1 /*
2 * Copyright (C) 1993-2001 by Darren Reed.
3 *
4 * See the IPFILTER.LICENCE file for details on licencing.
5 *
6 * Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com)
7 *
8 * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
9 * Use is subject to license terms.
10 *
11 * Copyright (c) 2014, Joyent, Inc. All rights reserved.
12 */
13
14 #include <stdio.h>
15 #include <string.h>
16 #include <fcntl.h>
17 #include <errno.h>
18 #include <sys/types.h>
19 #if !defined(__SVR4) && !defined(__svr4__)
20 #include <strings.h>
21 #else
22 #include <sys/byteorder.h>
23 #endif
24 #include <sys/time.h>
25 #include <sys/param.h>
26 #include <stdlib.h>
27 #include <unistd.h>
28 #include <stddef.h>
29 #include <sys/file.h>
30 #define _KERNEL
31 #include <sys/uio.h>
32 #undef _KERNEL
33 #include <sys/socket.h>
34 #include <sys/ioctl.h>
35 #if defined(sun) && (defined(__svr4__) || defined(__SVR4))
36 # include <sys/ioccom.h>
37 # include <sys/sysmacros.h>
38 #endif
39 #include <netinet/in.h>
40 #include <netinet/in_systm.h>
41 #include <netinet/ip.h>
42 #include <netinet/tcp.h>
43 #include <net/if.h>
44 #if __FreeBSD_version >= 300000
45 # include <net/if_var.h>
46 #endif
47 #include <netdb.h>
48 #include <arpa/nameser.h>
49 #include <arpa/inet.h>
50 #include <resolv.h>
51 #include <ctype.h>
52 #if defined(linux)
53 # include <linux/a.out.h>
54 #else
55 # include <nlist.h>
56 #endif
57 #include "ipf.h"
58 #include "netinet/ipl.h"
59 #include "kmem.h"
60 #include "ipfzone.h"
61
62 #ifdef __hpux
63 # define nlist nlist64
64 #endif
65
66 #if defined(sun) && !SOLARIS2
67 # define STRERROR(x) sys_errlist[x]
68 extern char *sys_errlist[];
69 #else
70 # define STRERROR(x) strerror(x)
71 #endif
72
73 #if !defined(lint)
74 static const char sccsid[] ="@(#)ipnat.c 1.9 6/5/96 (C) 1993 Darren Reed";
75 static const char rcsid[] = "@(#)$Id: ipnat.c,v 1.24.2.2 2005/05/10 21:19:30 darrenr Exp $";
76 #endif
77
78
79 #ifdef SOLARIS
80 #define bzero(a,b) memset(a,0,b)
81 #endif
82 int use_inet6 = 0;
83 char thishost[MAXHOSTNAMELEN];
84
85 extern char *optarg;
86
87 void dostats __P((int, natstat_t *, int, int));
88 void flushtable __P((int, int));
89 void usage __P((char *));
90 int main __P((int, char*[]));
91 void showhostmap __P((natstat_t *nsp));
92 void natstat_dead __P((natstat_t *, char *));
93 void dostats_live __P((int, natstat_t *, int));
94 void showhostmap_live __P((int, natstat_t *));
95
96 int opts;
97
usage(name)98 void usage(name)
99 char *name;
100 {
101 fprintf(stderr, "Usage: %s [-CdFhlnrRsv] [-f filename]", name);
102 fprintf(stderr, " [-G|-z zonename]\n");
103 exit(1);
104 }
105
106
main(argc,argv)107 int main(argc, argv)
108 int argc;
109 char *argv[];
110 {
111 char *file, *core, *kernel;
112 natstat_t ns, *nsp;
113 int fd, c, mode;
114 ipfobj_t obj;
115
116 fd = -1;
117 opts = 0;
118 nsp = &ns;
119 file = NULL;
120 core = NULL;
121 kernel = NULL;
122 mode = O_RDWR;
123
124 while ((c = getopt(argc, argv, "CdFf:G:hlM:N:nrRsvz:")) != -1)
125 switch (c)
126 {
127 case 'C' :
128 opts |= OPT_CLEAR;
129 break;
130 case 'd' :
131 opts |= OPT_DEBUG;
132 break;
133 case 'f' :
134 file = optarg;
135 break;
136 case 'F' :
137 opts |= OPT_FLUSH;
138 break;
139 case 'G' :
140 setzonename_global(optarg);
141 break;
142 case 'h' :
143 opts |=OPT_HITS;
144 break;
145 case 'l' :
146 opts |= OPT_LIST;
147 mode = O_RDONLY;
148 break;
149 case 'M' :
150 core = optarg;
151 break;
152 case 'N' :
153 kernel = optarg;
154 break;
155 case 'n' :
156 opts |= OPT_DONOTHING;
157 mode = O_RDONLY;
158 break;
159 case 'R' :
160 opts |= OPT_NORESOLVE;
161 break;
162 case 'r' :
163 opts |= OPT_REMOVE;
164 break;
165 case 's' :
166 opts |= OPT_STAT;
167 mode = O_RDONLY;
168 break;
169 case 'v' :
170 opts |= OPT_VERBOSE;
171 break;
172 case 'z' :
173 setzonename(optarg);
174 break;
175 default :
176 usage(argv[0]);
177 }
178
179 initparse();
180
181 if ((kernel != NULL) || (core != NULL)) {
182 (void) setgid(getgid());
183 (void) setreuid(getuid(), getuid());
184 }
185
186 bzero((char *)&ns, sizeof(ns));
187
188 if ((opts & OPT_DONOTHING) == 0) {
189 if (checkrev(IPL_NAME) == -1) {
190 fprintf(stderr, "User/kernel version check failed\n");
191 exit(1);
192 }
193 }
194
195
196 if (!(opts & OPT_DONOTHING) && (kernel == NULL) && (core == NULL)) {
197 #ifdef notdef
198 if (openkmem(kernel, core) == -1)
199 exit(1);
200 #endif
201 if (((fd = open(IPNAT_NAME, mode)) == -1) &&
202 ((fd = open(IPNAT_NAME, O_RDONLY)) == -1)) {
203 (void) fprintf(stderr, "%s: open: %s\n", IPNAT_NAME,
204 STRERROR(errno));
205 exit(1);
206 }
207
208 if (setzone(fd) != 0) {
209 close(fd);
210 exit(1);
211 }
212
213 bzero((char *)&obj, sizeof(obj));
214 obj.ipfo_rev = IPFILTER_VERSION;
215 obj.ipfo_size = sizeof(*nsp);
216 obj.ipfo_type = IPFOBJ_NATSTAT;
217 obj.ipfo_ptr = (void *)nsp;
218 if (ioctl(fd, SIOCGNATS, &obj) == -1) {
219 perror("ioctl(SIOCGNATS)");
220 exit(1);
221 }
222 (void) setgid(getgid());
223 (void) setreuid(getuid(), getuid());
224 } else if ((kernel != NULL) || (core != NULL)) {
225 if (openkmem(kernel, core) == -1)
226 exit(1);
227
228 natstat_dead(nsp, kernel);
229 if (opts & (OPT_LIST|OPT_STAT))
230 dostats(fd, nsp, opts, 0);
231 exit(0);
232 }
233
234 if (opts & (OPT_FLUSH|OPT_CLEAR))
235 flushtable(fd, opts);
236 if (file) {
237 ipnat_parsefile(fd, ipnat_addrule, ioctl, file);
238 }
239 if (opts & (OPT_LIST|OPT_STAT))
240 dostats(fd, nsp, opts, 1);
241 return 0;
242 }
243
244
245 /*
246 * Read NAT statistic information in using a symbol table and memory file
247 * rather than doing ioctl's.
248 */
natstat_dead(nsp,kernel)249 void natstat_dead(nsp, kernel)
250 natstat_t *nsp;
251 char *kernel;
252 {
253 struct nlist nat_nlist[10] = {
254 { "nat_table" }, /* 0 */
255 { "nat_list" },
256 { "maptable" },
257 { "ipf_nattable_sz" },
258 { "ipf_natrules_sz" },
259 { "ipf_rdrrules_sz" }, /* 5 */
260 { "ipf_hostmap_sz" },
261 { "nat_instances" },
262 { "ap_sess_list" },
263 { NULL }
264 };
265 void *tables[2];
266
267 if (nlist(kernel, nat_nlist) == -1) {
268 fprintf(stderr, "nlist error\n");
269 return;
270 }
271
272 /*
273 * Normally the ioctl copies all of these values into the structure
274 * for us, before returning it to userland, so here we must copy each
275 * one in individually.
276 */
277 kmemcpy((char *)&tables, nat_nlist[0].n_value, sizeof(tables));
278 nsp->ns_table[0] = tables[0];
279 nsp->ns_table[1] = tables[1];
280
281 kmemcpy((char *)&nsp->ns_list, nat_nlist[1].n_value,
282 sizeof(nsp->ns_list));
283 kmemcpy((char *)&nsp->ns_maptable, nat_nlist[2].n_value,
284 sizeof(nsp->ns_maptable));
285 kmemcpy((char *)&nsp->ns_nattab_sz, nat_nlist[3].n_value,
286 sizeof(nsp->ns_nattab_sz));
287 kmemcpy((char *)&nsp->ns_rultab_sz, nat_nlist[4].n_value,
288 sizeof(nsp->ns_rultab_sz));
289 kmemcpy((char *)&nsp->ns_rdrtab_sz, nat_nlist[5].n_value,
290 sizeof(nsp->ns_rdrtab_sz));
291 kmemcpy((char *)&nsp->ns_hostmap_sz, nat_nlist[6].n_value,
292 sizeof(nsp->ns_hostmap_sz));
293 kmemcpy((char *)&nsp->ns_instances, nat_nlist[7].n_value,
294 sizeof(nsp->ns_instances));
295 kmemcpy((char *)&nsp->ns_apslist, nat_nlist[8].n_value,
296 sizeof(nsp->ns_apslist));
297 }
298
299
300 /*
301 * Display NAT statistics.
302 */
dostats(fd,nsp,opts,alive)303 void dostats(fd, nsp, opts, alive)
304 natstat_t *nsp;
305 int fd, opts, alive;
306 {
307 nat_t *np, nat;
308 ipnat_t ipn;
309
310 /*
311 * Show statistics ?
312 */
313 if (opts & OPT_STAT) {
314 printf("mapped\tin\t%lu\tout\t%lu\n",
315 nsp->ns_mapped[0], nsp->ns_mapped[1]);
316 printf("added\t%lu\texpired\t%lu\n",
317 nsp->ns_added, nsp->ns_expire);
318 printf("no memory\t%lu\tbad nat\t%lu\n",
319 nsp->ns_memfail, nsp->ns_badnat);
320 printf("inuse\t%lu\norphans\t%u\nrules\t%lu\n",
321 nsp->ns_inuse, nsp->ns_orphans, nsp->ns_rules);
322 printf("wilds\t%u\n", nsp->ns_wilds);
323 if (opts & OPT_VERBOSE)
324 printf("table %p list %p\n",
325 nsp->ns_table, nsp->ns_list);
326 }
327
328 /*
329 * Show list of NAT rules and NAT sessions ?
330 */
331 if (opts & OPT_LIST) {
332 if (alive) {
333 dostats_live(fd, nsp, opts);
334 return;
335 }
336 printf("List of active MAP/Redirect filters:\n");
337 while (nsp->ns_list) {
338 if (kmemcpy((char *)&ipn, (long)nsp->ns_list,
339 sizeof(ipn))) {
340 perror("kmemcpy");
341 break;
342 }
343 if (opts & OPT_HITS)
344 printf("%lu ", ipn.in_hits);
345 printnat(&ipn, opts & (OPT_DEBUG|OPT_VERBOSE));
346 nsp->ns_list = ipn.in_next;
347 }
348
349 printf("\nList of active sessions:\n");
350
351 for (np = nsp->ns_instances; np; np = nat.nat_next) {
352 if (kmemcpy((char *)&nat, (long)np, sizeof(nat)))
353 break;
354 printactivenat(&nat, opts, 0);
355 if (nat.nat_aps)
356 printaps(nat.nat_aps, opts);
357 }
358
359 if (opts & OPT_VERBOSE)
360 showhostmap(nsp);
361 }
362 }
363
364
365 /*
366 * Display the active host mapping table.
367 */
showhostmap(nsp)368 void showhostmap(nsp)
369 natstat_t *nsp;
370 {
371 hostmap_t hm, *hmp, **maptable;
372 u_int hv;
373
374 printf("\nList of active host mappings:\n");
375
376 maptable = (hostmap_t **)malloc(sizeof(hostmap_t *) *
377 nsp->ns_hostmap_sz);
378 if (maptable == NULL) {
379 perror("malloc");
380 exit(1);
381 }
382 if (kmemcpy((char *)maptable, (u_long)nsp->ns_maptable,
383 sizeof(hostmap_t *) * nsp->ns_hostmap_sz)) {
384 perror("kmemcpy (maptable)");
385 return;
386 }
387
388 for (hv = 0; hv < nsp->ns_hostmap_sz; hv++) {
389 hmp = maptable[hv];
390
391 while (hmp) {
392 if (kmemcpy((char *)&hm, (u_long)hmp, sizeof(hm))) {
393 perror("kmemcpy (hostmap)");
394 return;
395 }
396
397 printhostmap(&hm, hv);
398 hmp = hm.hm_next;
399 }
400 }
401 free(maptable);
402 }
403
404
405 /*
406 * Issue an ioctl to flush either the NAT rules table or the active mapping
407 * table or both.
408 */
flushtable(fd,opts)409 void flushtable(fd, opts)
410 int fd, opts;
411 {
412 int n = 0;
413
414 if (opts & OPT_FLUSH) {
415 n = FLUSH_TABLE_ALL;
416 if (!(opts & OPT_DONOTHING) && ioctl(fd, SIOCIPFFL, &n) == -1)
417 perror("ioctl(SIOCFLNAT)");
418 else
419 printf("%d entries flushed from NAT table\n", n);
420 }
421
422 if (opts & OPT_CLEAR) {
423 n = FLUSH_LIST;
424 if (!(opts & OPT_DONOTHING) && ioctl(fd, SIOCIPFFL, &n) == -1)
425 perror("ioctl(SIOCCNATL)");
426 else
427 printf("%d entries flushed from NAT list\n", n);
428 }
429 }
430
431 /*
432 * Display NAT statistics.
433 */
dostats_live(fd,nsp,opts)434 void dostats_live(fd, nsp, opts)
435 natstat_t *nsp;
436 int fd, opts;
437 {
438 ipfgeniter_t iter;
439 ipfobj_t obj;
440 ipnat_t ipn;
441 nat_t nat;
442
443 bzero((char *)&obj, sizeof(obj));
444 obj.ipfo_rev = IPFILTER_VERSION;
445 obj.ipfo_type = IPFOBJ_GENITER;
446 obj.ipfo_size = sizeof(iter);
447 obj.ipfo_ptr = &iter;
448
449 iter.igi_type = IPFGENITER_IPNAT;
450 iter.igi_nitems = 1;
451 iter.igi_data = &ipn;
452
453 /*
454 * Show list of NAT rules and NAT sessions ?
455 */
456 printf("List of active MAP/Redirect filters:\n");
457 while (nsp->ns_list) {
458 if (ioctl(fd, SIOCGENITER, &obj) == -1)
459 break;
460 if (opts & OPT_HITS)
461 printf("%lu ", ipn.in_hits);
462 printnat(&ipn, opts & (OPT_DEBUG|OPT_VERBOSE));
463 nsp->ns_list = ipn.in_next;
464 }
465
466 printf("\nList of active sessions:\n");
467
468 iter.igi_type = IPFGENITER_NAT;
469 iter.igi_nitems = 1;
470 iter.igi_data = &nat;
471
472 while (nsp->ns_instances != NULL) {
473 if (ioctl(fd, SIOCGENITER, &obj) == -1)
474 break;
475 printactivenat(&nat, opts, 1);
476 if (nat.nat_aps)
477 printaps(nat.nat_aps, opts);
478 nsp->ns_instances = nat.nat_next;
479 }
480
481 if (opts & OPT_VERBOSE)
482 showhostmap_live(fd, nsp);
483 }
484
485 /*
486 * Display the active host mapping table.
487 */
showhostmap_live(fd,nsp)488 void showhostmap_live(fd, nsp)
489 int fd;
490 natstat_t *nsp;
491 {
492 hostmap_t hm, *hmp;
493 ipfgeniter_t iter;
494 ipfobj_t obj;
495
496 bzero((char *)&obj, sizeof(obj));
497 obj.ipfo_rev = IPFILTER_VERSION;
498 obj.ipfo_type = IPFOBJ_GENITER;
499 obj.ipfo_size = sizeof(iter);
500 obj.ipfo_ptr = &iter;
501
502 iter.igi_type = IPFGENITER_HOSTMAP;
503 iter.igi_nitems = 1;
504 iter.igi_data = &hm;
505
506 printf("\nList of active host mappings:\n");
507
508 while (nsp->ns_maplist != NULL) {
509 if (ioctl(fd, SIOCGENITER, &obj) == -1)
510 break;
511 printhostmap(&hm, 0);
512 nsp->ns_maplist = hm.hm_next;
513 }
514 }
515