ip_nat.c revision 1.2
1 /* $NetBSD: ip_nat.c,v 1.2 2012/03/23 20:39:50 christos Exp $ */ 2 3 /* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 */ 8 #if defined(KERNEL) || defined(_KERNEL) 9 # undef KERNEL 10 # undef ipf_nat_KERNEL 11 # define KERNEL 1 12 # define ipf_nat_KERNEL 1 13 #endif 14 #include <sys/errno.h> 15 #include <sys/types.h> 16 #include <sys/param.h> 17 #include <sys/time.h> 18 #include <sys/file.h> 19 #if defined(_KERNEL) && \ 20 (defined(__NetBSD_Version) && (__NetBSD_Version >= 399002000)) 21 # include <sys/kauth.h> 22 #endif 23 #if !defined(_KERNEL) 24 # include <stdio.h> 25 # include <string.h> 26 # include <stdlib.h> 27 # define ipf_nat_KERNEL 28 # ifdef ipf_nat__OpenBSD__ 29 struct file; 30 # endif 31 # include <sys/uio.h> 32 # undef ipf_nat_KERNEL 33 #endif 34 #if defined(_KERNEL) && \ 35 defined(__FreeBSD_version) && (__FreeBSD_version >= 220000) 36 # include <sys/filio.h> 37 # include <sys/fcntl.h> 38 #else 39 # include <sys/ioctl.h> 40 #endif 41 #if !defined(AIX) 42 # include <sys/fcntl.h> 43 #endif 44 #if !defined(linux) 45 # include <sys/protosw.h> 46 #endif 47 #include <sys/socket.h> 48 #if defined(_KERNEL) 49 # include <sys/systm.h> 50 # if !defined(__SVR4) && !defined(__svr4__) 51 # include <sys/mbuf.h> 52 # endif 53 #endif 54 #if defined(__SVR4) || defined(__svr4__) 55 # include <sys/filio.h> 56 # include <sys/byteorder.h> 57 # ifdef ipf_nat_KERNEL 58 # include <sys/dditypes.h> 59 # endif 60 # include <sys/stream.h> 61 # include <sys/kmem.h> 62 #endif 63 #if ipf_nat__FreeBSD_version >= 300000 64 # include <sys/queue.h> 65 #endif 66 #include <net/if.h> 67 #if ipf_nat__FreeBSD_version >= 300000 68 # include <net/if_var.h> 69 #endif 70 #ifdef sun 71 # include <net/af.h> 72 #endif 73 #include <netinet/in.h> 74 #include <netinet/in_systm.h> 75 #include <netinet/ip.h> 76 77 #ifdef RFC1825 78 # include <vpn/md5.h> 79 # include <vpn/ipsec.h> 80 extern struct ifnet vpnif; 81 #endif 82 83 #if !defined(linux) 84 # include <netinet/ip_var.h> 85 #endif 86 #include <netinet/tcp.h> 87 #include <netinet/udp.h> 88 #include <netinet/ip_icmp.h> 89 #include "netinet/ip_compat.h" 90 #include <netinet/tcpip.h> 91 #include "netinet/ipl.h" 92 #include "netinet/ip_fil.h" 93 #include "netinet/ip_nat.h" 94 #include "netinet/ip_frag.h" 95 #include "netinet/ip_state.h" 96 #include "netinet/ip_proxy.h" 97 #include "netinet/ip_lookup.h" 98 #include "netinet/ip_dstlist.h" 99 #include "netinet/ip_sync.h" 100 #if FREEBSD_GE_REV(300000) 101 # include <sys/malloc.h> 102 #endif 103 #ifdef HAS_SYS_MD5_H 104 # include <sys/md5.h> 105 #else 106 # include "md5.h" 107 #endif 108 /* END OF INCLUDES */ 109 110 #undef SOCKADDR_IN 111 #define SOCKADDR_IN struct sockaddr_in 112 113 #if !defined(lint) 114 #if defined(__NetBSD__) 115 #include <sys/cdefs.h> 116 __KERNEL_RCSID(0, "$NetBSD: ip_nat.c,v 1.2 2012/03/23 20:39:50 christos Exp $"); 117 #else 118 static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed"; 119 static const char rcsid[] = "@(#)Id: ip_nat.c,v 2.357.2.23 2012/01/29 05:30:36 darrenr Exp"; 120 #endif 121 #endif 122 123 124 #define NATFSUM(n,v,f) ((v) == 4 ? (n)->f.in4.s_addr : (n)->f.i6[0] + \ 125 (n)->f.i6[1] + (n)->f.i6[2] + (n)->f.i6[3]) 126 #define NBUMP(x) softn->(x)++ 127 #define NBUMPD(x, y) do { \ 128 softn->x.y++; \ 129 DT(y); \ 130 } while (0) 131 #define NBUMPSIDE(y,x) softn->ipf_nat_stats.ns_side[y].x++ 132 #define NBUMPSIDED(y,x) do { softn->ipf_nat_stats.ns_side[y].x++; \ 133 DT(x); } while (0) 134 #define NBUMPSIDEX(y,x,z) \ 135 do { softn->ipf_nat_stats.ns_side[y].x++; \ 136 DT(z); } while (0) 137 #define NBUMPSIDEDF(y,x)do { softn->ipf_nat_stats.ns_side[y].x++; \ 138 DT1(x, fr_info_t *, fin); } while (0) 139 140 frentry_t ipfnatblock; 141 142 static ipftuneable_t ipf_nat_tuneables[] = { 143 /* nat */ 144 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_lock) }, 145 "nat_lock", 0, 1, 146 stsizeof(ipf_nat_softc_t, ipf_nat_lock), 147 IPFT_RDONLY, NULL, NULL }, 148 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_sz) }, 149 "nat_table_size", 1, 0x7fffffff, 150 stsizeof(ipf_nat_softc_t, ipf_nat_table_sz), 151 0, NULL, ipf_nat_rehash }, 152 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_max) }, 153 "nat_table_max", 1, 0x7fffffff, 154 stsizeof(ipf_nat_softc_t, ipf_nat_table_max), 155 0, NULL, NULL }, 156 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_maprules_sz) }, 157 "nat_rules_size", 1, 0x7fffffff, 158 stsizeof(ipf_nat_softc_t, ipf_nat_maprules_sz), 159 0, NULL, ipf_nat_rehash_rules }, 160 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_rdrrules_sz) }, 161 "rdr_rules_size", 1, 0x7fffffff, 162 stsizeof(ipf_nat_softc_t, ipf_nat_rdrrules_sz), 163 0, NULL, ipf_nat_rehash_rules }, 164 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_hostmap_sz) }, 165 "hostmap_size", 1, 0x7fffffff, 166 stsizeof(ipf_nat_softc_t, ipf_nat_hostmap_sz), 167 0, NULL, ipf_nat_hostmap_rehash }, 168 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_maxbucket) }, 169 "nat_maxbucket",1, 0x7fffffff, 170 stsizeof(ipf_nat_softc_t, ipf_nat_maxbucket), 171 0, NULL, NULL }, 172 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_logging) }, 173 "nat_logging", 0, 1, 174 stsizeof(ipf_nat_softc_t, ipf_nat_logging), 175 0, NULL, NULL }, 176 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_doflush) }, 177 "nat_doflush", 0, 1, 178 stsizeof(ipf_nat_softc_t, ipf_nat_doflush), 179 0, NULL, NULL }, 180 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_wm_low) }, 181 "nat_table_wm_low", 1, 99, 182 stsizeof(ipf_nat_softc_t, ipf_nat_table_wm_low), 183 0, NULL, NULL }, 184 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_wm_high) }, 185 "nat_table_wm_high", 2, 100, 186 stsizeof(ipf_nat_softc_t, ipf_nat_table_wm_high), 187 0, NULL, NULL }, 188 { { 0 }, 189 NULL, 0, 0, 190 0, 191 0, NULL, NULL } 192 }; 193 194 /* ======================================================================== */ 195 /* How the NAT is organised and works. */ 196 /* */ 197 /* Inside (interface y) NAT Outside (interface x) */ 198 /* -------------------- -+- ------------------------------------- */ 199 /* Packet going | out, processsed by ipf_nat_checkout() for x */ 200 /* ------------> | ------------> */ 201 /* src=10.1.1.1 | src=192.1.1.1 */ 202 /* | */ 203 /* | in, processed by ipf_nat_checkin() for x */ 204 /* <------------ | <------------ */ 205 /* dst=10.1.1.1 | dst=192.1.1.1 */ 206 /* -------------------- -+- ------------------------------------- */ 207 /* ipf_nat_checkout() - changes ip_src and if required, sport */ 208 /* - creates a new mapping, if required. */ 209 /* ipf_nat_checkin() - changes ip_dst and if required, dport */ 210 /* */ 211 /* In the NAT table, internal source is recorded as "in" and externally */ 212 /* seen as "out". */ 213 /* ======================================================================== */ 214 215 216 #if SOLARIS && !defined(INSTANCES) 217 extern int pfil_delayed_copy; 218 #endif 219 220 static int ipf_nat_flush_entry(ipf_main_softc_t *, void *); 221 static int ipf_nat_getent(ipf_main_softc_t *, void *, int); 222 static int ipf_nat_getsz(ipf_main_softc_t *, void *, int); 223 static int ipf_nat_putent(ipf_main_softc_t *, void *, int); 224 static void ipf_nat_add_active(int, u_32_t *); 225 static void ipf_nat_add_map_mask(ipf_nat_softc_t *, int); 226 static void ipf_nat_add_rdr_mask(ipf_nat_softc_t *, int); 227 static void ipf_nat_addencap(ipf_nat_softc_t *, ipnat_t *); 228 static void ipf_nat_addmap(ipf_nat_softc_t *, ipnat_t *); 229 static void ipf_nat_addrdr(ipf_nat_softc_t *, ipnat_t *); 230 static int ipf_nat_builddivertmp(ipf_nat_softc_t *, ipnat_t *); 231 static int ipf_nat_clearlist(ipf_main_softc_t *, ipf_nat_softc_t *); 232 static int ipf_nat_cmp_rules(ipnat_t *, ipnat_t *); 233 static int ipf_nat_decap(fr_info_t *, nat_t *); 234 static void ipf_nat_del_active(int, u_32_t *); 235 static void ipf_nat_del_map_mask(ipf_nat_softc_t *, int); 236 static void ipf_nat_del_rdr_mask(ipf_nat_softc_t *, int); 237 static int ipf_nat_encapok(fr_info_t *, nat_t *); 238 static int ipf_nat_extraflush(ipf_main_softc_t *, ipf_nat_softc_t *, int); 239 static int ipf_nat_finalise(fr_info_t *, nat_t *); 240 static int ipf_nat_flushtable(ipf_main_softc_t *, ipf_nat_softc_t *); 241 static void ipf_nat_free_rule(ipf_main_softc_t *, ipf_nat_softc_t *, 242 ipnat_t *); 243 static int ipf_nat_getnext(ipf_main_softc_t *, ipftoken_t *, 244 ipfgeniter_t *, ipfobj_t *); 245 static int ipf_nat_gettable(ipf_main_softc_t *, ipf_nat_softc_t *, char *); 246 static hostmap_t *ipf_nat_hostmap(ipf_nat_softc_t *, ipnat_t *, 247 struct in_addr, struct in_addr, 248 struct in_addr, u_32_t); 249 static int ipf_nat_icmpquerytype(int); 250 static int ipf_nat_iterator(ipf_main_softc_t *, ipftoken_t *, 251 ipfgeniter_t *, ipfobj_t *); 252 static int ipf_nat_match(fr_info_t *, ipnat_t *); 253 static int ipf_nat_matcharray(nat_t *, int *, u_long); 254 static int ipf_nat_matchencap(ipf_nat_softc_t *, fr_info_t *, ipnat_t *); 255 static int ipf_nat_matchflush(ipf_main_softc_t *, ipf_nat_softc_t *, 256 void *); 257 static void ipf_nat_mssclamp(tcphdr_t *, u_32_t, fr_info_t *, u_short *); 258 static int ipf_nat_newmap(fr_info_t *, nat_t *, natinfo_t *); 259 static int ipf_nat_newdivert(fr_info_t *, nat_t *, natinfo_t *); 260 static int ipf_nat_newrdr(fr_info_t *, nat_t *, natinfo_t *); 261 static int ipf_nat_newrewrite(fr_info_t *, nat_t *, natinfo_t *); 262 static int ipf_nat_nextaddr(fr_info_t *, nat_addr_t *, u_32_t *, u_32_t *); 263 static int ipf_nat_nextaddrinit(ipf_main_softc_t *, char *, 264 nat_addr_t *, int, void *); 265 static nat_t *ipf_nat_rebuildencapicmp(fr_info_t *, nat_t *); 266 static int ipf_nat_resolverule(ipf_main_softc_t *, ipnat_t *); 267 static int ipf_nat_ruleaddrinit(ipf_main_softc_t *, 268 ipf_nat_softc_t *, ipnat_t *); 269 static int ipf_nat_siocaddnat(ipf_main_softc_t *, ipf_nat_softc_t *, 270 ipnat_t *, ipnat_t **, int); 271 static void ipf_nat_siocdelnat(ipf_main_softc_t *, ipf_nat_softc_t *, 272 ipnat_t *, ipnat_t **, int); 273 static void ipf_nat_tabmove(ipf_nat_softc_t *, nat_t *); 274 275 /* ------------------------------------------------------------------------ */ 276 /* Function: ipf_nat_main_load */ 277 /* Returns: int - 0 == success, -1 == failure */ 278 /* Parameters: Nil */ 279 /* */ 280 /* The only global NAT structure that needs to be initialised is the filter */ 281 /* rule that is used with blocking packets. */ 282 /* ------------------------------------------------------------------------ */ 283 int 284 ipf_nat_main_load(void) 285 { 286 bzero((char *)&ipfnatblock, sizeof(ipfnatblock)); 287 ipfnatblock.fr_flags = FR_BLOCK|FR_QUICK; 288 ipfnatblock.fr_ref = 1; 289 290 return 0; 291 } 292 293 294 /* ------------------------------------------------------------------------ */ 295 /* Function: ipf_nat_main_unload */ 296 /* Returns: int - 0 == success, -1 == failure */ 297 /* Parameters: Nil */ 298 /* */ 299 /* A null-op function that exists as a placeholder so that the flow in */ 300 /* other functions is obvious. */ 301 /* ------------------------------------------------------------------------ */ 302 int 303 ipf_nat_main_unload(void) 304 { 305 return 0; 306 } 307 308 309 /* ------------------------------------------------------------------------ */ 310 /* Function: ipf_nat_soft_create */ 311 /* Returns: void * - NULL = failure, else pointer to NAT context */ 312 /* Parameters: softc(I) - pointer to soft context main structure */ 313 /* */ 314 /* Allocate the initial soft context structure for NAT and populate it with */ 315 /* some default values. Creating the tables is left until we call _init so */ 316 /* that sizes can be changed before we get under way. */ 317 /* ------------------------------------------------------------------------ */ 318 void * 319 ipf_nat_soft_create(ipf_main_softc_t *softc) 320 { 321 ipf_nat_softc_t *softn; 322 323 KMALLOC(softn, ipf_nat_softc_t *); 324 if (softn == NULL) 325 return NULL; 326 327 bzero((char *)softn, sizeof(*softn)); 328 329 softn->ipf_nat_tune = ipf_tune_array_copy(softn, 330 sizeof(ipf_nat_tuneables), 331 ipf_nat_tuneables); 332 if (softn->ipf_nat_tune == NULL) { 333 ipf_nat_soft_destroy(softc, softn); 334 return NULL; 335 } 336 if (ipf_tune_array_link(softc, softn->ipf_nat_tune) == -1) { 337 ipf_nat_soft_destroy(softc, softn); 338 return NULL; 339 } 340 341 softn->ipf_nat_table_max = NAT_TABLE_MAX; 342 softn->ipf_nat_table_sz = NAT_TABLE_SZ; 343 softn->ipf_nat_maprules_sz = NAT_SIZE; 344 softn->ipf_nat_rdrrules_sz = RDR_SIZE; 345 softn->ipf_nat_hostmap_sz = HOSTMAP_SIZE; 346 softn->ipf_nat_doflush = 0; 347 #ifdef IPFILTER_LOG 348 softn->ipf_nat_logging = 1; 349 #else 350 softn->ipf_nat_logging = 0; 351 #endif 352 353 softn->ipf_nat_defage = DEF_NAT_AGE; 354 softn->ipf_nat_defipage = IPF_TTLVAL(60); 355 softn->ipf_nat_deficmpage = IPF_TTLVAL(3); 356 softn->ipf_nat_table_wm_high = 99; 357 softn->ipf_nat_table_wm_low = 90; 358 359 return softn; 360 } 361 362 /* ------------------------------------------------------------------------ */ 363 /* Function: ipf_nat_soft_destroy */ 364 /* Returns: Nil */ 365 /* Parameters: softc(I) - pointer to soft context main structure */ 366 /* */ 367 /* ------------------------------------------------------------------------ */ 368 void 369 ipf_nat_soft_destroy(ipf_main_softc_t *softc, void *arg) 370 { 371 ipf_nat_softc_t *softn = arg; 372 373 if (softn->ipf_nat_tune != NULL) { 374 ipf_tune_array_unlink(softc, softn->ipf_nat_tune); 375 KFREES(softn->ipf_nat_tune, sizeof(ipf_nat_tuneables)); 376 softn->ipf_nat_tune = NULL; 377 } 378 379 KFREE(softn); 380 } 381 382 383 /* ------------------------------------------------------------------------ */ 384 /* Function: ipf_nat_init */ 385 /* Returns: int - 0 == success, -1 == failure */ 386 /* Parameters: softc(I) - pointer to soft context main structure */ 387 /* */ 388 /* Initialise all of the NAT locks, tables and other structures. */ 389 /* ------------------------------------------------------------------------ */ 390 int 391 ipf_nat_soft_init(ipf_main_softc_t *softc, void *arg) 392 { 393 ipf_nat_softc_t *softn = arg; 394 ipftq_t *tq; 395 int i; 396 397 KMALLOCS(softn->ipf_nat_table[0], nat_t **, \ 398 sizeof(nat_t *) * softn->ipf_nat_table_sz); 399 400 if (softn->ipf_nat_table[0] != NULL) { 401 bzero((char *)softn->ipf_nat_table[0], 402 softn->ipf_nat_table_sz * sizeof(nat_t *)); 403 } else { 404 return -1; 405 } 406 407 KMALLOCS(softn->ipf_nat_table[1], nat_t **, \ 408 sizeof(nat_t *) * softn->ipf_nat_table_sz); 409 410 if (softn->ipf_nat_table[1] != NULL) { 411 bzero((char *)softn->ipf_nat_table[1], 412 softn->ipf_nat_table_sz * sizeof(nat_t *)); 413 } else { 414 return -2; 415 } 416 417 KMALLOCS(softn->ipf_nat_map_rules, ipnat_t **, \ 418 sizeof(ipnat_t *) * softn->ipf_nat_maprules_sz); 419 420 if (softn->ipf_nat_map_rules != NULL) { 421 bzero((char *)softn->ipf_nat_map_rules, 422 softn->ipf_nat_maprules_sz * sizeof(ipnat_t *)); 423 } else { 424 return -3; 425 } 426 427 KMALLOCS(softn->ipf_nat_rdr_rules, ipnat_t **, \ 428 sizeof(ipnat_t *) * softn->ipf_nat_rdrrules_sz); 429 430 if (softn->ipf_nat_rdr_rules != NULL) { 431 bzero((char *)softn->ipf_nat_rdr_rules, 432 softn->ipf_nat_rdrrules_sz * sizeof(ipnat_t *)); 433 } else { 434 return -4; 435 } 436 437 KMALLOCS(softn->ipf_hm_maptable, hostmap_t **, \ 438 sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz); 439 440 if (softn->ipf_hm_maptable != NULL) { 441 bzero((char *)softn->ipf_hm_maptable, 442 sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz); 443 } else { 444 return -5; 445 } 446 softn->ipf_hm_maplist = NULL; 447 448 KMALLOCS(softn->ipf_nat_stats.ns_side[0].ns_bucketlen, u_int *, 449 softn->ipf_nat_table_sz * sizeof(u_int)); 450 451 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen == NULL) { 452 return -6; 453 } 454 bzero((char *)softn->ipf_nat_stats.ns_side[0].ns_bucketlen, 455 softn->ipf_nat_table_sz * sizeof(u_int)); 456 457 KMALLOCS(softn->ipf_nat_stats.ns_side[1].ns_bucketlen, u_int *, 458 softn->ipf_nat_table_sz * sizeof(u_int)); 459 460 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen == NULL) { 461 return -7; 462 } 463 464 bzero((char *)softn->ipf_nat_stats.ns_side[1].ns_bucketlen, 465 softn->ipf_nat_table_sz * sizeof(u_int)); 466 467 if (softn->ipf_nat_maxbucket == 0) { 468 for (i = softn->ipf_nat_table_sz; i > 0; i >>= 1) 469 softn->ipf_nat_maxbucket++; 470 softn->ipf_nat_maxbucket *= 2; 471 } 472 473 ipf_sttab_init(softc, softn->ipf_nat_tcptq); 474 /* 475 * Increase this because we may have "keep state" following this too 476 * and packet storms can occur if this is removed too quickly. 477 */ 478 softn->ipf_nat_tcptq[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcplastack; 479 softn->ipf_nat_tcptq[IPF_TCP_NSTATES - 1].ifq_next = 480 &softn->ipf_nat_udptq; 481 482 IPFTQ_INIT(&softn->ipf_nat_udptq, softn->ipf_nat_defage, 483 "nat ipftq udp tab"); 484 softn->ipf_nat_udptq.ifq_next = &softn->ipf_nat_udpacktq; 485 486 IPFTQ_INIT(&softn->ipf_nat_udpacktq, softn->ipf_nat_defage, 487 "nat ipftq udpack tab"); 488 softn->ipf_nat_udpacktq.ifq_next = &softn->ipf_nat_icmptq; 489 490 IPFTQ_INIT(&softn->ipf_nat_icmptq, softn->ipf_nat_deficmpage, 491 "nat icmp ipftq tab"); 492 softn->ipf_nat_icmptq.ifq_next = &softn->ipf_nat_icmpacktq; 493 494 IPFTQ_INIT(&softn->ipf_nat_icmpacktq, softn->ipf_nat_defage, 495 "nat icmpack ipftq tab"); 496 softn->ipf_nat_icmpacktq.ifq_next = &softn->ipf_nat_iptq; 497 498 IPFTQ_INIT(&softn->ipf_nat_iptq, softn->ipf_nat_defipage, 499 "nat ip ipftq tab"); 500 softn->ipf_nat_iptq.ifq_next = &softn->ipf_nat_pending; 501 502 IPFTQ_INIT(&softn->ipf_nat_pending, 1, "nat pending ipftq tab"); 503 softn->ipf_nat_pending.ifq_next = NULL; 504 505 for (i = 0, tq = softn->ipf_nat_tcptq; i < IPF_TCP_NSTATES; i++, tq++) { 506 if (tq->ifq_ttl < softn->ipf_nat_deficmpage) 507 tq->ifq_ttl = softn->ipf_nat_deficmpage; 508 #ifdef LARGE_NAT 509 else if (tq->ifq_ttl > softn->ipf_nat_defage) 510 tq->ifq_ttl = softn->ipf_nat_defage; 511 #endif 512 } 513 514 /* 515 * Increase this because we may have "keep state" following 516 * this too and packet storms can occur if this is removed 517 * too quickly. 518 */ 519 softn->ipf_nat_tcptq[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcplastack; 520 521 MUTEX_INIT(&softn->ipf_nat_new, "ipf nat new mutex"); 522 MUTEX_INIT(&softn->ipf_nat_io, "ipf nat io mutex"); 523 524 softn->ipf_nat_inited = 1; 525 526 return 0; 527 } 528 529 530 /* ------------------------------------------------------------------------ */ 531 /* Function: ipf_nat_soft_fini */ 532 /* Returns: Nil */ 533 /* Parameters: softc(I) - pointer to soft context main structure */ 534 /* */ 535 /* Free all memory used by NAT structures allocated at runtime. */ 536 /* ------------------------------------------------------------------------ */ 537 int 538 ipf_nat_soft_fini(ipf_main_softc_t *softc, void *arg) 539 { 540 ipf_nat_softc_t *softn = arg; 541 ipftq_t *ifq, *ifqnext; 542 543 (void) ipf_nat_clearlist(softc, softn); 544 (void) ipf_nat_flushtable(softc, softn); 545 546 /* 547 * Proxy timeout queues are not cleaned here because although they 548 * exist on the NAT list, ipf_proxy_unload is called after unload 549 * and the proxies actually are responsible for them being created. 550 * Should the proxy timeouts have their own list? There's no real 551 * justification as this is the only complication. 552 */ 553 for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifqnext) { 554 ifqnext = ifq->ifq_next; 555 if (ipf_deletetimeoutqueue(ifq) == 0) 556 ipf_freetimeoutqueue(softc, ifq); 557 } 558 559 if (softn->ipf_nat_table[0] != NULL) { 560 KFREES(softn->ipf_nat_table[0], 561 sizeof(nat_t *) * softn->ipf_nat_table_sz); 562 softn->ipf_nat_table[0] = NULL; 563 } 564 if (softn->ipf_nat_table[1] != NULL) { 565 KFREES(softn->ipf_nat_table[1], 566 sizeof(nat_t *) * softn->ipf_nat_table_sz); 567 softn->ipf_nat_table[1] = NULL; 568 } 569 if (softn->ipf_nat_map_rules != NULL) { 570 KFREES(softn->ipf_nat_map_rules, 571 sizeof(ipnat_t *) * softn->ipf_nat_maprules_sz); 572 softn->ipf_nat_map_rules = NULL; 573 } 574 if (softn->ipf_nat_rdr_rules != NULL) { 575 KFREES(softn->ipf_nat_rdr_rules, 576 sizeof(ipnat_t *) * softn->ipf_nat_rdrrules_sz); 577 softn->ipf_nat_rdr_rules = NULL; 578 } 579 if (softn->ipf_hm_maptable != NULL) { 580 KFREES(softn->ipf_hm_maptable, 581 sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz); 582 softn->ipf_hm_maptable = NULL; 583 } 584 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen != NULL) { 585 KFREES(softn->ipf_nat_stats.ns_side[0].ns_bucketlen, 586 sizeof(u_int) * softn->ipf_nat_table_sz); 587 softn->ipf_nat_stats.ns_side[0].ns_bucketlen = NULL; 588 } 589 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen != NULL) { 590 KFREES(softn->ipf_nat_stats.ns_side[1].ns_bucketlen, 591 sizeof(u_int) * softn->ipf_nat_table_sz); 592 softn->ipf_nat_stats.ns_side[1].ns_bucketlen = NULL; 593 } 594 595 if (softn->ipf_nat_inited == 1) { 596 softn->ipf_nat_inited = 0; 597 ipf_sttab_destroy(softn->ipf_nat_tcptq); 598 599 MUTEX_DESTROY(&softn->ipf_nat_new); 600 MUTEX_DESTROY(&softn->ipf_nat_io); 601 602 MUTEX_DESTROY(&softn->ipf_nat_udptq.ifq_lock); 603 MUTEX_DESTROY(&softn->ipf_nat_udpacktq.ifq_lock); 604 MUTEX_DESTROY(&softn->ipf_nat_icmptq.ifq_lock); 605 MUTEX_DESTROY(&softn->ipf_nat_icmpacktq.ifq_lock); 606 MUTEX_DESTROY(&softn->ipf_nat_iptq.ifq_lock); 607 MUTEX_DESTROY(&softn->ipf_nat_pending.ifq_lock); 608 } 609 610 return 0; 611 } 612 613 614 /* ------------------------------------------------------------------------ */ 615 /* Function: ipf_nat_setlock */ 616 /* Returns: Nil */ 617 /* Parameters: arg(I) - pointer to soft state information */ 618 /* tmp(I) - new lock value */ 619 /* */ 620 /* Set the "lock status" of NAT to the value in tmp. */ 621 /* ------------------------------------------------------------------------ */ 622 void 623 ipf_nat_setlock(void *arg, int tmp) 624 { 625 ipf_nat_softc_t *softn = arg; 626 627 softn->ipf_nat_lock = tmp; 628 } 629 630 631 /* ------------------------------------------------------------------------ */ 632 /* Function: ipf_nat_add_active */ 633 /* Returns: Nil */ 634 /* Parameters: bitcount(I) - number of bits set in the netmask */ 635 /* active(O) - array to insert the new bitmask into */ 636 /* */ 637 /* Insert the 32bit bitmask represented by "bitcount" into the array of */ 638 /* active netmasks at active[]. The array should never have a duplicate of */ 639 /* any particular mask, except for "0". */ 640 /* ------------------------------------------------------------------------ */ 641 static void 642 ipf_nat_add_active(int bitcount, u_32_t *active) 643 { 644 u_32_t mask = 0xffffffff << (32 - bitcount); 645 int i; 646 647 for (i = 0; i < 33; i++) { 648 if (ntohl(active[i]) < mask) { 649 int j; 650 651 for (j = i + 1; j < 33; j++) 652 active[j] = active[j - 1]; 653 active[i] = htonl(mask); 654 break; 655 } 656 } 657 } 658 659 660 /* ------------------------------------------------------------------------ */ 661 /* Function: ipf_nat_del_active */ 662 /* Returns: Nil */ 663 /* Parameters: bitcount(I) - number of bits set in the netmask */ 664 /* active(O) - array to remove the bitmask from */ 665 /* */ 666 /* REmove the 32bit bitmask represented by "bitcount" from the array of */ 667 /* active netmasks at active[]. */ 668 /* ------------------------------------------------------------------------ */ 669 static void 670 ipf_nat_del_active(int bitcount, u_32_t *active) 671 { 672 u_32_t mask = htonl(0xffffffff << (32 - bitcount)); 673 int i; 674 675 for (i = 0; i < 33; i++) { 676 if (active[i] == mask) { 677 int j; 678 679 for (j = i + 1; j < 33; j++) 680 active[j - 1] = active[j]; 681 break; 682 } 683 } 684 } 685 686 687 /* ------------------------------------------------------------------------ */ 688 /* Function: ipf_nat_add_map_mask */ 689 /* Returns: Nil */ 690 /* Parameters: softn(I) - pointer to nat context information */ 691 /* bitcount(I) - bitcount of mask to add */ 692 /* */ 693 /* When called, bitcount represents the mask of a new map rule that has */ 694 /* just been added. This function inserts the bitmask into the array of */ 695 /* masks to search when searching for a matching map rule for a packet. */ 696 /* ------------------------------------------------------------------------ */ 697 static void 698 ipf_nat_add_map_mask(ipf_nat_softc_t *softn, int bitcount) 699 { 700 ipf_nat_add_active(bitcount, softn->ipf_nat_map_active_masks); 701 softn->ipf_nat_map_max++; 702 } 703 704 705 /* ------------------------------------------------------------------------ */ 706 /* Function: ipf_nat_add_rdr_mask */ 707 /* Returns: Nil */ 708 /* Parameters: softn(I) - pointer to nat context information */ 709 /* bitcount(I) - bitcount of mask to add */ 710 /* */ 711 /* When called, bitcount represents the mask of a new rdr rule that has */ 712 /* just been added. This function inserts the bitmask into the array of */ 713 /* masks to search when searching for a matching rdr rule for a packet. */ 714 /* ------------------------------------------------------------------------ */ 715 static void 716 ipf_nat_add_rdr_mask(ipf_nat_softc_t *softn, int bitcount) 717 { 718 ipf_nat_add_active(bitcount, softn->ipf_nat_rdr_active_masks); 719 softn->ipf_nat_rdr_max++; 720 } 721 722 723 /* ------------------------------------------------------------------------ */ 724 /* Function: ipf_nat_del_map_mask */ 725 /* Returns: Nil */ 726 /* Parameters: softn(I) - pointer to nat context information */ 727 /* bitcount(I) - bitcount of mask to add */ 728 /* */ 729 /* This function performs the opposite action to ipf_nat_add_map_mask by */ 730 /* removing the mask described by bitcount from the active mask array. */ 731 /* ------------------------------------------------------------------------ */ 732 static void 733 ipf_nat_del_map_mask(ipf_nat_softc_t *softn, int bitcount) 734 { 735 ipf_nat_del_active(bitcount, softn->ipf_nat_map_active_masks); 736 softn->ipf_nat_map_max--; 737 } 738 739 740 /* ------------------------------------------------------------------------ */ 741 /* Function: ipf_nat_del_rdr_mask */ 742 /* Returns: Nil */ 743 /* Parameters: softn(I) - pointer to nat context information */ 744 /* bitcount(I) - bitcount of mask to add */ 745 /* */ 746 /* This function performs the opposite action to ipf_nat_add_rdr_mask by */ 747 /* removing the mask described by bitcount from the active mask array. */ 748 /* ------------------------------------------------------------------------ */ 749 static void 750 ipf_nat_del_rdr_mask(ipf_nat_softc_t *softn, int bitcount) 751 { 752 ipf_nat_del_active(bitcount, softn->ipf_nat_rdr_active_masks); 753 softn->ipf_nat_rdr_max--; 754 } 755 756 757 /* ------------------------------------------------------------------------ */ 758 /* Function: ipf_nat_addrdr */ 759 /* Returns: Nil */ 760 /* Parameters: n(I) - pointer to NAT rule to add */ 761 /* */ 762 /* Adds a redirect rule to the hash table of redirect rules and the list of */ 763 /* loaded NAT rules. Updates the bitmask indicating which netmasks are in */ 764 /* use by redirect rules. */ 765 /* ------------------------------------------------------------------------ */ 766 static void 767 ipf_nat_addrdr(ipf_nat_softc_t *softn, ipnat_t *n) 768 { 769 ipnat_t **np; 770 u_32_t j; 771 u_int hv; 772 u_int rhv; 773 int k; 774 775 if (n->in_odstatype == FRI_NORMAL) { 776 k = count4bits(n->in_odstmsk); 777 softn->ipf_nat_rdr_masks[k]++; 778 if (softn->ipf_nat_rdr_masks[k] == 1) 779 ipf_nat_add_rdr_mask(softn, k); 780 j = (n->in_odstaddr & n->in_odstmsk); 781 rhv = NAT_HASH_FN(j, 0, 0xffffffff); 782 } else { 783 softn->ipf_nat_rdr_masks[0]++; 784 if (softn->ipf_nat_rdr_masks[0] == 1) 785 ipf_nat_add_rdr_mask(softn, 0); 786 j = 0; 787 rhv = 0; 788 } 789 hv = rhv % softn->ipf_nat_rdrrules_sz; 790 np = softn->ipf_nat_rdr_rules + hv; 791 while (*np != NULL) 792 np = &(*np)->in_rnext; 793 n->in_rnext = NULL; 794 n->in_prnext = np; 795 n->in_hv[0] = hv; 796 *np = n; 797 } 798 799 800 /* ------------------------------------------------------------------------ */ 801 /* Function: ipf_nat_addmap */ 802 /* Returns: Nil */ 803 /* Parameters: n(I) - pointer to NAT rule to add */ 804 /* */ 805 /* Adds a NAT map rule to the hash table of rules and the list of loaded */ 806 /* NAT rules. Updates the bitmask indicating which netmasks are in use by */ 807 /* redirect rules. */ 808 /* ------------------------------------------------------------------------ */ 809 static void 810 ipf_nat_addmap(ipf_nat_softc_t *softn, ipnat_t *n) 811 { 812 ipnat_t **np; 813 u_32_t j; 814 u_int hv; 815 u_int rhv; 816 int k; 817 818 if (n->in_osrcatype == FRI_NORMAL) { 819 k = count4bits(n->in_osrcmsk); 820 softn->ipf_nat_map_masks[k]++; 821 if (softn->ipf_nat_map_masks[k] == 1) 822 ipf_nat_add_map_mask(softn, k); 823 j = (n->in_osrcaddr & n->in_osrcmsk); 824 rhv = NAT_HASH_FN(j, 0, 0xffffffff); 825 } else { 826 softn->ipf_nat_map_masks[0]++; 827 if (softn->ipf_nat_map_masks[0] == 1) 828 ipf_nat_add_map_mask(softn, 0); 829 j = 0; 830 rhv = 0; 831 } 832 hv = rhv % softn->ipf_nat_maprules_sz; 833 np = softn->ipf_nat_map_rules + hv; 834 while (*np != NULL) 835 np = &(*np)->in_mnext; 836 n->in_mnext = NULL; 837 n->in_pmnext = np; 838 n->in_hv[1] = rhv; 839 *np = n; 840 } 841 842 843 /* ------------------------------------------------------------------------ */ 844 /* Function: ipf_nat_addencap */ 845 /* Returns: Nil */ 846 /* Parameters: n(I) - pointer to NAT rule to add */ 847 /* */ 848 /* Here we add in a pointer in the NAT rules hash table to match reply */ 849 /* packets that are encapsulated. For encap rules that are "out", what we */ 850 /* will want to match upon will be the source address in the encap rule as */ 851 /* this is what will become the destination in packets coming back to us. */ 852 /* For encaps pointing in, it is still the same because it is still the */ 853 /* reply packet we want to match. */ 854 /* ------------------------------------------------------------------------ */ 855 static void 856 ipf_nat_addencap(ipf_nat_softc_t *softn, ipnat_t *n) 857 { 858 ipnat_t **np; 859 u_32_t j; 860 u_int hv, rhv; 861 int k; 862 863 k = -1; 864 865 /* 866 * It is the new source address we're after... 867 */ 868 if (n->in_nsrcatype == FRI_NORMAL) { 869 k = count4bits(n->in_nsrcmsk); 870 j = (n->in_nsrcaddr & n->in_nsrcmsk); 871 rhv = NAT_HASH_FN(j, 0, 0xffffffff); 872 } else { 873 j = 0; 874 rhv = 0; 875 } 876 877 /* 878 * And place the rules table entry in the reverse spot, so for out 879 * we use the rdr-links and for rdr, we use the map-links. This is 880 * the reverse of how it is used elsewhere... 881 */ 882 if (n->in_redir & NAT_MAP) { 883 softn->ipf_nat_rdr_masks[k]++; 884 if (softn->ipf_nat_rdr_masks[k] == 1) 885 ipf_nat_add_rdr_mask(softn, k); 886 hv = rhv % softn->ipf_nat_maprules_sz; 887 np = softn->ipf_nat_rdr_rules + hv; 888 while (*np != NULL) 889 np = &(*np)->in_rnext; 890 n->in_rnext = NULL; 891 n->in_prnext = np; 892 n->in_hv[0] = rhv; 893 *np = n; 894 } 895 if (n->in_redir & NAT_REDIRECT) { 896 softn->ipf_nat_map_masks[k]++; 897 if (softn->ipf_nat_map_masks[k] == 1) 898 ipf_nat_add_map_mask(softn, k); 899 hv = rhv % softn->ipf_nat_rdrrules_sz; 900 np = softn->ipf_nat_map_rules + hv; 901 while (*np != NULL) 902 np = &(*np)->in_mnext; 903 n->in_mnext = NULL; 904 n->in_pmnext = np; 905 n->in_hv[1] = rhv; 906 *np = n; 907 } 908 909 /* TRACE(n, hv, k) */ 910 } 911 912 913 /* ------------------------------------------------------------------------ */ 914 /* Function: ipf_nat_delrdr */ 915 /* Returns: Nil */ 916 /* Parameters: n(I) - pointer to NAT rule to delete */ 917 /* */ 918 /* Removes a redirect rule from the hash table of redirect rules. */ 919 /* ------------------------------------------------------------------------ */ 920 void 921 ipf_nat_delrdr(ipf_nat_softc_t *softn, ipnat_t *n) 922 { 923 if (n->in_odstatype == FRI_NORMAL) { 924 int k = count4bits(n->in_odstmsk); 925 softn->ipf_nat_rdr_masks[k]--; 926 if (softn->ipf_nat_rdr_masks[k] == 0) 927 ipf_nat_del_rdr_mask(softn, k); 928 } else { 929 softn->ipf_nat_rdr_masks[0]--; 930 if (softn->ipf_nat_rdr_masks[0] == 0) 931 ipf_nat_del_rdr_mask(softn, 0); 932 } 933 if (n->in_rnext) 934 n->in_rnext->in_prnext = n->in_prnext; 935 *n->in_prnext = n->in_rnext; 936 } 937 938 939 /* ------------------------------------------------------------------------ */ 940 /* Function: ipf_nat_delmap */ 941 /* Returns: Nil */ 942 /* Parameters: n(I) - pointer to NAT rule to delete */ 943 /* */ 944 /* Removes a NAT map rule from the hash table of NAT map rules. */ 945 /* ------------------------------------------------------------------------ */ 946 void 947 ipf_nat_delmap(ipf_nat_softc_t *softn, ipnat_t *n) 948 { 949 if (n->in_osrcatype == FRI_NORMAL) { 950 int k = count4bits(n->in_osrcmsk); 951 softn->ipf_nat_map_masks[k]--; 952 if (softn->ipf_nat_map_masks[k] == 0) 953 ipf_nat_del_map_mask(softn, k); 954 } else { 955 softn->ipf_nat_map_masks[0]--; 956 if (softn->ipf_nat_map_masks[0] == 0) 957 ipf_nat_del_map_mask(softn, 0); 958 } 959 if (n->in_mnext != NULL) 960 n->in_mnext->in_pmnext = n->in_pmnext; 961 *n->in_pmnext = n->in_mnext; 962 } 963 964 965 /* ------------------------------------------------------------------------ */ 966 /* Function: ipf_nat_hostmap */ 967 /* Returns: struct hostmap* - NULL if no hostmap could be created, */ 968 /* else a pointer to the hostmapping to use */ 969 /* Parameters: np(I) - pointer to NAT rule */ 970 /* real(I) - real IP address */ 971 /* map(I) - mapped IP address */ 972 /* port(I) - destination port number */ 973 /* Write Locks: ipf_nat */ 974 /* */ 975 /* Check if an ip address has already been allocated for a given mapping */ 976 /* that is not doing port based translation. If is not yet allocated, then */ 977 /* create a new entry if a non-NULL NAT rule pointer has been supplied. */ 978 /* ------------------------------------------------------------------------ */ 979 static struct hostmap * 980 ipf_nat_hostmap(ipf_nat_softc_t *softn, ipnat_t *np, struct in_addr src, 981 struct in_addr dst, struct in_addr map, u_32_t port) 982 { 983 hostmap_t *hm; 984 u_int hv, rhv; 985 986 hv = (src.s_addr ^ dst.s_addr); 987 hv += src.s_addr; 988 hv += dst.s_addr; 989 rhv = hv; 990 hv %= softn->ipf_nat_hostmap_sz; 991 for (hm = softn->ipf_hm_maptable[hv]; hm; hm = hm->hm_hnext) 992 if ((hm->hm_osrcip.s_addr == src.s_addr) && 993 (hm->hm_odstip.s_addr == dst.s_addr) && 994 ((np == NULL) || (np == hm->hm_ipnat)) && 995 ((port == 0) || (port == hm->hm_port))) { 996 softn->ipf_nat_stats.ns_hm_addref++; 997 hm->hm_ref++; 998 return hm; 999 } 1000 1001 if (np == NULL) { 1002 softn->ipf_nat_stats.ns_hm_nullnp++; 1003 return NULL; 1004 } 1005 1006 KMALLOC(hm, hostmap_t *); 1007 if (hm) { 1008 hm->hm_next = softn->ipf_hm_maplist; 1009 hm->hm_pnext = &softn->ipf_hm_maplist; 1010 if (softn->ipf_hm_maplist != NULL) 1011 softn->ipf_hm_maplist->hm_pnext = &hm->hm_next; 1012 softn->ipf_hm_maplist = hm; 1013 hm->hm_hnext = softn->ipf_hm_maptable[hv]; 1014 hm->hm_phnext = softn->ipf_hm_maptable + hv; 1015 if (softn->ipf_hm_maptable[hv] != NULL) 1016 softn->ipf_hm_maptable[hv]->hm_phnext = &hm->hm_hnext; 1017 softn->ipf_hm_maptable[hv] = hm; 1018 hm->hm_ipnat = np; 1019 hm->hm_osrcip = src; 1020 hm->hm_odstip = dst; 1021 hm->hm_nsrcip = map; 1022 hm->hm_ndstip.s_addr = 0; 1023 hm->hm_ref = 1; 1024 hm->hm_port = port; 1025 hm->hm_hv = rhv; 1026 hm->hm_v = 4; 1027 softn->ipf_nat_stats.ns_hm_new++; 1028 } else { 1029 softn->ipf_nat_stats.ns_hm_newfail++; 1030 } 1031 return hm; 1032 } 1033 1034 1035 /* ------------------------------------------------------------------------ */ 1036 /* Function: ipf_nat_hostmapdel */ 1037 /* Returns: Nil */ 1038 /* Parameters: hmp(I) - pointer to hostmap structure pointer */ 1039 /* Write Locks: ipf_nat */ 1040 /* */ 1041 /* Decrement the references to this hostmap structure by one. If this */ 1042 /* reaches zero then remove it and free it. */ 1043 /* ------------------------------------------------------------------------ */ 1044 void 1045 ipf_nat_hostmapdel(struct hostmap **hmp) 1046 { 1047 struct hostmap *hm; 1048 1049 hm = *hmp; 1050 *hmp = NULL; 1051 1052 hm->hm_ref--; 1053 if (hm->hm_ref == 0) { 1054 if (hm->hm_hnext) 1055 hm->hm_hnext->hm_phnext = hm->hm_phnext; 1056 *hm->hm_phnext = hm->hm_hnext; 1057 if (hm->hm_next) 1058 hm->hm_next->hm_pnext = hm->hm_pnext; 1059 *hm->hm_pnext = hm->hm_next; 1060 KFREE(hm); 1061 } 1062 } 1063 1064 1065 /* ------------------------------------------------------------------------ */ 1066 /* Function: ipf_fix_outcksum */ 1067 /* Returns: Nil */ 1068 /* Parameters: fin(I) - pointer to packet information */ 1069 /* sp(I) - location of 16bit checksum to update */ 1070 /* n((I) - amount to adjust checksum by */ 1071 /* */ 1072 /* Adjusts the 16bit checksum by "n" for packets going out. */ 1073 /* ------------------------------------------------------------------------ */ 1074 void 1075 ipf_fix_outcksum(fr_info_t *fin, u_short *sp, u_32_t n) 1076 { 1077 u_short sumshort; 1078 u_32_t sum1; 1079 1080 if (n == 0) 1081 return; 1082 1083 if (n & NAT_HW_CKSUM) { 1084 # if SOLARIS && defined(_KERNEL) && defined(NET_HCK_NONE) 1085 *sp = (n + htons(fin->fin_dlen)) & 0xffff; 1086 return; 1087 #else 1088 n &= 0xffff; 1089 n += fin->fin_dlen; 1090 n = (n & 0xffff) + (n >> 16); 1091 *sp = n & 0xffff; 1092 #endif 1093 return; 1094 } 1095 sum1 = (~ntohs(*sp)) & 0xffff; 1096 sum1 += (n); 1097 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 1098 /* Again */ 1099 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 1100 sumshort = ~(u_short)sum1; 1101 *(sp) = htons(sumshort); 1102 } 1103 1104 1105 /* ------------------------------------------------------------------------ */ 1106 /* Function: ipf_fix_incksum */ 1107 /* Returns: Nil */ 1108 /* Parameters: fin(I) - pointer to packet information */ 1109 /* sp(I) - location of 16bit checksum to update */ 1110 /* n((I) - amount to adjust checksum by */ 1111 /* */ 1112 /* Adjusts the 16bit checksum by "n" for packets going in. */ 1113 /* ------------------------------------------------------------------------ */ 1114 void 1115 ipf_fix_incksum(fr_info_t *fin, u_short *sp, u_32_t n) 1116 { 1117 u_short sumshort; 1118 u_32_t sum1; 1119 1120 if (n == 0) 1121 return; 1122 1123 if (n & NAT_HW_CKSUM) { 1124 n &= 0xffff; 1125 n += fin->fin_dlen; 1126 n = (n & 0xffff) + (n >> 16); 1127 *sp = n & 0xffff; 1128 return; 1129 } 1130 sum1 = (~ntohs(*sp)) & 0xffff; 1131 sum1 += ~(n) & 0xffff; 1132 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 1133 /* Again */ 1134 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 1135 sumshort = ~(u_short)sum1; 1136 *(sp) = htons(sumshort); 1137 } 1138 1139 1140 /* ------------------------------------------------------------------------ */ 1141 /* Function: ipf_fix_datacksum */ 1142 /* Returns: Nil */ 1143 /* Parameters: sp(I) - location of 16bit checksum to update */ 1144 /* n((I) - amount to adjust checksum by */ 1145 /* */ 1146 /* Fix_datacksum is used *only* for the adjustments of checksums in the */ 1147 /* data section of an IP packet. */ 1148 /* */ 1149 /* The only situation in which you need to do this is when NAT'ing an */ 1150 /* ICMP error message. Such a message, contains in its body the IP header */ 1151 /* of the original IP packet, that causes the error. */ 1152 /* */ 1153 /* You can't use fix_incksum or fix_outcksum in that case, because for the */ 1154 /* kernel the data section of the ICMP error is just data, and no special */ 1155 /* processing like hardware cksum or ntohs processing have been done by the */ 1156 /* kernel on the data section. */ 1157 /* ------------------------------------------------------------------------ */ 1158 void 1159 ipf_fix_datacksum(u_short *sp, u_32_t n) 1160 { 1161 u_short sumshort; 1162 u_32_t sum1; 1163 1164 if (n == 0) 1165 return; 1166 1167 sum1 = (~ntohs(*sp)) & 0xffff; 1168 sum1 += (n); 1169 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 1170 /* Again */ 1171 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 1172 sumshort = ~(u_short)sum1; 1173 *(sp) = htons(sumshort); 1174 } 1175 1176 1177 /* ------------------------------------------------------------------------ */ 1178 /* Function: ipf_nat_ioctl */ 1179 /* Returns: int - 0 == success, != 0 == failure */ 1180 /* Parameters: data(I) - pointer to ioctl data */ 1181 /* cmd(I) - ioctl command integer */ 1182 /* mode(I) - file mode bits used with open */ 1183 /* */ 1184 /* Processes an ioctl call made to operate on the IP Filter NAT device. */ 1185 /* ------------------------------------------------------------------------ */ 1186 int 1187 ipf_nat_ioctl(ipf_main_softc_t *softc, void *data, ioctlcmd_t cmd, int mode, 1188 int uid, void *ctx) 1189 { 1190 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 1191 ipnat_t *nat, *nt, *n = NULL, **np = NULL; 1192 int error = 0, ret, arg, getlock; 1193 ipnat_t natd; 1194 SPL_INT(s); 1195 1196 #if BSD_GE_YEAR(199306) && defined(_KERNEL) 1197 # if NETBSD_GE_REV(399002000) 1198 if ((mode & FWRITE) && 1199 kauth_authorize_network(curlwp->l_cred, KAUTH_NETWORK_FIREWALL, 1200 KAUTH_REQ_NETWORK_FIREWALL_FW, 1201 NULL, NULL, NULL)) 1202 # else 1203 # if defined(__FreeBSD_version) && (__FreeBSD_version >= 500034) 1204 if (securelevel_ge(curthread->td_ucred, 3) && (mode & FWRITE)) 1205 # else 1206 if ((securelevel >= 3) && (mode & FWRITE)) 1207 # endif 1208 return EPERM; 1209 # endif 1210 { 1211 IPFERROR(60001); 1212 return EPERM; 1213 } 1214 #endif 1215 1216 #if defined(__osf__) && defined(_KERNEL) 1217 getlock = 0; 1218 #else 1219 getlock = (mode & NAT_LOCKHELD) ? 0 : 1; 1220 #endif 1221 1222 nat = NULL; /* XXX gcc -Wuninitialized */ 1223 nt = NULL; 1224 1225 if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) { 1226 if (mode & NAT_SYSSPACE) { 1227 bcopy(data, (char *)&natd, sizeof(natd)); 1228 nat = &natd; 1229 error = 0; 1230 } else { 1231 bzero(&natd, sizeof(natd)); 1232 error = ipf_inobj(softc, data, NULL, &natd, 1233 IPFOBJ_IPNAT); 1234 if (error != 0) 1235 goto done; 1236 1237 if (natd.in_size < sizeof(ipnat_t)) { 1238 error = EINVAL; 1239 goto done; 1240 } 1241 KMALLOCS(nt, ipnat_t *, natd.in_size); 1242 if (nt == NULL) { 1243 IPFERROR(60070); 1244 error = ENOMEM; 1245 goto done; 1246 } 1247 bzero(nt, natd.in_size); 1248 error = ipf_inobjsz(softc, data, nt, IPFOBJ_IPNAT, 1249 natd.in_size); 1250 if (error) 1251 goto done; 1252 nat = nt; 1253 } 1254 1255 /* 1256 * For add/delete, look to see if the NAT entry is 1257 * already present 1258 */ 1259 nat->in_flags &= IPN_USERFLAGS; 1260 if ((nat->in_redir & NAT_MAPBLK) == 0) { 1261 if (nat->in_osrcatype == FRI_NORMAL || 1262 nat->in_osrcatype == FRI_NONE) 1263 nat->in_osrcaddr &= nat->in_osrcmsk; 1264 if (nat->in_odstatype == FRI_NORMAL || 1265 nat->in_odstatype == FRI_NONE) 1266 nat->in_odstaddr &= nat->in_odstmsk; 1267 if ((nat->in_flags & (IPN_SPLIT|IPN_SIPRANGE)) == 0) { 1268 if (nat->in_nsrcatype == FRI_NORMAL) 1269 nat->in_nsrcaddr &= nat->in_nsrcmsk; 1270 if (nat->in_ndstatype == FRI_NORMAL) 1271 nat->in_ndstaddr &= nat->in_ndstmsk; 1272 } 1273 } 1274 MUTEX_ENTER(&softn->ipf_nat_io); 1275 for (np = &softn->ipf_nat_list; ((n = *np) != NULL); 1276 np = &n->in_next) 1277 if (ipf_nat_cmp_rules(nat, n) == 0) 1278 break; 1279 } 1280 1281 switch (cmd) 1282 { 1283 #ifdef IPFILTER_LOG 1284 case SIOCIPFFB : 1285 { 1286 int tmp; 1287 1288 if (!(mode & FWRITE)) { 1289 IPFERROR(60002); 1290 error = EPERM; 1291 } else { 1292 tmp = ipf_log_clear(softc, IPL_LOGNAT); 1293 error = BCOPYOUT(&tmp, data, sizeof(tmp)); 1294 if (error != 0) { 1295 IPFERROR(60057); 1296 error = EFAULT; 1297 } 1298 } 1299 break; 1300 } 1301 1302 case SIOCSETLG : 1303 if (!(mode & FWRITE)) { 1304 IPFERROR(60003); 1305 error = EPERM; 1306 } else { 1307 error = BCOPYIN(data, &softn->ipf_nat_logging, 1308 sizeof(softn->ipf_nat_logging)); 1309 if (error != 0) 1310 error = EFAULT; 1311 } 1312 break; 1313 1314 case SIOCGETLG : 1315 error = BCOPYOUT(&softn->ipf_nat_logging, data, 1316 sizeof(softn->ipf_nat_logging)); 1317 if (error != 0) { 1318 IPFERROR(60004); 1319 error = EFAULT; 1320 } 1321 break; 1322 1323 case FIONREAD : 1324 arg = ipf_log_bytesused(softc, IPL_LOGNAT); 1325 error = BCOPYOUT(&arg, data, sizeof(arg)); 1326 if (error != 0) { 1327 IPFERROR(60005); 1328 error = EFAULT; 1329 } 1330 break; 1331 #endif 1332 case SIOCADNAT : 1333 if (!(mode & FWRITE)) { 1334 IPFERROR(60006); 1335 error = EPERM; 1336 } else if (n != NULL) { 1337 IPFERROR(60007); 1338 error = EEXIST; 1339 } else if (nt == NULL) { 1340 IPFERROR(60008); 1341 error = ENOMEM; 1342 } 1343 if (error != 0) { 1344 MUTEX_EXIT(&softn->ipf_nat_io); 1345 break; 1346 } 1347 if (nat != nt) 1348 bcopy((char *)nat, (char *)nt, sizeof(*n)); 1349 error = ipf_nat_siocaddnat(softc, softn, nt, np, getlock); 1350 MUTEX_EXIT(&softn->ipf_nat_io); 1351 if (error == 0) 1352 nt = NULL; 1353 break; 1354 1355 case SIOCRMNAT : 1356 if (!(mode & FWRITE)) { 1357 IPFERROR(60009); 1358 error = EPERM; 1359 n = NULL; 1360 } else if (n == NULL) { 1361 IPFERROR(60010); 1362 error = ESRCH; 1363 } 1364 1365 if (error != 0) { 1366 MUTEX_EXIT(&softn->ipf_nat_io); 1367 break; 1368 } 1369 ipf_nat_siocdelnat(softc, softn, n, np, getlock); 1370 1371 MUTEX_EXIT(&softn->ipf_nat_io); 1372 n = NULL; 1373 break; 1374 1375 case SIOCGNATS : 1376 { 1377 natstat_t *nsp = &softn->ipf_nat_stats; 1378 1379 nsp->ns_side[0].ns_table = softn->ipf_nat_table[0]; 1380 nsp->ns_side[1].ns_table = softn->ipf_nat_table[1]; 1381 nsp->ns_list = softn->ipf_nat_list; 1382 nsp->ns_maptable = softn->ipf_hm_maptable; 1383 nsp->ns_maplist = softn->ipf_hm_maplist; 1384 nsp->ns_nattab_sz = softn->ipf_nat_table_sz; 1385 nsp->ns_nattab_max = softn->ipf_nat_table_max; 1386 nsp->ns_rultab_sz = softn->ipf_nat_maprules_sz; 1387 nsp->ns_rdrtab_sz = softn->ipf_nat_rdrrules_sz; 1388 nsp->ns_hostmap_sz = softn->ipf_nat_hostmap_sz; 1389 nsp->ns_instances = softn->ipf_nat_instances; 1390 nsp->ns_ticks = softc->ipf_ticks; 1391 #ifdef IPFILTER_LOGGING 1392 nsp->ns_log_ok = ipf_log_logok(softc, IPF_LOGNAT); 1393 nsp->ns_log_fail = ipf_log_failures(softc, IPF_LOGNAT); 1394 #else 1395 nsp->ns_log_ok = 0; 1396 nsp->ns_log_fail = 0; 1397 #endif 1398 error = ipf_outobj(softc, data, nsp, IPFOBJ_NATSTAT); 1399 break; 1400 } 1401 1402 case SIOCGNATL : 1403 { 1404 natlookup_t nl; 1405 1406 error = ipf_inobj(softc, data, NULL, &nl, IPFOBJ_NATLOOKUP); 1407 if (error == 0) { 1408 void *ptr; 1409 1410 if (getlock) { 1411 READ_ENTER(&softc->ipf_nat); 1412 } 1413 1414 switch (nl.nl_v) 1415 { 1416 case 4 : 1417 ptr = ipf_nat_lookupredir(&nl); 1418 break; 1419 #ifdef USE_INET6 1420 case 6 : 1421 ptr = ipf_nat6_lookupredir(&nl); 1422 break; 1423 #endif 1424 default: 1425 ptr = NULL; 1426 break; 1427 } 1428 1429 if (getlock) { 1430 RWLOCK_EXIT(&softc->ipf_nat); 1431 } 1432 if (ptr != NULL) { 1433 error = ipf_outobj(softc, data, &nl, 1434 IPFOBJ_NATLOOKUP); 1435 } else { 1436 IPFERROR(60011); 1437 error = ESRCH; 1438 } 1439 } 1440 break; 1441 } 1442 1443 case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */ 1444 if (!(mode & FWRITE)) { 1445 IPFERROR(60012); 1446 error = EPERM; 1447 break; 1448 } 1449 if (getlock) { 1450 WRITE_ENTER(&softc->ipf_nat); 1451 } 1452 1453 error = BCOPYIN(data, &arg, sizeof(arg)); 1454 if (error != 0) { 1455 IPFERROR(60013); 1456 error = EFAULT; 1457 } else { 1458 if (arg == 0) 1459 ret = ipf_nat_flushtable(softc, softn); 1460 else if (arg == 1) 1461 ret = ipf_nat_clearlist(softc, softn); 1462 else 1463 ret = ipf_nat_extraflush(softc, softn, arg); 1464 ipf_proxy_flush(softc->ipf_proxy_soft, arg); 1465 } 1466 1467 if (getlock) { 1468 RWLOCK_EXIT(&softc->ipf_nat); 1469 } 1470 if (error == 0) { 1471 error = BCOPYOUT(&ret, data, sizeof(ret)); 1472 } 1473 break; 1474 1475 case SIOCMATCHFLUSH : 1476 if (!(mode & FWRITE)) { 1477 IPFERROR(60014); 1478 error = EPERM; 1479 break; 1480 } 1481 if (getlock) { 1482 WRITE_ENTER(&softc->ipf_nat); 1483 } 1484 1485 error = ipf_nat_matchflush(softc, softn, data); 1486 1487 if (getlock) { 1488 RWLOCK_EXIT(&softc->ipf_nat); 1489 } 1490 break; 1491 1492 case SIOCPROXY : 1493 error = ipf_proxy_ioctl(softc, data, cmd, mode, ctx); 1494 break; 1495 1496 case SIOCSTLCK : 1497 if (!(mode & FWRITE)) { 1498 IPFERROR(60015); 1499 error = EPERM; 1500 } else { 1501 error = ipf_lock(data, &softn->ipf_nat_lock); 1502 } 1503 break; 1504 1505 case SIOCSTPUT : 1506 if ((mode & FWRITE) != 0) { 1507 error = ipf_nat_putent(softc, data, getlock); 1508 } else { 1509 IPFERROR(60016); 1510 error = EACCES; 1511 } 1512 break; 1513 1514 case SIOCSTGSZ : 1515 if (softn->ipf_nat_lock) { 1516 error = ipf_nat_getsz(softc, data, getlock); 1517 } else { 1518 IPFERROR(60017); 1519 error = EACCES; 1520 } 1521 break; 1522 1523 case SIOCSTGET : 1524 if (softn->ipf_nat_lock) { 1525 error = ipf_nat_getent(softc, data, getlock); 1526 } else { 1527 IPFERROR(60018); 1528 error = EACCES; 1529 } 1530 break; 1531 1532 case SIOCGENITER : 1533 { 1534 ipfgeniter_t iter; 1535 ipftoken_t *token; 1536 ipfobj_t obj; 1537 1538 error = ipf_inobj(softc, data, &obj, &iter, IPFOBJ_GENITER); 1539 if (error != 0) 1540 break; 1541 1542 SPL_SCHED(s); 1543 token = ipf_token_find(softc, iter.igi_type, uid, ctx); 1544 if (token != NULL) { 1545 error = ipf_nat_iterator(softc, token, &iter, &obj); 1546 WRITE_ENTER(&softc->ipf_tokens); 1547 if (token->ipt_data == NULL) 1548 ipf_token_free(softc, token); 1549 else 1550 ipf_token_deref(softc, token); 1551 RWLOCK_EXIT(&softc->ipf_tokens); 1552 } 1553 SPL_X(s); 1554 break; 1555 } 1556 1557 case SIOCIPFDELTOK : 1558 error = BCOPYIN(data, &arg, sizeof(arg)); 1559 if (error == 0) { 1560 SPL_SCHED(s); 1561 error = ipf_token_del(softc, arg, uid, ctx); 1562 SPL_X(s); 1563 } else { 1564 IPFERROR(60019); 1565 error = EFAULT; 1566 } 1567 break; 1568 1569 case SIOCGTQTAB : 1570 error = ipf_outobj(softc, data, softn->ipf_nat_tcptq, 1571 IPFOBJ_STATETQTAB); 1572 break; 1573 1574 case SIOCGTABL : 1575 error = ipf_nat_gettable(softc, softn, data); 1576 break; 1577 1578 default : 1579 IPFERROR(60020); 1580 error = EINVAL; 1581 break; 1582 } 1583 done: 1584 if (nt != NULL) 1585 KFREES(nt, nt->in_size); 1586 return error; 1587 } 1588 1589 1590 /* ------------------------------------------------------------------------ */ 1591 /* Function: ipf_nat_siocaddnat */ 1592 /* Returns: int - 0 == success, != 0 == failure */ 1593 /* Parameters: n(I) - pointer to new NAT rule */ 1594 /* np(I) - pointer to where to insert new NAT rule */ 1595 /* getlock(I) - flag indicating if lock on is held */ 1596 /* Mutex Locks: ipf_nat_io */ 1597 /* */ 1598 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */ 1599 /* from information passed to the kernel, then add it to the appropriate */ 1600 /* NAT rule table(s). */ 1601 /* ------------------------------------------------------------------------ */ 1602 static int 1603 ipf_nat_siocaddnat(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, 1604 ipnat_t *n, ipnat_t **np, int getlock) 1605 { 1606 int error = 0; 1607 1608 /* 1609 * This combination of flags is incompatible because in_flags will 1610 * be checked for packets coming back in too. 1611 */ 1612 if ((n->in_flags & IPN_TCPUDP) && (n->in_redir & NAT_ENCAP)) { 1613 IPFERROR(60021); 1614 return EINVAL; 1615 } 1616 1617 if (ipf_nat_resolverule(softc, n) != 0) { 1618 IPFERROR(60022); 1619 return ENOENT; 1620 } 1621 1622 if ((n->in_age[0] == 0) && (n->in_age[1] != 0)) { 1623 IPFERROR(60023); 1624 return EINVAL; 1625 } 1626 1627 n->in_use = 0; 1628 1629 if ((n->in_flags & IPN_SIPRANGE) != 0) 1630 n->in_nsrcatype = FRI_RANGE; 1631 1632 if ((n->in_flags & IPN_DIPRANGE) != 0) 1633 n->in_ndstatype = FRI_RANGE; 1634 1635 if ((n->in_flags & IPN_SPLIT) != 0) 1636 n->in_ndstatype = FRI_SPLIT; 1637 1638 if ((n->in_redir & (NAT_MAP|NAT_REWRITE|NAT_DIVERTUDP)) != 0) 1639 n->in_spnext = n->in_spmin; 1640 1641 if ((n->in_redir & (NAT_REWRITE|NAT_DIVERTUDP)) != 0) { 1642 n->in_dpnext = n->in_dpmin; 1643 } else if (n->in_redir == NAT_REDIRECT) { 1644 n->in_dpnext = n->in_dpmin; 1645 } 1646 1647 n->in_stepnext = 0; 1648 1649 switch (n->in_v[0]) 1650 { 1651 case 4 : 1652 error = ipf_nat_ruleaddrinit(softc, softn, n); 1653 if (error != 0) 1654 return error; 1655 break; 1656 #ifdef USE_INET6 1657 case 6 : 1658 error = ipf_nat6_ruleaddrinit(softc, softn, n); 1659 if (error != 0) 1660 return error; 1661 break; 1662 #endif 1663 default : 1664 break; 1665 } 1666 1667 if (n->in_redir == (NAT_DIVERTUDP|NAT_MAP)) { 1668 /* 1669 * Prerecord whether or not the destination of the divert 1670 * is local or not to the interface the packet is going 1671 * to be sent out. 1672 */ 1673 n->in_dlocal = ipf_deliverlocal(softc, n->in_v[1], 1674 n->in_ifps[1], &n->in_ndstip6); 1675 } 1676 1677 if (getlock) { 1678 WRITE_ENTER(&softc->ipf_nat); 1679 } 1680 n->in_next = NULL; 1681 *np = n; 1682 1683 if (n->in_redir & NAT_REDIRECT) { 1684 n->in_flags &= ~IPN_NOTDST; 1685 switch (n->in_v[0]) 1686 { 1687 case 4 : 1688 ipf_nat_addrdr(softn, n); 1689 if (n->in_redir & NAT_ENCAP) 1690 ipf_nat_addencap(softn, n); 1691 break; 1692 #ifdef USE_INET6 1693 case 6 : 1694 ipf_nat6_addrdr(softn, n); 1695 if (n->in_redir & NAT_ENCAP) 1696 ipf_nat6_addencap(softn, n); 1697 break; 1698 #endif 1699 default : 1700 break; 1701 } 1702 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules_rdr); 1703 } 1704 1705 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) { 1706 n->in_flags &= ~IPN_NOTSRC; 1707 switch (n->in_v[0]) 1708 { 1709 case 4 : 1710 ipf_nat_addmap(softn, n); 1711 if (n->in_redir & NAT_ENCAP) 1712 ipf_nat_addencap(softn, n); 1713 break; 1714 #ifdef USE_INET6 1715 case 6 : 1716 ipf_nat6_addmap(softn, n); 1717 if (n->in_redir & NAT_ENCAP) 1718 ipf_nat6_addencap(softn, n); 1719 break; 1720 #endif 1721 default : 1722 break; 1723 } 1724 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules_map); 1725 } 1726 1727 if (n->in_age[0] != 0) 1728 n->in_tqehead[0] = ipf_addtimeoutqueue(softc, 1729 &softn->ipf_nat_utqe, 1730 n->in_age[0]); 1731 1732 if (n->in_age[1] != 0) 1733 n->in_tqehead[1] = ipf_addtimeoutqueue(softc, 1734 &softn->ipf_nat_utqe, 1735 n->in_age[1]); 1736 1737 MUTEX_INIT(&n->in_lock, "ipnat rule lock"); 1738 1739 n = NULL; 1740 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules); 1741 #if SOLARIS && !defined(INSTANCES) 1742 pfil_delayed_copy = 0; 1743 #endif 1744 if (getlock) { 1745 RWLOCK_EXIT(&softc->ipf_nat); /* WRITE */ 1746 } 1747 1748 return error; 1749 } 1750 1751 1752 static int 1753 ipf_nat_ruleaddrinit(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, 1754 ipnat_t *n) 1755 { 1756 int idx, error; 1757 1758 if (n->in_redir == NAT_BIMAP) { 1759 n->in_ndstaddr = n->in_osrcaddr; 1760 n->in_ndstmsk = n->in_osrcmsk; 1761 n->in_odstaddr = n->in_nsrcaddr; 1762 n->in_odstmsk = n->in_nsrcmsk; 1763 1764 } 1765 1766 if (n->in_redir & NAT_REDIRECT) 1767 idx = 1; 1768 else 1769 idx = 0; 1770 /* 1771 * Initialise all of the address fields. 1772 */ 1773 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_osrc, 1, 1774 n->in_ifps[idx]); 1775 if (error != 0) 1776 return error; 1777 1778 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_odst, 1, 1779 n->in_ifps[idx]); 1780 if (error != 0) 1781 return error; 1782 1783 if ((n->in_nsrc.na_atype == FRI_LOOKUP) && 1784 (n->in_nsrc.na_type != IPLT_DSTLIST)) { 1785 IPFERROR(60069); 1786 return EINVAL; 1787 } 1788 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_nsrc, 1, 1789 n->in_ifps[idx]); 1790 if (error != 0) 1791 return error; 1792 1793 if ((n->in_ndst.na_atype == FRI_LOOKUP) && 1794 (n->in_ndst.na_type != IPLT_DSTLIST)) { 1795 IPFERROR(60071); 1796 return EINVAL; 1797 } 1798 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_ndst, 1, 1799 n->in_ifps[idx]); 1800 if (error != 0) 1801 return error; 1802 1803 if (n->in_redir & (NAT_ENCAP|NAT_DIVERTUDP)) 1804 ipf_nat_builddivertmp(softn, n); 1805 1806 return 0; 1807 } 1808 1809 1810 /* ------------------------------------------------------------------------ */ 1811 /* Function: nat_resolvrule */ 1812 /* Returns: Nil */ 1813 /* Parameters: n(I) - pointer to NAT rule */ 1814 /* */ 1815 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */ 1816 /* from information passed to the kernel, then add it to the appropriate */ 1817 /* NAT rule table(s). */ 1818 /* ------------------------------------------------------------------------ */ 1819 static int 1820 ipf_nat_resolverule(ipf_main_softc_t *softc, ipnat_t *n) 1821 { 1822 char *base; 1823 1824 base = n->in_names; 1825 1826 n->in_ifps[0] = ipf_resolvenic(softc, base + n->in_ifnames[0], 1827 n->in_v[0]); 1828 1829 if (n->in_ifnames[1] == -1) { 1830 n->in_ifnames[1] = n->in_ifnames[0]; 1831 n->in_ifps[1] = n->in_ifps[0]; 1832 } else { 1833 n->in_ifps[1] = ipf_resolvenic(softc, base + n->in_ifnames[1], 1834 n->in_v[1]); 1835 } 1836 1837 if (n->in_plabel != -1) { 1838 if (n->in_redir & NAT_REDIRECT) 1839 n->in_apr = ipf_proxy_lookup(softc->ipf_proxy_soft, 1840 n->in_pr[0], 1841 base + n->in_plabel); 1842 else 1843 n->in_apr = ipf_proxy_lookup(softc->ipf_proxy_soft, 1844 n->in_pr[1], 1845 base + n->in_plabel); 1846 if (n->in_apr == NULL) 1847 return -1; 1848 } 1849 return 0; 1850 } 1851 1852 1853 /* ------------------------------------------------------------------------ */ 1854 /* Function: nat_siocdelnat */ 1855 /* Returns: int - 0 == success, != 0 == failure */ 1856 /* Parameters: n(I) - pointer to new NAT rule */ 1857 /* np(I) - pointer to where to insert new NAT rule */ 1858 /* getlock(I) - flag indicating if lock on is held */ 1859 /* Mutex Locks: ipf_nat_io */ 1860 /* */ 1861 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */ 1862 /* from information passed to the kernel, then add it to the appropriate */ 1863 /* NAT rule table(s). */ 1864 /* ------------------------------------------------------------------------ */ 1865 static void 1866 ipf_nat_siocdelnat(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, ipnat_t *n, 1867 ipnat_t **np, int getlock) 1868 { 1869 #ifdef IPF_NAT6 1870 int i; 1871 #endif 1872 1873 if (getlock) { 1874 WRITE_ENTER(&softc->ipf_nat); 1875 } 1876 if (n->in_redir & NAT_REDIRECT) 1877 ipf_nat_delrdr(softn, n); 1878 if (n->in_redir & (NAT_MAPBLK|NAT_MAP)) 1879 ipf_nat_delmap(softn, n); 1880 1881 if (n->in_tqehead[0] != NULL) { 1882 if (ipf_deletetimeoutqueue(n->in_tqehead[0]) == 0) { 1883 ipf_freetimeoutqueue(softc, n->in_tqehead[1]); 1884 } 1885 } 1886 1887 if (n->in_tqehead[1] != NULL) { 1888 if (ipf_deletetimeoutqueue(n->in_tqehead[1]) == 0) { 1889 ipf_freetimeoutqueue(softc, n->in_tqehead[1]); 1890 } 1891 } 1892 1893 *np = n->in_next; 1894 1895 if (n->in_use == 0) { 1896 ipf_nat_free_rule(softc, softn, n); 1897 } else { 1898 n->in_flags |= IPN_DELETE; 1899 n->in_next = NULL; 1900 } 1901 if (getlock) { 1902 RWLOCK_EXIT(&softc->ipf_nat); /* READ/WRITE */ 1903 } 1904 } 1905 1906 1907 static void 1908 ipf_nat_free_rule(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, ipnat_t *n) 1909 { 1910 if (n->in_apr != NULL) 1911 ipf_proxy_free(n->in_apr); 1912 1913 if (n->in_odst.na_atype == FRI_LOOKUP) 1914 ipf_lookup_deref(softc, n->in_odst.na_type, n->in_odst.na_ptr); 1915 1916 if (n->in_osrc.na_atype == FRI_LOOKUP) 1917 ipf_lookup_deref(softc, n->in_osrc.na_type, n->in_osrc.na_ptr); 1918 1919 if (n->in_ndst.na_atype == FRI_LOOKUP) 1920 ipf_lookup_deref(softc, n->in_ndst.na_type, n->in_ndst.na_ptr); 1921 1922 if (n->in_nsrc.na_atype == FRI_LOOKUP) 1923 ipf_lookup_deref(softc, n->in_nsrc.na_type, n->in_nsrc.na_ptr); 1924 1925 if (n->in_redir & NAT_REDIRECT) { 1926 ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules_rdr); 1927 } 1928 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) { 1929 ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules_map); 1930 } 1931 1932 if (n->in_divmp != NULL) { 1933 FREE_MB_T(n->in_divmp); 1934 } 1935 ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules); 1936 1937 MUTEX_DESTROY(&n->in_lock); 1938 1939 KFREES(n, n->in_size); 1940 1941 #if SOLARIS && !defined(INSTANCES) 1942 if (softn->ipf_nat_stats.ns_rules == 0) 1943 pfil_delayed_copy = 1; 1944 #endif 1945 } 1946 1947 1948 /* ------------------------------------------------------------------------ */ 1949 /* Function: ipf_nat_getsz */ 1950 /* Returns: int - 0 == success, != 0 is the error value. */ 1951 /* Parameters: data(I) - pointer to natget structure with kernel */ 1952 /* pointer get the size of. */ 1953 /* getlock(I) - flag indicating whether or not the caller */ 1954 /* holds a lock on ipf_nat */ 1955 /* */ 1956 /* Handle SIOCSTGSZ. */ 1957 /* Return the size of the nat list entry to be copied back to user space. */ 1958 /* The size of the entry is stored in the ng_sz field and the enture natget */ 1959 /* structure is copied back to the user. */ 1960 /* ------------------------------------------------------------------------ */ 1961 static int 1962 ipf_nat_getsz(ipf_main_softc_t *softc, void *data, int getlock) 1963 { 1964 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 1965 ap_session_t *aps; 1966 nat_t *nat, *n; 1967 natget_t ng; 1968 int error; 1969 1970 error = BCOPYIN(data, &ng, sizeof(ng)); 1971 if (error != 0) { 1972 IPFERROR(60024); 1973 return EFAULT; 1974 } 1975 1976 if (getlock) { 1977 READ_ENTER(&softc->ipf_nat); 1978 } 1979 1980 nat = ng.ng_ptr; 1981 if (!nat) { 1982 nat = softn->ipf_nat_instances; 1983 ng.ng_sz = 0; 1984 /* 1985 * Empty list so the size returned is 0. Simple. 1986 */ 1987 if (nat == NULL) { 1988 if (getlock) { 1989 RWLOCK_EXIT(&softc->ipf_nat); 1990 } 1991 error = BCOPYOUT(&ng, data, sizeof(ng)); 1992 if (error != 0) { 1993 IPFERROR(60025); 1994 return EFAULT; 1995 } 1996 return 0; 1997 } 1998 } else { 1999 /* 2000 * Make sure the pointer we're copying from exists in the 2001 * current list of entries. Security precaution to prevent 2002 * copying of random kernel data. 2003 */ 2004 for (n = softn->ipf_nat_instances; n; n = n->nat_next) 2005 if (n == nat) 2006 break; 2007 if (n == NULL) { 2008 if (getlock) { 2009 RWLOCK_EXIT(&softc->ipf_nat); 2010 } 2011 IPFERROR(60026); 2012 return ESRCH; 2013 } 2014 } 2015 2016 /* 2017 * Incluse any space required for proxy data structures. 2018 */ 2019 ng.ng_sz = sizeof(nat_save_t); 2020 aps = nat->nat_aps; 2021 if (aps != NULL) { 2022 ng.ng_sz += sizeof(ap_session_t) - 4; 2023 if (aps->aps_data != 0) 2024 ng.ng_sz += aps->aps_psiz; 2025 } 2026 if (getlock) { 2027 RWLOCK_EXIT(&softc->ipf_nat); 2028 } 2029 2030 error = BCOPYOUT(&ng, data, sizeof(ng)); 2031 if (error != 0) { 2032 IPFERROR(60027); 2033 return EFAULT; 2034 } 2035 return 0; 2036 } 2037 2038 2039 /* ------------------------------------------------------------------------ */ 2040 /* Function: ipf_nat_getent */ 2041 /* Returns: int - 0 == success, != 0 is the error value. */ 2042 /* Parameters: data(I) - pointer to natget structure with kernel pointer*/ 2043 /* to NAT structure to copy out. */ 2044 /* getlock(I) - flag indicating whether or not the caller */ 2045 /* holds a lock on ipf_nat */ 2046 /* */ 2047 /* Handle SIOCSTGET. */ 2048 /* Copies out NAT entry to user space. Any additional data held for a */ 2049 /* proxy is also copied, as to is the NAT rule which was responsible for it */ 2050 /* ------------------------------------------------------------------------ */ 2051 static int 2052 ipf_nat_getent(ipf_main_softc_t *softc, void *data, int getlock) 2053 { 2054 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 2055 int error, outsize; 2056 ap_session_t *aps; 2057 nat_save_t *ipn, ipns; 2058 nat_t *n, *nat; 2059 2060 error = ipf_inobj(softc, data, NULL, &ipns, IPFOBJ_NATSAVE); 2061 if (error != 0) 2062 return error; 2063 2064 if ((ipns.ipn_dsize < sizeof(ipns)) || (ipns.ipn_dsize > 81920)) { 2065 IPFERROR(60028); 2066 return EINVAL; 2067 } 2068 2069 KMALLOCS(ipn, nat_save_t *, ipns.ipn_dsize); 2070 if (ipn == NULL) { 2071 IPFERROR(60029); 2072 return ENOMEM; 2073 } 2074 2075 if (getlock) { 2076 READ_ENTER(&softc->ipf_nat); 2077 } 2078 2079 ipn->ipn_dsize = ipns.ipn_dsize; 2080 nat = ipns.ipn_next; 2081 if (nat == NULL) { 2082 nat = softn->ipf_nat_instances; 2083 if (nat == NULL) { 2084 if (softn->ipf_nat_instances == NULL) { 2085 IPFERROR(60030); 2086 error = ENOENT; 2087 } 2088 goto finished; 2089 } 2090 } else { 2091 /* 2092 * Make sure the pointer we're copying from exists in the 2093 * current list of entries. Security precaution to prevent 2094 * copying of random kernel data. 2095 */ 2096 for (n = softn->ipf_nat_instances; n; n = n->nat_next) 2097 if (n == nat) 2098 break; 2099 if (n == NULL) { 2100 IPFERROR(60031); 2101 error = ESRCH; 2102 goto finished; 2103 } 2104 } 2105 ipn->ipn_next = nat->nat_next; 2106 2107 /* 2108 * Copy the NAT structure. 2109 */ 2110 bcopy((char *)nat, &ipn->ipn_nat, sizeof(*nat)); 2111 2112 /* 2113 * If we have a pointer to the NAT rule it belongs to, save that too. 2114 */ 2115 if (nat->nat_ptr != NULL) 2116 bcopy((char *)nat->nat_ptr, (char *)&ipn->ipn_ipnat, 2117 ipn->ipn_ipnat.in_size); 2118 2119 /* 2120 * If we also know the NAT entry has an associated filter rule, 2121 * save that too. 2122 */ 2123 if (nat->nat_fr != NULL) 2124 bcopy((char *)nat->nat_fr, (char *)&ipn->ipn_fr, 2125 sizeof(ipn->ipn_fr)); 2126 2127 /* 2128 * Last but not least, if there is an application proxy session set 2129 * up for this NAT entry, then copy that out too, including any 2130 * private data saved along side it by the proxy. 2131 */ 2132 aps = nat->nat_aps; 2133 outsize = ipn->ipn_dsize - sizeof(*ipn) + sizeof(ipn->ipn_data); 2134 if (aps != NULL) { 2135 char *s; 2136 2137 if (outsize < sizeof(*aps)) { 2138 IPFERROR(60032); 2139 error = ENOBUFS; 2140 goto finished; 2141 } 2142 2143 s = ipn->ipn_data; 2144 bcopy((char *)aps, s, sizeof(*aps)); 2145 s += sizeof(*aps); 2146 outsize -= sizeof(*aps); 2147 if ((aps->aps_data != NULL) && (outsize >= aps->aps_psiz)) 2148 bcopy(aps->aps_data, s, aps->aps_psiz); 2149 else { 2150 IPFERROR(60033); 2151 error = ENOBUFS; 2152 } 2153 } 2154 if (error == 0) { 2155 if (getlock) { 2156 READ_ENTER(&softc->ipf_nat); 2157 getlock = 0; 2158 } 2159 error = ipf_outobjsz(softc, data, ipn, IPFOBJ_NATSAVE, 2160 ipns.ipn_dsize); 2161 } 2162 2163 finished: 2164 if (getlock) { 2165 READ_ENTER(&softc->ipf_nat); 2166 } 2167 if (ipn != NULL) { 2168 KFREES(ipn, ipns.ipn_dsize); 2169 } 2170 return error; 2171 } 2172 2173 2174 /* ------------------------------------------------------------------------ */ 2175 /* Function: ipf_nat_putent */ 2176 /* Returns: int - 0 == success, != 0 is the error value. */ 2177 /* Parameters: data(I) - pointer to natget structure with NAT */ 2178 /* structure information to load into the kernel */ 2179 /* getlock(I) - flag indicating whether or not a write lock */ 2180 /* on is already held. */ 2181 /* */ 2182 /* Handle SIOCSTPUT. */ 2183 /* Loads a NAT table entry from user space, including a NAT rule, proxy and */ 2184 /* firewall rule data structures, if pointers to them indicate so. */ 2185 /* ------------------------------------------------------------------------ */ 2186 static int 2187 ipf_nat_putent(ipf_main_softc_t *softc, void *data, int getlock) 2188 { 2189 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 2190 nat_save_t *ipn, *ipnn; 2191 ap_session_t *aps; 2192 nat_t *n, *nat; 2193 frentry_t *fr; 2194 fr_info_t *fin; 2195 ipnat_t *in; 2196 int error; 2197 2198 KMALLOC(ipn, nat_save_t *); 2199 if (ipn == NULL) 2200 return ENOMEM; 2201 error = ipf_inobj(softc, data, NULL, ipn, IPFOBJ_NATSAVE); 2202 if (error != 0) 2203 return error; 2204 2205 /* 2206 * Initialise early because of code at junkput label. 2207 */ 2208 n = NULL; 2209 in = NULL; 2210 aps = NULL; 2211 nat = NULL; 2212 ipnn = NULL; 2213 fin = NULL; 2214 fr = NULL; 2215 2216 /* 2217 * New entry, copy in the rest of the NAT entry if it's size is more 2218 * than just the nat_t structure. 2219 */ 2220 if (ipn->ipn_dsize > sizeof(*ipn)) { 2221 if (ipn->ipn_dsize > 81920) { 2222 IPFERROR(60034); 2223 error = ENOMEM; 2224 goto junkput; 2225 } 2226 2227 KMALLOCS(ipnn, nat_save_t *, ipn->ipn_dsize); 2228 if (ipnn == NULL) { 2229 IPFERROR(60035); 2230 return ENOMEM; 2231 } 2232 2233 bzero(ipnn, ipn->ipn_dsize); 2234 error = ipf_inobjsz(softc, data, ipnn, IPFOBJ_NATSAVE, 2235 ipn->ipn_dsize); 2236 if (error != 0) { 2237 goto junkput; 2238 } 2239 } else 2240 ipnn = ipn; 2241 2242 KMALLOC(nat, nat_t *); 2243 if (nat == NULL) { 2244 IPFERROR(60037); 2245 error = ENOMEM; 2246 goto junkput; 2247 } 2248 2249 bcopy((char *)&ipnn->ipn_nat, (char *)nat, sizeof(*nat)); 2250 2251 switch (nat->nat_v[0]) 2252 { 2253 case 4: 2254 #ifdef USE_IENT6 2255 case 6 : 2256 #endif 2257 break; 2258 default : 2259 IPFERROR(60061); 2260 error = EPROTONOSUPPORT; 2261 goto junkput; 2262 /*NOTREACHED*/ 2263 } 2264 2265 /* 2266 * Initialize all these so that ipf_nat_delete() doesn't cause a crash. 2267 */ 2268 bzero((char *)nat, offsetof(struct nat, nat_tqe)); 2269 nat->nat_tqe.tqe_pnext = NULL; 2270 nat->nat_tqe.tqe_next = NULL; 2271 nat->nat_tqe.tqe_ifq = NULL; 2272 nat->nat_tqe.tqe_parent = nat; 2273 2274 /* 2275 * Restore the rule associated with this nat session 2276 */ 2277 in = ipnn->ipn_nat.nat_ptr; 2278 if (in != NULL) { 2279 KMALLOCS(in, ipnat_t *, ipnn->ipn_ipnat.in_size); 2280 nat->nat_ptr = in; 2281 if (in == NULL) { 2282 IPFERROR(60038); 2283 error = ENOMEM; 2284 goto junkput; 2285 } 2286 bcopy((char *)&ipnn->ipn_ipnat, (char *)in, 2287 ipnn->ipn_ipnat.in_size); 2288 in->in_use = 1; 2289 in->in_flags |= IPN_DELETE; 2290 2291 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules); 2292 2293 if (ipf_nat_resolverule(softc, in) != 0) { 2294 IPFERROR(60039); 2295 error = ESRCH; 2296 goto junkput; 2297 } 2298 } 2299 2300 /* 2301 * Check that the NAT entry doesn't already exist in the kernel. 2302 * 2303 * For NAT_OUTBOUND, we're lookup for a duplicate MAP entry. To do 2304 * this, we check to see if the inbound combination of addresses and 2305 * ports is already known. Similar logic is applied for NAT_INBOUND. 2306 * 2307 */ 2308 KMALLOC(fin, fr_info_t *); 2309 if (fin == NULL) { 2310 error = ENOMEM; 2311 goto junkput; 2312 } 2313 bzero(fin, sizeof(*fin)); 2314 fin->fin_v = nat->nat_v[0]; 2315 fin->fin_p = nat->nat_pr[0]; 2316 fin->fin_rev = nat->nat_rev; 2317 fin->fin_ifp = nat->nat_ifps[0]; 2318 fin->fin_data[0] = ntohs(nat->nat_ndport); 2319 fin->fin_data[1] = ntohs(nat->nat_nsport); 2320 2321 switch (nat->nat_dir) 2322 { 2323 case NAT_OUTBOUND : 2324 case NAT_ENCAPOUT : 2325 case NAT_DIVERTOUT : 2326 if (getlock) { 2327 READ_ENTER(&softc->ipf_nat); 2328 } 2329 2330 fin->fin_v = nat->nat_v[1]; 2331 if (nat->nat_v[1] == 4) { 2332 n = ipf_nat_inlookup(fin, nat->nat_flags, fin->fin_p, 2333 nat->nat_ndstip, nat->nat_nsrcip); 2334 #ifdef USE_INET6 2335 } else if (nat->nat_v[1] == 6) { 2336 n = ipf_nat6_inlookup(fin, nat->nat_flags, fin->fin_p, 2337 &nat->nat_ndst6.in6, 2338 &nat->nat_nsrc6.in6); 2339 #endif 2340 } 2341 2342 if (getlock) { 2343 RWLOCK_EXIT(&softc->ipf_nat); 2344 } 2345 if (n != NULL) { 2346 IPFERROR(60040); 2347 error = EEXIST; 2348 goto junkput; 2349 } 2350 break; 2351 2352 case NAT_INBOUND : 2353 case NAT_ENCAPIN : 2354 case NAT_DIVERTIN : 2355 if (getlock) { 2356 READ_ENTER(&softc->ipf_nat); 2357 } 2358 2359 if (fin->fin_v == 4) { 2360 n = ipf_nat_outlookup(fin, nat->nat_flags, fin->fin_p, 2361 nat->nat_ndstip, 2362 nat->nat_nsrcip); 2363 #ifdef USE_INET6 2364 } else if (fin->fin_v == 6) { 2365 n = ipf_nat6_outlookup(fin, nat->nat_flags, fin->fin_p, 2366 &nat->nat_ndst6.in6, 2367 &nat->nat_nsrc6.in6); 2368 #endif 2369 } 2370 2371 if (getlock) { 2372 RWLOCK_EXIT(&softc->ipf_nat); 2373 } 2374 if (n != NULL) { 2375 IPFERROR(60041); 2376 error = EEXIST; 2377 goto junkput; 2378 } 2379 break; 2380 2381 default : 2382 IPFERROR(60042); 2383 error = EINVAL; 2384 goto junkput; 2385 break; 2386 } 2387 2388 /* 2389 * Restore ap_session_t structure. Include the private data allocated 2390 * if it was there. 2391 */ 2392 aps = nat->nat_aps; 2393 if (aps != NULL) { 2394 KMALLOC(aps, ap_session_t *); 2395 nat->nat_aps = aps; 2396 if (aps == NULL) { 2397 IPFERROR(60043); 2398 error = ENOMEM; 2399 goto junkput; 2400 } 2401 bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps)); 2402 if (in != NULL) 2403 aps->aps_apr = in->in_apr; 2404 else 2405 aps->aps_apr = NULL; 2406 if (aps->aps_psiz != 0) { 2407 if (aps->aps_psiz > 81920) { 2408 IPFERROR(60044); 2409 error = ENOMEM; 2410 goto junkput; 2411 } 2412 KMALLOCS(aps->aps_data, void *, aps->aps_psiz); 2413 if (aps->aps_data == NULL) { 2414 IPFERROR(60045); 2415 error = ENOMEM; 2416 goto junkput; 2417 } 2418 bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data, 2419 aps->aps_psiz); 2420 } else { 2421 aps->aps_psiz = 0; 2422 aps->aps_data = NULL; 2423 } 2424 } 2425 2426 /* 2427 * If there was a filtering rule associated with this entry then 2428 * build up a new one. 2429 */ 2430 fr = nat->nat_fr; 2431 if (fr != NULL) { 2432 if ((nat->nat_flags & SI_NEWFR) != 0) { 2433 KMALLOC(fr, frentry_t *); 2434 nat->nat_fr = fr; 2435 if (fr == NULL) { 2436 IPFERROR(60046); 2437 error = ENOMEM; 2438 goto junkput; 2439 } 2440 ipnn->ipn_nat.nat_fr = fr; 2441 fr->fr_ref = 1; 2442 (void) ipf_outobj(softc, data, ipnn, IPFOBJ_NATSAVE); 2443 bcopy((char *)&ipnn->ipn_fr, (char *)fr, sizeof(*fr)); 2444 2445 fr->fr_ref = 1; 2446 fr->fr_dsize = 0; 2447 fr->fr_data = NULL; 2448 fr->fr_type = FR_T_NONE; 2449 2450 MUTEX_NUKE(&fr->fr_lock); 2451 MUTEX_INIT(&fr->fr_lock, "nat-filter rule lock"); 2452 } else { 2453 if (getlock) { 2454 READ_ENTER(&softc->ipf_nat); 2455 } 2456 for (n = softn->ipf_nat_instances; n; n = n->nat_next) 2457 if (n->nat_fr == fr) 2458 break; 2459 2460 if (n != NULL) { 2461 MUTEX_ENTER(&fr->fr_lock); 2462 fr->fr_ref++; 2463 MUTEX_EXIT(&fr->fr_lock); 2464 } 2465 if (getlock) { 2466 RWLOCK_EXIT(&softc->ipf_nat); 2467 } 2468 2469 if (n == NULL) { 2470 IPFERROR(60047); 2471 error = ESRCH; 2472 goto junkput; 2473 } 2474 } 2475 } 2476 2477 if (ipnn != ipn) { 2478 KFREES(ipnn, ipn->ipn_dsize); 2479 ipnn = NULL; 2480 } 2481 2482 if (getlock) { 2483 WRITE_ENTER(&softc->ipf_nat); 2484 } 2485 2486 if (fin->fin_v == 4) 2487 error = ipf_nat_finalise(fin, nat); 2488 #ifdef USE_INET6 2489 else 2490 error = ipf_nat6_finalise(fin, nat); 2491 #endif 2492 2493 if (getlock) { 2494 RWLOCK_EXIT(&softc->ipf_nat); 2495 } 2496 2497 if (error == 0) 2498 return 0; 2499 2500 IPFERROR(60048); 2501 error = ENOMEM; 2502 2503 junkput: 2504 if (fin != NULL) 2505 KFREE(fin); 2506 if (fr != NULL) { 2507 (void) ipf_derefrule(softc, &fr); 2508 } 2509 2510 if ((ipnn != NULL) && (ipnn != ipn)) { 2511 KFREES(ipnn, ipn->ipn_dsize); 2512 } 2513 if (ipn != NULL) 2514 KFREE(ipn); 2515 if (nat != NULL) { 2516 if (aps != NULL) { 2517 if (aps->aps_data != NULL) { 2518 KFREES(aps->aps_data, aps->aps_psiz); 2519 } 2520 KFREE(aps); 2521 } 2522 if (in != NULL) { 2523 if (in->in_apr) 2524 ipf_proxy_free(in->in_apr); 2525 KFREES(in, in->in_size); 2526 } 2527 KFREE(nat); 2528 } 2529 return error; 2530 } 2531 2532 2533 /* ------------------------------------------------------------------------ */ 2534 /* Function: ipf_nat_delete */ 2535 /* Returns: Nil */ 2536 /* Parameters: natd(I) - pointer to NAT structure to delete */ 2537 /* logtype(I) - type of LOG record to create before deleting */ 2538 /* Write Lock: ipf_nat */ 2539 /* */ 2540 /* Delete a nat entry from the various lists and table. If NAT logging is */ 2541 /* enabled then generate a NAT log record for this event. */ 2542 /* ------------------------------------------------------------------------ */ 2543 void 2544 ipf_nat_delete(ipf_main_softc_t *softc, struct nat *nat, int logtype) 2545 { 2546 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 2547 int madeorphan = 0, bkt, removed = 0; 2548 struct ipnat *ipn; 2549 2550 if (logtype != 0 && softn->ipf_nat_logging != 0) 2551 ipf_nat_log(softc, softn, nat, logtype); 2552 2553 /* 2554 * Take it as a general indication that all the pointers are set if 2555 * nat_pnext is set. 2556 */ 2557 if (nat->nat_pnext != NULL) { 2558 removed = 1; 2559 2560 bkt = nat->nat_hv[0] % softn->ipf_nat_table_sz; 2561 softn->ipf_nat_stats.ns_side[0].ns_bucketlen[bkt]--; 2562 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen[bkt] == 0) { 2563 softn->ipf_nat_stats.ns_side[0].ns_inuse--; 2564 } 2565 2566 bkt = nat->nat_hv[1] % softn->ipf_nat_table_sz; 2567 softn->ipf_nat_stats.ns_side[1].ns_bucketlen[bkt]--; 2568 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen[bkt] == 0) { 2569 softn->ipf_nat_stats.ns_side[1].ns_inuse--; 2570 } 2571 2572 *nat->nat_pnext = nat->nat_next; 2573 if (nat->nat_next != NULL) { 2574 nat->nat_next->nat_pnext = nat->nat_pnext; 2575 nat->nat_next = NULL; 2576 } 2577 nat->nat_pnext = NULL; 2578 2579 *nat->nat_phnext[0] = nat->nat_hnext[0]; 2580 if (nat->nat_hnext[0] != NULL) { 2581 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; 2582 nat->nat_hnext[0] = NULL; 2583 } 2584 nat->nat_phnext[0] = NULL; 2585 2586 *nat->nat_phnext[1] = nat->nat_hnext[1]; 2587 if (nat->nat_hnext[1] != NULL) { 2588 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; 2589 nat->nat_hnext[1] = NULL; 2590 } 2591 nat->nat_phnext[1] = NULL; 2592 2593 if ((nat->nat_flags & SI_WILDP) != 0) { 2594 ATOMIC_DEC32(softn->ipf_nat_stats.ns_wilds); 2595 } 2596 madeorphan = 1; 2597 } 2598 2599 if (nat->nat_me != NULL) { 2600 *nat->nat_me = NULL; 2601 nat->nat_me = NULL; 2602 nat->nat_ref--; 2603 } 2604 2605 if (nat->nat_tqe.tqe_ifq != NULL) { 2606 /* 2607 * No call to ipf_freetimeoutqueue() is made here, they are 2608 * garbage collected in ipf_nat_expire(). 2609 */ 2610 (void) ipf_deletequeueentry(&nat->nat_tqe); 2611 } 2612 2613 if (logtype == NL_EXPIRE) 2614 softn->ipf_nat_stats.ns_expire++; 2615 2616 MUTEX_ENTER(&nat->nat_lock); 2617 /* 2618 * NL_DESTROY should only be passed in when we've got nat_ref >= 2. 2619 * This happens when a nat'd packet is blocked and we want to throw 2620 * away the NAT session. 2621 */ 2622 if (logtype == NL_DESTROY) { 2623 if (nat->nat_ref > 2) { 2624 nat->nat_ref -= 2; 2625 MUTEX_EXIT(&nat->nat_lock); 2626 if (removed) 2627 softn->ipf_nat_stats.ns_orphans++; 2628 return; 2629 } 2630 } else if (nat->nat_ref > 1) { 2631 nat->nat_ref--; 2632 MUTEX_EXIT(&nat->nat_lock); 2633 if (madeorphan == 1) 2634 softn->ipf_nat_stats.ns_orphans++; 2635 return; 2636 } 2637 MUTEX_EXIT(&nat->nat_lock); 2638 2639 nat->nat_ref = 0; 2640 2641 if (madeorphan == 0) 2642 softn->ipf_nat_stats.ns_orphans--; 2643 2644 /* 2645 * At this point, nat_ref can be either 0 or -1 2646 */ 2647 softn->ipf_nat_stats.ns_proto[nat->nat_pr[0]]--; 2648 2649 if (nat->nat_sync) 2650 ipf_sync_del_nat(softc->ipf_sync_soft,nat->nat_sync); 2651 2652 if (nat->nat_fr != NULL) { 2653 (void) ipf_derefrule(softc, &nat->nat_fr); 2654 } 2655 2656 if (nat->nat_hm != NULL) { 2657 ipf_nat_hostmapdel(&nat->nat_hm); 2658 } 2659 2660 /* 2661 * If there is an active reference from the nat entry to its parent 2662 * rule, decrement the rule's reference count and free it too if no 2663 * longer being used. 2664 */ 2665 ipn = nat->nat_ptr; 2666 nat->nat_ptr = NULL; 2667 2668 if (ipn != NULL) { 2669 ipf_nat_rulederef(softc, &ipn); 2670 } 2671 2672 MUTEX_DESTROY(&nat->nat_lock); 2673 2674 aps_free(softc, softc->ipf_proxy_soft, nat->nat_aps); 2675 softn->ipf_nat_stats.ns_active--; 2676 2677 /* 2678 * If there's a fragment table entry too for this nat entry, then 2679 * dereference that as well. This is after nat_lock is released 2680 * because of Tru64. 2681 */ 2682 ipf_frag_natforget(softc, (void *)nat); 2683 2684 KFREE(nat); 2685 } 2686 2687 2688 /* ------------------------------------------------------------------------ */ 2689 /* Function: ipf_nat_flushtable */ 2690 /* Returns: int - number of NAT rules deleted */ 2691 /* Parameters: Nil */ 2692 /* Write Lock: ipf_nat */ 2693 /* */ 2694 /* Deletes all currently active NAT sessions. In deleting each NAT entry a */ 2695 /* log record should be emitted in ipf_nat_delete() if NAT logging is */ 2696 /* enabled. */ 2697 /* ------------------------------------------------------------------------ */ 2698 /* 2699 * nat_flushtable - clear the NAT table of all mapping entries. 2700 */ 2701 static int 2702 ipf_nat_flushtable(ipf_main_softc_t *softc, ipf_nat_softc_t *softn) 2703 { 2704 nat_t *nat; 2705 int j = 0; 2706 2707 /* 2708 * ALL NAT mappings deleted, so lets just make the deletions 2709 * quicker. 2710 */ 2711 if (softn->ipf_nat_table[0] != NULL) 2712 bzero((char *)softn->ipf_nat_table[0], 2713 sizeof(softn->ipf_nat_table[0]) * 2714 softn->ipf_nat_table_sz); 2715 if (softn->ipf_nat_table[1] != NULL) 2716 bzero((char *)softn->ipf_nat_table[1], 2717 sizeof(softn->ipf_nat_table[1]) * 2718 softn->ipf_nat_table_sz); 2719 2720 while ((nat = softn->ipf_nat_instances) != NULL) { 2721 ipf_nat_delete(softc, nat, NL_FLUSH); 2722 j++; 2723 } 2724 2725 return j; 2726 } 2727 2728 2729 /* ------------------------------------------------------------------------ */ 2730 /* Function: ipf_nat_clearlist */ 2731 /* Returns: int - number of NAT/RDR rules deleted */ 2732 /* Parameters: Nil */ 2733 /* */ 2734 /* Delete all rules in the current list of rules. There is nothing elegant */ 2735 /* about this cleanup: simply free all entries on the list of rules and */ 2736 /* clear out the tables used for hashed NAT rule lookups. */ 2737 /* ------------------------------------------------------------------------ */ 2738 static int 2739 ipf_nat_clearlist(ipf_main_softc_t *softc, ipf_nat_softc_t *softn) 2740 { 2741 ipnat_t *n, **np = &softn->ipf_nat_list; 2742 int i = 0; 2743 2744 if (softn->ipf_nat_map_rules != NULL) { 2745 bzero((char *)softn->ipf_nat_map_rules, 2746 sizeof(*softn->ipf_nat_map_rules) * 2747 softn->ipf_nat_maprules_sz); 2748 } 2749 if (softn->ipf_nat_rdr_rules != NULL) { 2750 bzero((char *)softn->ipf_nat_rdr_rules, 2751 sizeof(*softn->ipf_nat_rdr_rules) * 2752 softn->ipf_nat_rdrrules_sz); 2753 } 2754 2755 while ((n = *np) != NULL) { 2756 *np = n->in_next; 2757 ipf_nat_delrule(softc, softn, n); 2758 i++; 2759 } 2760 #if SOLARIS && !defined(INSTANCES) 2761 pfil_delayed_copy = 1; 2762 #endif 2763 return i; 2764 } 2765 2766 2767 /* ------------------------------------------------------------------------ */ 2768 /* Function: ipf_nat_delrule */ 2769 /* Returns: Nil */ 2770 /* Parameters: np(I) - pointer to NAT rule to delete */ 2771 /* */ 2772 /* ------------------------------------------------------------------------ */ 2773 void 2774 ipf_nat_delrule(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, ipnat_t *np) 2775 { 2776 if (np->in_use == 0) { 2777 ipf_nat_free_rule(softc, softn, np); 2778 } else { 2779 np->in_flags |= IPN_DELETE; 2780 np->in_next = NULL; 2781 } 2782 2783 } 2784 2785 2786 /* ------------------------------------------------------------------------ */ 2787 /* Function: ipf_nat_newmap */ 2788 /* Returns: int - -1 == error, 0 == success */ 2789 /* Parameters: fin(I) - pointer to packet information */ 2790 /* nat(I) - pointer to NAT entry */ 2791 /* ni(I) - pointer to structure with misc. information needed */ 2792 /* to create new NAT entry. */ 2793 /* */ 2794 /* Given an empty NAT structure, populate it with new information about a */ 2795 /* new NAT session, as defined by the matching NAT rule. */ 2796 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/ 2797 /* to the new IP address for the translation. */ 2798 /* ------------------------------------------------------------------------ */ 2799 static int 2800 ipf_nat_newmap(fr_info_t *fin, nat_t *nat, natinfo_t *ni) 2801 { 2802 ipf_main_softc_t *softc = fin->fin_main_soft; 2803 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 2804 u_short st_port, dport, sport, port, sp, dp; 2805 struct in_addr in, inb; 2806 hostmap_t *hm; 2807 u_32_t flags; 2808 u_32_t st_ip; 2809 ipnat_t *np; 2810 nat_t *natl; 2811 int l; 2812 2813 /* 2814 * If it's an outbound packet which doesn't match any existing 2815 * record, then create a new port 2816 */ 2817 l = 0; 2818 hm = NULL; 2819 np = ni->nai_np; 2820 st_ip = np->in_snip; 2821 st_port = np->in_spnext; 2822 flags = nat->nat_flags; 2823 2824 if (flags & IPN_ICMPQUERY) { 2825 sport = fin->fin_data[1]; 2826 dport = 0; 2827 } else { 2828 sport = htons(fin->fin_data[0]); 2829 dport = htons(fin->fin_data[1]); 2830 } 2831 2832 /* 2833 * Do a loop until we either run out of entries to try or we find 2834 * a NAT mapping that isn't currently being used. This is done 2835 * because the change to the source is not (usually) being fixed. 2836 */ 2837 do { 2838 port = 0; 2839 in.s_addr = htonl(np->in_snip); 2840 if (l == 0) { 2841 /* 2842 * Check to see if there is an existing NAT 2843 * setup for this IP address pair. 2844 */ 2845 hm = ipf_nat_hostmap(softn, np, fin->fin_src, 2846 fin->fin_dst, in, 0); 2847 if (hm != NULL) 2848 in.s_addr = hm->hm_nsrcip.s_addr; 2849 } else if ((l == 1) && (hm != NULL)) { 2850 ipf_nat_hostmapdel(&hm); 2851 } 2852 in.s_addr = ntohl(in.s_addr); 2853 2854 nat->nat_hm = hm; 2855 2856 if ((np->in_nsrcmsk == 0xffffffff) && (np->in_spnext == 0)) { 2857 if (l > 0) { 2858 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_1); 2859 return -1; 2860 } 2861 } 2862 2863 if (np->in_redir == NAT_BIMAP && 2864 np->in_osrcmsk == np->in_nsrcmsk) { 2865 /* 2866 * map the address block in a 1:1 fashion 2867 */ 2868 in.s_addr = np->in_nsrcaddr; 2869 in.s_addr |= fin->fin_saddr & ~np->in_osrcmsk; 2870 in.s_addr = ntohl(in.s_addr); 2871 2872 } else if (np->in_redir & NAT_MAPBLK) { 2873 if ((l >= np->in_ppip) || ((l > 0) && 2874 !(flags & IPN_TCPUDP))) { 2875 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_2); 2876 return -1; 2877 } 2878 /* 2879 * map-block - Calculate destination address. 2880 */ 2881 in.s_addr = ntohl(fin->fin_saddr); 2882 in.s_addr &= ntohl(~np->in_osrcmsk); 2883 inb.s_addr = in.s_addr; 2884 in.s_addr /= np->in_ippip; 2885 in.s_addr &= ntohl(~np->in_nsrcmsk); 2886 in.s_addr += ntohl(np->in_nsrcaddr); 2887 /* 2888 * Calculate destination port. 2889 */ 2890 if ((flags & IPN_TCPUDP) && 2891 (np->in_ppip != 0)) { 2892 port = ntohs(sport) + l; 2893 port %= np->in_ppip; 2894 port += np->in_ppip * 2895 (inb.s_addr % np->in_ippip); 2896 port += MAPBLK_MINPORT; 2897 port = htons(port); 2898 } 2899 2900 } else if ((np->in_nsrcaddr == 0) && 2901 (np->in_nsrcmsk == 0xffffffff)) { 2902 i6addr_t in6; 2903 2904 /* 2905 * 0/32 - use the interface's IP address. 2906 */ 2907 if ((l > 0) || 2908 ipf_ifpaddr(softc, 4, FRI_NORMAL, fin->fin_ifp, 2909 &in6, NULL) == -1) { 2910 NBUMPSIDEX(1, ns_new_ifpaddr, ns_new_ifpaddr_1); 2911 return -1; 2912 } 2913 in.s_addr = ntohl(in6.in4.s_addr); 2914 2915 } else if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0)) { 2916 /* 2917 * 0/0 - use the original source address/port. 2918 */ 2919 if (l > 0) { 2920 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_3); 2921 return -1; 2922 } 2923 in.s_addr = ntohl(fin->fin_saddr); 2924 2925 } else if ((np->in_nsrcmsk != 0xffffffff) && 2926 (np->in_spnext == 0) && ((l > 0) || (hm == NULL))) 2927 np->in_snip++; 2928 2929 natl = NULL; 2930 2931 if ((flags & IPN_TCPUDP) && 2932 ((np->in_redir & NAT_MAPBLK) == 0) && 2933 (np->in_flags & IPN_AUTOPORTMAP)) { 2934 /* 2935 * "ports auto" (without map-block) 2936 */ 2937 if ((l > 0) && np->in_ppip && (l % np->in_ppip == 0)) { 2938 if (l > np->in_space) { 2939 return -1; 2940 } else if ((l > np->in_ppip) && 2941 np->in_nsrcmsk != 0xffffffff) 2942 np->in_snip++; 2943 } 2944 if (np->in_ppip != 0) { 2945 port = ntohs(sport); 2946 port += (l % np->in_ppip); 2947 port %= np->in_ppip; 2948 port += np->in_ppip * 2949 (ntohl(fin->fin_saddr) % 2950 np->in_ippip); 2951 port += MAPBLK_MINPORT; 2952 port = htons(port); 2953 } 2954 2955 } else if (((np->in_redir & NAT_MAPBLK) == 0) && 2956 (flags & IPN_TCPUDPICMP) && (np->in_spnext != 0)) { 2957 /* 2958 * Standard port translation. Select next port. 2959 */ 2960 if (np->in_flags & IPN_SEQUENTIAL) { 2961 port = np->in_spnext; 2962 } else { 2963 port = ipf_random() % (np->in_spmax - 2964 np->in_spmin + 1); 2965 port += np->in_spmin; 2966 } 2967 port = htons(port); 2968 np->in_spnext++; 2969 2970 if (np->in_spnext > np->in_spmax) { 2971 np->in_spnext = np->in_spmin; 2972 if (np->in_nsrcmsk != 0xffffffff) 2973 np->in_snip++; 2974 } 2975 } 2976 2977 if (np->in_flags & IPN_SIPRANGE) { 2978 if (np->in_snip > ntohl(np->in_nsrcmsk)) 2979 np->in_snip = ntohl(np->in_nsrcaddr); 2980 } else { 2981 if ((np->in_nsrcmsk != 0xffffffff) && 2982 ((np->in_snip + 1) & ntohl(np->in_nsrcmsk)) > 2983 ntohl(np->in_nsrcaddr)) 2984 np->in_snip = ntohl(np->in_nsrcaddr) + 1; 2985 } 2986 2987 if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY))) 2988 port = sport; 2989 2990 /* 2991 * Here we do a lookup of the connection as seen from 2992 * the outside. If an IP# pair already exists, try 2993 * again. So if you have A->B becomes C->B, you can 2994 * also have D->E become C->E but not D->B causing 2995 * another C->B. Also take protocol and ports into 2996 * account when determining whether a pre-existing 2997 * NAT setup will cause an external conflict where 2998 * this is appropriate. 2999 */ 3000 inb.s_addr = htonl(in.s_addr); 3001 sp = fin->fin_data[0]; 3002 dp = fin->fin_data[1]; 3003 fin->fin_data[0] = fin->fin_data[1]; 3004 fin->fin_data[1] = ntohs(port); 3005 natl = ipf_nat_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH), 3006 (u_int)fin->fin_p, fin->fin_dst, inb); 3007 fin->fin_data[0] = sp; 3008 fin->fin_data[1] = dp; 3009 3010 /* 3011 * Has the search wrapped around and come back to the 3012 * start ? 3013 */ 3014 if ((natl != NULL) && 3015 (np->in_spnext != 0) && (st_port == np->in_spnext) && 3016 (np->in_snip != 0) && (st_ip == np->in_snip)) { 3017 NBUMPSIDED(1, ns_wrap); 3018 return -1; 3019 } 3020 l++; 3021 } while (natl != NULL); 3022 3023 /* Setup the NAT table */ 3024 nat->nat_osrcip = fin->fin_src; 3025 nat->nat_nsrcaddr = htonl(in.s_addr); 3026 nat->nat_odstip = fin->fin_dst; 3027 nat->nat_ndstip = fin->fin_dst; 3028 if (nat->nat_hm == NULL) 3029 nat->nat_hm = ipf_nat_hostmap(softn, np, fin->fin_src, 3030 fin->fin_dst, nat->nat_nsrcip, 3031 0); 3032 3033 if (flags & IPN_TCPUDP) { 3034 nat->nat_osport = sport; 3035 nat->nat_nsport = port; /* sport */ 3036 nat->nat_odport = dport; 3037 nat->nat_ndport = dport; 3038 ((tcphdr_t *)fin->fin_dp)->th_sport = port; 3039 } else if (flags & IPN_ICMPQUERY) { 3040 nat->nat_oicmpid = fin->fin_data[1]; 3041 ((icmphdr_t *)fin->fin_dp)->icmp_id = port; 3042 nat->nat_nicmpid = port; 3043 } 3044 return 0; 3045 } 3046 3047 3048 /* ------------------------------------------------------------------------ */ 3049 /* Function: ipf_nat_newrdr */ 3050 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */ 3051 /* allow rule to be moved if IPN_ROUNDR is set. */ 3052 /* Parameters: fin(I) - pointer to packet information */ 3053 /* nat(I) - pointer to NAT entry */ 3054 /* ni(I) - pointer to structure with misc. information needed */ 3055 /* to create new NAT entry. */ 3056 /* */ 3057 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/ 3058 /* to the new IP address for the translation. */ 3059 /* ------------------------------------------------------------------------ */ 3060 static int 3061 ipf_nat_newrdr(fr_info_t *fin, nat_t *nat, natinfo_t *ni) 3062 { 3063 ipf_main_softc_t *softc = fin->fin_main_soft; 3064 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 3065 u_short nport, dport, sport; 3066 struct in_addr in, inb; 3067 u_short sp, dp; 3068 hostmap_t *hm; 3069 u_32_t flags; 3070 ipnat_t *np; 3071 nat_t *natl; 3072 int move; 3073 3074 move = 1; 3075 hm = NULL; 3076 in.s_addr = 0; 3077 np = ni->nai_np; 3078 flags = nat->nat_flags; 3079 3080 if (flags & IPN_ICMPQUERY) { 3081 dport = fin->fin_data[1]; 3082 sport = 0; 3083 } else { 3084 sport = htons(fin->fin_data[0]); 3085 dport = htons(fin->fin_data[1]); 3086 } 3087 3088 /* TRACE sport, dport */ 3089 3090 3091 /* 3092 * If the matching rule has IPN_STICKY set, then we want to have the 3093 * same rule kick in as before. Why would this happen? If you have 3094 * a collection of rdr rules with "round-robin sticky", the current 3095 * packet might match a different one to the previous connection but 3096 * we want the same destination to be used. 3097 */ 3098 if (((np->in_flags & (IPN_ROUNDR|IPN_SPLIT)) != 0) && 3099 ((np->in_flags & IPN_STICKY) != 0)) { 3100 hm = ipf_nat_hostmap(softn, NULL, fin->fin_src, fin->fin_dst, 3101 in, (u_32_t)dport); 3102 if (hm != NULL) { 3103 in.s_addr = ntohl(hm->hm_ndstip.s_addr); 3104 np = hm->hm_ipnat; 3105 ni->nai_np = np; 3106 move = 0; 3107 ipf_nat_hostmapdel(&hm); 3108 } 3109 } 3110 3111 /* 3112 * Otherwise, it's an inbound packet. Most likely, we don't 3113 * want to rewrite source ports and source addresses. Instead, 3114 * we want to rewrite to a fixed internal address and fixed 3115 * internal port. 3116 */ 3117 if (np->in_flags & IPN_SPLIT) { 3118 in.s_addr = np->in_dnip; 3119 3120 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) { 3121 hm = ipf_nat_hostmap(softn, NULL, fin->fin_src, 3122 fin->fin_dst, in, (u_32_t)dport); 3123 if (hm != NULL) { 3124 in.s_addr = hm->hm_ndstip.s_addr; 3125 move = 0; 3126 } 3127 } 3128 3129 if (hm == NULL || hm->hm_ref == 1) { 3130 if (np->in_ndstaddr == htonl(in.s_addr)) { 3131 np->in_dnip = ntohl(np->in_ndstmsk); 3132 move = 0; 3133 } else { 3134 np->in_dnip = ntohl(np->in_ndstaddr); 3135 } 3136 } 3137 if (hm != NULL) 3138 ipf_nat_hostmapdel(&hm); 3139 3140 } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0xffffffff)) { 3141 i6addr_t in6; 3142 3143 /* 3144 * 0/32 - use the interface's IP address. 3145 */ 3146 if (ipf_ifpaddr(softc, 4, FRI_NORMAL, fin->fin_ifp, 3147 &in6, NULL) == -1) { 3148 NBUMPSIDEX(0, ns_new_ifpaddr, ns_new_ifpaddr_2); 3149 return -1; 3150 } 3151 in.s_addr = ntohl(in6.in4.s_addr); 3152 3153 } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk== 0)) { 3154 /* 3155 * 0/0 - use the original destination address/port. 3156 */ 3157 in.s_addr = ntohl(fin->fin_daddr); 3158 3159 } else if (np->in_redir == NAT_BIMAP && 3160 np->in_ndstmsk == np->in_odstmsk) { 3161 /* 3162 * map the address block in a 1:1 fashion 3163 */ 3164 in.s_addr = np->in_ndstaddr; 3165 in.s_addr |= fin->fin_daddr & ~np->in_ndstmsk; 3166 in.s_addr = ntohl(in.s_addr); 3167 } else { 3168 in.s_addr = ntohl(np->in_ndstaddr); 3169 } 3170 3171 if ((np->in_dpnext == 0) || ((flags & NAT_NOTRULEPORT) != 0)) 3172 nport = dport; 3173 else { 3174 /* 3175 * Whilst not optimized for the case where 3176 * pmin == pmax, the gain is not significant. 3177 */ 3178 if (((np->in_flags & IPN_FIXEDDPORT) == 0) && 3179 (np->in_odport != np->in_dtop)) { 3180 nport = ntohs(dport) - np->in_odport + np->in_dpmax; 3181 nport = htons(nport); 3182 } else { 3183 nport = htons(np->in_dpnext); 3184 np->in_dpnext++; 3185 if (np->in_dpnext > np->in_dpmax) 3186 np->in_dpnext = np->in_dpmin; 3187 } 3188 } 3189 3190 /* 3191 * When the redirect-to address is set to 0.0.0.0, just 3192 * assume a blank `forwarding' of the packet. We don't 3193 * setup any translation for this either. 3194 */ 3195 if (in.s_addr == 0) { 3196 if (nport == dport) { 3197 NBUMPSIDED(0, ns_xlate_null); 3198 return -1; 3199 } 3200 in.s_addr = ntohl(fin->fin_daddr); 3201 } 3202 3203 /* 3204 * Check to see if this redirect mapping already exists and if 3205 * it does, return "failure" (allowing it to be created will just 3206 * cause one or both of these "connections" to stop working.) 3207 */ 3208 inb.s_addr = htonl(in.s_addr); 3209 sp = fin->fin_data[0]; 3210 dp = fin->fin_data[1]; 3211 fin->fin_data[1] = fin->fin_data[0]; 3212 fin->fin_data[0] = ntohs(nport); 3213 natl = ipf_nat_outlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH), 3214 (u_int)fin->fin_p, inb, fin->fin_src); 3215 fin->fin_data[0] = sp; 3216 fin->fin_data[1] = dp; 3217 if (natl != NULL) { 3218 DT2(ns_new_xlate_exists, fr_info_t *, fin, nat_t *, natl); 3219 NBUMPSIDE(0, ns_xlate_exists); 3220 return -1; 3221 } 3222 3223 nat->nat_ndstaddr = htonl(in.s_addr); 3224 nat->nat_odstip = fin->fin_dst; 3225 nat->nat_nsrcip = fin->fin_src; 3226 nat->nat_osrcip = fin->fin_src; 3227 if ((nat->nat_hm == NULL) && ((np->in_flags & IPN_STICKY) != 0)) 3228 nat->nat_hm = ipf_nat_hostmap(softn, np, fin->fin_src, 3229 fin->fin_dst, in, (u_32_t)dport); 3230 3231 if (flags & IPN_TCPUDP) { 3232 nat->nat_odport = dport; 3233 nat->nat_ndport = nport; 3234 nat->nat_osport = sport; 3235 nat->nat_nsport = sport; 3236 ((tcphdr_t *)fin->fin_dp)->th_dport = nport; 3237 } else if (flags & IPN_ICMPQUERY) { 3238 nat->nat_oicmpid = fin->fin_data[1]; 3239 ((icmphdr_t *)fin->fin_dp)->icmp_id = nport; 3240 nat->nat_nicmpid = nport; 3241 } 3242 3243 return move; 3244 } 3245 3246 /* ------------------------------------------------------------------------ */ 3247 /* Function: ipf_nat_add */ 3248 /* Returns: nat_t* - NULL == failure to create new NAT structure, */ 3249 /* else pointer to new NAT structure */ 3250 /* Parameters: fin(I) - pointer to packet information */ 3251 /* np(I) - pointer to NAT rule */ 3252 /* natsave(I) - pointer to where to store NAT struct pointer */ 3253 /* flags(I) - flags describing the current packet */ 3254 /* direction(I) - direction of packet (in/out) */ 3255 /* Write Lock: ipf_nat */ 3256 /* */ 3257 /* Attempts to create a new NAT entry. Does not actually change the packet */ 3258 /* in any way. */ 3259 /* */ 3260 /* This fucntion is in three main parts: (1) deal with creating a new NAT */ 3261 /* structure for a "MAP" rule (outgoing NAT translation); (2) deal with */ 3262 /* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */ 3263 /* and (3) building that structure and putting it into the NAT table(s). */ 3264 /* */ 3265 /* NOTE: natsave should NOT be used top point back to an ipstate_t struct */ 3266 /* as it can result in memory being corrupted. */ 3267 /* ------------------------------------------------------------------------ */ 3268 nat_t * 3269 ipf_nat_add(fr_info_t *fin, ipnat_t *np, nat_t **natsave, u_int flags, 3270 int direction) 3271 { 3272 ipf_main_softc_t *softc = fin->fin_main_soft; 3273 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 3274 hostmap_t *hm = NULL; 3275 nat_t *nat, *natl; 3276 natstat_t *nsp; 3277 u_int nflags; 3278 natinfo_t ni; 3279 int move; 3280 3281 memset(&ni, 0, sizeof ni); /* XXX gcc */ 3282 nsp = &softn->ipf_nat_stats; 3283 3284 if ((nsp->ns_active * 100 / softn->ipf_nat_table_max) > 3285 softn->ipf_nat_table_wm_high) { 3286 softn->ipf_nat_doflush = 1; 3287 } 3288 3289 if (nsp->ns_active >= softn->ipf_nat_table_max) { 3290 NBUMPSIDED(fin->fin_out, ns_table_max); 3291 return NULL; 3292 } 3293 3294 move = 1; 3295 nflags = np->in_flags & flags; 3296 nflags &= NAT_FROMRULE; 3297 3298 ni.nai_np = np; 3299 ni.nai_dport = 0; 3300 ni.nai_sport = 0; 3301 3302 /* Give me a new nat */ 3303 KMALLOC(nat, nat_t *); 3304 if (nat == NULL) { 3305 NBUMPSIDED(fin->fin_out, ns_memfail); 3306 /* 3307 * Try to automatically tune the max # of entries in the 3308 * table allowed to be less than what will cause kmem_alloc() 3309 * to fail and try to eliminate panics due to out of memory 3310 * conditions arising. 3311 */ 3312 if ((softn->ipf_nat_table_max > softn->ipf_nat_table_sz) && 3313 (nsp->ns_active > 100)) { 3314 softn->ipf_nat_table_max = nsp->ns_active - 100; 3315 printf("table_max reduced to %d\n", 3316 softn->ipf_nat_table_max); 3317 } 3318 return NULL; 3319 } 3320 3321 if (flags & IPN_ICMPQUERY) { 3322 /* 3323 * In the ICMP query NAT code, we translate the ICMP id fields 3324 * to make them unique. This is indepedent of the ICMP type 3325 * (e.g. in the unlikely event that a host sends an echo and 3326 * an tstamp request with the same id, both packets will have 3327 * their ip address/id field changed in the same way). 3328 */ 3329 /* The icmp_id field is used by the sender to identify the 3330 * process making the icmp request. (the receiver justs 3331 * copies it back in its response). So, it closely matches 3332 * the concept of source port. We overlay sport, so we can 3333 * maximally reuse the existing code. 3334 */ 3335 ni.nai_sport = fin->fin_data[1]; 3336 ni.nai_dport = 0; 3337 } 3338 3339 bzero((char *)nat, sizeof(*nat)); 3340 nat->nat_flags = flags; 3341 nat->nat_redir = np->in_redir; 3342 nat->nat_dir = direction; 3343 nat->nat_pr[0] = fin->fin_p; 3344 nat->nat_pr[1] = fin->fin_p; 3345 3346 /* 3347 * Search the current table for a match and create a new mapping 3348 * if there is none found. 3349 */ 3350 if (np->in_redir & (NAT_ENCAP|NAT_DIVERTUDP)) { 3351 move = ipf_nat_newdivert(fin, nat, &ni); 3352 3353 } else if (np->in_redir & NAT_REWRITE) { 3354 move = ipf_nat_newrewrite(fin, nat, &ni); 3355 3356 } else if (direction == NAT_OUTBOUND) { 3357 /* 3358 * We can now arrange to call this for the same connection 3359 * because ipf_nat_new doesn't protect the code path into 3360 * this function. 3361 */ 3362 natl = ipf_nat_outlookup(fin, nflags, (u_int)fin->fin_p, 3363 fin->fin_src, fin->fin_dst); 3364 if (natl != NULL) { 3365 KFREE(nat); 3366 nat = natl; 3367 goto done; 3368 } 3369 3370 move = ipf_nat_newmap(fin, nat, &ni); 3371 } else { 3372 /* 3373 * NAT_INBOUND is used for redirects rules 3374 */ 3375 natl = ipf_nat_inlookup(fin, nflags, (u_int)fin->fin_p, 3376 fin->fin_src, fin->fin_dst); 3377 if (natl != NULL) { 3378 KFREE(nat); 3379 nat = natl; 3380 goto done; 3381 } 3382 3383 move = ipf_nat_newrdr(fin, nat, &ni); 3384 } 3385 if (move == -1) 3386 goto badnat; 3387 3388 np = ni.nai_np; 3389 3390 nat->nat_mssclamp = np->in_mssclamp; 3391 nat->nat_me = natsave; 3392 if (natsave != NULL) 3393 *natsave = nat; 3394 nat->nat_fr = fin->fin_fr; 3395 nat->nat_rev = fin->fin_rev; 3396 nat->nat_ptr = np; 3397 nat->nat_dlocal = np->in_dlocal; 3398 3399 if ((np->in_apr != NULL) && ((nat->nat_flags & NAT_SLAVE) == 0)) 3400 if (ipf_proxy_new(fin, nat) == -1) 3401 goto badnat; 3402 3403 nat->nat_ifps[0] = np->in_ifps[0]; 3404 if (np->in_ifps[0] != NULL) { 3405 COPYIFNAME(np->in_v[0], np->in_ifps[0], nat->nat_ifnames[0]); 3406 } 3407 3408 nat->nat_ifps[1] = np->in_ifps[1]; 3409 if (np->in_ifps[1] != NULL) { 3410 COPYIFNAME(np->in_v[1], np->in_ifps[1], nat->nat_ifnames[1]); 3411 } 3412 3413 if (ipf_nat_finalise(fin, nat) == -1) { 3414 goto badnat; 3415 } 3416 3417 np->in_use++; 3418 3419 if ((move == 1) && (np->in_flags & IPN_ROUNDR)) { 3420 if ((np->in_redir & (NAT_REDIRECT|NAT_MAP)) == NAT_REDIRECT) { 3421 ipf_nat_delrdr(softn, np); 3422 ipf_nat_addrdr(softn, np); 3423 } else if ((np->in_redir & (NAT_REDIRECT|NAT_MAP)) == NAT_MAP) { 3424 ipf_nat_delmap(softn, np); 3425 ipf_nat_addmap(softn, np); 3426 } 3427 } 3428 3429 if (flags & SI_WILDP) 3430 nsp->ns_wilds++; 3431 nsp->ns_proto[nat->nat_pr[0]]++; 3432 3433 goto done; 3434 badnat: 3435 DT2(ns_badnatnew, fr_info_t *, fin, nat_t *, nat); 3436 NBUMPSIDE(fin->fin_out, ns_badnatnew); 3437 if ((hm = nat->nat_hm) != NULL) 3438 ipf_nat_hostmapdel(&hm); 3439 KFREE(nat); 3440 nat = NULL; 3441 done: 3442 if (nat != NULL && np != NULL) 3443 np->in_hits++; 3444 return nat; 3445 } 3446 3447 3448 /* ------------------------------------------------------------------------ */ 3449 /* Function: ipf_nat_finalise */ 3450 /* Returns: int - 0 == sucess, -1 == failure */ 3451 /* Parameters: fin(I) - pointer to packet information */ 3452 /* nat(I) - pointer to NAT entry */ 3453 /* Write Lock: ipf_nat */ 3454 /* */ 3455 /* This is the tail end of constructing a new NAT entry and is the same */ 3456 /* for both IPv4 and IPv6. */ 3457 /* ------------------------------------------------------------------------ */ 3458 /*ARGSUSED*/ 3459 static int 3460 ipf_nat_finalise(fr_info_t *fin, nat_t *nat) 3461 { 3462 ipf_main_softc_t *softc = fin->fin_main_soft; 3463 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 3464 u_32_t sum1, sum2, sumd; 3465 frentry_t *fr; 3466 u_32_t flags; 3467 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) && defined(ICK_M_CTL_MAGIC) 3468 qpktinfo_t *qpi = fin->fin_qpi; 3469 #endif 3470 3471 flags = nat->nat_flags; 3472 3473 switch (nat->nat_pr[0]) 3474 { 3475 case IPPROTO_ICMP : 3476 sum1 = LONG_SUM(ntohs(nat->nat_osport)); 3477 sum2 = LONG_SUM(ntohs(nat->nat_nsport)); 3478 CALC_SUMD(sum1, sum2, sumd); 3479 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 3480 3481 break; 3482 3483 default : 3484 sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr) + \ 3485 ntohs(nat->nat_osport)); 3486 sum2 = LONG_SUM(ntohl(nat->nat_nsrcaddr) + \ 3487 ntohs(nat->nat_nsport)); 3488 CALC_SUMD(sum1, sum2, sumd); 3489 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 3490 3491 sum1 = LONG_SUM(ntohl(nat->nat_odstaddr) + \ 3492 ntohs(nat->nat_odport)); 3493 sum2 = LONG_SUM(ntohl(nat->nat_ndstaddr) + \ 3494 ntohs(nat->nat_ndport)); 3495 CALC_SUMD(sum1, sum2, sumd); 3496 nat->nat_sumd[0] += (sumd & 0xffff) + (sumd >> 16); 3497 break; 3498 } 3499 3500 #if SOLARIS && defined(_KERNEL) 3501 # if (SOLARIS2 >= 6) && defined(ICK_M_CTL_MAGIC) 3502 if ((flags & IPN_TCP) && dohwcksum && 3503 (((ill_t *)qpi->qpi_ill)->ill_ick.ick_magic == ICK_M_CTL_MAGIC)) { 3504 sum1 = LONG_SUM(ntohl(nat->nat_nsrcaddr)); 3505 sum1 += LONG_SUM(ntohl(nat->nat_ndstaddr)); 3506 sum1 += 30; 3507 sum1 = (sum1 & 0xffff) + (sum1 >> 16); 3508 nat->nat_sumd[1] = NAT_HW_CKSUM|(sum1 & 0xffff); 3509 } else 3510 # endif 3511 # if defined(NET_HCK_NONE) 3512 if ((flags & IPN_TCPUDP) && dohwcksum) { 3513 mblk_t *m = fin->fin_m; 3514 u_int flags = net_ispartialchecksum(softc->ipf_nd_v4, m); 3515 3516 if (flags & NET_HCK_L4_PART) { 3517 sum1 = LONG_SUM(ntohl(nat->nat_nsrcaddr)); 3518 sum1 += LONG_SUM(ntohl(nat->nat_ndstaddr)); 3519 sum1 += fin->fin_p; 3520 sum1 = htons(sum1); 3521 3522 nat->nat_sumd[1] = (sum1 & 0xffff) + (sum1 >> 16); 3523 nat->nat_sumd[1] |= NAT_HW_CKSUM; 3524 } else if (flags & NET_HCK_L4_FULL) { 3525 nat->nat_sumd[1] = NAT_HW_CKSUM; 3526 } else { 3527 nat->nat_sumd[1] = nat->nat_sumd[0]; 3528 } 3529 } else 3530 # endif 3531 #endif 3532 nat->nat_sumd[1] = nat->nat_sumd[0]; 3533 3534 sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr)); 3535 sum2 = LONG_SUM(ntohl(nat->nat_nsrcaddr)); 3536 CALC_SUMD(sum1, sum2, sumd); 3537 nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16); 3538 3539 sum1 = LONG_SUM(ntohl(nat->nat_odstaddr)); 3540 sum2 = LONG_SUM(ntohl(nat->nat_ndstaddr)); 3541 CALC_SUMD(sum1, sum2, sumd); 3542 nat->nat_ipsumd += (sumd & 0xffff) + (sumd >> 16); 3543 3544 nat->nat_v[0] = 4; 3545 nat->nat_v[1] = 4; 3546 3547 if ((nat->nat_ifps[0] != NULL) && (nat->nat_ifps[0] != (void *)-1)) { 3548 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]); 3549 } 3550 3551 if ((nat->nat_ifps[1] != NULL) && (nat->nat_ifps[1] != (void *)-1)) { 3552 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]); 3553 } 3554 3555 if ((nat->nat_flags & SI_CLONE) == 0) 3556 nat->nat_sync = ipf_sync_new(softc, SMC_NAT, fin, nat); 3557 3558 if (ipf_nat_insert(softc, softn, nat) == 0) { 3559 if (softn->ipf_nat_logging) 3560 ipf_nat_log(softc, softn, nat, NL_NEW); 3561 fr = nat->nat_fr; 3562 if (fr != NULL) { 3563 MUTEX_ENTER(&fr->fr_lock); 3564 fr->fr_ref++; 3565 MUTEX_EXIT(&fr->fr_lock); 3566 } 3567 return 0; 3568 } 3569 3570 NBUMPSIDED(fin->fin_out, ns_unfinalised); 3571 /* 3572 * nat_insert failed, so cleanup time... 3573 */ 3574 return -1; 3575 } 3576 3577 3578 /* ------------------------------------------------------------------------ */ 3579 /* Function: ipf_nat_insert */ 3580 /* Returns: int - 0 == sucess, -1 == failure */ 3581 /* Parameters: nat(I) - pointer to NAT structure */ 3582 /* rev(I) - flag indicating forward/reverse direction of packet */ 3583 /* Write Lock: ipf_nat */ 3584 /* */ 3585 /* Insert a NAT entry into the hash tables for searching and add it to the */ 3586 /* list of active NAT entries. Adjust global counters when complete. */ 3587 /* ------------------------------------------------------------------------ */ 3588 int 3589 ipf_nat_insert(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, nat_t *nat) 3590 { 3591 u_int hv0, hv1, rhv0, rhv1; 3592 ipnat_t *in; 3593 nat_t **natp; 3594 3595 /* 3596 * Try and return an error as early as possible, so calculate the hash 3597 * entry numbers first and then proceed. 3598 */ 3599 if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) { 3600 rhv0 = NAT_HASH_FN(nat->nat_osrcaddr, nat->nat_osport, 3601 0xffffffff); 3602 rhv0 = NAT_HASH_FN(nat->nat_odstaddr, rhv0 + nat->nat_odport, 3603 0xffffffff); 3604 3605 /* 3606 * TRACE nat_osrcaddr, nat_osport, nat_odstaddr, 3607 * nat_odport, hv0 3608 */ 3609 3610 rhv1 = NAT_HASH_FN(nat->nat_nsrcaddr, nat->nat_nsport, 3611 0xffffffff); 3612 rhv1 = NAT_HASH_FN(nat->nat_ndstaddr, rhv1 + nat->nat_ndport, 3613 0xffffffff); 3614 /* 3615 * TRACE nat_nsrcaddr, nat_nsport, nat_ndstaddr, 3616 * nat_ndport, hv1 3617 */ 3618 } else { 3619 rhv0 = NAT_HASH_FN(nat->nat_osrcaddr, 0, 0xffffffff); 3620 rhv0 = NAT_HASH_FN(nat->nat_odstaddr, rhv0, 0xffffffff); 3621 /* TRACE nat_osrcaddr, nat_odstaddr, rhv0 */ 3622 3623 rhv1 = NAT_HASH_FN(nat->nat_nsrcaddr, 0, 0xffffffff); 3624 rhv1 = NAT_HASH_FN(nat->nat_ndstaddr, rhv1, 0xffffffff); 3625 /* TRACE nat_nsrcaddr, nat_ndstaddr, rhv1 */ 3626 } 3627 hv0 = rhv0 % softn->ipf_nat_table_sz; 3628 hv1 = rhv1 % softn->ipf_nat_table_sz; 3629 3630 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0] >= 3631 softn->ipf_nat_maxbucket) { 3632 DT1(ns_bucket_max_0, int, 3633 softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0]); 3634 NBUMPSIDE(0, ns_bucket_max); 3635 return -1; 3636 } 3637 3638 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen[hv1] >= 3639 softn->ipf_nat_maxbucket) { 3640 DT1(ns_bucket_max_1, int, 3641 softn->ipf_nat_stats.ns_side[1].ns_bucketlen[hv1]); 3642 NBUMPSIDE(1, ns_bucket_max); 3643 return -1; 3644 } 3645 3646 if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_ENCAPIN || 3647 nat->nat_dir == NAT_DIVERTIN) { 3648 u_int swap; 3649 3650 swap = hv0; 3651 hv0 = hv1; 3652 hv1 = swap; 3653 } 3654 nat->nat_hv[0] = rhv0; 3655 nat->nat_hv[1] = rhv1; 3656 3657 MUTEX_INIT(&nat->nat_lock, "nat entry lock"); 3658 3659 in = nat->nat_ptr; 3660 nat->nat_ref = nat->nat_me ? 2 : 1; 3661 3662 nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0'; 3663 nat->nat_ifps[0] = ipf_resolvenic(softc, nat->nat_ifnames[0], 4); 3664 3665 if (nat->nat_ifnames[1][0] != '\0') { 3666 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0'; 3667 nat->nat_ifps[1] = ipf_resolvenic(softc, 3668 nat->nat_ifnames[1], 4); 3669 } else if (in->in_ifnames[1] != -1) { 3670 char *name; 3671 3672 name = in->in_names + in->in_ifnames[1]; 3673 if (name[1] != '\0' && name[0] != '-' && name[0] != '*') { 3674 (void) strncpy(nat->nat_ifnames[1], 3675 nat->nat_ifnames[0], LIFNAMSIZ); 3676 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0'; 3677 nat->nat_ifps[1] = nat->nat_ifps[0]; 3678 } 3679 } 3680 if ((nat->nat_ifps[0] != NULL) && (nat->nat_ifps[0] != (void *)-1)) { 3681 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]); 3682 } 3683 if ((nat->nat_ifps[1] != NULL) && (nat->nat_ifps[1] != (void *)-1)) { 3684 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]); 3685 } 3686 3687 /* 3688 * The ordering of operations in the list and hash table insertion 3689 * is very important. The last operation for each task should be 3690 * to update the top of the list, after all the "nexts" have been 3691 * done so that walking the list while it is being done does not 3692 * find strange pointers. 3693 * 3694 * Global list of NAT instances 3695 */ 3696 nat->nat_next = softn->ipf_nat_instances; 3697 nat->nat_pnext = &softn->ipf_nat_instances; 3698 if (softn->ipf_nat_instances) 3699 softn->ipf_nat_instances->nat_pnext = &nat->nat_next; 3700 softn->ipf_nat_instances = nat; 3701 3702 /* 3703 * Inbound hash table. 3704 */ 3705 natp = &softn->ipf_nat_table[0][hv0]; 3706 nat->nat_phnext[0] = natp; 3707 nat->nat_hnext[0] = *natp; 3708 if (*natp) { 3709 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 3710 } else { 3711 NBUMPSIDE(0, ns_inuse); 3712 } 3713 *natp = nat; 3714 NBUMPSIDE(0, ns_bucketlen[hv0]); 3715 3716 /* 3717 * Outbound hash table. 3718 */ 3719 natp = &softn->ipf_nat_table[1][hv1]; 3720 nat->nat_phnext[1] = natp; 3721 nat->nat_hnext[1] = *natp; 3722 if (*natp) 3723 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 3724 else { 3725 NBUMPSIDE(1, ns_inuse); 3726 } 3727 *natp = nat; 3728 NBUMPSIDE(1, ns_bucketlen[hv1]); 3729 3730 /* ---- */ 3731 3732 ipf_nat_setqueue(softc, softn, nat); 3733 3734 if (nat->nat_dir & NAT_OUTBOUND) { 3735 NBUMPSIDE(1, ns_added); 3736 } else { 3737 NBUMPSIDE(0, ns_added); 3738 } 3739 softn->ipf_nat_stats.ns_active++; 3740 return 0; 3741 } 3742 3743 3744 /* ------------------------------------------------------------------------ */ 3745 /* Function: ipf_nat_icmperrorlookup */ 3746 /* Returns: nat_t* - point to matching NAT structure */ 3747 /* Parameters: fin(I) - pointer to packet information */ 3748 /* dir(I) - direction of packet (in/out) */ 3749 /* */ 3750 /* Check if the ICMP error message is related to an existing TCP, UDP or */ 3751 /* ICMP query nat entry. It is assumed that the packet is already of the */ 3752 /* the required length. */ 3753 /* ------------------------------------------------------------------------ */ 3754 nat_t * 3755 ipf_nat_icmperrorlookup(fr_info_t *fin, int dir) 3756 { 3757 ipf_main_softc_t *softc = fin->fin_main_soft; 3758 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 3759 int flags = 0, type, minlen; 3760 icmphdr_t *icmp, *orgicmp; 3761 nat_stat_side_t *nside; 3762 tcphdr_t *tcp = NULL; 3763 u_short data[2]; 3764 nat_t *nat; 3765 ip_t *oip; 3766 u_int p; 3767 3768 icmp = fin->fin_dp; 3769 type = icmp->icmp_type; 3770 nside = &softn->ipf_nat_stats.ns_side[fin->fin_out]; 3771 /* 3772 * Does it at least have the return (basic) IP header ? 3773 * Only a basic IP header (no options) should be with an ICMP error 3774 * header. Also, if it's not an error type, then return. 3775 */ 3776 if ((fin->fin_hlen != sizeof(ip_t)) || !(fin->fin_flx & FI_ICMPERR)) { 3777 ATOMIC_INCL(nside->ns_icmp_basic); 3778 return NULL; 3779 } 3780 3781 /* 3782 * Check packet size 3783 */ 3784 oip = (ip_t *)((char *)fin->fin_dp + 8); 3785 minlen = IP_HL(oip) << 2; 3786 if ((minlen < sizeof(ip_t)) || 3787 (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen)) { 3788 ATOMIC_INCL(nside->ns_icmp_size); 3789 return NULL; 3790 } 3791 3792 /* 3793 * Is the buffer big enough for all of it ? It's the size of the IP 3794 * header claimed in the encapsulated part which is of concern. It 3795 * may be too big to be in this buffer but not so big that it's 3796 * outside the ICMP packet, leading to TCP deref's causing problems. 3797 * This is possible because we don't know how big oip_hl is when we 3798 * do the pullup early in ipf_check() and thus can't gaurantee it is 3799 * all here now. 3800 */ 3801 #ifdef ipf_nat_KERNEL 3802 { 3803 mb_t *m; 3804 3805 m = fin->fin_m; 3806 # if defined(MENTAT) 3807 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > 3808 (char *)m->b_wptr) { 3809 ATOMIC_INCL(nside->ns_icmp_mbuf); 3810 return NULL; 3811 } 3812 # else 3813 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > 3814 (char *)fin->fin_ip + M_LEN(m)) { 3815 ATOMIC_INCL(nside->ns_icmp_mbuf); 3816 return NULL; 3817 } 3818 # endif 3819 } 3820 #endif 3821 3822 if (fin->fin_daddr != oip->ip_src.s_addr) { 3823 ATOMIC_INCL(nside->ns_icmp_address); 3824 return NULL; 3825 } 3826 3827 p = oip->ip_p; 3828 if (p == IPPROTO_TCP) 3829 flags = IPN_TCP; 3830 else if (p == IPPROTO_UDP) 3831 flags = IPN_UDP; 3832 else if (p == IPPROTO_ICMP) { 3833 orgicmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 3834 3835 /* see if this is related to an ICMP query */ 3836 if (ipf_nat_icmpquerytype(orgicmp->icmp_type)) { 3837 data[0] = fin->fin_data[0]; 3838 data[1] = fin->fin_data[1]; 3839 fin->fin_data[0] = 0; 3840 fin->fin_data[1] = orgicmp->icmp_id; 3841 3842 flags = IPN_ICMPERR|IPN_ICMPQUERY; 3843 /* 3844 * NOTE : dir refers to the direction of the original 3845 * ip packet. By definition the icmp error 3846 * message flows in the opposite direction. 3847 */ 3848 if (dir == NAT_INBOUND) 3849 nat = ipf_nat_inlookup(fin, flags, p, 3850 oip->ip_dst, 3851 oip->ip_src); 3852 else 3853 nat = ipf_nat_outlookup(fin, flags, p, 3854 oip->ip_dst, 3855 oip->ip_src); 3856 fin->fin_data[0] = data[0]; 3857 fin->fin_data[1] = data[1]; 3858 return nat; 3859 } 3860 } 3861 3862 if (flags & IPN_TCPUDP) { 3863 minlen += 8; /* + 64bits of data to get ports */ 3864 /* TRACE (fin,minlen) */ 3865 if (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen) { 3866 ATOMIC_INCL(nside->ns_icmp_short); 3867 return NULL; 3868 } 3869 3870 data[0] = fin->fin_data[0]; 3871 data[1] = fin->fin_data[1]; 3872 tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2)); 3873 fin->fin_data[0] = ntohs(tcp->th_dport); 3874 fin->fin_data[1] = ntohs(tcp->th_sport); 3875 3876 if (dir == NAT_INBOUND) { 3877 nat = ipf_nat_inlookup(fin, flags, p, oip->ip_dst, 3878 oip->ip_src); 3879 } else { 3880 nat = ipf_nat_outlookup(fin, flags, p, oip->ip_dst, 3881 oip->ip_src); 3882 } 3883 fin->fin_data[0] = data[0]; 3884 fin->fin_data[1] = data[1]; 3885 return nat; 3886 } 3887 if (dir == NAT_INBOUND) 3888 nat = ipf_nat_inlookup(fin, 0, p, oip->ip_dst, oip->ip_src); 3889 else 3890 nat = ipf_nat_outlookup(fin, 0, p, oip->ip_dst, oip->ip_src); 3891 3892 return nat; 3893 } 3894 3895 3896 /* ------------------------------------------------------------------------ */ 3897 /* Function: ipf_nat_icmperror */ 3898 /* Returns: nat_t* - point to matching NAT structure */ 3899 /* Parameters: fin(I) - pointer to packet information */ 3900 /* nflags(I) - NAT flags for this packet */ 3901 /* dir(I) - direction of packet (in/out) */ 3902 /* */ 3903 /* Fix up an ICMP packet which is an error message for an existing NAT */ 3904 /* session. This will correct both packet header data and checksums. */ 3905 /* */ 3906 /* This should *ONLY* be used for incoming ICMP error packets to make sure */ 3907 /* a NAT'd ICMP packet gets correctly recognised. */ 3908 /* ------------------------------------------------------------------------ */ 3909 nat_t * 3910 ipf_nat_icmperror(fr_info_t *fin, u_int *nflags, int dir) 3911 { 3912 ipf_main_softc_t *softc = fin->fin_main_soft; 3913 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 3914 u_32_t sum1, sum2, sumd, sumd2; 3915 struct in_addr a1, a2, a3, a4; 3916 int flags, dlen, odst; 3917 icmphdr_t *icmp; 3918 u_short *csump; 3919 tcphdr_t *tcp; 3920 nat_t *nat; 3921 ip_t *oip; 3922 void *dp; 3923 3924 if ((fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) { 3925 NBUMPSIDED(fin->fin_out, ns_icmp_short); 3926 return NULL; 3927 } 3928 3929 /* 3930 * ipf_nat_icmperrorlookup() will return NULL for `defective' packets. 3931 */ 3932 if ((fin->fin_v != 4) || !(nat = ipf_nat_icmperrorlookup(fin, dir))) { 3933 NBUMPSIDED(fin->fin_out, ns_icmp_notfound); 3934 return NULL; 3935 } 3936 3937 if (nat->nat_dir == NAT_ENCAPIN || nat->nat_dir == NAT_ENCAPOUT) { 3938 /* 3939 * For ICMP replies to encapsulated packets, we need to 3940 * rebuild the ICMP reply completely to match the original 3941 * packet... 3942 */ 3943 if (ipf_nat_rebuildencapicmp(fin, nat) == 0) 3944 return nat; 3945 NBUMPSIDED(fin->fin_out, ns_icmp_rebuild); 3946 return NULL; 3947 } 3948 3949 tcp = NULL; 3950 csump = NULL; 3951 flags = 0; 3952 sumd2 = 0; 3953 *nflags = IPN_ICMPERR; 3954 icmp = fin->fin_dp; 3955 oip = (ip_t *)&icmp->icmp_ip; 3956 dp = (((char *)oip) + (IP_HL(oip) << 2)); 3957 if (oip->ip_p == IPPROTO_TCP) { 3958 tcp = (tcphdr_t *)dp; 3959 csump = (u_short *)&tcp->th_sum; 3960 flags = IPN_TCP; 3961 } else if (oip->ip_p == IPPROTO_UDP) { 3962 udphdr_t *udp; 3963 3964 udp = (udphdr_t *)dp; 3965 tcp = (tcphdr_t *)dp; 3966 csump = (u_short *)&udp->uh_sum; 3967 flags = IPN_UDP; 3968 } else if (oip->ip_p == IPPROTO_ICMP) 3969 flags = IPN_ICMPQUERY; 3970 dlen = fin->fin_plen - ((char *)dp - (char *)fin->fin_ip); 3971 3972 /* 3973 * Need to adjust ICMP header to include the real IP#'s and 3974 * port #'s. Only apply a checksum change relative to the 3975 * IP address change as it will be modified again in ipf_nat_checkout 3976 * for both address and port. Two checksum changes are 3977 * necessary for the two header address changes. Be careful 3978 * to only modify the checksum once for the port # and twice 3979 * for the IP#. 3980 */ 3981 3982 /* 3983 * Step 1 3984 * Fix the IP addresses in the offending IP packet. You also need 3985 * to adjust the IP header checksum of that offending IP packet. 3986 * 3987 * Normally, you would expect that the ICMP checksum of the 3988 * ICMP error message needs to be adjusted as well for the 3989 * IP address change in oip. 3990 * However, this is a NOP, because the ICMP checksum is 3991 * calculated over the complete ICMP packet, which includes the 3992 * changed oip IP addresses and oip->ip_sum. However, these 3993 * two changes cancel each other out (if the delta for 3994 * the IP address is x, then the delta for ip_sum is minus x), 3995 * so no change in the icmp_cksum is necessary. 3996 * 3997 * Inbound ICMP 3998 * ------------ 3999 * MAP rule, SRC=a,DST=b -> SRC=c,DST=b 4000 * - response to outgoing packet (a,b)=>(c,b) (OIP_SRC=c,OIP_DST=b) 4001 * - OIP_SRC(c)=nat_newsrcip, OIP_DST(b)=nat_newdstip 4002 *=> OIP_SRC(c)=nat_oldsrcip, OIP_DST(b)=nat_olddstip 4003 * 4004 * RDR rule, SRC=a,DST=b -> SRC=a,DST=c 4005 * - response to outgoing packet (c,a)=>(b,a) (OIP_SRC=b,OIP_DST=a) 4006 * - OIP_SRC(b)=nat_olddstip, OIP_DST(a)=nat_oldsrcip 4007 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip 4008 * 4009 * REWRITE out rule, SRC=a,DST=b -> SRC=c,DST=d 4010 * - response to outgoing packet (a,b)=>(c,d) (OIP_SRC=c,OIP_DST=d) 4011 * - OIP_SRC(c)=nat_newsrcip, OIP_DST(d)=nat_newdstip 4012 *=> OIP_SRC(c)=nat_oldsrcip, OIP_DST(d)=nat_olddstip 4013 * 4014 * REWRITE in rule, SRC=a,DST=b -> SRC=c,DST=d 4015 * - response to outgoing packet (d,c)=>(b,a) (OIP_SRC=b,OIP_DST=a) 4016 * - OIP_SRC(b)=nat_olddstip, OIP_DST(a)=nat_oldsrcip 4017 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip 4018 * 4019 * Outbound ICMP 4020 * ------------- 4021 * MAP rule, SRC=a,DST=b -> SRC=c,DST=b 4022 * - response to incoming packet (b,c)=>(b,a) (OIP_SRC=b,OIP_DST=a) 4023 * - OIP_SRC(b)=nat_olddstip, OIP_DST(a)=nat_oldsrcip 4024 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip 4025 * 4026 * RDR rule, SRC=a,DST=b -> SRC=a,DST=c 4027 * - response to incoming packet (a,b)=>(a,c) (OIP_SRC=a,OIP_DST=c) 4028 * - OIP_SRC(a)=nat_newsrcip, OIP_DST(c)=nat_newdstip 4029 *=> OIP_SRC(a)=nat_oldsrcip, OIP_DST(c)=nat_olddstip 4030 * 4031 * REWRITE out rule, SRC=a,DST=b -> SRC=c,DST=d 4032 * - response to incoming packet (d,c)=>(b,a) (OIP_SRC=c,OIP_DST=d) 4033 * - OIP_SRC(c)=nat_olddstip, OIP_DST(d)=nat_oldsrcip 4034 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip 4035 * 4036 * REWRITE in rule, SRC=a,DST=b -> SRC=c,DST=d 4037 * - response to incoming packet (a,b)=>(c,d) (OIP_SRC=b,OIP_DST=a) 4038 * - OIP_SRC(b)=nat_newsrcip, OIP_DST(a)=nat_newdstip 4039 *=> OIP_SRC(a)=nat_oldsrcip, OIP_DST(c)=nat_olddstip 4040 */ 4041 4042 if (((fin->fin_out == 0) && ((nat->nat_redir & NAT_MAP) != 0)) || 4043 ((fin->fin_out == 1) && ((nat->nat_redir & NAT_REDIRECT) != 0))) { 4044 a1.s_addr = ntohl(nat->nat_osrcaddr); 4045 a4.s_addr = ntohl(oip->ip_src.s_addr); 4046 a3.s_addr = ntohl(nat->nat_odstaddr); 4047 a2.s_addr = ntohl(oip->ip_dst.s_addr); 4048 oip->ip_src.s_addr = htonl(a1.s_addr); 4049 oip->ip_dst.s_addr = htonl(a3.s_addr); 4050 odst = 1; 4051 } else { 4052 a1.s_addr = ntohl(nat->nat_ndstaddr); 4053 a2.s_addr = ntohl(oip->ip_dst.s_addr); 4054 a3.s_addr = ntohl(nat->nat_nsrcaddr); 4055 a4.s_addr = ntohl(oip->ip_src.s_addr); 4056 oip->ip_dst.s_addr = htonl(a3.s_addr); 4057 oip->ip_src.s_addr = htonl(a1.s_addr); 4058 odst = 0; 4059 } 4060 sumd = 0; 4061 if ((a3.s_addr != a2.s_addr) || (a1.s_addr != a4.s_addr)) { 4062 if (a3.s_addr > a2.s_addr) 4063 sumd = a2.s_addr - a3.s_addr - 1; 4064 else 4065 sumd = a2.s_addr - a3.s_addr; 4066 if (a1.s_addr > a4.s_addr) 4067 sumd += a4.s_addr - a1.s_addr - 1; 4068 else 4069 sumd += a4.s_addr - a1.s_addr; 4070 sumd = ~sumd; 4071 4072 ipf_fix_datacksum(&oip->ip_sum, sumd); 4073 } 4074 4075 sumd2 = sumd; 4076 sum1 = 0; 4077 sum2 = 0; 4078 4079 /* 4080 * Fix UDP pseudo header checksum to compensate for the 4081 * IP address change. 4082 */ 4083 if (((flags & IPN_TCPUDP) != 0) && (dlen >= 4)) { 4084 u_32_t sum3, sum4; 4085 /* 4086 * Step 2 : 4087 * For offending TCP/UDP IP packets, translate the ports as 4088 * well, based on the NAT specification. Of course such 4089 * a change may be reflected in the ICMP checksum as well. 4090 * 4091 * Since the port fields are part of the TCP/UDP checksum 4092 * of the offending IP packet, you need to adjust that checksum 4093 * as well... except that the change in the port numbers should 4094 * be offset by the checksum change. However, the TCP/UDP 4095 * checksum will also need to change if there has been an 4096 * IP address change. 4097 */ 4098 if (odst == 1) { 4099 sum1 = ntohs(nat->nat_osport); 4100 sum4 = ntohs(tcp->th_sport); 4101 sum3 = ntohs(nat->nat_odport); 4102 sum2 = ntohs(tcp->th_dport); 4103 4104 tcp->th_sport = htons(sum1); 4105 tcp->th_dport = htons(sum3); 4106 } else { 4107 sum1 = ntohs(nat->nat_ndport); 4108 sum2 = ntohs(tcp->th_dport); 4109 sum3 = ntohs(nat->nat_nsport); 4110 sum4 = ntohs(tcp->th_sport); 4111 4112 tcp->th_dport = htons(sum3); 4113 tcp->th_sport = htons(sum1); 4114 } 4115 sumd += sum1 - sum4; 4116 sumd += sum3 - sum2; 4117 4118 if (sumd != 0 || sumd2 != 0) { 4119 /* 4120 * At this point, sumd is the delta to apply to the 4121 * TCP/UDP header, given the changes in both the IP 4122 * address and the ports and sumd2 is the delta to 4123 * apply to the ICMP header, given the IP address 4124 * change delta that may need to be applied to the 4125 * TCP/UDP checksum instead. 4126 * 4127 * If we will both the IP and TCP/UDP checksums 4128 * then the ICMP checksum changes by the address 4129 * delta applied to the TCP/UDP checksum. If we 4130 * do not change the TCP/UDP checksum them we 4131 * apply the delta in ports to the ICMP checksum. 4132 */ 4133 if (oip->ip_p == IPPROTO_UDP) { 4134 if ((dlen >= 8) && (*csump != 0)) { 4135 ipf_fix_datacksum(csump, sumd); 4136 } else { 4137 sumd2 = sum4 - sum1; 4138 if (sum1 > sum4) 4139 sumd2--; 4140 sumd2 += sum2 - sum3; 4141 if (sum3 > sum2) 4142 sumd2--; 4143 } 4144 } else if (oip->ip_p == IPPROTO_TCP) { 4145 if (dlen >= 18) { 4146 ipf_fix_datacksum(csump, sumd); 4147 } else { 4148 sumd2 = sum4 - sum1; 4149 if (sum1 > sum4) 4150 sumd2--; 4151 sumd2 += sum2 - sum3; 4152 if (sum3 > sum2) 4153 sumd2--; 4154 } 4155 } 4156 if (sumd2 != 0) { 4157 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 4158 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 4159 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 4160 ipf_fix_incksum(fin, &icmp->icmp_cksum, sumd2); 4161 } 4162 } 4163 } else if (((flags & IPN_ICMPQUERY) != 0) && (dlen >= 8)) { 4164 icmphdr_t *orgicmp; 4165 4166 /* 4167 * XXX - what if this is bogus hl and we go off the end ? 4168 * In this case, ipf_nat_icmperrorlookup() will have 4169 * returned NULL. 4170 */ 4171 orgicmp = (icmphdr_t *)dp; 4172 4173 if (odst == 1) { 4174 if (orgicmp->icmp_id != nat->nat_osport) { 4175 4176 /* 4177 * Fix ICMP checksum (of the offening ICMP 4178 * query packet) to compensate the change 4179 * in the ICMP id of the offending ICMP 4180 * packet. 4181 * 4182 * Since you modify orgicmp->icmp_id with 4183 * a delta (say x) and you compensate that 4184 * in origicmp->icmp_cksum with a delta 4185 * minus x, you don't have to adjust the 4186 * overall icmp->icmp_cksum 4187 */ 4188 sum1 = ntohs(orgicmp->icmp_id); 4189 sum2 = ntohs(nat->nat_osport); 4190 CALC_SUMD(sum1, sum2, sumd); 4191 orgicmp->icmp_id = nat->nat_oicmpid; 4192 ipf_fix_datacksum(&orgicmp->icmp_cksum, sumd); 4193 } 4194 } /* nat_dir == NAT_INBOUND is impossible for icmp queries */ 4195 } 4196 return nat; 4197 } 4198 4199 4200 /* 4201 * MAP-IN MAP-OUT RDR-IN RDR-OUT 4202 * osrc X == src == src X 4203 * odst X == dst == dst X 4204 * nsrc == dst X X == dst 4205 * ndst == src X X == src 4206 * MAP = NAT_OUTBOUND, RDR = NAT_INBOUND 4207 */ 4208 /* 4209 * NB: these lookups don't lock access to the list, it assumed that it has 4210 * already been done! 4211 */ 4212 /* ------------------------------------------------------------------------ */ 4213 /* Function: ipf_nat_inlookup */ 4214 /* Returns: nat_t* - NULL == no match, */ 4215 /* else pointer to matching NAT entry */ 4216 /* Parameters: fin(I) - pointer to packet information */ 4217 /* flags(I) - NAT flags for this packet */ 4218 /* p(I) - protocol for this packet */ 4219 /* src(I) - source IP address */ 4220 /* mapdst(I) - destination IP address */ 4221 /* */ 4222 /* Lookup a nat entry based on the mapped destination ip address/port and */ 4223 /* real source address/port. We use this lookup when receiving a packet, */ 4224 /* we're looking for a table entry, based on the destination address. */ 4225 /* */ 4226 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */ 4227 /* */ 4228 /* NOTE: IT IS ASSUMED THAT IS ONLY HELD WITH A READ LOCK WHEN */ 4229 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */ 4230 /* */ 4231 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */ 4232 /* the packet is of said protocol */ 4233 /* ------------------------------------------------------------------------ */ 4234 nat_t * 4235 ipf_nat_inlookup(fr_info_t *fin, u_int flags, u_int p, struct in_addr src, 4236 struct in_addr mapdst) 4237 { 4238 ipf_main_softc_t *softc = fin->fin_main_soft; 4239 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 4240 u_short sport, dport; 4241 grehdr_t *gre; 4242 ipnat_t *ipn; 4243 u_int sflags; 4244 nat_t *nat; 4245 int nflags; 4246 u_32_t dst; 4247 void *ifp; 4248 u_int hv, rhv; 4249 4250 ifp = fin->fin_ifp; 4251 gre = NULL; 4252 dst = mapdst.s_addr; 4253 sflags = flags & NAT_TCPUDPICMP; 4254 4255 switch (p) 4256 { 4257 case IPPROTO_TCP : 4258 case IPPROTO_UDP : 4259 sport = htons(fin->fin_data[0]); 4260 dport = htons(fin->fin_data[1]); 4261 break; 4262 case IPPROTO_ICMP : 4263 if (flags & IPN_ICMPERR) { 4264 sport = fin->fin_data[1]; 4265 dport = 0; 4266 } else { 4267 dport = fin->fin_data[1]; 4268 sport = 0; 4269 } 4270 break; 4271 default : 4272 sport = 0; 4273 dport = 0; 4274 break; 4275 } 4276 4277 4278 if ((flags & SI_WILDP) != 0) 4279 goto find_in_wild_ports; 4280 4281 rhv = NAT_HASH_FN(dst, dport, 0xffffffff); 4282 rhv = NAT_HASH_FN(src.s_addr, rhv + sport, 0xffffffff); 4283 hv = rhv % softn->ipf_nat_table_sz; 4284 nat = softn->ipf_nat_table[1][hv]; 4285 /* TRACE dst, dport, src, sport, hv, nat */ 4286 4287 for (; nat; nat = nat->nat_hnext[1]) { 4288 if (nat->nat_ifps[0] != NULL) { 4289 if ((ifp != NULL) && (ifp != nat->nat_ifps[0])) 4290 continue; 4291 } 4292 4293 if (nat->nat_pr[0] != p) 4294 continue; 4295 4296 switch (nat->nat_dir) 4297 { 4298 case NAT_INBOUND : 4299 case NAT_ENCAPIN : 4300 case NAT_DIVERTIN : 4301 if (nat->nat_v[0] != 4) 4302 continue; 4303 if (nat->nat_osrcaddr != src.s_addr || 4304 nat->nat_odstaddr != dst) 4305 continue; 4306 if ((nat->nat_flags & IPN_TCPUDP) != 0) { 4307 if (nat->nat_osport != sport) 4308 continue; 4309 if (nat->nat_odport != dport) 4310 continue; 4311 4312 } else if (p == IPPROTO_ICMP) { 4313 if (nat->nat_osport != dport) { 4314 continue; 4315 } 4316 } 4317 break; 4318 case NAT_DIVERTOUT : 4319 if (nat->nat_dlocal) 4320 continue; 4321 case NAT_OUTBOUND : 4322 case NAT_ENCAPOUT : 4323 if (nat->nat_v[1] != 4) 4324 continue; 4325 if (nat->nat_dlocal) 4326 continue; 4327 if (nat->nat_dlocal) 4328 continue; 4329 if (nat->nat_ndstaddr != src.s_addr || 4330 nat->nat_nsrcaddr != dst) 4331 continue; 4332 if ((nat->nat_flags & IPN_TCPUDP) != 0) { 4333 if (nat->nat_ndport != sport) 4334 continue; 4335 if (nat->nat_nsport != dport) 4336 continue; 4337 4338 } else if (p == IPPROTO_ICMP) { 4339 if (nat->nat_osport != dport) { 4340 continue; 4341 } 4342 } 4343 break; 4344 } 4345 4346 4347 if ((nat->nat_flags & IPN_TCPUDP) != 0) { 4348 ipn = nat->nat_ptr; 4349 if ((ipn != NULL) && (nat->nat_aps != NULL)) 4350 if (ipf_proxy_match(fin, nat) != 0) 4351 continue; 4352 } 4353 if ((nat->nat_ifps[0] == NULL) && (ifp != NULL)) { 4354 nat->nat_ifps[0] = ifp; 4355 nat->nat_mtu[0] = GETIFMTU_4(ifp); 4356 } 4357 return nat; 4358 } 4359 4360 /* 4361 * So if we didn't find it but there are wildcard members in the hash 4362 * table, go back and look for them. We do this search and update here 4363 * because it is modifying the NAT table and we want to do this only 4364 * for the first packet that matches. The exception, of course, is 4365 * for "dummy" (FI_IGNORE) lookups. 4366 */ 4367 find_in_wild_ports: 4368 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) { 4369 NBUMPSIDEX(0, ns_lookup_miss, ns_lookup_miss_0); 4370 return NULL; 4371 } 4372 if (softn->ipf_nat_stats.ns_wilds == 0) { 4373 NBUMPSIDEX(0, ns_lookup_nowild, ns_lookup_nowild_0); 4374 return NULL; 4375 } 4376 4377 RWLOCK_EXIT(&softc->ipf_nat); 4378 4379 hv = NAT_HASH_FN(dst, 0, 0xffffffff); 4380 hv = NAT_HASH_FN(src.s_addr, hv, softn->ipf_nat_table_sz); 4381 WRITE_ENTER(&softc->ipf_nat); 4382 4383 nat = softn->ipf_nat_table[1][hv]; 4384 /* TRACE dst, src, hv, nat */ 4385 for (; nat; nat = nat->nat_hnext[1]) { 4386 if (nat->nat_ifps[0] != NULL) { 4387 if ((ifp != NULL) && (ifp != nat->nat_ifps[0])) 4388 continue; 4389 } 4390 4391 if (nat->nat_pr[0] != fin->fin_p) 4392 continue; 4393 4394 switch (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND)) 4395 { 4396 case NAT_INBOUND : 4397 if (nat->nat_v[0] != 4) 4398 continue; 4399 if (nat->nat_osrcaddr != src.s_addr || 4400 nat->nat_odstaddr != dst) 4401 continue; 4402 break; 4403 case NAT_OUTBOUND : 4404 if (nat->nat_v[1] != 4) 4405 continue; 4406 if (nat->nat_ndstaddr != src.s_addr || 4407 nat->nat_nsrcaddr != dst) 4408 continue; 4409 break; 4410 } 4411 4412 nflags = nat->nat_flags; 4413 if (!(nflags & (NAT_TCPUDP|SI_WILDP))) 4414 continue; 4415 4416 if (ipf_nat_wildok(nat, (int)sport, (int)dport, nflags, 4417 NAT_INBOUND) == 1) { 4418 if ((fin->fin_flx & FI_IGNORE) != 0) 4419 break; 4420 if ((nflags & SI_CLONE) != 0) { 4421 nat = ipf_nat_clone(fin, nat); 4422 if (nat == NULL) 4423 break; 4424 } else { 4425 MUTEX_ENTER(&softn->ipf_nat_new); 4426 softn->ipf_nat_stats.ns_wilds--; 4427 MUTEX_EXIT(&softn->ipf_nat_new); 4428 } 4429 4430 if (nat->nat_dir == NAT_INBOUND) { 4431 if (nat->nat_osport == 0) { 4432 nat->nat_osport = sport; 4433 nat->nat_nsport = sport; 4434 } 4435 if (nat->nat_odport == 0) { 4436 nat->nat_odport = dport; 4437 nat->nat_ndport = dport; 4438 } 4439 } else if (nat->nat_dir == NAT_OUTBOUND) { 4440 if (nat->nat_osport == 0) { 4441 nat->nat_osport = dport; 4442 nat->nat_nsport = dport; 4443 } 4444 if (nat->nat_odport == 0) { 4445 nat->nat_odport = sport; 4446 nat->nat_ndport = sport; 4447 } 4448 } 4449 if ((nat->nat_ifps[0] == NULL) && (ifp != NULL)) { 4450 nat->nat_ifps[0] = ifp; 4451 nat->nat_mtu[0] = GETIFMTU_4(ifp); 4452 } 4453 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT); 4454 ipf_nat_tabmove(softn, nat); 4455 break; 4456 } 4457 } 4458 4459 MUTEX_DOWNGRADE(&softc->ipf_nat); 4460 4461 if (nat == NULL) { 4462 NBUMPSIDE(0, ns_lookup_miss); 4463 } 4464 return nat; 4465 } 4466 4467 4468 /* ------------------------------------------------------------------------ */ 4469 /* Function: ipf_nat_tabmove */ 4470 /* Returns: Nil */ 4471 /* Parameters: nat(I) - pointer to NAT structure */ 4472 /* Write Lock: ipf_nat */ 4473 /* */ 4474 /* This function is only called for TCP/UDP NAT table entries where the */ 4475 /* original was placed in the table without hashing on the ports and we now */ 4476 /* want to include hashing on port numbers. */ 4477 /* ------------------------------------------------------------------------ */ 4478 static void 4479 ipf_nat_tabmove(ipf_nat_softc_t *softn, nat_t *nat) 4480 { 4481 u_int hv0, hv1, rhv0, rhv1; 4482 natstat_t *nsp; 4483 nat_t **natp; 4484 4485 if (nat->nat_flags & SI_CLONE) 4486 return; 4487 4488 nsp = &softn->ipf_nat_stats; 4489 /* 4490 * Remove the NAT entry from the old location 4491 */ 4492 if (nat->nat_hnext[0]) 4493 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; 4494 *nat->nat_phnext[0] = nat->nat_hnext[0]; 4495 nsp->ns_side[0].ns_bucketlen[nat->nat_hv[0] % 4496 softn->ipf_nat_table_sz]--; 4497 4498 if (nat->nat_hnext[1]) 4499 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; 4500 *nat->nat_phnext[1] = nat->nat_hnext[1]; 4501 nsp->ns_side[1].ns_bucketlen[nat->nat_hv[1] % 4502 softn->ipf_nat_table_sz]--; 4503 4504 /* 4505 * Add into the NAT table in the new position 4506 */ 4507 rhv0 = NAT_HASH_FN(nat->nat_osrcaddr, nat->nat_osport, 0xffffffff); 4508 rhv0 = NAT_HASH_FN(nat->nat_odstaddr, rhv0 + nat->nat_odport, 4509 0xffffffff); 4510 rhv1 = NAT_HASH_FN(nat->nat_nsrcaddr, nat->nat_nsport, 0xffffffff); 4511 rhv1 = NAT_HASH_FN(nat->nat_ndstaddr, rhv1 + nat->nat_ndport, 4512 0xffffffff); 4513 4514 hv0 = rhv0 % softn->ipf_nat_table_sz; 4515 hv1 = rhv1 % softn->ipf_nat_table_sz; 4516 4517 if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_ENCAPIN || 4518 nat->nat_dir == NAT_DIVERTIN) { 4519 u_int swap; 4520 4521 swap = hv0; 4522 hv0 = hv1; 4523 hv1 = swap; 4524 } 4525 4526 /* TRACE nat_osrcaddr, nat_osport, nat_odstaddr, nat_odport, hv0 */ 4527 /* TRACE nat_nsrcaddr, nat_nsport, nat_ndstaddr, nat_ndport, hv1 */ 4528 4529 nat->nat_hv[0] = rhv0; 4530 natp = &softn->ipf_nat_table[0][hv0]; 4531 if (*natp) 4532 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 4533 nat->nat_phnext[0] = natp; 4534 nat->nat_hnext[0] = *natp; 4535 *natp = nat; 4536 nsp->ns_side[0].ns_bucketlen[hv0]++; 4537 4538 nat->nat_hv[1] = rhv1; 4539 natp = &softn->ipf_nat_table[1][hv1]; 4540 if (*natp) 4541 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 4542 nat->nat_phnext[1] = natp; 4543 nat->nat_hnext[1] = *natp; 4544 *natp = nat; 4545 nsp->ns_side[1].ns_bucketlen[hv1]++; 4546 } 4547 4548 4549 /* ------------------------------------------------------------------------ */ 4550 /* Function: ipf_nat_outlookup */ 4551 /* Returns: nat_t* - NULL == no match, */ 4552 /* else pointer to matching NAT entry */ 4553 /* Parameters: fin(I) - pointer to packet information */ 4554 /* flags(I) - NAT flags for this packet */ 4555 /* p(I) - protocol for this packet */ 4556 /* src(I) - source IP address */ 4557 /* dst(I) - destination IP address */ 4558 /* rw(I) - 1 == write lock on held, 0 == read lock. */ 4559 /* */ 4560 /* Lookup a nat entry based on the source 'real' ip address/port and */ 4561 /* destination address/port. We use this lookup when sending a packet out, */ 4562 /* we're looking for a table entry, based on the source address. */ 4563 /* */ 4564 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */ 4565 /* */ 4566 /* NOTE: IT IS ASSUMED THAT IS ONLY HELD WITH A READ LOCK WHEN */ 4567 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */ 4568 /* */ 4569 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */ 4570 /* the packet is of said protocol */ 4571 /* ------------------------------------------------------------------------ */ 4572 nat_t * 4573 ipf_nat_outlookup(fr_info_t *fin, u_int flags, u_int p, struct in_addr src, 4574 struct in_addr dst) 4575 { 4576 ipf_main_softc_t *softc = fin->fin_main_soft; 4577 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 4578 u_short sport, dport; 4579 u_int sflags; 4580 ipnat_t *ipn; 4581 nat_t *nat; 4582 void *ifp; 4583 u_int hv; 4584 4585 ifp = fin->fin_ifp; 4586 sflags = flags & IPN_TCPUDPICMP; 4587 sport = 0; 4588 dport = 0; 4589 4590 switch (p) 4591 { 4592 case IPPROTO_TCP : 4593 case IPPROTO_UDP : 4594 sport = htons(fin->fin_data[0]); 4595 dport = htons(fin->fin_data[1]); 4596 break; 4597 case IPPROTO_ICMP : 4598 if (flags & IPN_ICMPERR) 4599 sport = fin->fin_data[1]; 4600 else 4601 dport = fin->fin_data[1]; 4602 break; 4603 default : 4604 break; 4605 } 4606 4607 if ((flags & SI_WILDP) != 0) 4608 goto find_out_wild_ports; 4609 4610 hv = NAT_HASH_FN(src.s_addr, sport, 0xffffffff); 4611 hv = NAT_HASH_FN(dst.s_addr, hv + dport, softn->ipf_nat_table_sz); 4612 nat = softn->ipf_nat_table[0][hv]; 4613 4614 /* TRACE src, sport, dst, dport, hv, nat */ 4615 4616 for (; nat; nat = nat->nat_hnext[0]) { 4617 if (nat->nat_ifps[1] != NULL) { 4618 if ((ifp != NULL) && (ifp != nat->nat_ifps[1])) 4619 continue; 4620 } 4621 4622 if (nat->nat_pr[1] != p) 4623 continue; 4624 4625 switch (nat->nat_dir) 4626 { 4627 case NAT_INBOUND : 4628 case NAT_ENCAPIN : 4629 case NAT_DIVERTIN : 4630 if (nat->nat_v[1] != 4) 4631 continue; 4632 if (nat->nat_ndstaddr != src.s_addr || 4633 nat->nat_nsrcaddr != dst.s_addr) 4634 continue; 4635 4636 if ((nat->nat_flags & IPN_TCPUDP) != 0) { 4637 if (nat->nat_ndport != sport) 4638 continue; 4639 if (nat->nat_nsport != dport) 4640 continue; 4641 4642 } else if (p == IPPROTO_ICMP) { 4643 if (nat->nat_osport != dport) { 4644 continue; 4645 } 4646 } 4647 break; 4648 case NAT_OUTBOUND : 4649 case NAT_ENCAPOUT : 4650 case NAT_DIVERTOUT : 4651 if (nat->nat_v[0] != 4) 4652 continue; 4653 if (nat->nat_osrcaddr != src.s_addr || 4654 nat->nat_odstaddr != dst.s_addr) 4655 continue; 4656 4657 if ((nat->nat_flags & IPN_TCPUDP) != 0) { 4658 if (nat->nat_odport != dport) 4659 continue; 4660 if (nat->nat_osport != sport) 4661 continue; 4662 4663 } else if (p == IPPROTO_ICMP) { 4664 if (nat->nat_osport != dport) { 4665 continue; 4666 } 4667 } 4668 break; 4669 } 4670 4671 ipn = nat->nat_ptr; 4672 if ((ipn != NULL) && (nat->nat_aps != NULL)) 4673 if (ipf_proxy_match(fin, nat) != 0) 4674 continue; 4675 4676 if ((nat->nat_ifps[1] == NULL) && (ifp != NULL)) { 4677 nat->nat_ifps[1] = ifp; 4678 nat->nat_mtu[1] = GETIFMTU_4(ifp); 4679 } 4680 return nat; 4681 } 4682 4683 /* 4684 * So if we didn't find it but there are wildcard members in the hash 4685 * table, go back and look for them. We do this search and update here 4686 * because it is modifying the NAT table and we want to do this only 4687 * for the first packet that matches. The exception, of course, is 4688 * for "dummy" (FI_IGNORE) lookups. 4689 */ 4690 find_out_wild_ports: 4691 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) { 4692 NBUMPSIDEX(1, ns_lookup_miss, ns_lookup_miss_1); 4693 return NULL; 4694 } 4695 if (softn->ipf_nat_stats.ns_wilds == 0) { 4696 NBUMPSIDEX(1, ns_lookup_nowild, ns_lookup_nowild_1); 4697 return NULL; 4698 } 4699 4700 RWLOCK_EXIT(&softc->ipf_nat); 4701 4702 hv = NAT_HASH_FN(src.s_addr, 0, 0xffffffff); 4703 hv = NAT_HASH_FN(dst.s_addr, hv, softn->ipf_nat_table_sz); 4704 4705 WRITE_ENTER(&softc->ipf_nat); 4706 4707 nat = softn->ipf_nat_table[0][hv]; 4708 for (; nat; nat = nat->nat_hnext[0]) { 4709 if (nat->nat_ifps[1] != NULL) { 4710 if ((ifp != NULL) && (ifp != nat->nat_ifps[1])) 4711 continue; 4712 } 4713 4714 if (nat->nat_pr[1] != fin->fin_p) 4715 continue; 4716 4717 switch (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND)) 4718 { 4719 case NAT_INBOUND : 4720 if (nat->nat_v[1] != 4) 4721 continue; 4722 if (nat->nat_ndstaddr != src.s_addr || 4723 nat->nat_nsrcaddr != dst.s_addr) 4724 continue; 4725 break; 4726 case NAT_OUTBOUND : 4727 if (nat->nat_v[0] != 4) 4728 continue; 4729 if (nat->nat_osrcaddr != src.s_addr || 4730 nat->nat_odstaddr != dst.s_addr) 4731 continue; 4732 break; 4733 } 4734 4735 if (!(nat->nat_flags & (NAT_TCPUDP|SI_WILDP))) 4736 continue; 4737 4738 if (ipf_nat_wildok(nat, (int)sport, (int)dport, nat->nat_flags, 4739 NAT_OUTBOUND) == 1) { 4740 if ((fin->fin_flx & FI_IGNORE) != 0) 4741 break; 4742 if ((nat->nat_flags & SI_CLONE) != 0) { 4743 nat = ipf_nat_clone(fin, nat); 4744 if (nat == NULL) 4745 break; 4746 } else { 4747 MUTEX_ENTER(&softn->ipf_nat_new); 4748 softn->ipf_nat_stats.ns_wilds--; 4749 MUTEX_EXIT(&softn->ipf_nat_new); 4750 } 4751 4752 if (nat->nat_dir == NAT_OUTBOUND) { 4753 if (nat->nat_osport == 0) { 4754 nat->nat_osport = sport; 4755 nat->nat_nsport = sport; 4756 } 4757 if (nat->nat_odport == 0) { 4758 nat->nat_odport = dport; 4759 nat->nat_ndport = dport; 4760 } 4761 } else if (nat->nat_dir == NAT_INBOUND) { 4762 if (nat->nat_osport == 0) { 4763 nat->nat_osport = dport; 4764 nat->nat_nsport = dport; 4765 } 4766 if (nat->nat_odport == 0) { 4767 nat->nat_odport = sport; 4768 nat->nat_ndport = sport; 4769 } 4770 } 4771 if ((nat->nat_ifps[1] == NULL) && (ifp != NULL)) { 4772 nat->nat_ifps[1] = ifp; 4773 nat->nat_mtu[1] = GETIFMTU_4(ifp); 4774 } 4775 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT); 4776 ipf_nat_tabmove(softn, nat); 4777 break; 4778 } 4779 } 4780 4781 MUTEX_DOWNGRADE(&softc->ipf_nat); 4782 4783 if (nat == NULL) { 4784 NBUMPSIDE(1, ns_lookup_miss); 4785 } 4786 return nat; 4787 } 4788 4789 4790 /* ------------------------------------------------------------------------ */ 4791 /* Function: ipf_nat_lookupredir */ 4792 /* Returns: nat_t* - NULL == no match, */ 4793 /* else pointer to matching NAT entry */ 4794 /* Parameters: np(I) - pointer to description of packet to find NAT table */ 4795 /* entry for. */ 4796 /* */ 4797 /* Lookup the NAT tables to search for a matching redirect */ 4798 /* The contents of natlookup_t should imitate those found in a packet that */ 4799 /* would be translated - ie a packet coming in for RDR or going out for MAP.*/ 4800 /* We can do the lookup in one of two ways, imitating an inbound or */ 4801 /* outbound packet. By default we assume outbound, unless IPN_IN is set. */ 4802 /* For IN, the fields are set as follows: */ 4803 /* nl_real* = source information */ 4804 /* nl_out* = destination information (translated) */ 4805 /* For an out packet, the fields are set like this: */ 4806 /* nl_in* = source information (untranslated) */ 4807 /* nl_out* = destination information (translated) */ 4808 /* ------------------------------------------------------------------------ */ 4809 nat_t * 4810 ipf_nat_lookupredir(natlookup_t *np) 4811 { 4812 fr_info_t fi; 4813 nat_t *nat; 4814 4815 bzero((char *)&fi, sizeof(fi)); 4816 if (np->nl_flags & IPN_IN) { 4817 fi.fin_data[0] = ntohs(np->nl_realport); 4818 fi.fin_data[1] = ntohs(np->nl_outport); 4819 } else { 4820 fi.fin_data[0] = ntohs(np->nl_inport); 4821 fi.fin_data[1] = ntohs(np->nl_outport); 4822 } 4823 if (np->nl_flags & IPN_TCP) 4824 fi.fin_p = IPPROTO_TCP; 4825 else if (np->nl_flags & IPN_UDP) 4826 fi.fin_p = IPPROTO_UDP; 4827 else if (np->nl_flags & (IPN_ICMPERR|IPN_ICMPQUERY)) 4828 fi.fin_p = IPPROTO_ICMP; 4829 4830 /* 4831 * We can do two sorts of lookups: 4832 * - IPN_IN: we have the `real' and `out' address, look for `in'. 4833 * - default: we have the `in' and `out' address, look for `real'. 4834 */ 4835 if (np->nl_flags & IPN_IN) { 4836 if ((nat = ipf_nat_inlookup(&fi, np->nl_flags, fi.fin_p, 4837 np->nl_realip, np->nl_outip))) { 4838 np->nl_inip = nat->nat_odstip; 4839 np->nl_inport = nat->nat_odport; 4840 } 4841 } else { 4842 /* 4843 * If nl_inip is non null, this is a lookup based on the real 4844 * ip address. Else, we use the fake. 4845 */ 4846 if ((nat = ipf_nat_outlookup(&fi, np->nl_flags, fi.fin_p, 4847 np->nl_inip, np->nl_outip))) { 4848 4849 if ((np->nl_flags & IPN_FINDFORWARD) != 0) { 4850 fr_info_t fin; 4851 bzero((char *)&fin, sizeof(fin)); 4852 fin.fin_p = nat->nat_pr[0]; 4853 fin.fin_data[0] = ntohs(nat->nat_ndport); 4854 fin.fin_data[1] = ntohs(nat->nat_nsport); 4855 if (ipf_nat_inlookup(&fin, np->nl_flags, 4856 fin.fin_p, nat->nat_ndstip, 4857 nat->nat_nsrcip) != NULL) { 4858 np->nl_flags &= ~IPN_FINDFORWARD; 4859 } 4860 } 4861 4862 np->nl_realip = nat->nat_ndstip; 4863 np->nl_realport = nat->nat_ndport; 4864 } 4865 } 4866 4867 return nat; 4868 } 4869 4870 4871 /* ------------------------------------------------------------------------ */ 4872 /* Function: ipf_nat_match */ 4873 /* Returns: int - 0 == no match, 1 == match */ 4874 /* Parameters: fin(I) - pointer to packet information */ 4875 /* np(I) - pointer to NAT rule */ 4876 /* */ 4877 /* Pull the matching of a packet against a NAT rule out of that complex */ 4878 /* loop inside ipf_nat_checkin() and lay it out properly in its own function. */ 4879 /* ------------------------------------------------------------------------ */ 4880 static int 4881 ipf_nat_match(fr_info_t *fin, ipnat_t *np) 4882 { 4883 ipf_main_softc_t *softc = fin->fin_main_soft; 4884 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 4885 frtuc_t *ft; 4886 int match; 4887 4888 if ((fin->fin_p == IPPROTO_IPIP) && (np->in_redir & NAT_ENCAP)) 4889 return ipf_nat_matchencap(softn, fin, np); 4890 4891 match = 0; 4892 switch (np->in_osrcatype) 4893 { 4894 case FRI_NORMAL : 4895 match = ((fin->fin_saddr & np->in_osrcmsk) != np->in_osrcaddr); 4896 break; 4897 case FRI_LOOKUP : 4898 match = (*np->in_osrcfunc)(softc, np->in_osrcptr, 4899 4, &fin->fin_saddr, fin->fin_plen); 4900 break; 4901 } 4902 match ^= ((np->in_flags & IPN_NOTSRC) != 0); 4903 if (match) 4904 return 0; 4905 4906 match = 0; 4907 switch (np->in_odstatype) 4908 { 4909 case FRI_NORMAL : 4910 match = ((fin->fin_daddr & np->in_odstmsk) != np->in_odstaddr); 4911 break; 4912 case FRI_LOOKUP : 4913 match = (*np->in_odstfunc)(softc, np->in_odstptr, 4914 4, &fin->fin_daddr, fin->fin_plen); 4915 break; 4916 } 4917 4918 match ^= ((np->in_flags & IPN_NOTDST) != 0); 4919 if (match) 4920 return 0; 4921 4922 ft = &np->in_tuc; 4923 if (!(fin->fin_flx & FI_TCPUDP) || 4924 (fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) { 4925 if (ft->ftu_scmp || ft->ftu_dcmp) 4926 return 0; 4927 return 1; 4928 } 4929 4930 return ipf_tcpudpchk(&fin->fin_fi, ft); 4931 } 4932 4933 4934 /* ------------------------------------------------------------------------ */ 4935 /* Function: ipf_nat_update */ 4936 /* Returns: Nil */ 4937 /* Parameters: fin(I) - pointer to packet information */ 4938 /* nat(I) - pointer to NAT structure */ 4939 /* */ 4940 /* Updates the lifetime of a NAT table entry for non-TCP packets. Must be */ 4941 /* called with fin_rev updated - i.e. after calling ipf_nat_proto(). */ 4942 /* */ 4943 /* This *MUST* be called after ipf_nat_proto() as it expects fin_rev to */ 4944 /* already be set. */ 4945 /* ------------------------------------------------------------------------ */ 4946 void 4947 ipf_nat_update(fr_info_t *fin, nat_t *nat) 4948 { 4949 ipf_main_softc_t *softc = fin->fin_main_soft; 4950 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 4951 ipftq_t *ifq, *ifq2; 4952 ipftqent_t *tqe; 4953 ipnat_t *np = nat->nat_ptr; 4954 4955 tqe = &nat->nat_tqe; 4956 ifq = tqe->tqe_ifq; 4957 4958 /* 4959 * We allow over-riding of NAT timeouts from NAT rules, even for 4960 * TCP, however, if it is TCP and there is no rule timeout set, 4961 * then do not update the timeout here. 4962 */ 4963 if (np != NULL) { 4964 np->in_bytes[fin->fin_rev] += fin->fin_plen; 4965 ifq2 = np->in_tqehead[fin->fin_rev]; 4966 } else { 4967 ifq2 = NULL; 4968 } 4969 4970 if (nat->nat_pr[0] == IPPROTO_TCP && ifq2 == NULL) { 4971 (void) ipf_tcp_age(&nat->nat_tqe, fin, softn->ipf_nat_tcptq, 4972 0, 2); 4973 } else { 4974 if (ifq2 == NULL) { 4975 if (nat->nat_pr[0] == IPPROTO_UDP) 4976 ifq2 = fin->fin_rev ? &softn->ipf_nat_udpacktq : 4977 &softn->ipf_nat_udptq; 4978 else if (nat->nat_pr[0] == IPPROTO_ICMP) 4979 ifq2 = fin->fin_rev ? &softn->ipf_nat_icmpacktq: 4980 &softn->ipf_nat_icmptq; 4981 else 4982 ifq2 = &softn->ipf_nat_iptq; 4983 } 4984 4985 ipf_movequeue(softc->ipf_ticks, tqe, ifq, ifq2); 4986 } 4987 } 4988 4989 4990 /* ------------------------------------------------------------------------ */ 4991 /* Function: ipf_nat_ipfout */ 4992 /* Returns: frentry_t* - NULL (packet may have been translated, let it */ 4993 /* pass), &ipfnatblock - block/drop the packet. */ 4994 /* Parameters: fin(I) - pointer to packet information */ 4995 /* passp(I) - point to filtering result flags */ 4996 /* */ 4997 /* This is purely and simply a wrapper around ipf_nat_checkout for the sole */ 4998 /* reason of being able to activate NAT from an ipf rule using "call-now". */ 4999 /* ------------------------------------------------------------------------ */ 5000 frentry_t * 5001 ipf_nat_ipfout(fr_info_t *fin, u_32_t *passp) 5002 { 5003 frentry_t *fr = fin->fin_fr; 5004 5005 if (fin->fin_v == 6) { 5006 #ifdef USE_INET6 5007 return ipf_nat6_ipfout(fin, passp); 5008 #else 5009 return NULL; 5010 #endif 5011 } 5012 5013 switch (ipf_nat_checkout(fin, passp)) 5014 { 5015 case -1 : 5016 fr = &ipfnatblock; 5017 MUTEX_ENTER(&fr->fr_lock); 5018 fr->fr_ref++; 5019 MUTEX_EXIT(&fr->fr_lock); 5020 return fr; 5021 5022 case 0 : 5023 break; 5024 5025 case 1 : 5026 /* 5027 * Returing NULL causes this rule to be "ignored" but 5028 * it has actually had an influence on the packet so we 5029 * increment counters for it. 5030 */ 5031 fr->fr_bytes += (U_QUAD_T)fin->fin_plen; 5032 fr->fr_hits++; 5033 break; 5034 } 5035 5036 return NULL; 5037 } 5038 5039 5040 /* ------------------------------------------------------------------------ */ 5041 /* Function: ipf_nat_checkout */ 5042 /* Returns: int - -1 == packet failed NAT checks so block it, */ 5043 /* 0 == no packet translation occurred, */ 5044 /* 1 == packet was successfully translated. */ 5045 /* Parameters: fin(I) - pointer to packet information */ 5046 /* passp(I) - pointer to filtering result flags */ 5047 /* */ 5048 /* Check to see if an outcoming packet should be changed. ICMP packets are */ 5049 /* first checked to see if they match an existing entry (if an error), */ 5050 /* otherwise a search of the current NAT table is made. If neither results */ 5051 /* in a match then a search for a matching NAT rule is made. Create a new */ 5052 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */ 5053 /* packet header(s) as required. */ 5054 /* ------------------------------------------------------------------------ */ 5055 int 5056 ipf_nat_checkout(fr_info_t *fin, u_32_t *passp) 5057 { 5058 ipnat_t *np = NULL, *npnext; 5059 struct ifnet *ifp, *sifp; 5060 ipf_main_softc_t *softc; 5061 ipf_nat_softc_t *softn; 5062 icmphdr_t *icmp = NULL; 5063 tcphdr_t *tcp = NULL; 5064 int rval, natfailed; 5065 u_int nflags = 0; 5066 u_32_t ipa, iph; 5067 int natadd = 1; 5068 frentry_t *fr; 5069 nat_t *nat; 5070 5071 if (fin->fin_v == 6) { 5072 #ifdef USE_INET6 5073 return ipf_nat6_checkout(fin, passp); 5074 #else 5075 return 0; 5076 #endif 5077 } 5078 5079 softc = fin->fin_main_soft; 5080 softn = softc->ipf_nat_soft; 5081 5082 if (softn->ipf_nat_lock != 0) 5083 return 0; 5084 if (softn->ipf_nat_stats.ns_rules == 0 && 5085 softn->ipf_nat_instances == NULL) 5086 return 0; 5087 5088 natfailed = 0; 5089 fr = fin->fin_fr; 5090 sifp = fin->fin_ifp; 5091 if (fr != NULL) { 5092 ifp = fr->fr_tifs[fin->fin_rev].fd_ptr; 5093 if ((ifp != NULL) && (ifp != (void *)-1)) 5094 fin->fin_ifp = ifp; 5095 } 5096 ifp = fin->fin_ifp; 5097 5098 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 5099 switch (fin->fin_p) 5100 { 5101 case IPPROTO_TCP : 5102 nflags = IPN_TCP; 5103 break; 5104 case IPPROTO_UDP : 5105 nflags = IPN_UDP; 5106 break; 5107 case IPPROTO_ICMP : 5108 icmp = fin->fin_dp; 5109 5110 /* 5111 * This is an incoming packet, so the destination is 5112 * the icmp_id and the source port equals 0 5113 */ 5114 if ((fin->fin_flx & FI_ICMPQUERY) != 0) 5115 nflags = IPN_ICMPQUERY; 5116 break; 5117 default : 5118 break; 5119 } 5120 5121 if ((nflags & IPN_TCPUDP)) 5122 tcp = fin->fin_dp; 5123 } 5124 5125 ipa = fin->fin_saddr; 5126 5127 READ_ENTER(&softc->ipf_nat); 5128 5129 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) && 5130 (nat = ipf_nat_icmperror(fin, &nflags, NAT_OUTBOUND))) 5131 /*EMPTY*/; 5132 else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin))) 5133 natadd = 0; 5134 else if ((nat = ipf_nat_outlookup(fin, nflags|NAT_SEARCH, 5135 (u_int)fin->fin_p, fin->fin_src, 5136 fin->fin_dst))) { 5137 nflags = nat->nat_flags; 5138 } else if (fin->fin_off == 0) { 5139 u_32_t hv, msk, nmsk = 0; 5140 5141 /* 5142 * If there is no current entry in the nat table for this IP#, 5143 * create one for it (if there is a matching rule). 5144 */ 5145 maskloop: 5146 msk = softn->ipf_nat_map_active_masks[nmsk]; 5147 iph = ipa & msk; 5148 hv = NAT_HASH_FN(iph, 0, softn->ipf_nat_maprules_sz); 5149 retry_roundrobin: 5150 for (np = softn->ipf_nat_map_rules[hv]; np; np = npnext) { 5151 npnext = np->in_mnext; 5152 if ((np->in_ifps[1] && (np->in_ifps[1] != ifp))) 5153 continue; 5154 if (np->in_v[0] != 4) 5155 continue; 5156 if (np->in_pr[1] && (np->in_pr[1] != fin->fin_p)) 5157 continue; 5158 if ((np->in_flags & IPN_RF) && 5159 !(np->in_flags & nflags)) 5160 continue; 5161 if (np->in_flags & IPN_FILTER) { 5162 switch (ipf_nat_match(fin, np)) 5163 { 5164 case 0 : 5165 continue; 5166 case -1 : 5167 rval = -1; 5168 goto outmatchfail; 5169 case 1 : 5170 default : 5171 break; 5172 } 5173 } else if ((ipa & np->in_osrcmsk) != np->in_osrcaddr) 5174 continue; 5175 5176 if ((fr != NULL) && 5177 !ipf_matchtag(&np->in_tag, &fr->fr_nattag)) 5178 continue; 5179 5180 if (np->in_plabel != -1) { 5181 if (((np->in_flags & IPN_FILTER) == 0) && 5182 (np->in_odport != fin->fin_data[1])) 5183 continue; 5184 if (ipf_proxy_ok(fin, tcp, np) == 0) 5185 continue; 5186 } 5187 5188 if (np->in_flags & IPN_NO) { 5189 np->in_hits++; 5190 break; 5191 } 5192 MUTEX_ENTER(&softn->ipf_nat_new); 5193 /* 5194 * If we've matched a round-robin rule but it has 5195 * moved in the list since we got it, start over as 5196 * this is now no longer correct. 5197 */ 5198 if (npnext != np->in_mnext) { 5199 if ((np->in_flags & IPN_ROUNDR) != 0) { 5200 MUTEX_EXIT(&softn->ipf_nat_new); 5201 goto retry_roundrobin; 5202 } 5203 npnext = np->in_mnext; 5204 } 5205 5206 nat = ipf_nat_add(fin, np, NULL, nflags, NAT_OUTBOUND); 5207 MUTEX_EXIT(&softn->ipf_nat_new); 5208 if (nat != NULL) { 5209 natfailed = 0; 5210 break; 5211 } 5212 natfailed = -1; 5213 } 5214 if ((np == NULL) && (nmsk < softn->ipf_nat_map_max)) { 5215 nmsk++; 5216 goto maskloop; 5217 } 5218 } 5219 5220 if (nat != NULL) { 5221 rval = ipf_nat_out(fin, nat, natadd, nflags); 5222 if (rval == 1) { 5223 MUTEX_ENTER(&nat->nat_lock); 5224 ipf_nat_update(fin, nat); 5225 nat->nat_bytes[1] += fin->fin_plen; 5226 nat->nat_pkts[1]++; 5227 fin->fin_pktnum = nat->nat_pkts[1]; 5228 MUTEX_EXIT(&nat->nat_lock); 5229 } 5230 } else 5231 rval = natfailed; 5232 outmatchfail: 5233 RWLOCK_EXIT(&softc->ipf_nat); 5234 5235 switch (rval) 5236 { 5237 case -1 : 5238 if (passp != NULL) { 5239 DT1(frb_natv4out, fr_info_t *, fin); 5240 NBUMPSIDED(1, ns_drop); 5241 *passp = FR_BLOCK; 5242 fin->fin_reason = FRB_NATV4OUT; 5243 } 5244 fin->fin_flx |= FI_BADNAT; 5245 NBUMPSIDED(1, ns_badnat); 5246 break; 5247 case 0 : 5248 NBUMPSIDE(1, ns_ignored); 5249 break; 5250 case 1 : 5251 NBUMPSIDE(1, ns_translated); 5252 break; 5253 } 5254 fin->fin_ifp = sifp; 5255 return rval; 5256 } 5257 5258 /* ------------------------------------------------------------------------ */ 5259 /* Function: ipf_nat_out */ 5260 /* Returns: int - -1 == packet failed NAT checks so block it, */ 5261 /* 1 == packet was successfully translated. */ 5262 /* Parameters: fin(I) - pointer to packet information */ 5263 /* nat(I) - pointer to NAT structure */ 5264 /* natadd(I) - flag indicating if it is safe to add frag cache */ 5265 /* nflags(I) - NAT flags set for this packet */ 5266 /* */ 5267 /* Translate a packet coming "out" on an interface. */ 5268 /* ------------------------------------------------------------------------ */ 5269 int 5270 ipf_nat_out(fr_info_t *fin, nat_t *nat, int natadd, u_32_t nflags) 5271 { 5272 ipf_main_softc_t *softc = fin->fin_main_soft; 5273 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 5274 icmphdr_t *icmp; 5275 tcphdr_t *tcp; 5276 ipnat_t *np; 5277 int skip; 5278 int i; 5279 5280 tcp = NULL; 5281 icmp = NULL; 5282 np = nat->nat_ptr; 5283 5284 if ((natadd != 0) && (fin->fin_flx & FI_FRAG) && (np != NULL)) 5285 (void) ipf_frag_natnew(softc, fin, 0, nat); 5286 5287 /* 5288 * Fix up checksums, not by recalculating them, but 5289 * simply computing adjustments. 5290 * This is only done for STREAMS based IP implementations where the 5291 * checksum has already been calculated by IP. In all other cases, 5292 * IPFilter is called before the checksum needs calculating so there 5293 * is no call to modify whatever is in the header now. 5294 */ 5295 if (nflags == IPN_ICMPERR) { 5296 u_32_t s1, s2, sumd, msumd; 5297 5298 s1 = LONG_SUM(ntohl(fin->fin_saddr)); 5299 if (nat->nat_dir == NAT_OUTBOUND) { 5300 s2 = LONG_SUM(ntohl(nat->nat_nsrcaddr)); 5301 } else { 5302 s2 = LONG_SUM(ntohl(nat->nat_odstaddr)); 5303 } 5304 CALC_SUMD(s1, s2, sumd); 5305 msumd = sumd; 5306 5307 s1 = LONG_SUM(ntohl(fin->fin_daddr)); 5308 if (nat->nat_dir == NAT_OUTBOUND) { 5309 s2 = LONG_SUM(ntohl(nat->nat_ndstaddr)); 5310 } else { 5311 s2 = LONG_SUM(ntohl(nat->nat_osrcaddr)); 5312 } 5313 CALC_SUMD(s1, s2, sumd); 5314 msumd += sumd; 5315 5316 ipf_fix_outcksum(fin, &fin->fin_ip->ip_sum, msumd); 5317 } 5318 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 5319 defined(linux) || defined(BRIDGE_IPF) 5320 else { 5321 /* 5322 * Strictly speaking, this isn't necessary on BSD 5323 * kernels because they do checksum calculation after 5324 * this code has run BUT if ipfilter is being used 5325 * to do NAT as a bridge, that code doesn't exist. 5326 */ 5327 switch (nat->nat_dir) 5328 { 5329 case NAT_OUTBOUND : 5330 ipf_fix_outcksum(fin, &fin->fin_ip->ip_sum, 5331 nat->nat_ipsumd); 5332 break; 5333 5334 case NAT_INBOUND : 5335 ipf_fix_incksum(fin, &fin->fin_ip->ip_sum, 5336 nat->nat_ipsumd); 5337 break; 5338 5339 default : 5340 break; 5341 } 5342 } 5343 #endif 5344 5345 /* 5346 * Address assignment is after the checksum modification because 5347 * we are using the address in the packet for determining the 5348 * correct checksum offset (the ICMP error could be coming from 5349 * anyone...) 5350 */ 5351 switch (nat->nat_dir) 5352 { 5353 case NAT_OUTBOUND : 5354 fin->fin_ip->ip_src = nat->nat_nsrcip; 5355 fin->fin_saddr = nat->nat_nsrcaddr; 5356 fin->fin_ip->ip_dst = nat->nat_ndstip; 5357 fin->fin_daddr = nat->nat_ndstaddr; 5358 break; 5359 5360 case NAT_INBOUND : 5361 fin->fin_ip->ip_src = nat->nat_odstip; 5362 fin->fin_saddr = nat->nat_ndstaddr; 5363 fin->fin_ip->ip_dst = nat->nat_osrcip; 5364 fin->fin_daddr = nat->nat_nsrcaddr; 5365 break; 5366 5367 case NAT_ENCAPIN : 5368 fin->fin_flx |= FI_ENCAP; 5369 case NAT_DIVERTIN : 5370 { 5371 mb_t *m; 5372 5373 skip = ipf_nat_decap(fin, nat); 5374 if (skip <= 0) { 5375 NBUMPSIDED(1, ns_decap_fail); 5376 return -1; 5377 } 5378 5379 m = fin->fin_m; 5380 5381 #if defined(MENTAT) && defined(_KERNEL) 5382 m->b_rptr += skip; 5383 #else 5384 m->m_data += skip; 5385 m->m_len -= skip; 5386 5387 # ifdef M_PKTHDR 5388 if (m->m_flags & M_PKTHDR) 5389 m->m_pkthdr.len -= skip; 5390 # endif 5391 #endif 5392 5393 MUTEX_ENTER(&nat->nat_lock); 5394 ipf_nat_update(fin, nat); 5395 MUTEX_EXIT(&nat->nat_lock); 5396 fin->fin_flx |= FI_NATED; 5397 if (np != NULL && np->in_tag.ipt_num[0] != 0) 5398 fin->fin_nattag = &np->in_tag; 5399 return 1; 5400 /* NOTREACHED */ 5401 } 5402 5403 case NAT_ENCAPOUT : 5404 { 5405 u_32_t s1, s2, sumd; 5406 ip_t *ip; 5407 mb_t *m; 5408 5409 if (ipf_nat_encapok(fin, nat) == -1) 5410 return -1; 5411 5412 m = M_DUP(np->in_divmp); 5413 if (m == NULL) { 5414 NBUMPSIDED(1, ns_encap_dup); 5415 return -1; 5416 } 5417 5418 ip = MTOD(m, ip_t *); 5419 /* TRACE (fin,ip) */ 5420 ip->ip_off = (fin->fin_ip->ip_off & htons(IP_DF)); 5421 ip->ip_id = htons(ipf_nextipid(fin)); 5422 ip->ip_len = htons(fin->fin_plen + sizeof(ip_t)); 5423 s1 = 0; 5424 /* 5425 * We subtract 40 here because ip_len has already been set 5426 * to this value when the template checksum is created. 5427 */ 5428 s2 = ntohs(ip->ip_id) + ntohs(ip->ip_len) - sizeof(ip_t); 5429 s2 += ntohs(ip->ip_off) & IP_DF; 5430 /* TRACE (s1,s2,ip) */ 5431 CALC_SUMD(s1, s2, sumd); 5432 /* TRACE (sumd) */ 5433 5434 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 5435 defined(linux) || defined(BRIDGE_IPF) 5436 ipf_fix_outcksum(fin, &ip->ip_sum, sumd); 5437 #endif 5438 /* TRACE (ip) */ 5439 5440 PREP_MB_T(fin, m); 5441 5442 fin->fin_ip = ip; 5443 fin->fin_plen += sizeof(ip_t); /* UDP + new IPv4 hdr */ 5444 fin->fin_dlen += sizeof(ip_t); /* UDP + old IPv4 hdr */ 5445 fin->fin_flx |= FI_ENCAP; 5446 5447 nflags &= ~IPN_TCPUDPICMP; 5448 5449 break; 5450 } 5451 case NAT_DIVERTOUT : 5452 { 5453 u_32_t s1, s2, sumd; 5454 udphdr_t *uh; 5455 ip_t *ip; 5456 mb_t *m; 5457 5458 m = M_DUP(np->in_divmp); 5459 if (m == NULL) { 5460 NBUMPSIDED(1, ns_divert_dup); 5461 return -1; 5462 } 5463 5464 ip = MTOD(m, ip_t *); 5465 ip->ip_id = htons(ipf_nextipid(fin)); 5466 s2 = ntohs(ip->ip_id); 5467 5468 s1 = ip->ip_len; 5469 ip->ip_len = ntohs(ip->ip_len); 5470 ip->ip_len += fin->fin_plen; 5471 ip->ip_len = htons(ip->ip_len); 5472 s2 += ntohs(ip->ip_len); 5473 CALC_SUMD(s1, s2, sumd); 5474 5475 uh = (udphdr_t *)(ip + 1); 5476 uh->uh_ulen += fin->fin_plen; 5477 uh->uh_ulen = htons(uh->uh_ulen); 5478 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 5479 defined(linux) || defined(BRIDGE_IPF) 5480 ipf_fix_outcksum(fin, &ip->ip_sum, sumd); 5481 #endif 5482 5483 PREP_MB_T(fin, m); 5484 5485 fin->fin_src = ip->ip_src; 5486 fin->fin_dst = ip->ip_dst; 5487 fin->fin_ip = ip; 5488 fin->fin_plen += sizeof(ip_t) + 8; /* UDP + IPv4 hdr */ 5489 fin->fin_dlen += sizeof(ip_t) + 8; /* UDP + IPv4 hdr */ 5490 5491 nflags &= ~IPN_TCPUDPICMP; 5492 5493 break; 5494 } 5495 5496 default : 5497 break; 5498 } 5499 5500 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 5501 u_short *csump; 5502 5503 if ((nat->nat_nsport != 0) && (nflags & IPN_TCPUDP)) { 5504 tcp = fin->fin_dp; 5505 5506 switch (nat->nat_dir) 5507 { 5508 case NAT_OUTBOUND : 5509 tcp->th_sport = nat->nat_nsport; 5510 fin->fin_data[0] = ntohs(nat->nat_nsport); 5511 tcp->th_dport = nat->nat_ndport; 5512 fin->fin_data[0] = ntohs(nat->nat_ndport); 5513 break; 5514 5515 case NAT_INBOUND : 5516 tcp->th_sport = nat->nat_odport; 5517 fin->fin_data[0] = ntohs(nat->nat_odport); 5518 tcp->th_dport = nat->nat_osport; 5519 fin->fin_data[0] = ntohs(nat->nat_osport); 5520 break; 5521 } 5522 } 5523 5524 if ((nat->nat_nsport != 0) && (nflags & IPN_ICMPQUERY)) { 5525 icmp = fin->fin_dp; 5526 icmp->icmp_id = nat->nat_nicmpid; 5527 } 5528 5529 csump = ipf_nat_proto(fin, nat, nflags); 5530 5531 /* 5532 * The above comments do not hold for layer 4 (or higher) 5533 * checksums... 5534 */ 5535 if (csump != NULL) { 5536 if (nat->nat_dir == NAT_OUTBOUND) 5537 ipf_fix_outcksum(fin, csump, nat->nat_sumd[1]); 5538 else 5539 ipf_fix_incksum(fin, csump, nat->nat_sumd[1]); 5540 } 5541 } 5542 5543 ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync); 5544 /* ------------------------------------------------------------- */ 5545 /* A few quick notes: */ 5546 /* Following are test conditions prior to calling the */ 5547 /* ipf_proxy_check routine. */ 5548 /* */ 5549 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ 5550 /* with a redirect rule, we attempt to match the packet's */ 5551 /* source port against in_dport, otherwise we'd compare the */ 5552 /* packet's destination. */ 5553 /* ------------------------------------------------------------- */ 5554 if ((np != NULL) && (np->in_apr != NULL)) { 5555 i = ipf_proxy_check(fin, nat); 5556 if (i == 0) 5557 i = 1; 5558 else if (i == -1) { 5559 NBUMPSIDED(1, ns_ipf_proxy_fail); 5560 } 5561 } else { 5562 i = 1; 5563 } 5564 fin->fin_flx |= FI_NATED; 5565 return i; 5566 } 5567 5568 5569 /* ------------------------------------------------------------------------ */ 5570 /* Function: ipf_nat_ipfin */ 5571 /* Returns: frentry_t* - NULL (packet may have been translated, let it */ 5572 /* pass), &ipfnatblock - block/drop the packet. */ 5573 /* Parameters: fin(I) - pointer to packet information */ 5574 /* passp(I) - point to filtering result flags */ 5575 /* */ 5576 /* This is purely and simply a wrapper around ipf_nat_checkin for the sole */ 5577 /* reason of being able to activate NAT from an ipf rule using "call-now". */ 5578 /* ------------------------------------------------------------------------ */ 5579 frentry_t * 5580 ipf_nat_ipfin(fr_info_t *fin, u_32_t *passp) 5581 { 5582 frentry_t *fr = fin->fin_fr; 5583 5584 if (fin->fin_v == 6) { 5585 #ifdef USE_INET6 5586 return ipf_nat6_ipfin(fin, passp); 5587 #else 5588 return NULL; 5589 #endif 5590 } 5591 5592 switch (ipf_nat_checkin(fin, passp)) 5593 { 5594 case -1 : 5595 fr = &ipfnatblock; 5596 MUTEX_ENTER(&fr->fr_lock); 5597 fr->fr_ref++; 5598 MUTEX_EXIT(&fr->fr_lock); 5599 return fr; 5600 5601 case 0 : 5602 break; 5603 5604 case 1 : 5605 /* 5606 * Returing NULL causes this rule to be "ignored" but 5607 * it has actually had an influence on the packet so we 5608 * increment counters for it. 5609 */ 5610 fr->fr_bytes += (U_QUAD_T)fin->fin_plen; 5611 fr->fr_hits++; 5612 break; 5613 } 5614 5615 return NULL; 5616 } 5617 5618 5619 /* ------------------------------------------------------------------------ */ 5620 /* Function: ipf_nat_checkin */ 5621 /* Returns: int - -1 == packet failed NAT checks so block it, */ 5622 /* 0 == no packet translation occurred, */ 5623 /* 1 == packet was successfully translated. */ 5624 /* Parameters: fin(I) - pointer to packet information */ 5625 /* passp(I) - pointer to filtering result flags */ 5626 /* */ 5627 /* Check to see if an incoming packet should be changed. ICMP packets are */ 5628 /* first checked to see if they match an existing entry (if an error), */ 5629 /* otherwise a search of the current NAT table is made. If neither results */ 5630 /* in a match then a search for a matching NAT rule is made. Create a new */ 5631 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */ 5632 /* packet header(s) as required. */ 5633 /* ------------------------------------------------------------------------ */ 5634 int 5635 ipf_nat_checkin(fr_info_t *fin, u_32_t *passp) 5636 { 5637 ipf_main_softc_t *softc; 5638 ipf_nat_softc_t *softn; 5639 u_int nflags, natadd; 5640 ipnat_t *np, *npnext; 5641 int rval, natfailed; 5642 struct ifnet *ifp; 5643 struct in_addr in; 5644 icmphdr_t *icmp; 5645 tcphdr_t *tcp; 5646 u_short dport; 5647 nat_t *nat; 5648 u_32_t iph; 5649 5650 softc = fin->fin_main_soft; 5651 softn = softc->ipf_nat_soft; 5652 5653 if (softn->ipf_nat_lock != 0) 5654 return 0; 5655 if (softn->ipf_nat_stats.ns_rules == 0 && 5656 softn->ipf_nat_instances == NULL) 5657 return 0; 5658 5659 tcp = NULL; 5660 icmp = NULL; 5661 dport = 0; 5662 natadd = 1; 5663 nflags = 0; 5664 natfailed = 0; 5665 ifp = fin->fin_ifp; 5666 5667 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 5668 switch (fin->fin_p) 5669 { 5670 case IPPROTO_TCP : 5671 nflags = IPN_TCP; 5672 break; 5673 case IPPROTO_UDP : 5674 nflags = IPN_UDP; 5675 break; 5676 case IPPROTO_ICMP : 5677 icmp = fin->fin_dp; 5678 5679 /* 5680 * This is an incoming packet, so the destination is 5681 * the icmp_id and the source port equals 0 5682 */ 5683 if ((fin->fin_flx & FI_ICMPQUERY) != 0) { 5684 nflags = IPN_ICMPQUERY; 5685 dport = icmp->icmp_id; 5686 } break; 5687 default : 5688 break; 5689 } 5690 5691 if ((nflags & IPN_TCPUDP)) { 5692 tcp = fin->fin_dp; 5693 dport = fin->fin_data[1]; 5694 } 5695 } 5696 5697 in = fin->fin_dst; 5698 5699 READ_ENTER(&softc->ipf_nat); 5700 5701 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) && 5702 (nat = ipf_nat_icmperror(fin, &nflags, NAT_INBOUND))) 5703 /*EMPTY*/; 5704 else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin))) 5705 natadd = 0; 5706 else if ((nat = ipf_nat_inlookup(fin, nflags|NAT_SEARCH, 5707 (u_int)fin->fin_p, 5708 fin->fin_src, in))) { 5709 nflags = nat->nat_flags; 5710 } else if (fin->fin_off == 0) { 5711 u_32_t hv, msk, rmsk = 0; 5712 5713 /* 5714 * If there is no current entry in the nat table for this IP#, 5715 * create one for it (if there is a matching rule). 5716 */ 5717 maskloop: 5718 msk = softn->ipf_nat_rdr_active_masks[rmsk]; 5719 iph = in.s_addr & msk; 5720 hv = NAT_HASH_FN(iph, 0, softn->ipf_nat_rdrrules_sz); 5721 retry_roundrobin: 5722 /* TRACE (iph,msk,rmsk,hv,softn->ipf_nat_rdrrules_sz) */ 5723 for (np = softn->ipf_nat_rdr_rules[hv]; np; np = npnext) { 5724 npnext = np->in_rnext; 5725 if (np->in_ifps[0] && (np->in_ifps[0] != ifp)) 5726 continue; 5727 if (np->in_v[0] != 4) 5728 continue; 5729 if (np->in_pr[0] && (np->in_pr[0] != fin->fin_p)) 5730 continue; 5731 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags)) 5732 continue; 5733 if (np->in_flags & IPN_FILTER) { 5734 switch (ipf_nat_match(fin, np)) 5735 { 5736 case 0 : 5737 continue; 5738 case -1 : 5739 rval = -1; 5740 goto inmatchfail; 5741 case 1 : 5742 default : 5743 break; 5744 } 5745 } else { 5746 if ((in.s_addr & np->in_odstmsk) != 5747 np->in_odstaddr) 5748 continue; 5749 if (np->in_odport && 5750 ((np->in_dtop < dport) || 5751 (dport < np->in_odport))) 5752 continue; 5753 } 5754 5755 if (np->in_plabel != -1) { 5756 if (!ipf_proxy_ok(fin, tcp, np)) { 5757 continue; 5758 } 5759 } 5760 5761 if (np->in_flags & IPN_NO) { 5762 np->in_hits++; 5763 break; 5764 } 5765 5766 MUTEX_ENTER(&softn->ipf_nat_new); 5767 /* 5768 * If we've matched a round-robin rule but it has 5769 * moved in the list since we got it, start over as 5770 * this is now no longer correct. 5771 */ 5772 if (npnext != np->in_rnext) { 5773 if ((np->in_flags & IPN_ROUNDR) != 0) { 5774 MUTEX_EXIT(&softn->ipf_nat_new); 5775 goto retry_roundrobin; 5776 } 5777 npnext = np->in_rnext; 5778 } 5779 5780 nat = ipf_nat_add(fin, np, NULL, nflags, NAT_INBOUND); 5781 MUTEX_EXIT(&softn->ipf_nat_new); 5782 if (nat != NULL) { 5783 natfailed = 0; 5784 break; 5785 } 5786 natfailed = -1; 5787 } 5788 5789 if ((np == NULL) && (rmsk < softn->ipf_nat_rdr_max)) { 5790 rmsk++; 5791 goto maskloop; 5792 } 5793 } 5794 if (nat != NULL) { 5795 rval = ipf_nat_in(fin, nat, natadd, nflags); 5796 if (rval == 1) { 5797 MUTEX_ENTER(&nat->nat_lock); 5798 ipf_nat_update(fin, nat); 5799 nat->nat_bytes[0] += fin->fin_plen; 5800 nat->nat_pkts[0]++; 5801 fin->fin_pktnum = nat->nat_pkts[0]; 5802 MUTEX_EXIT(&nat->nat_lock); 5803 } 5804 } else 5805 rval = natfailed; 5806 inmatchfail: 5807 RWLOCK_EXIT(&softc->ipf_nat); 5808 5809 switch (rval) 5810 { 5811 case -1 : 5812 if (passp != NULL) { 5813 DT1(frb_natv4in, fr_info_t *, fin); 5814 NBUMPSIDED(0, ns_drop); 5815 *passp = FR_BLOCK; 5816 fin->fin_reason = FRB_NATV4IN; 5817 } 5818 fin->fin_flx |= FI_BADNAT; 5819 NBUMPSIDED(0, ns_badnat); 5820 break; 5821 case 0 : 5822 NBUMPSIDE(0, ns_ignored); 5823 break; 5824 case 1 : 5825 NBUMPSIDE(0, ns_translated); 5826 break; 5827 } 5828 return rval; 5829 } 5830 5831 5832 /* ------------------------------------------------------------------------ */ 5833 /* Function: ipf_nat_in */ 5834 /* Returns: int - -1 == packet failed NAT checks so block it, */ 5835 /* 1 == packet was successfully translated. */ 5836 /* Parameters: fin(I) - pointer to packet information */ 5837 /* nat(I) - pointer to NAT structure */ 5838 /* natadd(I) - flag indicating if it is safe to add frag cache */ 5839 /* nflags(I) - NAT flags set for this packet */ 5840 /* Locks Held: ipf_nat(READ) */ 5841 /* */ 5842 /* Translate a packet coming "in" on an interface. */ 5843 /* ------------------------------------------------------------------------ */ 5844 int 5845 ipf_nat_in(fr_info_t *fin, nat_t *nat, int natadd, u_32_t nflags) 5846 { 5847 ipf_main_softc_t *softc = fin->fin_main_soft; 5848 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 5849 u_32_t sumd, ipsumd, sum1, sum2; 5850 icmphdr_t *icmp; 5851 tcphdr_t *tcp; 5852 ipnat_t *np; 5853 int skip; 5854 int i; 5855 5856 tcp = NULL; 5857 np = nat->nat_ptr; 5858 fin->fin_fr = nat->nat_fr; 5859 5860 if (np != NULL) { 5861 if ((natadd != 0) && (fin->fin_flx & FI_FRAG)) 5862 (void) ipf_frag_natnew(softc, fin, 0, nat); 5863 5864 /* ------------------------------------------------------------- */ 5865 /* A few quick notes: */ 5866 /* Following are test conditions prior to calling the */ 5867 /* ipf_proxy_check routine. */ 5868 /* */ 5869 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ 5870 /* with a map rule, we attempt to match the packet's */ 5871 /* source port against in_dport, otherwise we'd compare the */ 5872 /* packet's destination. */ 5873 /* ------------------------------------------------------------- */ 5874 if (np->in_apr != NULL) { 5875 i = ipf_proxy_check(fin, nat); 5876 if (i == -1) { 5877 NBUMPSIDED(0, ns_ipf_proxy_fail); 5878 return -1; 5879 } 5880 } 5881 } 5882 5883 ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync); 5884 5885 ipsumd = nat->nat_ipsumd; 5886 /* 5887 * Fix up checksums, not by recalculating them, but 5888 * simply computing adjustments. 5889 * Why only do this for some platforms on inbound packets ? 5890 * Because for those that it is done, IP processing is yet to happen 5891 * and so the IPv4 header checksum has not yet been evaluated. 5892 * Perhaps it should always be done for the benefit of things like 5893 * fast forwarding (so that it doesn't need to be recomputed) but with 5894 * header checksum offloading, perhaps it is a moot point. 5895 */ 5896 5897 switch (nat->nat_dir) 5898 { 5899 case NAT_INBOUND : 5900 if ((fin->fin_flx & FI_ICMPERR) == 0) { 5901 fin->fin_ip->ip_src = nat->nat_nsrcip; 5902 fin->fin_saddr = nat->nat_nsrcaddr; 5903 } else { 5904 sum1 = nat->nat_osrcaddr; 5905 sum2 = nat->nat_nsrcaddr; 5906 CALC_SUMD(sum1, sum2, sumd); 5907 ipsumd -= sumd; 5908 } 5909 fin->fin_ip->ip_dst = nat->nat_ndstip; 5910 fin->fin_daddr = nat->nat_ndstaddr; 5911 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 5912 defined(__osf__) || defined(linux) 5913 ipf_fix_outcksum(fin, &fin->fin_ip->ip_sum, ipsumd); 5914 #endif 5915 break; 5916 5917 case NAT_OUTBOUND : 5918 if ((fin->fin_flx & FI_ICMPERR) == 0) { 5919 fin->fin_ip->ip_src = nat->nat_odstip; 5920 fin->fin_saddr = nat->nat_odstaddr; 5921 } else { 5922 sum1 = nat->nat_odstaddr; 5923 sum2 = nat->nat_ndstaddr; 5924 CALC_SUMD(sum1, sum2, sumd); 5925 ipsumd -= sumd; 5926 } 5927 fin->fin_ip->ip_dst = nat->nat_osrcip; 5928 fin->fin_daddr = nat->nat_osrcaddr; 5929 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 5930 defined(__osf__) || defined(linux) 5931 ipf_fix_incksum(fin, &fin->fin_ip->ip_sum, ipsumd); 5932 #endif 5933 break; 5934 5935 case NAT_ENCAPIN : 5936 { 5937 ip_t *ip; 5938 mb_t *m; 5939 5940 /* 5941 * XXX 5942 * This is not necessarily true. What we need to know here 5943 * is the MTU of the interface out which the packets will go 5944 * and this won't be nat_ifps[1] because that is where we 5945 * send packets after stripping off stuff - what's needed 5946 * here is the MTU of the interface for the route to the 5947 * destination of the outer header. 5948 */ 5949 if (ipf_nat_encapok(fin, nat) == -1) 5950 return -1; 5951 5952 m = M_DUP(np->in_divmp); 5953 if (m == NULL) { 5954 NBUMPSIDED(0, ns_encap_dup); 5955 return -1; 5956 } 5957 5958 ip = MTOD(m, ip_t *); 5959 ip->ip_id = htons(ipf_nextipid(fin)); 5960 sum1 = ntohs(ip->ip_len); 5961 ip->ip_len = htons(fin->fin_plen + sizeof(ip_t)); 5962 sum2 = ntohs(ip->ip_id) + ntohs(ip->ip_len); 5963 CALC_SUMD(sum1, sum2, sumd); 5964 5965 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 5966 defined(__osf__) || defined(linux) 5967 ipf_fix_outcksum(fin, &ip->ip_sum, sumd); 5968 #endif 5969 5970 PREP_MB_T(fin, m); 5971 5972 fin->fin_ip = ip; 5973 fin->fin_plen += sizeof(ip_t); /* UDP + new IPv4 hdr */ 5974 fin->fin_dlen += sizeof(ip_t); /* UDP + old IPv4 hdr */ 5975 fin->fin_flx |= FI_ENCAP; 5976 5977 nflags &= ~IPN_TCPUDPICMP; 5978 5979 break; 5980 } 5981 5982 case NAT_DIVERTIN : 5983 { 5984 udphdr_t *uh; 5985 ip_t *ip; 5986 mb_t *m; 5987 5988 m = M_DUP(np->in_divmp); 5989 if (m == NULL) { 5990 NBUMPSIDED(0, ns_divert_dup); 5991 return -1; 5992 } 5993 5994 ip = MTOD(m, ip_t *); 5995 ip->ip_id = htons(ipf_nextipid(fin)); 5996 sum1 = ntohs(ip->ip_len); 5997 ip->ip_len = ntohs(ip->ip_len); 5998 ip->ip_len += fin->fin_plen; 5999 ip->ip_len = htons(ip->ip_len); 6000 6001 uh = (udphdr_t *)(ip + 1); 6002 uh->uh_ulen += fin->fin_plen; 6003 uh->uh_ulen = htons(uh->uh_ulen); 6004 6005 sum2 = ntohs(ip->ip_id) + ntohs(ip->ip_len); 6006 sum2 += ntohs(ip->ip_off) & IP_DF; 6007 CALC_SUMD(sum1, sum2, sumd); 6008 6009 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 6010 defined(__osf__) || defined(linux) 6011 ipf_fix_outcksum(fin, &ip->ip_sum, sumd); 6012 #endif 6013 PREP_MB_T(fin, m); 6014 6015 fin->fin_ip = ip; 6016 fin->fin_plen += sizeof(ip_t) + 8; /* UDP + new IPv4 hdr */ 6017 fin->fin_dlen += sizeof(ip_t) + 8; /* UDP + old IPv4 hdr */ 6018 6019 nflags &= ~IPN_TCPUDPICMP; 6020 6021 break; 6022 } 6023 6024 case NAT_ENCAPOUT : 6025 fin->fin_flx |= FI_ENCAP; 6026 case NAT_DIVERTOUT : 6027 { 6028 mb_t *m; 6029 6030 skip = ipf_nat_decap(fin, nat); 6031 if (skip <= 0) { 6032 NBUMPSIDED(0, ns_decap_fail); 6033 return -1; 6034 } 6035 6036 m = fin->fin_m; 6037 6038 #if defined(MENTAT) && defined(_KERNEL) 6039 m->b_rptr += skip; 6040 #else 6041 m->m_data += skip; 6042 m->m_len -= skip; 6043 6044 # ifdef M_PKTHDR 6045 if (m->m_flags & M_PKTHDR) 6046 m->m_pkthdr.len -= skip; 6047 # endif 6048 #endif 6049 6050 ipf_nat_update(fin, nat); 6051 nflags &= ~IPN_TCPUDPICMP; 6052 fin->fin_flx |= FI_NATED; 6053 if (np != NULL && np->in_tag.ipt_num[0] != 0) 6054 fin->fin_nattag = &np->in_tag; 6055 return 1; 6056 /* NOTREACHED */ 6057 } 6058 } 6059 if (nflags & IPN_TCPUDP) 6060 tcp = fin->fin_dp; 6061 6062 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 6063 u_short *csump; 6064 6065 if ((nat->nat_odport != 0) && (nflags & IPN_TCPUDP)) { 6066 switch (nat->nat_dir) 6067 { 6068 case NAT_INBOUND : 6069 tcp->th_sport = nat->nat_nsport; 6070 fin->fin_data[0] = ntohs(nat->nat_nsport); 6071 tcp->th_dport = nat->nat_ndport; 6072 fin->fin_data[1] = ntohs(nat->nat_ndport); 6073 break; 6074 6075 case NAT_OUTBOUND : 6076 tcp->th_sport = nat->nat_odport; 6077 fin->fin_data[0] = ntohs(nat->nat_odport); 6078 tcp->th_dport = nat->nat_osport; 6079 fin->fin_data[1] = ntohs(nat->nat_osport); 6080 break; 6081 } 6082 } 6083 6084 6085 if ((nat->nat_odport != 0) && (nflags & IPN_ICMPQUERY)) { 6086 icmp = fin->fin_dp; 6087 6088 icmp->icmp_id = nat->nat_nicmpid; 6089 } 6090 6091 csump = ipf_nat_proto(fin, nat, nflags); 6092 6093 /* 6094 * The above comments do not hold for layer 4 (or higher) 6095 * checksums... 6096 */ 6097 if (csump != NULL) { 6098 if (nat->nat_dir == NAT_OUTBOUND) 6099 ipf_fix_incksum(fin, csump, nat->nat_sumd[0]); 6100 else 6101 ipf_fix_outcksum(fin, csump, nat->nat_sumd[0]); 6102 } 6103 } 6104 6105 fin->fin_flx |= FI_NATED; 6106 if (np != NULL && np->in_tag.ipt_num[0] != 0) 6107 fin->fin_nattag = &np->in_tag; 6108 return 1; 6109 } 6110 6111 6112 /* ------------------------------------------------------------------------ */ 6113 /* Function: ipf_nat_proto */ 6114 /* Returns: u_short* - pointer to transport header checksum to update, */ 6115 /* NULL if the transport protocol is not recognised */ 6116 /* as needing a checksum update. */ 6117 /* Parameters: fin(I) - pointer to packet information */ 6118 /* nat(I) - pointer to NAT structure */ 6119 /* nflags(I) - NAT flags set for this packet */ 6120 /* */ 6121 /* Return the pointer to the checksum field for each protocol so understood.*/ 6122 /* If support for making other changes to a protocol header is required, */ 6123 /* that is not strictly 'address' translation, such as clamping the MSS in */ 6124 /* TCP down to a specific value, then do it from here. */ 6125 /* ------------------------------------------------------------------------ */ 6126 u_short * 6127 ipf_nat_proto(fr_info_t *fin, nat_t *nat, u_int nflags) 6128 { 6129 icmphdr_t *icmp; 6130 u_short *csump; 6131 tcphdr_t *tcp; 6132 udphdr_t *udp; 6133 6134 csump = NULL; 6135 if (fin->fin_out == 0) { 6136 fin->fin_rev = (nat->nat_dir & NAT_OUTBOUND); 6137 } else { 6138 fin->fin_rev = ((nat->nat_dir & NAT_OUTBOUND) == 0); 6139 } 6140 6141 switch (fin->fin_p) 6142 { 6143 case IPPROTO_TCP : 6144 tcp = fin->fin_dp; 6145 6146 if ((nflags & IPN_TCP) != 0) 6147 csump = &tcp->th_sum; 6148 6149 /* 6150 * Do a MSS CLAMPING on a SYN packet, 6151 * only deal IPv4 for now. 6152 */ 6153 if ((nat->nat_mssclamp != 0) && (tcp->th_flags & TH_SYN) != 0) 6154 ipf_nat_mssclamp(tcp, nat->nat_mssclamp, fin, csump); 6155 6156 break; 6157 6158 case IPPROTO_UDP : 6159 udp = fin->fin_dp; 6160 6161 if ((nflags & IPN_UDP) != 0) { 6162 if (udp->uh_sum != 0) 6163 csump = &udp->uh_sum; 6164 } 6165 break; 6166 6167 case IPPROTO_ICMP : 6168 icmp = fin->fin_dp; 6169 6170 if ((nflags & IPN_ICMPQUERY) != 0) { 6171 if (icmp->icmp_cksum != 0) 6172 csump = &icmp->icmp_cksum; 6173 } 6174 break; 6175 } 6176 return csump; 6177 } 6178 6179 6180 /* ------------------------------------------------------------------------ */ 6181 /* Function: ipf_nat_expire */ 6182 /* Returns: Nil */ 6183 /* Parameters: Nil */ 6184 /* */ 6185 /* Check all of the timeout queues for entries at the top which need to be */ 6186 /* expired. */ 6187 /* ------------------------------------------------------------------------ */ 6188 void 6189 ipf_nat_expire(ipf_main_softc_t *softc) 6190 { 6191 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 6192 ipftq_t *ifq, *ifqnext; 6193 ipftqent_t *tqe, *tqn; 6194 int i; 6195 SPL_INT(s); 6196 6197 SPL_NET(s); 6198 WRITE_ENTER(&softc->ipf_nat); 6199 for (ifq = softn->ipf_nat_tcptq, i = 0; ifq != NULL; 6200 ifq = ifq->ifq_next) { 6201 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) { 6202 if (tqe->tqe_die > softc->ipf_ticks) 6203 break; 6204 tqn = tqe->tqe_next; 6205 ipf_nat_delete(softc, tqe->tqe_parent, NL_EXPIRE); 6206 } 6207 } 6208 6209 for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifq->ifq_next) { 6210 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) { 6211 if (tqe->tqe_die > softc->ipf_ticks) 6212 break; 6213 tqn = tqe->tqe_next; 6214 ipf_nat_delete(softc, tqe->tqe_parent, NL_EXPIRE); 6215 } 6216 } 6217 6218 for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifqnext) { 6219 ifqnext = ifq->ifq_next; 6220 6221 if (((ifq->ifq_flags & IFQF_DELETE) != 0) && 6222 (ifq->ifq_ref == 0)) { 6223 ipf_freetimeoutqueue(softc, ifq); 6224 } 6225 } 6226 6227 if (softn->ipf_nat_doflush != 0) { 6228 ipf_nat_extraflush(softc, softn, 2); 6229 softn->ipf_nat_doflush = 0; 6230 } 6231 6232 RWLOCK_EXIT(&softc->ipf_nat); 6233 SPL_X(s); 6234 } 6235 6236 6237 /* ------------------------------------------------------------------------ */ 6238 /* Function: ipf_nat_sync */ 6239 /* Returns: Nil */ 6240 /* Parameters: ifp(I) - pointer to network interface */ 6241 /* */ 6242 /* Walk through all of the currently active NAT sessions, looking for those */ 6243 /* which need to have their translated address updated. */ 6244 /* ------------------------------------------------------------------------ */ 6245 void 6246 ipf_nat_sync(ipf_main_softc_t *softc, void *ifp) 6247 { 6248 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 6249 u_32_t sum1, sum2, sumd; 6250 i6addr_t in; 6251 ipnat_t *n; 6252 nat_t *nat; 6253 void *ifp2; 6254 int idx; 6255 SPL_INT(s); 6256 6257 if (softc->ipf_running <= 0) 6258 return; 6259 6260 /* 6261 * Change IP addresses for NAT sessions for any protocol except TCP 6262 * since it will break the TCP connection anyway. The only rules 6263 * which will get changed are those which are "map ... -> 0/32", 6264 * where the rule specifies the address is taken from the interface. 6265 */ 6266 SPL_NET(s); 6267 WRITE_ENTER(&softc->ipf_nat); 6268 6269 if (softc->ipf_running <= 0) { 6270 RWLOCK_EXIT(&softc->ipf_nat); 6271 return; 6272 } 6273 6274 for (nat = softn->ipf_nat_instances; nat; nat = nat->nat_next) { 6275 if ((nat->nat_flags & IPN_TCP) != 0) 6276 continue; 6277 6278 n = nat->nat_ptr; 6279 if (n != NULL) { 6280 if (n->in_v[1] == 4) { 6281 if (n->in_redir & NAT_MAP) { 6282 if ((n->in_nsrcaddr != 0) || 6283 (n->in_nsrcmsk != 0xffffffff)) 6284 continue; 6285 } else if (n->in_redir & NAT_REDIRECT) { 6286 if ((n->in_ndstaddr != 0) || 6287 (n->in_ndstmsk != 0xffffffff)) 6288 continue; 6289 } 6290 } 6291 #ifdef USE_INET6 6292 if (n->in_v[1] == 4) { 6293 if (n->in_redir & NAT_MAP) { 6294 if (!IP6_ISZERO(&n->in_nsrcaddr) || 6295 !IP6_ISONES(&n->in_nsrcmsk)) 6296 continue; 6297 } else if (n->in_redir & NAT_REDIRECT) { 6298 if (!IP6_ISZERO(&n->in_ndstaddr) || 6299 !IP6_ISONES(&n->in_ndstmsk)) 6300 continue; 6301 } 6302 } 6303 #endif 6304 } 6305 6306 if (((ifp == NULL) || (ifp == nat->nat_ifps[0]) || 6307 (ifp == nat->nat_ifps[1]))) { 6308 nat->nat_ifps[0] = GETIFP(nat->nat_ifnames[0], 6309 nat->nat_v[0]); 6310 if ((nat->nat_ifps[0] != NULL) && 6311 (nat->nat_ifps[0] != (void *)-1)) { 6312 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]); 6313 } 6314 if (nat->nat_ifnames[1][0] != '\0') { 6315 nat->nat_ifps[1] = GETIFP(nat->nat_ifnames[1], 6316 nat->nat_v[1]); 6317 } else { 6318 nat->nat_ifps[1] = nat->nat_ifps[0]; 6319 } 6320 if ((nat->nat_ifps[1] != NULL) && 6321 (nat->nat_ifps[1] != (void *)-1)) { 6322 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]); 6323 } 6324 ifp2 = nat->nat_ifps[0]; 6325 if (ifp2 == NULL) 6326 continue; 6327 6328 /* 6329 * Change the map-to address to be the same as the 6330 * new one. 6331 */ 6332 sum1 = NATFSUM(nat, nat->nat_v[1], nat_nsrc6); 6333 if (ipf_ifpaddr(softc, nat->nat_v[0], FRI_NORMAL, ifp2, 6334 &in, NULL) != -1) { 6335 if (nat->nat_v[0] == 4) 6336 nat->nat_nsrcip = in.in4; 6337 } 6338 sum2 = NATFSUM(nat, nat->nat_v[1], nat_nsrc6); 6339 6340 if (sum1 == sum2) 6341 continue; 6342 /* 6343 * Readjust the checksum adjustment to take into 6344 * account the new IP#. 6345 */ 6346 CALC_SUMD(sum1, sum2, sumd); 6347 /* XXX - dont change for TCP when solaris does 6348 * hardware checksumming. 6349 */ 6350 sumd += nat->nat_sumd[0]; 6351 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 6352 nat->nat_sumd[1] = nat->nat_sumd[0]; 6353 } 6354 } 6355 6356 for (n = softn->ipf_nat_list; (n != NULL); n = n->in_next) { 6357 char *base = n->in_names; 6358 6359 if ((ifp == NULL) || (n->in_ifps[0] == ifp)) 6360 n->in_ifps[0] = ipf_resolvenic(softc, 6361 base + n->in_ifnames[0], 6362 n->in_v[0]); 6363 if ((ifp == NULL) || (n->in_ifps[1] == ifp)) 6364 n->in_ifps[1] = ipf_resolvenic(softc, 6365 base + n->in_ifnames[1], 6366 n->in_v[1]); 6367 6368 if (n->in_redir & NAT_REDIRECT) 6369 idx = 1; 6370 else 6371 idx = 0; 6372 6373 if (((ifp == NULL) || (n->in_ifps[idx] == ifp)) && 6374 (n->in_ifps[idx] != NULL && 6375 n->in_ifps[idx] != (void *)-1)) { 6376 6377 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_osrc, 6378 0, n->in_ifps[idx]); 6379 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_odst, 6380 0, n->in_ifps[idx]); 6381 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_nsrc, 6382 0, n->in_ifps[idx]); 6383 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_ndst, 6384 0, n->in_ifps[idx]); 6385 } 6386 } 6387 RWLOCK_EXIT(&softc->ipf_nat); 6388 SPL_X(s); 6389 } 6390 6391 6392 /* ------------------------------------------------------------------------ */ 6393 /* Function: ipf_nat_icmpquerytype */ 6394 /* Returns: int - 1 == success, 0 == failure */ 6395 /* Parameters: icmptype(I) - ICMP type number */ 6396 /* */ 6397 /* Tests to see if the ICMP type number passed is a query/response type or */ 6398 /* not. */ 6399 /* ------------------------------------------------------------------------ */ 6400 static int 6401 ipf_nat_icmpquerytype(int icmptype) 6402 { 6403 6404 /* 6405 * For the ICMP query NAT code, it is essential that both the query 6406 * and the reply match on the NAT rule. Because the NAT structure 6407 * does not keep track of the icmptype, and a single NAT structure 6408 * is used for all icmp types with the same src, dest and id, we 6409 * simply define the replies as queries as well. The funny thing is, 6410 * although it seems silly to call a reply a query, this is exactly 6411 * as it is defined in the IPv4 specification 6412 */ 6413 switch (icmptype) 6414 { 6415 case ICMP_ECHOREPLY: 6416 case ICMP_ECHO: 6417 /* route aedvertisement/solliciation is currently unsupported: */ 6418 /* it would require rewriting the ICMP data section */ 6419 case ICMP_TSTAMP: 6420 case ICMP_TSTAMPREPLY: 6421 case ICMP_IREQ: 6422 case ICMP_IREQREPLY: 6423 case ICMP_MASKREQ: 6424 case ICMP_MASKREPLY: 6425 return 1; 6426 default: 6427 return 0; 6428 } 6429 } 6430 6431 6432 /* ------------------------------------------------------------------------ */ 6433 /* Function: nat_log */ 6434 /* Returns: Nil */ 6435 /* Parameters: nat(I) - pointer to NAT structure */ 6436 /* action(I) - action related to NAT structure being performed */ 6437 /* */ 6438 /* Creates a NAT log entry. */ 6439 /* ------------------------------------------------------------------------ */ 6440 void 6441 ipf_nat_log(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, struct nat *nat, 6442 u_int action) 6443 { 6444 #ifdef IPFILTER_LOG 6445 # ifndef LARGE_NAT 6446 struct ipnat *np; 6447 int rulen; 6448 # endif 6449 struct natlog natl; 6450 void *items[1]; 6451 size_t sizes[1]; 6452 int types[1]; 6453 6454 bcopy((char *)&nat->nat_osrc6, (char *)&natl.nl_osrcip, 6455 sizeof(natl.nl_osrcip)); 6456 bcopy((char *)&nat->nat_nsrc6, (char *)&natl.nl_nsrcip, 6457 sizeof(natl.nl_nsrcip)); 6458 bcopy((char *)&nat->nat_odst6, (char *)&natl.nl_odstip, 6459 sizeof(natl.nl_odstip)); 6460 bcopy((char *)&nat->nat_ndst6, (char *)&natl.nl_ndstip, 6461 sizeof(natl.nl_ndstip)); 6462 6463 natl.nl_bytes[0] = nat->nat_bytes[0]; 6464 natl.nl_bytes[1] = nat->nat_bytes[1]; 6465 natl.nl_pkts[0] = nat->nat_pkts[0]; 6466 natl.nl_pkts[1] = nat->nat_pkts[1]; 6467 natl.nl_odstport = nat->nat_odport; 6468 natl.nl_osrcport = nat->nat_osport; 6469 natl.nl_nsrcport = nat->nat_nsport; 6470 natl.nl_ndstport = nat->nat_ndport; 6471 natl.nl_p[0] = nat->nat_pr[0]; 6472 natl.nl_p[1] = nat->nat_pr[1]; 6473 natl.nl_v[0] = nat->nat_v[0]; 6474 natl.nl_v[1] = nat->nat_v[1]; 6475 natl.nl_type = nat->nat_redir; 6476 natl.nl_action = action; 6477 natl.nl_rule = -1; 6478 6479 bcopy(nat->nat_ifnames[0], natl.nl_ifnames[0], 6480 sizeof(nat->nat_ifnames[0])); 6481 bcopy(nat->nat_ifnames[1], natl.nl_ifnames[1], 6482 sizeof(nat->nat_ifnames[1])); 6483 6484 # ifndef LARGE_NAT 6485 if (nat->nat_ptr != NULL) { 6486 for (rulen = 0, np = softn->ipf_nat_list; np != NULL; 6487 np = np->in_next, rulen++) 6488 if (np == nat->nat_ptr) { 6489 natl.nl_rule = rulen; 6490 break; 6491 } 6492 } 6493 # endif 6494 items[0] = &natl; 6495 sizes[0] = sizeof(natl); 6496 types[0] = 0; 6497 6498 (void) ipf_log_items(softc, IPL_LOGNAT, NULL, items, sizes, types, 1); 6499 #endif 6500 } 6501 6502 6503 #if defined(__OpenBSD__) 6504 /* ------------------------------------------------------------------------ */ 6505 /* Function: ipf_nat_ifdetach */ 6506 /* Returns: Nil */ 6507 /* Parameters: ifp(I) - pointer to network interface */ 6508 /* */ 6509 /* Compatibility interface for OpenBSD to trigger the correct updating of */ 6510 /* interface references within IPFilter. */ 6511 /* ------------------------------------------------------------------------ */ 6512 void 6513 ipf_nat_ifdetach(ifp) 6514 void *ifp; 6515 { 6516 ipf_main_softc_t *softc; 6517 6518 softc = ipf_get_softc(0); 6519 6520 ipf_sync(ifp); 6521 return; 6522 } 6523 #endif 6524 6525 6526 /* ------------------------------------------------------------------------ */ 6527 /* Function: ipf_nat_rulederef */ 6528 /* Returns: Nil */ 6529 /* Parameters: isp(I) - pointer to pointer to NAT rule */ 6530 /* Write Locks: ipf_nat */ 6531 /* */ 6532 /* ------------------------------------------------------------------------ */ 6533 void 6534 ipf_nat_rulederef(ipf_main_softc_t *softc, ipnat_t **inp) 6535 { 6536 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 6537 ipnat_t *in; 6538 6539 in = *inp; 6540 *inp = NULL; 6541 in->in_space++; 6542 in->in_use--; 6543 if (in->in_use == 0 && (in->in_flags & IPN_DELETE)) { 6544 ipf_nat_free_rule(softc, softn, in); 6545 } 6546 } 6547 6548 6549 /* ------------------------------------------------------------------------ */ 6550 /* Function: ipf_nat_deref */ 6551 /* Returns: Nil */ 6552 /* Parameters: isp(I) - pointer to pointer to NAT table entry */ 6553 /* */ 6554 /* Decrement the reference counter for this NAT table entry and free it if */ 6555 /* there are no more things using it. */ 6556 /* */ 6557 /* IF nat_ref == 1 when this function is called, then we have an orphan nat */ 6558 /* structure *because* it only gets called on paths _after_ nat_ref has been*/ 6559 /* incremented. If nat_ref == 1 then we shouldn't decrement it here */ 6560 /* because nat_delete() will do that and send nat_ref to -1. */ 6561 /* */ 6562 /* Holding the lock on nat_lock is required to serialise nat_delete() being */ 6563 /* called from a NAT flush ioctl with a deref happening because of a packet.*/ 6564 /* ------------------------------------------------------------------------ */ 6565 void 6566 ipf_nat_deref(ipf_main_softc_t *softc, nat_t **natp) 6567 { 6568 nat_t *nat; 6569 6570 nat = *natp; 6571 *natp = NULL; 6572 6573 MUTEX_ENTER(&nat->nat_lock); 6574 if (nat->nat_ref > 1) { 6575 nat->nat_ref--; 6576 MUTEX_EXIT(&nat->nat_lock); 6577 return; 6578 } 6579 MUTEX_EXIT(&nat->nat_lock); 6580 6581 WRITE_ENTER(&softc->ipf_nat); 6582 ipf_nat_delete(softc, nat, NL_EXPIRE); 6583 RWLOCK_EXIT(&softc->ipf_nat); 6584 } 6585 6586 6587 /* ------------------------------------------------------------------------ */ 6588 /* Function: ipf_nat_clone */ 6589 /* Returns: ipstate_t* - NULL == cloning failed, */ 6590 /* else pointer to new state structure */ 6591 /* Parameters: fin(I) - pointer to packet information */ 6592 /* is(I) - pointer to master state structure */ 6593 /* Write Lock: ipf_nat */ 6594 /* */ 6595 /* Create a "duplcate" state table entry from the master. */ 6596 /* ------------------------------------------------------------------------ */ 6597 nat_t * 6598 ipf_nat_clone(fr_info_t *fin, nat_t *nat) 6599 { 6600 ipf_main_softc_t *softc = fin->fin_main_soft; 6601 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 6602 frentry_t *fr; 6603 nat_t *clone; 6604 ipnat_t *np; 6605 6606 KMALLOC(clone, nat_t *); 6607 if (clone == NULL) { 6608 NBUMPSIDED(fin->fin_out, ns_clone_nomem); 6609 return NULL; 6610 } 6611 bcopy((char *)nat, (char *)clone, sizeof(*clone)); 6612 6613 MUTEX_NUKE(&clone->nat_lock); 6614 6615 clone->nat_rev = fin->fin_rev; 6616 clone->nat_aps = NULL; 6617 /* 6618 * Initialize all these so that ipf_nat_delete() doesn't cause a crash. 6619 */ 6620 clone->nat_tqe.tqe_pnext = NULL; 6621 clone->nat_tqe.tqe_next = NULL; 6622 clone->nat_tqe.tqe_ifq = NULL; 6623 clone->nat_tqe.tqe_parent = clone; 6624 6625 clone->nat_flags &= ~SI_CLONE; 6626 clone->nat_flags |= SI_CLONED; 6627 6628 if (clone->nat_hm) 6629 clone->nat_hm->hm_ref++; 6630 6631 if (ipf_nat_insert(softc, softn, clone) == -1) { 6632 KFREE(clone); 6633 NBUMPSIDED(fin->fin_out, ns_insert_fail); 6634 return NULL; 6635 } 6636 6637 np = clone->nat_ptr; 6638 if (np != NULL) { 6639 if (softn->ipf_nat_logging) 6640 ipf_nat_log(softc, softn, clone, NL_CLONE); 6641 np->in_use++; 6642 } 6643 fr = clone->nat_fr; 6644 if (fr != NULL) { 6645 MUTEX_ENTER(&fr->fr_lock); 6646 fr->fr_ref++; 6647 MUTEX_EXIT(&fr->fr_lock); 6648 } 6649 6650 6651 /* 6652 * Because the clone is created outside the normal loop of things and 6653 * TCP has special needs in terms of state, initialise the timeout 6654 * state of the new NAT from here. 6655 */ 6656 if (clone->nat_pr[0] == IPPROTO_TCP) { 6657 (void) ipf_tcp_age(&clone->nat_tqe, fin, softn->ipf_nat_tcptq, 6658 clone->nat_flags, 2); 6659 } 6660 clone->nat_sync = ipf_sync_new(softc, SMC_NAT, fin, clone); 6661 if (softn->ipf_nat_logging) 6662 ipf_nat_log(softc, softn, clone, NL_CLONE); 6663 return clone; 6664 } 6665 6666 6667 /* ------------------------------------------------------------------------ */ 6668 /* Function: ipf_nat_wildok */ 6669 /* Returns: int - 1 == packet's ports match wildcards */ 6670 /* 0 == packet's ports don't match wildcards */ 6671 /* Parameters: nat(I) - NAT entry */ 6672 /* sport(I) - source port */ 6673 /* dport(I) - destination port */ 6674 /* flags(I) - wildcard flags */ 6675 /* dir(I) - packet direction */ 6676 /* */ 6677 /* Use NAT entry and packet direction to determine which combination of */ 6678 /* wildcard flags should be used. */ 6679 /* ------------------------------------------------------------------------ */ 6680 int 6681 ipf_nat_wildok(nat_t *nat, int sport, int dport, int flags, int dir) 6682 { 6683 /* 6684 * When called by dir is set to 6685 * nat_inlookup NAT_INBOUND (0) 6686 * nat_outlookup NAT_OUTBOUND (1) 6687 * 6688 * We simply combine the packet's direction in dir with the original 6689 * "intended" direction of that NAT entry in nat->nat_dir to decide 6690 * which combination of wildcard flags to allow. 6691 */ 6692 switch ((dir << 1) | (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND))) 6693 { 6694 case 3: /* outbound packet / outbound entry */ 6695 if (((nat->nat_osport == sport) || 6696 (flags & SI_W_SPORT)) && 6697 ((nat->nat_odport == dport) || 6698 (flags & SI_W_DPORT))) 6699 return 1; 6700 break; 6701 case 2: /* outbound packet / inbound entry */ 6702 if (((nat->nat_osport == dport) || 6703 (flags & SI_W_SPORT)) && 6704 ((nat->nat_odport == sport) || 6705 (flags & SI_W_DPORT))) 6706 return 1; 6707 break; 6708 case 1: /* inbound packet / outbound entry */ 6709 if (((nat->nat_osport == dport) || 6710 (flags & SI_W_SPORT)) && 6711 ((nat->nat_odport == sport) || 6712 (flags & SI_W_DPORT))) 6713 return 1; 6714 break; 6715 case 0: /* inbound packet / inbound entry */ 6716 if (((nat->nat_osport == sport) || 6717 (flags & SI_W_SPORT)) && 6718 ((nat->nat_odport == dport) || 6719 (flags & SI_W_DPORT))) 6720 return 1; 6721 break; 6722 default: 6723 break; 6724 } 6725 6726 return(0); 6727 } 6728 6729 6730 /* ------------------------------------------------------------------------ */ 6731 /* Function: nat_mssclamp */ 6732 /* Returns: Nil */ 6733 /* Parameters: tcp(I) - pointer to TCP header */ 6734 /* maxmss(I) - value to clamp the TCP MSS to */ 6735 /* fin(I) - pointer to packet information */ 6736 /* csump(I) - pointer to TCP checksum */ 6737 /* */ 6738 /* Check for MSS option and clamp it if necessary. If found and changed, */ 6739 /* then the TCP header checksum will be updated to reflect the change in */ 6740 /* the MSS. */ 6741 /* ------------------------------------------------------------------------ */ 6742 static void 6743 ipf_nat_mssclamp(tcphdr_t *tcp, u_32_t maxmss, fr_info_t *fin, u_short *csump) 6744 { 6745 u_char *cp, *ep, opt; 6746 int hlen, advance; 6747 u_32_t mss, sumd; 6748 6749 hlen = TCP_OFF(tcp) << 2; 6750 if (hlen > sizeof(*tcp)) { 6751 cp = (u_char *)tcp + sizeof(*tcp); 6752 ep = (u_char *)tcp + hlen; 6753 6754 while (cp < ep) { 6755 opt = cp[0]; 6756 if (opt == TCPOPT_EOL) 6757 break; 6758 else if (opt == TCPOPT_NOP) { 6759 cp++; 6760 continue; 6761 } 6762 6763 if (cp + 1 >= ep) 6764 break; 6765 advance = cp[1]; 6766 if ((cp + advance > ep) || (advance <= 0)) 6767 break; 6768 switch (opt) 6769 { 6770 case TCPOPT_MAXSEG: 6771 if (advance != 4) 6772 break; 6773 mss = cp[2] * 256 + cp[3]; 6774 if (mss > maxmss) { 6775 cp[2] = maxmss / 256; 6776 cp[3] = maxmss & 0xff; 6777 CALC_SUMD(mss, maxmss, sumd); 6778 ipf_fix_outcksum(fin, csump, sumd); 6779 } 6780 break; 6781 default: 6782 /* ignore unknown options */ 6783 break; 6784 } 6785 6786 cp += advance; 6787 } 6788 } 6789 } 6790 6791 6792 /* ------------------------------------------------------------------------ */ 6793 /* Function: softn->ipf_nat_setqueue */ 6794 /* Returns: Nil */ 6795 /* Parameters: nat(I)- pointer to NAT structure */ 6796 /* rev(I) - forward(0) or reverse(1) direction */ 6797 /* Locks: ipf_nat (read or write) */ 6798 /* */ 6799 /* Put the NAT entry on its default queue entry, using rev as a helped in */ 6800 /* determining which queue it should be placed on. */ 6801 /* ------------------------------------------------------------------------ */ 6802 void 6803 ipf_nat_setqueue(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, nat_t *nat) 6804 { 6805 ipftq_t *oifq, *nifq; 6806 int rev = nat->nat_rev; 6807 6808 if (nat->nat_ptr != NULL) 6809 nifq = nat->nat_ptr->in_tqehead[rev]; 6810 else 6811 nifq = NULL; 6812 6813 if (nifq == NULL) { 6814 switch (nat->nat_pr[0]) 6815 { 6816 case IPPROTO_UDP : 6817 nifq = &softn->ipf_nat_udptq; 6818 break; 6819 case IPPROTO_ICMP : 6820 nifq = &softn->ipf_nat_icmptq; 6821 break; 6822 case IPPROTO_TCP : 6823 nifq = softn->ipf_nat_tcptq + 6824 nat->nat_tqe.tqe_state[rev]; 6825 break; 6826 default : 6827 nifq = &softn->ipf_nat_iptq; 6828 break; 6829 } 6830 } 6831 6832 oifq = nat->nat_tqe.tqe_ifq; 6833 /* 6834 * If it's currently on a timeout queue, move it from one queue to 6835 * another, else put it on the end of the newly determined queue. 6836 */ 6837 if (oifq != NULL) 6838 ipf_movequeue(softc->ipf_ticks, &nat->nat_tqe, oifq, nifq); 6839 else 6840 ipf_queueappend(softc->ipf_ticks, &nat->nat_tqe, nifq, nat); 6841 return; 6842 } 6843 6844 6845 /* ------------------------------------------------------------------------ */ 6846 /* Function: nat_getnext */ 6847 /* Returns: int - 0 == ok, else error */ 6848 /* Parameters: t(I) - pointer to ipftoken structure */ 6849 /* itp(I) - pointer to ipfgeniter_t structure */ 6850 /* */ 6851 /* Fetch the next nat/ipnat structure pointer from the linked list and */ 6852 /* copy it out to the storage space pointed to by itp_data. The next item */ 6853 /* in the list to look at is put back in the ipftoken struture. */ 6854 /* ------------------------------------------------------------------------ */ 6855 static int 6856 ipf_nat_getnext(ipf_main_softc_t *softc, ipftoken_t *t, ipfgeniter_t *itp, 6857 ipfobj_t *objp) 6858 { 6859 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 6860 hostmap_t *hm, *nexthm = NULL, zerohm; 6861 ipnat_t *ipn, *nextipnat = NULL, zeroipn; 6862 nat_t *nat, *nextnat = NULL, zeronat; 6863 int error = 0; 6864 void *nnext; 6865 6866 if (itp->igi_nitems != 1) { 6867 IPFERROR(60075); 6868 return ENOSPC; 6869 } 6870 6871 READ_ENTER(&softc->ipf_nat); 6872 6873 switch (itp->igi_type) 6874 { 6875 case IPFGENITER_HOSTMAP : 6876 hm = t->ipt_data; 6877 if (hm == NULL) { 6878 nexthm = softn->ipf_hm_maplist; 6879 } else { 6880 nexthm = hm->hm_next; 6881 } 6882 if (nexthm != NULL) { 6883 ATOMIC_INC32(nexthm->hm_ref); 6884 t->ipt_data = nexthm; 6885 } else { 6886 bzero(&zerohm, sizeof(zerohm)); 6887 nexthm = &zerohm; 6888 t->ipt_data = NULL; 6889 } 6890 nnext = nexthm->hm_next; 6891 break; 6892 6893 case IPFGENITER_IPNAT : 6894 ipn = t->ipt_data; 6895 if (ipn == NULL) { 6896 nextipnat = softn->ipf_nat_list; 6897 } else { 6898 nextipnat = ipn->in_next; 6899 } 6900 if (nextipnat != NULL) { 6901 ATOMIC_INC32(nextipnat->in_use); 6902 t->ipt_data = nextipnat; 6903 } else { 6904 bzero(&zeroipn, sizeof(zeroipn)); 6905 nextipnat = &zeroipn; 6906 t->ipt_data = NULL; 6907 } 6908 nnext = nextipnat->in_next; 6909 break; 6910 6911 case IPFGENITER_NAT : 6912 nat = t->ipt_data; 6913 if (nat == NULL) { 6914 nextnat = softn->ipf_nat_instances; 6915 } else { 6916 nextnat = nat->nat_next; 6917 } 6918 if (nextnat != NULL) { 6919 MUTEX_ENTER(&nextnat->nat_lock); 6920 nextnat->nat_ref++; 6921 MUTEX_EXIT(&nextnat->nat_lock); 6922 t->ipt_data = nextnat; 6923 } else { 6924 bzero(&zeronat, sizeof(zeronat)); 6925 nextnat = &zeronat; 6926 t->ipt_data = NULL; 6927 } 6928 nnext = nextnat->nat_next; 6929 break; 6930 6931 default : 6932 RWLOCK_EXIT(&softc->ipf_nat); 6933 IPFERROR(60055); 6934 return EINVAL; 6935 } 6936 6937 RWLOCK_EXIT(&softc->ipf_nat); 6938 6939 objp->ipfo_ptr = itp->igi_data; 6940 6941 switch (itp->igi_type) 6942 { 6943 case IPFGENITER_HOSTMAP : 6944 error = COPYOUT(nexthm, objp->ipfo_ptr, sizeof(*nexthm)); 6945 if (error != 0) { 6946 IPFERROR(60049); 6947 error = EFAULT; 6948 } 6949 if (hm != NULL) { 6950 WRITE_ENTER(&softc->ipf_nat); 6951 ipf_nat_hostmapdel(&hm); 6952 RWLOCK_EXIT(&softc->ipf_nat); 6953 } 6954 break; 6955 6956 case IPFGENITER_IPNAT : 6957 objp->ipfo_size = nextipnat->in_size; 6958 objp->ipfo_type = IPFOBJ_IPNAT; 6959 error = ipf_outobjk(softc, objp, nextipnat); 6960 if (ipn != NULL) { 6961 WRITE_ENTER(&softc->ipf_nat); 6962 ipf_nat_rulederef(softc, &ipn); 6963 RWLOCK_EXIT(&softc->ipf_nat); 6964 } 6965 break; 6966 6967 case IPFGENITER_NAT : 6968 objp->ipfo_size = sizeof(nat_t); 6969 objp->ipfo_type = IPFOBJ_NAT; 6970 error = ipf_outobjk(softc, objp, nextnat); 6971 if (nat != NULL) 6972 ipf_nat_deref(softc, &nat); 6973 6974 break; 6975 } 6976 6977 if (nnext == NULL) 6978 ipf_token_mark_complete(t); 6979 6980 return error; 6981 } 6982 6983 6984 /* ------------------------------------------------------------------------ */ 6985 /* Function: nat_extraflush */ 6986 /* Returns: int - 0 == success, -1 == failure */ 6987 /* Parameters: which(I) - how to flush the active NAT table */ 6988 /* Write Locks: ipf_nat */ 6989 /* */ 6990 /* Flush nat tables. Three actions currently defined: */ 6991 /* which == 0 : flush all nat table entries */ 6992 /* which == 1 : flush TCP connections which have started to close but are */ 6993 /* stuck for some reason. */ 6994 /* which == 2 : flush TCP connections which have been idle for a long time, */ 6995 /* starting at > 4 days idle and working back in successive half-*/ 6996 /* days to at most 12 hours old. If this fails to free enough */ 6997 /* slots then work backwards in half hour slots to 30 minutes. */ 6998 /* If that too fails, then work backwards in 30 second intervals */ 6999 /* for the last 30 minutes to at worst 30 seconds idle. */ 7000 /* ------------------------------------------------------------------------ */ 7001 static int 7002 ipf_nat_extraflush(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, int which) 7003 { 7004 nat_t *nat, **natp; 7005 ipftqent_t *tqn; 7006 ipftq_t *ifq; 7007 int removed; 7008 SPL_INT(s); 7009 7010 removed = 0; 7011 7012 SPL_NET(s); 7013 switch (which) 7014 { 7015 case 0 : 7016 softn->ipf_nat_stats.ns_flush_all++; 7017 /* 7018 * Style 0 flush removes everything... 7019 */ 7020 for (natp = &softn->ipf_nat_instances; 7021 ((nat = *natp) != NULL); ) { 7022 ipf_nat_delete(softc, nat, NL_FLUSH); 7023 removed++; 7024 } 7025 break; 7026 7027 case 1 : 7028 softn->ipf_nat_stats.ns_flush_closing++; 7029 /* 7030 * Since we're only interested in things that are closing, 7031 * we can start with the appropriate timeout queue. 7032 */ 7033 for (ifq = softn->ipf_nat_tcptq + IPF_TCPS_CLOSE_WAIT; 7034 ifq != NULL; ifq = ifq->ifq_next) { 7035 7036 for (tqn = ifq->ifq_head; tqn != NULL; ) { 7037 nat = tqn->tqe_parent; 7038 tqn = tqn->tqe_next; 7039 if (nat->nat_pr[0] != IPPROTO_TCP || 7040 nat->nat_pr[1] != IPPROTO_TCP) 7041 break; 7042 ipf_nat_delete(softc, nat, NL_EXPIRE); 7043 removed++; 7044 } 7045 } 7046 7047 /* 7048 * Also need to look through the user defined queues. 7049 */ 7050 for (ifq = softn->ipf_nat_utqe; ifq != NULL; 7051 ifq = ifq->ifq_next) { 7052 for (tqn = ifq->ifq_head; tqn != NULL; ) { 7053 nat = tqn->tqe_parent; 7054 tqn = tqn->tqe_next; 7055 if (nat->nat_pr[0] != IPPROTO_TCP || 7056 nat->nat_pr[1] != IPPROTO_TCP) 7057 continue; 7058 7059 if ((nat->nat_tcpstate[0] > 7060 IPF_TCPS_ESTABLISHED) && 7061 (nat->nat_tcpstate[1] > 7062 IPF_TCPS_ESTABLISHED)) { 7063 ipf_nat_delete(softc, nat, NL_EXPIRE); 7064 removed++; 7065 } 7066 } 7067 } 7068 break; 7069 7070 /* 7071 * Args 5-11 correspond to flushing those particular states 7072 * for TCP connections. 7073 */ 7074 case IPF_TCPS_CLOSE_WAIT : 7075 case IPF_TCPS_FIN_WAIT_1 : 7076 case IPF_TCPS_CLOSING : 7077 case IPF_TCPS_LAST_ACK : 7078 case IPF_TCPS_FIN_WAIT_2 : 7079 case IPF_TCPS_TIME_WAIT : 7080 case IPF_TCPS_CLOSED : 7081 softn->ipf_nat_stats.ns_flush_state++; 7082 tqn = softn->ipf_nat_tcptq[which].ifq_head; 7083 while (tqn != NULL) { 7084 nat = tqn->tqe_parent; 7085 tqn = tqn->tqe_next; 7086 ipf_nat_delete(softc, nat, NL_FLUSH); 7087 removed++; 7088 } 7089 break; 7090 7091 default : 7092 if (which < 30) 7093 break; 7094 7095 softn->ipf_nat_stats.ns_flush_timeout++; 7096 /* 7097 * Take a large arbitrary number to mean the number of seconds 7098 * for which which consider to be the maximum value we'll allow 7099 * the expiration to be. 7100 */ 7101 which = IPF_TTLVAL(which); 7102 for (natp = &softn->ipf_nat_instances; 7103 ((nat = *natp) != NULL); ) { 7104 if (softc->ipf_ticks - nat->nat_touched > which) { 7105 ipf_nat_delete(softc, nat, NL_FLUSH); 7106 removed++; 7107 } else 7108 natp = &nat->nat_next; 7109 } 7110 break; 7111 } 7112 7113 if (which != 2) { 7114 SPL_X(s); 7115 return removed; 7116 } 7117 7118 softn->ipf_nat_stats.ns_flush_queue++; 7119 7120 /* 7121 * Asked to remove inactive entries because the table is full, try 7122 * again, 3 times, if first attempt failed with a different criteria 7123 * each time. The order tried in must be in decreasing age. 7124 * Another alternative is to implement random drop and drop N entries 7125 * at random until N have been freed up. 7126 */ 7127 if (softc->ipf_ticks - softn->ipf_nat_last_force_flush > 7128 IPF_TTLVAL(5)) { 7129 softn->ipf_nat_last_force_flush = softc->ipf_ticks; 7130 7131 removed = ipf_queueflush(softc, ipf_nat_flush_entry, 7132 softn->ipf_nat_tcptq, 7133 softn->ipf_nat_utqe, 7134 &softn->ipf_nat_stats.ns_active, 7135 softn->ipf_nat_table_sz, 7136 softn->ipf_nat_table_wm_low); 7137 } 7138 7139 SPL_X(s); 7140 return removed; 7141 } 7142 7143 7144 /* ------------------------------------------------------------------------ */ 7145 /* Function: ipf_nat_flush_entry */ 7146 /* Returns: 0 - always succeeds */ 7147 /* Parameters: entry(I) - pointer to NAT entry */ 7148 /* Write Locks: ipf_nat */ 7149 /* */ 7150 /* This function is a stepping stone between ipf_queueflush() and */ 7151 /* nat_dlete(). It is used so we can provide a uniform interface via the */ 7152 /* ipf_queueflush() function. Since the nat_delete() function returns void */ 7153 /* we translate that to mean it always succeeds in deleting something. */ 7154 /* ------------------------------------------------------------------------ */ 7155 static int 7156 ipf_nat_flush_entry(ipf_main_softc_t *softc, void *entry) 7157 { 7158 ipf_nat_delete(softc, entry, NL_FLUSH); 7159 return 0; 7160 } 7161 7162 7163 /* ------------------------------------------------------------------------ */ 7164 /* Function: ipf_nat_iterator */ 7165 /* Returns: int - 0 == ok, else error */ 7166 /* Parameters: token(I) - pointer to ipftoken structure */ 7167 /* itp(I) - pointer to ipfgeniter_t structure */ 7168 /* */ 7169 /* This function acts as a handler for the SIOCGENITER ioctls that use a */ 7170 /* generic structure to iterate through a list. There are three different */ 7171 /* linked lists of NAT related information to go through: NAT rules, active */ 7172 /* NAT mappings and the NAT fragment cache. */ 7173 /* ------------------------------------------------------------------------ */ 7174 static int 7175 ipf_nat_iterator(ipf_main_softc_t *softc, ipftoken_t *token, ipfgeniter_t *itp, 7176 ipfobj_t *obj) 7177 { 7178 int error; 7179 7180 if (itp->igi_data == NULL) { 7181 IPFERROR(60052); 7182 return EFAULT; 7183 } 7184 7185 switch (itp->igi_type) 7186 { 7187 case IPFGENITER_HOSTMAP : 7188 case IPFGENITER_IPNAT : 7189 case IPFGENITER_NAT : 7190 error = ipf_nat_getnext(softc, token, itp, obj); 7191 break; 7192 7193 case IPFGENITER_NATFRAG : 7194 error = ipf_frag_nat_next(softc, token, itp); 7195 break; 7196 default : 7197 IPFERROR(60053); 7198 error = EINVAL; 7199 break; 7200 } 7201 7202 return error; 7203 } 7204 7205 7206 /* ------------------------------------------------------------------------ */ 7207 /* Function: ipf_nat_setpending */ 7208 /* Returns: Nil */ 7209 /* Parameters: nat(I) - pointer to NAT structure */ 7210 /* Locks: ipf_nat (read or write) */ 7211 /* */ 7212 /* Put the NAT entry on to the pending queue - this queue has a very short */ 7213 /* lifetime where items are put that can't be deleted straight away because */ 7214 /* of locking issues but we want to delete them ASAP, anyway. In calling */ 7215 /* this function, it is assumed that the owner (if there is one, as shown */ 7216 /* by nat_me) is no longer interested in it. */ 7217 /* ------------------------------------------------------------------------ */ 7218 void 7219 ipf_nat_setpending(ipf_main_softc_t *softc, nat_t *nat) 7220 { 7221 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 7222 ipftq_t *oifq; 7223 7224 oifq = nat->nat_tqe.tqe_ifq; 7225 if (oifq != NULL) 7226 ipf_movequeue(softc->ipf_ticks, &nat->nat_tqe, oifq, 7227 &softn->ipf_nat_pending); 7228 else 7229 ipf_queueappend(softc->ipf_ticks, &nat->nat_tqe, 7230 &softn->ipf_nat_pending, nat); 7231 7232 if (nat->nat_me != NULL) { 7233 *nat->nat_me = NULL; 7234 nat->nat_me = NULL; 7235 nat->nat_ref--; 7236 } 7237 } 7238 7239 7240 /* ------------------------------------------------------------------------ */ 7241 /* Function: nat_newrewrite */ 7242 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */ 7243 /* allow rule to be moved if IPN_ROUNDR is set. */ 7244 /* Parameters: fin(I) - pointer to packet information */ 7245 /* nat(I) - pointer to NAT entry */ 7246 /* ni(I) - pointer to structure with misc. information needed */ 7247 /* to create new NAT entry. */ 7248 /* Write Lock: ipf_nat */ 7249 /* */ 7250 /* This function is responsible for setting up an active NAT session where */ 7251 /* we are changing both the source and destination parameters at the same */ 7252 /* time. The loop in here works differently to elsewhere - each iteration */ 7253 /* is responsible for changing a single parameter that can be incremented. */ 7254 /* So one pass may increase the source IP#, next source port, next dest. IP#*/ 7255 /* and the last destination port for a total of 4 iterations to try each. */ 7256 /* This is done to try and exhaustively use the translation space available.*/ 7257 /* ------------------------------------------------------------------------ */ 7258 static int 7259 ipf_nat_newrewrite(fr_info_t *fin, nat_t *nat, natinfo_t *nai) 7260 { 7261 int src_search = 1; 7262 int dst_search = 1; 7263 fr_info_t frnat; 7264 u_32_t flags; 7265 u_short swap; 7266 ipnat_t *np; 7267 nat_t *natl; 7268 int l = 0; 7269 int changed; 7270 7271 natl = NULL; 7272 changed = -1; 7273 np = nai->nai_np; 7274 flags = nat->nat_flags; 7275 bcopy((char *)fin, (char *)&frnat, sizeof(*fin)); 7276 7277 nat->nat_hm = NULL; 7278 7279 do { 7280 changed = -1; 7281 /* TRACE (l, src_search, dst_search, np) */ 7282 7283 if ((src_search == 0) && (np->in_spnext == 0) && 7284 (dst_search == 0) && (np->in_dpnext == 0)) { 7285 if (l > 0) 7286 return -1; 7287 } 7288 7289 /* 7290 * Find a new source address 7291 */ 7292 if (ipf_nat_nextaddr(fin, &np->in_nsrc, &frnat.fin_saddr, 7293 &frnat.fin_saddr) == -1) { 7294 return -1; 7295 } 7296 7297 if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0xffffffff)) { 7298 src_search = 0; 7299 if (np->in_stepnext == 0) 7300 np->in_stepnext = 1; 7301 7302 } else if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0)) { 7303 src_search = 0; 7304 if (np->in_stepnext == 0) 7305 np->in_stepnext = 1; 7306 7307 } else if (np->in_nsrcmsk == 0xffffffff) { 7308 src_search = 0; 7309 if (np->in_stepnext == 0) 7310 np->in_stepnext = 1; 7311 7312 } else if (np->in_nsrcmsk != 0xffffffff) { 7313 if (np->in_stepnext == 0 && changed == -1) { 7314 np->in_snip++; 7315 np->in_stepnext++; 7316 changed = 0; 7317 } 7318 } 7319 7320 if ((flags & IPN_TCPUDPICMP) != 0) { 7321 if (np->in_spnext != 0) 7322 frnat.fin_data[0] = np->in_spnext; 7323 7324 /* 7325 * Standard port translation. Select next port. 7326 */ 7327 if ((flags & IPN_FIXEDSPORT) != 0) { 7328 np->in_stepnext = 2; 7329 } else if ((np->in_stepnext == 1) && 7330 (changed == -1) && (natl != NULL)) { 7331 np->in_spnext++; 7332 np->in_stepnext++; 7333 changed = 1; 7334 if (np->in_spnext > np->in_spmax) 7335 np->in_spnext = np->in_spmin; 7336 } 7337 } else { 7338 np->in_stepnext = 2; 7339 } 7340 np->in_stepnext &= 0x3; 7341 7342 /* 7343 * Find a new destination address 7344 */ 7345 /* TRACE (fin, np, l, frnat) */ 7346 7347 if (ipf_nat_nextaddr(fin, &np->in_ndst, &frnat.fin_daddr, 7348 &frnat.fin_daddr) == -1) 7349 return -1; 7350 if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0xffffffff)) { 7351 dst_search = 0; 7352 if (np->in_stepnext == 2) 7353 np->in_stepnext = 3; 7354 7355 } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0)) { 7356 dst_search = 0; 7357 if (np->in_stepnext == 2) 7358 np->in_stepnext = 3; 7359 7360 } else if (np->in_ndstmsk == 0xffffffff) { 7361 dst_search = 0; 7362 if (np->in_stepnext == 2) 7363 np->in_stepnext = 3; 7364 7365 } else if (np->in_ndstmsk != 0xffffffff) { 7366 if ((np->in_stepnext == 2) && (changed == -1) && 7367 (natl != NULL)) { 7368 changed = 2; 7369 np->in_stepnext++; 7370 np->in_dnip++; 7371 } 7372 } 7373 7374 if ((flags & IPN_TCPUDPICMP) != 0) { 7375 if (np->in_dpnext != 0) 7376 frnat.fin_data[1] = np->in_dpnext; 7377 7378 /* 7379 * Standard port translation. Select next port. 7380 */ 7381 if ((flags & IPN_FIXEDDPORT) != 0) { 7382 np->in_stepnext = 0; 7383 } else if (np->in_stepnext == 3 && changed == -1) { 7384 np->in_dpnext++; 7385 np->in_stepnext++; 7386 changed = 3; 7387 if (np->in_dpnext > np->in_dpmax) 7388 np->in_dpnext = np->in_dpmin; 7389 } 7390 } else { 7391 if (np->in_stepnext == 3) 7392 np->in_stepnext = 0; 7393 } 7394 7395 /* TRACE (frnat) */ 7396 7397 /* 7398 * Here we do a lookup of the connection as seen from 7399 * the outside. If an IP# pair already exists, try 7400 * again. So if you have A->B becomes C->B, you can 7401 * also have D->E become C->E but not D->B causing 7402 * another C->B. Also take protocol and ports into 7403 * account when determining whether a pre-existing 7404 * NAT setup will cause an external conflict where 7405 * this is appropriate. 7406 * 7407 * fin_data[] is swapped around because we are doing a 7408 * lookup of the packet is if it were moving in the opposite 7409 * direction of the one we are working with now. 7410 */ 7411 if (flags & IPN_TCPUDP) { 7412 swap = frnat.fin_data[0]; 7413 frnat.fin_data[0] = frnat.fin_data[1]; 7414 frnat.fin_data[1] = swap; 7415 } 7416 if (fin->fin_out == 1) { 7417 natl = ipf_nat_inlookup(&frnat, 7418 flags & ~(SI_WILDP|NAT_SEARCH), 7419 (u_int)frnat.fin_p, 7420 frnat.fin_dst, frnat.fin_src); 7421 7422 } else { 7423 natl = ipf_nat_outlookup(&frnat, 7424 flags & ~(SI_WILDP|NAT_SEARCH), 7425 (u_int)frnat.fin_p, 7426 frnat.fin_dst, frnat.fin_src); 7427 } 7428 if (flags & IPN_TCPUDP) { 7429 swap = frnat.fin_data[0]; 7430 frnat.fin_data[0] = frnat.fin_data[1]; 7431 frnat.fin_data[1] = swap; 7432 } 7433 7434 /* TRACE natl, in_stepnext, l */ 7435 7436 if ((natl != NULL) && (l > 8)) /* XXX 8 is arbitrary */ 7437 return -1; 7438 7439 np->in_stepnext &= 0x3; 7440 7441 l++; 7442 changed = -1; 7443 } while (natl != NULL); 7444 7445 nat->nat_osrcip = fin->fin_src; 7446 nat->nat_odstip = fin->fin_dst; 7447 nat->nat_nsrcip = frnat.fin_src; 7448 nat->nat_ndstip = frnat.fin_dst; 7449 7450 if ((flags & IPN_TCPUDPICMP) != 0) { 7451 nat->nat_osport = htons(fin->fin_data[0]); 7452 nat->nat_odport = htons(fin->fin_data[1]); 7453 nat->nat_nsport = htons(frnat.fin_data[0]); 7454 nat->nat_ndport = htons(frnat.fin_data[1]); 7455 } 7456 7457 return 0; 7458 } 7459 7460 7461 /* ------------------------------------------------------------------------ */ 7462 /* Function: nat_newdivert */ 7463 /* Returns: int - -1 == error, 0 == success */ 7464 /* Parameters: fin(I) - pointer to packet information */ 7465 /* nat(I) - pointer to NAT entry */ 7466 /* ni(I) - pointer to structure with misc. information needed */ 7467 /* to create new NAT entry. */ 7468 /* Write Lock: ipf_nat */ 7469 /* */ 7470 /* Create a new NAT encap/divert session as defined by the NAT rule. This */ 7471 /* is somewhat different to other NAT session creation routines because we */ 7472 /* do not iterate through either port numbers or IP addresses, searching */ 7473 /* for a unique mapping, however, a complimentary duplicate check is made. */ 7474 /* ------------------------------------------------------------------------ */ 7475 static int 7476 ipf_nat_newdivert(fr_info_t *fin, nat_t *nat, natinfo_t *nai) 7477 { 7478 ipf_main_softc_t *softc = fin->fin_main_soft; 7479 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 7480 fr_info_t frnat; 7481 ipnat_t *np; 7482 nat_t *natl; 7483 int p; 7484 7485 np = nai->nai_np; 7486 bcopy((char *)fin, (char *)&frnat, sizeof(*fin)); 7487 7488 nat->nat_pr[0] = 0; 7489 nat->nat_osrcaddr = fin->fin_saddr; 7490 nat->nat_odstaddr = fin->fin_daddr; 7491 nat->nat_osport = htons(fin->fin_data[0]); 7492 nat->nat_odport = htons(fin->fin_data[1]); 7493 frnat.fin_saddr = htonl(np->in_snip); 7494 frnat.fin_daddr = htonl(np->in_dnip); 7495 7496 if (np->in_redir & NAT_DIVERTUDP) { 7497 frnat.fin_data[0] = np->in_spnext; 7498 frnat.fin_data[1] = np->in_dpnext; 7499 frnat.fin_flx |= FI_TCPUDP; 7500 p = IPPROTO_UDP; 7501 } else { 7502 frnat.fin_flx &= ~FI_TCPUDP; 7503 p = IPPROTO_IPIP; 7504 } 7505 7506 if (fin->fin_out == 1) { 7507 natl = ipf_nat_inlookup(&frnat, 0, p, 7508 frnat.fin_dst, frnat.fin_src); 7509 7510 } else { 7511 natl = ipf_nat_outlookup(&frnat, 0, p, 7512 frnat.fin_dst, frnat.fin_src); 7513 } 7514 7515 if (natl != NULL) { 7516 NBUMPSIDED(fin->fin_out, ns_divert_exist); 7517 return -1; 7518 } 7519 7520 nat->nat_nsrcaddr = frnat.fin_saddr; 7521 nat->nat_ndstaddr = frnat.fin_daddr; 7522 if (np->in_redir & NAT_DIVERTUDP) { 7523 nat->nat_nsport = htons(frnat.fin_data[0]); 7524 nat->nat_ndport = htons(frnat.fin_data[1]); 7525 } 7526 nat->nat_pr[fin->fin_out] = fin->fin_p; 7527 nat->nat_pr[1 - fin->fin_out] = p; 7528 7529 if (np->in_redir & NAT_ENCAP) { 7530 if (np->in_redir & NAT_REDIRECT) 7531 nat->nat_dir = NAT_ENCAPIN; 7532 else 7533 nat->nat_dir = NAT_ENCAPOUT; 7534 } else { 7535 if (np->in_redir & NAT_REDIRECT) 7536 nat->nat_dir = NAT_DIVERTIN; 7537 else 7538 nat->nat_dir = NAT_DIVERTOUT; 7539 } 7540 7541 return 0; 7542 } 7543 7544 7545 /* ------------------------------------------------------------------------ */ 7546 /* Function: nat_builddivertmp */ 7547 /* Returns: int - -1 == error, 0 == success */ 7548 /* Parameters: np(I) - pointer to a NAT rule */ 7549 /* */ 7550 /* For encap/divert rules, a skeleton packet representing what will be */ 7551 /* prepended to the real packet is created. Even though we don't have the */ 7552 /* full packet here, a checksum is calculated that we update later when we */ 7553 /* fill in the final details. At present a 0 checksum for UDP is being set */ 7554 /* here because it is expected that divert will be used for localhost. */ 7555 /* ------------------------------------------------------------------------ */ 7556 static int 7557 ipf_nat_builddivertmp(ipf_nat_softc_t *softn, ipnat_t *np) 7558 { 7559 udphdr_t *uh; 7560 size_t len; 7561 ip_t *ip; 7562 7563 if ((np->in_redir & NAT_DIVERTUDP) != 0) 7564 len = sizeof(ip_t) + sizeof(udphdr_t); 7565 else 7566 len = sizeof(ip_t); 7567 7568 ALLOC_MB_T(np->in_divmp, len); 7569 if (np->in_divmp == NULL) { 7570 NBUMPD(ipf_nat_stats, ns_divert_build); 7571 return -1; 7572 } 7573 7574 /* 7575 * First, the header to get the packet diverted to the new destination 7576 */ 7577 ip = MTOD(np->in_divmp, ip_t *); 7578 IP_V_A(ip, 4); 7579 IP_HL_A(ip, 5); 7580 ip->ip_tos = 0; 7581 if ((np->in_redir & NAT_DIVERTUDP) != 0) 7582 ip->ip_p = IPPROTO_UDP; 7583 else 7584 ip->ip_p = IPPROTO_IPIP; 7585 ip->ip_ttl = 255; 7586 ip->ip_off = 0; 7587 ip->ip_sum = 0; 7588 ip->ip_len = htons(len); 7589 ip->ip_id = 0; 7590 ip->ip_src.s_addr = htonl(np->in_snip); 7591 ip->ip_dst.s_addr = htonl(np->in_dnip); 7592 ip->ip_sum = ipf_cksum((u_short *)ip, sizeof(*ip)); 7593 7594 if (np->in_redir & NAT_DIVERTUDP) { 7595 uh = (udphdr_t *)(ip + 1); 7596 uh->uh_sum = 0; 7597 uh->uh_ulen = 8; 7598 uh->uh_sport = htons(np->in_spnext); 7599 uh->uh_dport = htons(np->in_dpnext); 7600 } 7601 7602 return 0; 7603 } 7604 7605 7606 #define MINDECAP (sizeof(ip_t) + sizeof(udphdr_t) + sizeof(ip_t)) 7607 7608 /* ------------------------------------------------------------------------ */ 7609 /* Function: nat_decap */ 7610 /* Returns: int - -1 == error, 0 == success */ 7611 /* Parameters: fin(I) - pointer to packet information */ 7612 /* nat(I) - pointer to current NAT session */ 7613 /* */ 7614 /* This function is responsible for undoing a packet's encapsulation in the */ 7615 /* reverse of an encap/divert rule. After removing the outer encapsulation */ 7616 /* it is necessary to call ipf_makefrip() again so that the contents of 'fin'*/ 7617 /* match the "new" packet as it may still be used by IPFilter elsewhere. */ 7618 /* We use "dir" here as the basis for some of the expectations about the */ 7619 /* outer header. If we return an error, the goal is to leave the original */ 7620 /* packet information undisturbed - this falls short at the end where we'd */ 7621 /* need to back a backup copy of "fin" - expensive. */ 7622 /* ------------------------------------------------------------------------ */ 7623 static int 7624 ipf_nat_decap(fr_info_t *fin, nat_t *nat) 7625 { 7626 ipf_main_softc_t *softc = fin->fin_main_soft; 7627 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 7628 char *hdr; 7629 int hlen; 7630 int skip; 7631 mb_t *m; 7632 7633 if ((fin->fin_flx & FI_ICMPERR) != 0) { 7634 /* 7635 * ICMP packets don't get decapsulated, instead what we need 7636 * to do is change the ICMP reply from including (in the data 7637 * portion for errors) the encapsulated packet that we sent 7638 * out to something that resembles the original packet prior 7639 * to encapsulation. This isn't done here - all we're doing 7640 * here is changing the outer address to ensure that it gets 7641 * targetted back to the correct system. 7642 */ 7643 7644 if (nat->nat_dir & NAT_OUTBOUND) { 7645 u_32_t sum1, sum2, sumd; 7646 7647 sum1 = ntohl(fin->fin_daddr); 7648 sum2 = ntohl(nat->nat_osrcaddr); 7649 CALC_SUMD(sum1, sum2, sumd); 7650 fin->fin_ip->ip_dst = nat->nat_osrcip; 7651 fin->fin_daddr = nat->nat_osrcaddr; 7652 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ 7653 defined(__osf__) || defined(linux) 7654 ipf_fix_outcksum(fin, &fin->fin_ip->ip_sum, sumd); 7655 #endif 7656 } 7657 return 0; 7658 } 7659 7660 m = fin->fin_m; 7661 skip = fin->fin_hlen; 7662 7663 switch (nat->nat_dir) 7664 { 7665 case NAT_DIVERTIN : 7666 case NAT_DIVERTOUT : 7667 if (fin->fin_plen < MINDECAP) 7668 return -1; 7669 skip += sizeof(udphdr_t); 7670 break; 7671 7672 case NAT_ENCAPIN : 7673 case NAT_ENCAPOUT : 7674 if (fin->fin_plen < (skip + sizeof(ip_t))) 7675 return -1; 7676 break; 7677 default : 7678 return -1; 7679 /* NOTREACHED */ 7680 } 7681 7682 /* 7683 * The aim here is to keep the original packet details in "fin" for 7684 * as long as possible so that returning with an error is for the 7685 * original packet and there is little undoing work to do. 7686 */ 7687 if (M_LEN(m) < skip + sizeof(ip_t)) { 7688 if (ipf_pr_pullup(fin, skip + sizeof(ip_t)) == -1) 7689 return -1; 7690 } 7691 7692 hdr = MTOD(fin->fin_m, char *); 7693 fin->fin_ip = (ip_t *)(hdr + skip); 7694 hlen = IP_HL(fin->fin_ip) << 2; 7695 7696 if (ipf_pr_pullup(fin, skip + hlen) == -1) { 7697 NBUMPSIDED(fin->fin_out, ns_decap_pullup); 7698 return -1; 7699 } 7700 7701 fin->fin_hlen = hlen; 7702 fin->fin_dlen -= skip; 7703 fin->fin_plen -= skip; 7704 fin->fin_ipoff += skip; 7705 7706 if (ipf_makefrip(hlen, (ip_t *)hdr, fin) == -1) { 7707 NBUMPSIDED(fin->fin_out, ns_decap_bad); 7708 return -1; 7709 } 7710 7711 return skip; 7712 } 7713 7714 7715 /* ------------------------------------------------------------------------ */ 7716 /* Function: nat_matchencap */ 7717 /* Returns: int - -1 == packet error, 1 == success, 0 = no match */ 7718 /* Parameters: fin(I) - pointer to packet information */ 7719 /* np(I) - pointer to a NAT rule */ 7720 /* */ 7721 /* To properly compare a packet travelling in the reverse direction to an */ 7722 /* encap rule, it needs to be pseudo-decapsulated so we can check if a */ 7723 /* reply to it would be encapsulated. In doing this, we have to be careful */ 7724 /* so as not to actually do any decapsulation nor affect any of the current */ 7725 /* stored parameters in "fin" so that we can continue processing it else- */ 7726 /* where if it doesn't match. */ 7727 /* ------------------------------------------------------------------------ */ 7728 static int 7729 ipf_nat_matchencap(ipf_nat_softc_t *softn, fr_info_t *fin, ipnat_t *np) 7730 { 7731 int hlen, match, skip; 7732 u_short *ports; 7733 frtuc_t *ft; 7734 fr_ip_t fi; 7735 char *hdr; 7736 ip_t *ip; 7737 mb_t *m; 7738 7739 /* 7740 * This function is only for matching packets that are appearing from 7741 * the reverse direction against "encap" rules. 7742 */ 7743 if (fin->fin_out == 1) { 7744 if ((np->in_redir & NAT_REDIRECT) == 0) 7745 return 0; 7746 } else { 7747 if ((np->in_redir & NAT_MAP) == 0) 7748 return 0; 7749 } 7750 if (np->in_pr[fin->fin_out] != fin->fin_p) 7751 return 0; 7752 7753 /* 7754 * The aim here is to keep the original packet details in "fin" for 7755 * as long as possible so that returning with an error is for the 7756 * original packet and there is little undoing work to do. 7757 */ 7758 m = fin->fin_m; 7759 skip = fin->fin_hlen; 7760 if (M_LEN(m) < skip + sizeof(ip_t)) { 7761 if (ipf_pr_pullup(fin, sizeof(ip_t)) == -1) { 7762 NBUMPSIDED(fin->fin_out, ns_encap_pullup); 7763 return -1; 7764 } 7765 } 7766 7767 hdr = MTOD(fin->fin_m, char *); 7768 ip = (ip_t *)(hdr + skip); 7769 hlen = IP_HL(ip) << 2; 7770 7771 if (ipf_pr_pullup(fin, hlen) == -1) { 7772 NBUMPSIDED(fin->fin_out, ns_encap_pullup); 7773 return -1; 7774 } 7775 7776 match = 1; 7777 7778 /* 7779 * Now we should have the entire innder header, so match up the 7780 * address fields - easy enough. Reverse matching of source and 7781 * destination because this is purportedly a "reply" to an encap rule. 7782 */ 7783 switch (np->in_osrcatype) 7784 { 7785 case FRI_NORMAL : 7786 match = ((ip->ip_dst.s_addr & np->in_osrcmsk) 7787 != np->in_osrcaddr); 7788 break; 7789 case FRI_LOOKUP : 7790 match = (*np->in_nsrcfunc)(fin->fin_main_soft, np->in_osrcptr, 7791 np->in_v[0], &ip->ip_dst.s_addr, 7792 fin->fin_plen); 7793 break; 7794 } 7795 if (match) 7796 return 0; 7797 7798 switch (np->in_odstatype) 7799 { 7800 case FRI_NORMAL : 7801 match = ((ip->ip_src.s_addr & np->in_odstmsk) 7802 != np->in_odstaddr); 7803 break; 7804 case FRI_LOOKUP : 7805 match = (*np->in_ndstfunc)(fin->fin_main_soft, np->in_odstptr, 7806 np->in_v[0], &ip->ip_src.s_addr, 7807 fin->fin_plen); 7808 break; 7809 } 7810 if (match) 7811 return 0; 7812 7813 ft = &np->in_tuc; 7814 7815 switch (ip->ip_p) 7816 { 7817 case IPPROTO_TCP : 7818 case IPPROTO_UDP : 7819 /* 7820 * Only need to fetch port numbers for NAT 7821 */ 7822 if (ipf_pr_pullup(fin, hlen + 4) == -1) { 7823 NBUMPSIDED(fin->fin_out, ns_encap_pullup); 7824 return -1; 7825 } 7826 7827 ports = (u_short *)((char *)ip + hlen); 7828 7829 fi.fi_tcpf = 0; 7830 /* 7831 * And again, because we're simulating a reply, put the port 7832 * numbers in the revese place to where they are now. 7833 */ 7834 fi.fi_ports[0] = ntohs(ports[1]); 7835 fi.fi_ports[1] = ntohs(ports[0]); 7836 return ipf_tcpudpchk(&fi, ft); 7837 7838 /* NOTREACHED */ 7839 7840 default : 7841 if (ft->ftu_scmp || ft->ftu_dcmp) 7842 return 0; 7843 break; 7844 } 7845 7846 return 1; 7847 } 7848 7849 7850 /* ------------------------------------------------------------------------ */ 7851 /* Function: nat_nextaddr */ 7852 /* Returns: int - -1 == bad input (no new address), */ 7853 /* 0 == success and dst has new address */ 7854 /* Parameters: fin(I) - pointer to packet information */ 7855 /* na(I) - how to generate new address */ 7856 /* old(I) - original address being replaced */ 7857 /* dst(O) - where to put the new address */ 7858 /* Write Lock: ipf_nat */ 7859 /* */ 7860 /* This function uses the contents of the "na" structure, in combination */ 7861 /* with "old" to produce a new address to store in "dst". Not all of the */ 7862 /* possible uses of "na" will result in a new address. */ 7863 /* ------------------------------------------------------------------------ */ 7864 static int 7865 ipf_nat_nextaddr(fr_info_t *fin, nat_addr_t *na, u_32_t *old, u_32_t *dst) 7866 { 7867 ipf_main_softc_t *softc = fin->fin_main_soft; 7868 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 7869 u_32_t amin, amax, new; 7870 i6addr_t newip; 7871 int error; 7872 7873 new = 0; 7874 amin = na->na_addr[0].in4.s_addr; 7875 7876 switch (na->na_atype) 7877 { 7878 case FRI_RANGE : 7879 amax = na->na_addr[1].in4.s_addr; 7880 break; 7881 7882 case FRI_NETMASKED : 7883 case FRI_DYNAMIC : 7884 case FRI_NORMAL : 7885 /* 7886 * Compute the maximum address by adding the inverse of the 7887 * netmask to the minimum address. 7888 */ 7889 amax = ~na->na_addr[1].in4.s_addr; 7890 amax |= amin; 7891 break; 7892 7893 case FRI_LOOKUP : 7894 break; 7895 7896 case FRI_BROADCAST : 7897 case FRI_PEERADDR : 7898 case FRI_NETWORK : 7899 default : 7900 return -1; 7901 } 7902 7903 error = -1; 7904 7905 if (na->na_atype == FRI_LOOKUP) { 7906 if (na->na_type == IPLT_DSTLIST) { 7907 error = ipf_dstlist_select_node(fin, na->na_ptr, dst, 7908 NULL); 7909 } else { 7910 NBUMPSIDE(fin->fin_out, ns_badnextaddr); 7911 } 7912 7913 } else if (na->na_atype == IPLT_NONE) { 7914 /* 7915 * 0/0 as the new address means leave it alone. 7916 */ 7917 if (na->na_addr[0].in4.s_addr == 0 && 7918 na->na_addr[1].in4.s_addr == 0) { 7919 new = *old; 7920 7921 /* 7922 * 0/32 means get the interface's address 7923 */ 7924 } else if (na->na_addr[0].in4.s_addr == 0 && 7925 na->na_addr[1].in4.s_addr == 0xffffffff) { 7926 if (ipf_ifpaddr(softc, 4, na->na_atype, 7927 fin->fin_ifp, &newip, NULL) == -1) { 7928 NBUMPSIDED(fin->fin_out, ns_ifpaddrfail); 7929 return -1; 7930 } 7931 new = newip.in4.s_addr; 7932 } else { 7933 new = htonl(na->na_nextip); 7934 } 7935 *dst = new; 7936 error = 0; 7937 7938 } else { 7939 NBUMPSIDE(fin->fin_out, ns_badnextaddr); 7940 } 7941 7942 return error; 7943 } 7944 7945 7946 /* ------------------------------------------------------------------------ */ 7947 /* Function: nat_nextaddrinit */ 7948 /* Returns: int - 0 == success, else error number */ 7949 /* Parameters: na(I) - NAT address information for generating new addr*/ 7950 /* initial(I) - flag indicating if it is the first call for */ 7951 /* this "na" structure. */ 7952 /* ifp(I) - network interface to derive address */ 7953 /* information from. */ 7954 /* */ 7955 /* This function is expected to be called in two scenarious: when a new NAT */ 7956 /* rule is loaded into the kernel and when the list of NAT rules is sync'd */ 7957 /* up with the valid network interfaces (possibly due to them changing.) */ 7958 /* To distinguish between these, the "initial" parameter is used. If it is */ 7959 /* 1 then this indicates the rule has just been reloaded and 0 for when we */ 7960 /* are updating information. This difference is important because in */ 7961 /* instances where we are not updating address information associated with */ 7962 /* a network interface, we don't want to disturb what the "next" address to */ 7963 /* come out of ipf_nat_nextaddr() will be. */ 7964 /* ------------------------------------------------------------------------ */ 7965 static int 7966 ipf_nat_nextaddrinit(ipf_main_softc_t *softc, char *base, nat_addr_t *na, 7967 int initial, void *ifp) 7968 { 7969 7970 switch (na->na_atype) 7971 { 7972 case FRI_LOOKUP : 7973 if (na->na_subtype == 0) { 7974 na->na_ptr = ipf_lookup_res_num(softc, IPL_LOGNAT, 7975 na->na_type, 7976 na->na_num, 7977 &na->na_func); 7978 } else if (na->na_subtype == 1) { 7979 na->na_ptr = ipf_lookup_res_name(softc, IPL_LOGNAT, 7980 na->na_type, 7981 base + na->na_num, 7982 &na->na_func); 7983 } 7984 if (na->na_func == NULL) { 7985 IPFERROR(60060); 7986 return ESRCH; 7987 } 7988 if (na->na_ptr == NULL) { 7989 IPFERROR(60056); 7990 return ESRCH; 7991 } 7992 break; 7993 7994 case FRI_DYNAMIC : 7995 case FRI_BROADCAST : 7996 case FRI_NETWORK : 7997 case FRI_NETMASKED : 7998 case FRI_PEERADDR : 7999 if (ifp != NULL) 8000 (void )ipf_ifpaddr(softc, 4, na->na_atype, ifp, 8001 &na->na_addr[0], &na->na_addr[1]); 8002 break; 8003 8004 case FRI_SPLIT : 8005 case FRI_RANGE : 8006 if (initial) 8007 na->na_nextip = ntohl(na->na_addr[0].in4.s_addr); 8008 break; 8009 8010 case FRI_NONE : 8011 na->na_addr[0].in4.s_addr &= na->na_addr[1].in4.s_addr; 8012 return 0; 8013 8014 case FRI_NORMAL : 8015 na->na_addr[0].in4.s_addr &= na->na_addr[1].in4.s_addr; 8016 break; 8017 8018 default : 8019 IPFERROR(60054); 8020 return EINVAL; 8021 } 8022 8023 if (initial && (na->na_atype == FRI_NORMAL)) { 8024 if (na->na_addr[0].in4.s_addr == 0) { 8025 if ((na->na_addr[1].in4.s_addr == 0xffffffff) || 8026 (na->na_addr[1].in4.s_addr == 0)) { 8027 return 0; 8028 } 8029 } 8030 8031 if (na->na_addr[1].in4.s_addr == 0xffffffff) { 8032 na->na_nextip = ntohl(na->na_addr[0].in4.s_addr); 8033 } else { 8034 na->na_nextip = ntohl(na->na_addr[0].in4.s_addr) + 1; 8035 } 8036 } 8037 8038 return 0; 8039 } 8040 8041 8042 /* ------------------------------------------------------------------------ */ 8043 /* Function: nat_encapok */ 8044 /* Returns: int - -1 == MTU not big enough, 0 == ok to send packet */ 8045 /* Parameters: fin(I) - pointer to packet information */ 8046 /* nat(I) - pointer to current NAT session */ 8047 /* */ 8048 /* The purpose of this function is to determine whether or not a packet can */ 8049 /* be sent out of a network interface after it has been encapsulated, before*/ 8050 /* the actual encapsulation happens. If it cannot - because the "Don't */ 8051 /* fragment" bit has been set - then generate an ICMP error message back to */ 8052 /* the origin of the packet, informing it that the packet is too big and */ 8053 /* what the actual MTU out for the connection is. */ 8054 /* */ 8055 /* At present the only question this would leave for strange behaviour is */ 8056 /* with local connections that will go out an encapsulation as sending of */ 8057 /* ICMP messages to local destinations isn't considered robust. */ 8058 /* ------------------------------------------------------------------------ */ 8059 static int 8060 ipf_nat_encapok(fr_info_t *fin, nat_t *nat) 8061 { 8062 #ifdef INSTANCES 8063 ipf_main_softc_t *softc = fin->fin_main_soft; /* For GETIFMTU_4 */ 8064 #endif 8065 void *sifp; 8066 ipnat_t *n; 8067 int extra; 8068 int mtu; 8069 8070 if (!(fin->fin_ip->ip_off & htons(IP_DF))) 8071 return 0; 8072 8073 n = nat->nat_ptr; 8074 8075 if (n->in_redir & NAT_ENCAP) { 8076 extra = sizeof(ip_t); 8077 8078 } else { 8079 return 0; 8080 } 8081 8082 mtu = GETIFMTU_4(nat->nat_ifps[1]); 8083 8084 if (fin->fin_plen + extra < mtu) 8085 return 0; 8086 8087 sifp = fin->fin_ifp; 8088 fin->fin_ifp = NULL; 8089 fin->fin_icode = ICMP_UNREACH_NEEDFRAG; 8090 fin->fin_mtu = mtu - extra; 8091 8092 (void) ipf_send_icmp_err(ICMP_UNREACH, fin, 1); 8093 8094 fin->fin_mtu = 0; 8095 8096 return -1; 8097 } 8098 8099 8100 /* ------------------------------------------------------------------------ */ 8101 /* Function: ipf_nat_rebuildencapicmp */ 8102 /* Returns: int - -1 == error, 0 == success */ 8103 /* Parameters: fin(I) - pointer to packet information */ 8104 /* nat(I) - pointer to current NAT session */ 8105 /* */ 8106 /* For ICMP replies received in response to packets we've encapsulated on */ 8107 /* the way out, we need to replace all of the addressing fields found in */ 8108 /* the data section of the ICMP header. The ICMP packet is going to */ 8109 /* contain the the IP packet we sent out (IPENCAP) plus at least 64 bits of */ 8110 /* the original IP packet - not something that will be of use to the origin */ 8111 /* of the offending packet. */ 8112 /* ------------------------------------------------------------------------ */ 8113 static nat_t * 8114 ipf_nat_rebuildencapicmp(fr_info_t *fin, nat_t *nat) 8115 { 8116 icmphdr_t *icmp; 8117 udphdr_t *udp; 8118 ip_t *oip; 8119 int p; 8120 8121 icmp = fin->fin_dp; 8122 oip = (ip_t *)&icmp->icmp_ip; 8123 8124 if (fin->fin_out == 0) { 8125 if (nat->nat_dir == NAT_ENCAPIN) { 8126 oip->ip_src = nat->nat_odstip; 8127 oip->ip_dst = nat->nat_osrcip; 8128 } else { 8129 oip->ip_src = nat->nat_osrcip; 8130 oip->ip_dst = nat->nat_odstip; 8131 } 8132 } else { 8133 if (nat->nat_dir == NAT_ENCAPIN) { 8134 oip->ip_src = nat->nat_osrcip; 8135 oip->ip_dst = nat->nat_odstip; 8136 } else { 8137 oip->ip_src = nat->nat_odstip; 8138 oip->ip_dst = nat->nat_osrcip; 8139 } 8140 } 8141 8142 udp = (udphdr_t *)(oip + 1); 8143 8144 /* 8145 * We use nat_p here because the original UDP header is quite likely 8146 * to have been lost - the error packet returned contains the outer 8147 * encapsulation header plus 64 bits of the inner IP header, no room 8148 * for a UDP or TCP header unless extra data is returned. 8149 * 8150 * XXX - If the entire original packet has been included (possible) 8151 * then we should be just stripping off the outer encapsulation. 8152 * This is a "todo" for the near future. 8153 */ 8154 p = nat->nat_pr[1 - fin->fin_out]; 8155 8156 switch (p) 8157 { 8158 case IPPROTO_UDP : 8159 udp->uh_sum = 0; 8160 break; 8161 case IPPROTO_TCP : 8162 /* 8163 * NAT doesn't track the sequence number so we can't pretend 8164 * to know what value this field should carry. 8165 */ 8166 ((tcphdr_t *)udp)->th_seq = 0; 8167 break; 8168 default : 8169 break; 8170 } 8171 8172 if (p == IPPROTO_TCP || p == IPPROTO_UDP) { 8173 if (fin->fin_out == 0) { 8174 if (nat->nat_dir == NAT_ENCAPIN) { 8175 udp->uh_sport = nat->nat_odport; 8176 udp->uh_dport = nat->nat_osport; 8177 } else { 8178 udp->uh_sport = nat->nat_osport; 8179 udp->uh_dport = nat->nat_odport; 8180 } 8181 } else { 8182 if (nat->nat_dir == NAT_ENCAPIN) { 8183 udp->uh_sport = nat->nat_osport; 8184 udp->uh_dport = nat->nat_odport; 8185 } else { 8186 udp->uh_sport = nat->nat_odport; 8187 udp->uh_dport = nat->nat_osport; 8188 } 8189 } 8190 } 8191 8192 /* TRACE (fin,oip,udp,icmp) */ 8193 oip->ip_p = nat->nat_pr[1 - fin->fin_out]; 8194 oip->ip_sum = 0; 8195 oip->ip_sum = ipf_cksum((u_short *)oip, sizeof(*oip)); 8196 8197 /* 8198 * Reduce the next MTU setting by the size of the encap header 8199 */ 8200 if (icmp->icmp_type == ICMP_UNREACH && 8201 icmp->icmp_code == ICMP_UNREACH_NEEDFRAG) { 8202 icmp->icmp_nextmtu = ntohs(icmp->icmp_nextmtu); 8203 icmp->icmp_nextmtu -= sizeof(ip_t); 8204 icmp->icmp_nextmtu = htons(icmp->icmp_nextmtu); 8205 } 8206 8207 icmp->icmp_cksum = 0; 8208 icmp->icmp_cksum = ipf_cksum((u_short *)icmp, fin->fin_dlen); 8209 8210 /* TRACE (fin,oip,udp,icmp) */ 8211 8212 return 0; 8213 } 8214 8215 8216 /* ------------------------------------------------------------------------ */ 8217 /* Function: ipf_nat_matchflush */ 8218 /* Returns: int - -1 == error, 0 == success */ 8219 /* Parameters: fin(I) - pointer to packet information */ 8220 /* nat(I) - pointer to current NAT session */ 8221 /* */ 8222 /* ------------------------------------------------------------------------ */ 8223 static int 8224 ipf_nat_matchflush(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, void *data) 8225 { 8226 int *array, flushed, error; 8227 nat_t *nat, *natnext; 8228 ipfobj_t obj; 8229 8230 error = ipf_matcharray_load(softc, data, &obj, &array); 8231 if (error != 0) 8232 return error; 8233 8234 flushed = 0; 8235 8236 for (nat = softn->ipf_nat_instances; nat != NULL; nat = natnext) { 8237 natnext = nat->nat_next; 8238 if (ipf_nat_matcharray(nat, array, softc->ipf_ticks) == 0) { 8239 ipf_nat_delete(softc, nat, NL_FLUSH); 8240 flushed++; 8241 } 8242 } 8243 8244 obj.ipfo_retval = flushed; 8245 error = BCOPYOUT(&obj, data, sizeof(obj)); 8246 8247 KFREES(array, array[0] * sizeof(*array)); 8248 8249 return error; 8250 } 8251 8252 8253 /* ------------------------------------------------------------------------ */ 8254 /* Function: ipf_nat_matcharray */ 8255 /* Returns: int - -1 == error, 0 == success */ 8256 /* Parameters: fin(I) - pointer to packet information */ 8257 /* nat(I) - pointer to current NAT session */ 8258 /* */ 8259 /* ------------------------------------------------------------------------ */ 8260 static int 8261 ipf_nat_matcharray(nat_t *nat, int *array, u_long ticks) 8262 { 8263 int i, n, *x, e, p; 8264 8265 e = 0; 8266 n = array[0]; 8267 x = array + 1; 8268 8269 for (; n > 0; x += 3 + x[2]) { 8270 if (x[0] == IPF_EXP_END) 8271 break; 8272 e = 0; 8273 8274 n -= x[2] + 3; 8275 if (n < 0) 8276 break; 8277 8278 p = x[0] >> 16; 8279 if (p != 0 && p != nat->nat_pr[1]) 8280 break; 8281 8282 switch (x[0]) 8283 { 8284 case IPF_EXP_IP_PR : 8285 for (i = 0; !e && i < x[2]; i++) { 8286 e |= (nat->nat_pr[1] == x[i + 3]); 8287 } 8288 break; 8289 8290 case IPF_EXP_IP_SRCADDR : 8291 if (nat->nat_v[0] == 4) { 8292 for (i = 0; !e && i < x[2]; i++) { 8293 e |= ((nat->nat_osrcaddr & x[i + 4]) == 8294 x[i + 3]); 8295 } 8296 } 8297 if (nat->nat_v[1] == 4) { 8298 for (i = 0; !e && i < x[2]; i++) { 8299 e |= ((nat->nat_nsrcaddr & x[i + 4]) == 8300 x[i + 3]); 8301 } 8302 } 8303 break; 8304 8305 case IPF_EXP_IP_DSTADDR : 8306 if (nat->nat_v[0] == 4) { 8307 for (i = 0; !e && i < x[2]; i++) { 8308 e |= ((nat->nat_odstaddr & x[i + 4]) == 8309 x[i + 3]); 8310 } 8311 } 8312 if (nat->nat_v[1] == 4) { 8313 for (i = 0; !e && i < x[2]; i++) { 8314 e |= ((nat->nat_ndstaddr & x[i + 4]) == 8315 x[i + 3]); 8316 } 8317 } 8318 break; 8319 8320 case IPF_EXP_IP_ADDR : 8321 for (i = 0; !e && i < x[2]; i++) { 8322 if (nat->nat_v[0] == 4) { 8323 e |= ((nat->nat_osrcaddr & x[i + 4]) == 8324 x[i + 3]); 8325 } 8326 if (nat->nat_v[1] == 4) { 8327 e |= ((nat->nat_nsrcaddr & x[i + 4]) == 8328 x[i + 3]); 8329 } 8330 if (nat->nat_v[0] == 4) { 8331 e |= ((nat->nat_odstaddr & x[i + 4]) == 8332 x[i + 3]); 8333 } 8334 if (nat->nat_v[1] == 4) { 8335 e |= ((nat->nat_ndstaddr & x[i + 4]) == 8336 x[i + 3]); 8337 } 8338 } 8339 break; 8340 8341 #ifdef USE_INET6 8342 case IPF_EXP_IP6_SRCADDR : 8343 if (nat->nat_v[0] == 6) { 8344 for (i = 0; !e && i < x[3]; i++) { 8345 e |= IP6_MASKEQ(&nat->nat_osrc6, 8346 x + i + 7, x + i + 3); 8347 } 8348 } 8349 if (nat->nat_v[1] == 6) { 8350 for (i = 0; !e && i < x[3]; i++) { 8351 e |= IP6_MASKEQ(&nat->nat_nsrc6, 8352 x + i + 7, x + i + 3); 8353 } 8354 } 8355 break; 8356 8357 case IPF_EXP_IP6_DSTADDR : 8358 if (nat->nat_v[0] == 6) { 8359 for (i = 0; !e && i < x[3]; i++) { 8360 e |= IP6_MASKEQ(&nat->nat_odst6, 8361 x + i + 7, 8362 x + i + 3); 8363 } 8364 } 8365 if (nat->nat_v[1] == 6) { 8366 for (i = 0; !e && i < x[3]; i++) { 8367 e |= IP6_MASKEQ(&nat->nat_ndst6, 8368 x + i + 7, 8369 x + i + 3); 8370 } 8371 } 8372 break; 8373 8374 case IPF_EXP_IP6_ADDR : 8375 for (i = 0; !e && i < x[3]; i++) { 8376 if (nat->nat_v[0] == 6) { 8377 e |= IP6_MASKEQ(&nat->nat_osrc6, 8378 x + i + 7, 8379 x + i + 3); 8380 } 8381 if (nat->nat_v[0] == 6) { 8382 e |= IP6_MASKEQ(&nat->nat_odst6, 8383 x + i + 7, 8384 x + i + 3); 8385 } 8386 if (nat->nat_v[1] == 6) { 8387 e |= IP6_MASKEQ(&nat->nat_nsrc6, 8388 x + i + 7, 8389 x + i + 3); 8390 } 8391 if (nat->nat_v[1] == 6) { 8392 e |= IP6_MASKEQ(&nat->nat_ndst6, 8393 x + i + 7, 8394 x + i + 3); 8395 } 8396 } 8397 break; 8398 #endif 8399 8400 case IPF_EXP_UDP_PORT : 8401 case IPF_EXP_TCP_PORT : 8402 for (i = 0; !e && i < x[2]; i++) { 8403 e |= (nat->nat_nsport == x[i + 3]) || 8404 (nat->nat_ndport == x[i + 3]); 8405 } 8406 break; 8407 8408 case IPF_EXP_UDP_SPORT : 8409 case IPF_EXP_TCP_SPORT : 8410 for (i = 0; !e && i < x[2]; i++) { 8411 e |= (nat->nat_nsport == x[i + 3]); 8412 } 8413 break; 8414 8415 case IPF_EXP_UDP_DPORT : 8416 case IPF_EXP_TCP_DPORT : 8417 for (i = 0; !e && i < x[2]; i++) { 8418 e |= (nat->nat_ndport == x[i + 3]); 8419 } 8420 break; 8421 8422 case IPF_EXP_TCP_STATE : 8423 for (i = 0; !e && i < x[2]; i++) { 8424 e |= (nat->nat_tcpstate[0] == x[i + 3]) || 8425 (nat->nat_tcpstate[1] == x[i + 3]); 8426 } 8427 break; 8428 8429 case IPF_EXP_IDLE_GT : 8430 e |= (ticks - nat->nat_touched > x[3]); 8431 break; 8432 } 8433 e ^= x[1]; 8434 8435 if (!e) 8436 break; 8437 } 8438 8439 return e; 8440 } 8441 8442 8443 /* ------------------------------------------------------------------------ */ 8444 /* Function: ipf_nat_gettable */ 8445 /* Returns: int - 0 = success, else error */ 8446 /* Parameters: data(I) - pointer to ioctl data */ 8447 /* */ 8448 /* This function handles ioctl requests for tables of nat information. */ 8449 /* At present the only table it deals with is the hash bucket statistics. */ 8450 /* ------------------------------------------------------------------------ */ 8451 static int 8452 ipf_nat_gettable(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, char *data) 8453 { 8454 ipftable_t table; 8455 int error; 8456 8457 error = ipf_inobj(softc, data, NULL, &table, IPFOBJ_GTABLE); 8458 if (error != 0) 8459 return error; 8460 8461 switch (table.ita_type) 8462 { 8463 case IPFTABLE_BUCKETS_NATIN : 8464 error = COPYOUT(softn->ipf_nat_stats.ns_side[0].ns_bucketlen, 8465 table.ita_table, 8466 softn->ipf_nat_table_sz * sizeof(u_long)); 8467 break; 8468 8469 case IPFTABLE_BUCKETS_NATOUT : 8470 error = COPYOUT(softn->ipf_nat_stats.ns_side[1].ns_bucketlen, 8471 table.ita_table, 8472 softn->ipf_nat_table_sz * sizeof(u_long)); 8473 break; 8474 8475 default : 8476 IPFERROR(60058); 8477 return EINVAL; 8478 } 8479 8480 if (error != 0) { 8481 IPFERROR(60059); 8482 error = EFAULT; 8483 } 8484 return error; 8485 } 8486 8487 8488 /* ------------------------------------------------------------------------ */ 8489 /* Function: ipf_nat_settimeout */ 8490 /* Returns: int - 0 = success, else failure */ 8491 /* Parameters: t(I) - pointer to tunable */ 8492 /* p(I) - pointer to new tuning data */ 8493 /* */ 8494 /* Apply the timeout change to the NAT timeout queues. */ 8495 /* ------------------------------------------------------------------------ */ 8496 int 8497 ipf_nat_settimeout(struct ipf_main_softc_s *softc, ipftuneable_t *t, 8498 ipftuneval_t *p) 8499 { 8500 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 8501 8502 if (!strncmp(t->ipft_name, "tcp_", 4)) 8503 return ipf_settimeout_tcp(t, p, softn->ipf_nat_tcptq); 8504 8505 if (!strcmp(t->ipft_name, "udp_timeout")) { 8506 ipf_apply_timeout(&softn->ipf_nat_udptq, p->ipftu_int); 8507 } else if (!strcmp(t->ipft_name, "udp_ack_timeout")) { 8508 ipf_apply_timeout(&softn->ipf_nat_udpacktq, p->ipftu_int); 8509 } else if (!strcmp(t->ipft_name, "icmp_timeout")) { 8510 ipf_apply_timeout(&softn->ipf_nat_icmptq, p->ipftu_int); 8511 } else if (!strcmp(t->ipft_name, "icmp_ack_timeout")) { 8512 ipf_apply_timeout(&softn->ipf_nat_icmpacktq, p->ipftu_int); 8513 } else if (!strcmp(t->ipft_name, "ip_timeout")) { 8514 ipf_apply_timeout(&softn->ipf_nat_iptq, p->ipftu_int); 8515 } else { 8516 IPFERROR(60062); 8517 return ESRCH; 8518 } 8519 return 0; 8520 } 8521 8522 8523 /* ------------------------------------------------------------------------ */ 8524 /* Function: ipf_nat_rehash */ 8525 /* Returns: int - 0 = success, else failure */ 8526 /* Parameters: t(I) - pointer to tunable */ 8527 /* p(I) - pointer to new tuning data */ 8528 /* */ 8529 /* To change the size of the basic NAT table, we need to first allocate the */ 8530 /* new tables (lest it fails and we've got nowhere to store all of the NAT */ 8531 /* sessions currently active) and then walk through the entire list and */ 8532 /* insert them into the table. There are two tables here: an inbound one */ 8533 /* and an outbound one. Each NAT entry goes into each table once. */ 8534 /* ------------------------------------------------------------------------ */ 8535 int 8536 ipf_nat_rehash(ipf_main_softc_t *softc, ipftuneable_t *t, ipftuneval_t *p) 8537 { 8538 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 8539 nat_t **newtab[2], *nat, **natp; 8540 u_int *bucketlens[2]; 8541 u_int maxbucket; 8542 u_int newsize; 8543 u_int hv; 8544 int i; 8545 8546 newsize = p->ipftu_int; 8547 /* 8548 * In case there is nothing to do... 8549 */ 8550 if (newsize == softn->ipf_nat_table_sz) 8551 return 0; 8552 8553 /* 8554 * 4 tables depend on the NAT table size: the inbound looking table, 8555 * the outbound lookup table and the hash chain length for each. 8556 */ 8557 KMALLOCS(newtab[0], nat_t **, newsize * sizeof(nat_t *)); 8558 if (newtab == NULL) { 8559 IPFERROR(60063); 8560 return ENOMEM; 8561 } 8562 8563 KMALLOCS(newtab[1], nat_t **, newsize * sizeof(nat_t *)); 8564 if (newtab == NULL) { 8565 KFREES(newtab[0], newsize * sizeof(nat_t *)); 8566 IPFERROR(60064); 8567 return ENOMEM; 8568 } 8569 8570 KMALLOCS(bucketlens[0], u_int *, newsize * sizeof(u_int)); 8571 if (bucketlens[0] == NULL) { 8572 KFREES(newtab[0], newsize * sizeof(nat_t *)); 8573 KFREES(newtab[1], newsize * sizeof(nat_t *)); 8574 IPFERROR(60065); 8575 return ENOMEM; 8576 } 8577 8578 KMALLOCS(bucketlens[1], u_int *, newsize * sizeof(u_int)); 8579 if (bucketlens[1] == NULL) { 8580 KFREES(bucketlens[0], newsize * sizeof(u_int)); 8581 KFREES(newtab[0], newsize * sizeof(nat_t *)); 8582 KFREES(newtab[1], newsize * sizeof(nat_t *)); 8583 IPFERROR(60066); 8584 return ENOMEM; 8585 } 8586 8587 /* 8588 * Recalculate the maximum length based on the new size. 8589 */ 8590 for (maxbucket = 0, i = newsize; i > 0; i >>= 1) 8591 maxbucket++; 8592 maxbucket *= 2; 8593 8594 bzero((char *)newtab[0], newsize * sizeof(nat_t *)); 8595 bzero((char *)newtab[1], newsize * sizeof(nat_t *)); 8596 bzero((char *)bucketlens[0], newsize * sizeof(u_int)); 8597 bzero((char *)bucketlens[1], newsize * sizeof(u_int)); 8598 8599 WRITE_ENTER(&softc->ipf_nat); 8600 8601 if (softn->ipf_nat_table[0] != NULL) { 8602 KFREES(softn->ipf_nat_table[0], 8603 softn->ipf_nat_table_sz * 8604 sizeof(*softn->ipf_nat_table[0])); 8605 } 8606 softn->ipf_nat_table[0] = newtab[0]; 8607 8608 if (softn->ipf_nat_table[1] != NULL) { 8609 KFREES(softn->ipf_nat_table[1], 8610 softn->ipf_nat_table_sz * 8611 sizeof(*softn->ipf_nat_table[1])); 8612 } 8613 softn->ipf_nat_table[1] = newtab[1]; 8614 8615 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen != NULL) { 8616 KFREES(softn->ipf_nat_stats.ns_side[0].ns_bucketlen, 8617 softn->ipf_nat_table_sz * sizeof(u_int)); 8618 } 8619 softn->ipf_nat_stats.ns_side[0].ns_bucketlen = bucketlens[0]; 8620 8621 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen != NULL) { 8622 KFREES(softn->ipf_nat_stats.ns_side[1].ns_bucketlen, 8623 softn->ipf_nat_table_sz * sizeof(u_int)); 8624 } 8625 softn->ipf_nat_stats.ns_side[1].ns_bucketlen = bucketlens[1]; 8626 8627 softn->ipf_nat_maxbucket = maxbucket; 8628 softn->ipf_nat_table_sz = newsize; 8629 /* 8630 * Walk through the entire list of NAT table entries and put them 8631 * in the new NAT table, somewhere. Because we have a new table, 8632 * we need to restart the counter of how many chains are in use. 8633 */ 8634 softn->ipf_nat_stats.ns_side[0].ns_inuse = 0; 8635 softn->ipf_nat_stats.ns_side[1].ns_inuse = 0; 8636 8637 for (nat = softn->ipf_nat_instances; nat != NULL; nat = nat->nat_next) { 8638 nat->nat_hnext[0] = NULL; 8639 nat->nat_phnext[0] = NULL; 8640 hv = nat->nat_hv[0] % softn->ipf_nat_table_sz; 8641 8642 natp = &softn->ipf_nat_table[0][hv]; 8643 if (*natp) { 8644 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 8645 } else { 8646 NBUMPSIDE(0, ns_inuse); 8647 } 8648 nat->nat_phnext[0] = natp; 8649 nat->nat_hnext[0] = *natp; 8650 *natp = nat; 8651 NBUMPSIDE(0, ns_bucketlen[hv]); 8652 8653 nat->nat_hnext[1] = NULL; 8654 nat->nat_phnext[1] = NULL; 8655 hv = nat->nat_hv[1] % softn->ipf_nat_table_sz; 8656 8657 natp = &softn->ipf_nat_table[1][hv]; 8658 if (*natp) { 8659 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 8660 } else { 8661 NBUMPSIDE(1, ns_inuse); 8662 } 8663 nat->nat_phnext[1] = natp; 8664 nat->nat_hnext[1] = *natp; 8665 *natp = nat; 8666 NBUMPSIDE(1, ns_bucketlen[hv]); 8667 } 8668 RWLOCK_EXIT(&softc->ipf_nat); 8669 8670 return 0; 8671 } 8672 8673 8674 /* ------------------------------------------------------------------------ */ 8675 /* Function: ipf_nat_rehash_rules */ 8676 /* Returns: int - 0 = success, else failure */ 8677 /* Parameters: t(I) - pointer to tunable */ 8678 /* p(I) - pointer to new tuning data */ 8679 /* */ 8680 /* All of the NAT rules hang off of a hash table that is searched with a */ 8681 /* hash on address after the netmask is applied. There is a different table*/ 8682 /* for both inbound rules (rdr) and outbound (map.) The resizing will only */ 8683 /* affect one of these two tables. */ 8684 /* ------------------------------------------------------------------------ */ 8685 int 8686 ipf_nat_rehash_rules(ipf_main_softc_t *softc, ipftuneable_t *t, ipftuneval_t *p) 8687 { 8688 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 8689 ipnat_t **newtab, *np, ***old, **npp; 8690 u_int newsize; 8691 u_int mask; 8692 u_int hv; 8693 8694 newsize = p->ipftu_int; 8695 /* 8696 * In case there is nothing to do... 8697 */ 8698 if (newsize == *t->ipft_pint) 8699 return 0; 8700 8701 /* 8702 * All inbound rules have the NAT_REDIRECT bit set in in_redir and 8703 * all outbound rules have either NAT_MAP or MAT_MAPBLK set. 8704 * This if statement allows for some more generic code to be below, 8705 * rather than two huge gobs of code that almost do the same thing. 8706 */ 8707 if (t->ipft_pint == &softn->ipf_nat_rdrrules_sz) { 8708 old = &softn->ipf_nat_rdr_rules; 8709 mask = NAT_REDIRECT; 8710 } else { 8711 old = &softn->ipf_nat_map_rules; 8712 mask = NAT_MAP|NAT_MAPBLK; 8713 } 8714 8715 KMALLOCS(newtab, ipnat_t **, newsize * sizeof(ipnat_t *)); 8716 if (newtab == NULL) { 8717 IPFERROR(60067); 8718 return ENOMEM; 8719 } 8720 8721 bzero((char *)newtab, newsize * sizeof(ipnat_t *)); 8722 8723 WRITE_ENTER(&softc->ipf_nat); 8724 8725 if (*old != NULL) { 8726 KFREES(*old, *t->ipft_pint * sizeof(ipnat_t **)); 8727 } 8728 *old = newtab; 8729 *t->ipft_pint = newsize; 8730 8731 for (np = softn->ipf_nat_list; np != NULL; np = np->in_next) { 8732 if ((np->in_redir & mask) == 0) 8733 continue; 8734 8735 if ((np->in_redir & NAT_ENCAP) == 0) { 8736 if (np->in_redir & NAT_REDIRECT) { 8737 np->in_rnext = NULL; 8738 hv = np->in_hv[0] % newsize; 8739 for (npp = newtab + hv; *npp != NULL; ) 8740 npp = &(*npp)->in_rnext; 8741 np->in_prnext = npp; 8742 *npp = np; 8743 } 8744 if (np->in_redir & NAT_MAP) { 8745 np->in_mnext = NULL; 8746 hv = np->in_hv[1] % newsize; 8747 for (npp = newtab + hv; *npp != NULL; ) 8748 npp = &(*npp)->in_mnext; 8749 np->in_pmnext = npp; 8750 *npp = np; 8751 } 8752 } else { 8753 if (np->in_redir & NAT_MAP) { 8754 np->in_rnext = NULL; 8755 hv = np->in_hv[0] % newsize; 8756 for (npp = newtab + hv; *npp != NULL; ) 8757 npp = &(*npp)->in_rnext; 8758 np->in_prnext = npp; 8759 *npp = np; 8760 } 8761 if (np->in_redir & NAT_REDIRECT) { 8762 np->in_mnext = NULL; 8763 hv = np->in_hv[1] % newsize; 8764 for (npp = newtab + hv; *npp != NULL; ) 8765 npp = &(*npp)->in_mnext; 8766 np->in_pmnext = npp; 8767 *npp = np; 8768 } 8769 } 8770 8771 } 8772 RWLOCK_EXIT(&softc->ipf_nat); 8773 8774 return 0; 8775 } 8776 8777 8778 /* ------------------------------------------------------------------------ */ 8779 /* Function: ipf_nat_hostmap_rehash */ 8780 /* Returns: int - 0 = success, else failure */ 8781 /* Parameters: t(I) - pointer to tunable */ 8782 /* p(I) - pointer to new tuning data */ 8783 /* */ 8784 /* Allocate and populate a new hash table that will contain a reference to */ 8785 /* all of the active IP# translations currently in place. */ 8786 /* ------------------------------------------------------------------------ */ 8787 int 8788 ipf_nat_hostmap_rehash(ipf_main_softc_t *softc, ipftuneable_t *t, 8789 ipftuneval_t *p) 8790 { 8791 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 8792 hostmap_t *hm, **newtab; 8793 u_int newsize; 8794 u_int hv; 8795 8796 newsize = p->ipftu_int; 8797 /* 8798 * In case there is nothing to do... 8799 */ 8800 if (newsize == *t->ipft_pint) 8801 return 0; 8802 8803 KMALLOCS(newtab, hostmap_t **, newsize * sizeof(hostmap_t *)); 8804 if (newtab == NULL) { 8805 IPFERROR(60068); 8806 return ENOMEM; 8807 } 8808 8809 bzero((char *)newtab, newsize * sizeof(hostmap_t *)); 8810 8811 WRITE_ENTER(&softc->ipf_nat); 8812 if (softn->ipf_hm_maptable != NULL) { 8813 KFREES(softn->ipf_hm_maptable, 8814 softn->ipf_nat_hostmap_sz * sizeof(hostmap_t *)); 8815 } 8816 softn->ipf_hm_maptable = newtab; 8817 softn->ipf_nat_hostmap_sz = newsize; 8818 8819 for (hm = softn->ipf_hm_maplist; hm != NULL; hm = hm->hm_next) { 8820 hv = hm->hm_hv % softn->ipf_nat_hostmap_sz; 8821 hm->hm_hnext = softn->ipf_hm_maptable[hv]; 8822 hm->hm_phnext = softn->ipf_hm_maptable + hv; 8823 if (softn->ipf_hm_maptable[hv] != NULL) 8824 softn->ipf_hm_maptable[hv]->hm_phnext = &hm->hm_hnext; 8825 softn->ipf_hm_maptable[hv] = hm; 8826 } 8827 RWLOCK_EXIT(&softc->ipf_nat); 8828 8829 return 0; 8830 } 8831 8832 8833 /* ------------------------------------------------------------------------ */ 8834 /* Function: ipf_nat_add_tq */ 8835 /* Parameters: softc(I) - pointer to soft context main structure */ 8836 /* */ 8837 /* ------------------------------------------------------------------------ */ 8838 ipftq_t * 8839 ipf_nat_add_tq(ipf_main_softc_t *softc, int ttl) 8840 { 8841 ipf_nat_softc_t *softs = softc->ipf_nat_soft; 8842 8843 return ipf_addtimeoutqueue(softc, &softs->ipf_nat_utqe, ttl); 8844 } 8845 8846 /* ------------------------------------------------------------------------ */ 8847 /* Function: nat_uncreate */ 8848 /* Returns: Nil */ 8849 /* Parameters: fin(I) - pointer to packet information */ 8850 /* */ 8851 /* This function is used to remove a NAT entry from the NAT table when we */ 8852 /* decide that the create was actually in error. It is thus assumed that */ 8853 /* fin_flx will have both FI_NATED and FI_NATNEW set. Because we're dealing */ 8854 /* with the translated packet (not the original), we have to reverse the */ 8855 /* lookup. Although doing the lookup is expensive (relatively speaking), it */ 8856 /* is not anticipated that this will be a frequent occurance for normal */ 8857 /* traffic patterns. */ 8858 /* ------------------------------------------------------------------------ */ 8859 void 8860 ipf_nat_uncreate(fr_info_t *fin) 8861 { 8862 ipf_main_softc_t *softc = fin->fin_main_soft; 8863 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 8864 int nflags; 8865 nat_t *nat; 8866 8867 switch (fin->fin_p) 8868 { 8869 case IPPROTO_TCP : 8870 nflags = IPN_TCP; 8871 break; 8872 case IPPROTO_UDP : 8873 nflags = IPN_UDP; 8874 break; 8875 default : 8876 nflags = 0; 8877 break; 8878 } 8879 8880 WRITE_ENTER(&softc->ipf_nat); 8881 8882 if (fin->fin_out == 0) { 8883 nat = ipf_nat_outlookup(fin, nflags, (u_int)fin->fin_p, 8884 fin->fin_dst, fin->fin_src); 8885 } else { 8886 nat = ipf_nat_inlookup(fin, nflags, (u_int)fin->fin_p, 8887 fin->fin_src, fin->fin_dst); 8888 } 8889 8890 if (nat != NULL) { 8891 NBUMPSIDE(fin->fin_out, ns_uncreate[0]); 8892 ipf_nat_delete(softc, nat, NL_DESTROY); 8893 } else { 8894 NBUMPSIDE(fin->fin_out, ns_uncreate[1]); 8895 } 8896 8897 RWLOCK_EXIT(&softc->ipf_nat); 8898 } 8899 8900 8901 /* ------------------------------------------------------------------------ */ 8902 /* Function: ipf_nat_cmp_rules */ 8903 /* Returns: int - 0 == success, else rules do not match. */ 8904 /* Parameters: n1(I) - first rule to compare */ 8905 /* n2(I) - first rule to compare */ 8906 /* */ 8907 /* Compare two rules using pointers to each rule. A straight bcmp will not */ 8908 /* work as some fields (such as in_dst, in_pkts) actually do change once */ 8909 /* the rule has been loaded into the kernel. Whilst this function returns */ 8910 /* various non-zero returns, they're strictly to aid in debugging. Use of */ 8911 /* this function should simply care if the result is zero or not. */ 8912 /* ------------------------------------------------------------------------ */ 8913 static int 8914 ipf_nat_cmp_rules(ipnat_t *n1, ipnat_t *n2) 8915 { 8916 if (n1->in_size != n2->in_size) 8917 return 1; 8918 8919 if (bcmp((char *)&n1->in_v, (char *)&n2->in_v, 8920 offsetof(ipnat_t, in_ndst) - offsetof(ipnat_t, in_v)) != 0) 8921 return 2; 8922 8923 if (bcmp((char *)&n1->in_tuc, (char *)&n2->in_tuc, 8924 offsetof(ipnat_t, in_pkts) - offsetof(ipnat_t, in_tuc)) != 0) 8925 return 3; 8926 if (bcmp((char *)&n1->in_namelen, (char *)&n2->in_namelen, 8927 n1->in_size - offsetof(ipnat_t, in_namelen)) != 0) 8928 return 4; 8929 if (n1->in_ndst.na_atype != n2->in_ndst.na_atype) 8930 return 5; 8931 if (n1->in_ndst.na_function != n2->in_ndst.na_function) 8932 return 6; 8933 if (bcmp((char *)&n1->in_ndst.na_addr, (char *)&n2->in_ndst.na_addr, 8934 sizeof(n1->in_ndst.na_addr))) 8935 return 7; 8936 if (n1->in_nsrc.na_atype != n2->in_nsrc.na_atype) 8937 return 8; 8938 if (n1->in_nsrc.na_function != n2->in_nsrc.na_function) 8939 return 9; 8940 if (bcmp((char *)&n1->in_nsrc.na_addr, (char *)&n2->in_nsrc.na_addr, 8941 sizeof(n1->in_nsrc.na_addr))) 8942 return 10; 8943 if (n1->in_odst.na_atype != n2->in_odst.na_atype) 8944 return 11; 8945 if (n1->in_odst.na_function != n2->in_odst.na_function) 8946 return 12; 8947 if (bcmp((char *)&n1->in_odst.na_addr, (char *)&n2->in_odst.na_addr, 8948 sizeof(n1->in_odst.na_addr))) 8949 return 13; 8950 if (n1->in_osrc.na_atype != n2->in_osrc.na_atype) 8951 return 14; 8952 if (n1->in_osrc.na_function != n2->in_osrc.na_function) 8953 return 15; 8954 if (bcmp((char *)&n1->in_osrc.na_addr, (char *)&n2->in_osrc.na_addr, 8955 sizeof(n1->in_osrc.na_addr))) 8956 return 16; 8957 return 0; 8958 } 8959
Indexes created Sun Sep 28 16:09:52 GMT 2025