1 /* 2 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 3 * Use is subject to license terms. 4 */ 5 6 #pragma ident "%Z%%M% %I% %E% SMI" 7 8 #if defined(KERNEL) || defined(_KERNEL) 9 # undef KERNEL 10 # undef _KERNEL 11 # define KERNEL 1 12 # define _KERNEL 1 13 #endif 14 #include <sys/errno.h> 15 #include <sys/types.h> 16 #include <sys/param.h> 17 #include <sys/time.h> 18 #if defined(__NetBSD__) 19 # if (NetBSD >= 199905) && !defined(IPFILTER_LKM) && defined(_KERNEL) 20 # include "opt_ipfilter_log.h" 21 # endif 22 #endif 23 #if defined(_KERNEL) && defined(__FreeBSD_version) && \ 24 (__FreeBSD_version >= 220000) 25 # if (__FreeBSD_version >= 400000) 26 # if !defined(IPFILTER_LKM) 27 # include "opt_inet6.h" 28 # endif 29 # if (__FreeBSD_version == 400019) 30 # define CSUM_DELAY_DATA 31 # endif 32 # endif 33 # include <sys/filio.h> 34 #else 35 # include <sys/ioctl.h> 36 #endif 37 #if !defined(_AIX51) 38 # include <sys/fcntl.h> 39 #endif 40 #if defined(_KERNEL) 41 # include <sys/systm.h> 42 # include <sys/file.h> 43 #else 44 # include <stdio.h> 45 # include <string.h> 46 # include <stdlib.h> 47 # include <stddef.h> 48 # include <sys/file.h> 49 # define _KERNEL 50 # ifdef __OpenBSD__ 51 struct file; 52 # endif 53 # include <sys/uio.h> 54 # undef _KERNEL 55 #endif 56 #if !defined(__SVR4) && !defined(__svr4__) && !defined(__hpux) && \ 57 !defined(linux) 58 # include <sys/mbuf.h> 59 #else 60 # if !defined(linux) 61 # include <sys/byteorder.h> 62 # endif 63 # if (SOLARIS2 < 5) && defined(sun) 64 # include <sys/dditypes.h> 65 # endif 66 #endif 67 #ifdef __hpux 68 # define _NET_ROUTE_INCLUDED 69 #endif 70 #if !defined(linux) 71 # include <sys/protosw.h> 72 #endif 73 #include <sys/socket.h> 74 #include <net/if.h> 75 #ifdef sun 76 # include <net/af.h> 77 #endif 78 #if !defined(_KERNEL) && defined(__FreeBSD__) 79 # include "radix_ipf.h" 80 #endif 81 #include <net/route.h> 82 #include <netinet/in.h> 83 #include <netinet/in_systm.h> 84 #include <netinet/ip.h> 85 #if !defined(linux) 86 # include <netinet/ip_var.h> 87 #endif 88 #if defined(__sgi) && defined(IFF_DRVRLOCK) /* IRIX 6 */ 89 # include <sys/hashing.h> 90 # include <netinet/in_var.h> 91 #endif 92 #include <netinet/tcp.h> 93 #if (!defined(__sgi) && !defined(AIX)) || defined(_KERNEL) 94 # include <netinet/udp.h> 95 # include <netinet/ip_icmp.h> 96 #endif 97 #ifdef __hpux 98 # undef _NET_ROUTE_INCLUDED 99 #endif 100 #include "netinet/ip_compat.h" 101 #ifdef USE_INET6 102 # include <netinet/icmp6.h> 103 # if !SOLARIS && defined(_KERNEL) && !defined(__osf__) && !defined(__hpux) 104 # include <netinet6/in6_var.h> 105 # endif 106 #endif 107 #include <netinet/tcpip.h> 108 #include "netinet/ip_fil.h" 109 #include "netinet/ip_nat.h" 110 #include "netinet/ip_frag.h" 111 #include "netinet/ip_state.h" 112 #include "netinet/ip_proxy.h" 113 #include "netinet/ip_auth.h" 114 #include "netinet/ipf_stack.h" 115 #ifdef IPFILTER_SCAN 116 # include "netinet/ip_scan.h" 117 #endif 118 #ifdef IPFILTER_SYNC 119 # include "netinet/ip_sync.h" 120 #endif 121 #include "netinet/ip_pool.h" 122 #include "netinet/ip_htable.h" 123 #ifdef IPFILTER_COMPILED 124 # include "netinet/ip_rules.h" 125 #endif 126 #if defined(IPFILTER_BPF) && defined(_KERNEL) 127 # include <net/bpf.h> 128 #endif 129 #if defined(__FreeBSD_version) && (__FreeBSD_version >= 300000) 130 # include <sys/malloc.h> 131 # if defined(_KERNEL) && !defined(IPFILTER_LKM) 132 # include "opt_ipfilter.h" 133 # endif 134 #endif 135 #include "netinet/ipl.h" 136 /* END OF INCLUDES */ 137 138 #ifdef IPFILTER_COMPAT 139 140 # define IPFILTER_VERSION_4010900 4010900 141 142 struct nat_4010900 { 143 ipfmutex_t nat_lock; 144 struct nat *nat_next; 145 struct nat **nat_pnext; 146 struct nat *nat_hnext[2]; 147 struct nat **nat_phnext[2]; 148 struct hostmap *nat_hm; 149 void *nat_data; 150 struct nat **nat_me; 151 struct ipstate *nat_state; 152 struct ap_session *nat_aps; /* proxy session */ 153 frentry_t *nat_fr; /* filter rule ptr if appropriate */ 154 struct ipnat *nat_ptr; /* pointer back to the rule */ 155 void *nat_ifps[2]; 156 void *nat_sync; 157 ipftqent_t nat_tqe; 158 u_32_t nat_flags; 159 u_32_t nat_sumd[2]; /* ip checksum delta for data segment */ 160 u_32_t nat_ipsumd; /* ip checksum delta for ip header */ 161 u_32_t nat_mssclamp; /* if != zero clamp MSS to this */ 162 i6addr_t nat_inip6; 163 i6addr_t nat_outip6; 164 i6addr_t nat_oip6; /* other ip */ 165 U_QUAD_T nat_pkts[2]; 166 U_QUAD_T nat_bytes[2]; 167 union { 168 udpinfo_t nat_unu; 169 tcpinfo_t nat_unt; 170 icmpinfo_t nat_uni; 171 greinfo_t nat_ugre; 172 } nat_un; 173 u_short nat_oport; /* other port */ 174 u_short nat_use; 175 u_char nat_p; /* protocol for NAT */ 176 int nat_dir; 177 int nat_ref; /* reference count */ 178 int nat_hv[2]; 179 char nat_ifnames[2][LIFNAMSIZ]; 180 int nat_rev; /* 0 = forward, 1 = reverse */ 181 int nat_redir; 182 }; 183 184 struct nat_save_4010900 { 185 void *ipn_next; 186 struct nat_4010900 ipn_nat; 187 struct ipnat ipn_ipnat; 188 struct frentry ipn_fr; 189 int ipn_dsize; 190 char ipn_data[4]; 191 }; 192 193 struct natlookup_4010900 { 194 struct in_addr nlc_inip; 195 struct in_addr nlc_outip; 196 struct in_addr nlc_realip; 197 int nlc_flags; 198 u_short nlc_inport; 199 u_short nlc_outport; 200 u_short nlc_realport; 201 }; 202 203 204 /* ------------------------------------------------------------------------ */ 205 /* Function: fr_incomptrans */ 206 /* Returns: int - 0 = success, else failure */ 207 /* Parameters: obj(I) - pointer to ioctl data */ 208 /* ptr(I) - pointer to store real data in */ 209 /* */ 210 /* Translate the copied in ipfobj_t to new for backward compatibility at */ 211 /* the ABI for user land. */ 212 /* ------------------------------------------------------------------------ */ 213 int fr_incomptrans(obj, ptr) 214 ipfobj_t *obj; 215 void *ptr; 216 { 217 int error; 218 natlookup_t *nlp; 219 nat_save_t *nsp; 220 struct nat_save_4010900 nsc; 221 struct natlookup_4010900 nlc; 222 223 switch (obj->ipfo_type) 224 { 225 case IPFOBJ_NATLOOKUP : 226 if ((obj->ipfo_rev != IPFILTER_VERSION_4010900) || 227 (obj->ipfo_size != sizeof (nlc))) 228 return EINVAL; 229 error = COPYIN((caddr_t)obj->ipfo_ptr, (caddr_t)&nlc, 230 obj->ipfo_size); 231 if (!error) { 232 nlp = (natlookup_t *)ptr; 233 bzero((char *)nlp, sizeof (*nlp)); 234 nlp->nl_inip = nlc.nlc_inip; 235 nlp->nl_outip = nlc.nlc_outip; 236 nlp->nl_inport = nlc.nlc_inport; 237 nlp->nl_outport = nlc.nlc_outport; 238 nlp->nl_flags = nlc.nlc_flags; 239 nlp->nl_v = 4; 240 } 241 break; 242 case IPFOBJ_NATSAVE : 243 if ((obj->ipfo_rev != IPFILTER_VERSION_4010900) || 244 (obj->ipfo_size != sizeof (nsc))) 245 return EINVAL; 246 error = COPYIN((caddr_t)obj->ipfo_ptr, (caddr_t)&nsc, 247 obj->ipfo_size); 248 if (!error) { 249 nsp = (nat_save_t *)ptr; 250 bzero((char *)nsp, sizeof (*nsp)); 251 nsp->ipn_next = nsc.ipn_next; 252 nsp->ipn_dsize = nsc.ipn_dsize; 253 nsp->ipn_nat.nat_inip = nsc.ipn_nat.nat_inip; 254 nsp->ipn_nat.nat_outip = nsc.ipn_nat.nat_outip; 255 nsp->ipn_nat.nat_oip = nsc.ipn_nat.nat_oip; 256 nsp->ipn_nat.nat_inport = nsc.ipn_nat.nat_inport; 257 nsp->ipn_nat.nat_outport = nsc.ipn_nat.nat_outport; 258 nsp->ipn_nat.nat_oport = nsc.ipn_nat.nat_oport; 259 nsp->ipn_nat.nat_flags = nsc.ipn_nat.nat_flags; 260 nsp->ipn_nat.nat_v = 4; 261 } 262 break; 263 default : 264 return EINVAL; 265 } 266 return error; 267 } 268 269 /* ------------------------------------------------------------------------ */ 270 /* Function: fr_outcomptrans */ 271 /* Returns: int - 0 = success, else failure */ 272 /* Parameters: obj(I) - pointer to ioctl data */ 273 /* ptr(I) - pointer to store real data in */ 274 /* */ 275 /* Translate the copied out ipfobj_t to new definition for backward */ 276 /* compatibility at the ABI for user land. */ 277 /* ------------------------------------------------------------------------ */ 278 int fr_outcomptrans(obj, ptr) 279 ipfobj_t *obj; 280 void *ptr; 281 { 282 int error; 283 natlookup_t *nlp; 284 struct natlookup_4010900 nlc; 285 286 switch (obj->ipfo_type) 287 { 288 case IPFOBJ_NATLOOKUP : 289 if ((obj->ipfo_rev != IPFILTER_VERSION_4010900) || 290 (obj->ipfo_size != sizeof (nlc))) 291 return EINVAL; 292 bzero((char *)&nlc, sizeof (nlc)); 293 nlp = (natlookup_t *)ptr; 294 nlc.nlc_inip = nlp->nl_inip; 295 nlc.nlc_outip = nlp->nl_outip; 296 nlc.nlc_realip = nlp->nl_realip; 297 nlc.nlc_inport = nlp->nl_inport; 298 nlc.nlc_outport = nlp->nl_outport; 299 nlc.nlc_realport = nlp->nl_realport; 300 nlc.nlc_flags = nlp->nl_flags; 301 error = COPYOUT((caddr_t)&nlc, (caddr_t)obj->ipfo_ptr, 302 obj->ipfo_size); 303 break; 304 default : 305 return EINVAL; 306 } 307 return error; 308 } 309 310 #endif /* IPFILTER_COMPAT */ 311