(&nat->nat_outip6);
1441 		}
1442 		break;
1443 	case NAT_OUTBOUND:
1444 		/*
1445 		 * we are dealing with MAP rule (SRC address gets
1446 		 * modified on packet from client)
1447 		 */
1448 		if (nat->nat_v == 4) {
1449 			sum_changed = LONG_SUM(ntohl(nat->nat_outip.s_addr));
1450 			sum_orig = LONG_SUM(ntohl(nat->nat_inip.s_addr));
1451 		} else {
1452 			sum_changed = LONG_SUM6(&nat->nat_outip6);
1453 			sum_orig = LONG_SUM6(&nat->nat_inip6);
1454 		}
1455 		break;
1456 	default: ;
1457 		break;
1458 	}
1459 
1460 	/*
1461 	 * we also preserve CALC_SUMD() operands here, for IP chksum delta
1462 	 * calculation, which happens at the end of function.
1463 	 */
1464 	ipsum_changed = sum_changed;
1465 	ipsum_orig = sum_orig;
1466 	/*
1467 	 * NOTE: the order of operands for partial chksum adjustment
1468 	 * computation has to be swapped!
1469 	 */
1470 	CALC_SUMD(sum_changed, sum_orig, sumd);
1471 	nat->nat_sumd[1] = (sumd & 0xffff) + (sumd >> 16);
1472 
1473 	if (nat->nat_flags & (IPN_TCPUDP | IPN_ICMPQUERY)) {
1474 
1475 		/*
1476 		 * switch calculates operands for CALC_SUMD(), which will
1477 		 * compute the full chksum delta.
1478 		 */
1479 		switch (nat->nat_dir)
1480 		{
1481 		case NAT_INBOUND:
1482 			if (nat->nat_v == 4) {
1483 				sum_changed = LONG_SUM(
1484 				    ntohl(nat->nat_inip.s_addr) +
1485 				    ntohs(nat->nat_inport));
1486 				sum_orig = LONG_SUM(
1487 				    ntohl(nat->nat_outip.s_addr) +
1488 				    ntohs(nat->nat_outport));
1489 			} else {
1490 				sum_changed = LONG_SUM6(&nat->nat_inip6) +
1491 				    ntohs(nat->nat_inport);
1492 				sum_orig = LONG_SUM6(&nat->nat_outip6) +
1493 				    ntohs(nat->nat_outport);
1494 			}
1495 			break;
1496 		case NAT_OUTBOUND:
1497 			if (nat->nat_v == 4) {
1498 				sum_changed = LONG_SUM(
1499 				    ntohl(nat->nat_outip.s_addr) +
1500 				    ntohs(nat->nat_outport));
1501 				sum_orig = LONG_SUM(
1502 				    ntohl(nat->nat_inip.s_addr) +
1503 				    ntohs(nat->nat_inport));
1504 			} else {
1505 				sum_changed = LONG_SUM6(&nat->nat_outip6) +
1506 				    ntohs(nat->nat_outport);
1507 				sum_orig = LONG_SUM6(&nat->nat_inip6) +
1508 				    ntohs(nat->nat_inport);
1509 			}
1510 			break;
1511 		default: ;
1512 			break;
1513 		}
1514 
1515 		CALC_SUMD(sum_orig, sum_changed, sumd);
1516 		nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
1517 
1518 		if (!(nat->nat_flags & IPN_TCPUDP)) {
1519 			/*
1520 			 * partial HW chksum offload works for TCP/UDP headers only,
1521 			 * so we need to enforce full chksum adjustment for ICMP
1522 			 */
1523 			nat->nat_sumd[1] = nat->nat_sumd[0];
1524 		}
1525 	}
1526 	else
1527 		nat->nat_sumd[0] = nat->nat_sumd[1];
1528 
1529 	/*
1530 	 * we may reuse the already computed nat_sumd[0] for IP header chksum
1531 	 * adjustment in case the L4 (TCP/UDP header) is not changed by NAT.
1532 	 */
1533 	if (nat->nat_v == 4) {
1534 		if (NAT_HAS_L4_CHANGED(nat)) {
1535 			/*
1536 			 * bad luck, NAT changes also the L4 header, use IP
1537 			 * addresses to compute chksum adjustment for IP header.
1538 			 */
1539 			CALC_SUMD(ipsum_orig, ipsum_changed, sumd);
1540 			nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16);
1541 		} else {
1542 			/*
1543 			 * the NAT does not change L4 hdr -> reuse chksum
1544 			 * adjustment for IP hdr.
1545 			 */
1546 			nat->nat_ipsumd = nat->nat_sumd[0];
1547 
1548 			/*
1549 			 * if L4 header does not use chksum - zero out deltas
1550 			 */
1551 			if (!(nat->nat_flags & IPN_TCPUDP)) {
1552 				nat->nat_sumd[0] = 0;
1553 				nat->nat_sumd[1] = 0;
1554 			}
1555 		}
1556 	}
1557 
1558 	return;
1559 }
1560 
1561 /* ------------------------------------------------------------------------ */
1562 /* Function:    fr_natputent                                                */
1563 /* Returns:     int - 0 == success, != 0 is the error value.                */
1564 /* Parameters:  data(I) -     pointer to natget structure with NAT          */
1565 /*                            structure information to load into the kernel */
1566 /*              getlock(I) - flag indicating whether or not a write lock    */
1567 /*                           on ipf_nat is already held.                    */
1568 /*                                                                          */
1569 /* Handle SIOCSTPUT.                                                        */
1570 /* Loads a NAT table entry from user space, including a NAT rule, proxy and */
1571 /* firewall rule data structures, if pointers to them indicate so.          */
1572 /* ------------------------------------------------------------------------ */
1573 static int fr_natputent(data, getlock, ifs)
1574 caddr_t data;
1575 int getlock;
1576 ipf_stack_t *ifs;
1577 {
1578 	nat_save_t ipn, *ipnn;
1579 	ap_session_t *aps;
1580 	nat_t *n, *nat;
1581 	frentry_t *fr;
1582 	fr_info_t fin;
1583 	ipnat_t *in;
1584 	int error;
1585 
1586 	error = fr_inobj(data, &ipn, IPFOBJ_NATSAVE);
1587 	if (error != 0)
1588 		return error;
1589 
1590 	/*
1591 	 * Trigger automatic call to nat_extraflush() if the
1592 	 * table has reached capcity specified by hi watermark.
1593 	 */
1594 	if (NAT_TAB_WATER_LEVEL(ifs) > ifs->ifs_nat_flush_lvl_hi)
1595 		ifs->ifs_nat_doflush = 1;
1596 
1597 	/*
1598 	 * If automatic flushing did not do its job, and the table
1599 	 * has filled up, don't try to create a new entry.
1600 	 */
1601 	if (ifs->ifs_nat_stats.ns_inuse >= ifs->ifs_ipf_nattable_max) {
1602 		ifs->ifs_nat_stats.ns_memfail++;
1603 		return ENOMEM;
1604 	}
1605 
1606 	/*
1607 	 * Initialise early because of code at junkput label.
1608 	 */
1609 	in = NULL;
1610 	aps = NULL;
1611 	nat = NULL;
1612 	ipnn = NULL;
1613 
1614 	/*
1615 	 * New entry, copy in the rest of the NAT entry if it's size is more
1616 	 * than just the nat_t structure.
1617 	 */
1618 	fr = NULL;
1619 	if (ipn.ipn_dsize > sizeof(ipn)) {
1620 		if (ipn.ipn_dsize > 81920) {
1621 			error = ENOMEM;
1622 			goto junkput;
1623 		}
1624 
1625 		KMALLOCS(ipnn, nat_save_t *, ipn.ipn_dsize);
1626 		if (ipnn == NULL)
1627 			return ENOMEM;
1628 
1629 		error = fr_inobjsz(data, ipnn, IPFOBJ_NATSAVE, ipn.ipn_dsize);
1630 		if (error != 0) {
1631 			error = EFAULT;
1632 			goto junkput;
1633 		}
1634 	} else
1635 		ipnn = &ipn;
1636 
1637 	KMALLOC(nat, nat_t *);
1638 	if (nat == NULL) {
1639 		error = ENOMEM;
1640 		goto junkput;
1641 	}
1642 
1643 	bcopy((char *)&ipnn->ipn_nat, (char *)nat, sizeof(*nat));
1644 	/*
1645 	 * Initialize all these so that nat_delete() doesn't cause a crash.
1646 	 */
1647 	bzero((char *)nat, offsetof(struct nat, nat_tqe));
1648 	nat->nat_tqe.tqe_pnext = NULL;
1649 	nat->nat_tqe.tqe_next = NULL;
1650 	nat->nat_tqe.tqe_ifq = NULL;
1651 	nat->nat_tqe.tqe_parent = nat;
1652 
1653 	/*
1654 	 * Restore the rule associated with this nat session
1655 	 */
1656 	in = ipnn->ipn_nat.nat_ptr;
1657 	if (in != NULL) {
1658 		KMALLOC(in, ipnat_t *);
1659 		nat->nat_ptr = in;
1660 		if (in == NULL) {
1661 			error = ENOMEM;
1662 			goto junkput;
1663 		}
1664 		bzero((char *)in, offsetof(struct ipnat, in_next6));
1665 		bcopy((char *)&ipnn->ipn_ipnat, (char *)in, sizeof(*in));
1666 		in->in_use = 1;
1667 		in->in_flags |= IPN_DELETE;
1668 
1669 		ATOMIC_INC(ifs->ifs_nat_stats.ns_rules);
1670 
1671 		if (nat_resolverule(in, ifs) != 0) {
1672 			error = ESRCH;
1673 			goto junkput;
1674 		}
1675 	}
1676 
1677 	/*
1678 	 * Check that the NAT entry doesn't already exist in the kernel.
1679 	 */
1680 	if (nat->nat_v != 6)
1681 		nat->nat_v = 4;
1682 	bzero((char *)&fin, sizeof(fin));
1683 	fin.fin_p = nat->nat_p;
1684 	fin.fin_ifs = ifs;
1685 	if (nat->nat_dir == NAT_OUTBOUND) {
1686 		fin.fin_data[0] = ntohs(nat->nat_oport);
1687 		fin.fin_data[1] = ntohs(nat->nat_outport);
1688 		fin.fin_ifp = nat->nat_ifps[0];
1689 		if (getlock) {
1690 			READ_ENTER(&ifs->ifs_ipf_nat);
1691 		}
1692 
1693 		switch (nat->nat_v)
1694 		{
1695 		case 4:
1696 			fin.fin_v = nat->nat_v;
1697 			n = nat_inlookup(&fin, nat->nat_flags, fin.fin_p,
1698 			    nat->nat_oip, nat->nat_outip);
1699 			break;
1700 #ifdef USE_INET6
1701 		case 6:
1702 			n = nat6_inlookup(&fin, nat->nat_flags, fin.fin_p,
1703 			    &nat->nat_oip6.in6, &nat->nat_outip6.in6);
1704 			break;
1705 #endif
1706 		default:
1707 			n = NULL;
1708 			break;
1709 		}
1710 
1711 		if (getlock) {
1712 			RWLOCK_EXIT(&ifs->ifs_ipf_nat);
1713 		}
1714 		if (n != NULL) {
1715 			error = EEXIST;
1716 			goto junkput;
1717 		}
1718 	} else if (nat->nat_dir == NAT_INBOUND) {
1719 		fin.fin_data[0] = ntohs(nat->nat_inport);
1720 		fin.fin_data[1] = ntohs(nat->nat_oport);
1721 		fin.fin_ifp = nat->nat_ifps[1];
1722 		if (getlock) {
1723 			READ_ENTER(&ifs->ifs_ipf_nat);
1724 		}
1725 
1726 		switch (nat->nat_v)
1727 		{
1728 		case 4:
1729 			n = nat_outlookup(&fin, nat->nat_flags, fin.fin_p,
1730 			    nat->nat_inip, nat->nat_oip);
1731 			break;
1732 #ifdef USE_INET6
1733 		case 6:
1734 			n = nat6_outlookup(&fin, nat->nat_flags, fin.fin_p,
1735 			    &nat->nat_inip6.in6, &nat->nat_oip6.in6);
1736 			break;
1737 #endif
1738 		default:
1739 			n = NULL;
1740 			break;
1741 		}
1742 
1743 		if (getlock) {
1744 			RWLOCK_EXIT(&ifs->ifs_ipf_nat);
1745 		}
1746 		if (n != NULL) {
1747 			error = EEXIST;
1748 			goto junkput;
1749 		}
1750 	} else {
1751 		error = EINVAL;
1752 		goto junkput;
1753 	}
1754 
1755 	/*
1756 	 * Restore ap_session_t structure.  Include the private data allocated
1757 	 * if it was there.
1758 	 */
1759 	aps = nat->nat_aps;
1760 	if (aps != NULL) {
1761 		KMALLOC(aps, ap_session_t *);
1762 		nat->nat_aps = aps;
1763 		if (aps == NULL) {
1764 			error = ENOMEM;
1765 			goto junkput;
1766 		}
1767 		bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps));
1768 		if (in != NULL)
1769 			aps->aps_apr = in->in_apr;
1770 		else
1771 			aps->aps_apr = NULL;
1772 		if (aps->aps_psiz != 0) {
1773 			if (aps->aps_psiz > 81920) {
1774 				error = ENOMEM;
1775 				goto junkput;
1776 			}
1777 			KMALLOCS(aps->aps_data, void *, aps->aps_psiz);
1778 			if (aps->aps_data == NULL) {
1779 				error = ENOMEM;
1780 				goto junkput;
1781 			}
1782 			bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data,
1783 			      aps->aps_psiz);
1784 		} else {
1785 			aps->aps_psiz = 0;
1786 			aps->aps_data = NULL;
1787 		}
1788 	}
1789 
1790 	/*
1791 	 * If there was a filtering rule associated with this entry then
1792 	 * build up a new one.
1793 	 */
1794 	fr = nat->nat_fr;
1795 	if (fr != NULL) {
1796 		if ((nat->nat_flags & SI_NEWFR) != 0) {
1797 			KMALLOC(fr, frentry_t *);
1798 			nat->nat_fr = fr;
1799 			if (fr == NULL) {
1800 				error = ENOMEM;
1801 				goto junkput;
1802 			}
1803 			ipnn->ipn_nat.nat_fr = fr;
1804 			(void) fr_outobj(data, ipnn, IPFOBJ_NATSAVE);
1805 			bcopy((char *)&ipnn->ipn_fr, (char *)fr, sizeof(*fr));
1806 
1807 			fr->fr_ref = 1;
1808 			fr->fr_dsize = 0;
1809 			fr->fr_data = NULL;
1810 			fr->fr_type = FR_T_NONE;
1811 
1812 			MUTEX_NUKE(&fr->fr_lock);
1813 			MUTEX_INIT(&fr->fr_lock, "nat-filter rule lock");
1814 		} else {
1815 			if (getlock) {
1816 				READ_ENTER(&ifs->ifs_ipf_nat);
1817 			}
1818 			for (n = ifs->ifs_nat_instances; n; n = n->nat_next)
1819 				if (n->nat_fr == fr)
1820 					break;
1821 
1822 			if (n != NULL) {
1823 				MUTEX_ENTER(&fr->fr_lock);
1824 				fr->fr_ref++;
1825 				MUTEX_EXIT(&fr->fr_lock);
1826 			}
1827 			if (getlock) {
1828 				RWLOCK_EXIT(&ifs->ifs_ipf_nat);
1829 			}
1830 			if (!n) {
1831 				error = ESRCH;
1832 				goto junkput;
1833 			}
1834 		}
1835 	}
1836 
1837 	if (ipnn != &ipn) {
1838 		KFREES(ipnn, ipn.ipn_dsize);
1839 		ipnn = NULL;
1840 	}
1841 
1842 	nat_calc_chksum_diffs(nat);
1843 
1844 	if (getlock) {
1845 		WRITE_ENTER(&ifs->ifs_ipf_nat);
1846 	}
1847 
1848 	nat_calc_chksum_diffs(nat);
1849 
1850 	switch (nat->nat_v)
1851 	{
1852 	case 4 :
1853 		error = nat_insert(nat, nat->nat_rev, ifs);
1854 		break;
1855 #ifdef USE_INET6
1856 	case 6 :
1857 		error = nat6_insert(nat, nat->nat_rev, ifs);
1858 		break;
1859 #endif
1860 	default :
1861 		break;
1862 	}
1863 
1864 	if ((error == 0) && (aps != NULL)) {
1865 		aps->aps_next = ifs->ifs_ap_sess_list;
1866 		ifs->ifs_ap_sess_list = aps;
1867 	}
1868 	if (getlock) {
1869 		RWLOCK_EXIT(&ifs->ifs_ipf_nat);
1870 	}
1871 
1872 	if (error == 0)
1873 		return 0;
1874 
1875 	error = ENOMEM;
1876 
1877 junkput:
1878 	if (fr != NULL)
1879 		(void) fr_derefrule(&fr, ifs);
1880 
1881 	if ((ipnn != NULL) && (ipnn != &ipn)) {
1882 		KFREES(ipnn, ipn.ipn_dsize);
1883 	}
1884 	if (nat != NULL) {
1885 		if (aps != NULL) {
1886 			if (aps->aps_data != NULL) {
1887 				KFREES(aps->aps_data, aps->aps_psiz);
1888 			}
1889 			KFREE(aps);
1890 		}
1891 		if (in != NULL) {
1892 			if (in->in_apr)
1893 				appr_free(in->in_apr);
1894 			KFREE(in);
1895 		}
1896 		KFREE(nat);
1897 	}
1898 	return error;
1899 }
1900 
1901 
1902 /* ------------------------------------------------------------------------ */
1903 /* Function:    nat_delete                                                  */
1904 /* Returns:     Nil                                                         */
1905 /* Parameters:  natd(I)    - pointer to NAT structure to delete             */
1906 /*              logtype(I) - type of LOG record to create before deleting   */
1907 /*		ifs - ipf stack instance				    */
1908 /* Write Lock:  ipf_nat                                                     */
1909 /*                                                                          */
1910 /* Delete a nat entry from the various lists and table.  If NAT logging is  */
1911 /* enabled then generate a NAT log record for this event.                   */
1912 /* ------------------------------------------------------------------------ */
1913 void nat_delete(nat, logtype, ifs)
1914 struct nat *nat;
1915 int logtype;
1916 ipf_stack_t *ifs;
1917 {
1918 	struct ipnat *ipn;
1919 	int removed = 0;
1920 
1921 	if (logtype != 0 && ifs->ifs_nat_logging != 0)
1922 		nat_log(nat, logtype, ifs);
1923 
1924 	/*
1925 	 * Start by removing the entry from the hash table of nat entries
1926 	 * so it will not be "used" again.
1927 	 *
1928 	 * It will remain in the "list" of nat entries until all references
1929 	 * have been accounted for.
1930 	 */
1931 	if ((nat->nat_phnext[0] != NULL) && (nat->nat_phnext[1] != NULL)) {
1932 		removed = 1;
1933 
1934 		ifs->ifs_nat_stats.ns_bucketlen[0][nat->nat_hv[0]]--;
1935 		ifs->ifs_nat_stats.ns_bucketlen[1][nat->nat_hv[1]]--;
1936 
1937 		*nat->nat_phnext[0] = nat->nat_hnext[0];
1938 		if (nat->nat_hnext[0] != NULL) {
1939 			nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
1940 			nat->nat_hnext[0] = NULL;
1941 		}
1942 		nat->nat_phnext[0] = NULL;
1943 
1944 		*nat->nat_phnext[1] = nat->nat_hnext[1];
1945 		if (nat->nat_hnext[1] != NULL) {
1946 			nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
1947 			nat->nat_hnext[1] = NULL;
1948 		}
1949 		nat->nat_phnext[1] = NULL;
1950 
1951 		if ((nat->nat_flags & SI_WILDP) != 0)
1952 			ifs->ifs_nat_stats.ns_wilds--;
1953 	}
1954 
1955 	/*
1956 	 * Next, remove it from the timeout queue it is in.
1957 	 */
1958 	fr_deletequeueentry(&nat->nat_tqe);
1959 
1960 	if (nat->nat_me != NULL) {
1961 		*nat->nat_me = NULL;
1962 		nat->nat_me = NULL;
1963 	}
1964 
1965 	MUTEX_ENTER(&nat->nat_lock);
1966  	if (logtype == NL_DESTROY) {
1967  		/*
1968  		 * NL_DESTROY should only be passed when nat_ref >= 2.
1969  		 * This happens when a nat'd packet is blocked, we have
1970 		 * just created the nat table entry (reason why the ref
1971 		 * count is 2 or higher), but and we want to throw away
1972 		 * that NAT session as result of the blocked packet.
1973  		 */
1974  		if (nat->nat_ref > 2) {
1975  			nat->nat_ref -= 2;
1976  			MUTEX_EXIT(&nat->nat_lock);
1977  			if (removed)
1978  				ifs->ifs_nat_stats.ns_orphans++;
1979  			return;
1980  		}
1981  	} else if (nat->nat_ref > 1) {
1982 		nat->nat_ref--;
1983 		MUTEX_EXIT(&nat->nat_lock);
1984  		if (removed)
1985  			ifs->ifs_nat_stats.ns_orphans++;
1986 		return;
1987 	}
1988 	MUTEX_EXIT(&nat->nat_lock);
1989 
1990 	nat->nat_ref = 0;
1991 
1992 	/*
1993 	 * If entry had already been removed,
1994 	 * it means we're cleaning up an orphan.
1995 	 */
1996  	if (!removed)
1997  		ifs->ifs_nat_stats.ns_orphans--;
1998 
1999 #ifdef	IPFILTER_SYNC
2000 	if (nat->nat_sync)
2001 		ipfsync_del(nat->nat_sync);
2002 #endif
2003 
2004 	/*
2005 	 * Now remove it from master list of nat table entries
2006 	 */
2007 	if (nat->nat_pnext != NULL) {
2008 		*nat->nat_pnext = nat->nat_next;
2009 		if (nat->nat_next != NULL) {
2010 			nat->nat_next->nat_pnext = nat->nat_pnext;
2011 			nat->nat_next = NULL;
2012 		}
2013 		nat->nat_pnext = NULL;
2014 	}
2015 
2016 	if (nat->nat_fr != NULL)
2017 		(void)fr_derefrule(&nat->nat_fr, ifs);
2018 
2019 	if (nat->nat_hm != NULL)
2020 		fr_hostmapdel(&nat->nat_hm);
2021 
2022 	/*
2023 	 * If there is an active reference from the nat entry to its parent
2024 	 * rule, decrement the rule's reference count and free it too if no
2025 	 * longer being used.
2026 	 */
2027 	ipn = nat->nat_ptr;
2028 	if (ipn != NULL) {
2029 		ipn->in_space++;
2030 		ipn->in_use--;
2031 		if (ipn->in_use == 0 && (ipn->in_flags & IPN_DELETE)) {
2032 			if (ipn->in_apr)
2033 				appr_free(ipn->in_apr);
2034 			KFREE(ipn);
2035 			ifs->ifs_nat_stats.ns_rules--;
2036 		}
2037 	}
2038 
2039 	MUTEX_DESTROY(&nat->nat_lock);
2040 
2041 	aps_free(nat->nat_aps, ifs);
2042 	ifs->ifs_nat_stats.ns_inuse--;
2043 
2044 	/*
2045 	 * If there's a fragment table entry too for this nat entry, then
2046 	 * dereference that as well.  This is after nat_lock is released
2047 	 * because of Tru64.
2048 	 */
2049 	fr_forgetnat((void *)nat, ifs);
2050 
2051 	KFREE(nat);
2052 }
2053 
2054 
2055 /* ------------------------------------------------------------------------ */
2056 /* Function:    nat_flushtable                                              */
2057 /* Returns:     int - number of NAT rules deleted                           */
2058 /* Parameters:  Nil                                                         */
2059 /*                                                                          */
2060 /* Deletes all currently active NAT sessions.  In deleting each NAT entry a */
2061 /* log record should be emitted in nat_delete() if NAT logging is enabled.  */
2062 /* ------------------------------------------------------------------------ */
2063 /*
2064  * nat_flushtable - clear the NAT table of all mapping entries.
2065  */
2066 static int nat_flushtable(ifs)
2067 ipf_stack_t *ifs;
2068 {
2069 	nat_t *nat;
2070 	int j = 0;
2071 
2072 	/*
2073 	 * ALL NAT mappings deleted, so lets just make the deletions
2074 	 * quicker.
2075 	 */
2076 	if (ifs->ifs_nat_table[0] != NULL)
2077 		bzero((char *)ifs->ifs_nat_table[0],
2078 		      sizeof(ifs->ifs_nat_table[0]) * ifs->ifs_ipf_nattable_sz);
2079 	if (ifs->ifs_nat_table[1] != NULL)
2080 		bzero((char *)ifs->ifs_nat_table[1],
2081 		      sizeof(ifs->ifs_nat_table[1]) * ifs->ifs_ipf_nattable_sz);
2082 
2083 	while ((nat = ifs->ifs_nat_instances) != NULL) {
2084 		nat_delete(nat, NL_FLUSH, ifs);
2085 		j++;
2086 	}
2087 
2088 	return j;
2089 }
2090 
2091 
2092 /* ------------------------------------------------------------------------ */
2093 /* Function:    nat_clearlist                                               */
2094 /* Returns:     int - number of NAT/RDR rules deleted                       */
2095 /* Parameters:  Nil                                                         */
2096 /*                                                                          */
2097 /* Delete all rules in the current list of rules.  There is nothing elegant */
2098 /* about this cleanup: simply free all entries on the list of rules and     */
2099 /* clear out the tables used for hashed NAT rule lookups.                   */
2100 /* ------------------------------------------------------------------------ */
2101 static int nat_clearlist(ifs)
2102 ipf_stack_t *ifs;
2103 {
2104 	ipnat_t *n, **np = &ifs->ifs_nat_list;
2105 	int i = 0;
2106 
2107 	if (ifs->ifs_nat_rules != NULL)
2108 		bzero((char *)ifs->ifs_nat_rules,
2109 		      sizeof(*ifs->ifs_nat_rules) * ifs->ifs_ipf_natrules_sz);
2110 	if (ifs->ifs_rdr_rules != NULL)
2111 		bzero((char *)ifs->ifs_rdr_rules,
2112 		      sizeof(*ifs->ifs_rdr_rules) * ifs->ifs_ipf_rdrrules_sz);
2113 
2114 	while ((n = *np) != NULL) {
2115 		*np = n->in_next;
2116 		if (n->in_use == 0) {
2117 			if (n->in_apr != NULL)
2118 				appr_free(n->in_apr);
2119 			KFREE(n);
2120 			ifs->ifs_nat_stats.ns_rules--;
2121 		} else {
2122 			n->in_flags |= IPN_DELETE;
2123 			n->in_next = NULL;
2124 		}
2125 		i++;
2126 	}
2127 	ifs->ifs_nat_masks = 0;
2128 	ifs->ifs_rdr_masks = 0;
2129 	for (i = 0; i < 4; i++) {
2130 		ifs->ifs_nat6_masks[i] = 0;
2131 		ifs->ifs_rdr6_masks[i] = 0;
2132 	}
2133 	return i;
2134 }
2135 
2136 
2137 /* ------------------------------------------------------------------------ */
2138 /* Function:    nat_newmap                                                  */
2139 /* Returns:     int - -1 == error, 0 == success                             */
2140 /* Parameters:  fin(I) - pointer to packet information                      */
2141 /*              nat(I) - pointer to NAT entry                               */
2142 /*              ni(I)  - pointer to structure with misc. information needed */
2143 /*                       to create new NAT entry.                           */
2144 /*                                                                          */
2145 /* Given an empty NAT structure, populate it with new information about a   */
2146 /* new NAT session, as defined by the matching NAT rule.                    */
2147 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
2148 /* to the new IP address for the translation.                               */
2149 /* ------------------------------------------------------------------------ */
2150 static INLINE int nat_newmap(fin, nat, ni)
2151 fr_info_t *fin;
2152 nat_t *nat;
2153 natinfo_t *ni;
2154 {
2155 	u_short st_port, dport, sport, port, sp, dp;
2156 	struct in_addr in, inb;
2157 	hostmap_t *hm;
2158 	u_32_t flags;
2159 	u_32_t st_ip;
2160 	ipnat_t *np;
2161 	nat_t *natl;
2162 	int l;
2163 	ipf_stack_t *ifs = fin->fin_ifs;
2164 
2165 	/*
2166 	 * If it's an outbound packet which doesn't match any existing
2167 	 * record, then create a new port
2168 	 */
2169 	l = 0;
2170 	hm = NULL;
2171 	np = ni->nai_np;
2172 	st_ip = np->in_nip;
2173 	st_port = np->in_pnext;
2174 	flags = ni->nai_flags;
2175 	sport = ni->nai_sport;
2176 	dport = ni->nai_dport;
2177 
2178 	/*
2179 	 * Do a loop until we either run out of entries to try or we find
2180 	 * a NAT mapping that isn't currently being used.  This is done
2181 	 * because the change to the source is not (usually) being fixed.
2182 	 */
2183 	do {
2184 		port = 0;
2185 		in.s_addr = htonl(np->in_nip);
2186 		if (l == 0) {
2187 			/*
2188 			 * Check to see if there is an existing NAT
2189 			 * setup for this IP address pair.
2190 			 */
2191 			hm = nat_hostmap(np, fin->fin_src, fin->fin_dst,
2192 					 in, 0, ifs);
2193 			if (hm != NULL)
2194 				in.s_addr = hm->hm_mapip.s_addr;
2195 		} else if ((l == 1) && (hm != NULL)) {
2196 			fr_hostmapdel(&hm);
2197 		}
2198 		in.s_addr = ntohl(in.s_addr);
2199 
2200 		nat->nat_hm = hm;
2201 
2202 		if ((np->in_outmsk == 0xffffffff) && (np->in_pnext == 0)) {
2203 			if (l > 0)
2204 				return -1;
2205 		}
2206 
2207 		if (np->in_redir == NAT_BIMAP &&
2208 		    np->in_inmsk == np->in_outmsk) {
2209 			/*
2210 			 * map the address block in a 1:1 fashion
2211 			 */
2212 			in.s_addr = np->in_outip;
2213 			in.s_addr |= fin->fin_saddr & ~np->in_inmsk;
2214 			in.s_addr = ntohl(in.s_addr);
2215 
2216 		} else if (np->in_redir & NAT_MAPBLK) {
2217 			if ((l >= np->in_ppip) || ((l > 0) &&
2218 			     !(flags & IPN_TCPUDP)))
2219 				return -1;
2220 			/*
2221 			 * map-block - Calculate destination address.
2222 			 */
2223 			in.s_addr = ntohl(fin->fin_saddr);
2224 			in.s_addr &= ntohl(~np->in_inmsk);
2225 			inb.s_addr = in.s_addr;
2226 			in.s_addr /= np->in_ippip;
2227 			in.s_addr &= ntohl(~np->in_outmsk);
2228 			in.s_addr += ntohl(np->in_outip);
2229 			/*
2230 			 * Calculate destination port.
2231 			 */
2232 			if ((flags & IPN_TCPUDP) &&
2233 			    (np->in_ppip != 0)) {
2234 				port = ntohs(sport) + l;
2235 				port %= np->in_ppip;
2236 				port += np->in_ppip *
2237 					(inb.s_addr % np->in_ippip);
2238 				port += MAPBLK_MINPORT;
2239 				port = htons(port);
2240 			}
2241 
2242 		} else if ((np->in_outip == 0) &&
2243 			   (np->in_outmsk == 0xffffffff)) {
2244 			/*
2245 			 * 0/32 - use the interface's IP address.
2246 			 */
2247 			if ((l > 0) ||
2248 			    fr_ifpaddr(4, FRI_NORMAL, fin->fin_ifp,
2249 				       &in, NULL, fin->fin_ifs) == -1)
2250 				return -1;
2251 			in.s_addr = ntohl(in.s_addr);
2252 
2253 		} else if ((np->in_outip == 0) && (np->in_outmsk == 0)) {
2254 			/*
2255 			 * 0/0 - use the original source address/port.
2256 			 */
2257 			if (l > 0)
2258 				return -1;
2259 			in.s_addr = ntohl(fin->fin_saddr);
2260 
2261 		} else if ((np->in_outmsk != 0xffffffff) &&
2262 			   (np->in_pnext == 0) && ((l > 0) || (hm == NULL)))
2263 			np->in_nip++;
2264 
2265 		natl = NULL;
2266 
2267 		if ((flags & IPN_TCPUDP) &&
2268 		    ((np->in_redir & NAT_MAPBLK) == 0) &&
2269 		    (np->in_flags & IPN_AUTOPORTMAP)) {
2270 			/*
2271 			 * "ports auto" (without map-block)
2272 			 */
2273 			if ((l > 0) && (l % np->in_ppip == 0)) {
2274 				if (l > np->in_space) {
2275 					return -1;
2276 				} else if ((l > np->in_ppip) &&
2277 					   np->in_outmsk != 0xffffffff)
2278 					np->in_nip++;
2279 			}
2280 			if (np->in_ppip != 0) {
2281 				port = ntohs(sport);
2282 				port += (l % np->in_ppip);
2283 				port %= np->in_ppip;
2284 				port += np->in_ppip *
2285 					(ntohl(fin->fin_saddr) %
2286 					 np->in_ippip);
2287 				port += MAPBLK_MINPORT;
2288 				port = htons(port);
2289 			}
2290 
2291 		} else if (((np->in_redir & NAT_MAPBLK) == 0) &&
2292 			   (flags & IPN_TCPUDPICMP) && (np->in_pnext != 0)) {
2293 			/*
2294 			 * Standard port translation.  Select next port.
2295 			 */
2296 			if (np->in_flags & IPN_SEQUENTIAL) {
2297 				port = np->in_pnext;
2298 			} else {
2299 				port = ipf_random() % (ntohs(np->in_pmax) -
2300 						       ntohs(np->in_pmin));
2301 				port += ntohs(np->in_pmin);
2302 			}
2303 			port = htons(port);
2304 			np->in_pnext++;
2305 
2306 			if (np->in_pnext > ntohs(np->in_pmax)) {
2307 				np->in_pnext = ntohs(np->in_pmin);
2308 				if (np->in_outmsk != 0xffffffff)
2309 					np->in_nip++;
2310 			}
2311 		}
2312 
2313 		if (np->in_flags & IPN_IPRANGE) {
2314 			if (np->in_nip > ntohl(np->in_outmsk))
2315 				np->in_nip = ntohl(np->in_outip);
2316 		} else {
2317 			if ((np->in_outmsk != 0xffffffff) &&
2318 			    ((np->in_nip + 1) & ntohl(np->in_outmsk)) >
2319 			    ntohl(np->in_outip))
2320 				np->in_nip = ntohl(np->in_outip) + 1;
2321 		}
2322 
2323 		if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY)))
2324 			port = sport;
2325 
2326 		/*
2327 		 * Here we do a lookup of the connection as seen from
2328 		 * the outside.  If an IP# pair already exists, try
2329 		 * again.  So if you have A->B becomes C->B, you can
2330 		 * also have D->E become C->E but not D->B causing
2331 		 * another C->B.  Also take protocol and ports into
2332 		 * account when determining whether a pre-existing
2333 		 * NAT setup will cause an external conflict where
2334 		 * this is appropriate.
2335 		 */
2336 		inb.s_addr = htonl(in.s_addr);
2337 		sp = fin->fin_data[0];
2338 		dp = fin->fin_data[1];
2339 		fin->fin_data[0] = fin->fin_data[1];
2340 		fin->fin_data[1] = htons(port);
2341 		natl = nat_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
2342 				    (u_int)fin->fin_p, fin->fin_dst, inb);
2343 		fin->fin_data[0] = sp;
2344 		fin->fin_data[1] = dp;
2345 
2346 		/*
2347 		 * Has the search wrapped around and come back to the
2348 		 * start ?
2349 		 */
2350 		if ((natl != NULL) &&
2351 		    (np->in_pnext != 0) && (st_port == np->in_pnext) &&
2352 		    (np->in_nip != 0) && (st_ip == np->in_nip))
2353 			return -1;
2354 		l++;
2355 	} while (natl != NULL);
2356 
2357 	if (np->in_space > 0)
2358 		np->in_space--;
2359 
2360 	/* Setup the NAT table */
2361 	nat->nat_inip = fin->fin_src;
2362 	nat->nat_outip.s_addr = htonl(in.s_addr);
2363 	nat->nat_oip = fin->fin_dst;
2364 	if (nat->nat_hm == NULL)
2365 		nat->nat_hm = nat_hostmap(np, fin->fin_src, fin->fin_dst,
2366 					  nat->nat_outip, 0, ifs);
2367 
2368 	if (flags & IPN_TCPUDP) {
2369 		nat->nat_inport = sport;
2370 		nat->nat_outport = port;	/* sport */
2371 		nat->nat_oport = dport;
2372 		((tcphdr_t *)fin->fin_dp)->th_sport = port;
2373 	} else if (flags & IPN_ICMPQUERY) {
2374 		((icmphdr_t *)fin->fin_dp)->icmp_id = port;
2375 		nat->nat_inport = port;
2376 		nat->nat_outport = port;
2377 	}
2378 
2379 	ni->nai_ip.s_addr = in.s_addr;
2380 	ni->nai_port = port;
2381 	ni->nai_nport = dport;
2382 	return 0;
2383 }
2384 
2385 
2386 /* ------------------------------------------------------------------------ */
2387 /* Function:    nat_newrdr                                                  */
2388 /* Returns:     int - -1 == error, 0 == success (no move), 1 == success and */
2389 /*                    allow rule to be moved if IPN_ROUNDR is set.          */
2390 /* Parameters:  fin(I) - pointer to packet information                      */
2391 /*              nat(I) - pointer to NAT entry                               */
2392 /*              ni(I)  - pointer to structure with misc. information needed */
2393 /*                       to create new NAT entry.                           */
2394 /*                                                                          */
2395 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
2396 /* to the new IP address for the translation.                               */
2397 /* ------------------------------------------------------------------------ */
2398 static INLINE int nat_newrdr(fin, nat, ni)
2399 fr_info_t *fin;
2400 nat_t *nat;
2401 natinfo_t *ni;
2402 {
2403 	u_short nport, dport, sport;
2404 	struct in_addr in, inb;
2405 	u_short sp, dp;
2406 	hostmap_t *hm;
2407 	u_32_t flags;
2408 	ipnat_t *np;
2409 	nat_t *natl;
2410 	int move;
2411 	ipf_stack_t *ifs = fin->fin_ifs;
2412 
2413 	move = 1;
2414 	hm = NULL;
2415 	in.s_addr = 0;
2416 	np = ni->nai_np;
2417 	flags = ni->nai_flags;
2418 	sport = ni->nai_sport;
2419 	dport = ni->nai_dport;
2420 
2421 	/*
2422 	 * If the matching rule has IPN_STICKY set, then we want to have the
2423 	 * same rule kick in as before.  Why would this happen?  If you have
2424 	 * a collection of rdr rules with "round-robin sticky", the current
2425 	 * packet might match a different one to the previous connection but
2426 	 * we want the same destination to be used.
2427 	 */
2428 	if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) ==
2429 	    (IPN_ROUNDR|IPN_STICKY)) {
2430 		hm = nat_hostmap(NULL, fin->fin_src, fin->fin_dst, in,
2431 				 (u_32_t)dport, ifs);
2432 		if (hm != NULL) {
2433 			in.s_addr = ntohl(hm->hm_mapip.s_addr);
2434 			np = hm->hm_ipnat;
2435 			ni->nai_np = np;
2436 			move = 0;
2437 		}
2438 	}
2439 
2440 	/*
2441 	 * Otherwise, it's an inbound packet. Most likely, we don't
2442 	 * want to rewrite source ports and source addresses. Instead,
2443 	 * we want to rewrite to a fixed internal address and fixed
2444 	 * internal port.
2445 	 */
2446 	if (np->in_flags & IPN_SPLIT) {
2447 		in.s_addr = np->in_nip;
2448 
2449 		if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) {
2450 			hm = nat_hostmap(np, fin->fin_src, fin->fin_dst,
2451 					 in, (u_32_t)dport, ifs);
2452 			if (hm != NULL) {
2453 				in.s_addr = hm->hm_mapip.s_addr;
2454 				move = 0;
2455 			}
2456 		}
2457 
2458 		if (hm == NULL || hm->hm_ref == 1) {
2459 			if (np->in_inip == htonl(in.s_addr)) {
2460 				np->in_nip = ntohl(np->in_inmsk);
2461 				move = 0;
2462 			} else {
2463 				np->in_nip = ntohl(np->in_inip);
2464 			}
2465 		}
2466 
2467 	} else if ((np->in_inip == 0) && (np->in_inmsk == 0xffffffff)) {
2468 		/*
2469 		 * 0/32 - use the interface's IP address.
2470 		 */
2471 		if (fr_ifpaddr(4, FRI_NORMAL, fin->fin_ifp, &in, NULL,
2472 			   fin->fin_ifs) == -1)
2473 			return -1;
2474 		in.s_addr = ntohl(in.s_addr);
2475 
2476 	} else if ((np->in_inip == 0) && (np->in_inmsk== 0)) {
2477 		/*
2478 		 * 0/0 - use the original destination address/port.
2479 		 */
2480 		in.s_addr = ntohl(fin->fin_daddr);
2481 
2482 	} else if (np->in_redir == NAT_BIMAP &&
2483 		   np->in_inmsk == np->in_outmsk) {
2484 		/*
2485 		 * map the address block in a 1:1 fashion
2486 		 */
2487 		in.s_addr = np->in_inip;
2488 		in.s_addr |= fin->fin_daddr & ~np->in_inmsk;
2489 		in.s_addr = ntohl(in.s_addr);
2490 	} else {
2491 		in.s_addr = ntohl(np->in_inip);
2492 	}
2493 
2494 	if ((np->in_pnext == 0) || ((flags & NAT_NOTRULEPORT) != 0))
2495 		nport = dport;
2496 	else {
2497 		/*
2498 		 * Whilst not optimized for the case where
2499 		 * pmin == pmax, the gain is not significant.
2500 		 */
2501 		if (((np->in_flags & IPN_FIXEDDPORT) == 0) &&
2502 		    (np->in_pmin != np->in_pmax)) {
2503 			nport = ntohs(dport) - ntohs(np->in_pmin) +
2504 				ntohs(np->in_pnext);
2505 			nport = htons(nport);
2506 		} else
2507 			nport = np->in_pnext;
2508 	}
2509 
2510 	/*
2511 	 * When the redirect-to address is set to 0.0.0.0, just
2512 	 * assume a blank `forwarding' of the packet.  We don't
2513 	 * setup any translation for this either.
2514 	 */
2515 	if (in.s_addr == 0) {
2516 		if (nport == dport)
2517 			return -1;
2518 		in.s_addr = ntohl(fin->fin_daddr);
2519 	}
2520 
2521 	/*
2522 	 * Check to see if this redirect mapping already exists and if
2523 	 * it does, return "failure" (allowing it to be created will just
2524 	 * cause one or both of these "connections" to stop working.)
2525 	 */
2526 	inb.s_addr = htonl(in.s_addr);
2527 	sp = fin->fin_data[0];
2528 	dp = fin->fin_data[1];
2529 	fin->fin_data[1] = fin->fin_data[0];
2530 	fin->fin_data[0] = ntohs(nport);
2531 	natl = nat_outlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
2532 		    (u_int)fin->fin_p, inb, fin->fin_src);
2533 	fin->fin_data[0] = sp;
2534 	fin->fin_data[1] = dp;
2535 	if (natl != NULL)
2536 		return (-1);
2537 
2538 	nat->nat_inip.s_addr = htonl(in.s_addr);
2539 	nat->nat_outip = fin->fin_dst;
2540 	nat->nat_oip = fin->fin_src;
2541 
2542 	ni->nai_ip.s_addr = in.s_addr;
2543 	ni->nai_nport = nport;
2544 	ni->nai_port = sport;
2545 
2546 	if (flags & IPN_TCPUDP) {
2547 		nat->nat_inport = nport;
2548 		nat->nat_outport = dport;
2549 		nat->nat_oport = sport;
2550 		((tcphdr_t *)fin->fin_dp)->th_dport = nport;
2551 	} else if (flags & IPN_ICMPQUERY) {
2552 		((icmphdr_t *)fin->fin_dp)->icmp_id = nport;
2553 		nat->nat_inport = nport;
2554 		nat->nat_outport = nport;
2555 	}
2556 
2557 	return move;
2558 }
2559 
2560 /* ------------------------------------------------------------------------ */
2561 /* Function:    nat_new                                                     */
2562 /* Returns:     nat_t* - NULL == failure to create new NAT structure,       */
2563 /*                       else pointer to new NAT structure                  */
2564 /* Parameters:  fin(I)       - pointer to packet information                */
2565 /*              np(I)        - pointer to NAT rule                          */
2566 /*              natsave(I)   - pointer to where to store NAT struct pointer */
2567 /*              flags(I)     - flags describing the current packet          */
2568 /*              direction(I) - direction of packet (in/out)                 */
2569 /* Write Lock:  ipf_nat                                                     */
2570 /*                                                                          */
2571 /* Attempts to create a new NAT entry.  Does not actually change the packet */
2572 /* in any way.                                                              */
2573 /*                                                                          */
2574 /* This fucntion is in three main parts: (1) deal with creating a new NAT   */
2575 /* structure for a "MAP" rule (outgoing NAT translation); (2) deal with     */
2576 /* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */
2577 /* and (3) building that structure and putting it into the NAT table(s).    */
2578 /* ------------------------------------------------------------------------ */
2579 nat_t *nat_new(fin, np, natsave, flags, direction)
2580 fr_info_t *fin;
2581 ipnat_t *np;
2582 nat_t **natsave;
2583 u_int flags;
2584 int direction;
2585 {
2586 	tcphdr_t *tcp = NULL;
2587 	hostmap_t *hm = NULL;
2588 	nat_t *nat, *natl;
2589 	u_int nflags;
2590 	natinfo_t ni;
2591 	int move;
2592 	ipf_stack_t *ifs = fin->fin_ifs;
2593 
2594 	/*
2595 	 * Trigger automatic call to nat_extraflush() if the
2596 	 * table has reached capcity specified by hi watermark.
2597 	 */
2598 	if (NAT_TAB_WATER_LEVEL(ifs) > ifs->ifs_nat_flush_lvl_hi)
2599 		ifs->ifs_nat_doflush = 1;
2600 
2601 	/*
2602 	 * If automatic flushing did not do its job, and the table
2603 	 * has filled up, don't try to create a new entry.
2604 	 */
2605 	if (ifs->ifs_nat_stats.ns_inuse >= ifs->ifs_ipf_nattable_max) {
2606 		ifs->ifs_nat_stats.ns_memfail++;
2607 		return NULL;
2608 	}
2609 
2610 	move = 1;
2611 	nflags = np->in_flags & flags;
2612 	nflags &= NAT_FROMRULE;
2613 
2614 	ni.nai_np = np;
2615 	ni.nai_nflags = nflags;
2616 	ni.nai_flags = flags;
2617 
2618 	/* Give me a new nat */
2619 	KMALLOC(nat, nat_t *);
2620 	if (nat == NULL) {
2621 		ifs->ifs_nat_stats.ns_memfail++;
2622 		/*
2623 		 * Try to automatically tune the max # of entries in the
2624 		 * table allowed to be less than what will cause kmem_alloc()
2625 		 * to fail and try to eliminate panics due to out of memory
2626 		 * conditions arising.
2627 		 */
2628 		if (ifs->ifs_ipf_nattable_max > ifs->ifs_ipf_nattable_sz) {
2629 			ifs->ifs_ipf_nattable_max = ifs->ifs_nat_stats.ns_inuse - 100;
2630 			printf("ipf_nattable_max reduced to %d\n",
2631 				ifs->ifs_ipf_nattable_max);
2632 		}
2633 		return NULL;
2634 	}
2635 
2636 	if (flags & IPN_TCPUDP) {
2637 		tcp = fin->fin_dp;
2638 		ni.nai_sport = htons(fin->fin_sport);
2639 		ni.nai_dport = htons(fin->fin_dport);
2640 	} else if (flags & IPN_ICMPQUERY) {
2641 		/*
2642 		 * In the ICMP query NAT code, we translate the ICMP id fields
2643 		 * to make them unique. This is indepedent of the ICMP type
2644 		 * (e.g. in the unlikely event that a host sends an echo and
2645 		 * an tstamp request with the same id, both packets will have
2646 		 * their ip address/id field changed in the same way).
2647 		 */
2648 		/* The icmp_id field is used by the sender to identify the
2649 		 * process making the icmp request. (the receiver justs
2650 		 * copies it back in its response). So, it closely matches
2651 		 * the concept of source port. We overlay sport, so we can
2652 		 * maximally reuse the existing code.
2653 		 */
2654 		ni.nai_sport = ((icmphdr_t *)fin->fin_dp)->icmp_id;
2655 		ni.nai_dport = ni.nai_sport;
2656 	}
2657 
2658 	bzero((char *)nat, sizeof(*nat));
2659 	nat->nat_flags = flags;
2660 	nat->nat_redir = np->in_redir;
2661 
2662 	if ((flags & NAT_SLAVE) == 0) {
2663 		MUTEX_ENTER(&ifs->ifs_ipf_nat_new);
2664 	}
2665 
2666 	/*
2667 	 * Search the current table for a match.
2668 	 */
2669 	if (direction == NAT_OUTBOUND) {
2670 		/*
2671 		 * We can now arrange to call this for the same connection
2672 		 * because ipf_nat_new doesn't protect the code path into
2673 		 * this function.
2674 		 */
2675 		natl = nat_outlookup(fin, nflags, (u_int)fin->fin_p,
2676 				     fin->fin_src, fin->fin_dst);
2677 		if (natl != NULL) {
2678 			KFREE(nat);
2679 			nat = natl;
2680 			goto done;
2681 		}
2682 
2683 		move = nat_newmap(fin, nat, &ni);
2684 		if (move == -1)
2685 			goto badnat;
2686 
2687 		np = ni.nai_np;
2688 	} else {
2689 		/*
2690 		 * NAT_INBOUND is used only for redirects rules
2691 		 */
2692 		natl = nat_inlookup(fin, nflags, (u_int)fin->fin_p,
2693 				    fin->fin_src, fin->fin_dst);
2694 		if (natl != NULL) {
2695 			KFREE(nat);
2696 			nat = natl;
2697 			goto done;
2698 		}
2699 
2700 		move = nat_newrdr(fin, nat, &ni);
2701 		if (move == -1)
2702 			goto badnat;
2703 
2704 		np = ni.nai_np;
2705 	}
2706 
2707 	if ((move == 1) && (np->in_flags & IPN_ROUNDR)) {
2708 		if (np->in_redir == NAT_REDIRECT) {
2709 			nat_delrdr(np);
2710 			nat_addrdr(np, ifs);
2711 		} else if (np->in_redir == NAT_MAP) {
2712 			nat_delnat(np);
2713 			nat_addnat(np, ifs);
2714 		}
2715 	}
2716 
2717 	if (nat_finalise(fin, nat, &ni, tcp, natsave, direction) == -1) {
2718 		goto badnat;
2719 	}
2720 
2721 	nat_calc_chksum_diffs(nat);
2722 
2723 	if (flags & SI_WILDP)
2724 		ifs->ifs_nat_stats.ns_wilds++;
2725 	fin->fin_flx |= FI_NEWNAT;
2726 	goto done;
2727 badnat:
2728 	ifs->ifs_nat_stats.ns_badnat++;
2729 	if ((hm = nat->nat_hm) != NULL)
2730 		fr_hostmapdel(&hm);
2731 	KFREE(nat);
2732 	nat = NULL;
2733 done:
2734 	if ((flags & NAT_SLAVE) == 0) {
2735 		MUTEX_EXIT(&ifs->ifs_ipf_nat_new);
2736 	}
2737 	return nat;
2738 }
2739 
2740 
2741 /* ------------------------------------------------------------------------ */
2742 /* Function:    nat_finalise                                                */
2743 /* Returns:     int - 0 == sucess, -1 == failure                            */
2744 /* Parameters:  fin(I) - pointer to packet information                      */
2745 /*              nat(I) - pointer to NAT entry                               */
2746 /*              ni(I)  - pointer to structure with misc. information needed */
2747 /*                       to create new NAT entry.                           */
2748 /* Write Lock:  ipf_nat                                                     */
2749 /*                                                                          */
2750 /* This is the tail end of constructing a new NAT entry and is the same     */
2751 /* for both IPv4 and IPv6.                                                  */
2752 /* ------------------------------------------------------------------------ */
2753 /*ARGSUSED*/
2754 static INLINE int nat_finalise(fin, nat, ni, tcp, natsave, direction)
2755 fr_info_t *fin;
2756 nat_t *nat;
2757 natinfo_t *ni;
2758 tcphdr_t *tcp;
2759 nat_t **natsave;
2760 int direction;
2761 {
2762 	frentry_t *fr;
2763 	ipnat_t *np;
2764 	ipf_stack_t *ifs = fin->fin_ifs;
2765 
2766 	np = ni->nai_np;
2767 
2768 	COPYIFNAME(fin->fin_ifp, nat->nat_ifnames[0], fin->fin_v);
2769 
2770 #ifdef	IPFILTER_SYNC
2771 	if ((nat->nat_flags & SI_CLONE) == 0)
2772 		nat->nat_sync = ipfsync_new(SMC_NAT, fin, nat);
2773 #endif
2774 
2775 	nat->nat_me = natsave;
2776 	nat->nat_dir = direction;
2777 	nat->nat_ifps[0] = np->in_ifps[0];
2778 	nat->nat_ifps[1] = np->in_ifps[1];
2779 	nat->nat_ptr = np;
2780 	nat->nat_p = fin->fin_p;
2781 	nat->nat_v = fin->fin_v;
2782 	nat->nat_mssclamp = np->in_mssclamp;
2783 	fr = fin->fin_fr;
2784 	nat->nat_fr = fr;
2785 
2786 	if ((np->in_apr != NULL) && ((ni->nai_flags & NAT_SLAVE) == 0))
2787 		if (appr_new(fin, nat) == -1)
2788 			return -1;
2789 
2790 	if (nat_insert(nat, fin->fin_rev, ifs) == 0) {
2791 		if (ifs->ifs_nat_logging)
2792 			nat_log(nat, (u_int)np->in_redir, ifs);
2793 		np->in_use++;
2794 		if (fr != NULL) {
2795 			MUTEX_ENTER(&fr->fr_lock);
2796 			fr->fr_ref++;
2797 			MUTEX_EXIT(&fr->fr_lock);
2798 		}
2799 		return 0;
2800 	}
2801 
2802 	/*
2803 	 * nat_insert failed, so cleanup time...
2804 	 */
2805 	return -1;
2806 }
2807 
2808 
2809 /* ------------------------------------------------------------------------ */
2810 /* Function:   nat_insert                                                   */
2811 /* Returns:    int - 0 == sucess, -1 == failure                             */
2812 /* Parameters: nat(I) - pointer to NAT structure                            */
2813 /*             rev(I) - flag indicating forward/reverse direction of packet */
2814 /* Write Lock: ipf_nat                                                      */
2815 /*                                                                          */
2816 /* Insert a NAT entry into the hash tables for searching and add it to the  */
2817 /* list of active NAT entries.  Adjust global counters when complete.       */
2818 /* ------------------------------------------------------------------------ */
2819 int	nat_insert(nat, rev, ifs)
2820 nat_t	*nat;
2821 int	rev;
2822 ipf_stack_t *ifs;
2823 {
2824 	u_int hv1, hv2;
2825 	nat_t **natp;
2826 
2827 	/*
2828 	 * Try and return an error as early as possible, so calculate the hash
2829 	 * entry numbers first and then proceed.
2830 	 */
2831 	if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) {
2832 		hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport,
2833 				  0xffffffff);
2834 		hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1 + nat->nat_oport,
2835 				  ifs->ifs_ipf_nattable_sz);
2836 		hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport,
2837 				  0xffffffff);
2838 		hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2 + nat->nat_oport,
2839 				  ifs->ifs_ipf_nattable_sz);
2840 	} else {
2841 		hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, 0, 0xffffffff);
2842 		hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1,
2843 				  ifs->ifs_ipf_nattable_sz);
2844 		hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, 0, 0xffffffff);
2845 		hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2,
2846 				  ifs->ifs_ipf_nattable_sz);
2847 	}
2848 
2849 	if (ifs->ifs_nat_stats.ns_bucketlen[0][hv1] >= ifs->ifs_fr_nat_maxbucket ||
2850 	    ifs->ifs_nat_stats.ns_bucketlen[1][hv2] >= ifs->ifs_fr_nat_maxbucket) {
2851 		return -1;
2852 	}
2853 
2854 	nat->nat_hv[0] = hv1;
2855 	nat->nat_hv[1] = hv2;
2856 
2857 	MUTEX_INIT(&nat->nat_lock, "nat entry lock");
2858 
2859 	nat->nat_rev = rev;
2860 	nat->nat_ref = 1;
2861 	nat->nat_bytes[0] = 0;
2862 	nat->nat_pkts[0] = 0;
2863 	nat->nat_bytes[1] = 0;
2864 	nat->nat_pkts[1] = 0;
2865 
2866 	nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0';
2867 	nat->nat_ifps[0] = fr_resolvenic(nat->nat_ifnames[0], 4, ifs);
2868 
2869 	if (nat->nat_ifnames[1][0] !='\0') {
2870 		nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
2871 		nat->nat_ifps[1] = fr_resolvenic(nat->nat_ifnames[1], 4, ifs);
2872 	} else {
2873 		(void) strncpy(nat->nat_ifnames[1], nat->nat_ifnames[0],
2874 			       LIFNAMSIZ);
2875 		nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
2876 		nat->nat_ifps[1] = nat->nat_ifps[0];
2877 	}
2878 
2879 	nat->nat_next = ifs->ifs_nat_instances;
2880 	nat->nat_pnext = &ifs->ifs_nat_instances;
2881 	if (ifs->ifs_nat_instances)
2882 		ifs->ifs_nat_instances->nat_pnext = &nat->nat_next;
2883 	ifs->ifs_nat_instances = nat;
2884 
2885 	natp = &ifs->ifs_nat_table[0][hv1];
2886 	if (*natp)
2887 		(*natp)->nat_phnext[0] = &nat->nat_hnext[0];
2888 	nat->nat_phnext[0] = natp;
2889 	nat->nat_hnext[0] = *natp;
2890 	*natp = nat;
2891 	ifs->ifs_nat_stats.ns_bucketlen[0][hv1]++;
2892 
2893 	natp = &ifs->ifs_nat_table[1][hv2];
2894 	if (*natp)
2895 		(*natp)->nat_phnext[1] = &nat->nat_hnext[1];
2896 	nat->nat_phnext[1] = natp;
2897 	nat->nat_hnext[1] = *natp;
2898 	*natp = nat;
2899 	ifs->ifs_nat_stats.ns_bucketlen[1][hv2]++;
2900 
2901 	fr_setnatqueue(nat, rev, ifs);
2902 
2903 	ifs->ifs_nat_stats.ns_added++;
2904 	ifs->ifs_nat_stats.ns_inuse++;
2905 	return 0;
2906 }
2907 
2908 
2909 /* ------------------------------------------------------------------------ */
2910 /* Function:    nat_icmperrorlookup                                         */
2911 /* Returns:     nat_t* - point to matching NAT structure                    */
2912 /* Parameters:  fin(I) - pointer to packet information                      */
2913 /*              dir(I) - direction of packet (in/out)                       */
2914 /*                                                                          */
2915 /* Check if the ICMP error message is related to an existing TCP, UDP or    */
2916 /* ICMP query nat entry.  It is assumed that the packet is already of the   */
2917 /* the required length.                                                     */
2918 /* ------------------------------------------------------------------------ */
2919 nat_t *nat_icmperrorlookup(fin, dir)
2920 fr_info_t *fin;
2921 int dir;
2922 {
2923 	int flags = 0, minlen;
2924 	icmphdr_t *orgicmp;
2925 	tcphdr_t *tcp = NULL;
2926 	u_short data[2];
2927 	nat_t *nat;
2928 	ip_t *oip;
2929 	u_int p;
2930 
2931 	/*
2932 	 * Does it at least have the return (basic) IP header ?
2933 	 * Only a basic IP header (no options) should be with an ICMP error
2934 	 * header.  Also, if it's not an error type, then return.
2935 	 */
2936 	if ((fin->fin_hlen != sizeof(ip_t)) || !(fin->fin_flx & FI_ICMPERR))
2937 		return NULL;
2938 
2939 	/*
2940 	 * Check packet size
2941 	 */
2942 	oip = (ip_t *)((char *)fin->fin_dp + 8);
2943 	minlen = IP_HL(oip) << 2;
2944 	if ((minlen < sizeof(ip_t)) ||
2945 	    (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen))
2946 		return NULL;
2947 	/*
2948 	 * Is the buffer big enough for all of it ?  It's the size of the IP
2949 	 * header claimed in the encapsulated part which is of concern.  It
2950 	 * may be too big to be in this buffer but not so big that it's
2951 	 * outside the ICMP packet, leading to TCP deref's causing problems.
2952 	 * This is possible because we don't know how big oip_hl is when we
2953 	 * do the pullup early in fr_check() and thus can't gaurantee it is
2954 	 * all here now.
2955 	 */
2956 #ifdef  _KERNEL
2957 	{
2958 	mb_t *m;
2959 
2960 	m = fin->fin_m;
2961 # if defined(MENTAT)
2962 	if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > (char *)m->b_wptr)
2963 		return NULL;
2964 # else
2965 	if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
2966 	    (char *)fin->fin_ip + M_LEN(m))
2967 		return NULL;
2968 # endif
2969 	}
2970 #endif
2971 
2972 	if (fin->fin_daddr != oip->ip_src.s_addr)
2973 		return NULL;
2974 
2975 	p = oip->ip_p;
2976 	if (p == IPPROTO_TCP)
2977 		flags = IPN_TCP;
2978 	else if (p == IPPROTO_UDP)
2979 		flags = IPN_UDP;
2980 	else if (p == IPPROTO_ICMP) {
2981 		orgicmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2));
2982 
2983 		/* see if this is related to an ICMP query */
2984 		if (nat_icmpquerytype4(orgicmp->icmp_type)) {
2985 			data[0] = fin->fin_data[0];
2986 			data[1] = fin->fin_data[1];
2987 			fin->fin_data[0] = 0;
2988 			fin->fin_data[1] = orgicmp->icmp_id;
2989 
2990 			flags = IPN_ICMPERR|IPN_ICMPQUERY;
2991 			/*
2992 			 * NOTE : dir refers to the direction of the original
2993 			 *        ip packet. By definition the icmp error
2994 			 *        message flows in the opposite direction.
2995 			 */
2996 			if (dir == NAT_INBOUND)
2997 				nat = nat_inlookup(fin, flags, p, oip->ip_dst,
2998 						   oip->ip_src);
2999 			else
3000 				nat = nat_outlookup(fin, flags, p, oip->ip_dst,
3001 						    oip->ip_src);
3002 			fin->fin_data[0] = data[0];
3003 			fin->fin_data[1] = data[1];
3004 			return nat;
3005 		}
3006 	}
3007 
3008 	if (flags & IPN_TCPUDP) {
3009 		minlen += 8;		/* + 64bits of data to get ports */
3010 		if (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen)
3011 			return NULL;
3012 
3013 		data[0] = fin->fin_data[0];
3014 		data[1] = fin->fin_data[1];
3015 		tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2));
3016 		fin->fin_data[0] = ntohs(tcp->th_dport);
3017 		fin->fin_data[1] = ntohs(tcp->th_sport);
3018 
3019 		if (dir == NAT_INBOUND) {
3020 			nat = nat_inlookup(fin, flags, p, oip->ip_dst,
3021 					   oip->ip_src);
3022 		} else {
3023 			nat = nat_outlookup(fin, flags, p, oip->ip_dst,
3024 					    oip->ip_src);
3025 		}
3026 		fin->fin_data[0] = data[0];
3027 		fin->fin_data[1] = data[1];
3028 		return nat;
3029 	}
3030 	if (dir == NAT_INBOUND)
3031 		return nat_inlookup(fin, 0, p, oip->ip_dst, oip->ip_src);
3032 	else
3033 		return nat_outlookup(fin, 0, p, oip->ip_dst, oip->ip_src);
3034 }
3035 
3036 
3037 /* ------------------------------------------------------------------------ */
3038 /* Function:    nat_icmperror                                               */
3039 /* Returns:     nat_t* - point to matching NAT structure                    */
3040 /* Parameters:  fin(I)    - pointer to packet information                   */
3041 /*              nflags(I) - NAT flags for this packet                       */
3042 /*              dir(I)    - direction of packet (in/out)                    */
3043 /*                                                                          */
3044 /* Fix up an ICMP packet which is an error message for an existing NAT      */
3045 /* session.  This will correct both packet header data and checksums.       */
3046 /*                                                                          */
3047 /* This should *ONLY* be used for incoming ICMP error packets to make sure  */
3048 /* a NAT'd ICMP packet gets correctly recognised.                           */
3049 /* ------------------------------------------------------------------------ */
3050 nat_t *nat_icmperror(fin, nflags, dir)
3051 fr_info_t *fin;
3052 u_int *nflags;
3053 int dir;
3054 {
3055 	u_32_t sum1, sum2, sumd, psum1, psum2, psumd, sumd2;
3056 	struct in_addr in;
3057 	icmphdr_t *icmp, *orgicmp;
3058 	int dlen;
3059 	udphdr_t *udp;
3060 	tcphdr_t *tcp;
3061 	nat_t *nat;
3062 	ip_t *oip;
3063 	if ((fin->fin_flx & (FI_SHORT|FI_FRAGBODY)))
3064 		return NULL;
3065 
3066 	/*
3067 	 * nat_icmperrorlookup() looks up nat entry associated with the
3068 	 * offending IP packet and returns pointer to the entry, or NULL
3069 	 * if packet wasn't natted or for `defective' packets.
3070 	 */
3071 
3072 	if ((fin->fin_v != 4) || !(nat = nat_icmperrorlookup(fin, dir)))
3073 		return NULL;
3074 
3075 	sumd2 = 0;
3076 	*nflags = IPN_ICMPERR;
3077 	icmp = fin->fin_dp;
3078 	oip = (ip_t *)&icmp->icmp_ip;
3079 	udp = (udphdr_t *)((((char *)oip) + (IP_HL(oip) << 2)));
3080 	tcp = (tcphdr_t *)udp;
3081 	dlen = fin->fin_plen - ((char *)udp - (char *)fin->fin_ip);
3082 
3083 	/*
3084 	 * Need to adjust ICMP header to include the real IP#'s and
3085 	 * port #'s.  There are three steps required.
3086 	 *
3087 	 * Step 1
3088 	 * Fix the IP addresses in the offending IP packet and update
3089 	 * ip header checksum to compensate for the change.
3090 	 *
3091 	 * No update needed here for icmp_cksum because the ICMP checksum
3092 	 * is calculated over the complete ICMP packet, which includes the
3093 	 * changed oip IP addresses and oip->ip_sum.  These two changes
3094 	 * cancel each other out (if the delta for the IP address is x,
3095 	 * then the delta for ip_sum is minus x).
3096 	 */
3097 
3098 	if (oip->ip_dst.s_addr == nat->nat_oip.s_addr) {
3099 		sum1 = LONG_SUM(ntohl(oip->ip_src.s_addr));
3100 		in = nat->nat_inip;
3101 		oip->ip_src = in;
3102 	} else {
3103 		sum1 = LONG_SUM(ntohl(oip->ip_dst.s_addr));
3104 		in = nat->nat_outip;
3105 		oip->ip_dst = in;
3106 	}
3107 
3108 	sum2 = LONG_SUM(ntohl(in.s_addr));
3109 	CALC_SUMD(sum1, sum2, sumd);
3110 	fix_datacksum(&oip->ip_sum, sumd);
3111 
3112 	/*
3113 	 * Step 2
3114 	 * Perform other adjustments based on protocol of offending packet.
3115 	 */
3116 
3117 	switch (oip->ip_p) {
3118 		case IPPROTO_TCP :
3119 		case IPPROTO_UDP :
3120 
3121 			/*
3122 			* For offending TCP/UDP IP packets, translate the ports
3123 			* based on the NAT specification.
3124 			*
3125 			* Advance notice : Now it becomes complicated :-)
3126 			*
3127 			* Since the port and IP addresse fields are both part
3128 			* of the TCP/UDP checksum of the offending IP packet,
3129 			* we need to adjust that checksum as well.
3130 			*
3131 			* To further complicate things, the TCP/UDP checksum
3132 			* may not be present.  We must check to see if the
3133 			* length of the data portion is big enough to hold
3134 			* the checksum.  In the UDP case, a test to determine
3135 			* if the checksum is even set is also required.
3136 			*
3137 			* Any changes to an IP address, port or checksum within
3138 			* the ICMP packet requires a change to icmp_cksum.
3139 			*
3140 			* Be extremely careful here ... The change is dependent
3141 			* upon whether or not the TCP/UPD checksum is present.
3142 			*
3143 			* If TCP/UPD checksum is present, the icmp_cksum must
3144 			* compensate for checksum modification resulting from
3145 			* IP address change only.  Port change and resulting
3146 			* data checksum adjustments cancel each other out.
3147 			*
3148 			* If TCP/UDP checksum is not present, icmp_cksum must
3149 			* compensate for port change only.  The IP address
3150 			* change does not modify anything else in this case.
3151 			*/
3152 
3153 			psum1 = 0;
3154 			psum2 = 0;
3155 			psumd = 0;
3156 
3157 			if ((tcp->th_dport == nat->nat_oport) &&
3158 			    (tcp->th_sport != nat->nat_inport)) {
3159 
3160 				/*
3161 				 * Translate the source port.
3162 				 */
3163 
3164 				psum1 = ntohs(tcp->th_sport);
3165 				psum2 = ntohs(nat->nat_inport);
3166 				tcp->th_sport = nat->nat_inport;
3167 
3168 			} else if ((tcp->th_sport == nat->nat_oport) &&
3169 				    (tcp->th_dport != nat->nat_outport)) {
3170 
3171 				/*
3172 				 * Translate the destination port.
3173 				 */
3174 
3175 				psum1 = ntohs(tcp->th_dport);
3176 				psum2 = ntohs(nat->nat_outport);
3177 				tcp->th_dport = nat->nat_outport;
3178 			}
3179 
3180 			if ((oip->ip_p == IPPROTO_TCP) && (dlen >= 18)) {
3181 
3182 				/*
3183 				 * TCP checksum present.
3184 				 *
3185 				 * Adjust data checksum and icmp checksum to
3186 				 * compensate for any IP address change.
3187 				 */
3188 
3189 				sum1 = ntohs(tcp->th_sum);
3190 				fix_datacksum(&tcp->th_sum, sumd);
3191 				sum2 = ntohs(tcp->th_sum);
3192 				sumd2 = sumd << 1;
3193 				CALC_SUMD(sum1, sum2, sumd);
3194 				sumd2 += sumd;
3195 
3196 				/*
3197 				 * Also make data checksum adjustment to
3198 				 * compensate for any port change.
3199 				 */
3200 
3201 				if (psum1 != psum2) {
3202 					CALC_SUMD(psum1, psum2, psumd);
3203 					fix_datacksum(&tcp->th_sum, psumd);
3204 				}
3205 
3206 			} else if ((oip->ip_p == IPPROTO_UDP) &&
3207 				   (dlen >= 8) && (udp->uh_sum != 0)) {
3208 
3209 				/*
3210 				 * The UDP checksum is present and set.
3211 				 *
3212 				 * Adjust data checksum and icmp checksum to
3213 				 * compensate for any IP address change.
3214 				 */
3215 
3216 				sum1 = ntohs(udp->uh_sum);
3217 				fix_datacksum(&udp->uh_sum, sumd);
3218 				sum2 = ntohs(udp->uh_sum);
3219 				sumd2 = sumd << 1;
3220 				CALC_SUMD(sum1, sum2, sumd);
3221 				sumd2 += sumd;
3222 
3223 				/*
3224 				 * Also make data checksum adjustment to
3225 				 * compensate for any port change.
3226 				 */
3227 
3228 				if (psum1 != psum2) {
3229 					CALC_SUMD(psum1, psum2, psumd);
3230 					fix_datacksum(&udp->uh_sum, psumd);
3231 				}
3232 
3233 			} else {
3234 
3235 				/*
3236 				 * Data checksum was not present.
3237 				 *
3238 				 * Compensate for any port change.
3239 				 */
3240 
3241 				CALC_SUMD(psum2, psum1, psumd);
3242 				sumd2 += psumd;
3243 			}
3244 			break;
3245 
3246 		case IPPROTO_ICMP :
3247 
3248 			orgicmp = (icmphdr_t *)udp;
3249 
3250 			if ((nat->nat_dir == NAT_OUTBOUND) &&
3251 			    (orgicmp->icmp_id != nat->nat_inport) &&
3252 			    (dlen >= 8)) {
3253 
3254 				/*
3255 				 * Fix ICMP checksum (of the offening ICMP
3256 				 * query packet) to compensate the change
3257 				 * in the ICMP id of the offending ICMP
3258 				 * packet.
3259 				 *
3260 				 * Since you modify orgicmp->icmp_id with
3261 				 * a delta (say x) and you compensate that
3262 				 * in origicmp->icmp_cksum with a delta
3263 				 * minus x, you don't have to adjust the
3264 				 * overall icmp->icmp_cksum
3265 				 */
3266 
3267 				sum1 = ntohs(orgicmp->icmp_id);
3268 				sum2 = ntohs(nat->nat_inport);
3269 				CALC_SUMD(sum1, sum2, sumd);
3270 				orgicmp->icmp_id = nat->nat_inport;
3271 				fix_datacksum(&orgicmp->icmp_cksum, sumd);
3272 
3273 			} /* nat_dir can't be NAT_INBOUND for icmp queries */
3274 
3275 			break;
3276 
3277 		default :
3278 
3279 			break;
3280 
3281 	} /* switch (oip->ip_p) */
3282 
3283 	/*
3284 	 * Step 3
3285 	 * Make the adjustments to icmp checksum.
3286 	 */
3287 
3288 	if (sumd2 != 0) {
3289 		sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3290 		sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3291 		fix_incksum(&icmp->icmp_cksum, sumd2);
3292 	}
3293 	return nat;
3294 }
3295 
3296 
3297 /*
3298  * NB: these lookups don't lock access to the list, it assumed that it has
3299  * already been done!
3300  */
3301 
3302 /* ------------------------------------------------------------------------ */
3303 /* Function:    nat_inlookup                                                */
3304 /* Returns:     nat_t* - NULL == no match,                                  */
3305 /*                       else pointer to matching NAT entry                 */
3306 /* Parameters:  fin(I)    - pointer to packet information                   */
3307 /*              flags(I)  - NAT flags for this packet                       */
3308 /*              p(I)      - protocol for this packet                        */
3309 /*              src(I)    - source IP address                               */
3310 /*              mapdst(I) - destination IP address                          */
3311 /*                                                                          */
3312 /* Lookup a nat entry based on the mapped destination ip address/port and   */
3313 /* real source address/port.  We use this lookup when receiving a packet,   */
3314 /* we're looking for a table entry, based on the destination address.       */
3315 /*                                                                          */
3316 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY.         */
3317 /*                                                                          */
3318 /* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN      */
3319 /*       THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags.             */
3320 /*                                                                          */
3321 /* flags   -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if   */
3322 /*            the packet is of said protocol                                */
3323 /* ------------------------------------------------------------------------ */
3324 nat_t *nat_inlookup(fin, flags, p, src, mapdst)
3325 fr_info_t *fin;
3326 u_int flags, p;
3327 struct in_addr src , mapdst;
3328 {
3329 	u_short sport, dport;
3330 	ipnat_t *ipn;
3331 	u_int sflags;
3332 	nat_t *nat;
3333 	int nflags;
3334 	u_32_t dst;
3335 	void *ifp;
3336 	u_int hv;
3337 	ipf_stack_t *ifs = fin->fin_ifs;
3338 
3339 	if (fin != NULL)
3340 		ifp = fin->fin_ifp;
3341 	else
3342 		ifp = NULL;
3343 	sport = 0;
3344 	dport = 0;
3345 	dst = mapdst.s_addr;
3346 	sflags = flags & NAT_TCPUDPICMP;
3347 
3348 	switch (p)
3349 	{
3350 	case IPPROTO_TCP :
3351 	case IPPROTO_UDP :
3352 		sport = htons(fin->fin_data[0]);
3353 		dport = htons(fin->fin_data[1]);
3354 		break;
3355 	case IPPROTO_ICMP :
3356 		if (flags & IPN_ICMPERR)
3357 			sport = fin->fin_data[1];
3358 		else
3359 			dport = fin->fin_data[1];
3360 		break;
3361 	default :
3362 		break;
3363 	}
3364 
3365 
3366 	if ((flags & SI_WILDP) != 0)
3367 		goto find_in_wild_ports;
3368 
3369 	hv = NAT_HASH_FN(dst, dport, 0xffffffff);
3370 	hv = NAT_HASH_FN(src.s_addr, hv + sport, ifs->ifs_ipf_nattable_sz);
3371 	nat = ifs->ifs_nat_table[1][hv];
3372 	for (; nat; nat = nat->nat_hnext[1]) {
3373 		if (nat->nat_v != 4)
3374 			continue;
3375 
3376 		if (nat->nat_ifps[0] != NULL) {
3377 			if ((ifp != NULL) && (ifp != nat->nat_ifps[0]))
3378 				continue;
3379 		} else if (ifp != NULL)
3380 			nat->nat_ifps[0] = ifp;
3381 
3382 		nflags = nat->nat_flags;
3383 
3384 		if (nat->nat_oip.s_addr == src.s_addr &&
3385 		    nat->nat_outip.s_addr == dst &&
3386 		    (((p == 0) &&
3387 		      (sflags == (nat->nat_flags & IPN_TCPUDPICMP)))
3388 		     || (p == nat->nat_p))) {
3389 			switch (p)
3390 			{
3391 #if 0
3392 			case IPPROTO_GRE :
3393 				if (nat->nat_call[1] != fin->fin_data[0])
3394 					continue;
3395 				break;
3396 #endif
3397 			case IPPROTO_ICMP :
3398 				if ((flags & IPN_ICMPERR) != 0) {
3399 					if (nat->nat_outport != sport)
3400 						continue;
3401 				} else {
3402 					if (nat->nat_outport != dport)
3403 						continue;
3404 				}
3405 				break;
3406 			case IPPROTO_TCP :
3407 			case IPPROTO_UDP :
3408 				if (nat->nat_oport != sport)
3409 					continue;
3410 				if (nat->nat_outport != dport)
3411 					continue;
3412 				break;
3413 			default :
3414 				break;
3415 			}
3416 
3417 			ipn = nat->nat_ptr;
3418 			if ((ipn != NULL) && (nat->nat_aps != NULL))
3419 				if (appr_match(fin, nat) != 0)
3420 					continue;
3421 			return nat;
3422 		}
3423 	}
3424 
3425 	/*
3426 	 * So if we didn't find it but there are wildcard members in the hash
3427 	 * table, go back and look for them.  We do this search and update here
3428 	 * because it is modifying the NAT table and we want to do this only
3429 	 * for the first packet that matches.  The exception, of course, is
3430 	 * for "dummy" (FI_IGNORE) lookups.
3431 	 */
3432 find_in_wild_ports:
3433 	if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH))
3434 		return NULL;
3435 	if (ifs->ifs_nat_stats.ns_wilds == 0)
3436 		return NULL;
3437 
3438 	RWLOCK_EXIT(&ifs->ifs_ipf_nat);
3439 
3440 	hv = NAT_HASH_FN(dst, 0, 0xffffffff);
3441 	hv = NAT_HASH_FN(src.s_addr, hv, ifs->ifs_ipf_nattable_sz);
3442 
3443 	WRITE_ENTER(&ifs->ifs_ipf_nat);
3444 
3445 	nat = ifs->ifs_nat_table[1][hv];
3446 	for (; nat; nat = nat->nat_hnext[1]) {
3447 		if (nat->nat_v != 4)
3448 			continue;
3449 
3450 		if (nat->nat_ifps[0] != NULL) {
3451 			if ((ifp != NULL) && (ifp != nat->nat_ifps[0]))
3452 				continue;
3453 		} else if (ifp != NULL)
3454 			nat->nat_ifps[0] = ifp;
3455 
3456 		if (nat->nat_p != fin->fin_p)
3457 			continue;
3458 		if (nat->nat_oip.s_addr != src.s_addr ||
3459 		    nat->nat_outip.s_addr != dst)
3460 			continue;
3461 
3462 		nflags = nat->nat_flags;
3463 		if (!(nflags & (NAT_TCPUDP|SI_WILDP)))
3464 			continue;
3465 
3466 		if (nat_wildok(nat, (int)sport, (int)dport, nflags,
3467 			       NAT_INBOUND) == 1) {
3468 			if ((fin->fin_flx & FI_IGNORE) != 0)
3469 				break;
3470 			if ((nflags & SI_CLONE) != 0) {
3471 				nat = fr_natclone(fin, nat);
3472 				if (nat == NULL)
3473 					break;
3474 			} else {
3475 				MUTEX_ENTER(&ifs->ifs_ipf_nat_new);
3476 				ifs->ifs_nat_stats.ns_wilds--;
3477 				MUTEX_EXIT(&ifs->ifs_ipf_nat_new);
3478 			}
3479 			nat->nat_oport = sport;
3480 			nat->nat_outport = dport;
3481 			nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT);
3482 			nat_tabmove(nat, ifs);
3483 			break;
3484 		}
3485 	}
3486 
3487 	MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat);
3488 
3489 	return nat;
3490 }
3491 
3492 
3493 /* ------------------------------------------------------------------------ */
3494 /* Function:    nat_tabmove                                                 */
3495 /* Returns:     Nil                                                         */
3496 /* Parameters:  nat(I) - pointer to NAT structure                           */
3497 /* Write Lock:  ipf_nat                                                     */
3498 /*                                                                          */
3499 /* This function is only called for TCP/UDP NAT table entries where the     */
3500 /* original was placed in the table without hashing on the ports and we now */
3501 /* want to include hashing on port numbers.                                 */
3502 /* ------------------------------------------------------------------------ */
3503 static void nat_tabmove(nat, ifs)
3504 nat_t *nat;
3505 ipf_stack_t *ifs;
3506 {
3507 	nat_t **natp;
3508 	u_int hv;
3509 
3510 	if (nat->nat_flags & SI_CLONE)
3511 		return;
3512 
3513 	/*
3514 	 * Remove the NAT entry from the old location
3515 	 */
3516 	if (nat->nat_hnext[0])
3517 		nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
3518 	*nat->nat_phnext[0] = nat->nat_hnext[0];
3519 	ifs->ifs_nat_stats.ns_bucketlen[0][nat->nat_hv[0]]--;
3520 
3521 	if (nat->nat_hnext[1])
3522 		nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
3523 	*nat->nat_phnext[1] = nat->nat_hnext[1];
3524 	ifs->ifs_nat_stats.ns_bucketlen[1][nat->nat_hv[1]]--;
3525 
3526 	/*
3527 	 * Add into the NAT table in the new position
3528 	 */
3529 	hv = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport, 0xffffffff);
3530 	hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + nat->nat_oport,
3531 			 ifs->ifs_ipf_nattable_sz);
3532 	nat->nat_hv[0] = hv;
3533 	natp = &ifs->ifs_nat_table[0][hv];
3534 	if (*natp)
3535 		(*natp)->nat_phnext[0] = &nat->nat_hnext[0];
3536 	nat->nat_phnext[0] = natp;
3537 	nat->nat_hnext[0] = *natp;
3538 	*natp = nat;
3539 	ifs->ifs_nat_stats.ns_bucketlen[0][hv]++;
3540 
3541 	hv = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport, 0xffffffff);
3542 	hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + nat->nat_oport,
3543 			 ifs->ifs_ipf_nattable_sz);
3544 	nat->nat_hv[1] = hv;
3545 	natp = &ifs->ifs_nat_table[1][hv];
3546 	if (*natp)
3547 		(*natp)->nat_phnext[1] = &nat->nat_hnext[1];
3548 	nat->nat_phnext[1] = natp;
3549 	nat->nat_hnext[1] = *natp;
3550 	*natp = nat;
3551 	ifs->ifs_nat_stats.ns_bucketlen[1][hv]++;
3552 }
3553 
3554 
3555 /* ------------------------------------------------------------------------ */
3556 /* Function:    nat_outlookup                                               */
3557 /* Returns:     nat_t* - NULL == no match,                                  */
3558 /*                       else pointer to matching NAT entry                 */
3559 /* Parameters:  fin(I)   - pointer to packet information                    */
3560 /*              flags(I) - NAT flags for this packet                        */
3561 /*              p(I)     - protocol for this packet                         */
3562 /*              src(I)   - source IP address                                */
3563 /*              dst(I)   - destination IP address                           */
3564 /*              rw(I)    - 1 == write lock on ipf_nat held, 0 == read lock. */
3565 /*                                                                          */
3566 /* Lookup a nat entry based on the source 'real' ip address/port and        */
3567 /* destination address/port.  We use this lookup when sending a packet out, */
3568 /* we're looking for a table entry, based on the source address.            */
3569 /*                                                                          */
3570 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY.         */
3571 /*                                                                          */
3572 /* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN      */
3573 /*       THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags.             */
3574 /*                                                                          */
3575 /* flags   -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if   */
3576 /*            the packet is of said protocol                                */
3577 /* ------------------------------------------------------------------------ */
3578 nat_t *nat_outlookup(fin, flags, p, src, dst)
3579 fr_info_t *fin;
3580 u_int flags, p;
3581 struct in_addr src , dst;
3582 {
3583 	u_short sport, dport;
3584 	u_int sflags;
3585 	ipnat_t *ipn;
3586 	u_32_t srcip;
3587 	nat_t *nat;
3588 	int nflags;
3589 	void *ifp;
3590 	u_int hv;
3591 	ipf_stack_t *ifs = fin->fin_ifs;
3592 
3593 	ifp = fin->fin_ifp;
3594 
3595 	srcip = src.s_addr;
3596 	sflags = flags & IPN_TCPUDPICMP;
3597 	sport = 0;
3598 	dport = 0;
3599 
3600 	switch (p)
3601 	{
3602 	case IPPROTO_TCP :
3603 	case IPPROTO_UDP :
3604 		sport = htons(fin->fin_data[0]);
3605 		dport = htons(fin->fin_data[1]);
3606 		break;
3607 	case IPPROTO_ICMP :
3608 		if (flags & IPN_ICMPERR)
3609 			sport = fin->fin_data[1];
3610 		else
3611 			dport = fin->fin_data[1];
3612 		break;
3613 	default :
3614 		break;
3615 	}
3616 
3617 	if ((flags & SI_WILDP) != 0)
3618 		goto find_out_wild_ports;
3619 
3620 	hv = NAT_HASH_FN(srcip, sport, 0xffffffff);
3621 	hv = NAT_HASH_FN(dst.s_addr, hv + dport, ifs->ifs_ipf_nattable_sz);
3622 	nat = ifs->ifs_nat_table[0][hv];
3623 	for (; nat; nat = nat->nat_hnext[0]) {
3624 		if (nat->nat_v != 4)
3625 			continue;
3626 
3627 		if (nat->nat_ifps[1] != NULL) {
3628 			if ((ifp != NULL) && (ifp != nat->nat_ifps[1]))
3629 				continue;
3630 		} else if (ifp != NULL)
3631 			nat->nat_ifps[1] = ifp;
3632 
3633 		nflags = nat->nat_flags;
3634 
3635 		if (nat->nat_inip.s_addr == srcip &&
3636 		    nat->nat_oip.s_addr == dst.s_addr &&
3637 		    (((p == 0) && (sflags == (nflags & NAT_TCPUDPICMP)))
3638 		     || (p == nat->nat_p))) {
3639 			switch (p)
3640 			{
3641 #if 0
3642 			case IPPROTO_GRE :
3643 				if (nat->nat_call[1] != fin->fin_data[0])
3644 					continue;
3645 				break;
3646 #endif
3647 			case IPPROTO_TCP :
3648 			case IPPROTO_UDP :
3649 				if (nat->nat_oport != dport)
3650 					continue;
3651 				if (nat->nat_inport != sport)
3652 					continue;
3653 				break;
3654 			default :
3655 				break;
3656 			}
3657 
3658 			ipn = nat->nat_ptr;
3659 			if ((ipn != NULL) && (nat->nat_aps != NULL))
3660 				if (appr_match(fin, nat) != 0)
3661 					continue;
3662 			return nat;
3663 		}
3664 	}
3665 
3666 	/*
3667 	 * So if we didn't find it but there are wildcard members in the hash
3668 	 * table, go back and look for them.  We do this search and update here
3669 	 * because it is modifying the NAT table and we want to do this only
3670 	 * for the first packet that matches.  The exception, of course, is
3671 	 * for "dummy" (FI_IGNORE) lookups.
3672 	 */
3673 find_out_wild_ports:
3674 	if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH))
3675 		return NULL;
3676 	if (ifs->ifs_nat_stats.ns_wilds == 0)
3677 		return NULL;
3678 
3679 	RWLOCK_EXIT(&ifs->ifs_ipf_nat);
3680 
3681 	hv = NAT_HASH_FN(srcip, 0, 0xffffffff);
3682 	hv = NAT_HASH_FN(dst.s_addr, hv, ifs->ifs_ipf_nattable_sz);
3683 
3684 	WRITE_ENTER(&ifs->ifs_ipf_nat);
3685 
3686 	nat = ifs->ifs_nat_table[0][hv];
3687 	for (; nat; nat = nat->nat_hnext[0]) {
3688 		if (nat->nat_v != 4)
3689 			continue;
3690 
3691 		if (nat->nat_ifps[1] != NULL) {
3692 			if ((ifp != NULL) && (ifp != nat->nat_ifps[1]))
3693 				continue;
3694 		} else if (ifp != NULL)
3695 			nat->nat_ifps[1] = ifp;
3696 
3697 		if (nat->nat_p != fin->fin_p)
3698 			continue;
3699 		if ((nat->nat_inip.s_addr != srcip) ||
3700 		    (nat->nat_oip.s_addr != dst.s_addr))
3701 			continue;
3702 
3703 		nflags = nat->nat_flags;
3704 		if (!(nflags & (NAT_TCPUDP|SI_WILDP)))
3705 			continue;
3706 
3707 		if (nat_wildok(nat, (int)sport, (int)dport, nflags,
3708 			       NAT_OUTBOUND) == 1) {
3709 			if ((fin->fin_flx & FI_IGNORE) != 0)
3710 				break;
3711 			if ((nflags & SI_CLONE) != 0) {
3712 				nat = fr_natclone(fin, nat);
3713 				if (nat == NULL)
3714 					break;
3715 			} else {
3716 				MUTEX_ENTER(&ifs->ifs_ipf_nat_new);
3717 				ifs->ifs_nat_stats.ns_wilds--;
3718 				MUTEX_EXIT(&ifs->ifs_ipf_nat_new);
3719 			}
3720 			nat->nat_inport = sport;
3721 			nat->nat_oport = dport;
3722 			if (nat->nat_outport == 0)
3723 				nat->nat_outport = sport;
3724 			nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT);
3725 			nat_tabmove(nat, ifs);
3726 			break;
3727 		}
3728 	}
3729 
3730 	MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat);
3731 
3732 	return nat;
3733 }
3734 
3735 
3736 /* ------------------------------------------------------------------------ */
3737 /* Function:    nat_lookupredir                                             */
3738 /* Returns:     nat_t* - NULL == no match,                                  */
3739 /*                       else pointer to matching NAT entry                 */
3740 /* Parameters:  np(I) - pointer to description of packet to find NAT table  */
3741 /*                      entry for.                                          */
3742 /*                                                                          */
3743 /* Lookup the NAT tables to search for a matching redirect                  */
3744 /* ------------------------------------------------------------------------ */
3745 nat_t *nat_lookupredir(np, ifs)
3746 natlookup_t *np;
3747 ipf_stack_t *ifs;
3748 {
3749 	fr_info_t fi;
3750 	nat_t *nat;
3751 
3752 	bzero((char *)&fi, sizeof(fi));
3753 	if (np->nl_flags & IPN_IN) {
3754 		fi.fin_data[0] = ntohs(np->nl_realport);
3755 		fi.fin_data[1] = ntohs(np->nl_outport);
3756 	} else {
3757 		fi.fin_data[0] = ntohs(np->nl_inport);
3758 		fi.fin_data[1] = ntohs(np->nl_outport);
3759 	}
3760 	if (np->nl_flags & IPN_TCP)
3761 		fi.fin_p = IPPROTO_TCP;
3762 	else if (np->nl_flags & IPN_UDP)
3763 		fi.fin_p = IPPROTO_UDP;
3764 	else if (np->nl_flags & (IPN_ICMPERR|IPN_ICMPQUERY))
3765 		fi.fin_p = IPPROTO_ICMP;
3766 
3767 	fi.fin_ifs = ifs;
3768 	/*
3769 	 * We can do two sorts of lookups:
3770 	 * - IPN_IN: we have the `real' and `out' address, look for `in'.
3771 	 * - default: we have the `in' and `out' address, look for `real'.
3772 	 */
3773 	if (np->nl_flags & IPN_IN) {
3774 		if ((nat = nat_inlookup(&fi, np->nl_flags, fi.fin_p,
3775 					np->nl_realip, np->nl_outip))) {
3776 			np->nl_inip = nat->nat_inip;
3777 			np->nl_inport = nat->nat_inport;
3778 		}
3779 	} else {
3780 		/*
3781 		 * If nl_inip is non null, this is a lookup based on the real
3782 		 * ip address. Else, we use the fake.
3783 		 */
3784 		if ((nat = nat_outlookup(&fi, np->nl_flags, fi.fin_p,
3785 					 np->nl_inip, np->nl_outip))) {
3786 
3787 			if ((np->nl_flags & IPN_FINDFORWARD) != 0) {
3788 				fr_info_t fin;
3789 				bzero((char *)&fin, sizeof(fin));
3790 				fin.fin_p = nat->nat_p;
3791 				fin.fin_data[0] = ntohs(nat->nat_outport);
3792 				fin.fin_data[1] = ntohs(nat->nat_oport);
3793 				fin.fin_ifs = ifs;
3794 				if (nat_inlookup(&fin, np->nl_flags, fin.fin_p,
3795 						 nat->nat_outip,
3796 						 nat->nat_oip) != NULL) {
3797 					np->nl_flags &= ~IPN_FINDFORWARD;
3798 				}
3799 			}
3800 
3801 			np->nl_realip = nat->nat_outip;
3802 			np->nl_realport = nat->nat_outport;
3803 		}
3804  	}
3805 
3806 	return nat;
3807 }
3808 
3809 
3810 /* ------------------------------------------------------------------------ */
3811 /* Function:    nat_match                                                   */
3812 /* Returns:     int - 0 == no match, 1 == match                             */
3813 /* Parameters:  fin(I)   - pointer to packet information                    */
3814 /*              np(I)    - pointer to NAT rule                              */
3815 /*                                                                          */
3816 /* Pull the matching of a packet against a NAT rule out of that complex     */
3817 /* loop inside fr_checknatin() and lay it out properly in its own function. */
3818 /* ------------------------------------------------------------------------ */
3819 static int nat_match(fin, np)
3820 fr_info_t *fin;
3821 ipnat_t *np;
3822 {
3823 	frtuc_t *ft;
3824 
3825 	if (fin->fin_v != 4)
3826 		return 0;
3827 
3828 	if (np->in_p && fin->fin_p != np->in_p)
3829 		return 0;
3830 
3831 	if (fin->fin_out) {
3832 		if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK)))
3833 			return 0;
3834 		if (((fin->fin_fi.fi_saddr & np->in_inmsk) != np->in_inip)
3835 		    ^ ((np->in_flags & IPN_NOTSRC) != 0))
3836 			return 0;
3837 		if (((fin->fin_fi.fi_daddr & np->in_srcmsk) != np->in_srcip)
3838 		    ^ ((np->in_flags & IPN_NOTDST) != 0))
3839 			return 0;
3840 	} else {
3841 		if (!(np->in_redir & NAT_REDIRECT))
3842 			return 0;
3843 		if (((fin->fin_fi.fi_saddr & np->in_srcmsk) != np->in_srcip)
3844 		    ^ ((np->in_flags & IPN_NOTSRC) != 0))
3845 			return 0;
3846 		if (((fin->fin_fi.fi_daddr & np->in_outmsk) != np->in_outip)
3847 		    ^ ((np->in_flags & IPN_NOTDST) != 0))
3848 			return 0;
3849 	}
3850 
3851 	ft = &np->in_tuc;
3852 	if (!(fin->fin_flx & FI_TCPUDP) ||
3853 	    (fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) {
3854 		if (ft->ftu_scmp || ft->ftu_dcmp)
3855 			return 0;
3856 		return 1;
3857 	}
3858 
3859 	return fr_tcpudpchk(fin, ft);
3860 }
3861 
3862 
3863 /* ------------------------------------------------------------------------ */
3864 /* Function:    nat_update                                                  */
3865 /* Returns:     Nil                                                         */
3866 /* Parameters:	fin(I) - pointer to packet information			    */
3867 /*		nat(I) - pointer to NAT structure			    */
3868 /*              np(I)     - pointer to NAT rule                             */
3869 /* Locks:	nat_lock						    */
3870 /*                                                                          */
3871 /* Updates the lifetime of a NAT table entry for non-TCP packets.  Must be  */
3872 /* called with fin_rev updated - i.e. after calling nat_proto().            */
3873 /* ------------------------------------------------------------------------ */
3874 void nat_update(fin, nat, np)
3875 fr_info_t *fin;
3876 nat_t *nat;
3877 ipnat_t *np;
3878 {
3879 	ipftq_t *ifq, *ifq2;
3880 	ipftqent_t *tqe;
3881 	ipf_stack_t *ifs = fin->fin_ifs;
3882 
3883 	tqe = &nat->nat_tqe;
3884 	ifq = tqe->tqe_ifq;
3885 
3886 	/*
3887 	 * We allow over-riding of NAT timeouts from NAT rules, even for
3888 	 * TCP, however, if it is TCP and there is no rule timeout set,
3889 	 * then do not update the timeout here.
3890 	 */
3891 	if (np != NULL)
3892 		ifq2 = np->in_tqehead[fin->fin_rev];
3893 	else
3894 		ifq2 = NULL;
3895 
3896 	if (nat->nat_p == IPPROTO_TCP && ifq2 == NULL) {
3897 		(void) fr_tcp_age(&nat->nat_tqe, fin, ifs->ifs_nat_tqb, 0);
3898 	} else {
3899 		if (ifq2 == NULL) {
3900 			if (nat->nat_p == IPPROTO_UDP)
3901 				ifq2 = &ifs->ifs_nat_udptq;
3902 			else if (nat->nat_p == IPPROTO_ICMP)
3903 				ifq2 = &ifs->ifs_nat_icmptq;
3904 			else
3905 				ifq2 = &ifs->ifs_nat_iptq;
3906 		}
3907 
3908 		fr_movequeue(tqe, ifq, ifq2, ifs);
3909 	}
3910 }
3911 
3912 
3913 /* ------------------------------------------------------------------------ */
3914 /* Function:    fr_checknatout                                              */
3915 /* Returns:     int - -1 == packet failed NAT checks so block it,           */
3916 /*                     0 == no packet translation occurred,                 */
3917 /*                     1 == packet was successfully translated.             */
3918 /* Parameters:  fin(I)   - pointer to packet information                    */
3919 /*              passp(I) - pointer to filtering result flags                */
3920 /*                                                                          */
3921 /* Check to see if an outcoming packet should be changed.  ICMP packets are */
3922 /* first checked to see if they match an existing entry (if an error),      */
3923 /* otherwise a search of the current NAT table is made.  If neither results */
3924 /* in a match then a search for a matching NAT rule is made.  Create a new  */
3925 /* NAT entry if a we matched a NAT rule.  Lastly, actually change the       */
3926 /* packet header(s) as required.                                            */
3927 /* ------------------------------------------------------------------------ */
3928 int fr_checknatout(fin, passp)
3929 fr_info_t *fin;
3930 u_32_t *passp;
3931 {
3932 	ipnat_t *np = NULL, *npnext;
3933 	struct ifnet *ifp, *sifp;
3934 	icmphdr_t *icmp = NULL;
3935 	tcphdr_t *tcp = NULL;
3936 	int rval, natfailed;
3937 	u_int nflags = 0;
3938 	u_32_t ipa, iph;
3939 	int natadd = 1;
3940 	frentry_t *fr;
3941 	nat_t *nat;
3942 	ipf_stack_t *ifs = fin->fin_ifs;
3943 
3944 	if (ifs->ifs_fr_nat_lock != 0)
3945 		return 0;
3946 	if (ifs->ifs_nat_stats.ns_rules == 0 && ifs->ifs_nat_instances == NULL)
3947 		return 0;
3948 
3949 	natfailed = 0;
3950 	fr = fin->fin_fr;
3951 	sifp = fin->fin_ifp;
3952 	if ((fr != NULL) && !(fr->fr_flags & FR_DUP) &&
3953 	    fr->fr_tifs[fin->fin_rev].fd_ifp &&
3954 	    fr->fr_tifs[fin->fin_rev].fd_ifp != (void *)-1)
3955 		fin->fin_ifp = fr->fr_tifs[fin->fin_rev].fd_ifp;
3956 	ifp = fin->fin_ifp;
3957 
3958 	if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
3959 		switch (fin->fin_p)
3960 		{
3961 		case IPPROTO_TCP :
3962 			nflags = IPN_TCP;
3963 			break;
3964 		case IPPROTO_UDP :
3965 			nflags = IPN_UDP;
3966 			break;
3967 		case IPPROTO_ICMP :
3968 			icmp = fin->fin_dp;
3969 
3970 			/*
3971 			 * This is an incoming packet, so the destination is
3972 			 * the icmp_id and the source port equals 0
3973 			 */
3974 			if (nat_icmpquerytype4(icmp->icmp_type))
3975 				nflags = IPN_ICMPQUERY;
3976 			break;
3977 		default :
3978 			break;
3979 		}
3980 
3981 		if ((nflags & IPN_TCPUDP))
3982 			tcp = fin->fin_dp;
3983 	}
3984 
3985 	ipa = fin->fin_saddr;
3986 
3987 	READ_ENTER(&ifs->ifs_ipf_nat);
3988 
3989 	if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
3990 	    (nat = nat_icmperror(fin, &nflags, NAT_OUTBOUND)))
3991 		/*EMPTY*/;
3992 	else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin)))
3993 		natadd = 0;
3994 	else if ((nat = nat_outlookup(fin, nflags|NAT_SEARCH, (u_int)fin->fin_p,
3995 				      fin->fin_src, fin->fin_dst))) {
3996 		nflags = nat->nat_flags;
3997 	} else {
3998 		u_32_t hv, msk, nmsk;
3999 
4000 		/*
4001 		 * There is no current entry in the nat table for this packet.
4002 		 *
4003 		 * If the packet is a fragment, but not the first fragment,
4004 		 * then don't do anything.  Otherwise, if there is a matching
4005 		 * nat rule, try to create a new nat entry.
4006 		 */
4007 		if ((fin->fin_off != 0) && (fin->fin_flx & FI_TCPUDP))
4008 			goto nonatfrag;
4009 
4010 		msk = 0xffffffff;
4011 		nmsk = ifs->ifs_nat_masks;
4012 maskloop:
4013 		iph = ipa & htonl(msk);
4014 		hv = NAT_HASH_FN(iph, 0, ifs->ifs_ipf_natrules_sz);
4015 		for (np = ifs->ifs_nat_rules[hv]; np; np = npnext) {
4016 			npnext = np->in_mnext;
4017 			if ((np->in_ifps[1] && (np->in_ifps[1] != ifp)))
4018 				continue;
4019 			if (np->in_v != fin->fin_v)
4020 				continue;
4021 			if (np->in_p && (np->in_p != fin->fin_p))
4022 				continue;
4023 			if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags))
4024 				continue;
4025 			if (np->in_flags & IPN_FILTER) {
4026 				if (!nat_match(fin, np))
4027 					continue;
4028 			} else if ((ipa & np->in_inmsk) != np->in_inip)
4029 				continue;
4030 
4031 			if ((fr != NULL) &&
4032 			    !fr_matchtag(&np->in_tag, &fr->fr_nattag))
4033 				continue;
4034 
4035 			if (*np->in_plabel != '\0') {
4036 				if (((np->in_flags & IPN_FILTER) == 0) &&
4037 				    (np->in_dport != tcp->th_dport))
4038 					continue;
4039 				if (appr_ok(fin, tcp, np) == 0)
4040 					continue;
4041 			}
4042 
4043 			ATOMIC_INC32(np->in_use);
4044 			RWLOCK_EXIT(&ifs->ifs_ipf_nat);
4045 			WRITE_ENTER(&ifs->ifs_ipf_nat);
4046 			nat = nat_new(fin, np, NULL, nflags, NAT_OUTBOUND);
4047 			if (nat != NULL) {
4048 				np->in_use--;
4049 				np->in_hits++;
4050 				MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat);
4051 				break;
4052 			}
4053 			natfailed = -1;
4054 			npnext = np->in_mnext;
4055 			fr_ipnatderef(&np, ifs);
4056 			MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat);
4057 		}
4058 		if ((np == NULL) && (nmsk != 0)) {
4059 			while (nmsk) {
4060 				msk <<= 1;
4061 				if (nmsk & 0x80000000)
4062 					break;
4063 				nmsk <<= 1;
4064 			}
4065 			if (nmsk != 0) {
4066 				nmsk <<= 1;
4067 				goto maskloop;
4068 			}
4069 		}
4070 	}
4071 
4072 nonatfrag:
4073 	if (nat != NULL) {
4074 		rval = fr_natout(fin, nat, natadd, nflags);
4075 		if (rval == 1) {
4076 			MUTEX_ENTER(&nat->nat_lock);
4077 			nat_update(fin, nat, nat->nat_ptr);
4078 			nat->nat_bytes[1] += fin->fin_plen;
4079 			nat->nat_pkts[1]++;
4080 			nat->nat_ref++;
4081 			MUTEX_EXIT(&nat->nat_lock);
4082 			nat->nat_touched = ifs->ifs_fr_ticks;
4083 			fin->fin_nat = nat;
4084 		}
4085 	} else
4086 		rval = natfailed;
4087 	RWLOCK_EXIT(&ifs->ifs_ipf_nat);
4088 
4089 	if (rval == -1) {
4090 		if (passp != NULL)
4091 			*passp = FR_BLOCK;
4092 		fin->fin_flx |= FI_BADNAT;
4093 	}
4094 	fin->fin_ifp = sifp;
4095 	return rval;
4096 }
4097 
4098 /* ------------------------------------------------------------------------ */
4099 /* Function:    fr_natout                                                   */
4100 /* Returns:     int - -1 == packet failed NAT checks so block it,           */
4101 /*                     1 == packet was successfully translated.             */
4102 /* Parameters:  fin(I)    - pointer to packet information                   */
4103 /*              nat(I)    - pointer to NAT structure                        */
4104 /*              natadd(I) - flag indicating if it is safe to add frag cache */
4105 /*              nflags(I) - NAT flags set for this packet                   */
4106 /*                                                                          */
4107 /* Translate a packet coming "out" on an interface.                         */
4108 /* ------------------------------------------------------------------------ */
4109 int fr_natout(fin, nat, natadd, nflags)
4110 fr_info_t *fin;
4111 nat_t *nat;
4112 int natadd;
4113 u_32_t nflags;
4114 {
4115 	icmphdr_t *icmp;
4116 	u_short *csump;
4117 	u_32_t sumd;
4118 	tcphdr_t *tcp;
4119 	ipnat_t *np;
4120 	int i;
4121 	ipf_stack_t *ifs = fin->fin_ifs;
4122 
4123 	if (fin->fin_v == 6) {
4124 #ifdef	USE_INET6
4125 		return fr_nat6out(fin, nat, natadd, nflags);
4126 #else
4127 		return NULL;
4128 #endif
4129 	}
4130 
4131 #if SOLARIS && defined(_KERNEL)
4132 	net_handle_t net_data_p = ifs->ifs_ipf_ipv4;
4133 #endif
4134 
4135 	tcp = NULL;
4136 	icmp = NULL;
4137 	csump = NULL;
4138 	np = nat->nat_ptr;
4139 
4140 	if ((natadd != 0) && (fin->fin_flx & FI_FRAG))
4141 		(void) fr_nat_newfrag(fin, 0, nat);
4142 
4143 	/*
4144 	 * Fix up checksums, not by recalculating them, but
4145 	 * simply computing adjustments.
4146 	 * This is only done for STREAMS based IP implementations where the
4147 	 * checksum has already been calculated by IP.  In all other cases,
4148 	 * IPFilter is called before the checksum needs calculating so there
4149 	 * is no call to modify whatever is in the header now.
4150 	 */
4151 	ASSERT(fin->fin_m != NULL);
4152 	if (fin->fin_v == 4 && !NET_IS_HCK_L3_FULL(net_data_p, fin->fin_m)) {
4153 		if (nflags == IPN_ICMPERR) {
4154 			u_32_t s1, s2;
4155 
4156 			s1 = LONG_SUM(ntohl(fin->fin_saddr));
4157 			s2 = LONG_SUM(ntohl(nat->nat_outip.s_addr));
4158 			CALC_SUMD(s1, s2, sumd);
4159 
4160 			fix_outcksum(&fin->fin_ip->ip_sum, sumd);
4161 		}
4162 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
4163     defined(linux) || defined(BRIDGE_IPF)
4164 		else {
4165 			/*
4166 			 * Strictly speaking, this isn't necessary on BSD
4167 			 * kernels because they do checksum calculation after
4168 			 * this code has run BUT if ipfilter is being used
4169 			 * to do NAT as a bridge, that code doesn't exist.
4170 			 */
4171 			if (nat->nat_dir == NAT_OUTBOUND)
4172 				fix_outcksum(&fin->fin_ip->ip_sum,
4173 					    nat->nat_ipsumd);
4174 			else
4175 				fix_incksum(&fin->fin_ip->ip_sum,
4176 				 	   nat->nat_ipsumd);
4177 		}
4178 #endif
4179 	}
4180 
4181 	if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
4182 		if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) {
4183 			tcp = fin->fin_dp;
4184 
4185 			tcp->th_sport = nat->nat_outport;
4186 			fin->fin_data[0] = ntohs(nat->nat_outport);
4187 		}
4188 
4189 		if ((nat->nat_outport != 0) && (nflags & IPN_ICMPQUERY)) {
4190 			icmp = fin->fin_dp;
4191 			icmp->icmp_id = nat->nat_outport;
4192 		}
4193 
4194 		csump = nat_proto(fin, nat, nflags);
4195 	}
4196 
4197 	fin->fin_ip->ip_src = nat->nat_outip;
4198 
4199 	/*
4200 	 * The above comments do not hold for layer 4 (or higher) checksums...
4201 	 */
4202 	if (csump != NULL && !NET_IS_HCK_L4_FULL(net_data_p, fin->fin_m)) {
4203 		if (nflags & IPN_TCPUDP &&
4204 	   	    NET_IS_HCK_L4_PART(net_data_p, fin->fin_m))
4205 			sumd = nat->nat_sumd[1];
4206 		else
4207 			sumd = nat->nat_sumd[0];
4208 
4209 		if (nat->nat_dir == NAT_OUTBOUND)
4210 			fix_outcksum(csump, sumd);
4211 		else
4212 			fix_incksum(csump, sumd);
4213 	}
4214 #ifdef	IPFILTER_SYNC
4215 	ipfsync_update(SMC_NAT, fin, nat->nat_sync);
4216 #endif
4217 	/* ------------------------------------------------------------- */
4218 	/* A few quick notes:						 */
4219 	/*	Following are test conditions prior to calling the 	 */
4220 	/*	appr_check routine.					 */
4221 	/*								 */
4222 	/* 	A NULL tcp indicates a non TCP/UDP packet.  When dealing */
4223 	/*	with a redirect rule, we attempt to match the packet's	 */
4224 	/*	source port against in_dport, otherwise	we'd compare the */
4225 	/*	packet's destination.			 		 */
4226 	/* ------------------------------------------------------------- */
4227 	if ((np != NULL) && (np->in_apr != NULL)) {
4228 		i = appr_check(fin, nat);
4229 		if (i == 0)
4230 			i = 1;
4231 	} else
4232 		i = 1;
4233 	ifs->ifs_nat_stats.ns_mapped[1]++;
4234 	fin->fin_flx |= FI_NATED;
4235 	return i;
4236 }
4237 
4238 
4239 /* ------------------------------------------------------------------------ */
4240 /* Function:    fr_checknatin                                               */
4241 /* Returns:     int - -1 == packet failed NAT checks so block it,           */
4242 /*                     0 == no packet translation occurred,                 */
4243 /*                     1 == packet was successfully translated.             */
4244 /* Parameters:  fin(I)   - pointer to packet information                    */
4245 /*              passp(I) - pointer to filtering result flags                */
4246 /*                                                                          */
4247 /* Check to see if an incoming packet should be changed.  ICMP packets are  */
4248 /* first checked to see if they match an existing entry (if an error),      */
4249 /* otherwise a search of the current NAT table is made.  If neither results */
4250 /* in a match then a search for a matching NAT rule is made.  Create a new  */
4251 /* NAT entry if a we matched a NAT rule.  Lastly, actually change the       */
4252 /* packet header(s) as required.                                            */
4253 /* ------------------------------------------------------------------------ */
4254 int fr_checknatin(fin, passp)
4255 fr_info_t *fin;
4256 u_32_t *passp;
4257 {
4258 	u_int nflags, natadd;
4259 	ipnat_t *np, *npnext;
4260 	int rval, natfailed;
4261 	struct ifnet *ifp;
4262 	struct in_addr in;
4263 	icmphdr_t *icmp;
4264 	tcphdr_t *tcp;
4265 	u_short dport;
4266 	nat_t *nat;
4267 	u_32_t iph;
4268 	ipf_stack_t *ifs = fin->fin_ifs;
4269 
4270 	if (ifs->ifs_fr_nat_lock != 0)
4271 		return 0;
4272 	if (ifs->ifs_nat_stats.ns_rules == 0 && ifs->ifs_nat_instances == NULL)
4273 		return 0;
4274 
4275 	tcp = NULL;
4276 	icmp = NULL;
4277 	dport = 0;
4278 	natadd = 1;
4279 	nflags = 0;
4280 	natfailed = 0;
4281 	ifp = fin->fin_ifp;
4282 
4283 	if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
4284 		switch (fin->fin_p)
4285 		{
4286 		case IPPROTO_TCP :
4287 			nflags = IPN_TCP;
4288 			break;
4289 		case IPPROTO_UDP :
4290 			nflags = IPN_UDP;
4291 			break;
4292 		case IPPROTO_ICMP :
4293 			icmp = fin->fin_dp;
4294 
4295 			/*
4296 			 * This is an incoming packet, so the destination is
4297 			 * the icmp_id and the source port equals 0
4298 			 */
4299 			if (nat_icmpquerytype4(icmp->icmp_type)) {
4300 				nflags = IPN_ICMPQUERY;
4301 				dport = icmp->icmp_id;
4302 			} break;
4303 		default :
4304 			break;
4305 		}
4306 
4307 		if ((nflags & IPN_TCPUDP)) {
4308 			tcp = fin->fin_dp;
4309 			dport = tcp->th_dport;
4310 		}
4311 	}
4312 
4313 	in = fin->fin_dst;
4314 
4315 	READ_ENTER(&ifs->ifs_ipf_nat);
4316 
4317 	if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
4318 	    (nat = nat_icmperror(fin, &nflags, NAT_INBOUND)))
4319 		/*EMPTY*/;
4320 	else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin)))
4321 		natadd = 0;
4322 	else if ((nat = nat_inlookup(fin, nflags|NAT_SEARCH, (u_int)fin->fin_p,
4323 				     fin->fin_src, in))) {
4324 		nflags = nat->nat_flags;
4325 	} else {
4326 		u_32_t hv, msk, rmsk;
4327 
4328 		/*
4329 		 * There is no current entry in the nat table for this packet.
4330 		 *
4331 		 * If the packet is a fragment, but not the first fragment,
4332 		 * then don't do anything.  Otherwise, if there is a matching
4333 		 * nat rule, try to create a new nat entry.
4334 		 */
4335 		if ((fin->fin_off != 0) && (fin->fin_flx & FI_TCPUDP))
4336 			goto nonatfrag;
4337 
4338 		rmsk = ifs->ifs_rdr_masks;
4339 		msk = 0xffffffff;
4340 maskloop:
4341 		iph = in.s_addr & htonl(msk);
4342 		hv = NAT_HASH_FN(iph, 0, ifs->ifs_ipf_rdrrules_sz);
4343 		for (np = ifs->ifs_rdr_rules[hv]; np; np = npnext) {
4344 			npnext = np->in_rnext;
4345 			if (np->in_ifps[0] && (np->in_ifps[0] != ifp))
4346 				continue;
4347 			if (np->in_v != fin->fin_v)
4348 				continue;
4349 			if (np->in_p && (np->in_p != fin->fin_p))
4350 				continue;
4351 			if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags))
4352 				continue;
4353 			if (np->in_flags & IPN_FILTER) {
4354 				if (!nat_match(fin, np))
4355 					continue;
4356 			} else {
4357 				if ((in.s_addr & np->in_outmsk) != np->in_outip)
4358 					continue;
4359 				if (np->in_pmin &&
4360 				    ((ntohs(np->in_pmax) < ntohs(dport)) ||
4361 				     (ntohs(dport) < ntohs(np->in_pmin))))
4362 					continue;
4363 			}
4364 
4365 			if (*np->in_plabel != '\0') {
4366 				if (!appr_ok(fin, tcp, np)) {
4367 					continue;
4368 				}
4369 			}
4370 
4371 			ATOMIC_INC32(np->in_use);
4372 			RWLOCK_EXIT(&ifs->ifs_ipf_nat);
4373 			WRITE_ENTER(&ifs->ifs_ipf_nat);
4374 			nat = nat_new(fin, np, NULL, nflags, NAT_INBOUND);
4375 			if (nat != NULL) {
4376 				np->in_use--;
4377 				np->in_hits++;
4378 				MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat);
4379 				break;
4380 			}
4381 			natfailed = -1;
4382 			npnext = np->in_rnext;
4383 			fr_ipnatderef(&np, ifs);
4384 			MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat);
4385 		}
4386 
4387 		if ((np == NULL) && (rmsk != 0)) {
4388 			while (rmsk) {
4389 				msk <<= 1;
4390 				if (rmsk & 0x80000000)
4391 					break;
4392 				rmsk <<= 1;
4393 			}
4394 			if (rmsk != 0) {
4395 				rmsk <<= 1;
4396 				goto maskloop;
4397 			}
4398 		}
4399 	}
4400 
4401 nonatfrag:
4402 	if (nat != NULL) {
4403 		rval = fr_natin(fin, nat, natadd, nflags);
4404 		if (rval == 1) {
4405 			MUTEX_ENTER(&nat->nat_lock);
4406 			nat_update(fin, nat, nat->nat_ptr);
4407 			nat->nat_bytes[0] += fin->fin_plen;
4408 			nat->nat_pkts[0]++;
4409 			nat->nat_ref++;
4410 			MUTEX_EXIT(&nat->nat_lock);
4411 			nat->nat_touched = ifs->ifs_fr_ticks;
4412 			fin->fin_nat = nat;
4413 			fin->fin_state = nat->nat_state;
4414 		}
4415 	} else
4416 		rval = natfailed;
4417 	RWLOCK_EXIT(&ifs->ifs_ipf_nat);
4418 
4419 	if (rval == -1) {
4420 		if (passp != NULL)
4421 			*passp = FR_BLOCK;
4422 		fin->fin_flx |= FI_BADNAT;
4423 	}
4424 	return rval;
4425 }
4426 
4427 
4428 /* ------------------------------------------------------------------------ */
4429 /* Function:    fr_natin                                                    */
4430 /* Returns:     int - -1 == packet failed NAT checks so block it,           */
4431 /*                     1 == packet was successfully translated.             */
4432 /* Parameters:  fin(I)    - pointer to packet information                   */
4433 /*              nat(I)    - pointer to NAT structure                        */
4434 /*              natadd(I) - flag indicating if it is safe to add frag cache */
4435 /*              nflags(I) - NAT flags set for this packet                   */
4436 /* Locks Held:  ipf_nat (READ)                                              */
4437 /*                                                                          */
4438 /* Translate a packet coming "in" on an interface.                          */
4439 /* ------------------------------------------------------------------------ */
4440 int fr_natin(fin, nat, natadd, nflags)
4441 fr_info_t *fin;
4442 nat_t *nat;
4443 int natadd;
4444 u_32_t nflags;
4445 {
4446 	icmphdr_t *icmp;
4447 	u_short *csump;
4448 	tcphdr_t *tcp;
4449 	ipnat_t *np;
4450 	int i;
4451 	ipf_stack_t *ifs = fin->fin_ifs;
4452 
4453 	if (fin->fin_v == 6) {
4454 #ifdef	USE_INET6
4455 		return fr_nat6in(fin, nat, natadd, nflags);
4456 #else
4457 		return NULL;
4458 #endif
4459 	}
4460 
4461 #if SOLARIS && defined(_KERNEL)
4462 	net_handle_t net_data_p = ifs->ifs_ipf_ipv4;
4463 #endif
4464 
4465 	tcp = NULL;
4466 	csump = NULL;
4467 	np = nat->nat_ptr;
4468 	fin->fin_fr = nat->nat_fr;
4469 
4470 	if ((natadd != 0) && (fin->fin_flx & FI_FRAG))
4471 		(void) fr_nat_newfrag(fin, 0, nat);
4472 
4473 	if (np != NULL) {
4474 
4475 	/* ------------------------------------------------------------- */
4476 	/* A few quick notes:						 */
4477 	/*	Following are test conditions prior to calling the 	 */
4478 	/*	appr_check routine.					 */
4479 	/*								 */
4480 	/* 	A NULL tcp indicates a non TCP/UDP packet.  When dealing */
4481 	/*	with a map rule, we attempt to match the packet's	 */
4482 	/*	source port against in_dport, otherwise	we'd compare the */
4483 	/*	packet's destination.			 		 */
4484 	/* ------------------------------------------------------------- */
4485 		if (np->in_apr != NULL) {
4486 			i = appr_check(fin, nat);
4487 			if (i == -1) {
4488 				return -1;
4489 			}
4490 		}
4491 	}
4492 
4493 #ifdef	IPFILTER_SYNC
4494 	ipfsync_update(SMC_NAT, fin, nat->nat_sync);
4495 #endif
4496 
4497 	fin->fin_ip->ip_dst = nat->nat_inip;
4498 	fin->fin_fi.fi_daddr = nat->nat_inip.s_addr;
4499 	if (nflags & IPN_TCPUDP)
4500 		tcp = fin->fin_dp;
4501 
4502 	/*
4503 	 * Fix up checksums, not by recalculating them, but
4504 	 * simply computing adjustments.
4505 	 * Why only do this for some platforms on inbound packets ?
4506 	 * Because for those that it is done, IP processing is yet to happen
4507 	 * and so the IPv4 header checksum has not yet been evaluated.
4508 	 * Perhaps it should always be done for the benefit of things like
4509 	 * fast forwarding (so that it doesn't need to be recomputed) but with
4510 	 * header checksum offloading, perhaps it is a moot point.
4511 	 */
4512 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
4513      defined(__osf__) || defined(linux)
4514 	if (nat->nat_dir == NAT_OUTBOUND)
4515 		fix_incksum(&fin->fin_ip->ip_sum, nat->nat_ipsumd);
4516 	else
4517 		fix_outcksum(&fin->fin_ip->ip_sum, nat->nat_ipsumd);
4518 #endif
4519 
4520 	if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
4521 		if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) {
4522 			tcp->th_dport = nat->nat_inport;
4523 			fin->fin_data[1] = ntohs(nat->nat_inport);
4524 		}
4525 
4526 
4527 		if ((nat->nat_inport != 0) && (nflags & IPN_ICMPQUERY)) {
4528 			icmp = fin->fin_dp;
4529 
4530 			icmp->icmp_id = nat->nat_inport;
4531 		}
4532 
4533 		csump = nat_proto(fin, nat, nflags);
4534 	}
4535 
4536 	/*
4537 	 * In case they are being forwarded, inbound packets always need to have
4538 	 * their checksum adjusted even if hardware checksum validation said OK.
4539 	 */
4540 	if (csump != NULL) {
4541 		if (nat->nat_dir == NAT_OUTBOUND)
4542 			fix_incksum(csump, nat->nat_sumd[0]);
4543 		else
4544 			fix_outcksum(csump, nat->nat_sumd[0]);
4545 	}
4546 
4547 #if SOLARIS && defined(_KERNEL)
4548 	if (nflags & IPN_TCPUDP &&
4549 	    NET_IS_HCK_L4_PART(net_data_p, fin->fin_m)) {
4550 		/*
4551 		 * Need to adjust the partial checksum result stored in
4552 		 * db_cksum16, which will be used for validation in IP.
4553 		 * See IP_CKSUM_RECV().
4554 		 * Adjustment data should be the inverse of the IP address
4555 		 * changes, because db_cksum16 is supposed to be the complement
4556 		 * of the pesudo header.
4557 		 */
4558 		csump = &fin->fin_m->b_datap->db_cksum16;
4559 		if (nat->nat_dir == NAT_OUTBOUND)
4560 			fix_outcksum(csump, nat->nat_sumd[1]);
4561 		else
4562 			fix_incksum(csump, nat->nat_sumd[1]);
4563 	}
4564 #endif
4565 
4566 	ifs->ifs_nat_stats.ns_mapped[0]++;
4567 	fin->fin_flx |= FI_NATED;
4568 	if (np != NULL && np->in_tag.ipt_num[0] != 0)
4569 		fin->fin_nattag = &np->in_tag;
4570 	return 1;
4571 }
4572 
4573 
4574 /* ------------------------------------------------------------------------ */
4575 /* Function:    nat_proto                                                   */
4576 /* Returns:     u_short* - pointer to transport header checksum to update,  */
4577 /*                         NULL if the transport protocol is not recognised */
4578 /*                         as needing a checksum update.                    */
4579 /* Parameters:  fin(I)    - pointer to packet information                   */
4580 /*              nat(I)    - pointer to NAT structure                        */
4581 /*              nflags(I) - NAT flags set for this packet                   */
4582 /*                                                                          */
4583 /* Return the pointer to the checksum field for each protocol so understood.*/
4584 /* If support for making other changes to a protocol header is required,    */
4585 /* that is not strictly 'address' translation, such as clamping the MSS in  */
4586 /* TCP down to a specific value, then do it from here.                      */
4587 /* ------------------------------------------------------------------------ */
4588 u_short *nat_proto(fin, nat, nflags)
4589 fr_info_t *fin;
4590 nat_t *nat;
4591 u_int nflags;
4592 {
4593 	icmphdr_t *icmp;
4594 	struct icmp6_hdr *icmp6;
4595 	u_short *csump;
4596 	tcphdr_t *tcp;
4597 	udphdr_t *udp;
4598 
4599 	csump = NULL;
4600 	if (fin->fin_out == 0) {
4601 		fin->fin_rev = (nat->nat_dir == NAT_OUTBOUND);
4602 	} else {
4603 		fin->fin_rev = (nat->nat_dir == NAT_INBOUND);
4604 	}
4605 
4606 	switch (fin->fin_p)
4607 	{
4608 	case IPPROTO_TCP :
4609 		tcp = fin->fin_dp;
4610 
4611 		csump = &tcp->th_sum;
4612 
4613 		/*
4614 		 * Do a MSS CLAMPING on a SYN packet,
4615 		 * only deal IPv4 for now.
4616 		 */
4617 		if ((nat->nat_mssclamp != 0) && (tcp->th_flags & TH_SYN) != 0)
4618 			nat_mssclamp(tcp, nat->nat_mssclamp, csump);
4619 
4620 		break;
4621 
4622 	case IPPROTO_UDP :
4623 		udp = fin->fin_dp;
4624 
4625 		if (udp->uh_sum)
4626 			csump = &udp->uh_sum;
4627 		break;
4628 
4629 	case IPPROTO_ICMP :
4630 		icmp = fin->fin_dp;
4631 
4632 		if ((nflags & IPN_ICMPQUERY) != 0) {
4633 			if (icmp->icmp_cksum != 0)
4634 				csump = &icmp->icmp_cksum;
4635 		}
4636 		break;
4637 
4638 	case IPPROTO_ICMPV6 :
4639 		icmp6 = fin->fin_dp;
4640 
4641 		if ((nflags & IPN_ICMPQUERY) != 0) {
4642 			if (icmp6->icmp6_cksum != 0)
4643 				csump = &icmp6->icmp6_cksum;
4644 		}
4645 		break;
4646 	}
4647 	return csump;
4648 }
4649 
4650 
4651 /* ------------------------------------------------------------------------ */
4652 /* Function:    fr_natunload                                                */
4653 /* Returns:     Nil                                                         */
4654 /* Parameters:  Nil                                                         */
4655 /*                                                                          */
4656 /* Free all memory used by NAT structures allocated at runtime.             */
4657 /* ------------------------------------------------------------------------ */
4658 void fr_natunload(ifs)
4659 ipf_stack_t *ifs;
4660 {
4661 	ipftq_t *ifq, *ifqnext;
4662 
4663 	(void) nat_clearlist(ifs);
4664 	(void) nat_flushtable(ifs);
4665 
4666 	/*
4667 	 * Proxy timeout queues are not cleaned here because although they
4668 	 * exist on the NAT list, appr_unload is called after fr_natunload
4669 	 * and the proxies actually are responsible for them being created.
4670 	 * Should the proxy timeouts have their own list?  There's no real
4671 	 * justification as this is the only complication.
4672 	 */
4673 	for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) {
4674 		ifqnext = ifq->ifq_next;
4675 		if (((ifq->ifq_flags & IFQF_PROXY) == 0) &&
4676 		    (fr_deletetimeoutqueue(ifq) == 0))
4677 			fr_freetimeoutqueue(ifq, ifs);
4678 	}
4679 
4680 	if (ifs->ifs_nat_table[0] != NULL) {
4681 		KFREES(ifs->ifs_nat_table[0],
4682 		       sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz);
4683 		ifs->ifs_nat_table[0] = NULL;
4684 	}
4685 	if (ifs->ifs_nat_table[1] != NULL) {
4686 		KFREES(ifs->ifs_nat_table[1],
4687 		       sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz);
4688 		ifs->ifs_nat_table[1] = NULL;
4689 	}
4690 	if (ifs->ifs_nat_rules != NULL) {
4691 		KFREES(ifs->ifs_nat_rules,
4692 		       sizeof(ipnat_t *) * ifs->ifs_ipf_natrules_sz);
4693 		ifs->ifs_nat_rules = NULL;
4694 	}
4695 	if (ifs->ifs_rdr_rules != NULL) {
4696 		KFREES(ifs->ifs_rdr_rules,
4697 		       sizeof(ipnat_t *) * ifs->ifs_ipf_rdrrules_sz);
4698 		ifs->ifs_rdr_rules = NULL;
4699 	}
4700 	if (ifs->ifs_maptable != NULL) {
4701 		KFREES(ifs->ifs_maptable,
4702 		       sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz);
4703 		ifs->ifs_maptable = NULL;
4704 	}
4705 	if (ifs->ifs_nat_stats.ns_bucketlen[0] != NULL) {
4706 		KFREES(ifs->ifs_nat_stats.ns_bucketlen[0],
4707 		       sizeof(u_long *) * ifs->ifs_ipf_nattable_sz);
4708 		ifs->ifs_nat_stats.ns_bucketlen[0] = NULL;
4709 	}
4710 	if (ifs->ifs_nat_stats.ns_bucketlen[1] != NULL) {
4711 		KFREES(ifs->ifs_nat_stats.ns_bucketlen[1],
4712 		       sizeof(u_long *) * ifs->ifs_ipf_nattable_sz);
4713 		ifs->ifs_nat_stats.ns_bucketlen[1] = NULL;
4714 	}
4715 
4716 	if (ifs->ifs_fr_nat_maxbucket_reset == 1)
4717 		ifs->ifs_fr_nat_maxbucket = 0;
4718 
4719 	if (ifs->ifs_fr_nat_init == 1) {
4720 		ifs->ifs_fr_nat_init = 0;
4721 		fr_sttab_destroy(ifs->ifs_nat_tqb);
4722 
4723 		RW_DESTROY(&ifs->ifs_ipf_natfrag);
4724 		RW_DESTROY(&ifs->ifs_ipf_nat);
4725 
4726 		MUTEX_DESTROY(&ifs->ifs_ipf_nat_new);
4727 		MUTEX_DESTROY(&ifs->ifs_ipf_natio);
4728 
4729 		MUTEX_DESTROY(&ifs->ifs_nat_udptq.ifq_lock);
4730 		MUTEX_DESTROY(&ifs->ifs_nat_icmptq.ifq_lock);
4731 		MUTEX_DESTROY(&ifs->ifs_nat_iptq.ifq_lock);
4732 	}
4733 }
4734 
4735 
4736 /* ------------------------------------------------------------------------ */
4737 /* Function:    fr_natexpire                                                */
4738 /* Returns:     Nil                                                         */
4739 /* Parameters:  Nil                                                         */
4740 /*                                                                          */
4741 /* Check all of the timeout queues for entries at the top which need to be  */
4742 /* expired.                                                                 */
4743 /* ------------------------------------------------------------------------ */
4744 void fr_natexpire(ifs)
4745 ipf_stack_t *ifs;
4746 {
4747 	ipftq_t *ifq, *ifqnext;
4748 	ipftqent_t *tqe, *tqn;
4749 	int i;
4750 	SPL_INT(s);
4751 
4752 	SPL_NET(s);
4753 	WRITE_ENTER(&ifs->ifs_ipf_nat);
4754 	for (ifq = ifs->ifs_nat_tqb, i = 0; ifq != NULL; ifq = ifq->ifq_next) {
4755 		for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
4756 			if (tqe->tqe_die > ifs->ifs_fr_ticks)
4757 				break;
4758 			tqn = tqe->tqe_next;
4759 			nat_delete(tqe->tqe_parent, NL_EXPIRE, ifs);
4760 		}
4761 	}
4762 
4763 	for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) {
4764 		ifqnext = ifq->ifq_next;
4765 
4766 		for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
4767 			if (tqe->tqe_die > ifs->ifs_fr_ticks)
4768 				break;
4769 			tqn = tqe->tqe_next;
4770 			nat_delete(tqe->tqe_parent, NL_EXPIRE, ifs);
4771 		}
4772 	}
4773 
4774 	for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) {
4775 		ifqnext = ifq->ifq_next;
4776 
4777 		if (((ifq->ifq_flags & IFQF_DELETE) != 0) &&
4778 		    (ifq->ifq_ref == 0)) {
4779 			fr_freetimeoutqueue(ifq, ifs);
4780 		}
4781 	}
4782 
4783 	if (ifs->ifs_nat_doflush != 0) {
4784 		(void) nat_extraflush(2, ifs);
4785 		ifs->ifs_nat_doflush = 0;
4786 	}
4787 
4788 	RWLOCK_EXIT(&ifs->ifs_ipf_nat);
4789 	SPL_X(s);
4790 }
4791 
4792 
4793 /* ------------------------------------------------------------------------ */
4794 /* Function:    fr_nataddrsync                                              */
4795 /* Returns:     Nil                                                         */
4796 /* Parameters:  ifp(I) -  pointer to network interface                      */
4797 /*              addr(I) - pointer to new network address                    */
4798 /*                                                                          */
4799 /* Walk through all of the currently active NAT sessions, looking for those */
4800 /* which need to have their translated address updated (where the interface */
4801 /* matches the one passed in) and change it, recalculating the checksum sum */
4802 /* difference too.                                                          */
4803 /* ------------------------------------------------------------------------ */
4804 void fr_nataddrsync(v, ifp, addr, ifs)
4805 int v;
4806 void *ifp;
4807 void *addr;
4808 ipf_stack_t *ifs;
4809 {
4810 	u_32_t sum1, sum2, sumd;
4811 	nat_t *nat;
4812 	ipnat_t *np;
4813 	SPL_INT(s);
4814 
4815 	if (ifs->ifs_fr_running <= 0)
4816 		return;
4817 
4818 	SPL_NET(s);
4819 	WRITE_ENTER(&ifs->ifs_ipf_nat);
4820 
4821 	if (ifs->ifs_fr_running <= 0) {
4822 		RWLOCK_EXIT(&ifs->ifs_ipf_nat);
4823 		return;
4824 	}
4825 
4826 	/*
4827 	 * Change IP addresses for NAT sessions for any protocol except TCP
4828 	 * since it will break the TCP connection anyway.  The only rules
4829 	 * which will get changed are those which are "map ... -> 0/32",
4830 	 * where the rule specifies the address is taken from the interface.
4831 	 */
4832 	for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) {
4833 		if (addr != NULL) {
4834 			if (((ifp != NULL) && ifp != (nat->nat_ifps[0])) ||
4835 			    ((nat->nat_flags & IPN_TCP) != 0))
4836 				continue;
4837 			if ((np = nat->nat_ptr) == NULL)
4838 				continue;
4839 			if (v == 4 && np->in_v == 4) {
4840 				if (np->in_nip || np->in_outmsk != 0xffffffff)
4841 					continue;
4842 				/*
4843 				 * Change the map-to address to be the same as
4844 				 * the new one.
4845 				 */
4846 				sum1 = nat->nat_outip.s_addr;
4847 				nat->nat_outip = *(struct in_addr *)addr;
4848 				sum2 = nat->nat_outip.s_addr;
4849 			} else if (v == 6 && np->in_v == 6) {
4850 				if (!IP6_ISZERO(&np->in_next6.in6) ||
4851 				    !IP6_ISONES(&np->in_out[1].in6))
4852 					continue;
4853 				/*
4854 				 * Change the map-to address to be the same as
4855 				 * the new one.
4856 				 */
4857 				nat->nat_outip6.in6 = *(struct in6_addr *)addr;
4858 			} else
4859 				continue;
4860 
4861 		} else if (((ifp == NULL) || (ifp == nat->nat_ifps[0])) &&
4862 		    !(nat->nat_flags & IPN_TCP) && (np = nat->nat_ptr)) {
4863 			if (np->in_v == 4 && (v == 4 || v == 0)) {
4864 				struct in_addr in;
4865 				if (np->in_outmsk != 0xffffffff || np->in_nip)
4866 					continue;
4867 				/*
4868 				 * Change the map-to address to be the same as
4869 				 * the new one.
4870 				 */
4871 				sum1 = nat->nat_outip.s_addr;
4872 				if (fr_ifpaddr(4, FRI_NORMAL, nat->nat_ifps[0],
4873 					       &in, NULL, ifs) != -1)
4874 					nat->nat_outip = in;
4875 				sum2 = nat->nat_outip.s_addr;
4876 			} else if (np->in_v == 6 && (v == 6 || v == 0)) {
4877 				struct in6_addr in6;
4878 				if (!IP6_ISZERO(&np->in_next6.in6) ||
4879 				    !IP6_ISONES(&np->in_out[1].in6))
4880 					continue;
4881 				/*
4882 				 * Change the map-to address to be the same as
4883 				 * the new one.
4884 				 */
4885 				if (fr_ifpaddr(6, FRI_NORMAL, nat->nat_ifps[0],
4886 					       (void *)&in6, NULL, ifs) != -1)
4887 					nat->nat_outip6.in6 = in6;
4888 			} else
4889 				continue;
4890 		} else {
4891 			continue;
4892 		}
4893 
4894 		if (sum1 == sum2)
4895 			continue;
4896 		/*
4897 		 * Readjust the checksum adjustment to take into
4898 		 * account the new IP#.
4899 		 */
4900 		CALC_SUMD(sum1, sum2, sumd);
4901 		/* XXX - dont change for TCP when solaris does
4902 		 * hardware checksumming.
4903 		 */
4904 		sumd += nat->nat_sumd[0];
4905 		nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
4906 		nat->nat_sumd[1] = nat->nat_sumd[0];
4907 	}
4908 
4909 	RWLOCK_EXIT(&ifs->ifs_ipf_nat);
4910 	SPL_X(s);
4911 }
4912 
4913 
4914 /* ------------------------------------------------------------------------ */
4915 /* Function:    fr_natifpsync                                               */
4916 /* Returns:     Nil                                                         */
4917 /* Parameters:  action(I) - how we are syncing                              */
4918 /*              ifp(I)    - pointer to network interface                    */
4919 /*              name(I)   - name of interface to sync to                    */
4920 /*                                                                          */
4921 /* This function is used to resync the mapping of interface names and their */
4922 /* respective 'pointers'.  For "action == IPFSYNC_RESYNC", resync all       */
4923 /* interfaces by doing a new lookup of name to 'pointer'.  For "action ==   */
4924 /* IPFSYNC_NEWIFP", treat ifp as the new pointer value associated with      */
4925 /* "name" and for "action == IPFSYNC_OLDIFP", ifp is a pointer for which    */
4926 /* there is no longer any interface associated with it.                     */
4927 /* ------------------------------------------------------------------------ */
4928 void fr_natifpsync(action, v, ifp, name, ifs)
4929 int action, v;
4930 void *ifp;
4931 char *name;
4932 ipf_stack_t *ifs;
4933 {
4934 #if defined(_KERNEL) && !defined(MENTAT) && defined(USE_SPL)
4935 	int s;
4936 #endif
4937 	nat_t *nat;
4938 	ipnat_t *n;
4939 	int nv;
4940 
4941 	if (ifs->ifs_fr_running <= 0)
4942 		return;
4943 
4944 	SPL_NET(s);
4945 	WRITE_ENTER(&ifs->ifs_ipf_nat);
4946 
4947 	if (ifs->ifs_fr_running <= 0) {
4948 		RWLOCK_EXIT(&ifs->ifs_ipf_nat);
4949 		return;
4950 	}
4951 
4952 	switch (action)
4953 	{
4954 	case IPFSYNC_RESYNC :
4955 		for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) {
4956 			nv = (v == 0) ? nat->nat_v : v;
4957 			if (nat->nat_v != nv)
4958 				continue;
4959 			if ((ifp == nat->nat_ifps[0]) ||
4960 			    (nat->nat_ifps[0] == (void *)-1)) {
4961 				nat->nat_ifps[0] =
4962 				    fr_resolvenic(nat->nat_ifnames[0], nv, ifs);
4963 			}
4964 
4965 			if ((ifp == nat->nat_ifps[1]) ||
4966 			    (nat->nat_ifps[1] == (void *)-1)) {
4967 				nat->nat_ifps[1] =
4968 				    fr_resolvenic(nat->nat_ifnames[1], nv, ifs);
4969 			}
4970 		}
4971 
4972 		for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) {
4973 			nv = (v == 0) ? (int)n->in_v : v;
4974 			if ((int)n->in_v != nv)
4975 				continue;
4976 			if (n->in_ifps[0] == ifp ||
4977 			    n->in_ifps[0] == (void *)-1) {
4978 				n->in_ifps[0] =
4979 				    fr_resolvenic(n->in_ifnames[0], nv, ifs);
4980 			}
4981 			if (n->in_ifps[1] == ifp ||
4982 			    n->in_ifps[1] == (void *)-1) {
4983 				n->in_ifps[1] =
4984 				    fr_resolvenic(n->in_ifnames[1], nv, ifs);
4985 			}
4986 		}
4987 		break;
4988 	case IPFSYNC_NEWIFP :
4989 		for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) {
4990 			if (nat->nat_v != v)
4991 				continue;
4992 			if (!strncmp(name, nat->nat_ifnames[0],
4993 				     sizeof(nat->nat_ifnames[0])))
4994 				nat->nat_ifps[0] = ifp;
4995 			if (!strncmp(name, nat->nat_ifnames[1],
4996 				     sizeof(nat->nat_ifnames[1])))
4997 				nat->nat_ifps[1] = ifp;
4998 		}
4999 		for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) {
5000 			if ((int)n->in_v != v)
5001 				continue;
5002 			if (!strncmp(name, n->in_ifnames[0],
5003 				     sizeof(n->in_ifnames[0])))
5004 				n->in_ifps[0] = ifp;
5005 			if (!strncmp(name, n->in_ifnames[1],
5006 				     sizeof(n->in_ifnames[1])))
5007 				n->in_ifps[1] = ifp;
5008 		}
5009 		break;
5010 	case IPFSYNC_OLDIFP :
5011 		for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) {
5012 			if (nat->nat_v != v)
5013 				continue;
5014 			if (ifp == nat->nat_ifps[0])
5015 				nat->nat_ifps[0] = (void *)-1;
5016 			if (ifp == nat->nat_ifps[1])
5017 				nat->nat_ifps[1] = (void *)-1;
5018 		}
5019 		for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) {
5020 			if ((int)n->in_v != v)
5021 				continue;
5022 			if (n->in_ifps[0] == ifp)
5023 				n->in_ifps[0] = (void *)-1;
5024 			if (n->in_ifps[1] == ifp)
5025 				n->in_ifps[1] = (void *)-1;
5026 		}
5027 		break;
5028 	}
5029 	RWLOCK_EXIT(&ifs->ifs_ipf_nat);
5030 	SPL_X(s);
5031 }
5032 
5033 
5034 /* ------------------------------------------------------------------------ */
5035 /* Function:    nat_icmpquerytype4                                          */
5036 /* Returns:     int - 1 == success, 0 == failure                            */
5037 /* Parameters:  icmptype(I) - ICMP type number                              */
5038 /*                                                                          */
5039 /* Tests to see if the ICMP type number passed is a query/response type or  */
5040 /* not.                                                                     */
5041 /* ------------------------------------------------------------------------ */
5042 static INLINE int nat_icmpquerytype4(icmptype)
5043 int icmptype;
5044 {
5045 
5046 	/*
5047 	 * For the ICMP query NAT code, it is essential that both the query
5048 	 * and the reply match on the NAT rule. Because the NAT structure
5049 	 * does not keep track of the icmptype, and a single NAT structure
5050 	 * is used for all icmp types with the same src, dest and id, we
5051 	 * simply define the replies as queries as well. The funny thing is,
5052 	 * altough it seems silly to call a reply a query, this is exactly
5053 	 * as it is defined in the IPv4 specification
5054 	 */
5055 
5056 	switch (icmptype)
5057 	{
5058 
5059 	case ICMP_ECHOREPLY:
5060 	case ICMP_ECHO:
5061 	/* route aedvertisement/solliciation is currently unsupported: */
5062 	/* it would require rewriting the ICMP data section            */
5063 	case ICMP_TSTAMP:
5064 	case ICMP_TSTAMPREPLY:
5065 	case ICMP_IREQ:
5066 	case ICMP_IREQREPLY:
5067 	case ICMP_MASKREQ:
5068 	case ICMP_MASKREPLY:
5069 		return 1;
5070 	default:
5071 		return 0;
5072 	}
5073 }
5074 
5075 
5076 /* ------------------------------------------------------------------------ */
5077 /* Function:    nat_log                                                     */
5078 /* Returns:     Nil                                                         */
5079 /* Parameters:  nat(I)  - pointer to NAT structure                          */
5080 /*              type(I) - type of log entry to create                       */
5081 /*                                                                          */
5082 /* Creates a NAT log entry.                                                 */
5083 /* ------------------------------------------------------------------------ */
5084 void nat_log(nat, type, ifs)
5085 struct nat *nat;
5086 u_int type;
5087 ipf_stack_t *ifs;
5088 {
5089 #ifdef	IPFILTER_LOG
5090 # ifndef LARGE_NAT
5091 	struct ipnat *np;
5092 	int rulen;
5093 # endif
5094 	struct natlog natl;
5095 	void *items[1];
5096 	size_t sizes[1];
5097 	int types[1];
5098 
5099 	natl.nlg_inip = nat->nat_inip6;
5100 	natl.nlg_outip = nat->nat_outip6;
5101 	natl.nlg_origip = nat->nat_oip6;
5102 	natl.nlg_bytes[0] = nat->nat_bytes[0];
5103 	natl.nlg_bytes[1] = nat->nat_bytes[1];
5104 	natl.nlg_pkts[0] = nat->nat_pkts[0];
5105 	natl.nlg_pkts[1] = nat->nat_pkts[1];
5106 	natl.nlg_origport = nat->nat_oport;
5107 	natl.nlg_inport = nat->nat_inport;
5108 	natl.nlg_outport = nat->nat_outport;
5109 	natl.nlg_p = nat->nat_p;
5110 	natl.nlg_type = type;
5111 	natl.nlg_rule = -1;
5112 	natl.nlg_v = nat->nat_v;
5113 # ifndef LARGE_NAT
5114 	if (nat->nat_ptr != NULL) {
5115 		for (rulen = 0, np = ifs->ifs_nat_list; np;
5116 		     np = np->in_next, rulen++)
5117 			if (np == nat->nat_ptr) {
5118 				natl.nlg_rule = rulen;
5119 				break;
5120 			}
5121 	}
5122 # endif
5123 	items[0] = &natl;
5124 	sizes[0] = sizeof(natl);
5125 	types[0] = 0;
5126 
5127 	(void) ipllog(IPL_LOGNAT, NULL, items, sizes, types, 1, ifs);
5128 #endif
5129 }
5130 
5131 
5132 #if defined(__OpenBSD__)
5133 /* ------------------------------------------------------------------------ */
5134 /* Function:    nat_ifdetach                                                */
5135 /* Returns:     Nil                                                         */
5136 /* Parameters:  ifp(I) - pointer to network interface                       */
5137 /*                                                                          */
5138 /* Compatibility interface for OpenBSD to trigger the correct updating of   */
5139 /* interface references within IPFilter.                                    */
5140 /* ------------------------------------------------------------------------ */
5141 void nat_ifdetach(ifp, ifs)
5142 void *ifp;
5143 ipf_stack_t *ifs;
5144 {
5145 	frsync(ifp, ifs);
5146 	return;
5147 }
5148 #endif
5149 
5150 
5151 /* ------------------------------------------------------------------------ */
5152 /* Function:    fr_ipnatderef                                               */
5153 /* Returns:     Nil                                                         */
5154 /* Parameters:  inp(I) - pointer to pointer to NAT rule                     */
5155 /* Write Locks: ipf_nat                                                     */
5156 /*                                                                          */
5157 /* ------------------------------------------------------------------------ */
5158 void fr_ipnatderef(inp, ifs)
5159 ipnat_t **inp;
5160 ipf_stack_t *ifs;
5161 {
5162 	ipnat_t *in;
5163 
5164 	in = *inp;
5165 	*inp = NULL;
5166 	in->in_use--;
5167 	if (in->in_use == 0 && (in->in_flags & IPN_DELETE)) {
5168 		if (in->in_apr)
5169 			appr_free(in->in_apr);
5170 		KFREE(in);
5171 		ifs->ifs_nat_stats.ns_rules--;
5172 #ifdef notdef
5173 #if SOLARIS
5174 		if (ifs->ifs_nat_stats.ns_rules == 0)
5175 			ifs->ifs_pfil_delayed_copy = 1;
5176 #endif
5177 #endif
5178 	}
5179 }
5180 
5181 
5182 /* ------------------------------------------------------------------------ */
5183 /* Function:    fr_natderef                                                 */
5184 /* Returns:     Nil                                                         */
5185 /* Parameters:  isp(I) - pointer to pointer to NAT table entry              */
5186 /*                                                                          */
5187 /* Decrement the reference counter for this NAT table entry and free it if  */
5188 /* there are no more things using it.                                       */
5189 /*                                                                          */
5190 /* IF nat_ref == 1 when this function is called, then we have an orphan nat */
5191 /* structure *because* it only gets called on paths _after_ nat_ref has been*/
5192 /* incremented.  If nat_ref == 1 then we shouldn't decrement it here        */
5193 /* because nat_delete() will do that and send nat_ref to -1.                */
5194 /*                                                                          */
5195 /* Holding the lock on nat_lock is required to serialise nat_delete() being */
5196 /* called from a NAT flush ioctl with a deref happening because of a packet.*/
5197 /* ------------------------------------------------------------------------ */
5198 void fr_natderef(natp, ifs)
5199 nat_t **natp;
5200 ipf_stack_t *ifs;
5201 {
5202 	nat_t *nat;
5203 
5204 	nat = *natp;
5205 	*natp = NULL;
5206 
5207 	MUTEX_ENTER(&nat->nat_lock);
5208 	if (nat->nat_ref > 1) {
5209 		nat->nat_ref--;
5210 		MUTEX_EXIT(&nat->nat_lock);
5211 		return;
5212 	}
5213 	MUTEX_EXIT(&nat->nat_lock);
5214 
5215 	WRITE_ENTER(&ifs->ifs_ipf_nat);
5216 	nat_delete(nat, NL_EXPIRE, ifs);
5217 	RWLOCK_EXIT(&ifs->ifs_ipf_nat);
5218 }
5219 
5220 
5221 /* ------------------------------------------------------------------------ */
5222 /* Function:    fr_natclone                                                 */
5223 /* Returns:     ipstate_t* - NULL == cloning failed,                        */
5224 /*                           else pointer to new state structure            */
5225 /* Parameters:  fin(I) - pointer to packet information                      */
5226 /*              is(I)  - pointer to master state structure                  */
5227 /* Write Lock:  ipf_nat                                                     */
5228 /*                                                                          */
5229 /* Create a "duplcate" state table entry from the master.                   */
5230 /* ------------------------------------------------------------------------ */
5231 nat_t *fr_natclone(fin, nat)
5232 fr_info_t *fin;
5233 nat_t *nat;
5234 {
5235 	frentry_t *fr;
5236 	nat_t *clone;
5237 	ipnat_t *np;
5238 	ipf_stack_t *ifs = fin->fin_ifs;
5239 
5240 	KMALLOC(clone, nat_t *);
5241 	if (clone == NULL)
5242 		return NULL;
5243 	bcopy((char *)nat, (char *)clone, sizeof(*clone));
5244 
5245 	MUTEX_NUKE(&clone->nat_lock);
5246 
5247 	clone->nat_aps = NULL;
5248 	/*
5249 	 * Initialize all these so that nat_delete() doesn't cause a crash.
5250 	 */
5251 	clone->nat_tqe.tqe_pnext = NULL;
5252 	clone->nat_tqe.tqe_next = NULL;
5253 	clone->nat_tqe.tqe_ifq = NULL;
5254 	clone->nat_tqe.tqe_parent = clone;
5255 
5256 	clone->nat_flags &= ~SI_CLONE;
5257 	clone->nat_flags |= SI_CLONED;
5258 
5259 	if (clone->nat_hm)
5260 		clone->nat_hm->hm_ref++;
5261 
5262 	if (nat_insert(clone, fin->fin_rev, ifs) == -1) {
5263 		KFREE(clone);
5264 		return NULL;
5265 	}
5266 	np = clone->nat_ptr;
5267 	if (np != NULL) {
5268 		if (ifs->ifs_nat_logging)
5269 			nat_log(clone, (u_int)np->in_redir, ifs);
5270 		np->in_use++;
5271 	}
5272 	fr = clone->nat_fr;
5273 	if (fr != NULL) {
5274 		MUTEX_ENTER(&fr->fr_lock);
5275 		fr->fr_ref++;
5276 		MUTEX_EXIT(&fr->fr_lock);
5277 	}
5278 
5279 	/*
5280 	 * Because the clone is created outside the normal loop of things and
5281 	 * TCP has special needs in terms of state, initialise the timeout
5282 	 * state of the new NAT from here.
5283 	 */
5284 	if (clone->nat_p == IPPROTO_TCP) {
5285 		(void) fr_tcp_age(&clone->nat_tqe, fin, ifs->ifs_nat_tqb,
5286 				  clone->nat_flags);
5287 	}
5288 #ifdef	IPFILTER_SYNC
5289 	clone->nat_sync = ipfsync_new(SMC_NAT, fin, clone);
5290 #endif
5291 	if (ifs->ifs_nat_logging)
5292 		nat_log(clone, NL_CLONE, ifs);
5293 	return clone;
5294 }
5295 
5296 
5297 /* ------------------------------------------------------------------------ */
5298 /* Function:   nat_wildok                                                   */
5299 /* Returns:    int - 1 == packet's ports match wildcards                    */
5300 /*                   0 == packet's ports don't match wildcards              */
5301 /* Parameters: nat(I)   - NAT entry                                         */
5302 /*             sport(I) - source port                                       */
5303 /*             dport(I) - destination port                                  */
5304 /*             flags(I) - wildcard flags                                    */
5305 /*             dir(I)   - packet direction                                  */
5306 /*                                                                          */
5307 /* Use NAT entry and packet direction to determine which combination of     */
5308 /* wildcard flags should be used.                                           */
5309 /* ------------------------------------------------------------------------ */
5310 int nat_wildok(nat, sport, dport, flags, dir)
5311 nat_t *nat;
5312 int sport;
5313 int dport;
5314 int flags;
5315 int dir;
5316 {
5317 	/*
5318 	 * When called by       dir is set to
5319 	 * nat_inlookup         NAT_INBOUND (0)
5320 	 * nat_outlookup        NAT_OUTBOUND (1)
5321 	 *
5322 	 * We simply combine the packet's direction in dir with the original
5323 	 * "intended" direction of that NAT entry in nat->nat_dir to decide
5324 	 * which combination of wildcard flags to allow.
5325 	 */
5326 
5327 	switch ((dir << 1) | nat->nat_dir)
5328 	{
5329 	case 3: /* outbound packet / outbound entry */
5330 		if (((nat->nat_inport == sport) ||
5331 		    (flags & SI_W_SPORT)) &&
5332 		    ((nat->nat_oport == dport) ||
5333 		    (flags & SI_W_DPORT)))
5334 			return 1;
5335 		break;
5336 	case 2: /* outbound packet / inbound entry */
5337 		if (((nat->nat_outport == sport) ||
5338 		    (flags & SI_W_DPORT)) &&
5339 		    ((nat->nat_oport == dport) ||
5340 		    (flags & SI_W_SPORT)))
5341 			return 1;
5342 		break;
5343 	case 1: /* inbound packet / outbound entry */
5344 		if (((nat->nat_oport == sport) ||
5345 		    (flags & SI_W_DPORT)) &&
5346 		    ((nat->nat_outport == dport) ||
5347 		    (flags & SI_W_SPORT)))
5348 			return 1;
5349 		break;
5350 	case 0: /* inbound packet / inbound entry */
5351 		if (((nat->nat_oport == sport) ||
5352 		    (flags & SI_W_SPORT)) &&
5353 		    ((nat->nat_outport == dport) ||
5354 		    (flags & SI_W_DPORT)))
5355 			return 1;
5356 		break;
5357 	default:
5358 		break;
5359 	}
5360 
5361 	return(0);
5362 }
5363 
5364 
5365 /* ------------------------------------------------------------------------ */
5366 /* Function:    nat_mssclamp                                                */
5367 /* Returns:     Nil                                                         */
5368 /* Parameters:  tcp(I)    - pointer to TCP header                           */
5369 /*              maxmss(I) - value to clamp the TCP MSS to                   */
5370 /*              csump(I)  - pointer to TCP checksum                         */
5371 /*                                                                          */
5372 /* Check for MSS option and clamp it if necessary.  If found and changed,   */
5373 /* then the TCP header checksum will be updated to reflect the change in    */
5374 /* the MSS.                                                                 */
5375 /* ------------------------------------------------------------------------ */
5376 static void nat_mssclamp(tcp, maxmss, csump)
5377 tcphdr_t *tcp;
5378 u_32_t maxmss;
5379 u_short *csump;
5380 {
5381 	u_char *cp, *ep, opt;
5382 	int hlen, advance;
5383 	u_32_t mss, sumd;
5384 
5385 	hlen = TCP_OFF(tcp) << 2;
5386 	if (hlen > sizeof(*tcp)) {
5387 		cp = (u_char *)tcp + sizeof(*tcp);
5388 		ep = (u_char *)tcp + hlen;
5389 
5390 		while (cp < ep) {
5391 			opt = cp[0];
5392 			if (opt == TCPOPT_EOL)
5393 				break;
5394 			else if (opt == TCPOPT_NOP) {
5395 				cp++;
5396 				continue;
5397 			}
5398 
5399 			if (cp + 1 >= ep)
5400 				break;
5401 			advance = cp[1];
5402 			if ((cp + advance > ep) || (advance <= 0))
5403 				break;
5404 			switch (opt)
5405 			{
5406 			case TCPOPT_MAXSEG:
5407 				if (advance != 4)
5408 					break;
5409 				mss = cp[2] * 256 + cp[3];
5410 				if (mss > maxmss) {
5411 					cp[2] = maxmss / 256;
5412 					cp[3] = maxmss & 0xff;
5413 					CALC_SUMD(mss, maxmss, sumd);
5414 					fix_outcksum(csump, sumd);
5415 				}
5416 				break;
5417 			default:
5418 				/* ignore unknown options */
5419 				break;
5420 			}
5421 
5422 			cp += advance;
5423 		}
5424 	}
5425 }
5426 
5427 
5428 /* ------------------------------------------------------------------------ */
5429 /* Function:    fr_setnatqueue                                              */
5430 /* Returns:     Nil                                                         */
5431 /* Parameters:  nat(I)- pointer to NAT structure                            */
5432 /*              rev(I) - forward(0) or reverse(1) direction                 */
5433 /* Locks:       ipf_nat (read or write)                                     */
5434 /*                                                                          */
5435 /* Put the NAT entry on its default queue entry, using rev as a helped in   */
5436 /* determining which queue it should be placed on.                          */
5437 /* ------------------------------------------------------------------------ */
5438 void fr_setnatqueue(nat, rev, ifs)
5439 nat_t *nat;
5440 int rev;
5441 ipf_stack_t *ifs;
5442 {
5443 	ipftq_t *oifq, *nifq;
5444 
5445 	if (nat->nat_ptr != NULL)
5446 		nifq = nat->nat_ptr->in_tqehead[rev];
5447 	else
5448 		nifq = NULL;
5449 
5450 	if (nifq == NULL) {
5451 		switch (nat->nat_p)
5452 		{
5453 		case IPPROTO_UDP :
5454 			nifq = &ifs->ifs_nat_udptq;
5455 			break;
5456 		case IPPROTO_ICMP :
5457 			nifq = &ifs->ifs_nat_icmptq;
5458 			break;
5459 		case IPPROTO_TCP :
5460 			nifq = ifs->ifs_nat_tqb + nat->nat_tqe.tqe_state[rev];
5461 			break;
5462 		default :
5463 			nifq = &ifs->ifs_nat_iptq;
5464 			break;
5465 		}
5466 	}
5467 
5468 	oifq = nat->nat_tqe.tqe_ifq;
5469 	/*
5470 	 * If it's currently on a timeout queue, move it from one queue to
5471 	 * another, else put it on the end of the newly determined queue.
5472 	 */
5473 	if (oifq != NULL)
5474 		fr_movequeue(&nat->nat_tqe, oifq, nifq, ifs);
5475 	else
5476 		fr_queueappend(&nat->nat_tqe, nifq, nat, ifs);
5477 	return;
5478 }
5479 
5480 /* ------------------------------------------------------------------------ */
5481 /* Function:    nat_getnext                                                 */
5482 /* Returns:     int - 0 == ok, else error                                   */
5483 /* Parameters:  t(I)   - pointer to ipftoken structure                      */
5484 /*              itp(I) - pointer to ipfgeniter_t structure                  */
5485 /*              ifs - ipf stack instance                                    */
5486 /*                                                                          */
5487 /* Fetch the next nat/ipnat/hostmap structure pointer from the linked list  */
5488 /* and copy it out to the storage space pointed to by itp.  The next item   */
5489 /* in the list to look at is put back in the ipftoken struture.             */
5490 /* ------------------------------------------------------------------------ */
5491 static int nat_getnext(t, itp, ifs)
5492 ipftoken_t *t;
5493 ipfgeniter_t *itp;
5494 ipf_stack_t *ifs;
5495 {
5496 	hostmap_t *hm, *nexthm = NULL, zerohm;
5497 	ipnat_t *ipn, *nextipnat = NULL, zeroipn;
5498 	nat_t *nat, *nextnat = NULL, zeronat;
5499 	int error = 0, count;
5500 	char *dst;
5501 
5502 	if (itp->igi_nitems == 0)
5503 		return EINVAL;
5504 
5505 	READ_ENTER(&ifs->ifs_ipf_nat);
5506 
5507 	/*
5508 	 * Get "previous" entry from the token and find the next entry.
5509 	 */
5510 	switch (itp->igi_type)
5511 	{
5512 	case IPFGENITER_HOSTMAP :
5513 		hm = t->ipt_data;
5514 		if (hm == NULL) {
5515 			nexthm = ifs->ifs_ipf_hm_maplist;
5516 		} else {
5517 			nexthm = hm->hm_next;
5518 		}
5519 		break;
5520 
5521 	case IPFGENITER_IPNAT :
5522 		ipn = t->ipt_data;
5523 		if (ipn == NULL) {
5524 			nextipnat = ifs->ifs_nat_list;
5525 		} else {
5526 			nextipnat = ipn->in_next;
5527 		}
5528 		break;
5529 
5530 	case IPFGENITER_NAT :
5531 		nat = t->ipt_data;
5532 		if (nat == NULL) {
5533 			nextnat = ifs->ifs_nat_instances;
5534 		} else {
5535 			nextnat = nat->nat_next;
5536 		}
5537 		break;
5538 	default :
5539 		RWLOCK_EXIT(&ifs->ifs_ipf_nat);
5540 		return EINVAL;
5541 	}
5542 
5543 	dst = itp->igi_data;
5544 	for (count = itp->igi_nitems; count > 0; count--) {
5545 		/*
5546 		 * If we found an entry, add a reference to it and update the token.
5547 		 * Otherwise, zero out data to be returned and NULL out token.
5548 		 */
5549 		switch (itp->igi_type)
5550 		{
5551 		case IPFGENITER_HOSTMAP :
5552 			if (nexthm != NULL) {
5553 				ATOMIC_INC32(nexthm->hm_ref);
5554 				t->ipt_data = nexthm;
5555 			} else {
5556 				bzero(&zerohm, sizeof(zerohm));
5557 				nexthm = &zerohm;
5558 				t->ipt_data = NULL;
5559 			}
5560 			break;
5561 		case IPFGENITER_IPNAT :
5562 			if (nextipnat != NULL) {
5563 				ATOMIC_INC32(nextipnat->in_use);
5564 				t->ipt_data = nextipnat;
5565 			} else {
5566 				bzero(&zeroipn, sizeof(zeroipn));
5567 				nextipnat = &zeroipn;
5568 				t->ipt_data = NULL;
5569 			}
5570 			break;
5571 		case IPFGENITER_NAT :
5572 			if (nextnat != NULL) {
5573 				MUTEX_ENTER(&nextnat->nat_lock);
5574 				nextnat->nat_ref++;
5575 				MUTEX_EXIT(&nextnat->nat_lock);
5576 				t->ipt_data = nextnat;
5577 			} else {
5578 				bzero(&zeronat, sizeof(zeronat));
5579 				nextnat = &zeronat;
5580 				t->ipt_data = NULL;
5581 			}
5582 			break;
5583 		default :
5584 			break;
5585 		}
5586 
5587 		/*
5588 		 * Now that we have ref, it's save to give up lock.
5589 		 */
5590 		RWLOCK_EXIT(&ifs->ifs_ipf_nat);
5591 
5592 		/*
5593 		 * Copy out data and clean up references and token as needed.
5594 		 */
5595 		switch (itp->igi_type)
5596 		{
5597 		case IPFGENITER_HOSTMAP :
5598 			error = COPYOUT(nexthm, dst, sizeof(*nexthm));
5599 			if (error != 0)
5600 				error = EFAULT;
5601 			if (t->ipt_data == NULL) {
5602 				ipf_freetoken(t, ifs);
5603 				break;
5604 			} else {
5605 				if (hm != NULL) {
5606 					WRITE_ENTER(&ifs->ifs_ipf_nat);
5607 					fr_hostmapdel(&hm);
5608 					RWLOCK_EXIT(&ifs->ifs_ipf_nat);
5609 				}
5610 				if (nexthm->hm_next == NULL) {
5611 					ipf_freetoken(t, ifs);
5612 					break;
5613 				}
5614 				dst += sizeof(*nexthm);
5615 				hm = nexthm;
5616 				nexthm = nexthm->hm_next;
5617 			}
5618 			break;
5619 
5620 		case IPFGENITER_IPNAT :
5621 			error = COPYOUT(nextipnat, dst, sizeof(*nextipnat));
5622 			if (error != 0)
5623 				error = EFAULT;
5624 			if (t->ipt_data == NULL) {
5625 				ipf_freetoken(t, ifs);
5626 				break;
5627 			} else {
5628 				if (ipn != NULL) {
5629 					WRITE_ENTER(&ifs->ifs_ipf_nat);
5630 					fr_ipnatderef(&ipn, ifs);
5631 					RWLOCK_EXIT(&ifs->ifs_ipf_nat);
5632 				}
5633 				if (nextipnat->in_next == NULL) {
5634 					ipf_freetoken(t, ifs);
5635 					break;
5636 				}
5637 				dst += sizeof(*nextipnat);
5638 				ipn = nextipnat;
5639 				nextipnat = nextipnat->in_next;
5640 			}
5641 			break;
5642 
5643 		case IPFGENITER_NAT :
5644 			error = COPYOUT(nextnat, dst, sizeof(*nextnat));
5645 			if (error != 0)
5646 				error = EFAULT;
5647 			if (t->ipt_data == NULL) {
5648 				ipf_freetoken(t, ifs);
5649 				break;
5650 			} else {
5651 				if (nat != NULL)
5652 					fr_natderef(&nat, ifs);
5653 				if (nextnat->nat_next == NULL) {
5654 					ipf_freetoken(t, ifs);
5655 					break;
5656 				}
5657 				dst += sizeof(*nextnat);
5658 				nat = nextnat;
5659 				nextnat = nextnat->nat_next;
5660 			}
5661 			break;
5662 		default :
5663 			break;
5664 		}
5665 
5666 		if ((count == 1) || (error != 0))
5667 			break;
5668 
5669 		READ_ENTER(&ifs->ifs_ipf_nat);
5670 	}
5671 
5672 	return error;
5673 }
5674 
5675 
5676 /* ------------------------------------------------------------------------ */
5677 /* Function:    nat_iterator                                                */
5678 /* Returns:     int - 0 == ok, else error                                   */
5679 /* Parameters:  token(I) - pointer to ipftoken structure                    */
5680 /*              itp(I) - pointer to ipfgeniter_t structure                  */
5681 /*                                                                          */
5682 /* This function acts as a handler for the SIOCGENITER ioctls that use a    */
5683 /* generic structure to iterate through a list.  There are three different  */
5684 /* linked lists of NAT related information to go through: NAT rules, active */
5685 /* NAT mappings and the NAT fragment cache.                                 */
5686 /* ------------------------------------------------------------------------ */
5687 static int nat_iterator(token, itp, ifs)
5688 ipftoken_t *token;
5689 ipfgeniter_t *itp;
5690 ipf_stack_t *ifs;
5691 {
5692 	int error;
5693 
5694 	if (itp->igi_data == NULL)
5695 		return EFAULT;
5696 
5697 	token->ipt_subtype = itp->igi_type;
5698 
5699 	switch (itp->igi_type)
5700 	{
5701 	case IPFGENITER_HOSTMAP :
5702 	case IPFGENITER_IPNAT :
5703 	case IPFGENITER_NAT :
5704 		error = nat_getnext(token, itp, ifs);
5705 		break;
5706 	case IPFGENITER_NATFRAG :
5707 		error = fr_nextfrag(token, itp, &ifs->ifs_ipfr_natlist,
5708 				    &ifs->ifs_ipfr_nattail,
5709 				    &ifs->ifs_ipf_natfrag, ifs);
5710 		break;
5711 	default :
5712 		error = EINVAL;
5713 		break;
5714 	}
5715 
5716 	return error;
5717 }
5718 
5719 
5720 /* -------------------------------------------------------------------- */
5721 /* Function:	nat_earlydrop						*/
5722 /* Returns:	number of dropped/removed entries from the queue	*/
5723 /* Parameters:	ifq - pointer to queue with entries to be processed	*/
5724 /*		maxidle - entry must be idle this long to be dropped	*/
5725 /*		ifs - ipf stack instance				*/
5726 /*									*/
5727 /* Function is invoked from nat_extraflush() only.  Removes entries	*/
5728 /* form specified timeout queue, based on how long they've sat idle,	*/
5729 /* without waiting for it to happen on its own.				*/
5730 /* -------------------------------------------------------------------- */
5731 static int nat_earlydrop(ifq, maxidle, ifs)
5732 ipftq_t *ifq;
5733 int maxidle;
5734 ipf_stack_t *ifs;
5735 {
5736 	ipftqent_t *tqe, *tqn;
5737 	nat_t *nat;
5738 	unsigned int dropped;
5739 	int droptick;
5740 
5741 	if (ifq == NULL)
5742 		return (0);
5743 
5744 	dropped = 0;
5745 
5746 	/*
5747 	 * Determine the tick representing the idle time we're interested
5748 	 * in.  If an entry exists in the queue, and it was touched before
5749 	 * that tick, then it's been idle longer than maxidle ... remove it.
5750 	 */
5751 	droptick = ifs->ifs_fr_ticks - maxidle;
5752 	tqn = ifq->ifq_head;
5753 	while ((tqe = tqn) != NULL && tqe->tqe_touched < droptick) {
5754 		tqn = tqe->tqe_next;
5755 		nat = tqe->tqe_parent;
5756 		nat_delete(nat, ISL_EXPIRE, ifs);
5757 		dropped++;
5758 	}
5759 	return (dropped);
5760 }
5761 
5762 
5763 /* --------------------------------------------------------------------- */
5764 /* Function:	nat_flushclosing					 */
5765 /* Returns:	int - number of NAT entries deleted			 */
5766 /* Parameters:	stateval(I) - State at which to start removing entries	 */
5767 /*		ifs - ipf stack instance				 */
5768 /*									 */
5769 /* Remove nat table entries for TCP connections which are in the process */
5770 /* of closing, and are in (or "beyond") state specified by 'stateval'.	 */
5771 /* --------------------------------------------------------------------- */
5772 static int nat_flushclosing(stateval, ifs)
5773 int stateval;
5774 ipf_stack_t *ifs;
5775 {
5776 	ipftq_t *ifq, *ifqn;
5777 	ipftqent_t *tqe, *tqn;
5778 	nat_t *nat;
5779 	int dropped;
5780 
5781 	dropped = 0;
5782 
5783 	/*
5784 	 * Start by deleting any entries in specific timeout queues.
5785 	 */
5786 	ifqn = &ifs->ifs_nat_tqb[stateval];
5787 	while ((ifq = ifqn) != NULL) {
5788 		ifqn = ifq->ifq_next;
5789 		dropped += nat_earlydrop(ifq, (int)0, ifs);
5790 	}
5791 
5792 	/*
5793 	 * Next, look through user defined queues for closing entries.
5794 	 */
5795 	ifqn = ifs->ifs_nat_utqe;
5796 	while ((ifq = ifqn) != NULL) {
5797 		ifqn = ifq->ifq_next;
5798 		tqn = ifq->ifq_head;
5799 		while ((tqe = tqn) != NULL) {
5800 			tqn = tqe->tqe_next;
5801 			nat = tqe->tqe_parent;
5802 			if (nat->nat_p != IPPROTO_TCP)
5803 				continue;
5804 			if ((nat->nat_tcpstate[0] >= stateval) &&
5805 			    (nat->nat_tcpstate[1] >= stateval)) {
5806 				nat_delete(nat, NL_EXPIRE, ifs);
5807 				dropped++;
5808 			}
5809 		}
5810 	}
5811 	return (dropped);
5812 }
5813 
5814 
5815 /* --------------------------------------------------------------------- */
5816 /* Function:	nat_extraflush						 */
5817 /* Returns:	int - number of NAT entries deleted			 */
5818 /* Parameters:	which(I) - how to flush the active NAT table		 */
5819 /*		ifs - ipf stack instance				 */
5820 /* Write Locks:	ipf_nat							 */
5821 /*									 */
5822 /* Flush nat tables.  Three actions currently defined:			 */
5823 /*									 */
5824 /* which == 0 :	Flush all nat table entries.				 */
5825 /*									 */
5826 /* which == 1 :	Flush entries with TCP connections which have started	 */
5827 /*		to close on both ends.					 */
5828 /*									 */
5829 /* which == 2 :	First, flush entries which are "almost" closed.  If that */
5830 /*		does not take us below specified threshold in the table, */
5831 /*		we want to flush entries with TCP connections which have */
5832 /*		been idle for a long time.  Start with connections idle	 */
5833 /*		over 12 hours,  and then work backwards in half hour	 */
5834 /*		increments to at most 30 minutes idle, and finally work	 */
5835 /*		back in 30 second increments to at most 30 seconds.	 */
5836 /* --------------------------------------------------------------------- */
5837 static int nat_extraflush(which, ifs)
5838 int which;
5839 ipf_stack_t *ifs;
5840 {
5841 	ipftq_t *ifq, *ifqn;
5842 	nat_t *nat, **natp;
5843 	int idletime, removed, idle_idx;
5844 	SPL_INT(s);
5845 
5846 	removed = 0;
5847 
5848 	SPL_NET(s);
5849 	switch (which)
5850 	{
5851 	case 0:
5852 		natp = &ifs->ifs_nat_instances;
5853 		while ((nat = *natp) != NULL) {
5854 			natp = &nat->nat_next;
5855 			nat_delete(nat, ISL_FLUSH, ifs);
5856 			removed++;
5857 		}
5858 		break;
5859 
5860 	case 1:
5861 		removed = nat_flushclosing(IPF_TCPS_CLOSE_WAIT, ifs);
5862 		break;
5863 
5864 	case 2:
5865 		removed = nat_flushclosing(IPF_TCPS_FIN_WAIT_2, ifs);
5866 
5867 		/*
5868 		 * Be sure we haven't done this in the last 10 seconds.
5869 		 */
5870 		if (ifs->ifs_fr_ticks - ifs->ifs_nat_last_force_flush <
5871 		    IPF_TTLVAL(10))
5872 			break;
5873 		ifs->ifs_nat_last_force_flush = ifs->ifs_fr_ticks;
5874 
5875 		/*
5876 		 * Determine initial threshold for minimum idle time based on
5877 		 * how long ipfilter has been running.  Ipfilter needs to have
5878 		 * been up as long as the smallest interval to continue on.
5879 		 *
5880 		 * Minimum idle times stored in idletime_tab and indexed by
5881 		 * idle_idx.  Start at upper end of array and work backwards.
5882 		 *
5883 		 * Once the index is found, set the initial idle time to the
5884 		 * first interval before the current ipfilter run time.
5885 		 */
5886 		if (ifs->ifs_fr_ticks < idletime_tab[0])
5887 			break;  /* switch */
5888 		idle_idx = (sizeof (idletime_tab) / sizeof (int)) - 1;
5889 		if (ifs->ifs_fr_ticks > idletime_tab[idle_idx]) {
5890 			idletime = idletime_tab[idle_idx];
5891 		} else {
5892 			while ((idle_idx > 0) &&
5893 			    (ifs->ifs_fr_ticks < idletime_tab[idle_idx]))
5894 				idle_idx--;
5895 			idletime = (ifs->ifs_fr_ticks /
5896 				    idletime_tab[idle_idx]) *
5897 				    idletime_tab[idle_idx];
5898 		}
5899 
5900 		while ((idle_idx >= 0) &&
5901 		    (NAT_TAB_WATER_LEVEL(ifs) > ifs->ifs_nat_flush_lvl_lo)) {
5902 			/*
5903 			 * Start with appropriate timeout queue.
5904 			 */
5905 			removed += nat_earlydrop(
5906 					&ifs->ifs_nat_tqb[IPF_TCPS_ESTABLISHED],
5907 					idletime, ifs);
5908 
5909 			/*
5910 			 * Make sure we haven't already deleted enough
5911 			 * entries before checking the user defined queues.
5912 			 */
5913 			if (NAT_TAB_WATER_LEVEL(ifs) <=
5914 			    ifs->ifs_nat_flush_lvl_lo)
5915 				break;
5916 
5917 			/*
5918 			 * Next, look through the user defined queues.
5919 			 */
5920 			ifqn = ifs->ifs_nat_utqe;
5921 			while ((ifq = ifqn) != NULL) {
5922 				ifqn = ifq->ifq_next;
5923 				removed += nat_earlydrop(ifq, idletime, ifs);
5924 			}
5925 
5926 			/*
5927 			 * Adjust the granularity of idle time.
5928 			 *
5929 			 * If we reach an interval boundary, we need to
5930 			 * either adjust the idle time accordingly or exit
5931 			 * the loop altogether (if this is very last check).
5932 			 */
5933 			idletime -= idletime_tab[idle_idx];
5934 			if (idletime < idletime_tab[idle_idx]) {
5935 				if (idle_idx != 0) {
5936 					idletime = idletime_tab[idle_idx] -
5937 					    idletime_tab[idle_idx - 1];
5938 					idle_idx--;
5939 				} else {
5940 					break;  /* while */
5941 				}
5942 			}
5943 		}
5944 		break;
5945 	default:
5946 		break;
5947 	}
5948 
5949 	SPL_X(s);
5950 	return (removed);
5951 }
5952