ip_nat6.c revision 1.8
1 /* $NetBSD: ip_nat6.c,v 1.8 2015/08/07 17:31:12 prlw1 Exp $ */ 2 3 /* 4 * Copyright (C) 2012 by Darren Reed. 5 * 6 * See the IPFILTER.LICENCE file for details on licencing. 7 */ 8 #if defined(KERNEL) || defined(_KERNEL) 9 # undef KERNEL 10 # undef ipf_nat6_KERNEL 11 # define KERNEL 1 12 # define ipf_nat6_KERNEL 1 13 #endif 14 #include <sys/errno.h> 15 #include <sys/types.h> 16 #include <sys/param.h> 17 #include <sys/time.h> 18 #include <sys/file.h> 19 #if defined(_KERNEL) && defined(__NetBSD_Version__) && \ 20 (__NetBSD_Version__ >= 399002000) 21 # include <sys/kauth.h> 22 #endif 23 #if !defined(_KERNEL) 24 # include <stdio.h> 25 # include <string.h> 26 # include <stdlib.h> 27 # define ipf_nat6_KERNEL 28 # ifdef ipf_nat6__OpenBSD__ 29 struct file; 30 # endif 31 # include <sys/uio.h> 32 # undef ipf_nat6_KERNEL 33 #endif 34 #if defined(_KERNEL) && (__FreeBSD_version >= 220000) 35 # include <sys/filio.h> 36 # include <sys/fcntl.h> 37 #else 38 # include <sys/ioctl.h> 39 #endif 40 #if !defined(AIX) 41 # include <sys/fcntl.h> 42 #endif 43 #if !defined(linux) 44 # include <sys/protosw.h> 45 #endif 46 #include <sys/socket.h> 47 #if defined(_KERNEL) 48 # include <sys/systm.h> 49 # if !defined(__SVR4) && !defined(__svr4__) 50 # include <sys/mbuf.h> 51 # endif 52 #endif 53 #if defined(__SVR4) || defined(__svr4__) 54 # include <sys/filio.h> 55 # include <sys/byteorder.h> 56 # ifdef ipf_nat6_KERNEL 57 # include <sys/dditypes.h> 58 # endif 59 # include <sys/stream.h> 60 # include <sys/kmem.h> 61 #endif 62 #if ipf_nat6__FreeBSD_version >= 300000 63 # include <sys/queue.h> 64 #endif 65 #include <net/if.h> 66 #if ipf_nat6__FreeBSD_version >= 300000 67 # include <net/if_var.h> 68 #endif 69 #ifdef sun 70 # include <net/af.h> 71 #endif 72 #include <net/route.h> 73 #include <netinet/in.h> 74 #include <netinet/in_systm.h> 75 #include <netinet/ip.h> 76 77 #ifdef RFC1825 78 # include <vpn/md5.h> 79 # include <vpn/ipsec.h> 80 extern struct ifnet vpnif; 81 #endif 82 83 #if !defined(linux) 84 # include <netinet/ip_var.h> 85 #endif 86 #include <netinet/tcp.h> 87 #include <netinet/udp.h> 88 #include <netinet/ip_icmp.h> 89 #include "netinet/ip_compat.h" 90 #include <netinet/tcpip.h> 91 #include "netinet/ip_fil.h" 92 #include "netinet/ip_nat.h" 93 #include "netinet/ip_frag.h" 94 #include "netinet/ip_state.h" 95 #include "netinet/ip_proxy.h" 96 #include "netinet/ip_lookup.h" 97 #include "netinet/ip_dstlist.h" 98 #include "netinet/ip_sync.h" 99 #if (__FreeBSD_version >= 300000) 100 # include <sys/malloc.h> 101 #endif 102 #ifdef HAS_SYS_MD5_H 103 # include <sys/md5.h> 104 #else 105 # include "md5.h" 106 #endif 107 /* END OF INCLUDES */ 108 109 #undef SOCKADDR_IN 110 #define SOCKADDR_IN struct sockaddr_in 111 112 __KERNEL_RCSID(0, "Id: ip_nat6.c,v 1.1.1.2 2012/07/22 13:45:29 darrenr Exp"); 113 114 #ifdef USE_INET6 115 static struct hostmap *ipf_nat6_hostmap(ipf_nat_softc_t *, ipnat_t *, 116 i6addr_t *, i6addr_t *, 117 i6addr_t *, u_32_t); 118 static int ipf_nat6_match(fr_info_t *, ipnat_t *); 119 static void ipf_nat6_tabmove(ipf_nat_softc_t *, nat_t *); 120 static int ipf_nat6_decap(fr_info_t *, nat_t *); 121 static int ipf_nat6_nextaddr(fr_info_t *, nat_addr_t *, i6addr_t *, 122 i6addr_t *); 123 static int ipf_nat6_icmpquerytype(int); 124 static int ipf_nat6_out(fr_info_t *, nat_t *, int, u_32_t); 125 static int ipf_nat6_in(fr_info_t *, nat_t *, int, u_32_t); 126 static int ipf_nat6_builddivertmp(ipf_nat_softc_t *, ipnat_t *); 127 static int ipf_nat6_nextaddrinit(ipf_main_softc_t *, char *, 128 nat_addr_t *, int, void *); 129 static int ipf_nat6_insert(ipf_main_softc_t *, ipf_nat_softc_t *, 130 nat_t *); 131 132 133 #define NINCLSIDE6(y,x) ATOMIC_INCL(softn->ipf_nat_stats.ns_side6[y].x) 134 #define NBUMPSIDE(y,x) softn->ipf_nat_stats.ns_side[y].x++ 135 #define NBUMPSIDE6(y,x) softn->ipf_nat_stats.ns_side6[y].x++ 136 #define NBUMPSIDE6D(y,x) \ 137 do { \ 138 softn->ipf_nat_stats.ns_side6[y].x++; \ 139 DT(x); \ 140 } while (0) 141 #define NBUMPSIDE6DX(y,x,z) \ 142 do { \ 143 softn->ipf_nat_stats.ns_side6[y].x++; \ 144 DT(z); \ 145 } while (0) 146 147 148 /* ------------------------------------------------------------------------ */ 149 /* Function: ipf_nat6_ruleaddrinit */ 150 /* Returns: int - 0 == success, else failure */ 151 /* Parameters: in(I) - NAT rule that requires address fields to be init'd */ 152 /* */ 153 /* For each of the source/destination address fields in a NAT rule, call */ 154 /* ipf_nat6_nextaddrinit() to prepare the structure for active duty. Other */ 155 /* IPv6 specific actions can also be taken care of here. */ 156 /* ------------------------------------------------------------------------ */ 157 int 158 ipf_nat6_ruleaddrinit(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, 159 ipnat_t *n) 160 { 161 int idx, error; 162 163 if (n->in_redir == NAT_BIMAP) { 164 n->in_ndstip6 = n->in_osrcip6; 165 n->in_ndstmsk6 = n->in_osrcmsk6; 166 n->in_odstip6 = n->in_nsrcip6; 167 n->in_odstmsk6 = n->in_nsrcmsk6; 168 169 } 170 171 if (n->in_redir & NAT_REDIRECT) 172 idx = 1; 173 else 174 idx = 0; 175 /* 176 * Initialise all of the address fields. 177 */ 178 error = ipf_nat6_nextaddrinit(softc, n->in_names, &n->in_osrc, 1, 179 n->in_ifps[idx]); 180 if (error != 0) 181 return error; 182 183 error = ipf_nat6_nextaddrinit(softc, n->in_names, &n->in_odst, 1, 184 n->in_ifps[idx]); 185 if (error != 0) 186 return error; 187 188 error = ipf_nat6_nextaddrinit(softc, n->in_names, &n->in_nsrc, 1, 189 n->in_ifps[idx]); 190 if (error != 0) 191 return error; 192 193 error = ipf_nat6_nextaddrinit(softc, n->in_names, &n->in_ndst, 1, 194 n->in_ifps[idx]); 195 if (error != 0) 196 return error; 197 198 if (n->in_redir & NAT_DIVERTUDP) 199 ipf_nat6_builddivertmp(softn, n); 200 return 0; 201 } 202 203 204 /* ------------------------------------------------------------------------ */ 205 /* Function: ipf_nat6_addrdr */ 206 /* Returns: Nil */ 207 /* Parameters: n(I) - pointer to NAT rule to add */ 208 /* */ 209 /* Adds a redirect rule to the hash table of redirect rules and the list of */ 210 /* loaded NAT rules. Updates the bitmask indicating which netmasks are in */ 211 /* use by redirect rules. */ 212 /* ------------------------------------------------------------------------ */ 213 void 214 ipf_nat6_addrdr(ipf_nat_softc_t *softn, ipnat_t *n) 215 { 216 i6addr_t *mask; 217 ipnat_t **np; 218 i6addr_t j; 219 u_int hv; 220 int k; 221 222 if ((n->in_redir & NAT_BIMAP) == NAT_BIMAP) { 223 k = count6bits(n->in_nsrcmsk6.i6); 224 mask = &n->in_nsrcmsk6; 225 IP6_AND(&n->in_odstip6, &n->in_odstmsk6, &j); 226 hv = NAT_HASH_FN6(&j, 0, softn->ipf_nat_rdrrules_sz); 227 228 } else if (n->in_odstatype == FRI_NORMAL) { 229 k = count6bits(n->in_odstmsk6.i6); 230 mask = &n->in_odstmsk6; 231 IP6_AND(&n->in_odstip6, &n->in_odstmsk6, &j); 232 hv = NAT_HASH_FN6(&j, 0, softn->ipf_nat_rdrrules_sz); 233 } else { 234 k = 0; 235 hv = 0; 236 mask = NULL; 237 } 238 ipf_inet6_mask_add(k, mask, &softn->ipf_nat6_rdr_mask); 239 240 np = softn->ipf_nat_rdr_rules + hv; 241 while (*np != NULL) 242 np = &(*np)->in_rnext; 243 n->in_rnext = NULL; 244 n->in_prnext = np; 245 n->in_hv[0] = hv; 246 n->in_use++; 247 *np = n; 248 } 249 250 251 /* ------------------------------------------------------------------------ */ 252 /* Function: ipf_nat6_addmap */ 253 /* Returns: Nil */ 254 /* Parameters: n(I) - pointer to NAT rule to add */ 255 /* */ 256 /* Adds a NAT map rule to the hash table of rules and the list of loaded */ 257 /* NAT rules. Updates the bitmask indicating which netmasks are in use by */ 258 /* redirect rules. */ 259 /* ------------------------------------------------------------------------ */ 260 void 261 ipf_nat6_addmap(ipf_nat_softc_t *softn, ipnat_t *n) 262 { 263 i6addr_t *mask; 264 ipnat_t **np; 265 i6addr_t j; 266 u_int hv; 267 int k; 268 269 if (n->in_osrcatype == FRI_NORMAL) { 270 k = count6bits(n->in_osrcmsk6.i6); 271 mask = &n->in_osrcmsk6; 272 IP6_AND(&n->in_osrcip6, &n->in_osrcmsk6, &j); 273 hv = NAT_HASH_FN6(&j, 0, softn->ipf_nat_maprules_sz); 274 } else { 275 k = 0; 276 hv = 0; 277 mask = NULL; 278 } 279 ipf_inet6_mask_add(k, mask, &softn->ipf_nat6_map_mask); 280 281 np = softn->ipf_nat_map_rules + hv; 282 while (*np != NULL) 283 np = &(*np)->in_mnext; 284 n->in_mnext = NULL; 285 n->in_pmnext = np; 286 n->in_hv[1] = hv; 287 n->in_use++; 288 *np = n; 289 } 290 291 292 /* ------------------------------------------------------------------------ */ 293 /* Function: ipf_nat6_del_rdr */ 294 /* Returns: Nil */ 295 /* Parameters: n(I) - pointer to NAT rule to delete */ 296 /* */ 297 /* Removes a NAT rdr rule from the hash table of NAT rdr rules. */ 298 /* ------------------------------------------------------------------------ */ 299 void 300 ipf_nat6_delrdr(ipf_nat_softc_t *softn, ipnat_t *n) 301 { 302 i6addr_t *mask; 303 int k; 304 305 if ((n->in_redir & NAT_BIMAP) == NAT_BIMAP) { 306 k = count6bits(n->in_nsrcmsk6.i6); 307 mask = &n->in_nsrcmsk6; 308 } else if (n->in_odstatype == FRI_NORMAL) { 309 k = count6bits(n->in_odstmsk6.i6); 310 mask = &n->in_odstmsk6; 311 } else { 312 k = 0; 313 mask = NULL; 314 } 315 ipf_inet6_mask_del(k, mask, &softn->ipf_nat6_rdr_mask); 316 317 if (n->in_rnext != NULL) 318 n->in_rnext->in_prnext = n->in_prnext; 319 *n->in_prnext = n->in_rnext; 320 n->in_use--; 321 } 322 323 324 /* ------------------------------------------------------------------------ */ 325 /* Function: ipf_nat6_delmap */ 326 /* Returns: Nil */ 327 /* Parameters: n(I) - pointer to NAT rule to delete */ 328 /* */ 329 /* Removes a NAT map rule from the hash table of NAT map rules. */ 330 /* ------------------------------------------------------------------------ */ 331 void 332 ipf_nat6_delmap(ipf_nat_softc_t *softn, ipnat_t *n) 333 { 334 i6addr_t *mask; 335 int k; 336 337 if (n->in_osrcatype == FRI_NORMAL) { 338 k = count6bits(n->in_osrcmsk6.i6); 339 mask = &n->in_osrcmsk6; 340 } else { 341 k = 0; 342 mask = NULL; 343 } 344 ipf_inet6_mask_del(k, mask, &softn->ipf_nat6_map_mask); 345 346 if (n->in_mnext != NULL) 347 n->in_mnext->in_pmnext = n->in_pmnext; 348 *n->in_pmnext = n->in_mnext; 349 n->in_use--; 350 } 351 352 353 /* ------------------------------------------------------------------------ */ 354 /* Function: ipf_nat6_hostmap */ 355 /* Returns: struct hostmap* - NULL if no hostmap could be created, */ 356 /* else a pointer to the hostmapping to use */ 357 /* Parameters: np(I) - pointer to NAT rule */ 358 /* real(I) - real IP address */ 359 /* map(I) - mapped IP address */ 360 /* port(I) - destination port number */ 361 /* Write Locks: ipf_nat */ 362 /* */ 363 /* Check if an ip address has already been allocated for a given mapping */ 364 /* that is not doing port based translation. If is not yet allocated, then */ 365 /* create a new entry if a non-NULL NAT rule pointer has been supplied. */ 366 /* ------------------------------------------------------------------------ */ 367 static struct hostmap * 368 ipf_nat6_hostmap(ipf_nat_softc_t *softn, ipnat_t *np, i6addr_t *src, 369 i6addr_t *dst, i6addr_t *map, u_32_t port) 370 { 371 hostmap_t *hm; 372 u_int hv; 373 374 hv = (src->i6[3] ^ dst->i6[3]); 375 hv += (src->i6[2] ^ dst->i6[2]); 376 hv += (src->i6[1] ^ dst->i6[1]); 377 hv += (src->i6[0] ^ dst->i6[0]); 378 hv += src->i6[3]; 379 hv += src->i6[2]; 380 hv += src->i6[1]; 381 hv += src->i6[0]; 382 hv += dst->i6[3]; 383 hv += dst->i6[2]; 384 hv += dst->i6[1]; 385 hv += dst->i6[0]; 386 hv %= HOSTMAP_SIZE; 387 for (hm = softn->ipf_hm_maptable[hv]; hm; hm = hm->hm_next) 388 if (IP6_EQ(&hm->hm_osrc6, src) && 389 IP6_EQ(&hm->hm_odst6, dst) && 390 ((np == NULL) || (np == hm->hm_ipnat)) && 391 ((port == 0) || (port == hm->hm_port))) { 392 softn->ipf_nat_stats.ns_hm_addref++; 393 hm->hm_ref++; 394 return hm; 395 } 396 397 if (np == NULL) { 398 softn->ipf_nat_stats.ns_hm_nullnp++; 399 return NULL; 400 } 401 402 KMALLOC(hm, hostmap_t *); 403 if (hm) { 404 hm->hm_next = softn->ipf_hm_maplist; 405 hm->hm_pnext = &softn->ipf_hm_maplist; 406 if (softn->ipf_hm_maplist != NULL) 407 softn->ipf_hm_maplist->hm_pnext = &hm->hm_next; 408 softn->ipf_hm_maplist = hm; 409 hm->hm_hnext = softn->ipf_hm_maptable[hv]; 410 hm->hm_phnext = softn->ipf_hm_maptable + hv; 411 if (softn->ipf_hm_maptable[hv] != NULL) 412 softn->ipf_hm_maptable[hv]->hm_phnext = &hm->hm_hnext; 413 softn->ipf_hm_maptable[hv] = hm; 414 hm->hm_ipnat = np; 415 np->in_use++; 416 hm->hm_osrcip6 = *src; 417 hm->hm_odstip6 = *dst; 418 hm->hm_nsrcip6 = *map; 419 hm->hm_ndstip6.i6[0] = 0; 420 hm->hm_ndstip6.i6[1] = 0; 421 hm->hm_ndstip6.i6[2] = 0; 422 hm->hm_ndstip6.i6[3] = 0; 423 hm->hm_ref = 1; 424 hm->hm_port = port; 425 hm->hm_hv = hv; 426 hm->hm_v = 6; 427 softn->ipf_nat_stats.ns_hm_new++; 428 } else { 429 softn->ipf_nat_stats.ns_hm_newfail++; 430 } 431 return hm; 432 } 433 434 435 /* ------------------------------------------------------------------------ */ 436 /* Function: ipf_nat6_newmap */ 437 /* Returns: int - -1 == error, 0 == success */ 438 /* Parameters: fin(I) - pointer to packet information */ 439 /* nat(I) - pointer to NAT entry */ 440 /* ni(I) - pointer to structure with misc. information needed */ 441 /* to create new NAT entry. */ 442 /* */ 443 /* Given an empty NAT structure, populate it with new information about a */ 444 /* new NAT session, as defined by the matching NAT rule. */ 445 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/ 446 /* to the new IP address for the translation. */ 447 /* ------------------------------------------------------------------------ */ 448 int 449 ipf_nat6_newmap(fr_info_t *fin, nat_t *nat, natinfo_t *ni) 450 { 451 ipf_main_softc_t *softc = fin->fin_main_soft; 452 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 453 u_short st_port, dport, sport, port, sp, dp; 454 i6addr_t in, st_ip; 455 hostmap_t *hm; 456 u_32_t flags; 457 ipnat_t *np; 458 nat_t *natl; 459 int l; 460 461 /* 462 * If it's an outbound packet which doesn't match any existing 463 * record, then create a new port 464 */ 465 l = 0; 466 hm = NULL; 467 np = ni->nai_np; 468 st_ip = np->in_snip6; 469 st_port = np->in_spnext; 470 flags = nat->nat_flags; 471 472 if (flags & IPN_ICMPQUERY) { 473 sport = fin->fin_data[1]; 474 dport = 0; 475 } else { 476 sport = htons(fin->fin_data[0]); 477 dport = htons(fin->fin_data[1]); 478 } 479 480 /* 481 * Do a loop until we either run out of entries to try or we find 482 * a NAT mapping that isn't currently being used. This is done 483 * because the change to the source is not (usually) being fixed. 484 */ 485 do { 486 port = 0; 487 in = np->in_nsrc.na_nextaddr; 488 if (l == 0) { 489 /* 490 * Check to see if there is an existing NAT 491 * setup for this IP address pair. 492 */ 493 hm = ipf_nat6_hostmap(softn, np, &fin->fin_src6, 494 &fin->fin_dst6, &in, 0); 495 if (hm != NULL) 496 in = hm->hm_nsrcip6; 497 } else if ((l == 1) && (hm != NULL)) { 498 ipf_nat_hostmapdel(softc, &hm); 499 } 500 501 nat->nat_hm = hm; 502 503 if (IP6_ISONES(&np->in_nsrcmsk6) && (np->in_spnext == 0)) { 504 if (l > 0) { 505 NBUMPSIDE6DX(1, ns_exhausted, ns_exhausted_1); 506 return -1; 507 } 508 } 509 510 if ((np->in_redir == NAT_BIMAP) && 511 IP6_EQ(&np->in_osrcmsk6, &np->in_nsrcmsk6)) { 512 i6addr_t temp; 513 /* 514 * map the address block in a 1:1 fashion 515 */ 516 temp.i6[0] = fin->fin_src6.i6[0] & 517 ~np->in_osrcmsk6.i6[0]; 518 temp.i6[1] = fin->fin_src6.i6[1] & 519 ~np->in_osrcmsk6.i6[1]; 520 temp.i6[2] = fin->fin_src6.i6[2] & 521 ~np->in_osrcmsk6.i6[0]; 522 temp.i6[3] = fin->fin_src6.i6[3] & 523 ~np->in_osrcmsk6.i6[3]; 524 in = np->in_nsrcip6; 525 IP6_MERGE(&in, &temp, &np->in_osrc); 526 527 #ifdef NEED_128BIT_MATH 528 } else if (np->in_redir & NAT_MAPBLK) { 529 if ((l >= np->in_ppip) || ((l > 0) && 530 !(flags & IPN_TCPUDP))) { 531 NBUMPSIDE6DX(1, ns_exhausted, ns_exhausted_2); 532 return -1; 533 } 534 /* 535 * map-block - Calculate destination address. 536 */ 537 IP6_MASK(&in, &fin->fin_src6, &np->in_osrcmsk6); 538 in = ntohl(in); 539 inb = in; 540 in.s_addr /= np->in_ippip; 541 in.s_addr &= ntohl(~np->in_nsrcmsk6); 542 in.s_addr += ntohl(np->in_nsrcaddr6); 543 /* 544 * Calculate destination port. 545 */ 546 if ((flags & IPN_TCPUDP) && 547 (np->in_ppip != 0)) { 548 port = ntohs(sport) + l; 549 port %= np->in_ppip; 550 port += np->in_ppip * 551 (inb.s_addr % np->in_ippip); 552 port += MAPBLK_MINPORT; 553 port = htons(port); 554 } 555 #endif 556 557 } else if (IP6_ISZERO(&np->in_nsrcaddr) && 558 IP6_ISONES(&np->in_nsrcmsk)) { 559 /* 560 * 0/32 - use the interface's IP address. 561 */ 562 if ((l > 0) || 563 ipf_ifpaddr(softc, 6, FRI_NORMAL, fin->fin_ifp, 564 &in, NULL) == -1) { 565 NBUMPSIDE6DX(1, ns_new_ifpaddr, 566 ns_new_ifpaddr_1); 567 return -1; 568 } 569 570 } else if (IP6_ISZERO(&np->in_nsrcip6) && 571 IP6_ISZERO(&np->in_nsrcmsk6)) { 572 /* 573 * 0/0 - use the original source address/port. 574 */ 575 if (l > 0) { 576 NBUMPSIDE6DX(1, ns_exhausted, ns_exhausted_3); 577 return -1; 578 } 579 in = fin->fin_src6; 580 581 } else if (!IP6_ISONES(&np->in_nsrcmsk6) && 582 (np->in_spnext == 0) && ((l > 0) || (hm == NULL))) { 583 IP6_INC(&np->in_snip6); 584 } 585 586 natl = NULL; 587 588 if ((flags & IPN_TCPUDP) && 589 ((np->in_redir & NAT_MAPBLK) == 0) && 590 (np->in_flags & IPN_AUTOPORTMAP)) { 591 #ifdef NEED_128BIT_MATH 592 /* 593 * "ports auto" (without map-block) 594 */ 595 if ((l > 0) && (l % np->in_ppip == 0)) { 596 if ((l > np->in_ppip) && 597 !IP6_ISONES(&np->in_nsrcmsk)) { 598 IP6_INC(&np->in_snip6) 599 } 600 } 601 if (np->in_ppip != 0) { 602 port = ntohs(sport); 603 port += (l % np->in_ppip); 604 port %= np->in_ppip; 605 port += np->in_ppip * 606 (ntohl(fin->fin_src6) % 607 np->in_ippip); 608 port += MAPBLK_MINPORT; 609 port = htons(port); 610 } 611 #endif 612 613 } else if (((np->in_redir & NAT_MAPBLK) == 0) && 614 (flags & IPN_TCPUDPICMP) && (np->in_spnext != 0)) { 615 /* 616 * Standard port translation. Select next port. 617 */ 618 if (np->in_flags & IPN_SEQUENTIAL) { 619 port = np->in_spnext; 620 } else { 621 port = ipf_random() % (np->in_spmax - 622 np->in_spmin + 1); 623 port += np->in_spmin; 624 } 625 port = htons(port); 626 np->in_spnext++; 627 628 if (np->in_spnext > np->in_spmax) { 629 np->in_spnext = np->in_spmin; 630 if (!IP6_ISONES(&np->in_nsrcmsk6)) { 631 IP6_INC(&np->in_snip6); 632 } 633 } 634 } 635 636 if (np->in_flags & IPN_SIPRANGE) { 637 if (IP6_GT(&np->in_snip, &np->in_nsrcmsk)) 638 np->in_snip6 = np->in_nsrcip6; 639 } else { 640 i6addr_t a1, a2; 641 642 a1 = np->in_snip6; 643 IP6_INC(&a1); 644 IP6_AND(&a1, &np->in_nsrcmsk6, &a2); 645 646 if (!IP6_ISONES(&np->in_nsrcmsk6) && 647 IP6_GT(&a2, &np->in_nsrcip6)) { 648 IP6_ADD(&np->in_nsrcip6, 1, &np->in_snip6); 649 } 650 } 651 652 if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY))) 653 port = sport; 654 655 /* 656 * Here we do a lookup of the connection as seen from 657 * the outside. If an IP# pair already exists, try 658 * again. So if you have A->B becomes C->B, you can 659 * also have D->E become C->E but not D->B causing 660 * another C->B. Also take protocol and ports into 661 * account when determining whether a pre-existing 662 * NAT setup will cause an external conflict where 663 * this is appropriate. 664 */ 665 sp = fin->fin_data[0]; 666 dp = fin->fin_data[1]; 667 fin->fin_data[0] = fin->fin_data[1]; 668 fin->fin_data[1] = ntohs(port); 669 natl = ipf_nat6_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH), 670 (u_int)fin->fin_p, &fin->fin_dst6.in6, 671 &in.in6); 672 fin->fin_data[0] = sp; 673 fin->fin_data[1] = dp; 674 675 /* 676 * Has the search wrapped around and come back to the 677 * start ? 678 */ 679 if ((natl != NULL) && 680 (np->in_spnext != 0) && (st_port == np->in_spnext) && 681 (!IP6_ISZERO(&np->in_snip6) && 682 IP6_EQ(&st_ip, &np->in_snip6))) { 683 NBUMPSIDE6D(1, ns_wrap); 684 return -1; 685 } 686 l++; 687 } while (natl != NULL); 688 689 /* Setup the NAT table */ 690 nat->nat_osrc6 = fin->fin_src6; 691 nat->nat_nsrc6 = in; 692 nat->nat_odst6 = fin->fin_dst6; 693 nat->nat_ndst6 = fin->fin_dst6; 694 if (nat->nat_hm == NULL) 695 nat->nat_hm = ipf_nat6_hostmap(softn, np, &fin->fin_src6, 696 &fin->fin_dst6, 697 &nat->nat_nsrc6, 0); 698 699 if (flags & IPN_TCPUDP) { 700 nat->nat_osport = sport; 701 nat->nat_nsport = port; /* sport */ 702 nat->nat_odport = dport; 703 nat->nat_ndport = dport; 704 ((tcphdr_t *)fin->fin_dp)->th_sport = port; 705 } else if (flags & IPN_ICMPQUERY) { 706 nat->nat_oicmpid = fin->fin_data[1]; 707 ((struct icmp6_hdr *)fin->fin_dp)->icmp6_id = port; 708 nat->nat_nicmpid = port; 709 } 710 return 0; 711 } 712 713 714 /* ------------------------------------------------------------------------ */ 715 /* Function: ipf_nat6_newrdr */ 716 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */ 717 /* allow rule to be moved if IPN_ROUNDR is set. */ 718 /* Parameters: fin(I) - pointer to packet information */ 719 /* nat(I) - pointer to NAT entry */ 720 /* ni(I) - pointer to structure with misc. information needed */ 721 /* to create new NAT entry. */ 722 /* */ 723 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/ 724 /* to the new IP address for the translation. */ 725 /* ------------------------------------------------------------------------ */ 726 int 727 ipf_nat6_newrdr(fr_info_t *fin, nat_t *nat, natinfo_t *ni) 728 { 729 ipf_main_softc_t *softc = fin->fin_main_soft; 730 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 731 u_short nport, dport, sport; 732 u_short sp, dp; 733 hostmap_t *hm; 734 u_32_t flags; 735 i6addr_t in; 736 ipnat_t *np; 737 nat_t *natl; 738 int move; 739 740 move = 1; 741 hm = NULL; 742 in.i6[0] = 0; 743 in.i6[1] = 0; 744 in.i6[2] = 0; 745 in.i6[3] = 0; 746 np = ni->nai_np; 747 flags = nat->nat_flags; 748 749 if (flags & IPN_ICMPQUERY) { 750 dport = fin->fin_data[1]; 751 sport = 0; 752 } else { 753 sport = htons(fin->fin_data[0]); 754 dport = htons(fin->fin_data[1]); 755 } 756 757 /* TRACE sport, dport */ 758 759 760 /* 761 * If the matching rule has IPN_STICKY set, then we want to have the 762 * same rule kick in as before. Why would this happen? If you have 763 * a collection of rdr rules with "round-robin sticky", the current 764 * packet might match a different one to the previous connection but 765 * we want the same destination to be used. 766 */ 767 if (((np->in_flags & (IPN_ROUNDR|IPN_SPLIT)) != 0) && 768 ((np->in_flags & IPN_STICKY) != 0)) { 769 hm = ipf_nat6_hostmap(softn, NULL, &fin->fin_src6, 770 &fin->fin_dst6, &in, (u_32_t)dport); 771 if (hm != NULL) { 772 in = hm->hm_ndstip6; 773 np = hm->hm_ipnat; 774 ni->nai_np = np; 775 move = 0; 776 } 777 } 778 779 /* 780 * Otherwise, it's an inbound packet. Most likely, we don't 781 * want to rewrite source ports and source addresses. Instead, 782 * we want to rewrite to a fixed internal address and fixed 783 * internal port. 784 */ 785 if (np->in_flags & IPN_SPLIT) { 786 in = np->in_dnip6; 787 788 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) { 789 hm = ipf_nat6_hostmap(softn, NULL, &fin->fin_src6, 790 &fin->fin_dst6, &in, 791 (u_32_t)dport); 792 if (hm != NULL) { 793 in = hm->hm_ndstip6; 794 move = 0; 795 } 796 } 797 798 if (hm == NULL || hm->hm_ref == 1) { 799 if (IP6_EQ(&np->in_ndstip6, &in)) { 800 np->in_dnip6 = np->in_ndstmsk6; 801 move = 0; 802 } else { 803 np->in_dnip6 = np->in_ndstip6; 804 } 805 } 806 807 } else if (IP6_ISZERO(&np->in_ndstaddr) && 808 IP6_ISONES(&np->in_ndstmsk)) { 809 /* 810 * 0/32 - use the interface's IP address. 811 */ 812 if (ipf_ifpaddr(softc, 6, FRI_NORMAL, fin->fin_ifp, 813 &in, NULL) == -1) { 814 NBUMPSIDE6DX(0, ns_new_ifpaddr, ns_new_ifpaddr_2); 815 return -1; 816 } 817 818 } else if (IP6_ISZERO(&np->in_ndstip6) && 819 IP6_ISZERO(&np->in_ndstmsk6)) { 820 /* 821 * 0/0 - use the original destination address/port. 822 */ 823 in = fin->fin_dst6; 824 825 } else if (np->in_redir == NAT_BIMAP && 826 IP6_EQ(&np->in_ndstmsk6, &np->in_odstmsk6)) { 827 i6addr_t temp; 828 /* 829 * map the address block in a 1:1 fashion 830 */ 831 temp.i6[0] = fin->fin_dst6.i6[0] & ~np->in_osrcmsk6.i6[0]; 832 temp.i6[1] = fin->fin_dst6.i6[1] & ~np->in_osrcmsk6.i6[1]; 833 temp.i6[2] = fin->fin_dst6.i6[2] & ~np->in_osrcmsk6.i6[0]; 834 temp.i6[3] = fin->fin_dst6.i6[3] & ~np->in_osrcmsk6.i6[3]; 835 in = np->in_ndstip6; 836 IP6_MERGE(&in, &temp, &np->in_ndstmsk6); 837 } else { 838 in = np->in_ndstip6; 839 } 840 841 if ((np->in_dpnext == 0) || ((flags & NAT_NOTRULEPORT) != 0)) 842 nport = dport; 843 else { 844 /* 845 * Whilst not optimized for the case where 846 * pmin == pmax, the gain is not significant. 847 */ 848 if (((np->in_flags & IPN_FIXEDDPORT) == 0) && 849 (np->in_odport != np->in_dtop)) { 850 nport = ntohs(dport) - np->in_odport + np->in_dpmax; 851 nport = htons(nport); 852 } else { 853 nport = htons(np->in_dpnext); 854 np->in_dpnext++; 855 if (np->in_dpnext > np->in_dpmax) 856 np->in_dpnext = np->in_dpmin; 857 } 858 } 859 860 /* 861 * When the redirect-to address is set to 0.0.0.0, just 862 * assume a blank `forwarding' of the packet. We don't 863 * setup any translation for this either. 864 */ 865 if (IP6_ISZERO(&in)) { 866 if (nport == dport) { 867 NBUMPSIDE6D(0, ns_xlate_null); 868 return -1; 869 } 870 in = fin->fin_dst6; 871 } 872 873 /* 874 * Check to see if this redirect mapping already exists and if 875 * it does, return "failure" (allowing it to be created will just 876 * cause one or both of these "connections" to stop working.) 877 */ 878 sp = fin->fin_data[0]; 879 dp = fin->fin_data[1]; 880 fin->fin_data[1] = fin->fin_data[0]; 881 fin->fin_data[0] = ntohs(nport); 882 natl = ipf_nat6_outlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH), 883 (u_int)fin->fin_p, &in.in6, 884 &fin->fin_src6.in6); 885 fin->fin_data[0] = sp; 886 fin->fin_data[1] = dp; 887 if (natl != NULL) { 888 NBUMPSIDE6D(0, ns_xlate_exists); 889 return -1; 890 } 891 892 nat->nat_ndst6 = in; 893 nat->nat_odst6 = fin->fin_dst6; 894 nat->nat_nsrc6 = fin->fin_src6; 895 nat->nat_osrc6 = fin->fin_src6; 896 if ((nat->nat_hm == NULL) && ((np->in_flags & IPN_STICKY) != 0)) 897 nat->nat_hm = ipf_nat6_hostmap(softn, np, &fin->fin_src6, 898 &fin->fin_dst6, &in, 899 (u_32_t)dport); 900 901 if (flags & IPN_TCPUDP) { 902 nat->nat_odport = dport; 903 nat->nat_ndport = nport; 904 nat->nat_osport = sport; 905 nat->nat_nsport = sport; 906 ((tcphdr_t *)fin->fin_dp)->th_dport = nport; 907 } else if (flags & IPN_ICMPQUERY) { 908 nat->nat_oicmpid = fin->fin_data[1]; 909 ((struct icmp6_hdr *)fin->fin_dp)->icmp6_id = nport; 910 nat->nat_nicmpid = nport; 911 } 912 913 return move; 914 } 915 916 /* ------------------------------------------------------------------------ */ 917 /* Function: ipf_nat6_add */ 918 /* Returns: nat6_t* - NULL == failure to create new NAT structure, */ 919 /* else pointer to new NAT structure */ 920 /* Parameters: fin(I) - pointer to packet information */ 921 /* np(I) - pointer to NAT rule */ 922 /* natsave(I) - pointer to where to store NAT struct pointer */ 923 /* flags(I) - flags describing the current packet */ 924 /* direction(I) - direction of packet (in/out) */ 925 /* Write Lock: ipf_nat */ 926 /* */ 927 /* Attempts to create a new NAT entry. Does not actually change the packet */ 928 /* in any way. */ 929 /* */ 930 /* This fucntion is in three main parts: (1) deal with creating a new NAT */ 931 /* structure for a "MAP" rule (outgoing NAT translation); (2) deal with */ 932 /* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */ 933 /* and (3) building that structure and putting it into the NAT table(s). */ 934 /* */ 935 /* NOTE: natsave should NOT be used top point back to an ipstate_t struct */ 936 /* as it can result in memory being corrupted. */ 937 /* ------------------------------------------------------------------------ */ 938 nat_t * 939 ipf_nat6_add(fr_info_t *fin, ipnat_t *np, nat_t **natsave, u_int flags, 940 int direction) 941 { 942 ipf_main_softc_t *softc = fin->fin_main_soft; 943 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 944 hostmap_t *hm = NULL; 945 nat_t *nat, *natl; 946 natstat_t *nsp; 947 u_int nflags; 948 natinfo_t ni; 949 int move; 950 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) && defined(ICK_M_CTL_MAGIC) 951 qpktinfo_t *qpi = fin->fin_qpi; 952 #endif 953 954 nsp = &softn->ipf_nat_stats; 955 956 if ((nsp->ns_active * 100 / softn->ipf_nat_table_max) > 957 softn->ipf_nat_table_wm_high) { 958 softn->ipf_nat_doflush = 1; 959 } 960 961 if (nsp->ns_active >= softn->ipf_nat_table_max) { 962 NBUMPSIDE6(fin->fin_out, ns_table_max); 963 return NULL; 964 } 965 966 move = 1; 967 nflags = np->in_flags & flags; 968 nflags &= NAT_FROMRULE; 969 970 ni.nai_np = np; 971 ni.nai_dport = 0; 972 ni.nai_sport = 0; 973 974 /* Give me a new nat */ 975 KMALLOC(nat, nat_t *); 976 if (nat == NULL) { 977 NBUMPSIDE6(fin->fin_out, ns_memfail); 978 /* 979 * Try to automatically tune the max # of entries in the 980 * table allowed to be less than what will cause kmem_alloc() 981 * to fail and try to eliminate panics due to out of memory 982 * conditions arising. 983 */ 984 if ((softn->ipf_nat_table_max > softn->ipf_nat_table_sz) && 985 (nsp->ns_active > 100)) { 986 softn->ipf_nat_table_max = nsp->ns_active - 100; 987 printf("table_max reduced to %d\n", 988 softn->ipf_nat_table_max); 989 } 990 return NULL; 991 } 992 993 if (flags & IPN_ICMPQUERY) { 994 /* 995 * In the ICMP query NAT code, we translate the ICMP id fields 996 * to make them unique. This is indepedent of the ICMP type 997 * (e.g. in the unlikely event that a host sends an echo and 998 * an tstamp request with the same id, both packets will have 999 * their ip address/id field changed in the same way). 1000 */ 1001 /* The icmp6_id field is used by the sender to identify the 1002 * process making the icmp request. (the receiver justs 1003 * copies it back in its response). So, it closely matches 1004 * the concept of source port. We overlay sport, so we can 1005 * maximally reuse the existing code. 1006 */ 1007 ni.nai_sport = fin->fin_data[1]; 1008 ni.nai_dport = 0; 1009 } 1010 1011 bzero((char *)nat, sizeof(*nat)); 1012 nat->nat_flags = flags; 1013 nat->nat_redir = np->in_redir; 1014 nat->nat_dir = direction; 1015 nat->nat_pr[0] = fin->fin_p; 1016 nat->nat_pr[1] = fin->fin_p; 1017 1018 /* 1019 * Search the current table for a match and create a new mapping 1020 * if there is none found. 1021 */ 1022 if (np->in_redir & NAT_DIVERTUDP) { 1023 move = ipf_nat6_newdivert(fin, nat, &ni); 1024 1025 } else if (np->in_redir & NAT_REWRITE) { 1026 move = ipf_nat6_newrewrite(fin, nat, &ni); 1027 1028 } else if (direction == NAT_OUTBOUND) { 1029 /* 1030 * We can now arrange to call this for the same connection 1031 * because ipf_nat6_new doesn't protect the code path into 1032 * this function. 1033 */ 1034 natl = ipf_nat6_outlookup(fin, nflags, (u_int)fin->fin_p, 1035 &fin->fin_src6.in6, 1036 &fin->fin_dst6.in6); 1037 if (natl != NULL) { 1038 KFREE(nat); 1039 nat = natl; 1040 goto done; 1041 } 1042 1043 move = ipf_nat6_newmap(fin, nat, &ni); 1044 } else { 1045 /* 1046 * NAT_INBOUND is used for redirects rules 1047 */ 1048 natl = ipf_nat6_inlookup(fin, nflags, (u_int)fin->fin_p, 1049 &fin->fin_src6.in6, 1050 &fin->fin_dst6.in6); 1051 if (natl != NULL) { 1052 KFREE(nat); 1053 nat = natl; 1054 goto done; 1055 } 1056 1057 move = ipf_nat6_newrdr(fin, nat, &ni); 1058 } 1059 if (move == -1) 1060 goto badnat; 1061 1062 np = ni.nai_np; 1063 1064 nat->nat_mssclamp = np->in_mssclamp; 1065 nat->nat_me = natsave; 1066 nat->nat_fr = fin->fin_fr; 1067 nat->nat_rev = fin->fin_rev; 1068 nat->nat_ptr = np; 1069 nat->nat_dlocal = np->in_dlocal; 1070 1071 if ((np->in_apr != NULL) && ((nat->nat_flags & NAT_SLAVE) == 0)) { 1072 if (ipf_proxy_new(fin, nat) == -1) { 1073 NBUMPSIDE6D(fin->fin_out, ns_appr_fail); 1074 goto badnat; 1075 } 1076 } 1077 1078 nat->nat_ifps[0] = np->in_ifps[0]; 1079 if (np->in_ifps[0] != NULL) { 1080 COPYIFNAME(np->in_v[0], np->in_ifps[0], nat->nat_ifnames[0]); 1081 } 1082 1083 nat->nat_ifps[1] = np->in_ifps[1]; 1084 if (np->in_ifps[1] != NULL) { 1085 COPYIFNAME(np->in_v[1], np->in_ifps[1], nat->nat_ifnames[1]); 1086 } 1087 1088 if (ipf_nat6_finalise(fin, nat) == -1) { 1089 goto badnat; 1090 } 1091 1092 np->in_use++; 1093 1094 if ((move == 1) && (np->in_flags & IPN_ROUNDR)) { 1095 if ((np->in_redir & (NAT_REDIRECT|NAT_MAP)) == NAT_REDIRECT) { 1096 ipf_nat6_delrdr(softn, np); 1097 ipf_nat6_addrdr(softn, np); 1098 } else if ((np->in_redir & (NAT_REDIRECT|NAT_MAP)) == NAT_MAP) { 1099 ipf_nat6_delmap(softn, np); 1100 ipf_nat6_addmap(softn, np); 1101 } 1102 } 1103 1104 if (flags & SI_WILDP) 1105 nsp->ns_wilds++; 1106 softn->ipf_nat_stats.ns_proto[nat->nat_pr[0]]++; 1107 1108 goto done; 1109 badnat: 1110 NBUMPSIDE6(fin->fin_out, ns_badnatnew); 1111 if ((hm = nat->nat_hm) != NULL) 1112 ipf_nat_hostmapdel(softc, &hm); 1113 KFREE(nat); 1114 nat = NULL; 1115 done: 1116 if (nat != NULL && np != NULL) 1117 np->in_hits++; 1118 if (natsave != NULL) 1119 *natsave = nat; 1120 return nat; 1121 } 1122 1123 1124 /* ------------------------------------------------------------------------ */ 1125 /* Function: ipf_nat6_finalise */ 1126 /* Returns: int - 0 == sucess, -1 == failure */ 1127 /* Parameters: fin(I) - pointer to packet information */ 1128 /* nat(I) - pointer to NAT entry */ 1129 /* Write Lock: ipf_nat */ 1130 /* */ 1131 /* This is the tail end of constructing a new NAT entry and is the same */ 1132 /* for both IPv4 and IPv6. */ 1133 /* ------------------------------------------------------------------------ */ 1134 /*ARGSUSED*/ 1135 int 1136 ipf_nat6_finalise(fr_info_t *fin, nat_t *nat) 1137 { 1138 ipf_main_softc_t *softc = fin->fin_main_soft; 1139 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 1140 u_32_t sum1, sum2, sumd; 1141 frentry_t *fr; 1142 1143 switch (fin->fin_p) 1144 { 1145 case IPPROTO_ICMPV6 : 1146 sum1 = LONG_SUM6(&nat->nat_osrc6); 1147 sum1 += ntohs(nat->nat_oicmpid); 1148 sum2 = LONG_SUM6(&nat->nat_nsrc6); 1149 sum2 += ntohs(nat->nat_nicmpid); 1150 CALC_SUMD(sum1, sum2, sumd); 1151 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 1152 1153 sum1 = LONG_SUM6(&nat->nat_odst6); 1154 sum2 = LONG_SUM6(&nat->nat_ndst6); 1155 CALC_SUMD(sum1, sum2, sumd); 1156 nat->nat_sumd[0] += (sumd & 0xffff) + (sumd >> 16); 1157 break; 1158 1159 case IPPROTO_TCP : 1160 case IPPROTO_UDP : 1161 sum1 = LONG_SUM6(&nat->nat_osrc6); 1162 sum1 += ntohs(nat->nat_osport); 1163 sum2 = LONG_SUM6(&nat->nat_nsrc6); 1164 sum2 += ntohs(nat->nat_nsport); 1165 CALC_SUMD(sum1, sum2, sumd); 1166 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 1167 1168 sum1 = LONG_SUM6(&nat->nat_odst6); 1169 sum1 += ntohs(nat->nat_odport); 1170 sum2 = LONG_SUM6(&nat->nat_ndst6); 1171 sum2 += ntohs(nat->nat_ndport); 1172 CALC_SUMD(sum1, sum2, sumd); 1173 nat->nat_sumd[0] += (sumd & 0xffff) + (sumd >> 16); 1174 break; 1175 1176 default : 1177 sum1 = LONG_SUM6(&nat->nat_osrc6); 1178 sum2 = LONG_SUM6(&nat->nat_nsrc6); 1179 CALC_SUMD(sum1, sum2, sumd); 1180 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 1181 1182 sum1 = LONG_SUM6(&nat->nat_odst6); 1183 sum2 = LONG_SUM6(&nat->nat_ndst6); 1184 CALC_SUMD(sum1, sum2, sumd); 1185 nat->nat_sumd[0] += (sumd & 0xffff) + (sumd >> 16); 1186 break; 1187 } 1188 1189 /* 1190 * Compute the partial checksum, just in case. 1191 * This is only ever placed into outbound packets so care needs 1192 * to be taken over which pair of addresses are used. 1193 */ 1194 if (nat->nat_dir == NAT_OUTBOUND) { 1195 sum1 = LONG_SUM6(&nat->nat_nsrc6); 1196 sum1 += LONG_SUM6(&nat->nat_ndst6); 1197 } else { 1198 sum1 = LONG_SUM6(&nat->nat_osrc6); 1199 sum1 += LONG_SUM6(&nat->nat_odst6); 1200 } 1201 sum1 += nat->nat_pr[1]; 1202 nat->nat_sumd[1] = (sum1 & 0xffff) + (sum1 >> 16); 1203 1204 if ((nat->nat_flags & SI_CLONE) == 0) 1205 nat->nat_sync = ipf_sync_new(softc, SMC_NAT, fin, nat); 1206 1207 if ((nat->nat_ifps[0] != NULL) && (nat->nat_ifps[0] != (void *)-1)) { 1208 nat->nat_mtu[0] = GETIFMTU_6(nat->nat_ifps[0]); 1209 } 1210 1211 if ((nat->nat_ifps[1] != NULL) && (nat->nat_ifps[1] != (void *)-1)) { 1212 nat->nat_mtu[1] = GETIFMTU_6(nat->nat_ifps[1]); 1213 } 1214 1215 nat->nat_v[0] = 6; 1216 nat->nat_v[1] = 6; 1217 1218 if (ipf_nat6_insert(softc, softn, nat) == 0) { 1219 if (softn->ipf_nat_logging) 1220 ipf_nat_log(softc, softn, nat, NL_NEW); 1221 fr = nat->nat_fr; 1222 if (fr != NULL) { 1223 MUTEX_ENTER(&fr->fr_lock); 1224 fr->fr_ref++; 1225 MUTEX_EXIT(&fr->fr_lock); 1226 } 1227 return 0; 1228 } 1229 1230 NBUMPSIDE6D(fin->fin_out, ns_unfinalised); 1231 /* 1232 * nat6_insert failed, so cleanup time... 1233 */ 1234 if (nat->nat_sync != NULL) 1235 ipf_sync_del_nat(softc->ipf_sync_soft, nat->nat_sync); 1236 return -1; 1237 } 1238 1239 1240 /* ------------------------------------------------------------------------ */ 1241 /* Function: ipf_nat6_insert */ 1242 /* Returns: int - 0 == sucess, -1 == failure */ 1243 /* Parameters: softc(I) - pointer to soft context main structure */ 1244 /* softn(I) - pointer to NAT context structure */ 1245 /* nat(I) - pointer to NAT structure */ 1246 /* Write Lock: ipf_nat */ 1247 /* */ 1248 /* Insert a NAT entry into the hash tables for searching and add it to the */ 1249 /* list of active NAT entries. Adjust global counters when complete. */ 1250 /* ------------------------------------------------------------------------ */ 1251 static int 1252 ipf_nat6_insert(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, nat_t *nat) 1253 { 1254 u_int hv0, hv1; 1255 u_32_t sp, dp; 1256 ipnat_t *in; 1257 1258 /* 1259 * Try and return an error as early as possible, so calculate the hash 1260 * entry numbers first and then proceed. 1261 */ 1262 if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) { 1263 if ((nat->nat_flags & IPN_TCPUDP) != 0) { 1264 sp = nat->nat_osport; 1265 dp = nat->nat_odport; 1266 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) { 1267 sp = 0; 1268 dp = nat->nat_oicmpid; 1269 } else { 1270 sp = 0; 1271 dp = 0; 1272 } 1273 hv0 = NAT_HASH_FN6(&nat->nat_osrc6, sp, 0xffffffff); 1274 hv0 = NAT_HASH_FN6(&nat->nat_odst6, hv0 + dp, 1275 softn->ipf_nat_table_sz); 1276 1277 /* 1278 * TRACE nat6_osrc6, nat6_osport, nat6_odst6, 1279 * nat6_odport, hv0 1280 */ 1281 1282 if ((nat->nat_flags & IPN_TCPUDP) != 0) { 1283 sp = nat->nat_nsport; 1284 dp = nat->nat_ndport; 1285 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) { 1286 sp = 0; 1287 dp = nat->nat_nicmpid; 1288 } else { 1289 sp = 0; 1290 dp = 0; 1291 } 1292 hv1 = NAT_HASH_FN6(&nat->nat_nsrc6, sp, 0xffffffff); 1293 hv1 = NAT_HASH_FN6(&nat->nat_ndst6, hv1 + dp, 1294 softn->ipf_nat_table_sz); 1295 /* 1296 * TRACE nat6_nsrcaddr, nat6_nsport, nat6_ndstaddr, 1297 * nat6_ndport, hv0 1298 */ 1299 } else { 1300 hv0 = NAT_HASH_FN6(&nat->nat_osrc6, 0, 0xffffffff); 1301 hv0 = NAT_HASH_FN6(&nat->nat_odst6, hv0, 1302 softn->ipf_nat_table_sz); 1303 /* TRACE nat6_osrcip6, nat6_odstip6, hv0 */ 1304 1305 hv1 = NAT_HASH_FN6(&nat->nat_nsrc6, 0, 0xffffffff); 1306 hv1 = NAT_HASH_FN6(&nat->nat_ndst6, hv1, 1307 softn->ipf_nat_table_sz); 1308 /* TRACE nat6_nsrcip6, nat6_ndstip6, hv1 */ 1309 } 1310 1311 if ((nat->nat_dir & NAT_OUTBOUND) == NAT_OUTBOUND) { 1312 nat->nat_hv[0] = hv0; 1313 nat->nat_hv[1] = hv1; 1314 } else { 1315 nat->nat_hv[0] = hv1; 1316 nat->nat_hv[1] = hv0; 1317 } 1318 1319 MUTEX_INIT(&nat->nat_lock, "nat entry lock"); 1320 1321 in = nat->nat_ptr; 1322 nat->nat_ref = nat->nat_me ? 2 : 1; 1323 1324 nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0'; 1325 nat->nat_ifps[0] = ipf_resolvenic(softc, nat->nat_ifnames[0], 1326 nat->nat_v[0]); 1327 1328 if (nat->nat_ifnames[1][0] != '\0') { 1329 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0'; 1330 nat->nat_ifps[1] = ipf_resolvenic(softc, nat->nat_ifnames[1], 1331 nat->nat_v[1]); 1332 } else if (in->in_ifnames[1] != -1) { 1333 char *name; 1334 1335 name = in->in_names + in->in_ifnames[1]; 1336 if (name[1] != '\0' && name[0] != '-' && name[0] != '*') { 1337 (void) strncpy(nat->nat_ifnames[1], 1338 nat->nat_ifnames[0], LIFNAMSIZ); 1339 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0'; 1340 nat->nat_ifps[1] = nat->nat_ifps[0]; 1341 } 1342 } 1343 if ((nat->nat_ifps[0] != NULL) && (nat->nat_ifps[0] != (void *)-1)) { 1344 nat->nat_mtu[0] = GETIFMTU_6(nat->nat_ifps[0]); 1345 } 1346 if ((nat->nat_ifps[1] != NULL) && (nat->nat_ifps[1] != (void *)-1)) { 1347 nat->nat_mtu[1] = GETIFMTU_6(nat->nat_ifps[1]); 1348 } 1349 1350 return ipf_nat_hashtab_add(softc, softn, nat); 1351 } 1352 1353 1354 /* ------------------------------------------------------------------------ */ 1355 /* Function: ipf_nat6_icmperrorlookup */ 1356 /* Returns: nat6_t* - point to matching NAT structure */ 1357 /* Parameters: fin(I) - pointer to packet information */ 1358 /* dir(I) - direction of packet (in/out) */ 1359 /* */ 1360 /* Check if the ICMP error message is related to an existing TCP, UDP or */ 1361 /* ICMP query nat entry. It is assumed that the packet is already of the */ 1362 /* the required length. */ 1363 /* ------------------------------------------------------------------------ */ 1364 nat_t * 1365 ipf_nat6_icmperrorlookup(fr_info_t *fin, int dir) 1366 { 1367 ipf_main_softc_t *softc = fin->fin_main_soft; 1368 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 1369 struct icmp6_hdr *orgicmp; 1370 int flags = 0, minlen; 1371 nat_stat_side_t *nside; 1372 tcphdr_t *tcp = NULL; 1373 u_short data[2]; 1374 ip6_t *oip6; 1375 nat_t *nat; 1376 u_int p; 1377 1378 minlen = 40; 1379 nside = &softn->ipf_nat_stats.ns_side6[fin->fin_out]; 1380 /* 1381 * Does it at least have the return (basic) IP header ? 1382 * Only a basic IP header (no options) should be with an ICMP error 1383 * header. Also, if it's not an error type, then return. 1384 */ 1385 if (!(fin->fin_flx & FI_ICMPERR)) { 1386 ATOMIC_INCL(nside->ns_icmp_basic); 1387 return NULL; 1388 } 1389 1390 /* 1391 * Check packet size 1392 */ 1393 if (fin->fin_plen < ICMP6ERR_IPICMPHLEN) { 1394 ATOMIC_INCL(nside->ns_icmp_size); 1395 return NULL; 1396 } 1397 oip6 = (ip6_t *)((char *)fin->fin_dp + 8); 1398 1399 /* 1400 * Is the buffer big enough for all of it ? It's the size of the IP 1401 * header claimed in the encapsulated part which is of concern. It 1402 * may be too big to be in this buffer but not so big that it's 1403 * outside the ICMP packet, leading to TCP deref's causing problems. 1404 * This is possible because we don't know how big oip_hl is when we 1405 * do the pullup early in ipf_check() and thus can't gaurantee it is 1406 * all here now. 1407 */ 1408 #ifdef ipf_nat6_KERNEL 1409 { 1410 mb_t *m; 1411 1412 m = fin->fin_m; 1413 # if defined(MENTAT) 1414 if ((char *)oip6 + fin->fin_dlen - ICMPERR_ICMPHLEN > 1415 (char *)m->b_wptr) { 1416 ATOMIC_INCL(nside->ns_icmp_mbuf); 1417 return NULL; 1418 } 1419 # else 1420 if ((char *)oip6 + fin->fin_dlen - ICMPERR_ICMPHLEN > 1421 (char *)fin->fin_ip + M_LEN(m)) { 1422 ATOMIC_INCL(nside->ns_icmp_mbuf); 1423 return NULL; 1424 } 1425 # endif 1426 } 1427 #endif 1428 1429 if (IP6_NEQ(&fin->fin_dst6, &oip6->ip6_src)) { 1430 ATOMIC_INCL(nside->ns_icmp_address); 1431 return NULL; 1432 } 1433 1434 p = oip6->ip6_nxt; 1435 if (p == IPPROTO_TCP) 1436 flags = IPN_TCP; 1437 else if (p == IPPROTO_UDP) 1438 flags = IPN_UDP; 1439 else if (p == IPPROTO_ICMPV6) { 1440 orgicmp = (struct icmp6_hdr *)(oip6 + 1); 1441 1442 /* see if this is related to an ICMP query */ 1443 if (ipf_nat6_icmpquerytype(orgicmp->icmp6_type)) { 1444 data[0] = fin->fin_data[0]; 1445 data[1] = fin->fin_data[1]; 1446 fin->fin_data[0] = 0; 1447 fin->fin_data[1] = orgicmp->icmp6_id; 1448 1449 flags = IPN_ICMPERR|IPN_ICMPQUERY; 1450 /* 1451 * NOTE : dir refers to the direction of the original 1452 * ip packet. By definition the icmp error 1453 * message flows in the opposite direction. 1454 */ 1455 if (dir == NAT_INBOUND) 1456 nat = ipf_nat6_inlookup(fin, flags, p, 1457 &oip6->ip6_dst, 1458 &oip6->ip6_src); 1459 else 1460 nat = ipf_nat6_outlookup(fin, flags, p, 1461 &oip6->ip6_dst, 1462 &oip6->ip6_src); 1463 fin->fin_data[0] = data[0]; 1464 fin->fin_data[1] = data[1]; 1465 return nat; 1466 } 1467 } 1468 1469 if (flags & IPN_TCPUDP) { 1470 minlen += 8; /* + 64bits of data to get ports */ 1471 /* TRACE (fin,minlen) */ 1472 if (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen) { 1473 ATOMIC_INCL(nside->ns_icmp_short); 1474 return NULL; 1475 } 1476 1477 data[0] = fin->fin_data[0]; 1478 data[1] = fin->fin_data[1]; 1479 tcp = (tcphdr_t *)(oip6 + 1); 1480 fin->fin_data[0] = ntohs(tcp->th_dport); 1481 fin->fin_data[1] = ntohs(tcp->th_sport); 1482 1483 if (dir == NAT_INBOUND) { 1484 nat = ipf_nat6_inlookup(fin, flags, p, &oip6->ip6_dst, 1485 &oip6->ip6_src); 1486 } else { 1487 nat = ipf_nat6_outlookup(fin, flags, p, &oip6->ip6_dst, 1488 &oip6->ip6_src); 1489 } 1490 fin->fin_data[0] = data[0]; 1491 fin->fin_data[1] = data[1]; 1492 return nat; 1493 } 1494 if (dir == NAT_INBOUND) 1495 nat = ipf_nat6_inlookup(fin, 0, p, &oip6->ip6_dst, 1496 &oip6->ip6_src); 1497 else 1498 nat = ipf_nat6_outlookup(fin, 0, p, &oip6->ip6_dst, 1499 &oip6->ip6_src); 1500 1501 return nat; 1502 } 1503 1504 1505 /* result = ip1 - ip2 */ 1506 u_32_t 1507 ipf_nat6_ip6subtract(i6addr_t *ip1, i6addr_t *ip2) 1508 { 1509 i6addr_t l1, l2, d; 1510 u_short *s1, *s2, *ds; 1511 u_32_t r; 1512 int i; 1513 1514 l1 = *ip1; 1515 l2 = *ip2; 1516 s1 = (u_short *)&l1; 1517 s2 = (u_short *)&l2; 1518 ds = (u_short *)&d; 1519 1520 for (i = 7; i > 0; i--) { 1521 if (s1[i] > s2[i]) { 1522 ds[i] = s2[i] + 0x10000 - s1[i]; 1523 s2[i - 1] += 0x10000; 1524 } else { 1525 ds[i] = s2[i] - s1[i]; 1526 } 1527 } 1528 if (s2[0] > s1[0]) { 1529 ds[0] = s2[0] + 0x10000 - s1[0]; 1530 } else { 1531 ds[0] = s2[0] - s1[0]; 1532 } 1533 1534 for (i = 0, r = 0; i < 8; i++) { 1535 r += ds[i]; 1536 } 1537 1538 return r; 1539 } 1540 1541 1542 /* ------------------------------------------------------------------------ */ 1543 /* Function: ipf_nat6_icmperror */ 1544 /* Returns: nat6_t* - point to matching NAT structure */ 1545 /* Parameters: fin(I) - pointer to packet information */ 1546 /* nflags(I) - NAT flags for this packet */ 1547 /* dir(I) - direction of packet (in/out) */ 1548 /* */ 1549 /* Fix up an ICMP packet which is an error message for an existing NAT */ 1550 /* session. This will correct both packet header data and checksums. */ 1551 /* */ 1552 /* This should *ONLY* be used for incoming ICMP error packets to make sure */ 1553 /* a NAT'd ICMP packet gets correctly recognised. */ 1554 /* ------------------------------------------------------------------------ */ 1555 nat_t * 1556 ipf_nat6_icmperror(fr_info_t *fin, u_int *nflags, int dir) 1557 { 1558 ipf_main_softc_t *softc = fin->fin_main_soft; 1559 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 1560 u_32_t sum1, sum2, sumd, sumd2; 1561 i6addr_t a1, a2, a3, a4; 1562 struct icmp6_hdr *icmp6; 1563 int flags, dlen, odst; 1564 u_short *csump; 1565 tcphdr_t *tcp; 1566 ip6_t *oip6; 1567 nat_t *nat; 1568 void *dp; 1569 1570 if ((fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) { 1571 NBUMPSIDE6D(fin->fin_out, ns_icmp_short); 1572 return NULL; 1573 } 1574 1575 /* 1576 * ipf_nat6_icmperrorlookup() will return NULL for `defective' packets. 1577 */ 1578 if ((fin->fin_v != 6) || !(nat = ipf_nat6_icmperrorlookup(fin, dir))) { 1579 NBUMPSIDE6D(fin->fin_out, ns_icmp_notfound); 1580 return NULL; 1581 } 1582 1583 tcp = NULL; 1584 csump = NULL; 1585 flags = 0; 1586 sumd2 = 0; 1587 *nflags = IPN_ICMPERR; 1588 icmp6 = fin->fin_dp; 1589 oip6 = (ip6_t *)((u_char *)icmp6 + sizeof(*icmp6)); 1590 dp = (u_char *)oip6 + sizeof(*oip6); 1591 if (oip6->ip6_nxt == IPPROTO_TCP) { 1592 tcp = (tcphdr_t *)dp; 1593 csump = (u_short *)&tcp->th_sum; 1594 flags = IPN_TCP; 1595 } else if (oip6->ip6_nxt == IPPROTO_UDP) { 1596 udphdr_t *udp; 1597 1598 udp = (udphdr_t *)dp; 1599 tcp = (tcphdr_t *)dp; 1600 csump = (u_short *)&udp->uh_sum; 1601 flags = IPN_UDP; 1602 } else if (oip6->ip6_nxt == IPPROTO_ICMPV6) 1603 flags = IPN_ICMPQUERY; 1604 dlen = fin->fin_plen - ((char *)dp - (char *)fin->fin_ip); 1605 1606 /* 1607 * Need to adjust ICMP header to include the real IP#'s and 1608 * port #'s. Only apply a checksum change relative to the 1609 * IP address change as it will be modified again in ipf_nat6_checkout 1610 * for both address and port. Two checksum changes are 1611 * necessary for the two header address changes. Be careful 1612 * to only modify the checksum once for the port # and twice 1613 * for the IP#. 1614 */ 1615 1616 /* 1617 * Step 1 1618 * Fix the IP addresses in the offending IP packet. You also need 1619 * to adjust the IP header checksum of that offending IP packet. 1620 * 1621 * Normally, you would expect that the ICMP checksum of the 1622 * ICMP error message needs to be adjusted as well for the 1623 * IP address change in oip. 1624 * However, this is a NOP, because the ICMP checksum is 1625 * calculated over the complete ICMP packet, which includes the 1626 * changed oip IP addresses and oip6->ip6_sum. However, these 1627 * two changes cancel each other out (if the delta for 1628 * the IP address is x, then the delta for ip_sum is minus x), 1629 * so no change in the icmp_cksum is necessary. 1630 * 1631 * Inbound ICMP 1632 * ------------ 1633 * MAP rule, SRC=a,DST=b -> SRC=c,DST=b 1634 * - response to outgoing packet (a,b)=>(c,b) (OIP_SRC=c,OIP_DST=b) 1635 * - OIP_SRC(c)=nat6_newsrcip, OIP_DST(b)=nat6_newdstip 1636 *=> OIP_SRC(c)=nat6_oldsrcip, OIP_DST(b)=nat6_olddstip 1637 * 1638 * RDR rule, SRC=a,DST=b -> SRC=a,DST=c 1639 * - response to outgoing packet (c,a)=>(b,a) (OIP_SRC=b,OIP_DST=a) 1640 * - OIP_SRC(b)=nat6_olddstip, OIP_DST(a)=nat6_oldsrcip 1641 *=> OIP_SRC(b)=nat6_newdstip, OIP_DST(a)=nat6_newsrcip 1642 * 1643 * REWRITE out rule, SRC=a,DST=b -> SRC=c,DST=d 1644 * - response to outgoing packet (a,b)=>(c,d) (OIP_SRC=c,OIP_DST=d) 1645 * - OIP_SRC(c)=nat6_newsrcip, OIP_DST(d)=nat6_newdstip 1646 *=> OIP_SRC(c)=nat6_oldsrcip, OIP_DST(d)=nat6_olddstip 1647 * 1648 * REWRITE in rule, SRC=a,DST=b -> SRC=c,DST=d 1649 * - response to outgoing packet (d,c)=>(b,a) (OIP_SRC=b,OIP_DST=a) 1650 * - OIP_SRC(b)=nat6_olddstip, OIP_DST(a)=nat6_oldsrcip 1651 *=> OIP_SRC(b)=nat6_newdstip, OIP_DST(a)=nat6_newsrcip 1652 * 1653 * Outbound ICMP 1654 * ------------- 1655 * MAP rule, SRC=a,DST=b -> SRC=c,DST=b 1656 * - response to incoming packet (b,c)=>(b,a) (OIP_SRC=b,OIP_DST=a) 1657 * - OIP_SRC(b)=nat6_olddstip, OIP_DST(a)=nat6_oldsrcip 1658 *=> OIP_SRC(b)=nat6_newdstip, OIP_DST(a)=nat6_newsrcip 1659 * 1660 * RDR rule, SRC=a,DST=b -> SRC=a,DST=c 1661 * - response to incoming packet (a,b)=>(a,c) (OIP_SRC=a,OIP_DST=c) 1662 * - OIP_SRC(a)=nat6_newsrcip, OIP_DST(c)=nat6_newdstip 1663 *=> OIP_SRC(a)=nat6_oldsrcip, OIP_DST(c)=nat6_olddstip 1664 * 1665 * REWRITE out rule, SRC=a,DST=b -> SRC=c,DST=d 1666 * - response to incoming packet (d,c)=>(b,a) (OIP_SRC=c,OIP_DST=d) 1667 * - OIP_SRC(c)=nat6_olddstip, OIP_DST(d)=nat6_oldsrcip 1668 *=> OIP_SRC(b)=nat6_newdstip, OIP_DST(a)=nat6_newsrcip 1669 * 1670 * REWRITE in rule, SRC=a,DST=b -> SRC=c,DST=d 1671 * - response to incoming packet (a,b)=>(c,d) (OIP_SRC=b,OIP_DST=a) 1672 * - OIP_SRC(b)=nat6_newsrcip, OIP_DST(a)=nat6_newdstip 1673 *=> OIP_SRC(a)=nat6_oldsrcip, OIP_DST(c)=nat6_olddstip 1674 */ 1675 1676 if (((fin->fin_out == 0) && ((nat->nat_redir & NAT_MAP) != 0)) || 1677 ((fin->fin_out == 1) && ((nat->nat_redir & NAT_REDIRECT) != 0))) { 1678 a1 = nat->nat_osrc6; 1679 a4.in6 = oip6->ip6_src; 1680 a3 = nat->nat_odst6; 1681 a2.in6 = oip6->ip6_dst; 1682 oip6->ip6_src = a1.in6; 1683 oip6->ip6_dst = a3.in6; 1684 odst = 1; 1685 } else { 1686 a1 = nat->nat_ndst6; 1687 a2.in6 = oip6->ip6_dst; 1688 a3 = nat->nat_nsrc6; 1689 a4.in6 = oip6->ip6_src; 1690 oip6->ip6_dst = a3.in6; 1691 oip6->ip6_src = a1.in6; 1692 odst = 0; 1693 } 1694 1695 sumd = 0; 1696 if (IP6_NEQ(&a3, &a2) || IP6_NEQ(&a1, &a4)) { 1697 if (IP6_GT(&a3, &a2)) { 1698 sumd = ipf_nat6_ip6subtract(&a2, &a3); 1699 sumd--; 1700 } else { 1701 sumd = ipf_nat6_ip6subtract(&a2, &a3); 1702 } 1703 if (IP6_GT(&a1, &a4)) { 1704 sumd += ipf_nat6_ip6subtract(&a4, &a1); 1705 sumd--; 1706 } else { 1707 sumd += ipf_nat6_ip6subtract(&a4, &a1); 1708 } 1709 sumd = ~sumd; 1710 } 1711 1712 sumd2 = sumd; 1713 sum1 = 0; 1714 sum2 = 0; 1715 1716 /* 1717 * Fix UDP pseudo header checksum to compensate for the 1718 * IP address change. 1719 */ 1720 if (((flags & IPN_TCPUDP) != 0) && (dlen >= 4)) { 1721 u_32_t sum3, sum4; 1722 /* 1723 * Step 2 : 1724 * For offending TCP/UDP IP packets, translate the ports as 1725 * well, based on the NAT specification. Of course such 1726 * a change may be reflected in the ICMP checksum as well. 1727 * 1728 * Since the port fields are part of the TCP/UDP checksum 1729 * of the offending IP packet, you need to adjust that checksum 1730 * as well... except that the change in the port numbers should 1731 * be offset by the checksum change. However, the TCP/UDP 1732 * checksum will also need to change if there has been an 1733 * IP address change. 1734 */ 1735 if (odst == 1) { 1736 sum1 = ntohs(nat->nat_osport); 1737 sum4 = ntohs(tcp->th_sport); 1738 sum3 = ntohs(nat->nat_odport); 1739 sum2 = ntohs(tcp->th_dport); 1740 1741 tcp->th_sport = htons(sum1); 1742 tcp->th_dport = htons(sum3); 1743 } else { 1744 sum1 = ntohs(nat->nat_ndport); 1745 sum2 = ntohs(tcp->th_dport); 1746 sum3 = ntohs(nat->nat_nsport); 1747 sum4 = ntohs(tcp->th_sport); 1748 1749 tcp->th_dport = htons(sum3); 1750 tcp->th_sport = htons(sum1); 1751 } 1752 sumd += sum1 - sum4; 1753 sumd += sum3 - sum2; 1754 1755 if (sumd != 0 || sumd2 != 0) { 1756 /* 1757 * At this point, sumd is the delta to apply to the 1758 * TCP/UDP header, given the changes in both the IP 1759 * address and the ports and sumd2 is the delta to 1760 * apply to the ICMP header, given the IP address 1761 * change delta that may need to be applied to the 1762 * TCP/UDP checksum instead. 1763 * 1764 * If we will both the IP and TCP/UDP checksums 1765 * then the ICMP checksum changes by the address 1766 * delta applied to the TCP/UDP checksum. If we 1767 * do not change the TCP/UDP checksum them we 1768 * apply the delta in ports to the ICMP checksum. 1769 */ 1770 if (oip6->ip6_nxt == IPPROTO_UDP) { 1771 if ((dlen >= 8) && (*csump != 0)) { 1772 ipf_fix_datacksum(csump, sumd); 1773 } else { 1774 sumd2 = sum4 - sum1; 1775 if (sum1 > sum4) 1776 sumd2--; 1777 sumd2 += sum2 - sum3; 1778 if (sum3 > sum2) 1779 sumd2--; 1780 } 1781 } else if (oip6->ip6_nxt == IPPROTO_TCP) { 1782 if (dlen >= 18) { 1783 ipf_fix_datacksum(csump, sumd); 1784 } else { 1785 sumd2 = sum4 - sum1; 1786 if (sum1 > sum4) 1787 sumd2--; 1788 sumd2 += sum2 - sum3; 1789 if (sum3 > sum2) 1790 sumd2--; 1791 } 1792 } 1793 if (sumd2 != 0) { 1794 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 1795 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 1796 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 1797 ipf_fix_incksum(0, &icmp6->icmp6_cksum, 1798 sumd2, 0); 1799 } 1800 } 1801 } else if (((flags & IPN_ICMPQUERY) != 0) && (dlen >= 8)) { 1802 struct icmp6_hdr *orgicmp; 1803 1804 /* 1805 * XXX - what if this is bogus hl and we go off the end ? 1806 * In this case, ipf_nat6_icmperrorlookup() will have 1807 * returned NULL. 1808 */ 1809 orgicmp = (struct icmp6_hdr *)dp; 1810 1811 if (odst == 1) { 1812 if (orgicmp->icmp6_id != nat->nat_osport) { 1813 1814 /* 1815 * Fix ICMP checksum (of the offening ICMP 1816 * query packet) to compensate the change 1817 * in the ICMP id of the offending ICMP 1818 * packet. 1819 * 1820 * Since you modify orgicmp->icmp6_id with 1821 * a delta (say x) and you compensate that 1822 * in origicmp->icmp6_cksum with a delta 1823 * minus x, you don't have to adjust the 1824 * overall icmp->icmp6_cksum 1825 */ 1826 sum1 = ntohs(orgicmp->icmp6_id); 1827 sum2 = ntohs(nat->nat_osport); 1828 CALC_SUMD(sum1, sum2, sumd); 1829 orgicmp->icmp6_id = nat->nat_oicmpid; 1830 ipf_fix_datacksum(&orgicmp->icmp6_cksum, sumd); 1831 } 1832 } /* nat6_dir == NAT_INBOUND is impossible for icmp queries */ 1833 } 1834 return nat; 1835 } 1836 1837 1838 /* 1839 * MAP-IN MAP-OUT RDR-IN RDR-OUT 1840 * osrc X == src == src X 1841 * odst X == dst == dst X 1842 * nsrc == dst X X == dst 1843 * ndst == src X X == src 1844 * MAP = NAT_OUTBOUND, RDR = NAT_INBOUND 1845 */ 1846 /* 1847 * NB: these lookups don't lock access to the list, it assumed that it has 1848 * already been done! 1849 */ 1850 /* ------------------------------------------------------------------------ */ 1851 /* Function: ipf_nat6_inlookup */ 1852 /* Returns: nat6_t* - NULL == no match, */ 1853 /* else pointer to matching NAT entry */ 1854 /* Parameters: fin(I) - pointer to packet information */ 1855 /* flags(I) - NAT flags for this packet */ 1856 /* p(I) - protocol for this packet */ 1857 /* src(I) - source IP address */ 1858 /* mapdst(I) - destination IP address */ 1859 /* */ 1860 /* Lookup a nat entry based on the mapped destination ip address/port and */ 1861 /* real source address/port. We use this lookup when receiving a packet, */ 1862 /* we're looking for a table entry, based on the destination address. */ 1863 /* */ 1864 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */ 1865 /* */ 1866 /* NOTE: IT IS ASSUMED THAT IS ONLY HELD WITH A READ LOCK WHEN */ 1867 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */ 1868 /* */ 1869 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */ 1870 /* the packet is of said protocol */ 1871 /* ------------------------------------------------------------------------ */ 1872 nat_t * 1873 ipf_nat6_inlookup(fr_info_t *fin, u_int flags, u_int p, struct in6_addr *src, 1874 struct in6_addr *mapdst) 1875 { 1876 ipf_main_softc_t *softc = fin->fin_main_soft; 1877 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 1878 u_short sport, dport; 1879 nat_t *nat; 1880 int nflags; 1881 i6addr_t dst; 1882 void *ifp; 1883 u_int hv; 1884 1885 ifp = fin->fin_ifp; 1886 sport = 0; 1887 dport = 0; 1888 dst.in6 = *mapdst; 1889 1890 switch (p) 1891 { 1892 case IPPROTO_TCP : 1893 case IPPROTO_UDP : 1894 sport = htons(fin->fin_data[0]); 1895 dport = htons(fin->fin_data[1]); 1896 break; 1897 case IPPROTO_ICMPV6 : 1898 if (flags & IPN_ICMPERR) 1899 sport = fin->fin_data[1]; 1900 else 1901 dport = fin->fin_data[1]; 1902 break; 1903 default : 1904 break; 1905 } 1906 1907 1908 if ((flags & SI_WILDP) != 0) 1909 goto find_in_wild_ports; 1910 1911 hv = NAT_HASH_FN6(&dst, dport, 0xffffffff); 1912 hv = NAT_HASH_FN6(src, hv + sport, softn->ipf_nat_table_sz); 1913 nat = softn->ipf_nat_table[1][hv]; 1914 /* TRACE dst, dport, src, sport, hv, nat */ 1915 1916 for (; nat; nat = nat->nat_hnext[1]) { 1917 if (nat->nat_ifps[0] != NULL) { 1918 if ((ifp != NULL) && (ifp != nat->nat_ifps[0])) 1919 continue; 1920 } 1921 1922 if (nat->nat_pr[0] != p) 1923 continue; 1924 1925 switch (nat->nat_dir) 1926 { 1927 case NAT_INBOUND : 1928 if (nat->nat_v[0] != 6) 1929 continue; 1930 if (IP6_NEQ(&nat->nat_osrc6, src) || 1931 IP6_NEQ(&nat->nat_odst6, &dst)) 1932 continue; 1933 if ((nat->nat_flags & IPN_TCPUDP) != 0) { 1934 if (nat->nat_osport != sport) 1935 continue; 1936 if (nat->nat_odport != dport) 1937 continue; 1938 1939 } else if (p == IPPROTO_ICMPV6) { 1940 if (nat->nat_osport != dport) { 1941 continue; 1942 } 1943 } 1944 break; 1945 case NAT_OUTBOUND : 1946 if (nat->nat_v[1] != 6) 1947 continue; 1948 if (IP6_NEQ(&nat->nat_ndst6, src) || 1949 IP6_NEQ(&nat->nat_nsrc6, &dst)) 1950 continue; 1951 if ((nat->nat_flags & IPN_TCPUDP) != 0) { 1952 if (nat->nat_ndport != sport) 1953 continue; 1954 if (nat->nat_nsport != dport) 1955 continue; 1956 1957 } else if (p == IPPROTO_ICMPV6) { 1958 if (nat->nat_osport != dport) { 1959 continue; 1960 } 1961 } 1962 break; 1963 } 1964 1965 1966 if ((nat->nat_flags & IPN_TCPUDP) != 0) { 1967 #ifdef IPF_V6_PROXIES 1968 if ((nat->nat_ptr != NULL) && (nat->nat_aps != NULL)) 1969 if (appr_match(fin, nat) != 0) 1970 continue; 1971 #endif 1972 } 1973 if ((nat->nat_ifps[0] == NULL) && (ifp != NULL)) { 1974 nat->nat_ifps[0] = ifp; 1975 nat->nat_mtu[0] = GETIFMTU_6(ifp); 1976 } 1977 return nat; 1978 } 1979 1980 /* 1981 * So if we didn't find it but there are wildcard members in the hash 1982 * table, go back and look for them. We do this search and update here 1983 * because it is modifying the NAT table and we want to do this only 1984 * for the first packet that matches. The exception, of course, is 1985 * for "dummy" (FI_IGNORE) lookups. 1986 */ 1987 find_in_wild_ports: 1988 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) { 1989 NBUMPSIDE6DX(0, ns_lookup_miss, ns_lookup_miss_1); 1990 return NULL; 1991 } 1992 if (softn->ipf_nat_stats.ns_wilds == 0 || (fin->fin_flx & FI_NOWILD)) { 1993 NBUMPSIDE6D(0, ns_lookup_nowild); 1994 return NULL; 1995 } 1996 1997 RWLOCK_EXIT(&softc->ipf_nat); 1998 1999 hv = NAT_HASH_FN6(&dst, 0, 0xffffffff); 2000 hv = NAT_HASH_FN6(src, hv, softn->ipf_nat_table_sz); 2001 WRITE_ENTER(&softc->ipf_nat); 2002 2003 nat = softn->ipf_nat_table[1][hv]; 2004 /* TRACE dst, src, hv, nat */ 2005 for (; nat; nat = nat->nat_hnext[1]) { 2006 if (nat->nat_ifps[0] != NULL) { 2007 if ((ifp != NULL) && (ifp != nat->nat_ifps[0])) 2008 continue; 2009 } 2010 2011 if (nat->nat_pr[0] != fin->fin_p) 2012 continue; 2013 2014 switch (nat->nat_dir) 2015 { 2016 case NAT_INBOUND : 2017 if (nat->nat_v[0] != 6) 2018 continue; 2019 if (IP6_NEQ(&nat->nat_osrc6, src) || 2020 IP6_NEQ(&nat->nat_odst6, &dst)) 2021 continue; 2022 break; 2023 case NAT_OUTBOUND : 2024 if (nat->nat_v[1] != 6) 2025 continue; 2026 if (IP6_NEQ(&nat->nat_ndst6, src) || 2027 IP6_NEQ(&nat->nat_nsrc6, &dst)) 2028 continue; 2029 break; 2030 } 2031 2032 nflags = nat->nat_flags; 2033 if (!(nflags & (NAT_TCPUDP|SI_WILDP))) 2034 continue; 2035 2036 if (ipf_nat_wildok(nat, (int)sport, (int)dport, nflags, 2037 NAT_INBOUND) == 1) { 2038 if ((fin->fin_flx & FI_IGNORE) != 0) 2039 break; 2040 if ((nflags & SI_CLONE) != 0) { 2041 nat = ipf_nat_clone(fin, nat); 2042 if (nat == NULL) 2043 break; 2044 } else { 2045 MUTEX_ENTER(&softn->ipf_nat_new); 2046 softn->ipf_nat_stats.ns_wilds--; 2047 MUTEX_EXIT(&softn->ipf_nat_new); 2048 } 2049 2050 if (nat->nat_dir == NAT_INBOUND) { 2051 if (nat->nat_osport == 0) { 2052 nat->nat_osport = sport; 2053 nat->nat_nsport = sport; 2054 } 2055 if (nat->nat_odport == 0) { 2056 nat->nat_odport = dport; 2057 nat->nat_ndport = dport; 2058 } 2059 } else { 2060 if (nat->nat_osport == 0) { 2061 nat->nat_osport = dport; 2062 nat->nat_nsport = dport; 2063 } 2064 if (nat->nat_odport == 0) { 2065 nat->nat_odport = sport; 2066 nat->nat_ndport = sport; 2067 } 2068 } 2069 if ((nat->nat_ifps[0] == NULL) && (ifp != NULL)) { 2070 nat->nat_ifps[0] = ifp; 2071 nat->nat_mtu[0] = GETIFMTU_6(ifp); 2072 } 2073 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT); 2074 ipf_nat6_tabmove(softn, nat); 2075 break; 2076 } 2077 } 2078 2079 MUTEX_DOWNGRADE(&softc->ipf_nat); 2080 2081 if (nat == NULL) { 2082 NBUMPSIDE6DX(0, ns_lookup_miss, ns_lookup_miss_2); 2083 } 2084 return nat; 2085 } 2086 2087 2088 /* ------------------------------------------------------------------------ */ 2089 /* Function: ipf_nat6_tabmove */ 2090 /* Returns: Nil */ 2091 /* Parameters: nat(I) - pointer to NAT structure */ 2092 /* Write Lock: ipf_nat */ 2093 /* */ 2094 /* This function is only called for TCP/UDP NAT table entries where the */ 2095 /* original was placed in the table without hashing on the ports and we now */ 2096 /* want to include hashing on port numbers. */ 2097 /* ------------------------------------------------------------------------ */ 2098 static void 2099 ipf_nat6_tabmove(ipf_nat_softc_t *softn, nat_t *nat) 2100 { 2101 u_int rhv0, rhv1, hv0, hv1; 2102 nat_t **natp; 2103 2104 if (nat->nat_flags & SI_CLONE) 2105 return; 2106 2107 /* 2108 * Remove the NAT entry from the old location 2109 */ 2110 if (nat->nat_hnext[0]) 2111 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; 2112 *nat->nat_phnext[0] = nat->nat_hnext[0]; 2113 softn->ipf_nat_stats.ns_side[0].ns_bucketlen[nat->nat_hv[0]]--; 2114 2115 if (nat->nat_hnext[1]) 2116 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; 2117 *nat->nat_phnext[1] = nat->nat_hnext[1]; 2118 softn->ipf_nat_stats.ns_side[1].ns_bucketlen[nat->nat_hv[1]]--; 2119 2120 /* 2121 * Add into the NAT table in the new position 2122 */ 2123 rhv0 = NAT_HASH_FN6(&nat->nat_osrc6, nat->nat_osport, 0xffffffff); 2124 rhv0 = NAT_HASH_FN6(&nat->nat_odst6, rhv0 + nat->nat_odport, 2125 softn->ipf_nat_table_sz); 2126 rhv1 = NAT_HASH_FN6(&nat->nat_nsrc6, nat->nat_nsport, 0xffffffff); 2127 rhv1 = NAT_HASH_FN6(&nat->nat_ndst6, rhv1 + nat->nat_ndport, 2128 softn->ipf_nat_table_sz); 2129 2130 if ((nat->nat_dir & NAT_OUTBOUND) == NAT_OUTBOUND) { 2131 nat->nat_hv[0] = rhv0; 2132 nat->nat_hv[1] = rhv1; 2133 } else { 2134 nat->nat_hv[0] = rhv1; 2135 nat->nat_hv[1] = rhv0; 2136 } 2137 2138 hv0 = nat->nat_hv[0] % softn->ipf_nat_table_sz; 2139 hv1 = nat->nat_hv[1] % softn->ipf_nat_table_sz; 2140 2141 /* TRACE nat_osrc6, nat_osport, nat_odst6, nat_odport, hv0 */ 2142 /* TRACE nat_nsrc6, nat_nsport, nat_ndst6, nat_ndport, hv1 */ 2143 2144 natp = &softn->ipf_nat_table[0][hv0]; 2145 if (*natp) 2146 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 2147 nat->nat_phnext[0] = natp; 2148 nat->nat_hnext[0] = *natp; 2149 *natp = nat; 2150 softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0]++; 2151 2152 natp = &softn->ipf_nat_table[1][hv1]; 2153 if (*natp) 2154 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 2155 nat->nat_phnext[1] = natp; 2156 nat->nat_hnext[1] = *natp; 2157 *natp = nat; 2158 softn->ipf_nat_stats.ns_side[1].ns_bucketlen[hv1]++; 2159 } 2160 2161 2162 /* ------------------------------------------------------------------------ */ 2163 /* Function: ipf_nat6_outlookup */ 2164 /* Returns: nat6_t* - NULL == no match, */ 2165 /* else pointer to matching NAT entry */ 2166 /* Parameters: fin(I) - pointer to packet information */ 2167 /* flags(I) - NAT flags for this packet */ 2168 /* p(I) - protocol for this packet */ 2169 /* src(I) - source IP address */ 2170 /* dst(I) - destination IP address */ 2171 /* rw(I) - 1 == write lock on held, 0 == read lock. */ 2172 /* */ 2173 /* Lookup a nat entry based on the source 'real' ip address/port and */ 2174 /* destination address/port. We use this lookup when sending a packet out, */ 2175 /* we're looking for a table entry, based on the source address. */ 2176 /* */ 2177 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */ 2178 /* */ 2179 /* NOTE: IT IS ASSUMED THAT IS ONLY HELD WITH A READ LOCK WHEN */ 2180 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */ 2181 /* */ 2182 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */ 2183 /* the packet is of said protocol */ 2184 /* ------------------------------------------------------------------------ */ 2185 nat_t * 2186 ipf_nat6_outlookup(fr_info_t *fin, u_int flags, u_int p, struct in6_addr *src, 2187 struct in6_addr *dst) 2188 { 2189 ipf_main_softc_t *softc = fin->fin_main_soft; 2190 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 2191 u_short sport, dport; 2192 nat_t *nat; 2193 void *ifp; 2194 u_int hv; 2195 2196 ifp = fin->fin_ifp; 2197 sport = 0; 2198 dport = 0; 2199 2200 switch (p) 2201 { 2202 case IPPROTO_TCP : 2203 case IPPROTO_UDP : 2204 sport = htons(fin->fin_data[0]); 2205 dport = htons(fin->fin_data[1]); 2206 break; 2207 case IPPROTO_ICMPV6 : 2208 if (flags & IPN_ICMPERR) 2209 sport = fin->fin_data[1]; 2210 else 2211 dport = fin->fin_data[1]; 2212 break; 2213 default : 2214 break; 2215 } 2216 2217 if ((flags & SI_WILDP) != 0) 2218 goto find_out_wild_ports; 2219 2220 hv = NAT_HASH_FN6(src, sport, 0xffffffff); 2221 hv = NAT_HASH_FN6(dst, hv + dport, softn->ipf_nat_table_sz); 2222 nat = softn->ipf_nat_table[0][hv]; 2223 2224 /* TRACE src, sport, dst, dport, hv, nat */ 2225 2226 for (; nat; nat = nat->nat_hnext[0]) { 2227 if (nat->nat_ifps[1] != NULL) { 2228 if ((ifp != NULL) && (ifp != nat->nat_ifps[1])) 2229 continue; 2230 } 2231 2232 if (nat->nat_pr[1] != p) 2233 continue; 2234 2235 switch (nat->nat_dir) 2236 { 2237 case NAT_INBOUND : 2238 if (nat->nat_v[1] != 6) 2239 continue; 2240 if (IP6_NEQ(&nat->nat_ndst6, src) || 2241 IP6_NEQ(&nat->nat_nsrc6, dst)) 2242 continue; 2243 2244 if ((nat->nat_flags & IPN_TCPUDP) != 0) { 2245 if (nat->nat_ndport != sport) 2246 continue; 2247 if (nat->nat_nsport != dport) 2248 continue; 2249 2250 } else if (p == IPPROTO_ICMPV6) { 2251 if (nat->nat_osport != dport) { 2252 continue; 2253 } 2254 } 2255 break; 2256 case NAT_OUTBOUND : 2257 if (nat->nat_v[0] != 6) 2258 continue; 2259 if (IP6_NEQ(&nat->nat_osrc6, src) || 2260 IP6_NEQ(&nat->nat_odst6, dst)) 2261 continue; 2262 2263 if ((nat->nat_flags & IPN_TCPUDP) != 0) { 2264 if (nat->nat_odport != dport) 2265 continue; 2266 if (nat->nat_osport != sport) 2267 continue; 2268 2269 } else if (p == IPPROTO_ICMPV6) { 2270 if (nat->nat_osport != dport) { 2271 continue; 2272 } 2273 } 2274 break; 2275 } 2276 2277 #ifdef IPF_V6_PROXIES 2278 if ((nat->nat_ptr != NULL) && (nat->nat_aps != NULL)) 2279 if (appr_match(fin, nat) != 0) 2280 continue; 2281 #endif 2282 2283 if ((nat->nat_ifps[1] == NULL) && (ifp != NULL)) { 2284 nat->nat_ifps[1] = ifp; 2285 nat->nat_mtu[1] = GETIFMTU_6(ifp); 2286 } 2287 return nat; 2288 } 2289 2290 /* 2291 * So if we didn't find it but there are wildcard members in the hash 2292 * table, go back and look for them. We do this search and update here 2293 * because it is modifying the NAT table and we want to do this only 2294 * for the first packet that matches. The exception, of course, is 2295 * for "dummy" (FI_IGNORE) lookups. 2296 */ 2297 find_out_wild_ports: 2298 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) { 2299 NBUMPSIDE6DX(1, ns_lookup_miss, ns_lookup_miss_3); 2300 return NULL; 2301 } 2302 if (softn->ipf_nat_stats.ns_wilds == 0 || (fin->fin_flx & FI_NOWILD)) { 2303 NBUMPSIDE6D(1, ns_lookup_nowild); 2304 return NULL; 2305 } 2306 2307 RWLOCK_EXIT(&softc->ipf_nat); 2308 2309 hv = NAT_HASH_FN6(src, 0, 0xffffffff); 2310 hv = NAT_HASH_FN6(dst, hv, softn->ipf_nat_table_sz); 2311 2312 WRITE_ENTER(&softc->ipf_nat); 2313 2314 nat = softn->ipf_nat_table[0][hv]; 2315 for (; nat; nat = nat->nat_hnext[0]) { 2316 if (nat->nat_ifps[1] != NULL) { 2317 if ((ifp != NULL) && (ifp != nat->nat_ifps[1])) 2318 continue; 2319 } 2320 2321 if (nat->nat_pr[1] != fin->fin_p) 2322 continue; 2323 2324 switch (nat->nat_dir) 2325 { 2326 case NAT_INBOUND : 2327 if (nat->nat_v[1] != 6) 2328 continue; 2329 if (IP6_NEQ(&nat->nat_ndst6, src) || 2330 IP6_NEQ(&nat->nat_nsrc6, dst)) 2331 continue; 2332 break; 2333 case NAT_OUTBOUND : 2334 if (nat->nat_v[0] != 6) 2335 continue; 2336 if (IP6_NEQ(&nat->nat_osrc6, src) || 2337 IP6_NEQ(&nat->nat_odst6, dst)) 2338 continue; 2339 break; 2340 } 2341 2342 if (!(nat->nat_flags & (NAT_TCPUDP|SI_WILDP))) 2343 continue; 2344 2345 if (ipf_nat_wildok(nat, (int)sport, (int)dport, nat->nat_flags, 2346 NAT_OUTBOUND) == 1) { 2347 if ((fin->fin_flx & FI_IGNORE) != 0) 2348 break; 2349 if ((nat->nat_flags & SI_CLONE) != 0) { 2350 nat = ipf_nat_clone(fin, nat); 2351 if (nat == NULL) 2352 break; 2353 } else { 2354 MUTEX_ENTER(&softn->ipf_nat_new); 2355 softn->ipf_nat_stats.ns_wilds--; 2356 MUTEX_EXIT(&softn->ipf_nat_new); 2357 } 2358 2359 if (nat->nat_dir == NAT_OUTBOUND) { 2360 if (nat->nat_osport == 0) { 2361 nat->nat_osport = sport; 2362 nat->nat_nsport = sport; 2363 } 2364 if (nat->nat_odport == 0) { 2365 nat->nat_odport = dport; 2366 nat->nat_ndport = dport; 2367 } 2368 } else { 2369 if (nat->nat_osport == 0) { 2370 nat->nat_osport = dport; 2371 nat->nat_nsport = dport; 2372 } 2373 if (nat->nat_odport == 0) { 2374 nat->nat_odport = sport; 2375 nat->nat_ndport = sport; 2376 } 2377 } 2378 if ((nat->nat_ifps[1] == NULL) && (ifp != NULL)) { 2379 nat->nat_ifps[1] = ifp; 2380 nat->nat_mtu[1] = GETIFMTU_6(ifp); 2381 } 2382 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT); 2383 ipf_nat6_tabmove(softn, nat); 2384 break; 2385 } 2386 } 2387 2388 MUTEX_DOWNGRADE(&softc->ipf_nat); 2389 2390 if (nat == NULL) { 2391 NBUMPSIDE6DX(1, ns_lookup_miss, ns_lookup_miss_4); 2392 } 2393 return nat; 2394 } 2395 2396 2397 /* ------------------------------------------------------------------------ */ 2398 /* Function: ipf_nat6_lookupredir */ 2399 /* Returns: nat6_t* - NULL == no match, */ 2400 /* else pointer to matching NAT entry */ 2401 /* Parameters: np(I) - pointer to description of packet to find NAT table */ 2402 /* entry for. */ 2403 /* */ 2404 /* Lookup the NAT tables to search for a matching redirect */ 2405 /* The contents of natlookup_t should imitate those found in a packet that */ 2406 /* would be translated - ie a packet coming in for RDR or going out for MAP.*/ 2407 /* We can do the lookup in one of two ways, imitating an inbound or */ 2408 /* outbound packet. By default we assume outbound, unless IPN_IN is set. */ 2409 /* For IN, the fields are set as follows: */ 2410 /* nl_real* = source information */ 2411 /* nl_out* = destination information (translated) */ 2412 /* For an out packet, the fields are set like this: */ 2413 /* nl_in* = source information (untranslated) */ 2414 /* nl_out* = destination information (translated) */ 2415 /* ------------------------------------------------------------------------ */ 2416 nat_t * 2417 ipf_nat6_lookupredir(ipf_main_softc_t *softc, natlookup_t *np) 2418 { 2419 fr_info_t fi; 2420 nat_t *nat; 2421 2422 bzero((char *)&fi, sizeof(fi)); 2423 fi.fin_main_soft = softc; 2424 if (np->nl_flags & IPN_IN) { 2425 fi.fin_data[0] = ntohs(np->nl_realport); 2426 fi.fin_data[1] = ntohs(np->nl_outport); 2427 } else { 2428 fi.fin_data[0] = ntohs(np->nl_inport); 2429 fi.fin_data[1] = ntohs(np->nl_outport); 2430 } 2431 if (np->nl_flags & IPN_TCP) 2432 fi.fin_p = IPPROTO_TCP; 2433 else if (np->nl_flags & IPN_UDP) 2434 fi.fin_p = IPPROTO_UDP; 2435 else if (np->nl_flags & (IPN_ICMPERR|IPN_ICMPQUERY)) 2436 fi.fin_p = IPPROTO_ICMPV6; 2437 2438 /* 2439 * We can do two sorts of lookups: 2440 * - IPN_IN: we have the `real' and `out' address, look for `in'. 2441 * - default: we have the `in' and `out' address, look for `real'. 2442 */ 2443 if (np->nl_flags & IPN_IN) { 2444 if ((nat = ipf_nat6_inlookup(&fi, np->nl_flags, fi.fin_p, 2445 &np->nl_realip6, 2446 &np->nl_outip6))) { 2447 np->nl_inip6 = nat->nat_odst6.in6; 2448 np->nl_inport = nat->nat_odport; 2449 } 2450 } else { 2451 /* 2452 * If nl_inip is non null, this is a lookup based on the real 2453 * ip address. Else, we use the fake. 2454 */ 2455 if ((nat = ipf_nat6_outlookup(&fi, np->nl_flags, fi.fin_p, 2456 &np->nl_inip6, &np->nl_outip6))) { 2457 2458 if ((np->nl_flags & IPN_FINDFORWARD) != 0) { 2459 fr_info_t fin; 2460 bzero((char *)&fin, sizeof(fin)); 2461 fin.fin_p = nat->nat_pr[0]; 2462 fin.fin_data[0] = ntohs(nat->nat_ndport); 2463 fin.fin_data[1] = ntohs(nat->nat_nsport); 2464 if (ipf_nat6_inlookup(&fin, np->nl_flags, 2465 fin.fin_p, 2466 &nat->nat_ndst6.in6, 2467 &nat->nat_nsrc6.in6) != 2468 NULL) { 2469 np->nl_flags &= ~IPN_FINDFORWARD; 2470 } 2471 } 2472 2473 np->nl_realip6 = nat->nat_ndst6.in6; 2474 np->nl_realport = nat->nat_ndport; 2475 } 2476 } 2477 2478 return nat; 2479 } 2480 2481 2482 /* ------------------------------------------------------------------------ */ 2483 /* Function: ipf_nat6_match */ 2484 /* Returns: int - 0 == no match, 1 == match */ 2485 /* Parameters: fin(I) - pointer to packet information */ 2486 /* np(I) - pointer to NAT rule */ 2487 /* */ 2488 /* Pull the matching of a packet against a NAT rule out of that complex */ 2489 /* loop inside ipf_nat6_checkin() and lay it out properly in its own */ 2490 /* function. */ 2491 /* ------------------------------------------------------------------------ */ 2492 static int 2493 ipf_nat6_match(fr_info_t *fin, ipnat_t *np) 2494 { 2495 frtuc_t *ft; 2496 int match; 2497 2498 match = 0; 2499 switch (np->in_osrcatype) 2500 { 2501 case FRI_NORMAL : 2502 match = IP6_MASKNEQ(&fin->fin_src6, &np->in_osrcmsk6, 2503 &np->in_osrcip6); 2504 break; 2505 case FRI_LOOKUP : 2506 match = (*np->in_osrcfunc)(fin->fin_main_soft, np->in_osrcptr, 2507 6, &fin->fin_src6, fin->fin_plen); 2508 break; 2509 } 2510 match ^= ((np->in_flags & IPN_NOTSRC) != 0); 2511 if (match) 2512 return 0; 2513 2514 match = 0; 2515 switch (np->in_odstatype) 2516 { 2517 case FRI_NORMAL : 2518 match = IP6_MASKNEQ(&fin->fin_dst6, &np->in_odstmsk6, 2519 &np->in_odstip6); 2520 break; 2521 case FRI_LOOKUP : 2522 match = (*np->in_odstfunc)(fin->fin_main_soft, np->in_odstptr, 2523 6, &fin->fin_dst6, fin->fin_plen); 2524 break; 2525 } 2526 2527 match ^= ((np->in_flags & IPN_NOTDST) != 0); 2528 if (match) 2529 return 0; 2530 2531 ft = &np->in_tuc; 2532 if (!(fin->fin_flx & FI_TCPUDP) || 2533 (fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) { 2534 if (ft->ftu_scmp || ft->ftu_dcmp) 2535 return 0; 2536 return 1; 2537 } 2538 2539 return ipf_tcpudpchk(&fin->fin_fi, ft); 2540 } 2541 2542 2543 /* ------------------------------------------------------------------------ */ 2544 /* Function: ipf_nat6_checkout */ 2545 /* Returns: int - -1 == packet failed NAT checks so block it, */ 2546 /* 0 == no packet translation occurred, */ 2547 /* 1 == packet was successfully translated. */ 2548 /* Parameters: fin(I) - pointer to packet information */ 2549 /* passp(I) - pointer to filtering result flags */ 2550 /* */ 2551 /* Check to see if an outcoming packet should be changed. ICMP packets are */ 2552 /* first checked to see if they match an existing entry (if an error), */ 2553 /* otherwise a search of the current NAT table is made. If neither results */ 2554 /* in a match then a search for a matching NAT rule is made. Create a new */ 2555 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */ 2556 /* packet header(s) as required. */ 2557 /* ------------------------------------------------------------------------ */ 2558 int 2559 ipf_nat6_checkout(fr_info_t *fin, u_32_t *passp) 2560 { 2561 ipf_main_softc_t *softc = fin->fin_main_soft; 2562 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 2563 struct icmp6_hdr *icmp6 = NULL; 2564 struct ifnet *ifp, *sifp; 2565 #ifdef IPF_V6_PROXIES 2566 tcphdr_t *tcp = NULL; 2567 #endif 2568 int rval, natfailed; 2569 ipnat_t *np = NULL; 2570 u_int nflags = 0; 2571 i6addr_t ipa, iph; 2572 int natadd = 1; 2573 frentry_t *fr; 2574 nat_t *nat; 2575 2576 if (softn->ipf_nat_stats.ns_rules == 0 || softn->ipf_nat_lock != 0) 2577 return 0; 2578 2579 icmp6 = NULL; 2580 natfailed = 0; 2581 fr = fin->fin_fr; 2582 sifp = fin->fin_ifp; 2583 if (fr != NULL) { 2584 ifp = fr->fr_tifs[fin->fin_rev].fd_ptr; 2585 if ((ifp != NULL) && (ifp != (void *)-1)) 2586 fin->fin_ifp = ifp; 2587 } 2588 ifp = fin->fin_ifp; 2589 2590 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 2591 switch (fin->fin_p) 2592 { 2593 case IPPROTO_TCP : 2594 nflags = IPN_TCP; 2595 break; 2596 case IPPROTO_UDP : 2597 nflags = IPN_UDP; 2598 break; 2599 case IPPROTO_ICMPV6 : 2600 icmp6 = fin->fin_dp; 2601 2602 /* 2603 * Apart from ECHO request and reply, all other 2604 * informational messages should not be translated 2605 * so as to keep IPv6 working. 2606 */ 2607 if (icmp6->icmp6_type > ICMP6_ECHO_REPLY) 2608 return 0; 2609 2610 /* 2611 * This is an incoming packet, so the destination is 2612 * the icmp6_id and the source port equals 0 2613 */ 2614 if ((fin->fin_flx & FI_ICMPQUERY) != 0) 2615 nflags = IPN_ICMPQUERY; 2616 break; 2617 default : 2618 break; 2619 } 2620 2621 #ifdef IPF_V6_PROXIES 2622 if ((nflags & IPN_TCPUDP)) 2623 tcp = fin->fin_dp; 2624 #endif 2625 } 2626 2627 ipa = fin->fin_src6; 2628 2629 READ_ENTER(&softc->ipf_nat); 2630 2631 if ((fin->fin_p == IPPROTO_ICMPV6) && !(nflags & IPN_ICMPQUERY) && 2632 (nat = ipf_nat6_icmperror(fin, &nflags, NAT_OUTBOUND))) 2633 /*EMPTY*/; 2634 else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin))) 2635 natadd = 0; 2636 else if ((nat = ipf_nat6_outlookup(fin, nflags|NAT_SEARCH, 2637 (u_int)fin->fin_p, 2638 &fin->fin_src6.in6, 2639 &fin->fin_dst6.in6))) { 2640 nflags = nat->nat_flags; 2641 } else if (fin->fin_off == 0) { 2642 u_32_t hv, nmsk = 0; 2643 i6addr_t *msk; 2644 2645 /* 2646 * If there is no current entry in the nat table for this IP#, 2647 * create one for it (if there is a matching rule). 2648 */ 2649 maskloop: 2650 msk = &softn->ipf_nat6_map_active_masks[nmsk]; 2651 IP6_AND(&ipa, msk, &iph); 2652 hv = NAT_HASH_FN6(&iph, 0, softn->ipf_nat_maprules_sz); 2653 for (np = softn->ipf_nat_map_rules[hv]; np; np = np->in_mnext) { 2654 if ((np->in_ifps[1] && (np->in_ifps[1] != ifp))) 2655 continue; 2656 if (np->in_v[0] != 6) 2657 continue; 2658 if (np->in_pr[1] && (np->in_pr[1] != fin->fin_p)) 2659 continue; 2660 if ((np->in_flags & IPN_RF) && 2661 !(np->in_flags & nflags)) 2662 continue; 2663 if (np->in_flags & IPN_FILTER) { 2664 switch (ipf_nat6_match(fin, np)) 2665 { 2666 case 0 : 2667 continue; 2668 case -1 : 2669 rval = -1; 2670 goto outmatchfail; 2671 case 1 : 2672 default : 2673 break; 2674 } 2675 } else if (!IP6_MASKEQ(&ipa, &np->in_osrcmsk, 2676 &np->in_osrcip6)) 2677 continue; 2678 2679 if ((fr != NULL) && 2680 !ipf_matchtag(&np->in_tag, &fr->fr_nattag)) 2681 continue; 2682 2683 #ifdef IPF_V6_PROXIES 2684 if (np->in_plabel != -1) { 2685 if (((np->in_flags & IPN_FILTER) == 0) && 2686 (np->in_odport != fin->fin_data[1])) 2687 continue; 2688 if (appr_ok(fin, tcp, np) == 0) 2689 continue; 2690 } 2691 #endif 2692 2693 if (np->in_flags & IPN_NO) { 2694 np->in_hits++; 2695 break; 2696 } 2697 2698 MUTEX_ENTER(&softn->ipf_nat_new); 2699 nat = ipf_nat6_add(fin, np, NULL, nflags, NAT_OUTBOUND); 2700 MUTEX_EXIT(&softn->ipf_nat_new); 2701 if (nat != NULL) { 2702 np->in_hits++; 2703 break; 2704 } 2705 natfailed = -1; 2706 } 2707 if ((np == NULL) && (nmsk < softn->ipf_nat6_map_max)) { 2708 nmsk++; 2709 goto maskloop; 2710 } 2711 } 2712 2713 if (nat != NULL) { 2714 rval = ipf_nat6_out(fin, nat, natadd, nflags); 2715 if (rval == 1) { 2716 MUTEX_ENTER(&nat->nat_lock); 2717 ipf_nat_update(fin, nat); 2718 nat->nat_bytes[1] += fin->fin_plen; 2719 nat->nat_pkts[1]++; 2720 MUTEX_EXIT(&nat->nat_lock); 2721 } 2722 } else 2723 rval = natfailed; 2724 outmatchfail: 2725 RWLOCK_EXIT(&softc->ipf_nat); 2726 2727 switch (rval) 2728 { 2729 case -1 : 2730 if (passp != NULL) { 2731 NBUMPSIDE6D(1, ns_drop); 2732 *passp = FR_BLOCK; 2733 fin->fin_reason = FRB_NATV6; 2734 } 2735 fin->fin_flx |= FI_BADNAT; 2736 NBUMPSIDE6D(1, ns_badnat); 2737 break; 2738 case 0 : 2739 NBUMPSIDE6D(1, ns_ignored); 2740 break; 2741 case 1 : 2742 NBUMPSIDE6D(1, ns_translated); 2743 break; 2744 } 2745 fin->fin_ifp = sifp; 2746 return rval; 2747 } 2748 2749 /* ------------------------------------------------------------------------ */ 2750 /* Function: ipf_nat6_out */ 2751 /* Returns: int - -1 == packet failed NAT checks so block it, */ 2752 /* 1 == packet was successfully translated. */ 2753 /* Parameters: fin(I) - pointer to packet information */ 2754 /* nat(I) - pointer to NAT structure */ 2755 /* natadd(I) - flag indicating if it is safe to add frag cache */ 2756 /* nflags(I) - NAT flags set for this packet */ 2757 /* */ 2758 /* Translate a packet coming "out" on an interface. */ 2759 /* ------------------------------------------------------------------------ */ 2760 static int 2761 ipf_nat6_out(fr_info_t *fin, nat_t *nat, int natadd, u_32_t nflags) 2762 { 2763 ipf_main_softc_t *softc = fin->fin_main_soft; 2764 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 2765 struct icmp6_hdr *icmp6; 2766 tcphdr_t *tcp; 2767 ipnat_t *np; 2768 int skip; 2769 int i; 2770 2771 tcp = NULL; 2772 icmp6 = NULL; 2773 np = nat->nat_ptr; 2774 2775 if ((natadd != 0) && (fin->fin_flx & FI_FRAG) && (np != NULL)) 2776 (void) ipf_frag_natnew(softc, fin, 0, nat); 2777 2778 /* 2779 * Address assignment is after the checksum modification because 2780 * we are using the address in the packet for determining the 2781 * correct checksum offset (the ICMP error could be coming from 2782 * anyone...) 2783 */ 2784 switch (nat->nat_dir) 2785 { 2786 case NAT_OUTBOUND : 2787 fin->fin_ip6->ip6_src = nat->nat_nsrc6.in6; 2788 fin->fin_src6 = nat->nat_nsrc6; 2789 fin->fin_ip6->ip6_dst = nat->nat_ndst6.in6; 2790 fin->fin_dst6 = nat->nat_ndst6; 2791 break; 2792 2793 case NAT_INBOUND : 2794 fin->fin_ip6->ip6_src = nat->nat_odst6.in6; 2795 fin->fin_src6 = nat->nat_ndst6; 2796 fin->fin_ip6->ip6_dst = nat->nat_osrc6.in6; 2797 fin->fin_dst6 = nat->nat_nsrc6; 2798 break; 2799 2800 case NAT_DIVERTIN : 2801 { 2802 mb_t *m; 2803 2804 skip = ipf_nat6_decap(fin, nat); 2805 if (skip <= 0) { 2806 NBUMPSIDE6D(1, ns_decap_fail); 2807 return -1; 2808 } 2809 2810 m = fin->fin_m; 2811 2812 #if defined(MENTAT) && defined(_KERNEL) 2813 m->b_rptr += skip; 2814 #else 2815 m->m_data += skip; 2816 m->m_len -= skip; 2817 2818 # ifdef M_PKTHDR 2819 if (m->m_flags & M_PKTHDR) 2820 m->m_pkthdr.len -= skip; 2821 # endif 2822 #endif 2823 2824 MUTEX_ENTER(&nat->nat_lock); 2825 ipf_nat_update(fin, nat); 2826 MUTEX_EXIT(&nat->nat_lock); 2827 fin->fin_flx |= FI_NATED; 2828 if (np != NULL && np->in_tag.ipt_num[0] != 0) 2829 fin->fin_nattag = &np->in_tag; 2830 return 1; 2831 /* NOTREACHED */ 2832 } 2833 2834 case NAT_DIVERTOUT : 2835 { 2836 udphdr_t *uh; 2837 ip6_t *ip6; 2838 mb_t *m; 2839 2840 m = M_DUP(np->in_divmp); 2841 if (m == NULL) { 2842 NBUMPSIDE6D(1, ns_divert_dup); 2843 return -1; 2844 } 2845 2846 ip6 = MTOD(m, ip6_t *); 2847 2848 ip6->ip6_plen = htons(fin->fin_plen + 8); 2849 2850 uh = (udphdr_t *)(ip6 + 1); 2851 uh->uh_ulen = htons(fin->fin_plen); 2852 2853 PREP_MB_T(fin, m); 2854 2855 fin->fin_ip6 = ip6; 2856 fin->fin_plen += sizeof(ip6_t) + 8; /* UDP + new IPv4 hdr */ 2857 fin->fin_dlen += sizeof(ip6_t) + 8; /* UDP + old IPv4 hdr */ 2858 2859 nflags &= ~IPN_TCPUDPICMP; 2860 2861 break; 2862 } 2863 2864 default : 2865 break; 2866 } 2867 2868 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 2869 u_short *csump; 2870 2871 if ((nat->nat_nsport != 0) && (nflags & IPN_TCPUDP)) { 2872 tcp = fin->fin_dp; 2873 2874 switch (nat->nat_dir) 2875 { 2876 case NAT_OUTBOUND : 2877 tcp->th_sport = nat->nat_nsport; 2878 fin->fin_data[0] = ntohs(nat->nat_nsport); 2879 tcp->th_dport = nat->nat_ndport; 2880 fin->fin_data[1] = ntohs(nat->nat_ndport); 2881 break; 2882 2883 case NAT_INBOUND : 2884 tcp->th_sport = nat->nat_odport; 2885 fin->fin_data[0] = ntohs(nat->nat_odport); 2886 tcp->th_dport = nat->nat_osport; 2887 fin->fin_data[1] = ntohs(nat->nat_osport); 2888 break; 2889 } 2890 } 2891 2892 if ((nat->nat_nsport != 0) && (nflags & IPN_ICMPQUERY)) { 2893 icmp6 = fin->fin_dp; 2894 icmp6->icmp6_id = nat->nat_nicmpid; 2895 } 2896 2897 csump = ipf_nat_proto(fin, nat, nflags); 2898 2899 /* 2900 * The above comments do not hold for layer 4 (or higher) 2901 * checksums... 2902 */ 2903 if (csump != NULL) { 2904 if (nat->nat_dir == NAT_OUTBOUND) 2905 ipf_fix_outcksum(fin->fin_cksum, csump, 2906 nat->nat_sumd[0], 2907 nat->nat_sumd[1] + 2908 fin->fin_dlen); 2909 else 2910 ipf_fix_incksum(fin->fin_cksum, csump, 2911 nat->nat_sumd[0], 2912 nat->nat_sumd[1] + 2913 fin->fin_dlen); 2914 } 2915 } 2916 2917 ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync); 2918 /* ------------------------------------------------------------- */ 2919 /* A few quick notes: */ 2920 /* Following are test conditions prior to calling the */ 2921 /* ipf_proxy_check routine. */ 2922 /* */ 2923 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ 2924 /* with a redirect rule, we attempt to match the packet's */ 2925 /* source port against in_dport, otherwise we'd compare the */ 2926 /* packet's destination. */ 2927 /* ------------------------------------------------------------- */ 2928 if ((np != NULL) && (np->in_apr != NULL)) { 2929 i = ipf_proxy_check(fin, nat); 2930 if (i == 0) { 2931 i = 1; 2932 } else if (i == -1) { 2933 NBUMPSIDE6D(1, ns_ipf_proxy_fail); 2934 } 2935 } else { 2936 i = 1; 2937 } 2938 fin->fin_flx |= FI_NATED; 2939 return i; 2940 } 2941 2942 2943 /* ------------------------------------------------------------------------ */ 2944 /* Function: ipf_nat6_checkin */ 2945 /* Returns: int - -1 == packet failed NAT checks so block it, */ 2946 /* 0 == no packet translation occurred, */ 2947 /* 1 == packet was successfully translated. */ 2948 /* Parameters: fin(I) - pointer to packet information */ 2949 /* passp(I) - pointer to filtering result flags */ 2950 /* */ 2951 /* Check to see if an incoming packet should be changed. ICMP packets are */ 2952 /* first checked to see if they match an existing entry (if an error), */ 2953 /* otherwise a search of the current NAT table is made. If neither results */ 2954 /* in a match then a search for a matching NAT rule is made. Create a new */ 2955 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */ 2956 /* packet header(s) as required. */ 2957 /* ------------------------------------------------------------------------ */ 2958 int 2959 ipf_nat6_checkin(fr_info_t *fin, u_32_t *passp) 2960 { 2961 ipf_main_softc_t *softc = fin->fin_main_soft; 2962 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 2963 struct icmp6_hdr *icmp6; 2964 u_int nflags, natadd; 2965 int rval, natfailed; 2966 struct ifnet *ifp; 2967 i6addr_t ipa, iph; 2968 #ifdef IPF_V6_PROXIES 2969 tcphdr_t *tcp; 2970 #endif 2971 u_short dport; 2972 ipnat_t *np; 2973 nat_t *nat; 2974 2975 if (softn->ipf_nat_stats.ns_rules == 0 || softn->ipf_nat_lock != 0) 2976 return 0; 2977 2978 #ifdef IPF_V6_PROXIES 2979 tcp = NULL; 2980 #endif 2981 icmp6 = NULL; 2982 dport = 0; 2983 natadd = 1; 2984 nflags = 0; 2985 natfailed = 0; 2986 ifp = fin->fin_ifp; 2987 2988 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 2989 switch (fin->fin_p) 2990 { 2991 case IPPROTO_TCP : 2992 nflags = IPN_TCP; 2993 break; 2994 case IPPROTO_UDP : 2995 nflags = IPN_UDP; 2996 break; 2997 case IPPROTO_ICMPV6 : 2998 icmp6 = fin->fin_dp; 2999 3000 /* 3001 * Apart from ECHO request and reply, all other 3002 * informational messages should not be translated 3003 * so as to keep IPv6 working. 3004 */ 3005 if (icmp6->icmp6_type > ICMP6_ECHO_REPLY) 3006 return 0; 3007 3008 /* 3009 * This is an incoming packet, so the destination is 3010 * the icmp6_id and the source port equals 0 3011 */ 3012 if ((fin->fin_flx & FI_ICMPQUERY) != 0) { 3013 nflags = IPN_ICMPQUERY; 3014 dport = icmp6->icmp6_id; 3015 } break; 3016 default : 3017 break; 3018 } 3019 3020 if ((nflags & IPN_TCPUDP)) { 3021 #ifdef IPF_V6_PROXIES 3022 tcp = fin->fin_dp; 3023 #endif 3024 dport = fin->fin_data[1]; 3025 } 3026 } 3027 3028 ipa = fin->fin_dst6; 3029 3030 READ_ENTER(&softc->ipf_nat); 3031 3032 if ((fin->fin_p == IPPROTO_ICMPV6) && !(nflags & IPN_ICMPQUERY) && 3033 (nat = ipf_nat6_icmperror(fin, &nflags, NAT_INBOUND))) 3034 /*EMPTY*/; 3035 else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin))) 3036 natadd = 0; 3037 else if ((nat = ipf_nat6_inlookup(fin, nflags|NAT_SEARCH, 3038 (u_int)fin->fin_p, 3039 &fin->fin_src6.in6, &ipa.in6))) { 3040 nflags = nat->nat_flags; 3041 } else if (fin->fin_off == 0) { 3042 u_32_t hv, rmsk = 0; 3043 i6addr_t *msk; 3044 3045 /* 3046 * If there is no current entry in the nat table for this IP#, 3047 * create one for it (if there is a matching rule). 3048 */ 3049 maskloop: 3050 msk = &softn->ipf_nat6_rdr_active_masks[rmsk]; 3051 IP6_AND(&ipa, msk, &iph); 3052 hv = NAT_HASH_FN6(&iph, 0, softn->ipf_nat_rdrrules_sz); 3053 for (np = softn->ipf_nat_rdr_rules[hv]; np; np = np->in_rnext) { 3054 if (np->in_ifps[0] && (np->in_ifps[0] != ifp)) 3055 continue; 3056 if (np->in_v[0] != 6) 3057 continue; 3058 if (np->in_pr[0] && (np->in_pr[0] != fin->fin_p)) 3059 continue; 3060 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags)) 3061 continue; 3062 if (np->in_flags & IPN_FILTER) { 3063 switch (ipf_nat6_match(fin, np)) 3064 { 3065 case 0 : 3066 continue; 3067 case -1 : 3068 rval = -1; 3069 goto inmatchfail; 3070 case 1 : 3071 default : 3072 break; 3073 } 3074 } else { 3075 if (!IP6_MASKEQ(&ipa, &np->in_odstmsk6, 3076 &np->in_odstip6)) { 3077 continue; 3078 } 3079 if (np->in_odport && 3080 ((np->in_dtop < dport) || 3081 (dport < np->in_odport))) 3082 continue; 3083 } 3084 3085 #ifdef IPF_V6_PROXIES 3086 if (np->in_plabel != -1) { 3087 if (!appr_ok(fin, tcp, np)) { 3088 continue; 3089 } 3090 } 3091 #endif 3092 3093 if (np->in_flags & IPN_NO) { 3094 np->in_hits++; 3095 break; 3096 } 3097 3098 MUTEX_ENTER(&softn->ipf_nat_new); 3099 nat = ipf_nat6_add(fin, np, NULL, nflags, NAT_INBOUND); 3100 MUTEX_EXIT(&softn->ipf_nat_new); 3101 if (nat != NULL) { 3102 np->in_hits++; 3103 break; 3104 } 3105 natfailed = -1; 3106 } 3107 3108 if ((np == NULL) && (rmsk < softn->ipf_nat6_rdr_max)) { 3109 rmsk++; 3110 goto maskloop; 3111 } 3112 } 3113 if (nat != NULL) { 3114 rval = ipf_nat6_in(fin, nat, natadd, nflags); 3115 if (rval == 1) { 3116 MUTEX_ENTER(&nat->nat_lock); 3117 ipf_nat_update(fin, nat); 3118 nat->nat_bytes[0] += fin->fin_plen; 3119 nat->nat_pkts[0]++; 3120 MUTEX_EXIT(&nat->nat_lock); 3121 } 3122 } else 3123 rval = natfailed; 3124 inmatchfail: 3125 RWLOCK_EXIT(&softc->ipf_nat); 3126 3127 switch (rval) 3128 { 3129 case -1 : 3130 if (passp != NULL) { 3131 NBUMPSIDE6D(0, ns_drop); 3132 *passp = FR_BLOCK; 3133 fin->fin_reason = FRB_NATV6; 3134 } 3135 fin->fin_flx |= FI_BADNAT; 3136 NBUMPSIDE6D(0, ns_badnat); 3137 break; 3138 case 0 : 3139 NBUMPSIDE6D(0, ns_ignored); 3140 break; 3141 case 1 : 3142 NBUMPSIDE6D(0, ns_translated); 3143 break; 3144 } 3145 return rval; 3146 } 3147 3148 3149 /* ------------------------------------------------------------------------ */ 3150 /* Function: ipf_nat6_in */ 3151 /* Returns: int - -1 == packet failed NAT checks so block it, */ 3152 /* 1 == packet was successfully translated. */ 3153 /* Parameters: fin(I) - pointer to packet information */ 3154 /* nat(I) - pointer to NAT structure */ 3155 /* natadd(I) - flag indicating if it is safe to add frag cache */ 3156 /* nflags(I) - NAT flags set for this packet */ 3157 /* Locks Held: (READ) */ 3158 /* */ 3159 /* Translate a packet coming "in" on an interface. */ 3160 /* ------------------------------------------------------------------------ */ 3161 static int 3162 ipf_nat6_in(fr_info_t *fin, nat_t *nat, int natadd, u_32_t nflags) 3163 { 3164 ipf_main_softc_t *softc = fin->fin_main_soft; 3165 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 3166 struct icmp6_hdr *icmp6; 3167 u_short *csump; 3168 tcphdr_t *tcp; 3169 ipnat_t *np; 3170 int skip; 3171 int i; 3172 3173 tcp = NULL; 3174 csump = NULL; 3175 np = nat->nat_ptr; 3176 fin->fin_fr = nat->nat_fr; 3177 3178 if (np != NULL) { 3179 if ((natadd != 0) && (fin->fin_flx & FI_FRAG)) 3180 (void) ipf_frag_natnew(softc, fin, 0, nat); 3181 3182 /* ------------------------------------------------------------- */ 3183 /* A few quick notes: */ 3184 /* Following are test conditions prior to calling the */ 3185 /* ipf_proxy_check routine. */ 3186 /* */ 3187 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ 3188 /* with a map rule, we attempt to match the packet's */ 3189 /* source port against in_dport, otherwise we'd compare the */ 3190 /* packet's destination. */ 3191 /* ------------------------------------------------------------- */ 3192 if (np->in_apr != NULL) { 3193 i = ipf_proxy_check(fin, nat); 3194 if (i == -1) { 3195 NBUMPSIDE6D(0, ns_ipf_proxy_fail); 3196 return -1; 3197 } 3198 } 3199 } 3200 3201 ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync); 3202 3203 /* 3204 * Fix up checksums, not by recalculating them, but 3205 * simply computing adjustments. 3206 * Why only do this for some platforms on inbound packets ? 3207 * Because for those that it is done, IP processing is yet to happen 3208 * and so the IPv4 header checksum has not yet been evaluated. 3209 * Perhaps it should always be done for the benefit of things like 3210 * fast forwarding (so that it doesn't need to be recomputed) but with 3211 * header checksum offloading, perhaps it is a moot point. 3212 */ 3213 3214 switch (nat->nat_dir) 3215 { 3216 case NAT_INBOUND : 3217 if ((fin->fin_flx & FI_ICMPERR) == 0) { 3218 fin->fin_ip6->ip6_src = nat->nat_nsrc6.in6; 3219 fin->fin_src6 = nat->nat_nsrc6; 3220 } 3221 fin->fin_ip6->ip6_dst = nat->nat_ndst6.in6; 3222 fin->fin_dst6 = nat->nat_ndst6; 3223 break; 3224 3225 case NAT_OUTBOUND : 3226 if ((fin->fin_flx & FI_ICMPERR) == 0) { 3227 fin->fin_ip6->ip6_src = nat->nat_odst6.in6; 3228 fin->fin_src6 = nat->nat_odst6; 3229 } 3230 fin->fin_ip6->ip6_dst = nat->nat_osrc6.in6; 3231 fin->fin_dst6 = nat->nat_osrc6; 3232 break; 3233 3234 case NAT_DIVERTIN : 3235 { 3236 udphdr_t *uh; 3237 ip6_t *ip6; 3238 mb_t *m; 3239 3240 m = M_DUP(np->in_divmp); 3241 if (m == NULL) { 3242 NBUMPSIDE6D(0, ns_divert_dup); 3243 return -1; 3244 } 3245 3246 ip6 = MTOD(m, ip6_t *); 3247 ip6->ip6_plen = htons(fin->fin_plen + sizeof(udphdr_t)); 3248 3249 uh = (udphdr_t *)(ip6 + 1); 3250 uh->uh_ulen = ntohs(fin->fin_plen); 3251 3252 PREP_MB_T(fin, m); 3253 3254 fin->fin_ip6 = ip6; 3255 fin->fin_plen += sizeof(ip6_t) + 8; /* UDP + new IPv6 hdr */ 3256 fin->fin_dlen += sizeof(ip6_t) + 8; /* UDP + old IPv6 hdr */ 3257 3258 nflags &= ~IPN_TCPUDPICMP; 3259 3260 break; 3261 } 3262 3263 case NAT_DIVERTOUT : 3264 { 3265 mb_t *m; 3266 3267 skip = ipf_nat6_decap(fin, nat); 3268 if (skip <= 0) { 3269 NBUMPSIDE6D(0, ns_decap_fail); 3270 return -1; 3271 } 3272 3273 m = fin->fin_m; 3274 3275 #if defined(MENTAT) && defined(_KERNEL) 3276 m->b_rptr += skip; 3277 #else 3278 m->m_data += skip; 3279 m->m_len -= skip; 3280 3281 # ifdef M_PKTHDR 3282 if (m->m_flags & M_PKTHDR) 3283 m->m_pkthdr.len -= skip; 3284 # endif 3285 #endif 3286 3287 ipf_nat_update(fin, nat); 3288 fin->fin_flx |= FI_NATED; 3289 if (np != NULL && np->in_tag.ipt_num[0] != 0) 3290 fin->fin_nattag = &np->in_tag; 3291 return 1; 3292 /* NOTREACHED */ 3293 } 3294 } 3295 if (nflags & IPN_TCPUDP) 3296 tcp = fin->fin_dp; 3297 3298 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { 3299 if ((nat->nat_odport != 0) && (nflags & IPN_TCPUDP)) { 3300 switch (nat->nat_dir) 3301 { 3302 case NAT_INBOUND : 3303 tcp->th_sport = nat->nat_nsport; 3304 fin->fin_data[0] = ntohs(nat->nat_nsport); 3305 tcp->th_dport = nat->nat_ndport; 3306 fin->fin_data[1] = ntohs(nat->nat_ndport); 3307 break; 3308 3309 case NAT_OUTBOUND : 3310 tcp->th_sport = nat->nat_odport; 3311 fin->fin_data[0] = ntohs(nat->nat_odport); 3312 tcp->th_dport = nat->nat_osport; 3313 fin->fin_data[1] = ntohs(nat->nat_osport); 3314 break; 3315 } 3316 } 3317 3318 3319 if ((nat->nat_odport != 0) && (nflags & IPN_ICMPQUERY)) { 3320 icmp6 = fin->fin_dp; 3321 3322 icmp6->icmp6_id = nat->nat_nicmpid; 3323 } 3324 3325 csump = ipf_nat_proto(fin, nat, nflags); 3326 } 3327 3328 /* 3329 * The above comments do not hold for layer 4 (or higher) checksums... 3330 */ 3331 if (csump != NULL) { 3332 if (nat->nat_dir == NAT_OUTBOUND) 3333 ipf_fix_incksum(0, csump, nat->nat_sumd[0], 0); 3334 else 3335 ipf_fix_outcksum(0, csump, nat->nat_sumd[0], 0); 3336 } 3337 fin->fin_flx |= FI_NATED; 3338 if (np != NULL && np->in_tag.ipt_num[0] != 0) 3339 fin->fin_nattag = &np->in_tag; 3340 return 1; 3341 } 3342 3343 3344 /* ------------------------------------------------------------------------ */ 3345 /* Function: ipf_nat6_newrewrite */ 3346 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */ 3347 /* allow rule to be moved if IPN_ROUNDR is set. */ 3348 /* Parameters: fin(I) - pointer to packet information */ 3349 /* nat(I) - pointer to NAT entry */ 3350 /* ni(I) - pointer to structure with misc. information needed */ 3351 /* to create new NAT entry. */ 3352 /* Write Lock: ipf_nat */ 3353 /* */ 3354 /* This function is responsible for setting up an active NAT session where */ 3355 /* we are changing both the source and destination parameters at the same */ 3356 /* time. The loop in here works differently to elsewhere - each iteration */ 3357 /* is responsible for changing a single parameter that can be incremented. */ 3358 /* So one pass may increase the source IP#, next source port, next dest. IP#*/ 3359 /* and the last destination port for a total of 4 iterations to try each. */ 3360 /* This is done to try and exhaustively use the translation space available.*/ 3361 /* ------------------------------------------------------------------------ */ 3362 int 3363 ipf_nat6_newrewrite(fr_info_t *fin, nat_t *nat, natinfo_t *nai) 3364 { 3365 int src_search = 1; 3366 int dst_search = 1; 3367 fr_info_t frnat; 3368 u_32_t flags; 3369 u_short swap; 3370 ipnat_t *np; 3371 nat_t *natl; 3372 int l = 0; 3373 int changed; 3374 3375 natl = NULL; 3376 changed = -1; 3377 np = nai->nai_np; 3378 flags = nat->nat_flags; 3379 bcopy((char *)fin, (char *)&frnat, sizeof(*fin)); 3380 3381 nat->nat_hm = NULL; 3382 3383 do { 3384 changed = -1; 3385 /* TRACE (l, src_search, dst_search, np) */ 3386 3387 if ((src_search == 0) && (np->in_spnext == 0) && 3388 (dst_search == 0) && (np->in_dpnext == 0)) { 3389 if (l > 0) 3390 return -1; 3391 } 3392 3393 /* 3394 * Find a new source address 3395 */ 3396 if (ipf_nat6_nextaddr(fin, &np->in_nsrc, &frnat.fin_src6, 3397 &frnat.fin_src6) == -1) { 3398 return -1; 3399 } 3400 3401 if (IP6_ISZERO(&np->in_nsrcip6) && 3402 IP6_ISONES(&np->in_nsrcmsk6)) { 3403 src_search = 0; 3404 if (np->in_stepnext == 0) 3405 np->in_stepnext = 1; 3406 3407 } else if (IP6_ISZERO(&np->in_nsrcip6) && 3408 IP6_ISZERO(&np->in_nsrcmsk6)) { 3409 src_search = 0; 3410 if (np->in_stepnext == 0) 3411 np->in_stepnext = 1; 3412 3413 } else if (IP6_ISONES(&np->in_nsrcmsk)) { 3414 src_search = 0; 3415 if (np->in_stepnext == 0) 3416 np->in_stepnext = 1; 3417 3418 } else if (!IP6_ISONES(&np->in_nsrcmsk6)) { 3419 if (np->in_stepnext == 0 && changed == -1) { 3420 IP6_INC(&np->in_snip); 3421 np->in_stepnext++; 3422 changed = 0; 3423 } 3424 } 3425 3426 if ((flags & IPN_TCPUDPICMP) != 0) { 3427 if (np->in_spnext != 0) 3428 frnat.fin_data[0] = np->in_spnext; 3429 3430 /* 3431 * Standard port translation. Select next port. 3432 */ 3433 if ((flags & IPN_FIXEDSPORT) != 0) { 3434 np->in_stepnext = 2; 3435 } else if ((np->in_stepnext == 1) && 3436 (changed == -1) && (natl != NULL)) { 3437 np->in_spnext++; 3438 np->in_stepnext++; 3439 changed = 1; 3440 if (np->in_spnext > np->in_spmax) 3441 np->in_spnext = np->in_spmin; 3442 } 3443 } else { 3444 np->in_stepnext = 2; 3445 } 3446 np->in_stepnext &= 0x3; 3447 3448 /* 3449 * Find a new destination address 3450 */ 3451 /* TRACE (fin, np, l, frnat) */ 3452 3453 if (ipf_nat6_nextaddr(fin, &np->in_ndst, &frnat.fin_dst6, 3454 &frnat.fin_dst6) == -1) 3455 return -1; 3456 3457 if (IP6_ISZERO(&np->in_ndstip6) && 3458 IP6_ISONES(&np->in_ndstmsk6)) { 3459 dst_search = 0; 3460 if (np->in_stepnext == 2) 3461 np->in_stepnext = 3; 3462 3463 } else if (IP6_ISZERO(&np->in_ndstip6) && 3464 IP6_ISZERO(&np->in_ndstmsk6)) { 3465 dst_search = 0; 3466 if (np->in_stepnext == 2) 3467 np->in_stepnext = 3; 3468 3469 } else if (IP6_ISONES(&np->in_ndstmsk6)) { 3470 dst_search = 0; 3471 if (np->in_stepnext == 2) 3472 np->in_stepnext = 3; 3473 3474 } else if (!IP6_ISONES(&np->in_ndstmsk6)) { 3475 if ((np->in_stepnext == 2) && (changed == -1) && 3476 (natl != NULL)) { 3477 changed = 2; 3478 np->in_stepnext++; 3479 IP6_INC(&np->in_dnip6); 3480 } 3481 } 3482 3483 if ((flags & IPN_TCPUDPICMP) != 0) { 3484 if (np->in_dpnext != 0) 3485 frnat.fin_data[1] = np->in_dpnext; 3486 3487 /* 3488 * Standard port translation. Select next port. 3489 */ 3490 if ((flags & IPN_FIXEDDPORT) != 0) { 3491 np->in_stepnext = 0; 3492 } else if (np->in_stepnext == 3 && changed == -1) { 3493 np->in_dpnext++; 3494 np->in_stepnext++; 3495 changed = 3; 3496 if (np->in_dpnext > np->in_dpmax) 3497 np->in_dpnext = np->in_dpmin; 3498 } 3499 } else { 3500 if (np->in_stepnext == 3) 3501 np->in_stepnext = 0; 3502 } 3503 3504 /* TRACE (frnat) */ 3505 3506 /* 3507 * Here we do a lookup of the connection as seen from 3508 * the outside. If an IP# pair already exists, try 3509 * again. So if you have A->B becomes C->B, you can 3510 * also have D->E become C->E but not D->B causing 3511 * another C->B. Also take protocol and ports into 3512 * account when determining whether a pre-existing 3513 * NAT setup will cause an external conflict where 3514 * this is appropriate. 3515 * 3516 * fin_data[] is swapped around because we are doing a 3517 * lookup of the packet is if it were moving in the opposite 3518 * direction of the one we are working with now. 3519 */ 3520 if (flags & IPN_TCPUDP) { 3521 swap = frnat.fin_data[0]; 3522 frnat.fin_data[0] = frnat.fin_data[1]; 3523 frnat.fin_data[1] = swap; 3524 } 3525 if (fin->fin_out == 1) { 3526 natl = ipf_nat6_inlookup(&frnat, 3527 flags & ~(SI_WILDP|NAT_SEARCH), 3528 (u_int)frnat.fin_p, 3529 &frnat.fin_dst6.in6, 3530 &frnat.fin_src6.in6); 3531 3532 } else { 3533 natl = ipf_nat6_outlookup(&frnat, 3534 flags & ~(SI_WILDP|NAT_SEARCH), 3535 (u_int)frnat.fin_p, 3536 &frnat.fin_dst6.in6, 3537 &frnat.fin_src6.in6); 3538 } 3539 if (flags & IPN_TCPUDP) { 3540 swap = frnat.fin_data[0]; 3541 frnat.fin_data[0] = frnat.fin_data[1]; 3542 frnat.fin_data[1] = swap; 3543 } 3544 3545 /* TRACE natl, in_stepnext, l */ 3546 3547 if ((natl != NULL) && (l > 8)) /* XXX 8 is arbitrary */ 3548 return -1; 3549 3550 np->in_stepnext &= 0x3; 3551 3552 l++; 3553 changed = -1; 3554 } while (natl != NULL); 3555 nat->nat_osrc6 = fin->fin_src6; 3556 nat->nat_odst6 = fin->fin_dst6; 3557 nat->nat_nsrc6 = frnat.fin_src6; 3558 nat->nat_ndst6 = frnat.fin_dst6; 3559 3560 if ((flags & IPN_TCPUDP) != 0) { 3561 nat->nat_osport = htons(fin->fin_data[0]); 3562 nat->nat_odport = htons(fin->fin_data[1]); 3563 nat->nat_nsport = htons(frnat.fin_data[0]); 3564 nat->nat_ndport = htons(frnat.fin_data[1]); 3565 } else if ((flags & IPN_ICMPQUERY) != 0) { 3566 nat->nat_oicmpid = fin->fin_data[1]; 3567 nat->nat_nicmpid = frnat.fin_data[1]; 3568 } 3569 3570 return 0; 3571 } 3572 3573 3574 /* ------------------------------------------------------------------------ */ 3575 /* Function: ipf_nat6_newdivert */ 3576 /* Returns: int - -1 == error, 0 == success */ 3577 /* Parameters: fin(I) - pointer to packet information */ 3578 /* nat(I) - pointer to NAT entry */ 3579 /* ni(I) - pointer to structure with misc. information needed */ 3580 /* to create new NAT entry. */ 3581 /* Write Lock: ipf_nat */ 3582 /* */ 3583 /* Create a new NAT divert session as defined by the NAT rule. This is */ 3584 /* somewhat different to other NAT session creation routines because we */ 3585 /* do not iterate through either port numbers or IP addresses, searching */ 3586 /* for a unique mapping, however, a complimentary duplicate check is made. */ 3587 /* ------------------------------------------------------------------------ */ 3588 int 3589 ipf_nat6_newdivert(fr_info_t *fin, nat_t *nat, natinfo_t *nai) 3590 { 3591 ipf_main_softc_t *softc = fin->fin_main_soft; 3592 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 3593 fr_info_t frnat; 3594 ipnat_t *np; 3595 nat_t *natl; 3596 int p; 3597 3598 np = nai->nai_np; 3599 bcopy((char *)fin, (char *)&frnat, sizeof(*fin)); 3600 3601 nat->nat_pr[0] = 0; 3602 nat->nat_osrc6 = fin->fin_src6; 3603 nat->nat_odst6 = fin->fin_dst6; 3604 nat->nat_osport = htons(fin->fin_data[0]); 3605 nat->nat_odport = htons(fin->fin_data[1]); 3606 frnat.fin_src6 = np->in_snip6; 3607 frnat.fin_dst6 = np->in_dnip6; 3608 3609 if (np->in_redir & NAT_DIVERTUDP) { 3610 frnat.fin_data[0] = np->in_spnext; 3611 frnat.fin_data[1] = np->in_dpnext; 3612 frnat.fin_flx |= FI_TCPUDP; 3613 p = IPPROTO_UDP; 3614 } else { 3615 frnat.fin_flx &= ~FI_TCPUDP; 3616 p = IPPROTO_IPIP; 3617 } 3618 3619 if (fin->fin_out == 1) { 3620 natl = ipf_nat6_inlookup(&frnat, 0, p, &frnat.fin_dst6.in6, 3621 &frnat.fin_src6.in6); 3622 3623 } else { 3624 natl = ipf_nat6_outlookup(&frnat, 0, p, &frnat.fin_dst6.in6, 3625 &frnat.fin_src6.in6); 3626 } 3627 3628 if (natl != NULL) { 3629 NBUMPSIDE6D(fin->fin_out, ns_divert_exist); 3630 return -1; 3631 } 3632 3633 nat->nat_nsrc6 = frnat.fin_src6; 3634 nat->nat_ndst6 = frnat.fin_dst6; 3635 if (np->in_redir & NAT_DIVERTUDP) { 3636 nat->nat_nsport = htons(frnat.fin_data[0]); 3637 nat->nat_ndport = htons(frnat.fin_data[1]); 3638 } 3639 nat->nat_pr[fin->fin_out] = fin->fin_p; 3640 nat->nat_pr[1 - fin->fin_out] = p; 3641 3642 if (np->in_redir & NAT_REDIRECT) 3643 nat->nat_dir = NAT_DIVERTIN; 3644 else 3645 nat->nat_dir = NAT_DIVERTOUT; 3646 3647 return 0; 3648 } 3649 3650 3651 /* ------------------------------------------------------------------------ */ 3652 /* Function: nat6_builddivertmp */ 3653 /* Returns: int - -1 == error, 0 == success */ 3654 /* Parameters: np(I) - pointer to a NAT rule */ 3655 /* */ 3656 /* For divert rules, a skeleton packet representing what will be prepended */ 3657 /* to the real packet is created. Even though we don't have the full */ 3658 /* packet here, a checksum is calculated that we update later when we */ 3659 /* fill in the final details. At present a 0 checksum for UDP is being set */ 3660 /* here because it is expected that divert will be used for localhost. */ 3661 /* ------------------------------------------------------------------------ */ 3662 static int 3663 ipf_nat6_builddivertmp(ipf_nat_softc_t *softn, ipnat_t *np) 3664 { 3665 udphdr_t *uh; 3666 size_t len; 3667 ip6_t *ip6; 3668 3669 if ((np->in_redir & NAT_DIVERTUDP) != 0) 3670 len = sizeof(ip6_t) + sizeof(udphdr_t); 3671 else 3672 len = sizeof(ip6_t); 3673 3674 ALLOC_MB_T(np->in_divmp, len); 3675 if (np->in_divmp == NULL) { 3676 ATOMIC_INCL(softn->ipf_nat_stats.ns_divert_build); 3677 return -1; 3678 } 3679 3680 /* 3681 * First, the header to get the packet diverted to the new destination 3682 */ 3683 ip6 = MTOD(np->in_divmp, ip6_t *); 3684 ip6->ip6_vfc = 0x60; 3685 if ((np->in_redir & NAT_DIVERTUDP) != 0) 3686 ip6->ip6_nxt = IPPROTO_UDP; 3687 else 3688 ip6->ip6_nxt = IPPROTO_IPIP; 3689 ip6->ip6_hlim = 255; 3690 ip6->ip6_plen = 0; 3691 ip6->ip6_src = np->in_snip6.in6; 3692 ip6->ip6_dst = np->in_dnip6.in6; 3693 3694 if (np->in_redir & NAT_DIVERTUDP) { 3695 uh = (udphdr_t *)((u_char *)ip6 + sizeof(*ip6)); 3696 uh->uh_sum = 0; 3697 uh->uh_ulen = 8; 3698 uh->uh_sport = htons(np->in_spnext); 3699 uh->uh_dport = htons(np->in_dpnext); 3700 } 3701 3702 return 0; 3703 } 3704 3705 3706 #define MINDECAP (sizeof(ip6_t) + sizeof(udphdr_t) + sizeof(ip6_t)) 3707 3708 /* ------------------------------------------------------------------------ */ 3709 /* Function: nat6_decap */ 3710 /* Returns: int - -1 == error, 0 == success */ 3711 /* Parameters: fin(I) - pointer to packet information */ 3712 /* nat(I) - pointer to current NAT session */ 3713 /* */ 3714 /* This function is responsible for undoing a packet's encapsulation in the */ 3715 /* reverse of an encap/divert rule. After removing the outer encapsulation */ 3716 /* it is necessary to call ipf_makefrip() again so that the contents of 'fin'*/ 3717 /* match the "new" packet as it may still be used by IPFilter elsewhere. */ 3718 /* We use "dir" here as the basis for some of the expectations about the */ 3719 /* outer header. If we return an error, the goal is to leave the original */ 3720 /* packet information undisturbed - this falls short at the end where we'd */ 3721 /* need to back a backup copy of "fin" - expensive. */ 3722 /* ------------------------------------------------------------------------ */ 3723 static int 3724 ipf_nat6_decap(fr_info_t *fin, nat_t *nat) 3725 { 3726 ipf_main_softc_t *softc = fin->fin_main_soft; 3727 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 3728 char *hdr; 3729 int skip; 3730 mb_t *m; 3731 3732 if ((fin->fin_flx & FI_ICMPERR) != 0) { 3733 return 0; 3734 } 3735 3736 m = fin->fin_m; 3737 skip = fin->fin_hlen; 3738 3739 switch (nat->nat_dir) 3740 { 3741 case NAT_DIVERTIN : 3742 case NAT_DIVERTOUT : 3743 if (fin->fin_plen < MINDECAP) 3744 return -1; 3745 skip += sizeof(udphdr_t); 3746 break; 3747 3748 case NAT_ENCAPIN : 3749 case NAT_ENCAPOUT : 3750 if (fin->fin_plen < (skip + sizeof(ip6_t))) 3751 return -1; 3752 break; 3753 default : 3754 return -1; 3755 /* NOTREACHED */ 3756 } 3757 3758 /* 3759 * The aim here is to keep the original packet details in "fin" for 3760 * as long as possible so that returning with an error is for the 3761 * original packet and there is little undoing work to do. 3762 */ 3763 if (M_LEN(m) < skip + sizeof(ip6_t)) { 3764 if (ipf_pr_pullup(fin, skip + sizeof(ip6_t)) == -1) 3765 return -1; 3766 } 3767 3768 hdr = MTOD(fin->fin_m, char *); 3769 fin->fin_ip6 = (ip6_t *)(hdr + skip); 3770 3771 if (ipf_pr_pullup(fin, skip + sizeof(ip6_t)) == -1) { 3772 NBUMPSIDE6D(fin->fin_out, ns_decap_pullup); 3773 return -1; 3774 } 3775 3776 fin->fin_hlen = sizeof(ip6_t); 3777 fin->fin_dlen -= skip; 3778 fin->fin_plen -= skip; 3779 fin->fin_ipoff += skip; 3780 3781 if (ipf_makefrip(sizeof(ip6_t), (ip_t *)hdr, fin) == -1) { 3782 NBUMPSIDE6D(fin->fin_out, ns_decap_bad); 3783 return -1; 3784 } 3785 3786 return skip; 3787 } 3788 3789 3790 /* ------------------------------------------------------------------------ */ 3791 /* Function: nat6_nextaddr */ 3792 /* Returns: int - -1 == bad input (no new address), */ 3793 /* 0 == success and dst has new address */ 3794 /* Parameters: fin(I) - pointer to packet information */ 3795 /* na(I) - how to generate new address */ 3796 /* old(I) - original address being replaced */ 3797 /* dst(O) - where to put the new address */ 3798 /* Write Lock: ipf_nat */ 3799 /* */ 3800 /* This function uses the contents of the "na" structure, in combination */ 3801 /* with "old" to produce a new address to store in "dst". Not all of the */ 3802 /* possible uses of "na" will result in a new address. */ 3803 /* ------------------------------------------------------------------------ */ 3804 static int 3805 ipf_nat6_nextaddr(fr_info_t *fin, nat_addr_t *na, i6addr_t *old, i6addr_t *dst) 3806 { 3807 ipf_main_softc_t *softc = fin->fin_main_soft; 3808 ipf_nat_softc_t *softn = softc->ipf_nat_soft; 3809 i6addr_t newip, new; 3810 u_32_t amin, amax; 3811 int error; 3812 3813 new.i6[0] = 0; 3814 new.i6[1] = 0; 3815 new.i6[2] = 0; 3816 new.i6[3] = 0; 3817 amin = na->na_addr[0].in4.s_addr; 3818 3819 switch (na->na_atype) 3820 { 3821 case FRI_RANGE : 3822 amax = na->na_addr[1].in4.s_addr; 3823 break; 3824 3825 case FRI_NETMASKED : 3826 case FRI_DYNAMIC : 3827 case FRI_NORMAL : 3828 /* 3829 * Compute the maximum address by adding the inverse of the 3830 * netmask to the minimum address. 3831 */ 3832 amax = ~na->na_addr[1].in4.s_addr; 3833 amax |= amin; 3834 break; 3835 3836 case FRI_LOOKUP : 3837 break; 3838 3839 case FRI_BROADCAST : 3840 case FRI_PEERADDR : 3841 case FRI_NETWORK : 3842 default : 3843 return -1; 3844 } 3845 3846 error = -1; 3847 switch (na->na_function) 3848 { 3849 case IPLT_DSTLIST : 3850 error = ipf_dstlist_select_node(fin, na->na_ptr, dst->i6, 3851 NULL); 3852 break; 3853 3854 case IPLT_NONE : 3855 /* 3856 * 0/0 as the new address means leave it alone. 3857 */ 3858 if (na->na_addr[0].in4.s_addr == 0 && 3859 na->na_addr[1].in4.s_addr == 0) { 3860 new = *old; 3861 3862 /* 3863 * 0/32 means get the interface's address 3864 */ 3865 } else if (IP6_ISZERO(&na->na_addr[0].in6) && 3866 IP6_ISONES(&na->na_addr[1].in6)) { 3867 if (ipf_ifpaddr(softc, 6, na->na_atype, 3868 fin->fin_ifp, &newip, NULL) == -1) { 3869 NBUMPSIDE6(fin->fin_out, ns_ifpaddrfail); 3870 return -1; 3871 } 3872 new = newip; 3873 } else { 3874 new.in6 = na->na_nextip6; 3875 } 3876 *dst = new; 3877 error = 0; 3878 break; 3879 3880 default : 3881 NBUMPSIDE6(fin->fin_out, ns_badnextaddr); 3882 break; 3883 } 3884 3885 return error; 3886 } 3887 3888 3889 /* ------------------------------------------------------------------------ */ 3890 /* Function: ipf_nat6_nextaddrinit */ 3891 /* Returns: int - 0 == success, else error number */ 3892 /* Parameters: na(I) - NAT address information for generating new addr*/ 3893 /* base(I) - start of where to find strings */ 3894 /* initial(I) - flag indicating if it is the first call for */ 3895 /* this "na" structure. */ 3896 /* ifp(I) - network interface to derive address */ 3897 /* information from. */ 3898 /* */ 3899 /* This function is expected to be called in two scenarious: when a new NAT */ 3900 /* rule is loaded into the kernel and when the list of NAT rules is sync'd */ 3901 /* up with the valid network interfaces (possibly due to them changing.) */ 3902 /* To distinguish between these, the "initial" parameter is used. If it is */ 3903 /* 1 then this indicates the rule has just been reloaded and 0 for when we */ 3904 /* are updating information. This difference is important because in */ 3905 /* instances where we are not updating address information associated with */ 3906 /* a network interface, we don't want to disturb what the "next" address to */ 3907 /* come out of ipf_nat6_nextaddr() will be. */ 3908 /* ------------------------------------------------------------------------ */ 3909 static int 3910 ipf_nat6_nextaddrinit(ipf_main_softc_t *softc, char *base, nat_addr_t *na, 3911 int initial, void *ifp) 3912 { 3913 switch (na->na_atype) 3914 { 3915 case FRI_LOOKUP : 3916 if (na->na_subtype == 0) { 3917 na->na_ptr = ipf_lookup_res_num(softc, IPL_LOGNAT, 3918 na->na_type, 3919 na->na_num, 3920 &na->na_func); 3921 } else if (na->na_subtype == 1) { 3922 na->na_ptr = ipf_lookup_res_name(softc, IPL_LOGNAT, 3923 na->na_type, 3924 base + na->na_num, 3925 &na->na_func); 3926 } 3927 if (na->na_func == NULL) { 3928 IPFERROR(60072); 3929 return ESRCH; 3930 } 3931 if (na->na_ptr == NULL) { 3932 IPFERROR(60073); 3933 return ESRCH; 3934 } 3935 break; 3936 case FRI_DYNAMIC : 3937 case FRI_BROADCAST : 3938 case FRI_NETWORK : 3939 case FRI_NETMASKED : 3940 case FRI_PEERADDR : 3941 if (ifp != NULL) 3942 (void )ipf_ifpaddr(softc, 6, na->na_atype, ifp, 3943 &na->na_addr[0], 3944 &na->na_addr[1]); 3945 break; 3946 3947 case FRI_SPLIT : 3948 case FRI_RANGE : 3949 if (initial) 3950 na->na_nextip6 = na->na_addr[0].in6; 3951 break; 3952 3953 case FRI_NONE : 3954 IP6_ANDASSIGN(&na->na_addr[0].in6, &na->na_addr[1].in6); 3955 return 0; 3956 3957 case FRI_NORMAL : 3958 IP6_ANDASSIGN(&na->na_addr[0].in6, &na->na_addr[1].in6); 3959 break; 3960 3961 default : 3962 IPFERROR(60074); 3963 return EINVAL; 3964 } 3965 3966 if (initial && (na->na_atype == FRI_NORMAL)) { 3967 if (IP6_ISZERO(&na->na_addr[0].in6)) { 3968 if (IP6_ISONES(&na->na_addr[1].in6) || 3969 IP6_ISZERO(&na->na_addr[1].in6)) { 3970 return 0; 3971 } 3972 } 3973 3974 na->na_nextip6 = na->na_addr[0].in6; 3975 if (!IP6_ISONES(&na->na_addr[1].in6)) { 3976 IP6_INC(&na->na_nextip6); 3977 } 3978 } 3979 3980 return 0; 3981 } 3982 3983 3984 /* ------------------------------------------------------------------------ */ 3985 /* Function: ipf_nat6_icmpquerytype */ 3986 /* Returns: int - 1 == success, 0 == failure */ 3987 /* Parameters: icmptype(I) - ICMP type number */ 3988 /* */ 3989 /* Tests to see if the ICMP type number passed is a query/response type or */ 3990 /* not. */ 3991 /* ------------------------------------------------------------------------ */ 3992 static int 3993 ipf_nat6_icmpquerytype(int icmptype) 3994 { 3995 3996 /* 3997 * For the ICMP query NAT code, it is essential that both the query 3998 * and the reply match on the NAT rule. Because the NAT structure 3999 * does not keep track of the icmptype, and a single NAT structure 4000 * is used for all icmp types with the same src, dest and id, we 4001 * simply define the replies as queries as well. The funny thing is, 4002 * altough it seems silly to call a reply a query, this is exactly 4003 * as it is defined in the IPv4 specification 4004 */ 4005 4006 switch (icmptype) 4007 { 4008 4009 case ICMP6_ECHO_REPLY: 4010 case ICMP6_ECHO_REQUEST: 4011 /* route aedvertisement/solliciation is currently unsupported: */ 4012 /* it would require rewriting the ICMP data section */ 4013 case ICMP6_MEMBERSHIP_QUERY: 4014 case ICMP6_MEMBERSHIP_REPORT: 4015 case ICMP6_MEMBERSHIP_REDUCTION: 4016 case ICMP6_WRUREQUEST: 4017 case ICMP6_WRUREPLY: 4018 case MLD6_MTRACE_RESP: 4019 case MLD6_MTRACE: 4020 return 1; 4021 default: 4022 return 0; 4023 } 4024 } 4025 #endif /* USE_INET6 */ 4026
Indexes created Sun Sep 28 16:09:52 GMT 2025