1 /* $FreeBSD: stable/12/sys/netpfil/ipfilter/netinet/ip_nat.c 372218 2022-07-29 17:06:57Z cy $ */
2
3 /*
4 * Copyright (C) 2012 by Darren Reed.
5 *
6 * See the IPFILTER.LICENCE file for details on licencing.
7 */
8 #if defined(KERNEL) || defined(_KERNEL)
9 # undef KERNEL
10 # undef _KERNEL
11 # define KERNEL 1
12 # define _KERNEL 1
13 #endif
14 #include <sys/errno.h>
15 #include <sys/types.h>
16 #include <sys/param.h>
17 #include <sys/time.h>
18 #include <sys/file.h>
19 #if defined(_KERNEL) && \
20 (defined(__NetBSD_Version) && (__NetBSD_Version >= 399002000))
21 # include <sys/kauth.h>
22 #endif
23 #if !defined(_KERNEL)
24 # include <stdio.h>
25 # include <string.h>
26 # include <stdlib.h>
27 # define KERNEL
28 # ifdef _OpenBSD__
29 struct file;
30 # endif
31 # include <sys/uio.h>
32 # undef KERNEL
33 #endif
34 #if defined(_KERNEL) && defined(__FreeBSD__)
35 # include <sys/filio.h>
36 # include <sys/fcntl.h>
37 #else
38 # include <sys/ioctl.h>
39 #endif
40 # include <sys/fcntl.h>
41 # include <sys/protosw.h>
42 #include <sys/socket.h>
43 #if defined(_KERNEL)
44 # include <sys/systm.h>
45 # if defined(__FreeBSD__)
46 # include <sys/jail.h>
47 # endif
48 # if !defined(__SVR4)
49 # include <sys/mbuf.h>
50 # endif
51 #endif
52 #if defined(__SVR4)
53 # include <sys/filio.h>
54 # include <sys/byteorder.h>
55 # ifdef KERNEL
56 # include <sys/dditypes.h>
57 # endif
58 # include <sys/stream.h>
59 # include <sys/kmem.h>
60 #endif
61 #if defined(__FreeBSD__)
62 # include <sys/queue.h>
63 #endif
64 #include <net/if.h>
65 #if defined(__FreeBSD__)
66 # include <net/if_var.h>
67 #endif
68 #ifdef sun
69 # include <net/af.h>
70 #endif
71 #include <netinet/in.h>
72 #include <netinet/in_systm.h>
73 #include <netinet/ip.h>
74
75 #ifdef RFC1825
76 # include <vpn/md5.h>
77 # include <vpn/ipsec.h>
78 extern struct ifnet vpnif;
79 #endif
80
81 # include <netinet/ip_var.h>
82 #include <netinet/tcp.h>
83 #include <netinet/udp.h>
84 #include <netinet/ip_icmp.h>
85 #include "netinet/ip_compat.h"
86 #include <netinet/tcpip.h>
87 #include "netinet/ipl.h"
88 #include "netinet/ip_fil.h"
89 #include "netinet/ip_nat.h"
90 #include "netinet/ip_frag.h"
91 #include "netinet/ip_state.h"
92 #include "netinet/ip_proxy.h"
93 #include "netinet/ip_lookup.h"
94 #include "netinet/ip_dstlist.h"
95 #include "netinet/ip_sync.h"
96 #if defined(__FreeBSD__)
97 # include <sys/malloc.h>
98 #endif
99 #ifdef HAS_SYS_MD5_H
100 # include <sys/md5.h>
101 #else
102 # include "md5.h"
103 #endif
104 /* END OF INCLUDES */
105
106 #undef SOCKADDR_IN
107 #define SOCKADDR_IN struct sockaddr_in
108
109 #if !defined(lint)
110 static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
111 static const char rcsid[] = "@(#)$FreeBSD: stable/12/sys/netpfil/ipfilter/netinet/ip_nat.c 372218 2022-07-29 17:06:57Z cy $";
112 /* static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.195.2.102 2007/10/16 10:08:10 darrenr Exp $"; */
113 #endif
114
115
116 #define NATFSUM(n,v,f) ((v) == 4 ? (n)->f.in4.s_addr : (n)->f.i6[0] + \
117 (n)->f.i6[1] + (n)->f.i6[2] + (n)->f.i6[3])
118 #define NBUMP(x) softn->(x)++
119 #define NBUMPD(x, y) do { \
120 softn->x.y++; \
121 DT(y); \
122 } while (0)
123 #define NBUMPSIDE(y,x) softn->ipf_nat_stats.ns_side[y].x++
124 #define NBUMPSIDED(y,x) do { softn->ipf_nat_stats.ns_side[y].x++; \
125 DT(x); } while (0)
126 #define NBUMPSIDEX(y,x,z) \
127 do { softn->ipf_nat_stats.ns_side[y].x++; \
128 DT(z); } while (0)
129 #define NBUMPSIDEDF(y,x)do { softn->ipf_nat_stats.ns_side[y].x++; \
130 DT1(x, fr_info_t *, fin); } while (0)
131
132 static ipftuneable_t ipf_nat_tuneables[] = {
133 /* nat */
134 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_lock) },
135 "nat_lock", 0, 1,
136 stsizeof(ipf_nat_softc_t, ipf_nat_lock),
137 IPFT_RDONLY, NULL, NULL },
138 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_sz) },
139 "nat_table_size", 1, 0x7fffffff,
140 stsizeof(ipf_nat_softc_t, ipf_nat_table_sz),
141 0, NULL, ipf_nat_rehash },
142 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_max) },
143 "nat_table_max", 1, 0x7fffffff,
144 stsizeof(ipf_nat_softc_t, ipf_nat_table_max),
145 0, NULL, NULL },
146 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_maprules_sz) },
147 "nat_rules_size", 1, 0x7fffffff,
148 stsizeof(ipf_nat_softc_t, ipf_nat_maprules_sz),
149 0, NULL, ipf_nat_rehash_rules },
150 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_rdrrules_sz) },
151 "rdr_rules_size", 1, 0x7fffffff,
152 stsizeof(ipf_nat_softc_t, ipf_nat_rdrrules_sz),
153 0, NULL, ipf_nat_rehash_rules },
154 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_hostmap_sz) },
155 "hostmap_size", 1, 0x7fffffff,
156 stsizeof(ipf_nat_softc_t, ipf_nat_hostmap_sz),
157 0, NULL, ipf_nat_hostmap_rehash },
158 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_maxbucket) },
159 "nat_maxbucket",1, 0x7fffffff,
160 stsizeof(ipf_nat_softc_t, ipf_nat_maxbucket),
161 0, NULL, NULL },
162 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_logging) },
163 "nat_logging", 0, 1,
164 stsizeof(ipf_nat_softc_t, ipf_nat_logging),
165 0, NULL, NULL },
166 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_doflush) },
167 "nat_doflush", 0, 1,
168 stsizeof(ipf_nat_softc_t, ipf_nat_doflush),
169 0, NULL, NULL },
170 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_wm_low) },
171 "nat_table_wm_low", 1, 99,
172 stsizeof(ipf_nat_softc_t, ipf_nat_table_wm_low),
173 0, NULL, NULL },
174 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_wm_high) },
175 "nat_table_wm_high", 2, 100,
176 stsizeof(ipf_nat_softc_t, ipf_nat_table_wm_high),
177 0, NULL, NULL },
178 { { 0 },
179 NULL, 0, 0,
180 0,
181 0, NULL, NULL }
182 };
183
184 /* ======================================================================== */
185 /* How the NAT is organised and works. */
186 /* */
187 /* Inside (interface y) NAT Outside (interface x) */
188 /* -------------------- -+- ------------------------------------- */
189 /* Packet going | out, processsed by ipf_nat_checkout() for x */
190 /* ------------> | ------------> */
191 /* src=10.1.1.1 | src=192.1.1.1 */
192 /* | */
193 /* | in, processed by ipf_nat_checkin() for x */
194 /* <------------ | <------------ */
195 /* dst=10.1.1.1 | dst=192.1.1.1 */
196 /* -------------------- -+- ------------------------------------- */
197 /* ipf_nat_checkout() - changes ip_src and if required, sport */
198 /* - creates a new mapping, if required. */
199 /* ipf_nat_checkin() - changes ip_dst and if required, dport */
200 /* */
201 /* In the NAT table, internal source is recorded as "in" and externally */
202 /* seen as "out". */
203 /* ======================================================================== */
204
205
206 #if SOLARIS && !defined(INSTANCES)
207 extern int pfil_delayed_copy;
208 #endif
209
210 static int ipf_nat_flush_entry(ipf_main_softc_t *, void *);
211 static int ipf_nat_getent(ipf_main_softc_t *, caddr_t, int);
212 static int ipf_nat_getsz(ipf_main_softc_t *, caddr_t, int);
213 static int ipf_nat_putent(ipf_main_softc_t *, caddr_t, int);
214 static void ipf_nat_addmap(ipf_nat_softc_t *, ipnat_t *);
215 static void ipf_nat_addrdr(ipf_nat_softc_t *, ipnat_t *);
216 static int ipf_nat_builddivertmp(ipf_nat_softc_t *, ipnat_t *);
217 static int ipf_nat_clearlist(ipf_main_softc_t *, ipf_nat_softc_t *);
218 static int ipf_nat_cmp_rules(ipnat_t *, ipnat_t *);
219 static int ipf_nat_decap(fr_info_t *, nat_t *);
220 static void ipf_nat_delrule(ipf_main_softc_t *, ipf_nat_softc_t *,
221 ipnat_t *, int);
222 static int ipf_nat_extraflush(ipf_main_softc_t *, ipf_nat_softc_t *, int);
223 static int ipf_nat_finalise(fr_info_t *, nat_t *);
224 static int ipf_nat_flushtable(ipf_main_softc_t *, ipf_nat_softc_t *);
225 static int ipf_nat_getnext(ipf_main_softc_t *, ipftoken_t *,
226 ipfgeniter_t *, ipfobj_t *);
227 static int ipf_nat_gettable(ipf_main_softc_t *, ipf_nat_softc_t *,
228 char *);
229 static hostmap_t *ipf_nat_hostmap(ipf_nat_softc_t *, ipnat_t *,
230 struct in_addr, struct in_addr,
231 struct in_addr, u_32_t);
232 static int ipf_nat_icmpquerytype(int);
233 static int ipf_nat_iterator(ipf_main_softc_t *, ipftoken_t *,
234 ipfgeniter_t *, ipfobj_t *);
235 static int ipf_nat_match(fr_info_t *, ipnat_t *);
236 static int ipf_nat_matcharray(nat_t *, int *, u_long);
237 static int ipf_nat_matchflush(ipf_main_softc_t *, ipf_nat_softc_t *,
238 caddr_t);
239 static void ipf_nat_mssclamp(tcphdr_t *, u_32_t, fr_info_t *,
240 u_short *);
241 static int ipf_nat_newmap(fr_info_t *, nat_t *, natinfo_t *);
242 static int ipf_nat_newdivert(fr_info_t *, nat_t *, natinfo_t *);
243 static int ipf_nat_newrdr(fr_info_t *, nat_t *, natinfo_t *);
244 static int ipf_nat_newrewrite(fr_info_t *, nat_t *, natinfo_t *);
245 static int ipf_nat_nextaddr(fr_info_t *, nat_addr_t *, u_32_t *,
246 u_32_t *);
247 static int ipf_nat_nextaddrinit(ipf_main_softc_t *, char *,
248 nat_addr_t *, int, void *);
249 static int ipf_nat_resolverule(ipf_main_softc_t *, ipnat_t *);
250 static int ipf_nat_ruleaddrinit(ipf_main_softc_t *,
251 ipf_nat_softc_t *, ipnat_t *);
252 static void ipf_nat_rule_fini(ipf_main_softc_t *, ipnat_t *);
253 static int ipf_nat_rule_init(ipf_main_softc_t *, ipf_nat_softc_t *,
254 ipnat_t *);
255 static int ipf_nat_siocaddnat(ipf_main_softc_t *, ipf_nat_softc_t *,
256 ipnat_t *, int);
257 static void ipf_nat_siocdelnat(ipf_main_softc_t *, ipf_nat_softc_t *,
258 ipnat_t *, int);
259 static void ipf_nat_tabmove(ipf_nat_softc_t *, nat_t *);
260
261 /* ------------------------------------------------------------------------ */
262 /* Function: ipf_nat_main_load */
263 /* Returns: int - 0 == success, -1 == failure */
264 /* Parameters: Nil */
265 /* */
266 /* The only global NAT structure that needs to be initialised is the filter */
267 /* rule that is used with blocking packets. */
268 /* ------------------------------------------------------------------------ */
269 int
ipf_nat_main_load(void)270 ipf_nat_main_load(void)
271 {
272
273 return (0);
274 }
275
276
277 /* ------------------------------------------------------------------------ */
278 /* Function: ipf_nat_main_unload */
279 /* Returns: int - 0 == success, -1 == failure */
280 /* Parameters: Nil */
281 /* */
282 /* A null-op function that exists as a placeholder so that the flow in */
283 /* other functions is obvious. */
284 /* ------------------------------------------------------------------------ */
285 int
ipf_nat_main_unload(void)286 ipf_nat_main_unload(void)
287 {
288 return (0);
289 }
290
291
292 /* ------------------------------------------------------------------------ */
293 /* Function: ipf_nat_soft_create */
294 /* Returns: void * - NULL = failure, else pointer to NAT context */
295 /* Parameters: softc(I) - pointer to soft context main structure */
296 /* */
297 /* Allocate the initial soft context structure for NAT and populate it with */
298 /* some default values. Creating the tables is left until we call _init so */
299 /* that sizes can be changed before we get under way. */
300 /* ------------------------------------------------------------------------ */
301 void *
ipf_nat_soft_create(ipf_main_softc_t * softc)302 ipf_nat_soft_create(ipf_main_softc_t *softc)
303 {
304 ipf_nat_softc_t *softn;
305
306 KMALLOC(softn, ipf_nat_softc_t *);
307 if (softn == NULL)
308 return (NULL);
309
310 bzero((char *)softn, sizeof(*softn));
311
312 softn->ipf_nat_tune = ipf_tune_array_copy(softn,
313 sizeof(ipf_nat_tuneables),
314 ipf_nat_tuneables);
315 if (softn->ipf_nat_tune == NULL) {
316 ipf_nat_soft_destroy(softc, softn);
317 return (NULL);
318 }
319 if (ipf_tune_array_link(softc, softn->ipf_nat_tune) == -1) {
320 ipf_nat_soft_destroy(softc, softn);
321 return (NULL);
322 }
323
324 softn->ipf_nat_list_tail = &softn->ipf_nat_list;
325
326 if (softc->ipf_large_nat) {
327 softn->ipf_nat_table_max = NAT_TABLE_MAX_LARGE;
328 softn->ipf_nat_table_sz = NAT_TABLE_SZ_LARGE;
329 softn->ipf_nat_maprules_sz = NAT_SIZE_LARGE;
330 softn->ipf_nat_rdrrules_sz = RDR_SIZE_LARGE;
331 softn->ipf_nat_hostmap_sz = HOSTMAP_SIZE_LARGE;
332 } else {
333 softn->ipf_nat_table_max = NAT_TABLE_MAX_NORMAL;
334 softn->ipf_nat_table_sz = NAT_TABLE_SZ_NORMAL;
335 softn->ipf_nat_maprules_sz = NAT_SIZE_NORMAL;
336 softn->ipf_nat_rdrrules_sz = RDR_SIZE_NORMAL;
337 softn->ipf_nat_hostmap_sz = HOSTMAP_SIZE_NORMAL;
338 }
339 softn->ipf_nat_doflush = 0;
340 #ifdef IPFILTER_LOG
341 softn->ipf_nat_logging = 1;
342 #else
343 softn->ipf_nat_logging = 0;
344 #endif
345
346 softn->ipf_nat_defage = DEF_NAT_AGE;
347 softn->ipf_nat_defipage = IPF_TTLVAL(60);
348 softn->ipf_nat_deficmpage = IPF_TTLVAL(3);
349 softn->ipf_nat_table_wm_high = 99;
350 softn->ipf_nat_table_wm_low = 90;
351
352 return (softn);
353 }
354
355 /* ------------------------------------------------------------------------ */
356 /* Function: ipf_nat_soft_destroy */
357 /* Returns: Nil */
358 /* Parameters: softc(I) - pointer to soft context main structure */
359 /* */
360 /* ------------------------------------------------------------------------ */
361 void
ipf_nat_soft_destroy(ipf_main_softc_t * softc,void * arg)362 ipf_nat_soft_destroy(ipf_main_softc_t *softc, void *arg)
363 {
364 ipf_nat_softc_t *softn = arg;
365
366 if (softn->ipf_nat_tune != NULL) {
367 ipf_tune_array_unlink(softc, softn->ipf_nat_tune);
368 KFREES(softn->ipf_nat_tune, sizeof(ipf_nat_tuneables));
369 softn->ipf_nat_tune = NULL;
370 }
371
372 KFREE(softn);
373 }
374
375
376 /* ------------------------------------------------------------------------ */
377 /* Function: ipf_nat_init */
378 /* Returns: int - 0 == success, -1 == failure */
379 /* Parameters: softc(I) - pointer to soft context main structure */
380 /* */
381 /* Initialise all of the NAT locks, tables and other structures. */
382 /* ------------------------------------------------------------------------ */
383 int
ipf_nat_soft_init(ipf_main_softc_t * softc,void * arg)384 ipf_nat_soft_init(ipf_main_softc_t *softc, void *arg)
385 {
386 ipf_nat_softc_t *softn = arg;
387 ipftq_t *tq;
388 int i;
389
390 KMALLOCS(softn->ipf_nat_table[0], nat_t **, \
391 sizeof(nat_t *) * softn->ipf_nat_table_sz);
392
393 if (softn->ipf_nat_table[0] != NULL) {
394 bzero((char *)softn->ipf_nat_table[0],
395 softn->ipf_nat_table_sz * sizeof(nat_t *));
396 } else {
397 return (-1);
398 }
399
400 KMALLOCS(softn->ipf_nat_table[1], nat_t **, \
401 sizeof(nat_t *) * softn->ipf_nat_table_sz);
402
403 if (softn->ipf_nat_table[1] != NULL) {
404 bzero((char *)softn->ipf_nat_table[1],
405 softn->ipf_nat_table_sz * sizeof(nat_t *));
406 } else {
407 return (-2);
408 }
409
410 KMALLOCS(softn->ipf_nat_map_rules, ipnat_t **, \
411 sizeof(ipnat_t *) * softn->ipf_nat_maprules_sz);
412
413 if (softn->ipf_nat_map_rules != NULL) {
414 bzero((char *)softn->ipf_nat_map_rules,
415 softn->ipf_nat_maprules_sz * sizeof(ipnat_t *));
416 } else {
417 return (-3);
418 }
419
420 KMALLOCS(softn->ipf_nat_rdr_rules, ipnat_t **, \
421 sizeof(ipnat_t *) * softn->ipf_nat_rdrrules_sz);
422
423 if (softn->ipf_nat_rdr_rules != NULL) {
424 bzero((char *)softn->ipf_nat_rdr_rules,
425 softn->ipf_nat_rdrrules_sz * sizeof(ipnat_t *));
426 } else {
427 return (-4);
428 }
429
430 KMALLOCS(softn->ipf_hm_maptable, hostmap_t **, \
431 sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
432
433 if (softn->ipf_hm_maptable != NULL) {
434 bzero((char *)softn->ipf_hm_maptable,
435 sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
436 } else {
437 return (-5);
438 }
439 softn->ipf_hm_maplist = NULL;
440
441 KMALLOCS(softn->ipf_nat_stats.ns_side[0].ns_bucketlen, u_int *,
442 softn->ipf_nat_table_sz * sizeof(u_int));
443
444 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen == NULL) {
445 return (-6);
446 }
447 bzero((char *)softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
448 softn->ipf_nat_table_sz * sizeof(u_int));
449
450 KMALLOCS(softn->ipf_nat_stats.ns_side[1].ns_bucketlen, u_int *,
451 softn->ipf_nat_table_sz * sizeof(u_int));
452
453 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen == NULL) {
454 return (-7);
455 }
456
457 bzero((char *)softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
458 softn->ipf_nat_table_sz * sizeof(u_int));
459
460 if (softn->ipf_nat_maxbucket == 0) {
461 for (i = softn->ipf_nat_table_sz; i > 0; i >>= 1)
462 softn->ipf_nat_maxbucket++;
463 softn->ipf_nat_maxbucket *= 2;
464 }
465
466 ipf_sttab_init(softc, softn->ipf_nat_tcptq);
467 /*
468 * Increase this because we may have "keep state" following this too
469 * and packet storms can occur if this is removed too quickly.
470 */
471 softn->ipf_nat_tcptq[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcplastack;
472 softn->ipf_nat_tcptq[IPF_TCP_NSTATES - 1].ifq_next =
473 &softn->ipf_nat_udptq;
474
475 IPFTQ_INIT(&softn->ipf_nat_udptq, softn->ipf_nat_defage,
476 "nat ipftq udp tab");
477 softn->ipf_nat_udptq.ifq_next = &softn->ipf_nat_udpacktq;
478
479 IPFTQ_INIT(&softn->ipf_nat_udpacktq, softn->ipf_nat_defage,
480 "nat ipftq udpack tab");
481 softn->ipf_nat_udpacktq.ifq_next = &softn->ipf_nat_icmptq;
482
483 IPFTQ_INIT(&softn->ipf_nat_icmptq, softn->ipf_nat_deficmpage,
484 "nat icmp ipftq tab");
485 softn->ipf_nat_icmptq.ifq_next = &softn->ipf_nat_icmpacktq;
486
487 IPFTQ_INIT(&softn->ipf_nat_icmpacktq, softn->ipf_nat_defage,
488 "nat icmpack ipftq tab");
489 softn->ipf_nat_icmpacktq.ifq_next = &softn->ipf_nat_iptq;
490
491 IPFTQ_INIT(&softn->ipf_nat_iptq, softn->ipf_nat_defipage,
492 "nat ip ipftq tab");
493 softn->ipf_nat_iptq.ifq_next = &softn->ipf_nat_pending;
494
495 IPFTQ_INIT(&softn->ipf_nat_pending, 1, "nat pending ipftq tab");
496 softn->ipf_nat_pending.ifq_next = NULL;
497
498 for (i = 0, tq = softn->ipf_nat_tcptq; i < IPF_TCP_NSTATES; i++, tq++) {
499 if (tq->ifq_ttl < softn->ipf_nat_deficmpage)
500 tq->ifq_ttl = softn->ipf_nat_deficmpage;
501 else if (tq->ifq_ttl > softn->ipf_nat_defage && softc->ipf_large_nat)
502 tq->ifq_ttl = softn->ipf_nat_defage;
503 }
504
505 /*
506 * Increase this because we may have "keep state" following
507 * this too and packet storms can occur if this is removed
508 * too quickly.
509 */
510 softn->ipf_nat_tcptq[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcplastack;
511
512 MUTEX_INIT(&softn->ipf_nat_new, "ipf nat new mutex");
513 MUTEX_INIT(&softn->ipf_nat_io, "ipf nat io mutex");
514
515 softn->ipf_nat_inited = 1;
516
517 return (0);
518 }
519
520
521 /* ------------------------------------------------------------------------ */
522 /* Function: ipf_nat_soft_fini */
523 /* Returns: Nil */
524 /* Parameters: softc(I) - pointer to soft context main structure */
525 /* */
526 /* Free all memory used by NAT structures allocated at runtime. */
527 /* ------------------------------------------------------------------------ */
528 int
ipf_nat_soft_fini(ipf_main_softc_t * softc,void * arg)529 ipf_nat_soft_fini(ipf_main_softc_t *softc, void *arg)
530 {
531 ipf_nat_softc_t *softn = arg;
532 ipftq_t *ifq, *ifqnext;
533
534 (void) ipf_nat_clearlist(softc, softn);
535 (void) ipf_nat_flushtable(softc, softn);
536
537 /*
538 * Proxy timeout queues are not cleaned here because although they
539 * exist on the NAT list, ipf_proxy_unload is called after unload
540 * and the proxies actually are responsible for them being created.
541 * Should the proxy timeouts have their own list? There's no real
542 * justification as this is the only complication.
543 */
544 for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifqnext) {
545 ifqnext = ifq->ifq_next;
546 if (ipf_deletetimeoutqueue(ifq) == 0)
547 ipf_freetimeoutqueue(softc, ifq);
548 }
549
550 if (softn->ipf_nat_table[0] != NULL) {
551 KFREES(softn->ipf_nat_table[0],
552 sizeof(nat_t *) * softn->ipf_nat_table_sz);
553 softn->ipf_nat_table[0] = NULL;
554 }
555 if (softn->ipf_nat_table[1] != NULL) {
556 KFREES(softn->ipf_nat_table[1],
557 sizeof(nat_t *) * softn->ipf_nat_table_sz);
558 softn->ipf_nat_table[1] = NULL;
559 }
560 if (softn->ipf_nat_map_rules != NULL) {
561 KFREES(softn->ipf_nat_map_rules,
562 sizeof(ipnat_t *) * softn->ipf_nat_maprules_sz);
563 softn->ipf_nat_map_rules = NULL;
564 }
565 if (softn->ipf_nat_rdr_rules != NULL) {
566 KFREES(softn->ipf_nat_rdr_rules,
567 sizeof(ipnat_t *) * softn->ipf_nat_rdrrules_sz);
568 softn->ipf_nat_rdr_rules = NULL;
569 }
570 if (softn->ipf_hm_maptable != NULL) {
571 KFREES(softn->ipf_hm_maptable,
572 sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
573 softn->ipf_hm_maptable = NULL;
574 }
575 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen != NULL) {
576 KFREES(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
577 sizeof(u_int) * softn->ipf_nat_table_sz);
578 softn->ipf_nat_stats.ns_side[0].ns_bucketlen = NULL;
579 }
580 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen != NULL) {
581 KFREES(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
582 sizeof(u_int) * softn->ipf_nat_table_sz);
583 softn->ipf_nat_stats.ns_side[1].ns_bucketlen = NULL;
584 }
585
586 if (softn->ipf_nat_inited == 1) {
587 softn->ipf_nat_inited = 0;
588 ipf_sttab_destroy(softn->ipf_nat_tcptq);
589
590 MUTEX_DESTROY(&softn->ipf_nat_new);
591 MUTEX_DESTROY(&softn->ipf_nat_io);
592
593 MUTEX_DESTROY(&softn->ipf_nat_udptq.ifq_lock);
594 MUTEX_DESTROY(&softn->ipf_nat_udpacktq.ifq_lock);
595 MUTEX_DESTROY(&softn->ipf_nat_icmptq.ifq_lock);
596 MUTEX_DESTROY(&softn->ipf_nat_icmpacktq.ifq_lock);
597 MUTEX_DESTROY(&softn->ipf_nat_iptq.ifq_lock);
598 MUTEX_DESTROY(&softn->ipf_nat_pending.ifq_lock);
599 }
600
601 return (0);
602 }
603
604
605 /* ------------------------------------------------------------------------ */
606 /* Function: ipf_nat_setlock */
607 /* Returns: Nil */
608 /* Parameters: arg(I) - pointer to soft state information */
609 /* tmp(I) - new lock value */
610 /* */
611 /* Set the "lock status" of NAT to the value in tmp. */
612 /* ------------------------------------------------------------------------ */
613 void
ipf_nat_setlock(void * arg,int tmp)614 ipf_nat_setlock(void *arg, int tmp)
615 {
616 ipf_nat_softc_t *softn = arg;
617
618 softn->ipf_nat_lock = tmp;
619 }
620
621
622 /* ------------------------------------------------------------------------ */
623 /* Function: ipf_nat_addrdr */
624 /* Returns: Nil */
625 /* Parameters: n(I) - pointer to NAT rule to add */
626 /* */
627 /* Adds a redirect rule to the hash table of redirect rules and the list of */
628 /* loaded NAT rules. Updates the bitmask indicating which netmasks are in */
629 /* use by redirect rules. */
630 /* ------------------------------------------------------------------------ */
631 static void
ipf_nat_addrdr(ipf_nat_softc_t * softn,ipnat_t * n)632 ipf_nat_addrdr(ipf_nat_softc_t *softn, ipnat_t *n)
633 {
634 ipnat_t **np;
635 u_32_t j;
636 u_int hv;
637 u_int rhv;
638 int k;
639
640 if (n->in_odstatype == FRI_NORMAL) {
641 k = count4bits(n->in_odstmsk);
642 ipf_inet_mask_add(k, &softn->ipf_nat_rdr_mask);
643 j = (n->in_odstaddr & n->in_odstmsk);
644 rhv = NAT_HASH_FN(j, 0, 0xffffffff);
645 } else {
646 ipf_inet_mask_add(0, &softn->ipf_nat_rdr_mask);
647 j = 0;
648 rhv = 0;
649 }
650 hv = rhv % softn->ipf_nat_rdrrules_sz;
651 np = softn->ipf_nat_rdr_rules + hv;
652 while (*np != NULL)
653 np = &(*np)->in_rnext;
654 n->in_rnext = NULL;
655 n->in_prnext = np;
656 n->in_hv[0] = hv;
657 n->in_use++;
658 *np = n;
659 }
660
661
662 /* ------------------------------------------------------------------------ */
663 /* Function: ipf_nat_addmap */
664 /* Returns: Nil */
665 /* Parameters: n(I) - pointer to NAT rule to add */
666 /* */
667 /* Adds a NAT map rule to the hash table of rules and the list of loaded */
668 /* NAT rules. Updates the bitmask indicating which netmasks are in use by */
669 /* redirect rules. */
670 /* ------------------------------------------------------------------------ */
671 static void
ipf_nat_addmap(ipf_nat_softc_t * softn,ipnat_t * n)672 ipf_nat_addmap(ipf_nat_softc_t *softn, ipnat_t *n)
673 {
674 ipnat_t **np;
675 u_32_t j;
676 u_int hv;
677 u_int rhv;
678 int k;
679
680 if (n->in_osrcatype == FRI_NORMAL) {
681 k = count4bits(n->in_osrcmsk);
682 ipf_inet_mask_add(k, &softn->ipf_nat_map_mask);
683 j = (n->in_osrcaddr & n->in_osrcmsk);
684 rhv = NAT_HASH_FN(j, 0, 0xffffffff);
685 } else {
686 ipf_inet_mask_add(0, &softn->ipf_nat_map_mask);
687 j = 0;
688 rhv = 0;
689 }
690 hv = rhv % softn->ipf_nat_maprules_sz;
691 np = softn->ipf_nat_map_rules + hv;
692 while (*np != NULL)
693 np = &(*np)->in_mnext;
694 n->in_mnext = NULL;
695 n->in_pmnext = np;
696 n->in_hv[1] = rhv;
697 n->in_use++;
698 *np = n;
699 }
700
701
702 /* ------------------------------------------------------------------------ */
703 /* Function: ipf_nat_delrdr */
704 /* Returns: Nil */
705 /* Parameters: n(I) - pointer to NAT rule to delete */
706 /* */
707 /* Removes a redirect rule from the hash table of redirect rules. */
708 /* ------------------------------------------------------------------------ */
709 void
ipf_nat_delrdr(ipf_nat_softc_t * softn,ipnat_t * n)710 ipf_nat_delrdr(ipf_nat_softc_t *softn, ipnat_t *n)
711 {
712 if (n->in_odstatype == FRI_NORMAL) {
713 int k = count4bits(n->in_odstmsk);
714 ipf_inet_mask_del(k, &softn->ipf_nat_rdr_mask);
715 } else {
716 ipf_inet_mask_del(0, &softn->ipf_nat_rdr_mask);
717 }
718 if (n->in_rnext)
719 n->in_rnext->in_prnext = n->in_prnext;
720 *n->in_prnext = n->in_rnext;
721 n->in_use--;
722 }
723
724
725 /* ------------------------------------------------------------------------ */
726 /* Function: ipf_nat_delmap */
727 /* Returns: Nil */
728 /* Parameters: n(I) - pointer to NAT rule to delete */
729 /* */
730 /* Removes a NAT map rule from the hash table of NAT map rules. */
731 /* ------------------------------------------------------------------------ */
732 void
ipf_nat_delmap(ipf_nat_softc_t * softn,ipnat_t * n)733 ipf_nat_delmap(ipf_nat_softc_t *softn, ipnat_t *n)
734 {
735 if (n->in_osrcatype == FRI_NORMAL) {
736 int k = count4bits(n->in_osrcmsk);
737 ipf_inet_mask_del(k, &softn->ipf_nat_map_mask);
738 } else {
739 ipf_inet_mask_del(0, &softn->ipf_nat_map_mask);
740 }
741 if (n->in_mnext != NULL)
742 n->in_mnext->in_pmnext = n->in_pmnext;
743 *n->in_pmnext = n->in_mnext;
744 n->in_use--;
745 }
746
747
748 /* ------------------------------------------------------------------------ */
749 /* Function: ipf_nat_hostmap */
750 /* Returns: struct hostmap* - NULL if no hostmap could be created, */
751 /* else a pointer to the hostmapping to use */
752 /* Parameters: np(I) - pointer to NAT rule */
753 /* real(I) - real IP address */
754 /* map(I) - mapped IP address */
755 /* port(I) - destination port number */
756 /* Write Locks: ipf_nat */
757 /* */
758 /* Check if an ip address has already been allocated for a given mapping */
759 /* that is not doing port based translation. If is not yet allocated, then */
760 /* create a new entry if a non-NULL NAT rule pointer has been supplied. */
761 /* ------------------------------------------------------------------------ */
762 static struct hostmap *
ipf_nat_hostmap(ipf_nat_softc_t * softn,ipnat_t * np,struct in_addr src,struct in_addr dst,struct in_addr map,u_32_t port)763 ipf_nat_hostmap(ipf_nat_softc_t *softn, ipnat_t *np, struct in_addr src,
764 struct in_addr dst, struct in_addr map, u_32_t port)
765 {
766 hostmap_t *hm;
767 u_int hv, rhv;
768
769 hv = (src.s_addr ^ dst.s_addr);
770 hv += src.s_addr;
771 hv += dst.s_addr;
772 rhv = hv;
773 hv %= softn->ipf_nat_hostmap_sz;
774 for (hm = softn->ipf_hm_maptable[hv]; hm; hm = hm->hm_hnext)
775 if ((hm->hm_osrcip.s_addr == src.s_addr) &&
776 (hm->hm_odstip.s_addr == dst.s_addr) &&
777 ((np == NULL) || (np == hm->hm_ipnat)) &&
778 ((port == 0) || (port == hm->hm_port))) {
779 softn->ipf_nat_stats.ns_hm_addref++;
780 hm->hm_ref++;
781 return (hm);
782 }
783
784 if (np == NULL) {
785 softn->ipf_nat_stats.ns_hm_nullnp++;
786 return (NULL);
787 }
788
789 KMALLOC(hm, hostmap_t *);
790 if (hm) {
791 hm->hm_next = softn->ipf_hm_maplist;
792 hm->hm_pnext = &softn->ipf_hm_maplist;
793 if (softn->ipf_hm_maplist != NULL)
794 softn->ipf_hm_maplist->hm_pnext = &hm->hm_next;
795 softn->ipf_hm_maplist = hm;
796 hm->hm_hnext = softn->ipf_hm_maptable[hv];
797 hm->hm_phnext = softn->ipf_hm_maptable + hv;
798 if (softn->ipf_hm_maptable[hv] != NULL)
799 softn->ipf_hm_maptable[hv]->hm_phnext = &hm->hm_hnext;
800 softn->ipf_hm_maptable[hv] = hm;
801 hm->hm_ipnat = np;
802 np->in_use++;
803 hm->hm_osrcip = src;
804 hm->hm_odstip = dst;
805 hm->hm_nsrcip = map;
806 hm->hm_ndstip.s_addr = 0;
807 hm->hm_ref = 1;
808 hm->hm_port = port;
809 hm->hm_hv = rhv;
810 hm->hm_v = 4;
811 softn->ipf_nat_stats.ns_hm_new++;
812 } else {
813 softn->ipf_nat_stats.ns_hm_newfail++;
814 }
815 return (hm);
816 }
817
818
819 /* ------------------------------------------------------------------------ */
820 /* Function: ipf_nat_hostmapdel */
821 /* Returns: Nil */
822 /* Parameters: hmp(I) - pointer to hostmap structure pointer */
823 /* Write Locks: ipf_nat */
824 /* */
825 /* Decrement the references to this hostmap structure by one. If this */
826 /* reaches zero then remove it and free it. */
827 /* ------------------------------------------------------------------------ */
828 void
ipf_nat_hostmapdel(ipf_main_softc_t * softc,struct hostmap ** hmp)829 ipf_nat_hostmapdel(ipf_main_softc_t *softc, struct hostmap **hmp)
830 {
831 struct hostmap *hm;
832
833 hm = *hmp;
834 *hmp = NULL;
835
836 hm->hm_ref--;
837 if (hm->hm_ref == 0) {
838 ipf_nat_rule_deref(softc, &hm->hm_ipnat);
839 if (hm->hm_hnext)
840 hm->hm_hnext->hm_phnext = hm->hm_phnext;
841 *hm->hm_phnext = hm->hm_hnext;
842 if (hm->hm_next)
843 hm->hm_next->hm_pnext = hm->hm_pnext;
844 *hm->hm_pnext = hm->hm_next;
845 KFREE(hm);
846 }
847 }
848
849
850 /* ------------------------------------------------------------------------ */
851 /* Function: ipf_fix_outcksum */
852 /* Returns: Nil */
853 /* Parameters: cksum(I) - ipf_cksum_t, value of fin_cksum */
854 /* sp(I) - location of 16bit checksum to update */
855 /* n(I) - amount to adjust checksum by */
856 /* partial(I) - partial checksum */
857 /* */
858 /* Adjusts the 16bit checksum by "n" for packets going out. */
859 /* ------------------------------------------------------------------------ */
860 void
ipf_fix_outcksum(int cksum,u_short * sp,u_32_t n,u_32_t partial)861 ipf_fix_outcksum(int cksum, u_short *sp, u_32_t n, u_32_t partial)
862 {
863 u_short sumshort;
864 u_32_t sum1;
865
866 if (n == 0)
867 return;
868
869 if (cksum == 4) {
870 *sp = 0;
871 return;
872 }
873 if (cksum == 2) {
874 sum1 = partial;
875 sum1 = (sum1 & 0xffff) + (sum1 >> 16);
876 *sp = htons(sum1);
877 return;
878 }
879 sum1 = (~ntohs(*sp)) & 0xffff;
880 sum1 += (n);
881 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
882 /* Again */
883 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
884 sumshort = ~(u_short)sum1;
885 *(sp) = htons(sumshort);
886 }
887
888
889 /* ------------------------------------------------------------------------ */
890 /* Function: ipf_fix_incksum */
891 /* Returns: Nil */
892 /* Parameters: cksum(I) - ipf_cksum_t, value of fin_cksum */
893 /* sp(I) - location of 16bit checksum to update */
894 /* n(I) - amount to adjust checksum by */
895 /* partial(I) - partial checksum */
896 /* */
897 /* Adjusts the 16bit checksum by "n" for packets going in. */
898 /* ------------------------------------------------------------------------ */
899 void
ipf_fix_incksum(int cksum,u_short * sp,u_32_t n,u_32_t partial)900 ipf_fix_incksum(int cksum, u_short *sp, u_32_t n, u_32_t partial)
901 {
902 u_short sumshort;
903 u_32_t sum1;
904
905 if (n == 0)
906 return;
907
908 if (cksum == 4) {
909 *sp = 0;
910 return;
911 }
912 if (cksum == 2) {
913 sum1 = partial;
914 sum1 = (sum1 & 0xffff) + (sum1 >> 16);
915 *sp = htons(sum1);
916 return;
917 }
918
919 sum1 = (~ntohs(*sp)) & 0xffff;
920 sum1 += ~(n) & 0xffff;
921 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
922 /* Again */
923 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
924 sumshort = ~(u_short)sum1;
925 *(sp) = htons(sumshort);
926 }
927
928
929 /* ------------------------------------------------------------------------ */
930 /* Function: ipf_fix_datacksum */
931 /* Returns: Nil */
932 /* Parameters: sp(I) - location of 16bit checksum to update */
933 /* n(I) - amount to adjust checksum by */
934 /* */
935 /* Fix_datacksum is used *only* for the adjustments of checksums in the */
936 /* data section of an IP packet. */
937 /* */
938 /* The only situation in which you need to do this is when NAT'ing an */
939 /* ICMP error message. Such a message, contains in its body the IP header */
940 /* of the original IP packet, that causes the error. */
941 /* */
942 /* You can't use fix_incksum or fix_outcksum in that case, because for the */
943 /* kernel the data section of the ICMP error is just data, and no special */
944 /* processing like hardware cksum or ntohs processing have been done by the */
945 /* kernel on the data section. */
946 /* ------------------------------------------------------------------------ */
947 void
ipf_fix_datacksum(u_short * sp,u_32_t n)948 ipf_fix_datacksum(u_short *sp, u_32_t n)
949 {
950 u_short sumshort;
951 u_32_t sum1;
952
953 if (n == 0)
954 return;
955
956 sum1 = (~ntohs(*sp)) & 0xffff;
957 sum1 += (n);
958 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
959 /* Again */
960 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
961 sumshort = ~(u_short)sum1;
962 *(sp) = htons(sumshort);
963 }
964
965
966 /* ------------------------------------------------------------------------ */
967 /* Function: ipf_nat_ioctl */
968 /* Returns: int - 0 == success, != 0 == failure */
969 /* Parameters: softc(I) - pointer to soft context main structure */
970 /* data(I) - pointer to ioctl data */
971 /* cmd(I) - ioctl command integer */
972 /* mode(I) - file mode bits used with open */
973 /* uid(I) - uid of calling process */
974 /* ctx(I) - pointer used as key for finding context */
975 /* */
976 /* Processes an ioctl call made to operate on the IP Filter NAT device. */
977 /* ------------------------------------------------------------------------ */
978 int
ipf_nat_ioctl(ipf_main_softc_t * softc,caddr_t data,ioctlcmd_t cmd,int mode,int uid,void * ctx)979 ipf_nat_ioctl(ipf_main_softc_t *softc, caddr_t data, ioctlcmd_t cmd,
980 int mode, int uid, void *ctx)
981 {
982 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
983 int error = 0, ret, arg, getlock;
984 ipnat_t *nat, *nt, *n;
985 ipnat_t natd;
986 SPL_INT(s);
987
988 #if !SOLARIS && defined(_KERNEL)
989 # if NETBSD_GE_REV(399002000)
990 if ((mode & FWRITE) &&
991 kauth_authorize_network(curlwp->l_cred, KAUTH_NETWORK_FIREWALL,
992 KAUTH_REQ_NETWORK_FIREWALL_FW,
993 NULL, NULL, NULL))
994 # else
995 # if defined(__FreeBSD__)
996 if (securelevel_ge(curthread->td_ucred, 3) && (mode & FWRITE))
997 # else
998 if ((securelevel >= 3) && (mode & FWRITE))
999 # endif
1000 # endif
1001 {
1002 IPFERROR(60001);
1003 return (EPERM);
1004 }
1005 # if defined(__FreeBSD__)
1006 if (jailed_without_vnet(curthread->td_ucred)) {
1007 IPFERROR(60076);
1008 return (EOPNOTSUPP);
1009 }
1010 # endif
1011 #endif
1012
1013 getlock = (mode & NAT_LOCKHELD) ? 0 : 1;
1014
1015 n = NULL;
1016 nt = NULL;
1017 nat = NULL;
1018
1019 if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT) ||
1020 (cmd == (ioctlcmd_t)SIOCPURGENAT)) {
1021 if (mode & NAT_SYSSPACE) {
1022 bcopy(data, (char *)&natd, sizeof(natd));
1023 nat = &natd;
1024 error = 0;
1025 } else {
1026 bzero(&natd, sizeof(natd));
1027 error = ipf_inobj(softc, data, NULL, &natd,
1028 IPFOBJ_IPNAT);
1029 if (error != 0)
1030 goto done;
1031
1032 if (natd.in_size < sizeof(ipnat_t)) {
1033 error = EINVAL;
1034 goto done;
1035 }
1036 KMALLOCS(nt, ipnat_t *, natd.in_size);
1037 if (nt == NULL) {
1038 IPFERROR(60070);
1039 error = ENOMEM;
1040 goto done;
1041 }
1042 bzero(nt, natd.in_size);
1043 error = ipf_inobjsz(softc, data, nt, IPFOBJ_IPNAT,
1044 natd.in_size);
1045 if (error)
1046 goto done;
1047 nat = nt;
1048 }
1049
1050 /*
1051 * For add/delete, look to see if the NAT entry is
1052 * already present
1053 */
1054 nat->in_flags &= IPN_USERFLAGS;
1055 if ((nat->in_redir & NAT_MAPBLK) == 0) {
1056 if (nat->in_osrcatype == FRI_NORMAL ||
1057 nat->in_osrcatype == FRI_NONE)
1058 nat->in_osrcaddr &= nat->in_osrcmsk;
1059 if (nat->in_odstatype == FRI_NORMAL ||
1060 nat->in_odstatype == FRI_NONE)
1061 nat->in_odstaddr &= nat->in_odstmsk;
1062 if ((nat->in_flags & (IPN_SPLIT|IPN_SIPRANGE)) == 0) {
1063 if (nat->in_nsrcatype == FRI_NORMAL)
1064 nat->in_nsrcaddr &= nat->in_nsrcmsk;
1065 if (nat->in_ndstatype == FRI_NORMAL)
1066 nat->in_ndstaddr &= nat->in_ndstmsk;
1067 }
1068 }
1069
1070 error = ipf_nat_rule_init(softc, softn, nat);
1071 if (error != 0)
1072 goto done;
1073
1074 MUTEX_ENTER(&softn->ipf_nat_io);
1075 for (n = softn->ipf_nat_list; n != NULL; n = n->in_next)
1076 if (ipf_nat_cmp_rules(nat, n) == 0)
1077 break;
1078 }
1079
1080 switch (cmd)
1081 {
1082 #ifdef IPFILTER_LOG
1083 case SIOCIPFFB :
1084 {
1085 int tmp;
1086
1087 if (!(mode & FWRITE)) {
1088 IPFERROR(60002);
1089 error = EPERM;
1090 } else {
1091 tmp = ipf_log_clear(softc, IPL_LOGNAT);
1092 error = BCOPYOUT(&tmp, data, sizeof(tmp));
1093 if (error != 0) {
1094 IPFERROR(60057);
1095 error = EFAULT;
1096 }
1097 }
1098 break;
1099 }
1100
1101 case SIOCSETLG :
1102 if (!(mode & FWRITE)) {
1103 IPFERROR(60003);
1104 error = EPERM;
1105 } else {
1106 error = BCOPYIN(data, &softn->ipf_nat_logging,
1107 sizeof(softn->ipf_nat_logging));
1108 if (error != 0)
1109 error = EFAULT;
1110 }
1111 break;
1112
1113 case SIOCGETLG :
1114 error = BCOPYOUT(&softn->ipf_nat_logging, data,
1115 sizeof(softn->ipf_nat_logging));
1116 if (error != 0) {
1117 IPFERROR(60004);
1118 error = EFAULT;
1119 }
1120 break;
1121
1122 case FIONREAD :
1123 arg = ipf_log_bytesused(softc, IPL_LOGNAT);
1124 error = BCOPYOUT(&arg, data, sizeof(arg));
1125 if (error != 0) {
1126 IPFERROR(60005);
1127 error = EFAULT;
1128 }
1129 break;
1130 #endif
1131 case SIOCADNAT :
1132 if (!(mode & FWRITE)) {
1133 IPFERROR(60006);
1134 error = EPERM;
1135 } else if (n != NULL) {
1136 natd.in_flineno = n->in_flineno;
1137 (void) ipf_outobj(softc, data, &natd, IPFOBJ_IPNAT);
1138 IPFERROR(60007);
1139 error = EEXIST;
1140 } else if (nt == NULL) {
1141 IPFERROR(60008);
1142 error = ENOMEM;
1143 }
1144 if (error != 0) {
1145 MUTEX_EXIT(&softn->ipf_nat_io);
1146 break;
1147 }
1148 if (nat != nt)
1149 bcopy((char *)nat, (char *)nt, sizeof(*n));
1150 error = ipf_nat_siocaddnat(softc, softn, nt, getlock);
1151 MUTEX_EXIT(&softn->ipf_nat_io);
1152 if (error == 0) {
1153 nat = NULL;
1154 nt = NULL;
1155 }
1156 break;
1157
1158 case SIOCRMNAT :
1159 case SIOCPURGENAT :
1160 if (!(mode & FWRITE)) {
1161 IPFERROR(60009);
1162 error = EPERM;
1163 n = NULL;
1164 } else if (n == NULL) {
1165 IPFERROR(60010);
1166 error = ESRCH;
1167 }
1168
1169 if (error != 0) {
1170 MUTEX_EXIT(&softn->ipf_nat_io);
1171 break;
1172 }
1173 if (cmd == (ioctlcmd_t)SIOCPURGENAT) {
1174 error = ipf_outobjsz(softc, data, n, IPFOBJ_IPNAT,
1175 n->in_size);
1176 if (error) {
1177 MUTEX_EXIT(&softn->ipf_nat_io);
1178 goto done;
1179 }
1180 n->in_flags |= IPN_PURGE;
1181 }
1182 ipf_nat_siocdelnat(softc, softn, n, getlock);
1183
1184 MUTEX_EXIT(&softn->ipf_nat_io);
1185 n = NULL;
1186 break;
1187
1188 case SIOCGNATS :
1189 {
1190 natstat_t *nsp = &softn->ipf_nat_stats;
1191
1192 nsp->ns_side[0].ns_table = softn->ipf_nat_table[0];
1193 nsp->ns_side[1].ns_table = softn->ipf_nat_table[1];
1194 nsp->ns_list = softn->ipf_nat_list;
1195 nsp->ns_maptable = softn->ipf_hm_maptable;
1196 nsp->ns_maplist = softn->ipf_hm_maplist;
1197 nsp->ns_nattab_sz = softn->ipf_nat_table_sz;
1198 nsp->ns_nattab_max = softn->ipf_nat_table_max;
1199 nsp->ns_rultab_sz = softn->ipf_nat_maprules_sz;
1200 nsp->ns_rdrtab_sz = softn->ipf_nat_rdrrules_sz;
1201 nsp->ns_hostmap_sz = softn->ipf_nat_hostmap_sz;
1202 nsp->ns_instances = softn->ipf_nat_instances;
1203 nsp->ns_ticks = softc->ipf_ticks;
1204 #ifdef IPFILTER_LOGGING
1205 nsp->ns_log_ok = ipf_log_logok(softc, IPF_LOGNAT);
1206 nsp->ns_log_fail = ipf_log_failures(softc, IPF_LOGNAT);
1207 #else
1208 nsp->ns_log_ok = 0;
1209 nsp->ns_log_fail = 0;
1210 #endif
1211 error = ipf_outobj(softc, data, nsp, IPFOBJ_NATSTAT);
1212 break;
1213 }
1214
1215 case SIOCGNATL :
1216 {
1217 natlookup_t nl;
1218
1219 error = ipf_inobj(softc, data, NULL, &nl, IPFOBJ_NATLOOKUP);
1220 if (error == 0) {
1221 void *ptr;
1222
1223 if (getlock) {
1224 READ_ENTER(&softc->ipf_nat);
1225 }
1226
1227 switch (nl.nl_v)
1228 {
1229 case 4 :
1230 ptr = ipf_nat_lookupredir(&nl);
1231 break;
1232 #ifdef USE_INET6
1233 case 6 :
1234 ptr = ipf_nat6_lookupredir(&nl);
1235 break;
1236 #endif
1237 default:
1238 ptr = NULL;
1239 break;
1240 }
1241
1242 if (getlock) {
1243 RWLOCK_EXIT(&softc->ipf_nat);
1244 }
1245 if (ptr != NULL) {
1246 error = ipf_outobj(softc, data, &nl,
1247 IPFOBJ_NATLOOKUP);
1248 } else {
1249 IPFERROR(60011);
1250 error = ESRCH;
1251 }
1252 }
1253 break;
1254 }
1255
1256 case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */
1257 if (!(mode & FWRITE)) {
1258 IPFERROR(60012);
1259 error = EPERM;
1260 break;
1261 }
1262 if (getlock) {
1263 WRITE_ENTER(&softc->ipf_nat);
1264 }
1265
1266 error = BCOPYIN(data, &arg, sizeof(arg));
1267 if (error != 0) {
1268 IPFERROR(60013);
1269 error = EFAULT;
1270 } else {
1271 if (arg == 0)
1272 ret = ipf_nat_flushtable(softc, softn);
1273 else if (arg == 1)
1274 ret = ipf_nat_clearlist(softc, softn);
1275 else
1276 ret = ipf_nat_extraflush(softc, softn, arg);
1277 ipf_proxy_flush(softc->ipf_proxy_soft, arg);
1278 }
1279
1280 if (getlock) {
1281 RWLOCK_EXIT(&softc->ipf_nat);
1282 }
1283 if (error == 0) {
1284 error = BCOPYOUT(&ret, data, sizeof(ret));
1285 }
1286 break;
1287
1288 case SIOCMATCHFLUSH :
1289 if (!(mode & FWRITE)) {
1290 IPFERROR(60014);
1291 error = EPERM;
1292 break;
1293 }
1294 if (getlock) {
1295 WRITE_ENTER(&softc->ipf_nat);
1296 }
1297
1298 error = ipf_nat_matchflush(softc, softn, data);
1299
1300 if (getlock) {
1301 RWLOCK_EXIT(&softc->ipf_nat);
1302 }
1303 break;
1304
1305 case SIOCPROXY :
1306 error = ipf_proxy_ioctl(softc, data, cmd, mode, ctx);
1307 break;
1308
1309 case SIOCSTLCK :
1310 if (!(mode & FWRITE)) {
1311 IPFERROR(60015);
1312 error = EPERM;
1313 } else {
1314 error = ipf_lock(data, &softn->ipf_nat_lock);
1315 }
1316 break;
1317
1318 case SIOCSTPUT :
1319 if ((mode & FWRITE) != 0) {
1320 error = ipf_nat_putent(softc, data, getlock);
1321 } else {
1322 IPFERROR(60016);
1323 error = EACCES;
1324 }
1325 break;
1326
1327 case SIOCSTGSZ :
1328 if (softn->ipf_nat_lock) {
1329 error = ipf_nat_getsz(softc, data, getlock);
1330 } else {
1331 IPFERROR(60017);
1332 error = EACCES;
1333 }
1334 break;
1335
1336 case SIOCSTGET :
1337 if (softn->ipf_nat_lock) {
1338 error = ipf_nat_getent(softc, data, getlock);
1339 } else {
1340 IPFERROR(60018);
1341 error = EACCES;
1342 }
1343 break;
1344
1345 case SIOCGENITER :
1346 {
1347 ipfgeniter_t iter;
1348 ipftoken_t *token;
1349 ipfobj_t obj;
1350
1351 error = ipf_inobj(softc, data, &obj, &iter, IPFOBJ_GENITER);
1352 if (error != 0)
1353 break;
1354
1355 SPL_SCHED(s);
1356 token = ipf_token_find(softc, iter.igi_type, uid, ctx);
1357 if (token != NULL) {
1358 error = ipf_nat_iterator(softc, token, &iter, &obj);
1359 WRITE_ENTER(&softc->ipf_tokens);
1360 ipf_token_deref(softc, token);
1361 RWLOCK_EXIT(&softc->ipf_tokens);
1362 }
1363 SPL_X(s);
1364 break;
1365 }
1366
1367 case SIOCIPFDELTOK :
1368 error = BCOPYIN(data, &arg, sizeof(arg));
1369 if (error == 0) {
1370 SPL_SCHED(s);
1371 error = ipf_token_del(softc, arg, uid, ctx);
1372 SPL_X(s);
1373 } else {
1374 IPFERROR(60019);
1375 error = EFAULT;
1376 }
1377 break;
1378
1379 case SIOCGTQTAB :
1380 error = ipf_outobj(softc, data, softn->ipf_nat_tcptq,
1381 IPFOBJ_STATETQTAB);
1382 break;
1383
1384 case SIOCGTABL :
1385 error = ipf_nat_gettable(softc, softn, data);
1386 break;
1387
1388 default :
1389 IPFERROR(60020);
1390 error = EINVAL;
1391 break;
1392 }
1393 done:
1394 if (nat != NULL)
1395 ipf_nat_rule_fini(softc, nat);
1396 if (nt != NULL)
1397 KFREES(nt, nt->in_size);
1398 return (error);
1399 }
1400
1401
1402 /* ------------------------------------------------------------------------ */
1403 /* Function: ipf_nat_siocaddnat */
1404 /* Returns: int - 0 == success, != 0 == failure */
1405 /* Parameters: softc(I) - pointer to soft context main structure */
1406 /* softn(I) - pointer to NAT context structure */
1407 /* n(I) - pointer to new NAT rule */
1408 /* np(I) - pointer to where to insert new NAT rule */
1409 /* getlock(I) - flag indicating if lock on is held */
1410 /* Mutex Locks: ipf_nat_io */
1411 /* */
1412 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
1413 /* from information passed to the kernel, then add it to the appropriate */
1414 /* NAT rule table(s). */
1415 /* ------------------------------------------------------------------------ */
1416 static int
ipf_nat_siocaddnat(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * n,int getlock)1417 ipf_nat_siocaddnat(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, ipnat_t *n,
1418 int getlock)
1419 {
1420 int error = 0;
1421
1422 if (ipf_nat_resolverule(softc, n) != 0) {
1423 IPFERROR(60022);
1424 return (ENOENT);
1425 }
1426
1427 if ((n->in_age[0] == 0) && (n->in_age[1] != 0)) {
1428 IPFERROR(60023);
1429 return (EINVAL);
1430 }
1431
1432 if (n->in_redir == (NAT_DIVERTUDP|NAT_MAP)) {
1433 /*
1434 * Prerecord whether or not the destination of the divert
1435 * is local or not to the interface the packet is going
1436 * to be sent out.
1437 */
1438 n->in_dlocal = ipf_deliverlocal(softc, n->in_v[1],
1439 n->in_ifps[1], &n->in_ndstip6);
1440 }
1441
1442 if (getlock) {
1443 WRITE_ENTER(&softc->ipf_nat);
1444 }
1445 n->in_next = NULL;
1446 n->in_pnext = softn->ipf_nat_list_tail;
1447 *n->in_pnext = n;
1448 softn->ipf_nat_list_tail = &n->in_next;
1449 n->in_use++;
1450
1451 if (n->in_redir & NAT_REDIRECT) {
1452 n->in_flags &= ~IPN_NOTDST;
1453 switch (n->in_v[0])
1454 {
1455 case 4 :
1456 ipf_nat_addrdr(softn, n);
1457 break;
1458 #ifdef USE_INET6
1459 case 6 :
1460 ipf_nat6_addrdr(softn, n);
1461 break;
1462 #endif
1463 default :
1464 break;
1465 }
1466 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules_rdr);
1467 }
1468
1469 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
1470 n->in_flags &= ~IPN_NOTSRC;
1471 switch (n->in_v[0])
1472 {
1473 case 4 :
1474 ipf_nat_addmap(softn, n);
1475 break;
1476 #ifdef USE_INET6
1477 case 6 :
1478 ipf_nat6_addmap(softn, n);
1479 break;
1480 #endif
1481 default :
1482 break;
1483 }
1484 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules_map);
1485 }
1486
1487 if (n->in_age[0] != 0)
1488 n->in_tqehead[0] = ipf_addtimeoutqueue(softc,
1489 &softn->ipf_nat_utqe,
1490 n->in_age[0]);
1491
1492 if (n->in_age[1] != 0)
1493 n->in_tqehead[1] = ipf_addtimeoutqueue(softc,
1494 &softn->ipf_nat_utqe,
1495 n->in_age[1]);
1496
1497 MUTEX_INIT(&n->in_lock, "ipnat rule lock");
1498
1499 n = NULL;
1500 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules);
1501 #if SOLARIS && !defined(INSTANCES)
1502 pfil_delayed_copy = 0;
1503 #endif
1504 if (getlock) {
1505 RWLOCK_EXIT(&softc->ipf_nat); /* WRITE */
1506 }
1507
1508 return (error);
1509 }
1510
1511
1512 /* ------------------------------------------------------------------------ */
1513 /* Function: ipf_nat_ruleaddrinit */
1514 /* Parameters: softc(I) - pointer to soft context main structure */
1515 /* softn(I) - pointer to NAT context structure */
1516 /* n(I) - pointer to NAT rule */
1517 /* */
1518 /* Initialise all of the NAT address structures in a NAT rule. */
1519 /* ------------------------------------------------------------------------ */
1520 static int
ipf_nat_ruleaddrinit(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * n)1521 ipf_nat_ruleaddrinit(ipf_main_softc_t *softc, ipf_nat_softc_t *softn,
1522 ipnat_t *n)
1523 {
1524 int idx, error;
1525
1526 if ((n->in_ndst.na_atype == FRI_LOOKUP) &&
1527 (n->in_ndst.na_type != IPLT_DSTLIST)) {
1528 IPFERROR(60071);
1529 return (EINVAL);
1530 }
1531 if ((n->in_nsrc.na_atype == FRI_LOOKUP) &&
1532 (n->in_nsrc.na_type != IPLT_DSTLIST)) {
1533 IPFERROR(60069);
1534 return (EINVAL);
1535 }
1536
1537 if (n->in_redir == NAT_BIMAP) {
1538 n->in_ndstaddr = n->in_osrcaddr;
1539 n->in_ndstmsk = n->in_osrcmsk;
1540 n->in_odstaddr = n->in_nsrcaddr;
1541 n->in_odstmsk = n->in_nsrcmsk;
1542
1543 }
1544
1545 if (n->in_redir & NAT_REDIRECT)
1546 idx = 1;
1547 else
1548 idx = 0;
1549 /*
1550 * Initialise all of the address fields.
1551 */
1552 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_osrc, 1,
1553 n->in_ifps[idx]);
1554 if (error != 0)
1555 return (error);
1556
1557 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_odst, 1,
1558 n->in_ifps[idx]);
1559 if (error != 0)
1560 return (error);
1561
1562 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_nsrc, 1,
1563 n->in_ifps[idx]);
1564 if (error != 0)
1565 return (error);
1566
1567 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_ndst, 1,
1568 n->in_ifps[idx]);
1569 if (error != 0)
1570 return (error);
1571
1572 if (n->in_redir & NAT_DIVERTUDP)
1573 ipf_nat_builddivertmp(softn, n);
1574
1575 return (0);
1576 }
1577
1578
1579 /* ------------------------------------------------------------------------ */
1580 /* Function: ipf_nat_resolvrule */
1581 /* Returns: Nil */
1582 /* Parameters: softc(I) - pointer to soft context main structure */
1583 /* n(I) - pointer to NAT rule */
1584 /* */
1585 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
1586 /* from information passed to the kernel, then add it to the appropriate */
1587 /* NAT rule table(s). */
1588 /* ------------------------------------------------------------------------ */
1589 static int
ipf_nat_resolverule(ipf_main_softc_t * softc,ipnat_t * n)1590 ipf_nat_resolverule(ipf_main_softc_t *softc, ipnat_t *n)
1591 {
1592 char *base;
1593
1594 base = n->in_names;
1595
1596 n->in_ifps[0] = ipf_resolvenic(softc, base + n->in_ifnames[0],
1597 n->in_v[0]);
1598
1599 if (n->in_ifnames[1] == -1) {
1600 n->in_ifnames[1] = n->in_ifnames[0];
1601 n->in_ifps[1] = n->in_ifps[0];
1602 } else {
1603 n->in_ifps[1] = ipf_resolvenic(softc, base + n->in_ifnames[1],
1604 n->in_v[1]);
1605 }
1606
1607 if (n->in_plabel != -1) {
1608 if (n->in_redir & NAT_REDIRECT)
1609 n->in_apr = ipf_proxy_lookup(softc->ipf_proxy_soft,
1610 n->in_pr[0],
1611 base + n->in_plabel);
1612 else
1613 n->in_apr = ipf_proxy_lookup(softc->ipf_proxy_soft,
1614 n->in_pr[1],
1615 base + n->in_plabel);
1616 if (n->in_apr == NULL)
1617 return (-1);
1618 }
1619 return (0);
1620 }
1621
1622
1623 /* ------------------------------------------------------------------------ */
1624 /* Function: ipf_nat_siocdelnat */
1625 /* Returns: int - 0 == success, != 0 == failure */
1626 /* Parameters: softc(I) - pointer to soft context main structure */
1627 /* softn(I) - pointer to NAT context structure */
1628 /* n(I) - pointer to new NAT rule */
1629 /* getlock(I) - flag indicating if lock on is held */
1630 /* Mutex Locks: ipf_nat_io */
1631 /* */
1632 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
1633 /* from information passed to the kernel, then add it to the appropriate */
1634 /* NAT rule table(s). */
1635 /* ------------------------------------------------------------------------ */
1636 static void
ipf_nat_siocdelnat(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * n,int getlock)1637 ipf_nat_siocdelnat(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, ipnat_t *n,
1638 int getlock)
1639 {
1640 if (getlock) {
1641 WRITE_ENTER(&softc->ipf_nat);
1642 }
1643
1644 ipf_nat_delrule(softc, softn, n, 1);
1645
1646 if (getlock) {
1647 RWLOCK_EXIT(&softc->ipf_nat); /* READ/WRITE */
1648 }
1649 }
1650
1651
1652 /* ------------------------------------------------------------------------ */
1653 /* Function: ipf_nat_getsz */
1654 /* Returns: int - 0 == success, != 0 is the error value. */
1655 /* Parameters: softc(I) - pointer to soft context main structure */
1656 /* data(I) - pointer to natget structure with kernel */
1657 /* pointer get the size of. */
1658 /* getlock(I) - flag indicating whether or not the caller */
1659 /* holds a lock on ipf_nat */
1660 /* */
1661 /* Handle SIOCSTGSZ. */
1662 /* Return the size of the nat list entry to be copied back to user space. */
1663 /* The size of the entry is stored in the ng_sz field and the enture natget */
1664 /* structure is copied back to the user. */
1665 /* ------------------------------------------------------------------------ */
1666 static int
ipf_nat_getsz(ipf_main_softc_t * softc,caddr_t data,int getlock)1667 ipf_nat_getsz(ipf_main_softc_t *softc, caddr_t data, int getlock)
1668 {
1669 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1670 ap_session_t *aps;
1671 nat_t *nat, *n;
1672 natget_t ng;
1673 int error;
1674
1675 error = BCOPYIN(data, &ng, sizeof(ng));
1676 if (error != 0) {
1677 IPFERROR(60024);
1678 return (EFAULT);
1679 }
1680
1681 if (getlock) {
1682 READ_ENTER(&softc->ipf_nat);
1683 }
1684
1685 nat = ng.ng_ptr;
1686 if (!nat) {
1687 nat = softn->ipf_nat_instances;
1688 ng.ng_sz = 0;
1689 /*
1690 * Empty list so the size returned is 0. Simple.
1691 */
1692 if (nat == NULL) {
1693 if (getlock) {
1694 RWLOCK_EXIT(&softc->ipf_nat);
1695 }
1696 error = BCOPYOUT(&ng, data, sizeof(ng));
1697 if (error != 0) {
1698 IPFERROR(60025);
1699 return (EFAULT);
1700 }
1701 return (0);
1702 }
1703 } else {
1704 /*
1705 * Make sure the pointer we're copying from exists in the
1706 * current list of entries. Security precaution to prevent
1707 * copying of random kernel data.
1708 */
1709 for (n = softn->ipf_nat_instances; n; n = n->nat_next)
1710 if (n == nat)
1711 break;
1712 if (n == NULL) {
1713 if (getlock) {
1714 RWLOCK_EXIT(&softc->ipf_nat);
1715 }
1716 IPFERROR(60026);
1717 return (ESRCH);
1718 }
1719 }
1720
1721 /*
1722 * Include any space required for proxy data structures.
1723 */
1724 ng.ng_sz = sizeof(nat_save_t);
1725 aps = nat->nat_aps;
1726 if (aps != NULL) {
1727 ng.ng_sz += sizeof(ap_session_t) - 4;
1728 if (aps->aps_data != 0)
1729 ng.ng_sz += aps->aps_psiz;
1730 }
1731 if (getlock) {
1732 RWLOCK_EXIT(&softc->ipf_nat);
1733 }
1734
1735 error = BCOPYOUT(&ng, data, sizeof(ng));
1736 if (error != 0) {
1737 IPFERROR(60027);
1738 return (EFAULT);
1739 }
1740 return (0);
1741 }
1742
1743
1744 /* ------------------------------------------------------------------------ */
1745 /* Function: ipf_nat_getent */
1746 /* Returns: int - 0 == success, != 0 is the error value. */
1747 /* Parameters: softc(I) - pointer to soft context main structure */
1748 /* data(I) - pointer to natget structure with kernel pointer*/
1749 /* to NAT structure to copy out. */
1750 /* getlock(I) - flag indicating whether or not the caller */
1751 /* holds a lock on ipf_nat */
1752 /* */
1753 /* Handle SIOCSTGET. */
1754 /* Copies out NAT entry to user space. Any additional data held for a */
1755 /* proxy is also copied, as to is the NAT rule which was responsible for it */
1756 /* ------------------------------------------------------------------------ */
1757 static int
ipf_nat_getent(ipf_main_softc_t * softc,caddr_t data,int getlock)1758 ipf_nat_getent(ipf_main_softc_t *softc, caddr_t data, int getlock)
1759 {
1760 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1761 int error, outsize;
1762 ap_session_t *aps;
1763 nat_save_t *ipn, ipns;
1764 nat_t *n, *nat;
1765
1766 error = ipf_inobj(softc, data, NULL, &ipns, IPFOBJ_NATSAVE);
1767 if (error != 0)
1768 return (error);
1769
1770 if ((ipns.ipn_dsize < sizeof(ipns)) || (ipns.ipn_dsize > 81920)) {
1771 IPFERROR(60028);
1772 return (EINVAL);
1773 }
1774
1775 KMALLOCS(ipn, nat_save_t *, ipns.ipn_dsize);
1776 if (ipn == NULL) {
1777 IPFERROR(60029);
1778 return (ENOMEM);
1779 }
1780
1781 if (getlock) {
1782 READ_ENTER(&softc->ipf_nat);
1783 }
1784
1785 ipn->ipn_dsize = ipns.ipn_dsize;
1786 nat = ipns.ipn_next;
1787 if (nat == NULL) {
1788 nat = softn->ipf_nat_instances;
1789 if (nat == NULL) {
1790 if (softn->ipf_nat_instances == NULL) {
1791 IPFERROR(60030);
1792 error = ENOENT;
1793 }
1794 goto finished;
1795 }
1796 } else {
1797 /*
1798 * Make sure the pointer we're copying from exists in the
1799 * current list of entries. Security precaution to prevent
1800 * copying of random kernel data.
1801 */
1802 for (n = softn->ipf_nat_instances; n; n = n->nat_next)
1803 if (n == nat)
1804 break;
1805 if (n == NULL) {
1806 IPFERROR(60031);
1807 error = ESRCH;
1808 goto finished;
1809 }
1810 }
1811 ipn->ipn_next = nat->nat_next;
1812
1813 /*
1814 * Copy the NAT structure.
1815 */
1816 bcopy((char *)nat, &ipn->ipn_nat, sizeof(*nat));
1817
1818 /*
1819 * If we have a pointer to the NAT rule it belongs to, save that too.
1820 */
1821 if (nat->nat_ptr != NULL)
1822 bcopy((char *)nat->nat_ptr, (char *)&ipn->ipn_ipnat,
1823 ipn->ipn_ipnat.in_size);
1824
1825 /*
1826 * If we also know the NAT entry has an associated filter rule,
1827 * save that too.
1828 */
1829 if (nat->nat_fr != NULL)
1830 bcopy((char *)nat->nat_fr, (char *)&ipn->ipn_fr,
1831 sizeof(ipn->ipn_fr));
1832
1833 /*
1834 * Last but not least, if there is an application proxy session set
1835 * up for this NAT entry, then copy that out too, including any
1836 * private data saved along side it by the proxy.
1837 */
1838 aps = nat->nat_aps;
1839 outsize = ipn->ipn_dsize - sizeof(*ipn) + sizeof(ipn->ipn_data);
1840 if (aps != NULL) {
1841 char *s;
1842
1843 if (outsize < sizeof(*aps)) {
1844 IPFERROR(60032);
1845 error = ENOBUFS;
1846 goto finished;
1847 }
1848
1849 s = ipn->ipn_data;
1850 bcopy((char *)aps, s, sizeof(*aps));
1851 s += sizeof(*aps);
1852 outsize -= sizeof(*aps);
1853 if ((aps->aps_data != NULL) && (outsize >= aps->aps_psiz))
1854 bcopy(aps->aps_data, s, aps->aps_psiz);
1855 else {
1856 IPFERROR(60033);
1857 error = ENOBUFS;
1858 }
1859 }
1860 if (error == 0) {
1861 error = ipf_outobjsz(softc, data, ipn, IPFOBJ_NATSAVE,
1862 ipns.ipn_dsize);
1863 }
1864
1865 finished:
1866 if (ipn != NULL) {
1867 KFREES(ipn, ipns.ipn_dsize);
1868 }
1869 if (getlock) {
1870 RWLOCK_EXIT(&softc->ipf_nat);
1871 }
1872 return (error);
1873 }
1874
1875
1876 /* ------------------------------------------------------------------------ */
1877 /* Function: ipf_nat_putent */
1878 /* Returns: int - 0 == success, != 0 is the error value. */
1879 /* Parameters: softc(I) - pointer to soft context main structure */
1880 /* data(I) - pointer to natget structure with NAT */
1881 /* structure information to load into the kernel */
1882 /* getlock(I) - flag indicating whether or not a write lock */
1883 /* on is already held. */
1884 /* */
1885 /* Handle SIOCSTPUT. */
1886 /* Loads a NAT table entry from user space, including a NAT rule, proxy and */
1887 /* firewall rule data structures, if pointers to them indicate so. */
1888 /* ------------------------------------------------------------------------ */
1889 static int
ipf_nat_putent(ipf_main_softc_t * softc,caddr_t data,int getlock)1890 ipf_nat_putent(ipf_main_softc_t *softc, caddr_t data, int getlock)
1891 {
1892 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1893 nat_save_t ipn, *ipnn;
1894 ap_session_t *aps;
1895 nat_t *n, *nat;
1896 frentry_t *fr;
1897 fr_info_t fin;
1898 ipnat_t *in;
1899 int error;
1900
1901 error = ipf_inobj(softc, data, NULL, &ipn, IPFOBJ_NATSAVE);
1902 if (error != 0)
1903 return (error);
1904
1905 /*
1906 * Initialise early because of code at junkput label.
1907 */
1908 n = NULL;
1909 in = NULL;
1910 aps = NULL;
1911 nat = NULL;
1912 ipnn = NULL;
1913 fr = NULL;
1914
1915 /*
1916 * New entry, copy in the rest of the NAT entry if it's size is more
1917 * than just the nat_t structure.
1918 */
1919 if (ipn.ipn_dsize > sizeof(ipn)) {
1920 if (ipn.ipn_dsize > 81920) {
1921 IPFERROR(60034);
1922 error = ENOMEM;
1923 goto junkput;
1924 }
1925
1926 KMALLOCS(ipnn, nat_save_t *, ipn.ipn_dsize);
1927 if (ipnn == NULL) {
1928 IPFERROR(60035);
1929 return (ENOMEM);
1930 }
1931
1932 bzero(ipnn, ipn.ipn_dsize);
1933 error = ipf_inobjsz(softc, data, ipnn, IPFOBJ_NATSAVE,
1934 ipn.ipn_dsize);
1935 if (error != 0) {
1936 goto junkput;
1937 }
1938 } else
1939 ipnn = &ipn;
1940
1941 KMALLOC(nat, nat_t *);
1942 if (nat == NULL) {
1943 IPFERROR(60037);
1944 error = ENOMEM;
1945 goto junkput;
1946 }
1947
1948 bcopy((char *)&ipnn->ipn_nat, (char *)nat, sizeof(*nat));
1949
1950 switch (nat->nat_v[0])
1951 {
1952 case 4:
1953 #ifdef USE_INET6
1954 case 6 :
1955 #endif
1956 break;
1957 default :
1958 IPFERROR(60061);
1959 error = EPROTONOSUPPORT;
1960 goto junkput;
1961 /*NOTREACHED*/
1962 }
1963
1964 /*
1965 * Initialize all these so that ipf_nat_delete() doesn't cause a crash.
1966 */
1967 bzero((char *)nat, offsetof(struct nat, nat_tqe));
1968 nat->nat_tqe.tqe_pnext = NULL;
1969 nat->nat_tqe.tqe_next = NULL;
1970 nat->nat_tqe.tqe_ifq = NULL;
1971 nat->nat_tqe.tqe_parent = nat;
1972
1973 /*
1974 * Restore the rule associated with this nat session
1975 */
1976 in = ipnn->ipn_nat.nat_ptr;
1977 if (in != NULL) {
1978 KMALLOCS(in, ipnat_t *, ipnn->ipn_ipnat.in_size);
1979 nat->nat_ptr = in;
1980 if (in == NULL) {
1981 IPFERROR(60038);
1982 error = ENOMEM;
1983 goto junkput;
1984 }
1985 bcopy((char *)&ipnn->ipn_ipnat, (char *)in,
1986 ipnn->ipn_ipnat.in_size);
1987 in->in_use = 1;
1988 in->in_flags |= IPN_DELETE;
1989
1990 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules);
1991
1992 if (ipf_nat_resolverule(softc, in) != 0) {
1993 IPFERROR(60039);
1994 error = ESRCH;
1995 goto junkput;
1996 }
1997 }
1998
1999 /*
2000 * Check that the NAT entry doesn't already exist in the kernel.
2001 *
2002 * For NAT_OUTBOUND, we're lookup for a duplicate MAP entry. To do
2003 * this, we check to see if the inbound combination of addresses and
2004 * ports is already known. Similar logic is applied for NAT_INBOUND.
2005 *
2006 */
2007 bzero((char *)&fin, sizeof(fin));
2008 fin.fin_v = nat->nat_v[0];
2009 fin.fin_p = nat->nat_pr[0];
2010 fin.fin_rev = nat->nat_rev;
2011 fin.fin_ifp = nat->nat_ifps[0];
2012 fin.fin_data[0] = ntohs(nat->nat_ndport);
2013 fin.fin_data[1] = ntohs(nat->nat_nsport);
2014
2015 switch (nat->nat_dir)
2016 {
2017 case NAT_OUTBOUND :
2018 case NAT_DIVERTOUT :
2019 if (getlock) {
2020 READ_ENTER(&softc->ipf_nat);
2021 }
2022
2023 fin.fin_v = nat->nat_v[1];
2024 if (nat->nat_v[1] == 4) {
2025 n = ipf_nat_inlookup(&fin, nat->nat_flags, fin.fin_p,
2026 nat->nat_ndstip, nat->nat_nsrcip);
2027 #ifdef USE_INET6
2028 } else if (nat->nat_v[1] == 6) {
2029 n = ipf_nat6_inlookup(&fin, nat->nat_flags, fin.fin_p,
2030 &nat->nat_ndst6.in6,
2031 &nat->nat_nsrc6.in6);
2032 #endif
2033 }
2034
2035 if (getlock) {
2036 RWLOCK_EXIT(&softc->ipf_nat);
2037 }
2038 if (n != NULL) {
2039 IPFERROR(60040);
2040 error = EEXIST;
2041 goto junkput;
2042 }
2043 break;
2044
2045 case NAT_INBOUND :
2046 case NAT_DIVERTIN :
2047 if (getlock) {
2048 READ_ENTER(&softc->ipf_nat);
2049 }
2050
2051 if (fin.fin_v == 4) {
2052 n = ipf_nat_outlookup(&fin, nat->nat_flags, fin.fin_p,
2053 nat->nat_ndstip,
2054 nat->nat_nsrcip);
2055 #ifdef USE_INET6
2056 } else if (fin.fin_v == 6) {
2057 n = ipf_nat6_outlookup(&fin, nat->nat_flags, fin.fin_p,
2058 &nat->nat_ndst6.in6,
2059 &nat->nat_nsrc6.in6);
2060 #endif
2061 }
2062
2063 if (getlock) {
2064 RWLOCK_EXIT(&softc->ipf_nat);
2065 }
2066 if (n != NULL) {
2067 IPFERROR(60041);
2068 error = EEXIST;
2069 goto junkput;
2070 }
2071 break;
2072
2073 default :
2074 IPFERROR(60042);
2075 error = EINVAL;
2076 goto junkput;
2077 }
2078
2079 /*
2080 * Restore ap_session_t structure. Include the private data allocated
2081 * if it was there.
2082 */
2083 aps = nat->nat_aps;
2084 if (aps != NULL) {
2085 KMALLOC(aps, ap_session_t *);
2086 nat->nat_aps = aps;
2087 if (aps == NULL) {
2088 IPFERROR(60043);
2089 error = ENOMEM;
2090 goto junkput;
2091 }
2092 bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps));
2093 if (in != NULL)
2094 aps->aps_apr = in->in_apr;
2095 else
2096 aps->aps_apr = NULL;
2097 if (aps->aps_psiz != 0) {
2098 if (aps->aps_psiz > 81920) {
2099 IPFERROR(60044);
2100 error = ENOMEM;
2101 goto junkput;
2102 }
2103 KMALLOCS(aps->aps_data, void *, aps->aps_psiz);
2104 if (aps->aps_data == NULL) {
2105 IPFERROR(60045);
2106 error = ENOMEM;
2107 goto junkput;
2108 }
2109 bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data,
2110 aps->aps_psiz);
2111 } else {
2112 aps->aps_psiz = 0;
2113 aps->aps_data = NULL;
2114 }
2115 }
2116
2117 /*
2118 * If there was a filtering rule associated with this entry then
2119 * build up a new one.
2120 */
2121 fr = nat->nat_fr;
2122 if (fr != NULL) {
2123 if ((nat->nat_flags & SI_NEWFR) != 0) {
2124 KMALLOC(fr, frentry_t *);
2125 nat->nat_fr = fr;
2126 if (fr == NULL) {
2127 IPFERROR(60046);
2128 error = ENOMEM;
2129 goto junkput;
2130 }
2131 ipnn->ipn_nat.nat_fr = fr;
2132 fr->fr_ref = 1;
2133 (void) ipf_outobj(softc, data, ipnn, IPFOBJ_NATSAVE);
2134 bcopy((char *)&ipnn->ipn_fr, (char *)fr, sizeof(*fr));
2135
2136 fr->fr_ref = 1;
2137 fr->fr_dsize = 0;
2138 fr->fr_data = NULL;
2139 fr->fr_type = FR_T_NONE;
2140
2141 MUTEX_NUKE(&fr->fr_lock);
2142 MUTEX_INIT(&fr->fr_lock, "nat-filter rule lock");
2143 } else {
2144 if (getlock) {
2145 READ_ENTER(&softc->ipf_nat);
2146 }
2147 for (n = softn->ipf_nat_instances; n; n = n->nat_next)
2148 if (n->nat_fr == fr)
2149 break;
2150
2151 if (n != NULL) {
2152 MUTEX_ENTER(&fr->fr_lock);
2153 fr->fr_ref++;
2154 MUTEX_EXIT(&fr->fr_lock);
2155 }
2156 if (getlock) {
2157 RWLOCK_EXIT(&softc->ipf_nat);
2158 }
2159
2160 if (n == NULL) {
2161 IPFERROR(60047);
2162 error = ESRCH;
2163 goto junkput;
2164 }
2165 }
2166 }
2167
2168 if (ipnn != &ipn) {
2169 KFREES(ipnn, ipn.ipn_dsize);
2170 ipnn = NULL;
2171 }
2172
2173 if (getlock) {
2174 WRITE_ENTER(&softc->ipf_nat);
2175 }
2176
2177 if (fin.fin_v == 4)
2178 error = ipf_nat_finalise(&fin, nat);
2179 #ifdef USE_INET6
2180 else
2181 error = ipf_nat6_finalise(&fin, nat);
2182 #endif
2183
2184 if (getlock) {
2185 RWLOCK_EXIT(&softc->ipf_nat);
2186 }
2187
2188 if (error == 0)
2189 return (0);
2190
2191 IPFERROR(60048);
2192 error = ENOMEM;
2193
2194 junkput:
2195 if (fr != NULL) {
2196 (void) ipf_derefrule(softc, &fr);
2197 }
2198
2199 if ((ipnn != NULL) && (ipnn != &ipn)) {
2200 KFREES(ipnn, ipn.ipn_dsize);
2201 }
2202 if (nat != NULL) {
2203 if (aps != NULL) {
2204 if (aps->aps_data != NULL) {
2205 KFREES(aps->aps_data, aps->aps_psiz);
2206 }
2207 KFREE(aps);
2208 }
2209 if (in != NULL) {
2210 if (in->in_apr)
2211 ipf_proxy_deref(in->in_apr);
2212 KFREES(in, in->in_size);
2213 }
2214 KFREE(nat);
2215 }
2216 return (error);
2217 }
2218
2219
2220 /* ------------------------------------------------------------------------ */
2221 /* Function: ipf_nat_delete */
2222 /* Returns: Nil */
2223 /* Parameters: softc(I) - pointer to soft context main structure */
2224 /* nat(I) - pointer to NAT structure to delete */
2225 /* logtype(I) - type of LOG record to create before deleting */
2226 /* Write Lock: ipf_nat */
2227 /* */
2228 /* Delete a nat entry from the various lists and table. If NAT logging is */
2229 /* enabled then generate a NAT log record for this event. */
2230 /* ------------------------------------------------------------------------ */
2231 void
ipf_nat_delete(ipf_main_softc_t * softc,struct nat * nat,int logtype)2232 ipf_nat_delete(ipf_main_softc_t *softc, struct nat *nat, int logtype)
2233 {
2234 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2235 int madeorphan = 0, bkt, removed = 0;
2236 nat_stat_side_t *nss;
2237 struct ipnat *ipn;
2238
2239 if (logtype != 0 && softn->ipf_nat_logging != 0)
2240 ipf_nat_log(softc, softn, nat, logtype);
2241
2242 /*
2243 * Take it as a general indication that all the pointers are set if
2244 * nat_pnext is set.
2245 */
2246 if (nat->nat_pnext != NULL) {
2247 removed = 1;
2248
2249 bkt = nat->nat_hv[0] % softn->ipf_nat_table_sz;
2250 nss = &softn->ipf_nat_stats.ns_side[0];
2251 if (nss->ns_bucketlen[bkt] > 0)
2252 nss->ns_bucketlen[bkt]--;
2253 if (nss->ns_bucketlen[bkt] == 0) {
2254 nss->ns_inuse--;
2255 }
2256
2257 bkt = nat->nat_hv[1] % softn->ipf_nat_table_sz;
2258 nss = &softn->ipf_nat_stats.ns_side[1];
2259 if (nss->ns_bucketlen[bkt] > 0)
2260 nss->ns_bucketlen[bkt]--;
2261 if (nss->ns_bucketlen[bkt] == 0) {
2262 nss->ns_inuse--;
2263 }
2264
2265 *nat->nat_pnext = nat->nat_next;
2266 if (nat->nat_next != NULL) {
2267 nat->nat_next->nat_pnext = nat->nat_pnext;
2268 nat->nat_next = NULL;
2269 }
2270 nat->nat_pnext = NULL;
2271
2272 *nat->nat_phnext[0] = nat->nat_hnext[0];
2273 if (nat->nat_hnext[0] != NULL) {
2274 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
2275 nat->nat_hnext[0] = NULL;
2276 }
2277 nat->nat_phnext[0] = NULL;
2278
2279 *nat->nat_phnext[1] = nat->nat_hnext[1];
2280 if (nat->nat_hnext[1] != NULL) {
2281 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
2282 nat->nat_hnext[1] = NULL;
2283 }
2284 nat->nat_phnext[1] = NULL;
2285
2286 if ((nat->nat_flags & SI_WILDP) != 0) {
2287 ATOMIC_DEC32(softn->ipf_nat_stats.ns_wilds);
2288 }
2289 madeorphan = 1;
2290 }
2291
2292 if (nat->nat_me != NULL) {
2293 *nat->nat_me = NULL;
2294 nat->nat_me = NULL;
2295 nat->nat_ref--;
2296 ASSERT(nat->nat_ref >= 0);
2297 }
2298
2299 if (nat->nat_tqe.tqe_ifq != NULL) {
2300 /*
2301 * No call to ipf_freetimeoutqueue() is made here, they are
2302 * garbage collected in ipf_nat_expire().
2303 */
2304 (void) ipf_deletequeueentry(&nat->nat_tqe);
2305 }
2306
2307 if (nat->nat_sync) {
2308 ipf_sync_del_nat(softc->ipf_sync_soft, nat->nat_sync);
2309 nat->nat_sync = NULL;
2310 }
2311
2312 if (logtype == NL_EXPIRE)
2313 softn->ipf_nat_stats.ns_expire++;
2314
2315 MUTEX_ENTER(&nat->nat_lock);
2316 /*
2317 * NL_DESTROY should only be passed in when we've got nat_ref >= 2.
2318 * This happens when a nat'd packet is blocked and we want to throw
2319 * away the NAT session.
2320 */
2321 if (logtype == NL_DESTROY) {
2322 if (nat->nat_ref > 2) {
2323 nat->nat_ref -= 2;
2324 MUTEX_EXIT(&nat->nat_lock);
2325 if (removed)
2326 softn->ipf_nat_stats.ns_orphans++;
2327 return;
2328 }
2329 } else if (nat->nat_ref > 1) {
2330 nat->nat_ref--;
2331 MUTEX_EXIT(&nat->nat_lock);
2332 if (madeorphan == 1)
2333 softn->ipf_nat_stats.ns_orphans++;
2334 return;
2335 }
2336 ASSERT(nat->nat_ref >= 0);
2337 MUTEX_EXIT(&nat->nat_lock);
2338
2339 nat->nat_ref = 0;
2340
2341 if (madeorphan == 0)
2342 softn->ipf_nat_stats.ns_orphans--;
2343
2344 /*
2345 * At this point, nat_ref can be either 0 or -1
2346 */
2347 softn->ipf_nat_stats.ns_proto[nat->nat_pr[0]]--;
2348
2349 if (nat->nat_fr != NULL) {
2350 (void) ipf_derefrule(softc, &nat->nat_fr);
2351 }
2352
2353 if (nat->nat_hm != NULL) {
2354 ipf_nat_hostmapdel(softc, &nat->nat_hm);
2355 }
2356
2357 /*
2358 * If there is an active reference from the nat entry to its parent
2359 * rule, decrement the rule's reference count and free it too if no
2360 * longer being used.
2361 */
2362 ipn = nat->nat_ptr;
2363 nat->nat_ptr = NULL;
2364
2365 if (ipn != NULL) {
2366 ipn->in_space++;
2367 ipf_nat_rule_deref(softc, &ipn);
2368 }
2369
2370 if (nat->nat_aps != NULL) {
2371 ipf_proxy_free(softc, nat->nat_aps);
2372 nat->nat_aps = NULL;
2373 }
2374
2375 MUTEX_DESTROY(&nat->nat_lock);
2376
2377 softn->ipf_nat_stats.ns_active--;
2378
2379 /*
2380 * If there's a fragment table entry too for this nat entry, then
2381 * dereference that as well. This is after nat_lock is released
2382 * because of Tru64.
2383 */
2384 ipf_frag_natforget(softc, (void *)nat);
2385
2386 KFREE(nat);
2387 }
2388
2389
2390 /* ------------------------------------------------------------------------ */
2391 /* Function: ipf_nat_flushtable */
2392 /* Returns: int - number of NAT rules deleted */
2393 /* Parameters: softc(I) - pointer to soft context main structure */
2394 /* softn(I) - pointer to NAT context structure */
2395 /* Write Lock: ipf_nat */
2396 /* */
2397 /* Deletes all currently active NAT sessions. In deleting each NAT entry a */
2398 /* log record should be emitted in ipf_nat_delete() if NAT logging is */
2399 /* enabled. */
2400 /* ------------------------------------------------------------------------ */
2401 /*
2402 * nat_flushtable - clear the NAT table of all mapping entries.
2403 */
2404 static int
ipf_nat_flushtable(ipf_main_softc_t * softc,ipf_nat_softc_t * softn)2405 ipf_nat_flushtable(ipf_main_softc_t *softc, ipf_nat_softc_t *softn)
2406 {
2407 nat_t *nat;
2408 int j = 0;
2409
2410 /*
2411 * ALL NAT mappings deleted, so lets just make the deletions
2412 * quicker.
2413 */
2414 if (softn->ipf_nat_table[0] != NULL)
2415 bzero((char *)softn->ipf_nat_table[0],
2416 sizeof(softn->ipf_nat_table[0]) *
2417 softn->ipf_nat_table_sz);
2418 if (softn->ipf_nat_table[1] != NULL)
2419 bzero((char *)softn->ipf_nat_table[1],
2420 sizeof(softn->ipf_nat_table[1]) *
2421 softn->ipf_nat_table_sz);
2422
2423 while ((nat = softn->ipf_nat_instances) != NULL) {
2424 ipf_nat_delete(softc, nat, NL_FLUSH);
2425 j++;
2426 }
2427
2428 return (j);
2429 }
2430
2431
2432 /* ------------------------------------------------------------------------ */
2433 /* Function: ipf_nat_clearlist */
2434 /* Returns: int - number of NAT/RDR rules deleted */
2435 /* Parameters: softc(I) - pointer to soft context main structure */
2436 /* softn(I) - pointer to NAT context structure */
2437 /* */
2438 /* Delete all rules in the current list of rules. There is nothing elegant */
2439 /* about this cleanup: simply free all entries on the list of rules and */
2440 /* clear out the tables used for hashed NAT rule lookups. */
2441 /* ------------------------------------------------------------------------ */
2442 static int
ipf_nat_clearlist(ipf_main_softc_t * softc,ipf_nat_softc_t * softn)2443 ipf_nat_clearlist(ipf_main_softc_t *softc, ipf_nat_softc_t *softn)
2444 {
2445 ipnat_t *n;
2446 int i = 0;
2447
2448 if (softn->ipf_nat_map_rules != NULL) {
2449 bzero((char *)softn->ipf_nat_map_rules,
2450 sizeof(*softn->ipf_nat_map_rules) *
2451 softn->ipf_nat_maprules_sz);
2452 }
2453 if (softn->ipf_nat_rdr_rules != NULL) {
2454 bzero((char *)softn->ipf_nat_rdr_rules,
2455 sizeof(*softn->ipf_nat_rdr_rules) *
2456 softn->ipf_nat_rdrrules_sz);
2457 }
2458
2459 while ((n = softn->ipf_nat_list) != NULL) {
2460 ipf_nat_delrule(softc, softn, n, 0);
2461 i++;
2462 }
2463 #if SOLARIS && !defined(INSTANCES)
2464 pfil_delayed_copy = 1;
2465 #endif
2466 return (i);
2467 }
2468
2469
2470 /* ------------------------------------------------------------------------ */
2471 /* Function: ipf_nat_delrule */
2472 /* Returns: Nil */
2473 /* Parameters: softc(I) - pointer to soft context main structure */
2474 /* softn(I) - pointer to NAT context structure */
2475 /* np(I) - pointer to NAT rule to delete */
2476 /* purge(I) - 1 == allow purge, 0 == prevent purge */
2477 /* Locks: WRITE(ipf_nat) */
2478 /* */
2479 /* Preventing "purge" from occuring is allowed because when all of the NAT */
2480 /* rules are being removed, allowing the "purge" to walk through the list */
2481 /* of NAT sessions, possibly multiple times, would be a large performance */
2482 /* hit, on the order of O(N^2). */
2483 /* ------------------------------------------------------------------------ */
2484 static void
ipf_nat_delrule(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * np,int purge)2485 ipf_nat_delrule(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, ipnat_t *np,
2486 int purge)
2487 {
2488
2489 if (np->in_pnext != NULL) {
2490 *np->in_pnext = np->in_next;
2491 if (np->in_next != NULL)
2492 np->in_next->in_pnext = np->in_pnext;
2493 if (softn->ipf_nat_list_tail == &np->in_next)
2494 softn->ipf_nat_list_tail = np->in_pnext;
2495 }
2496
2497 if ((purge == 1) && ((np->in_flags & IPN_PURGE) != 0)) {
2498 nat_t *next;
2499 nat_t *nat;
2500
2501 for (next = softn->ipf_nat_instances; (nat = next) != NULL;) {
2502 next = nat->nat_next;
2503 if (nat->nat_ptr == np)
2504 ipf_nat_delete(softc, nat, NL_PURGE);
2505 }
2506 }
2507
2508 if ((np->in_flags & IPN_DELETE) == 0) {
2509 if (np->in_redir & NAT_REDIRECT) {
2510 switch (np->in_v[0])
2511 {
2512 case 4 :
2513 ipf_nat_delrdr(softn, np);
2514 break;
2515 #ifdef USE_INET6
2516 case 6 :
2517 ipf_nat6_delrdr(softn, np);
2518 break;
2519 #endif
2520 }
2521 }
2522 if (np->in_redir & (NAT_MAPBLK|NAT_MAP)) {
2523 switch (np->in_v[0])
2524 {
2525 case 4 :
2526 ipf_nat_delmap(softn, np);
2527 break;
2528 #ifdef USE_INET6
2529 case 6 :
2530 ipf_nat6_delmap(softn, np);
2531 break;
2532 #endif
2533 }
2534 }
2535 }
2536
2537 np->in_flags |= IPN_DELETE;
2538 ipf_nat_rule_deref(softc, &np);
2539 }
2540
2541
2542 /* ------------------------------------------------------------------------ */
2543 /* Function: ipf_nat_newmap */
2544 /* Returns: int - -1 == error, 0 == success */
2545 /* Parameters: fin(I) - pointer to packet information */
2546 /* nat(I) - pointer to NAT entry */
2547 /* ni(I) - pointer to structure with misc. information needed */
2548 /* to create new NAT entry. */
2549 /* */
2550 /* Given an empty NAT structure, populate it with new information about a */
2551 /* new NAT session, as defined by the matching NAT rule. */
2552 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
2553 /* to the new IP address for the translation. */
2554 /* ------------------------------------------------------------------------ */
2555 static int
ipf_nat_newmap(fr_info_t * fin,nat_t * nat,natinfo_t * ni)2556 ipf_nat_newmap(fr_info_t *fin, nat_t *nat, natinfo_t *ni)
2557 {
2558 ipf_main_softc_t *softc = fin->fin_main_soft;
2559 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2560 u_short st_port, dport, sport, port, sp, dp;
2561 struct in_addr in, inb;
2562 hostmap_t *hm;
2563 u_32_t flags;
2564 u_32_t st_ip;
2565 ipnat_t *np;
2566 nat_t *natl;
2567 int l;
2568
2569 /*
2570 * If it's an outbound packet which doesn't match any existing
2571 * record, then create a new port
2572 */
2573 l = 0;
2574 hm = NULL;
2575 np = ni->nai_np;
2576 st_ip = np->in_snip;
2577 st_port = np->in_spnext;
2578 flags = nat->nat_flags;
2579
2580 if (flags & IPN_ICMPQUERY) {
2581 sport = fin->fin_data[1];
2582 dport = 0;
2583 } else {
2584 sport = htons(fin->fin_data[0]);
2585 dport = htons(fin->fin_data[1]);
2586 }
2587
2588 /*
2589 * Do a loop until we either run out of entries to try or we find
2590 * a NAT mapping that isn't currently being used. This is done
2591 * because the change to the source is not (usually) being fixed.
2592 */
2593 do {
2594 port = 0;
2595 in.s_addr = htonl(np->in_snip);
2596 if (l == 0) {
2597 /*
2598 * Check to see if there is an existing NAT
2599 * setup for this IP address pair.
2600 */
2601 hm = ipf_nat_hostmap(softn, np, fin->fin_src,
2602 fin->fin_dst, in, 0);
2603 if (hm != NULL)
2604 in.s_addr = hm->hm_nsrcip.s_addr;
2605 } else if ((l == 1) && (hm != NULL)) {
2606 ipf_nat_hostmapdel(softc, &hm);
2607 }
2608 in.s_addr = ntohl(in.s_addr);
2609
2610 nat->nat_hm = hm;
2611
2612 if ((np->in_nsrcmsk == 0xffffffff) && (np->in_spnext == 0)) {
2613 if (l > 0) {
2614 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_1);
2615 DT4(ns_exhausted_1, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2616 return (-1);
2617 }
2618 }
2619
2620 if (np->in_redir == NAT_BIMAP &&
2621 np->in_osrcmsk == np->in_nsrcmsk) {
2622 /*
2623 * map the address block in a 1:1 fashion
2624 */
2625 in.s_addr = np->in_nsrcaddr;
2626 in.s_addr |= fin->fin_saddr & ~np->in_osrcmsk;
2627 in.s_addr = ntohl(in.s_addr);
2628
2629 } else if (np->in_redir & NAT_MAPBLK) {
2630 if ((l >= np->in_ppip) || ((l > 0) &&
2631 !(flags & IPN_TCPUDP))) {
2632 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_2);
2633 DT4(ns_exhausted_2, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2634 return (-1);
2635 }
2636 /*
2637 * map-block - Calculate destination address.
2638 */
2639 in.s_addr = ntohl(fin->fin_saddr);
2640 in.s_addr &= ntohl(~np->in_osrcmsk);
2641 inb.s_addr = in.s_addr;
2642 in.s_addr /= np->in_ippip;
2643 in.s_addr &= ntohl(~np->in_nsrcmsk);
2644 in.s_addr += ntohl(np->in_nsrcaddr);
2645 /*
2646 * Calculate destination port.
2647 */
2648 if ((flags & IPN_TCPUDP) &&
2649 (np->in_ppip != 0)) {
2650 port = ntohs(sport) + l;
2651 port %= np->in_ppip;
2652 port += np->in_ppip *
2653 (inb.s_addr % np->in_ippip);
2654 port += MAPBLK_MINPORT;
2655 port = htons(port);
2656 }
2657
2658 } else if ((np->in_nsrcaddr == 0) &&
2659 (np->in_nsrcmsk == 0xffffffff)) {
2660 i6addr_t in6;
2661
2662 /*
2663 * 0/32 - use the interface's IP address.
2664 */
2665 if ((l > 0) ||
2666 ipf_ifpaddr(softc, 4, FRI_NORMAL, fin->fin_ifp,
2667 &in6, NULL) == -1) {
2668 NBUMPSIDEX(1, ns_new_ifpaddr, ns_new_ifpaddr_1);
2669 DT4(ns_new_ifpaddr_1, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2670 return (-1);
2671 }
2672 in.s_addr = ntohl(in6.in4.s_addr);
2673
2674 } else if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0)) {
2675 /*
2676 * 0/0 - use the original source address/port.
2677 */
2678 if (l > 0) {
2679 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_3);
2680 DT4(ns_exhausted_3, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2681 return (-1);
2682 }
2683 in.s_addr = ntohl(fin->fin_saddr);
2684
2685 } else if ((np->in_nsrcmsk != 0xffffffff) &&
2686 (np->in_spnext == 0) && ((l > 0) || (hm == NULL)))
2687 np->in_snip++;
2688
2689 natl = NULL;
2690
2691 if ((flags & IPN_TCPUDP) &&
2692 ((np->in_redir & NAT_MAPBLK) == 0) &&
2693 (np->in_flags & IPN_AUTOPORTMAP)) {
2694 /*
2695 * "ports auto" (without map-block)
2696 */
2697 if ((l > 0) && (l % np->in_ppip == 0)) {
2698 if ((l > np->in_ppip) &&
2699 np->in_nsrcmsk != 0xffffffff)
2700 np->in_snip++;
2701 }
2702 if (np->in_ppip != 0) {
2703 port = ntohs(sport);
2704 port += (l % np->in_ppip);
2705 port %= np->in_ppip;
2706 port += np->in_ppip *
2707 (ntohl(fin->fin_saddr) %
2708 np->in_ippip);
2709 port += MAPBLK_MINPORT;
2710 port = htons(port);
2711 }
2712
2713 } else if (((np->in_redir & NAT_MAPBLK) == 0) &&
2714 (flags & IPN_TCPUDPICMP) && (np->in_spnext != 0)) {
2715 /*
2716 * Standard port translation. Select next port.
2717 */
2718 if (np->in_flags & IPN_SEQUENTIAL) {
2719 port = np->in_spnext;
2720 } else {
2721 port = ipf_random() % (np->in_spmax -
2722 np->in_spmin + 1);
2723 port += np->in_spmin;
2724 }
2725 port = htons(port);
2726 np->in_spnext++;
2727
2728 if (np->in_spnext > np->in_spmax) {
2729 np->in_spnext = np->in_spmin;
2730 if (np->in_nsrcmsk != 0xffffffff)
2731 np->in_snip++;
2732 }
2733 }
2734
2735 if (np->in_flags & IPN_SIPRANGE) {
2736 if (np->in_snip > ntohl(np->in_nsrcmsk))
2737 np->in_snip = ntohl(np->in_nsrcaddr);
2738 } else {
2739 if ((np->in_nsrcmsk != 0xffffffff) &&
2740 ((np->in_snip + 1) & ntohl(np->in_nsrcmsk)) >
2741 ntohl(np->in_nsrcaddr))
2742 np->in_snip = ntohl(np->in_nsrcaddr) + 1;
2743 }
2744
2745 if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY)))
2746 port = sport;
2747
2748 /*
2749 * Here we do a lookup of the connection as seen from
2750 * the outside. If an IP# pair already exists, try
2751 * again. So if you have A->B becomes C->B, you can
2752 * also have D->E become C->E but not D->B causing
2753 * another C->B. Also take protocol and ports into
2754 * account when determining whether a pre-existing
2755 * NAT setup will cause an external conflict where
2756 * this is appropriate.
2757 */
2758 inb.s_addr = htonl(in.s_addr);
2759 sp = fin->fin_data[0];
2760 dp = fin->fin_data[1];
2761 fin->fin_data[0] = fin->fin_data[1];
2762 fin->fin_data[1] = ntohs(port);
2763 natl = ipf_nat_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
2764 (u_int)fin->fin_p, fin->fin_dst, inb);
2765 fin->fin_data[0] = sp;
2766 fin->fin_data[1] = dp;
2767
2768 /*
2769 * Has the search wrapped around and come back to the
2770 * start ?
2771 */
2772 if ((natl != NULL) &&
2773 (np->in_spnext != 0) && (st_port == np->in_spnext) &&
2774 (np->in_snip != 0) && (st_ip == np->in_snip)) {
2775 NBUMPSIDED(1, ns_wrap);
2776 DT4(ns_wrap, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2777 return (-1);
2778 }
2779 l++;
2780 } while (natl != NULL);
2781
2782 /* Setup the NAT table */
2783 nat->nat_osrcip = fin->fin_src;
2784 nat->nat_nsrcaddr = htonl(in.s_addr);
2785 nat->nat_odstip = fin->fin_dst;
2786 nat->nat_ndstip = fin->fin_dst;
2787 if (nat->nat_hm == NULL)
2788 nat->nat_hm = ipf_nat_hostmap(softn, np, fin->fin_src,
2789 fin->fin_dst, nat->nat_nsrcip,
2790 0);
2791
2792 if (flags & IPN_TCPUDP) {
2793 nat->nat_osport = sport;
2794 nat->nat_nsport = port; /* sport */
2795 nat->nat_odport = dport;
2796 nat->nat_ndport = dport;
2797 ((tcphdr_t *)fin->fin_dp)->th_sport = port;
2798 } else if (flags & IPN_ICMPQUERY) {
2799 nat->nat_oicmpid = fin->fin_data[1];
2800 ((icmphdr_t *)fin->fin_dp)->icmp_id = port;
2801 nat->nat_nicmpid = port;
2802 }
2803 return (0);
2804 }
2805
2806
2807 /* ------------------------------------------------------------------------ */
2808 /* Function: ipf_nat_newrdr */
2809 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */
2810 /* allow rule to be moved if IPN_ROUNDR is set. */
2811 /* Parameters: fin(I) - pointer to packet information */
2812 /* nat(I) - pointer to NAT entry */
2813 /* ni(I) - pointer to structure with misc. information needed */
2814 /* to create new NAT entry. */
2815 /* */
2816 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
2817 /* to the new IP address for the translation. */
2818 /* ------------------------------------------------------------------------ */
2819 static int
ipf_nat_newrdr(fr_info_t * fin,nat_t * nat,natinfo_t * ni)2820 ipf_nat_newrdr(fr_info_t *fin, nat_t *nat, natinfo_t *ni)
2821 {
2822 ipf_main_softc_t *softc = fin->fin_main_soft;
2823 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2824 u_short nport, dport, sport;
2825 struct in_addr in, inb;
2826 u_short sp, dp;
2827 hostmap_t *hm;
2828 u_32_t flags;
2829 ipnat_t *np;
2830 nat_t *natl;
2831 int move;
2832
2833 move = 1;
2834 hm = NULL;
2835 in.s_addr = 0;
2836 np = ni->nai_np;
2837 flags = nat->nat_flags;
2838
2839 if (flags & IPN_ICMPQUERY) {
2840 dport = fin->fin_data[1];
2841 sport = 0;
2842 } else {
2843 sport = htons(fin->fin_data[0]);
2844 dport = htons(fin->fin_data[1]);
2845 }
2846
2847 /* TRACE sport, dport */
2848
2849
2850 /*
2851 * If the matching rule has IPN_STICKY set, then we want to have the
2852 * same rule kick in as before. Why would this happen? If you have
2853 * a collection of rdr rules with "round-robin sticky", the current
2854 * packet might match a different one to the previous connection but
2855 * we want the same destination to be used.
2856 */
2857 if (((np->in_flags & (IPN_ROUNDR|IPN_SPLIT)) != 0) &&
2858 ((np->in_flags & IPN_STICKY) != 0)) {
2859 hm = ipf_nat_hostmap(softn, NULL, fin->fin_src, fin->fin_dst,
2860 in, (u_32_t)dport);
2861 if (hm != NULL) {
2862 in.s_addr = ntohl(hm->hm_ndstip.s_addr);
2863 np = hm->hm_ipnat;
2864 ni->nai_np = np;
2865 move = 0;
2866 ipf_nat_hostmapdel(softc, &hm);
2867 }
2868 }
2869
2870 /*
2871 * Otherwise, it's an inbound packet. Most likely, we don't
2872 * want to rewrite source ports and source addresses. Instead,
2873 * we want to rewrite to a fixed internal address and fixed
2874 * internal port.
2875 */
2876 if (np->in_flags & IPN_SPLIT) {
2877 in.s_addr = np->in_dnip;
2878 inb.s_addr = htonl(in.s_addr);
2879
2880 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) {
2881 hm = ipf_nat_hostmap(softn, NULL, fin->fin_src,
2882 fin->fin_dst, inb, (u_32_t)dport);
2883 if (hm != NULL) {
2884 in.s_addr = hm->hm_ndstip.s_addr;
2885 move = 0;
2886 }
2887 }
2888
2889 if (hm == NULL || hm->hm_ref == 1) {
2890 if (np->in_ndstaddr == htonl(in.s_addr)) {
2891 np->in_dnip = ntohl(np->in_ndstmsk);
2892 move = 0;
2893 } else {
2894 np->in_dnip = ntohl(np->in_ndstaddr);
2895 }
2896 }
2897 if (hm != NULL)
2898 ipf_nat_hostmapdel(softc, &hm);
2899
2900 } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0xffffffff)) {
2901 i6addr_t in6;
2902
2903 /*
2904 * 0/32 - use the interface's IP address.
2905 */
2906 if (ipf_ifpaddr(softc, 4, FRI_NORMAL, fin->fin_ifp,
2907 &in6, NULL) == -1) {
2908 NBUMPSIDEX(0, ns_new_ifpaddr, ns_new_ifpaddr_2);
2909 DT3(ns_new_ifpaddr_2, fr_info_t *, fin, nat_t *, nat, natinfo_t, ni);
2910 return (-1);
2911 }
2912 in.s_addr = ntohl(in6.in4.s_addr);
2913
2914 } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk== 0)) {
2915 /*
2916 * 0/0 - use the original destination address/port.
2917 */
2918 in.s_addr = ntohl(fin->fin_daddr);
2919
2920 } else if (np->in_redir == NAT_BIMAP &&
2921 np->in_ndstmsk == np->in_odstmsk) {
2922 /*
2923 * map the address block in a 1:1 fashion
2924 */
2925 in.s_addr = np->in_ndstaddr;
2926 in.s_addr |= fin->fin_daddr & ~np->in_ndstmsk;
2927 in.s_addr = ntohl(in.s_addr);
2928 } else {
2929 in.s_addr = ntohl(np->in_ndstaddr);
2930 }
2931
2932 if ((np->in_dpnext == 0) || ((flags & NAT_NOTRULEPORT) != 0))
2933 nport = dport;
2934 else {
2935 /*
2936 * Whilst not optimized for the case where
2937 * pmin == pmax, the gain is not significant.
2938 */
2939 if (((np->in_flags & IPN_FIXEDDPORT) == 0) &&
2940 (np->in_odport != np->in_dtop)) {
2941 nport = ntohs(dport) - np->in_odport + np->in_dpmax;
2942 nport = htons(nport);
2943 } else {
2944 nport = htons(np->in_dpnext);
2945 np->in_dpnext++;
2946 if (np->in_dpnext > np->in_dpmax)
2947 np->in_dpnext = np->in_dpmin;
2948 }
2949 }
2950
2951 /*
2952 * When the redirect-to address is set to 0.0.0.0, just
2953 * assume a blank `forwarding' of the packet. We don't
2954 * setup any translation for this either.
2955 */
2956 if (in.s_addr == 0) {
2957 if (nport == dport) {
2958 NBUMPSIDED(0, ns_xlate_null);
2959 return (-1);
2960 }
2961 in.s_addr = ntohl(fin->fin_daddr);
2962 }
2963
2964 /*
2965 * Check to see if this redirect mapping already exists and if
2966 * it does, return "failure" (allowing it to be created will just
2967 * cause one or both of these "connections" to stop working.)
2968 */
2969 inb.s_addr = htonl(in.s_addr);
2970 sp = fin->fin_data[0];
2971 dp = fin->fin_data[1];
2972 fin->fin_data[1] = fin->fin_data[0];
2973 fin->fin_data[0] = ntohs(nport);
2974 natl = ipf_nat_outlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
2975 (u_int)fin->fin_p, inb, fin->fin_src);
2976 fin->fin_data[0] = sp;
2977 fin->fin_data[1] = dp;
2978 if (natl != NULL) {
2979 DT2(ns_new_xlate_exists, fr_info_t *, fin, nat_t *, natl);
2980 NBUMPSIDE(0, ns_xlate_exists);
2981 return (-1);
2982 }
2983
2984 inb.s_addr = htonl(in.s_addr);
2985 nat->nat_ndstaddr = htonl(in.s_addr);
2986 nat->nat_odstip = fin->fin_dst;
2987 nat->nat_nsrcip = fin->fin_src;
2988 nat->nat_osrcip = fin->fin_src;
2989 if ((nat->nat_hm == NULL) && ((np->in_flags & IPN_STICKY) != 0))
2990 nat->nat_hm = ipf_nat_hostmap(softn, np, fin->fin_src,
2991 fin->fin_dst, inb, (u_32_t)dport);
2992
2993 if (flags & IPN_TCPUDP) {
2994 nat->nat_odport = dport;
2995 nat->nat_ndport = nport;
2996 nat->nat_osport = sport;
2997 nat->nat_nsport = sport;
2998 ((tcphdr_t *)fin->fin_dp)->th_dport = nport;
2999 } else if (flags & IPN_ICMPQUERY) {
3000 nat->nat_oicmpid = fin->fin_data[1];
3001 ((icmphdr_t *)fin->fin_dp)->icmp_id = nport;
3002 nat->nat_nicmpid = nport;
3003 }
3004
3005 return (move);
3006 }
3007
3008 /* ------------------------------------------------------------------------ */
3009 /* Function: ipf_nat_add */
3010 /* Returns: nat_t* - NULL == failure to create new NAT structure, */
3011 /* else pointer to new NAT structure */
3012 /* Parameters: fin(I) - pointer to packet information */
3013 /* np(I) - pointer to NAT rule */
3014 /* natsave(I) - pointer to where to store NAT struct pointer */
3015 /* flags(I) - flags describing the current packet */
3016 /* direction(I) - direction of packet (in/out) */
3017 /* Write Lock: ipf_nat */
3018 /* */
3019 /* Attempts to create a new NAT entry. Does not actually change the packet */
3020 /* in any way. */
3021 /* */
3022 /* This function is in three main parts: (1) deal with creating a new NAT */
3023 /* structure for a "MAP" rule (outgoing NAT translation); (2) deal with */
3024 /* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */
3025 /* and (3) building that structure and putting it into the NAT table(s). */
3026 /* */
3027 /* NOTE: natsave should NOT be used to point back to an ipstate_t struct */
3028 /* as it can result in memory being corrupted. */
3029 /* ------------------------------------------------------------------------ */
3030 nat_t *
ipf_nat_add(fr_info_t * fin,ipnat_t * np,nat_t ** natsave,u_int flags,int direction)3031 ipf_nat_add(fr_info_t *fin, ipnat_t *np, nat_t **natsave, u_int flags,
3032 int direction)
3033 {
3034 ipf_main_softc_t *softc = fin->fin_main_soft;
3035 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3036 hostmap_t *hm = NULL;
3037 nat_t *nat, *natl;
3038 natstat_t *nsp;
3039 u_int nflags;
3040 natinfo_t ni;
3041 int move;
3042
3043 nsp = &softn->ipf_nat_stats;
3044
3045 if ((nsp->ns_active * 100 / softn->ipf_nat_table_max) >
3046 softn->ipf_nat_table_wm_high) {
3047 softn->ipf_nat_doflush = 1;
3048 }
3049
3050 if (nsp->ns_active >= softn->ipf_nat_table_max) {
3051 NBUMPSIDED(fin->fin_out, ns_table_max);
3052 DT2(ns_table_max, nat_stat_t *, nsp, ipf_nat_softc_t *, softn);
3053 return (NULL);
3054 }
3055
3056 move = 1;
3057 nflags = np->in_flags & flags;
3058 nflags &= NAT_FROMRULE;
3059
3060 ni.nai_np = np;
3061 ni.nai_dport = 0;
3062 ni.nai_sport = 0;
3063
3064 /* Give me a new nat */
3065 KMALLOC(nat, nat_t *);
3066 if (nat == NULL) {
3067 DT(ns_memfail);
3068 NBUMPSIDED(fin->fin_out, ns_memfail);
3069 /*
3070 * Try to automatically tune the max # of entries in the
3071 * table allowed to be less than what will cause kmem_alloc()
3072 * to fail and try to eliminate panics due to out of memory
3073 * conditions arising.
3074 */
3075 if ((softn->ipf_nat_table_max > softn->ipf_nat_table_sz) &&
3076 (nsp->ns_active > 100)) {
3077 softn->ipf_nat_table_max = nsp->ns_active - 100;
3078 printf("table_max reduced to %d\n",
3079 softn->ipf_nat_table_max);
3080 }
3081 return (NULL);
3082 }
3083
3084 if (flags & IPN_ICMPQUERY) {
3085 /*
3086 * In the ICMP query NAT code, we translate the ICMP id fields
3087 * to make them unique. This is indepedent of the ICMP type
3088 * (e.g. in the unlikely event that a host sends an echo and
3089 * an tstamp request with the same id, both packets will have
3090 * their ip address/id field changed in the same way).
3091 */
3092 /* The icmp_id field is used by the sender to identify the
3093 * process making the icmp request. (the receiver justs
3094 * copies it back in its response). So, it closely matches
3095 * the concept of source port. We overlay sport, so we can
3096 * maximally reuse the existing code.
3097 */
3098 ni.nai_sport = fin->fin_data[1];
3099 ni.nai_dport = 0;
3100 }
3101
3102 bzero((char *)nat, sizeof(*nat));
3103 nat->nat_flags = flags;
3104 nat->nat_redir = np->in_redir;
3105 nat->nat_dir = direction;
3106 nat->nat_pr[0] = fin->fin_p;
3107 nat->nat_pr[1] = fin->fin_p;
3108
3109 /*
3110 * Search the current table for a match and create a new mapping
3111 * if there is none found.
3112 */
3113 if (np->in_redir & NAT_DIVERTUDP) {
3114 move = ipf_nat_newdivert(fin, nat, &ni);
3115
3116 } else if (np->in_redir & NAT_REWRITE) {
3117 move = ipf_nat_newrewrite(fin, nat, &ni);
3118
3119 } else if (direction == NAT_OUTBOUND) {
3120 /*
3121 * We can now arrange to call this for the same connection
3122 * because ipf_nat_new doesn't protect the code path into
3123 * this function.
3124 */
3125 natl = ipf_nat_outlookup(fin, nflags, (u_int)fin->fin_p,
3126 fin->fin_src, fin->fin_dst);
3127 if (natl != NULL) {
3128 KFREE(nat);
3129 nat = natl;
3130 goto done;
3131 }
3132
3133 move = ipf_nat_newmap(fin, nat, &ni);
3134 } else {
3135 /*
3136 * NAT_INBOUND is used for redirects rules
3137 */
3138 natl = ipf_nat_inlookup(fin, nflags, (u_int)fin->fin_p,
3139 fin->fin_src, fin->fin_dst);
3140 if (natl != NULL) {
3141 KFREE(nat);
3142 nat = natl;
3143 goto done;
3144 }
3145
3146 move = ipf_nat_newrdr(fin, nat, &ni);
3147 }
3148 if (move == -1)
3149 goto badnat;
3150
3151 np = ni.nai_np;
3152
3153 nat->nat_mssclamp = np->in_mssclamp;
3154 nat->nat_me = natsave;
3155 nat->nat_fr = fin->fin_fr;
3156 nat->nat_rev = fin->fin_rev;
3157 nat->nat_ptr = np;
3158 nat->nat_dlocal = np->in_dlocal;
3159
3160 if ((np->in_apr != NULL) && ((nat->nat_flags & NAT_SLAVE) == 0)) {
3161 if (ipf_proxy_new(fin, nat) == -1) {
3162 NBUMPSIDED(fin->fin_out, ns_appr_fail);
3163 DT3(ns_appr_fail, fr_info_t *, fin, nat_t *, nat, ipnat_t *, np);
3164 goto badnat;
3165 }
3166 }
3167
3168 nat->nat_ifps[0] = np->in_ifps[0];
3169 if (np->in_ifps[0] != NULL) {
3170 COPYIFNAME(np->in_v[0], np->in_ifps[0], nat->nat_ifnames[0]);
3171 }
3172
3173 nat->nat_ifps[1] = np->in_ifps[1];
3174 if (np->in_ifps[1] != NULL) {
3175 COPYIFNAME(np->in_v[1], np->in_ifps[1], nat->nat_ifnames[1]);
3176 }
3177
3178 if (ipf_nat_finalise(fin, nat) == -1) {
3179 goto badnat;
3180 }
3181
3182 np->in_use++;
3183
3184 if ((move == 1) && (np->in_flags & IPN_ROUNDR)) {
3185 if ((np->in_redir & (NAT_REDIRECT|NAT_MAP)) == NAT_REDIRECT) {
3186 ipf_nat_delrdr(softn, np);
3187 ipf_nat_addrdr(softn, np);
3188 } else if ((np->in_redir & (NAT_REDIRECT|NAT_MAP)) == NAT_MAP) {
3189 ipf_nat_delmap(softn, np);
3190 ipf_nat_addmap(softn, np);
3191 }
3192 }
3193
3194 if (flags & SI_WILDP)
3195 nsp->ns_wilds++;
3196 nsp->ns_proto[nat->nat_pr[0]]++;
3197
3198 goto done;
3199 badnat:
3200 DT3(ns_badnatnew, fr_info_t *, fin, nat_t *, nat, ipnat_t *, np);
3201 NBUMPSIDE(fin->fin_out, ns_badnatnew);
3202 if ((hm = nat->nat_hm) != NULL)
3203 ipf_nat_hostmapdel(softc, &hm);
3204 KFREE(nat);
3205 nat = NULL;
3206 done:
3207 if (nat != NULL && np != NULL)
3208 np->in_hits++;
3209 if (natsave != NULL)
3210 *natsave = nat;
3211 return (nat);
3212 }
3213
3214
3215 /* ------------------------------------------------------------------------ */
3216 /* Function: ipf_nat_finalise */
3217 /* Returns: int - 0 == sucess, -1 == failure */
3218 /* Parameters: fin(I) - pointer to packet information */
3219 /* nat(I) - pointer to NAT entry */
3220 /* Write Lock: ipf_nat */
3221 /* */
3222 /* This is the tail end of constructing a new NAT entry and is the same */
3223 /* for both IPv4 and IPv6. */
3224 /* ------------------------------------------------------------------------ */
3225 /*ARGSUSED*/
3226 static int
ipf_nat_finalise(fr_info_t * fin,nat_t * nat)3227 ipf_nat_finalise(fr_info_t *fin, nat_t *nat)
3228 {
3229 ipf_main_softc_t *softc = fin->fin_main_soft;
3230 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3231 u_32_t sum1, sum2, sumd;
3232 frentry_t *fr;
3233 u_32_t flags;
3234 #if SOLARIS && defined(_KERNEL) && defined(ICK_M_CTL_MAGIC)
3235 qpktinfo_t *qpi = fin->fin_qpi;
3236 #endif
3237
3238 flags = nat->nat_flags;
3239
3240 switch (nat->nat_pr[0])
3241 {
3242 case IPPROTO_ICMP :
3243 sum1 = LONG_SUM(ntohs(nat->nat_oicmpid));
3244 sum2 = LONG_SUM(ntohs(nat->nat_nicmpid));
3245 CALC_SUMD(sum1, sum2, sumd);
3246 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
3247
3248 break;
3249
3250 default :
3251 sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr) + \
3252 ntohs(nat->nat_osport));
3253 sum2 = LONG_SUM(ntohl(nat->nat_nsrcaddr) + \
3254 ntohs(nat->nat_nsport));
3255 CALC_SUMD(sum1, sum2, sumd);
3256 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
3257
3258 sum1 = LONG_SUM(ntohl(nat->nat_odstaddr) + \
3259 ntohs(nat->nat_odport));
3260 sum2 = LONG_SUM(ntohl(nat->nat_ndstaddr) + \
3261 ntohs(nat->nat_ndport));
3262 CALC_SUMD(sum1, sum2, sumd);
3263 nat->nat_sumd[0] += (sumd & 0xffff) + (sumd >> 16);
3264 break;
3265 }
3266
3267 /*
3268 * Compute the partial checksum, just in case.
3269 * This is only ever placed into outbound packets so care needs
3270 * to be taken over which pair of addresses are used.
3271 */
3272 if (nat->nat_dir == NAT_OUTBOUND) {
3273 sum1 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
3274 sum1 += LONG_SUM(ntohl(nat->nat_ndstaddr));
3275 } else {
3276 sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr));
3277 sum1 += LONG_SUM(ntohl(nat->nat_odstaddr));
3278 }
3279 sum1 += nat->nat_pr[1];
3280 nat->nat_sumd[1] = (sum1 & 0xffff) + (sum1 >> 16);
3281
3282 sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr));
3283 sum2 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
3284 CALC_SUMD(sum1, sum2, sumd);
3285 nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16);
3286
3287 sum1 = LONG_SUM(ntohl(nat->nat_odstaddr));
3288 sum2 = LONG_SUM(ntohl(nat->nat_ndstaddr));
3289 CALC_SUMD(sum1, sum2, sumd);
3290 nat->nat_ipsumd += (sumd & 0xffff) + (sumd >> 16);
3291
3292 nat->nat_v[0] = 4;
3293 nat->nat_v[1] = 4;
3294
3295 if ((nat->nat_ifps[0] != NULL) && (nat->nat_ifps[0] != (void *)-1)) {
3296 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
3297 }
3298
3299 if ((nat->nat_ifps[1] != NULL) && (nat->nat_ifps[1] != (void *)-1)) {
3300 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
3301 }
3302
3303 if ((nat->nat_flags & SI_CLONE) == 0)
3304 nat->nat_sync = ipf_sync_new(softc, SMC_NAT, fin, nat);
3305
3306 if (ipf_nat_insert(softc, softn, nat) == 0) {
3307 if (softn->ipf_nat_logging)
3308 ipf_nat_log(softc, softn, nat, NL_NEW);
3309 fr = nat->nat_fr;
3310 if (fr != NULL) {
3311 MUTEX_ENTER(&fr->fr_lock);
3312 fr->fr_ref++;
3313 MUTEX_EXIT(&fr->fr_lock);
3314 }
3315 return (0);
3316 }
3317
3318 NBUMPSIDED(fin->fin_out, ns_unfinalised);
3319 DT2(ns_unfinalised, fr_info_t *, fin, nat_t *, nat);
3320 /*
3321 * nat_insert failed, so cleanup time...
3322 */
3323 if (nat->nat_sync != NULL)
3324 ipf_sync_del_nat(softc->ipf_sync_soft, nat->nat_sync);
3325 return (-1);
3326 }
3327
3328
3329 /* ------------------------------------------------------------------------ */
3330 /* Function: ipf_nat_insert */
3331 /* Returns: int - 0 == sucess, -1 == failure */
3332 /* Parameters: softc(I) - pointer to soft context main structure */
3333 /* softn(I) - pointer to NAT context structure */
3334 /* nat(I) - pointer to NAT structure */
3335 /* Write Lock: ipf_nat */
3336 /* */
3337 /* Insert a NAT entry into the hash tables for searching and add it to the */
3338 /* list of active NAT entries. Adjust global counters when complete. */
3339 /* ------------------------------------------------------------------------ */
3340 int
ipf_nat_insert(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,nat_t * nat)3341 ipf_nat_insert(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, nat_t *nat)
3342 {
3343 u_int hv0, hv1;
3344 u_int sp, dp;
3345 ipnat_t *in;
3346 int ret;
3347
3348 /*
3349 * Try and return an error as early as possible, so calculate the hash
3350 * entry numbers first and then proceed.
3351 */
3352 if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) {
3353 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
3354 sp = nat->nat_osport;
3355 dp = nat->nat_odport;
3356 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
3357 sp = 0;
3358 dp = nat->nat_oicmpid;
3359 } else {
3360 sp = 0;
3361 dp = 0;
3362 }
3363 hv0 = NAT_HASH_FN(nat->nat_osrcaddr, sp, 0xffffffff);
3364 hv0 = NAT_HASH_FN(nat->nat_odstaddr, hv0 + dp, 0xffffffff);
3365 /*
3366 * TRACE nat_osrcaddr, nat_osport, nat_odstaddr,
3367 * nat_odport, hv0
3368 */
3369
3370 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
3371 sp = nat->nat_nsport;
3372 dp = nat->nat_ndport;
3373 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
3374 sp = 0;
3375 dp = nat->nat_nicmpid;
3376 } else {
3377 sp = 0;
3378 dp = 0;
3379 }
3380 hv1 = NAT_HASH_FN(nat->nat_nsrcaddr, sp, 0xffffffff);
3381 hv1 = NAT_HASH_FN(nat->nat_ndstaddr, hv1 + dp, 0xffffffff);
3382 /*
3383 * TRACE nat_nsrcaddr, nat_nsport, nat_ndstaddr,
3384 * nat_ndport, hv1
3385 */
3386 } else {
3387 hv0 = NAT_HASH_FN(nat->nat_osrcaddr, 0, 0xffffffff);
3388 hv0 = NAT_HASH_FN(nat->nat_odstaddr, hv0, 0xffffffff);
3389 /* TRACE nat_osrcaddr, nat_odstaddr, hv0 */
3390
3391 hv1 = NAT_HASH_FN(nat->nat_nsrcaddr, 0, 0xffffffff);
3392 hv1 = NAT_HASH_FN(nat->nat_ndstaddr, hv1, 0xffffffff);
3393 /* TRACE nat_nsrcaddr, nat_ndstaddr, hv1 */
3394 }
3395
3396 nat->nat_hv[0] = hv0;
3397 nat->nat_hv[1] = hv1;
3398
3399 MUTEX_INIT(&nat->nat_lock, "nat entry lock");
3400
3401 in = nat->nat_ptr;
3402 nat->nat_ref = nat->nat_me ? 2 : 1;
3403
3404 nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0';
3405 nat->nat_ifps[0] = ipf_resolvenic(softc, nat->nat_ifnames[0], 4);
3406
3407 if (nat->nat_ifnames[1][0] != '\0') {
3408 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
3409 nat->nat_ifps[1] = ipf_resolvenic(softc,
3410 nat->nat_ifnames[1], 4);
3411 } else if (in->in_ifnames[1] != -1) {
3412 char *name;
3413
3414 name = in->in_names + in->in_ifnames[1];
3415 if (name[1] != '\0' && name[0] != '-' && name[0] != '*') {
3416 (void) strncpy(nat->nat_ifnames[1],
3417 nat->nat_ifnames[0], LIFNAMSIZ);
3418 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
3419 nat->nat_ifps[1] = nat->nat_ifps[0];
3420 }
3421 }
3422 if ((nat->nat_ifps[0] != NULL) && (nat->nat_ifps[0] != (void *)-1)) {
3423 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
3424 }
3425 if ((nat->nat_ifps[1] != NULL) && (nat->nat_ifps[1] != (void *)-1)) {
3426 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
3427 }
3428
3429 ret = ipf_nat_hashtab_add(softc, softn, nat);
3430 if (ret == -1)
3431 MUTEX_DESTROY(&nat->nat_lock);
3432 return (ret);
3433 }
3434
3435
3436 /* ------------------------------------------------------------------------ */
3437 /* Function: ipf_nat_hashtab_add */
3438 /* Returns: int - 0 == sucess, -1 == failure */
3439 /* Parameters: softc(I) - pointer to soft context main structure */
3440 /* softn(I) - pointer to NAT context structure */
3441 /* nat(I) - pointer to NAT structure */
3442 /* */
3443 /* Handle the insertion of a NAT entry into the table/list. */
3444 /* ------------------------------------------------------------------------ */
3445 int
ipf_nat_hashtab_add(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,nat_t * nat)3446 ipf_nat_hashtab_add(ipf_main_softc_t *softc, ipf_nat_softc_t *softn,
3447 nat_t *nat)
3448 {
3449 nat_t **natp;
3450 u_int hv0;
3451 u_int hv1;
3452
3453 hv0 = nat->nat_hv[0] % softn->ipf_nat_table_sz;
3454 hv1 = nat->nat_hv[1] % softn->ipf_nat_table_sz;
3455
3456 if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) {
3457 u_int swap;
3458
3459 swap = hv0;
3460 hv0 = hv1;
3461 hv1 = swap;
3462 }
3463
3464 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0] >=
3465 softn->ipf_nat_maxbucket) {
3466 DT1(ns_bucket_max_0, int,
3467 softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0]);
3468 NBUMPSIDE(0, ns_bucket_max);
3469 return (-1);
3470 }
3471
3472 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen[hv1] >=
3473 softn->ipf_nat_maxbucket) {
3474 DT1(ns_bucket_max_1, int,
3475 softn->ipf_nat_stats.ns_side[1].ns_bucketlen[hv1]);
3476 NBUMPSIDE(1, ns_bucket_max);
3477 return (-1);
3478 }
3479
3480 /*
3481 * The ordering of operations in the list and hash table insertion
3482 * is very important. The last operation for each task should be
3483 * to update the top of the list, after all the "nexts" have been
3484 * done so that walking the list while it is being done does not
3485 * find strange pointers.
3486 *
3487 * Global list of NAT instances
3488 */
3489 nat->nat_next = softn->ipf_nat_instances;
3490 nat->nat_pnext = &softn->ipf_nat_instances;
3491 if (softn->ipf_nat_instances)
3492 softn->ipf_nat_instances->nat_pnext = &nat->nat_next;
3493 softn->ipf_nat_instances = nat;
3494
3495 /*
3496 * Inbound hash table.
3497 */
3498 natp = &softn->ipf_nat_table[0][hv0];
3499 nat->nat_phnext[0] = natp;
3500 nat->nat_hnext[0] = *natp;
3501 if (*natp) {
3502 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
3503 } else {
3504 NBUMPSIDE(0, ns_inuse);
3505 }
3506 *natp = nat;
3507 NBUMPSIDE(0, ns_bucketlen[hv0]);
3508
3509 /*
3510 * Outbound hash table.
3511 */
3512 natp = &softn->ipf_nat_table[1][hv1];
3513 nat->nat_phnext[1] = natp;
3514 nat->nat_hnext[1] = *natp;
3515 if (*natp)
3516 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
3517 else {
3518 NBUMPSIDE(1, ns_inuse);
3519 }
3520 *natp = nat;
3521 NBUMPSIDE(1, ns_bucketlen[hv1]);
3522
3523 ipf_nat_setqueue(softc, softn, nat);
3524
3525 if (nat->nat_dir & NAT_OUTBOUND) {
3526 NBUMPSIDE(1, ns_added);
3527 } else {
3528 NBUMPSIDE(0, ns_added);
3529 }
3530 softn->ipf_nat_stats.ns_active++;
3531 return (0);
3532 }
3533
3534
3535 /* ------------------------------------------------------------------------ */
3536 /* Function: ipf_nat_icmperrorlookup */
3537 /* Returns: nat_t* - point to matching NAT structure */
3538 /* Parameters: fin(I) - pointer to packet information */
3539 /* dir(I) - direction of packet (in/out) */
3540 /* */
3541 /* Check if the ICMP error message is related to an existing TCP, UDP or */
3542 /* ICMP query nat entry. It is assumed that the packet is already of the */
3543 /* the required length. */
3544 /* ------------------------------------------------------------------------ */
3545 nat_t *
ipf_nat_icmperrorlookup(fr_info_t * fin,int dir)3546 ipf_nat_icmperrorlookup(fr_info_t *fin, int dir)
3547 {
3548 ipf_main_softc_t *softc = fin->fin_main_soft;
3549 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3550 int flags = 0, type, minlen;
3551 icmphdr_t *icmp, *orgicmp;
3552 nat_stat_side_t *nside;
3553 tcphdr_t *tcp = NULL;
3554 u_short data[2];
3555 nat_t *nat;
3556 ip_t *oip;
3557 u_int p;
3558
3559 icmp = fin->fin_dp;
3560 type = icmp->icmp_type;
3561 nside = &softn->ipf_nat_stats.ns_side[fin->fin_out];
3562 /*
3563 * Does it at least have the return (basic) IP header ?
3564 * Only a basic IP header (no options) should be with an ICMP error
3565 * header. Also, if it's not an error type, then return.
3566 */
3567 if ((fin->fin_hlen != sizeof(ip_t)) || !(fin->fin_flx & FI_ICMPERR)) {
3568 ATOMIC_INCL(nside->ns_icmp_basic);
3569 return (NULL);
3570 }
3571
3572 /*
3573 * Check packet size
3574 */
3575 oip = (ip_t *)((char *)fin->fin_dp + 8);
3576 minlen = IP_HL(oip) << 2;
3577 if ((minlen < sizeof(ip_t)) ||
3578 (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen)) {
3579 ATOMIC_INCL(nside->ns_icmp_size);
3580 return (NULL);
3581 }
3582
3583 /*
3584 * Is the buffer big enough for all of it ? It's the size of the IP
3585 * header claimed in the encapsulated part which is of concern. It
3586 * may be too big to be in this buffer but not so big that it's
3587 * outside the ICMP packet, leading to TCP deref's causing problems.
3588 * This is possible because we don't know how big oip_hl is when we
3589 * do the pullup early in ipf_check() and thus can't gaurantee it is
3590 * all here now.
3591 */
3592 #ifdef ipf_nat_KERNEL
3593 {
3594 mb_t *m;
3595
3596 m = fin->fin_m;
3597 # if SOLARIS
3598 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
3599 (char *)m->b_wptr) {
3600 ATOMIC_INCL(nside->ns_icmp_mbuf);
3601 return (NULL);
3602 }
3603 # else
3604 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
3605 (char *)fin->fin_ip + M_LEN(m)) {
3606 ATOMIC_INCL(nside->ns_icmp_mbuf);
3607 return (NULL);
3608 }
3609 # endif
3610 }
3611 #endif
3612
3613 if (fin->fin_daddr != oip->ip_src.s_addr) {
3614 ATOMIC_INCL(nside->ns_icmp_address);
3615 return (NULL);
3616 }
3617
3618 p = oip->ip_p;
3619 if (p == IPPROTO_TCP)
3620 flags = IPN_TCP;
3621 else if (p == IPPROTO_UDP)
3622 flags = IPN_UDP;
3623 else if (p == IPPROTO_ICMP) {
3624 orgicmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2));
3625
3626 /* see if this is related to an ICMP query */
3627 if (ipf_nat_icmpquerytype(orgicmp->icmp_type)) {
3628 data[0] = fin->fin_data[0];
3629 data[1] = fin->fin_data[1];
3630 fin->fin_data[0] = 0;
3631 fin->fin_data[1] = orgicmp->icmp_id;
3632
3633 flags = IPN_ICMPERR|IPN_ICMPQUERY;
3634 /*
3635 * NOTE : dir refers to the direction of the original
3636 * ip packet. By definition the icmp error
3637 * message flows in the opposite direction.
3638 */
3639 if (dir == NAT_INBOUND)
3640 nat = ipf_nat_inlookup(fin, flags, p,
3641 oip->ip_dst,
3642 oip->ip_src);
3643 else
3644 nat = ipf_nat_outlookup(fin, flags, p,
3645 oip->ip_dst,
3646 oip->ip_src);
3647 fin->fin_data[0] = data[0];
3648 fin->fin_data[1] = data[1];
3649 return (nat);
3650 }
3651 }
3652
3653 if (flags & IPN_TCPUDP) {
3654 minlen += 8; /* + 64bits of data to get ports */
3655 /* TRACE (fin,minlen) */
3656 if (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen) {
3657 ATOMIC_INCL(nside->ns_icmp_short);
3658 return (NULL);
3659 }
3660
3661 data[0] = fin->fin_data[0];
3662 data[1] = fin->fin_data[1];
3663 tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2));
3664 fin->fin_data[0] = ntohs(tcp->th_dport);
3665 fin->fin_data[1] = ntohs(tcp->th_sport);
3666
3667 if (dir == NAT_INBOUND) {
3668 nat = ipf_nat_inlookup(fin, flags, p, oip->ip_dst,
3669 oip->ip_src);
3670 } else {
3671 nat = ipf_nat_outlookup(fin, flags, p, oip->ip_dst,
3672 oip->ip_src);
3673 }
3674 fin->fin_data[0] = data[0];
3675 fin->fin_data[1] = data[1];
3676 return (nat);
3677 }
3678 if (dir == NAT_INBOUND)
3679 nat = ipf_nat_inlookup(fin, 0, p, oip->ip_dst, oip->ip_src);
3680 else
3681 nat = ipf_nat_outlookup(fin, 0, p, oip->ip_dst, oip->ip_src);
3682
3683 return (nat);
3684 }
3685
3686
3687 /* ------------------------------------------------------------------------ */
3688 /* Function: ipf_nat_icmperror */
3689 /* Returns: nat_t* - point to matching NAT structure */
3690 /* Parameters: fin(I) - pointer to packet information */
3691 /* nflags(I) - NAT flags for this packet */
3692 /* dir(I) - direction of packet (in/out) */
3693 /* */
3694 /* Fix up an ICMP packet which is an error message for an existing NAT */
3695 /* session. This will correct both packet header data and checksums. */
3696 /* */
3697 /* This should *ONLY* be used for incoming ICMP error packets to make sure */
3698 /* a NAT'd ICMP packet gets correctly recognised. */
3699 /* ------------------------------------------------------------------------ */
3700 nat_t *
ipf_nat_icmperror(fr_info_t * fin,u_int * nflags,int dir)3701 ipf_nat_icmperror(fr_info_t *fin, u_int *nflags, int dir)
3702 {
3703 ipf_main_softc_t *softc = fin->fin_main_soft;
3704 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3705 u_32_t sum1, sum2, sumd, sumd2;
3706 struct in_addr a1, a2, a3, a4;
3707 int flags, dlen, odst;
3708 icmphdr_t *icmp;
3709 u_short *csump;
3710 tcphdr_t *tcp;
3711 nat_t *nat;
3712 ip_t *oip;
3713 void *dp;
3714
3715 if ((fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) {
3716 NBUMPSIDED(fin->fin_out, ns_icmp_short);
3717 return (NULL);
3718 }
3719
3720 /*
3721 * ipf_nat_icmperrorlookup() will return NULL for `defective' packets.
3722 */
3723 if ((fin->fin_v != 4) || !(nat = ipf_nat_icmperrorlookup(fin, dir))) {
3724 NBUMPSIDED(fin->fin_out, ns_icmp_notfound);
3725 return (NULL);
3726 }
3727
3728 tcp = NULL;
3729 csump = NULL;
3730 flags = 0;
3731 sumd2 = 0;
3732 *nflags = IPN_ICMPERR;
3733 icmp = fin->fin_dp;
3734 oip = (ip_t *)&icmp->icmp_ip;
3735 dp = (((char *)oip) + (IP_HL(oip) << 2));
3736 if (oip->ip_p == IPPROTO_TCP) {
3737 tcp = (tcphdr_t *)dp;
3738 csump = (u_short *)&tcp->th_sum;
3739 flags = IPN_TCP;
3740 } else if (oip->ip_p == IPPROTO_UDP) {
3741 udphdr_t *udp;
3742
3743 udp = (udphdr_t *)dp;
3744 tcp = (tcphdr_t *)dp;
3745 csump = (u_short *)&udp->uh_sum;
3746 flags = IPN_UDP;
3747 } else if (oip->ip_p == IPPROTO_ICMP)
3748 flags = IPN_ICMPQUERY;
3749 dlen = fin->fin_plen - ((char *)dp - (char *)fin->fin_ip);
3750
3751 /*
3752 * Need to adjust ICMP header to include the real IP#'s and
3753 * port #'s. Only apply a checksum change relative to the
3754 * IP address change as it will be modified again in ipf_nat_checkout
3755 * for both address and port. Two checksum changes are
3756 * necessary for the two header address changes. Be careful
3757 * to only modify the checksum once for the port # and twice
3758 * for the IP#.
3759 */
3760
3761 /*
3762 * Step 1
3763 * Fix the IP addresses in the offending IP packet. You also need
3764 * to adjust the IP header checksum of that offending IP packet.
3765 *
3766 * Normally, you would expect that the ICMP checksum of the
3767 * ICMP error message needs to be adjusted as well for the
3768 * IP address change in oip.
3769 * However, this is a NOP, because the ICMP checksum is
3770 * calculated over the complete ICMP packet, which includes the
3771 * changed oip IP addresses and oip->ip_sum. However, these
3772 * two changes cancel each other out (if the delta for
3773 * the IP address is x, then the delta for ip_sum is minus x),
3774 * so no change in the icmp_cksum is necessary.
3775 *
3776 * Inbound ICMP
3777 * ------------
3778 * MAP rule, SRC=a,DST=b -> SRC=c,DST=b
3779 * - response to outgoing packet (a,b)=>(c,b) (OIP_SRC=c,OIP_DST=b)
3780 * - OIP_SRC(c)=nat_newsrcip, OIP_DST(b)=nat_newdstip
3781 *=> OIP_SRC(c)=nat_oldsrcip, OIP_DST(b)=nat_olddstip
3782 *
3783 * RDR rule, SRC=a,DST=b -> SRC=a,DST=c
3784 * - response to outgoing packet (c,a)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3785 * - OIP_SRC(b)=nat_olddstip, OIP_DST(a)=nat_oldsrcip
3786 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip
3787 *
3788 * REWRITE out rule, SRC=a,DST=b -> SRC=c,DST=d
3789 * - response to outgoing packet (a,b)=>(c,d) (OIP_SRC=c,OIP_DST=d)
3790 * - OIP_SRC(c)=nat_newsrcip, OIP_DST(d)=nat_newdstip
3791 *=> OIP_SRC(c)=nat_oldsrcip, OIP_DST(d)=nat_olddstip
3792 *
3793 * REWRITE in rule, SRC=a,DST=b -> SRC=c,DST=d
3794 * - response to outgoing packet (d,c)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3795 * - OIP_SRC(b)=nat_olddstip, OIP_DST(a)=nat_oldsrcip
3796 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip
3797 *
3798 * Outbound ICMP
3799 * -------------
3800 * MAP rule, SRC=a,DST=b -> SRC=c,DST=b
3801 * - response to incoming packet (b,c)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3802 * - OIP_SRC(b)=nat_olddstip, OIP_DST(a)=nat_oldsrcip
3803 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip
3804 *
3805 * RDR rule, SRC=a,DST=b -> SRC=a,DST=c
3806 * - response to incoming packet (a,b)=>(a,c) (OIP_SRC=a,OIP_DST=c)
3807 * - OIP_SRC(a)=nat_newsrcip, OIP_DST(c)=nat_newdstip
3808 *=> OIP_SRC(a)=nat_oldsrcip, OIP_DST(c)=nat_olddstip
3809 *
3810 * REWRITE out rule, SRC=a,DST=b -> SRC=c,DST=d
3811 * - response to incoming packet (d,c)=>(b,a) (OIP_SRC=c,OIP_DST=d)
3812 * - OIP_SRC(c)=nat_olddstip, OIP_DST(d)=nat_oldsrcip
3813 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip
3814 *
3815 * REWRITE in rule, SRC=a,DST=b -> SRC=c,DST=d
3816 * - response to incoming packet (a,b)=>(c,d) (OIP_SRC=b,OIP_DST=a)
3817 * - OIP_SRC(b)=nat_newsrcip, OIP_DST(a)=nat_newdstip
3818 *=> OIP_SRC(a)=nat_oldsrcip, OIP_DST(c)=nat_olddstip
3819 */
3820
3821 if (((fin->fin_out == 0) && ((nat->nat_redir & NAT_MAP) != 0)) ||
3822 ((fin->fin_out == 1) && ((nat->nat_redir & NAT_REDIRECT) != 0))) {
3823 a1.s_addr = ntohl(nat->nat_osrcaddr);
3824 a4.s_addr = ntohl(oip->ip_src.s_addr);
3825 a3.s_addr = ntohl(nat->nat_odstaddr);
3826 a2.s_addr = ntohl(oip->ip_dst.s_addr);
3827 oip->ip_src.s_addr = htonl(a1.s_addr);
3828 oip->ip_dst.s_addr = htonl(a3.s_addr);
3829 odst = 1;
3830 } else {
3831 a1.s_addr = ntohl(nat->nat_ndstaddr);
3832 a2.s_addr = ntohl(oip->ip_dst.s_addr);
3833 a3.s_addr = ntohl(nat->nat_nsrcaddr);
3834 a4.s_addr = ntohl(oip->ip_src.s_addr);
3835 oip->ip_dst.s_addr = htonl(a3.s_addr);
3836 oip->ip_src.s_addr = htonl(a1.s_addr);
3837 odst = 0;
3838 }
3839 sum1 = 0;
3840 sum2 = 0;
3841 sumd = 0;
3842 CALC_SUMD(a2.s_addr, a3.s_addr, sum1);
3843 CALC_SUMD(a4.s_addr, a1.s_addr, sum2);
3844 sumd = sum2 + sum1;
3845 if (sumd != 0)
3846 ipf_fix_datacksum(&oip->ip_sum, sumd);
3847
3848 sumd2 = sumd;
3849 sum1 = 0;
3850 sum2 = 0;
3851
3852 /*
3853 * Fix UDP pseudo header checksum to compensate for the
3854 * IP address change.
3855 */
3856 if (((flags & IPN_TCPUDP) != 0) && (dlen >= 4)) {
3857 u_32_t sum3, sum4, sumt;
3858
3859 /*
3860 * Step 2 :
3861 * For offending TCP/UDP IP packets, translate the ports as
3862 * well, based on the NAT specification. Of course such
3863 * a change may be reflected in the ICMP checksum as well.
3864 *
3865 * Since the port fields are part of the TCP/UDP checksum
3866 * of the offending IP packet, you need to adjust that checksum
3867 * as well... except that the change in the port numbers should
3868 * be offset by the checksum change. However, the TCP/UDP
3869 * checksum will also need to change if there has been an
3870 * IP address change.
3871 */
3872 if (odst == 1) {
3873 sum1 = ntohs(nat->nat_osport);
3874 sum4 = ntohs(tcp->th_sport);
3875 sum3 = ntohs(nat->nat_odport);
3876 sum2 = ntohs(tcp->th_dport);
3877
3878 tcp->th_sport = htons(sum1);
3879 tcp->th_dport = htons(sum3);
3880 } else {
3881 sum1 = ntohs(nat->nat_ndport);
3882 sum2 = ntohs(tcp->th_dport);
3883 sum3 = ntohs(nat->nat_nsport);
3884 sum4 = ntohs(tcp->th_sport);
3885
3886 tcp->th_dport = htons(sum3);
3887 tcp->th_sport = htons(sum1);
3888 }
3889 CALC_SUMD(sum4, sum1, sumt);
3890 sumd += sumt;
3891 CALC_SUMD(sum2, sum3, sumt);
3892 sumd += sumt;
3893
3894 if (sumd != 0 || sumd2 != 0) {
3895 /*
3896 * At this point, sumd is the delta to apply to the
3897 * TCP/UDP header, given the changes in both the IP
3898 * address and the ports and sumd2 is the delta to
3899 * apply to the ICMP header, given the IP address
3900 * change delta that may need to be applied to the
3901 * TCP/UDP checksum instead.
3902 *
3903 * If we will both the IP and TCP/UDP checksums
3904 * then the ICMP checksum changes by the address
3905 * delta applied to the TCP/UDP checksum. If we
3906 * do not change the TCP/UDP checksum them we
3907 * apply the delta in ports to the ICMP checksum.
3908 */
3909 if (oip->ip_p == IPPROTO_UDP) {
3910 if ((dlen >= 8) && (*csump != 0)) {
3911 ipf_fix_datacksum(csump, sumd);
3912 } else {
3913 CALC_SUMD(sum1, sum4, sumd2);
3914 CALC_SUMD(sum3, sum2, sumt);
3915 sumd2 += sumt;
3916 }
3917 } else if (oip->ip_p == IPPROTO_TCP) {
3918 if (dlen >= 18) {
3919 ipf_fix_datacksum(csump, sumd);
3920 } else {
3921 CALC_SUMD(sum1, sum4, sumd2);
3922 CALC_SUMD(sum3, sum2, sumt);
3923 sumd2 += sumt;
3924 }
3925 }
3926 if (sumd2 != 0) {
3927 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3928 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3929 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3930 ipf_fix_incksum(0, &icmp->icmp_cksum, sumd2, 0);
3931 }
3932 }
3933 } else if (((flags & IPN_ICMPQUERY) != 0) && (dlen >= 8)) {
3934 icmphdr_t *orgicmp;
3935
3936 /*
3937 * XXX - what if this is bogus hl and we go off the end ?
3938 * In this case, ipf_nat_icmperrorlookup() will have
3939 * returned NULL.
3940 */
3941 orgicmp = (icmphdr_t *)dp;
3942
3943 if (odst == 1) {
3944 if (orgicmp->icmp_id != nat->nat_osport) {
3945
3946 /*
3947 * Fix ICMP checksum (of the offening ICMP
3948 * query packet) to compensate the change
3949 * in the ICMP id of the offending ICMP
3950 * packet.
3951 *
3952 * Since you modify orgicmp->icmp_id with
3953 * a delta (say x) and you compensate that
3954 * in origicmp->icmp_cksum with a delta
3955 * minus x, you don't have to adjust the
3956 * overall icmp->icmp_cksum
3957 */
3958 sum1 = ntohs(orgicmp->icmp_id);
3959 sum2 = ntohs(nat->nat_oicmpid);
3960 CALC_SUMD(sum1, sum2, sumd);
3961 orgicmp->icmp_id = nat->nat_oicmpid;
3962 ipf_fix_datacksum(&orgicmp->icmp_cksum, sumd);
3963 }
3964 } /* nat_dir == NAT_INBOUND is impossible for icmp queries */
3965 }
3966 return (nat);
3967 }
3968
3969
3970 /*
3971 * MAP-IN MAP-OUT RDR-IN RDR-OUT
3972 * osrc X == src == src X
3973 * odst X == dst == dst X
3974 * nsrc == dst X X == dst
3975 * ndst == src X X == src
3976 * MAP = NAT_OUTBOUND, RDR = NAT_INBOUND
3977 */
3978 /*
3979 * NB: these lookups don't lock access to the list, it assumed that it has
3980 * already been done!
3981 */
3982 /* ------------------------------------------------------------------------ */
3983 /* Function: ipf_nat_inlookup */
3984 /* Returns: nat_t* - NULL == no match, */
3985 /* else pointer to matching NAT entry */
3986 /* Parameters: fin(I) - pointer to packet information */
3987 /* flags(I) - NAT flags for this packet */
3988 /* p(I) - protocol for this packet */
3989 /* src(I) - source IP address */
3990 /* mapdst(I) - destination IP address */
3991 /* */
3992 /* Lookup a nat entry based on the mapped destination ip address/port and */
3993 /* real source address/port. We use this lookup when receiving a packet, */
3994 /* we're looking for a table entry, based on the destination address. */
3995 /* */
3996 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */
3997 /* */
3998 /* NOTE: IT IS ASSUMED THAT IS ONLY HELD WITH A READ LOCK WHEN */
3999 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */
4000 /* */
4001 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */
4002 /* the packet is of said protocol */
4003 /* ------------------------------------------------------------------------ */
4004 nat_t *
ipf_nat_inlookup(fr_info_t * fin,u_int flags,u_int p,struct in_addr src,struct in_addr mapdst)4005 ipf_nat_inlookup(fr_info_t *fin, u_int flags, u_int p,
4006 struct in_addr src , struct in_addr mapdst)
4007 {
4008 ipf_main_softc_t *softc = fin->fin_main_soft;
4009 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4010 u_short sport, dport;
4011 grehdr_t *gre;
4012 ipnat_t *ipn;
4013 u_int sflags;
4014 nat_t *nat;
4015 int nflags;
4016 u_32_t dst;
4017 void *ifp;
4018 u_int hv, rhv;
4019
4020 ifp = fin->fin_ifp;
4021 gre = NULL;
4022 dst = mapdst.s_addr;
4023 sflags = flags & NAT_TCPUDPICMP;
4024
4025 switch (p)
4026 {
4027 case IPPROTO_TCP :
4028 case IPPROTO_UDP :
4029 sport = htons(fin->fin_data[0]);
4030 dport = htons(fin->fin_data[1]);
4031 break;
4032 case IPPROTO_ICMP :
4033 sport = 0;
4034 dport = fin->fin_data[1];
4035 break;
4036 default :
4037 sport = 0;
4038 dport = 0;
4039 break;
4040 }
4041
4042
4043 if ((flags & SI_WILDP) != 0)
4044 goto find_in_wild_ports;
4045
4046 rhv = NAT_HASH_FN(dst, dport, 0xffffffff);
4047 rhv = NAT_HASH_FN(src.s_addr, rhv + sport, 0xffffffff);
4048 hv = rhv % softn->ipf_nat_table_sz;
4049 nat = softn->ipf_nat_table[1][hv];
4050 /* TRACE dst, dport, src, sport, hv, nat */
4051
4052 for (; nat; nat = nat->nat_hnext[1]) {
4053 if (nat->nat_ifps[0] != NULL) {
4054 if ((ifp != NULL) && (ifp != nat->nat_ifps[0]))
4055 continue;
4056 }
4057
4058 if (nat->nat_pr[0] != p)
4059 continue;
4060
4061 switch (nat->nat_dir)
4062 {
4063 case NAT_INBOUND :
4064 case NAT_DIVERTIN :
4065 if (nat->nat_v[0] != 4)
4066 continue;
4067 if (nat->nat_osrcaddr != src.s_addr ||
4068 nat->nat_odstaddr != dst)
4069 continue;
4070 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4071 if (nat->nat_osport != sport)
4072 continue;
4073 if (nat->nat_odport != dport)
4074 continue;
4075
4076 } else if (p == IPPROTO_ICMP) {
4077 if (nat->nat_osport != dport) {
4078 continue;
4079 }
4080 }
4081 break;
4082 case NAT_DIVERTOUT :
4083 if (nat->nat_dlocal)
4084 continue;
4085 case NAT_OUTBOUND :
4086 if (nat->nat_v[1] != 4)
4087 continue;
4088 if (nat->nat_dlocal)
4089 continue;
4090 if (nat->nat_dlocal)
4091 continue;
4092 if (nat->nat_ndstaddr != src.s_addr ||
4093 nat->nat_nsrcaddr != dst)
4094 continue;
4095 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4096 if (nat->nat_ndport != sport)
4097 continue;
4098 if (nat->nat_nsport != dport)
4099 continue;
4100
4101 } else if (p == IPPROTO_ICMP) {
4102 if (nat->nat_osport != dport) {
4103 continue;
4104 }
4105 }
4106 break;
4107 }
4108
4109
4110 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4111 ipn = nat->nat_ptr;
4112 if ((ipn != NULL) && (nat->nat_aps != NULL))
4113 if (ipf_proxy_match(fin, nat) != 0)
4114 continue;
4115 }
4116 if ((nat->nat_ifps[0] == NULL) && (ifp != NULL)) {
4117 nat->nat_ifps[0] = ifp;
4118 nat->nat_mtu[0] = GETIFMTU_4(ifp);
4119 }
4120 return (nat);
4121 }
4122
4123 /*
4124 * So if we didn't find it but there are wildcard members in the hash
4125 * table, go back and look for them. We do this search and update here
4126 * because it is modifying the NAT table and we want to do this only
4127 * for the first packet that matches. The exception, of course, is
4128 * for "dummy" (FI_IGNORE) lookups.
4129 */
4130 find_in_wild_ports:
4131 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) {
4132 NBUMPSIDEX(0, ns_lookup_miss, ns_lookup_miss_0);
4133 return (NULL);
4134 }
4135 if (softn->ipf_nat_stats.ns_wilds == 0 || (fin->fin_flx & FI_NOWILD)) {
4136 NBUMPSIDEX(0, ns_lookup_nowild, ns_lookup_nowild_0);
4137 return (NULL);
4138 }
4139
4140 RWLOCK_EXIT(&softc->ipf_nat);
4141
4142 hv = NAT_HASH_FN(dst, 0, 0xffffffff);
4143 hv = NAT_HASH_FN(src.s_addr, hv, softn->ipf_nat_table_sz);
4144 WRITE_ENTER(&softc->ipf_nat);
4145
4146 nat = softn->ipf_nat_table[1][hv];
4147 /* TRACE dst, src, hv, nat */
4148 for (; nat; nat = nat->nat_hnext[1]) {
4149 if (nat->nat_ifps[0] != NULL) {
4150 if ((ifp != NULL) && (ifp != nat->nat_ifps[0]))
4151 continue;
4152 }
4153
4154 if (nat->nat_pr[0] != fin->fin_p)
4155 continue;
4156
4157 switch (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND))
4158 {
4159 case NAT_INBOUND :
4160 if (nat->nat_v[0] != 4)
4161 continue;
4162 if (nat->nat_osrcaddr != src.s_addr ||
4163 nat->nat_odstaddr != dst)
4164 continue;
4165 break;
4166 case NAT_OUTBOUND :
4167 if (nat->nat_v[1] != 4)
4168 continue;
4169 if (nat->nat_ndstaddr != src.s_addr ||
4170 nat->nat_nsrcaddr != dst)
4171 continue;
4172 break;
4173 }
4174
4175 nflags = nat->nat_flags;
4176 if (!(nflags & (NAT_TCPUDP|SI_WILDP)))
4177 continue;
4178
4179 if (ipf_nat_wildok(nat, (int)sport, (int)dport, nflags,
4180 NAT_INBOUND) == 1) {
4181 if ((fin->fin_flx & FI_IGNORE) != 0)
4182 break;
4183 if ((nflags & SI_CLONE) != 0) {
4184 nat = ipf_nat_clone(fin, nat);
4185 if (nat == NULL)
4186 break;
4187 } else {
4188 MUTEX_ENTER(&softn->ipf_nat_new);
4189 softn->ipf_nat_stats.ns_wilds--;
4190 MUTEX_EXIT(&softn->ipf_nat_new);
4191 }
4192
4193 if (nat->nat_dir == NAT_INBOUND) {
4194 if (nat->nat_osport == 0) {
4195 nat->nat_osport = sport;
4196 nat->nat_nsport = sport;
4197 }
4198 if (nat->nat_odport == 0) {
4199 nat->nat_odport = dport;
4200 nat->nat_ndport = dport;
4201 }
4202 } else if (nat->nat_dir == NAT_OUTBOUND) {
4203 if (nat->nat_osport == 0) {
4204 nat->nat_osport = dport;
4205 nat->nat_nsport = dport;
4206 }
4207 if (nat->nat_odport == 0) {
4208 nat->nat_odport = sport;
4209 nat->nat_ndport = sport;
4210 }
4211 }
4212 if ((nat->nat_ifps[0] == NULL) && (ifp != NULL)) {
4213 nat->nat_ifps[0] = ifp;
4214 nat->nat_mtu[0] = GETIFMTU_4(ifp);
4215 }
4216 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT);
4217 ipf_nat_tabmove(softn, nat);
4218 break;
4219 }
4220 }
4221
4222 MUTEX_DOWNGRADE(&softc->ipf_nat);
4223
4224 if (nat == NULL) {
4225 NBUMPSIDE(0, ns_lookup_miss);
4226 }
4227 return (nat);
4228 }
4229
4230
4231 /* ------------------------------------------------------------------------ */
4232 /* Function: ipf_nat_tabmove */
4233 /* Returns: Nil */
4234 /* Parameters: softn(I) - pointer to NAT context structure */
4235 /* nat(I) - pointer to NAT structure */
4236 /* Write Lock: ipf_nat */
4237 /* */
4238 /* This function is only called for TCP/UDP NAT table entries where the */
4239 /* original was placed in the table without hashing on the ports and we now */
4240 /* want to include hashing on port numbers. */
4241 /* ------------------------------------------------------------------------ */
4242 static void
ipf_nat_tabmove(ipf_nat_softc_t * softn,nat_t * nat)4243 ipf_nat_tabmove(ipf_nat_softc_t *softn, nat_t *nat)
4244 {
4245 u_int hv0, hv1, rhv0, rhv1;
4246 natstat_t *nsp;
4247 nat_t **natp;
4248
4249 if (nat->nat_flags & SI_CLONE)
4250 return;
4251
4252 nsp = &softn->ipf_nat_stats;
4253 /*
4254 * Remove the NAT entry from the old location
4255 */
4256 if (nat->nat_hnext[0])
4257 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
4258 *nat->nat_phnext[0] = nat->nat_hnext[0];
4259 nsp->ns_side[0].ns_bucketlen[nat->nat_hv[0] %
4260 softn->ipf_nat_table_sz]--;
4261
4262 if (nat->nat_hnext[1])
4263 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
4264 *nat->nat_phnext[1] = nat->nat_hnext[1];
4265 nsp->ns_side[1].ns_bucketlen[nat->nat_hv[1] %
4266 softn->ipf_nat_table_sz]--;
4267
4268 /*
4269 * Add into the NAT table in the new position
4270 */
4271 rhv0 = NAT_HASH_FN(nat->nat_osrcaddr, nat->nat_osport, 0xffffffff);
4272 rhv0 = NAT_HASH_FN(nat->nat_odstaddr, rhv0 + nat->nat_odport,
4273 0xffffffff);
4274 rhv1 = NAT_HASH_FN(nat->nat_nsrcaddr, nat->nat_nsport, 0xffffffff);
4275 rhv1 = NAT_HASH_FN(nat->nat_ndstaddr, rhv1 + nat->nat_ndport,
4276 0xffffffff);
4277
4278 hv0 = rhv0 % softn->ipf_nat_table_sz;
4279 hv1 = rhv1 % softn->ipf_nat_table_sz;
4280
4281 if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) {
4282 u_int swap;
4283
4284 swap = hv0;
4285 hv0 = hv1;
4286 hv1 = swap;
4287 }
4288
4289 /* TRACE nat_osrcaddr, nat_osport, nat_odstaddr, nat_odport, hv0 */
4290 /* TRACE nat_nsrcaddr, nat_nsport, nat_ndstaddr, nat_ndport, hv1 */
4291
4292 nat->nat_hv[0] = rhv0;
4293 natp = &softn->ipf_nat_table[0][hv0];
4294 if (*natp)
4295 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
4296 nat->nat_phnext[0] = natp;
4297 nat->nat_hnext[0] = *natp;
4298 *natp = nat;
4299 nsp->ns_side[0].ns_bucketlen[hv0]++;
4300
4301 nat->nat_hv[1] = rhv1;
4302 natp = &softn->ipf_nat_table[1][hv1];
4303 if (*natp)
4304 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
4305 nat->nat_phnext[1] = natp;
4306 nat->nat_hnext[1] = *natp;
4307 *natp = nat;
4308 nsp->ns_side[1].ns_bucketlen[hv1]++;
4309 }
4310
4311
4312 /* ------------------------------------------------------------------------ */
4313 /* Function: ipf_nat_outlookup */
4314 /* Returns: nat_t* - NULL == no match, */
4315 /* else pointer to matching NAT entry */
4316 /* Parameters: fin(I) - pointer to packet information */
4317 /* flags(I) - NAT flags for this packet */
4318 /* p(I) - protocol for this packet */
4319 /* src(I) - source IP address */
4320 /* dst(I) - destination IP address */
4321 /* rw(I) - 1 == write lock on held, 0 == read lock. */
4322 /* */
4323 /* Lookup a nat entry based on the source 'real' ip address/port and */
4324 /* destination address/port. We use this lookup when sending a packet out, */
4325 /* we're looking for a table entry, based on the source address. */
4326 /* */
4327 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */
4328 /* */
4329 /* NOTE: IT IS ASSUMED THAT IS ONLY HELD WITH A READ LOCK WHEN */
4330 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */
4331 /* */
4332 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */
4333 /* the packet is of said protocol */
4334 /* ------------------------------------------------------------------------ */
4335 nat_t *
ipf_nat_outlookup(fr_info_t * fin,u_int flags,u_int p,struct in_addr src,struct in_addr dst)4336 ipf_nat_outlookup(fr_info_t *fin, u_int flags, u_int p,
4337 struct in_addr src , struct in_addr dst)
4338 {
4339 ipf_main_softc_t *softc = fin->fin_main_soft;
4340 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4341 u_short sport, dport;
4342 u_int sflags;
4343 ipnat_t *ipn;
4344 nat_t *nat;
4345 void *ifp;
4346 u_int hv;
4347
4348 ifp = fin->fin_ifp;
4349 sflags = flags & IPN_TCPUDPICMP;
4350
4351 switch (p)
4352 {
4353 case IPPROTO_TCP :
4354 case IPPROTO_UDP :
4355 sport = htons(fin->fin_data[0]);
4356 dport = htons(fin->fin_data[1]);
4357 break;
4358 case IPPROTO_ICMP :
4359 sport = 0;
4360 dport = fin->fin_data[1];
4361 break;
4362 default :
4363 sport = 0;
4364 dport = 0;
4365 break;
4366 }
4367
4368 if ((flags & SI_WILDP) != 0)
4369 goto find_out_wild_ports;
4370
4371 hv = NAT_HASH_FN(src.s_addr, sport, 0xffffffff);
4372 hv = NAT_HASH_FN(dst.s_addr, hv + dport, softn->ipf_nat_table_sz);
4373 nat = softn->ipf_nat_table[0][hv];
4374
4375 /* TRACE src, sport, dst, dport, hv, nat */
4376
4377 for (; nat; nat = nat->nat_hnext[0]) {
4378 if (nat->nat_ifps[1] != NULL) {
4379 if ((ifp != NULL) && (ifp != nat->nat_ifps[1]))
4380 continue;
4381 }
4382
4383 if (nat->nat_pr[1] != p)
4384 continue;
4385
4386 switch (nat->nat_dir)
4387 {
4388 case NAT_INBOUND :
4389 case NAT_DIVERTIN :
4390 if (nat->nat_v[1] != 4)
4391 continue;
4392 if (nat->nat_ndstaddr != src.s_addr ||
4393 nat->nat_nsrcaddr != dst.s_addr)
4394 continue;
4395
4396 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4397 if (nat->nat_ndport != sport)
4398 continue;
4399 if (nat->nat_nsport != dport)
4400 continue;
4401
4402 } else if (p == IPPROTO_ICMP) {
4403 if (nat->nat_osport != dport) {
4404 continue;
4405 }
4406 }
4407 break;
4408 case NAT_OUTBOUND :
4409 case NAT_DIVERTOUT :
4410 if (nat->nat_v[0] != 4)
4411 continue;
4412 if (nat->nat_osrcaddr != src.s_addr ||
4413 nat->nat_odstaddr != dst.s_addr)
4414 continue;
4415
4416 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4417 if (nat->nat_odport != dport)
4418 continue;
4419 if (nat->nat_osport != sport)
4420 continue;
4421
4422 } else if (p == IPPROTO_ICMP) {
4423 if (nat->nat_osport != dport) {
4424 continue;
4425 }
4426 }
4427 break;
4428 }
4429
4430 ipn = nat->nat_ptr;
4431 if ((ipn != NULL) && (nat->nat_aps != NULL))
4432 if (ipf_proxy_match(fin, nat) != 0)
4433 continue;
4434
4435 if ((nat->nat_ifps[1] == NULL) && (ifp != NULL)) {
4436 nat->nat_ifps[1] = ifp;
4437 nat->nat_mtu[1] = GETIFMTU_4(ifp);
4438 }
4439 return (nat);
4440 }
4441
4442 /*
4443 * So if we didn't find it but there are wildcard members in the hash
4444 * table, go back and look for them. We do this search and update here
4445 * because it is modifying the NAT table and we want to do this only
4446 * for the first packet that matches. The exception, of course, is
4447 * for "dummy" (FI_IGNORE) lookups.
4448 */
4449 find_out_wild_ports:
4450 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) {
4451 NBUMPSIDEX(1, ns_lookup_miss, ns_lookup_miss_1);
4452 return (NULL);
4453 }
4454 if (softn->ipf_nat_stats.ns_wilds == 0 || (fin->fin_flx & FI_NOWILD)) {
4455 NBUMPSIDEX(1, ns_lookup_nowild, ns_lookup_nowild_1);
4456 return (NULL);
4457 }
4458
4459 RWLOCK_EXIT(&softc->ipf_nat);
4460
4461 hv = NAT_HASH_FN(src.s_addr, 0, 0xffffffff);
4462 hv = NAT_HASH_FN(dst.s_addr, hv, softn->ipf_nat_table_sz);
4463
4464 WRITE_ENTER(&softc->ipf_nat);
4465
4466 nat = softn->ipf_nat_table[0][hv];
4467 for (; nat; nat = nat->nat_hnext[0]) {
4468 if (nat->nat_ifps[1] != NULL) {
4469 if ((ifp != NULL) && (ifp != nat->nat_ifps[1]))
4470 continue;
4471 }
4472
4473 if (nat->nat_pr[1] != fin->fin_p)
4474 continue;
4475
4476 switch (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND))
4477 {
4478 case NAT_INBOUND :
4479 if (nat->nat_v[1] != 4)
4480 continue;
4481 if (nat->nat_ndstaddr != src.s_addr ||
4482 nat->nat_nsrcaddr != dst.s_addr)
4483 continue;
4484 break;
4485 case NAT_OUTBOUND :
4486 if (nat->nat_v[0] != 4)
4487 continue;
4488 if (nat->nat_osrcaddr != src.s_addr ||
4489 nat->nat_odstaddr != dst.s_addr)
4490 continue;
4491 break;
4492 }
4493
4494 if (!(nat->nat_flags & (NAT_TCPUDP|SI_WILDP)))
4495 continue;
4496
4497 if (ipf_nat_wildok(nat, (int)sport, (int)dport, nat->nat_flags,
4498 NAT_OUTBOUND) == 1) {
4499 if ((fin->fin_flx & FI_IGNORE) != 0)
4500 break;
4501 if ((nat->nat_flags & SI_CLONE) != 0) {
4502 nat = ipf_nat_clone(fin, nat);
4503 if (nat == NULL)
4504 break;
4505 } else {
4506 MUTEX_ENTER(&softn->ipf_nat_new);
4507 softn->ipf_nat_stats.ns_wilds--;
4508 MUTEX_EXIT(&softn->ipf_nat_new);
4509 }
4510
4511 if (nat->nat_dir == NAT_OUTBOUND) {
4512 if (nat->nat_osport == 0) {
4513 nat->nat_osport = sport;
4514 nat->nat_nsport = sport;
4515 }
4516 if (nat->nat_odport == 0) {
4517 nat->nat_odport = dport;
4518 nat->nat_ndport = dport;
4519 }
4520 } else if (nat->nat_dir == NAT_INBOUND) {
4521 if (nat->nat_osport == 0) {
4522 nat->nat_osport = dport;
4523 nat->nat_nsport = dport;
4524 }
4525 if (nat->nat_odport == 0) {
4526 nat->nat_odport = sport;
4527 nat->nat_ndport = sport;
4528 }
4529 }
4530 if ((nat->nat_ifps[1] == NULL) && (ifp != NULL)) {
4531 nat->nat_ifps[1] = ifp;
4532 nat->nat_mtu[1] = GETIFMTU_4(ifp);
4533 }
4534 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT);
4535 ipf_nat_tabmove(softn, nat);
4536 break;
4537 }
4538 }
4539
4540 MUTEX_DOWNGRADE(&softc->ipf_nat);
4541
4542 if (nat == NULL) {
4543 NBUMPSIDE(1, ns_lookup_miss);
4544 }
4545 return (nat);
4546 }
4547
4548
4549 /* ------------------------------------------------------------------------ */
4550 /* Function: ipf_nat_lookupredir */
4551 /* Returns: nat_t* - NULL == no match, */
4552 /* else pointer to matching NAT entry */
4553 /* Parameters: np(I) - pointer to description of packet to find NAT table */
4554 /* entry for. */
4555 /* */
4556 /* Lookup the NAT tables to search for a matching redirect */
4557 /* The contents of natlookup_t should imitate those found in a packet that */
4558 /* would be translated - ie a packet coming in for RDR or going out for MAP.*/
4559 /* We can do the lookup in one of two ways, imitating an inbound or */
4560 /* outbound packet. By default we assume outbound, unless IPN_IN is set. */
4561 /* For IN, the fields are set as follows: */
4562 /* nl_real* = source information */
4563 /* nl_out* = destination information (translated) */
4564 /* For an out packet, the fields are set like this: */
4565 /* nl_in* = source information (untranslated) */
4566 /* nl_out* = destination information (translated) */
4567 /* ------------------------------------------------------------------------ */
4568 nat_t *
ipf_nat_lookupredir(natlookup_t * np)4569 ipf_nat_lookupredir(natlookup_t *np)
4570 {
4571 fr_info_t fi;
4572 nat_t *nat;
4573
4574 bzero((char *)&fi, sizeof(fi));
4575 if (np->nl_flags & IPN_IN) {
4576 fi.fin_data[0] = ntohs(np->nl_realport);
4577 fi.fin_data[1] = ntohs(np->nl_outport);
4578 } else {
4579 fi.fin_data[0] = ntohs(np->nl_inport);
4580 fi.fin_data[1] = ntohs(np->nl_outport);
4581 }
4582 if (np->nl_flags & IPN_TCP)
4583 fi.fin_p = IPPROTO_TCP;
4584 else if (np->nl_flags & IPN_UDP)
4585 fi.fin_p = IPPROTO_UDP;
4586 else if (np->nl_flags & (IPN_ICMPERR|IPN_ICMPQUERY))
4587 fi.fin_p = IPPROTO_ICMP;
4588
4589 /*
4590 * We can do two sorts of lookups:
4591 * - IPN_IN: we have the `real' and `out' address, look for `in'.
4592 * - default: we have the `in' and `out' address, look for `real'.
4593 */
4594 if (np->nl_flags & IPN_IN) {
4595 if ((nat = ipf_nat_inlookup(&fi, np->nl_flags, fi.fin_p,
4596 np->nl_realip, np->nl_outip))) {
4597 np->nl_inip = nat->nat_odstip;
4598 np->nl_inport = nat->nat_odport;
4599 }
4600 } else {
4601 /*
4602 * If nl_inip is non null, this is a lookup based on the real
4603 * ip address. Else, we use the fake.
4604 */
4605 if ((nat = ipf_nat_outlookup(&fi, np->nl_flags, fi.fin_p,
4606 np->nl_inip, np->nl_outip))) {
4607
4608 if ((np->nl_flags & IPN_FINDFORWARD) != 0) {
4609 fr_info_t fin;
4610 bzero((char *)&fin, sizeof(fin));
4611 fin.fin_p = nat->nat_pr[0];
4612 fin.fin_data[0] = ntohs(nat->nat_ndport);
4613 fin.fin_data[1] = ntohs(nat->nat_nsport);
4614 if (ipf_nat_inlookup(&fin, np->nl_flags,
4615 fin.fin_p, nat->nat_ndstip,
4616 nat->nat_nsrcip) != NULL) {
4617 np->nl_flags &= ~IPN_FINDFORWARD;
4618 }
4619 }
4620
4621 np->nl_realip = nat->nat_odstip;
4622 np->nl_realport = nat->nat_odport;
4623 }
4624 }
4625
4626 return (nat);
4627 }
4628
4629
4630 /* ------------------------------------------------------------------------ */
4631 /* Function: ipf_nat_match */
4632 /* Returns: int - 0 == no match, 1 == match */
4633 /* Parameters: fin(I) - pointer to packet information */
4634 /* np(I) - pointer to NAT rule */
4635 /* */
4636 /* Pull the matching of a packet against a NAT rule out of that complex */
4637 /* loop inside ipf_nat_checkin() and lay it out properly in its own function. */
4638 /* ------------------------------------------------------------------------ */
4639 static int
ipf_nat_match(fr_info_t * fin,ipnat_t * np)4640 ipf_nat_match(fr_info_t *fin, ipnat_t *np)
4641 {
4642 ipf_main_softc_t *softc = fin->fin_main_soft;
4643 frtuc_t *ft;
4644 int match;
4645
4646 match = 0;
4647 switch (np->in_osrcatype)
4648 {
4649 case FRI_NORMAL :
4650 match = ((fin->fin_saddr & np->in_osrcmsk) != np->in_osrcaddr);
4651 break;
4652 case FRI_LOOKUP :
4653 match = (*np->in_osrcfunc)(softc, np->in_osrcptr,
4654 4, &fin->fin_saddr, fin->fin_plen);
4655 break;
4656 }
4657 match ^= ((np->in_flags & IPN_NOTSRC) != 0);
4658 if (match)
4659 return (0);
4660
4661 match = 0;
4662 switch (np->in_odstatype)
4663 {
4664 case FRI_NORMAL :
4665 match = ((fin->fin_daddr & np->in_odstmsk) != np->in_odstaddr);
4666 break;
4667 case FRI_LOOKUP :
4668 match = (*np->in_odstfunc)(softc, np->in_odstptr,
4669 4, &fin->fin_daddr, fin->fin_plen);
4670 break;
4671 }
4672
4673 match ^= ((np->in_flags & IPN_NOTDST) != 0);
4674 if (match)
4675 return (0);
4676
4677 ft = &np->in_tuc;
4678 if (!(fin->fin_flx & FI_TCPUDP) ||
4679 (fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) {
4680 if (ft->ftu_scmp || ft->ftu_dcmp)
4681 return (0);
4682 return (1);
4683 }
4684
4685 return (ipf_tcpudpchk(&fin->fin_fi, ft));
4686 }
4687
4688
4689 /* ------------------------------------------------------------------------ */
4690 /* Function: ipf_nat_update */
4691 /* Returns: Nil */
4692 /* Parameters: fin(I) - pointer to packet information */
4693 /* nat(I) - pointer to NAT structure */
4694 /* */
4695 /* Updates the lifetime of a NAT table entry for non-TCP packets. Must be */
4696 /* called with fin_rev updated - i.e. after calling ipf_nat_proto(). */
4697 /* */
4698 /* This *MUST* be called after ipf_nat_proto() as it expects fin_rev to */
4699 /* already be set. */
4700 /* ------------------------------------------------------------------------ */
4701 void
ipf_nat_update(fr_info_t * fin,nat_t * nat)4702 ipf_nat_update(fr_info_t *fin, nat_t *nat)
4703 {
4704 ipf_main_softc_t *softc = fin->fin_main_soft;
4705 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4706 ipftq_t *ifq, *ifq2;
4707 ipftqent_t *tqe;
4708 ipnat_t *np = nat->nat_ptr;
4709
4710 tqe = &nat->nat_tqe;
4711 ifq = tqe->tqe_ifq;
4712
4713 /*
4714 * We allow over-riding of NAT timeouts from NAT rules, even for
4715 * TCP, however, if it is TCP and there is no rule timeout set,
4716 * then do not update the timeout here.
4717 */
4718 if (np != NULL) {
4719 np->in_bytes[fin->fin_rev] += fin->fin_plen;
4720 ifq2 = np->in_tqehead[fin->fin_rev];
4721 } else {
4722 ifq2 = NULL;
4723 }
4724
4725 if (nat->nat_pr[0] == IPPROTO_TCP && ifq2 == NULL) {
4726 (void) ipf_tcp_age(&nat->nat_tqe, fin, softn->ipf_nat_tcptq,
4727 0, 2);
4728 } else {
4729 if (ifq2 == NULL) {
4730 if (nat->nat_pr[0] == IPPROTO_UDP)
4731 ifq2 = fin->fin_rev ? &softn->ipf_nat_udpacktq :
4732 &softn->ipf_nat_udptq;
4733 else if (nat->nat_pr[0] == IPPROTO_ICMP ||
4734 nat->nat_pr[0] == IPPROTO_ICMPV6)
4735 ifq2 = fin->fin_rev ? &softn->ipf_nat_icmpacktq:
4736 &softn->ipf_nat_icmptq;
4737 else
4738 ifq2 = &softn->ipf_nat_iptq;
4739 }
4740
4741 ipf_movequeue(softc->ipf_ticks, tqe, ifq, ifq2);
4742 }
4743 }
4744
4745
4746 /* ------------------------------------------------------------------------ */
4747 /* Function: ipf_nat_checkout */
4748 /* Returns: int - -1 == packet failed NAT checks so block it, */
4749 /* 0 == no packet translation occurred, */
4750 /* 1 == packet was successfully translated. */
4751 /* Parameters: fin(I) - pointer to packet information */
4752 /* passp(I) - pointer to filtering result flags */
4753 /* */
4754 /* Check to see if an outcoming packet should be changed. ICMP packets are */
4755 /* first checked to see if they match an existing entry (if an error), */
4756 /* otherwise a search of the current NAT table is made. If neither results */
4757 /* in a match then a search for a matching NAT rule is made. Create a new */
4758 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */
4759 /* packet header(s) as required. */
4760 /* ------------------------------------------------------------------------ */
4761 int
ipf_nat_checkout(fr_info_t * fin,u_32_t * passp)4762 ipf_nat_checkout(fr_info_t *fin, u_32_t *passp)
4763 {
4764 ipnat_t *np = NULL, *npnext;
4765 struct ifnet *ifp, *sifp;
4766 ipf_main_softc_t *softc;
4767 ipf_nat_softc_t *softn;
4768 icmphdr_t *icmp = NULL;
4769 tcphdr_t *tcp = NULL;
4770 int rval, natfailed;
4771 u_int nflags = 0;
4772 u_32_t ipa, iph;
4773 int natadd = 1;
4774 frentry_t *fr;
4775 nat_t *nat;
4776
4777 if (fin->fin_v == 6) {
4778 #ifdef USE_INET6
4779 return (ipf_nat6_checkout(fin, passp));
4780 #else
4781 return (0);
4782 #endif
4783 }
4784
4785 softc = fin->fin_main_soft;
4786 softn = softc->ipf_nat_soft;
4787
4788 if (softn->ipf_nat_lock != 0)
4789 return (0);
4790 if (softn->ipf_nat_stats.ns_rules == 0 &&
4791 softn->ipf_nat_instances == NULL)
4792 return (0);
4793
4794 natfailed = 0;
4795 fr = fin->fin_fr;
4796 sifp = fin->fin_ifp;
4797 if (fr != NULL) {
4798 ifp = fr->fr_tifs[fin->fin_rev].fd_ptr;
4799 if ((ifp != NULL) && (ifp != (void *)-1))
4800 fin->fin_ifp = ifp;
4801 }
4802 ifp = fin->fin_ifp;
4803
4804 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
4805 switch (fin->fin_p)
4806 {
4807 case IPPROTO_TCP :
4808 nflags = IPN_TCP;
4809 break;
4810 case IPPROTO_UDP :
4811 nflags = IPN_UDP;
4812 break;
4813 case IPPROTO_ICMP :
4814 icmp = fin->fin_dp;
4815
4816 /*
4817 * This is an incoming packet, so the destination is
4818 * the icmp_id and the source port equals 0
4819 */
4820 if ((fin->fin_flx & FI_ICMPQUERY) != 0)
4821 nflags = IPN_ICMPQUERY;
4822 break;
4823 default :
4824 break;
4825 }
4826
4827 if ((nflags & IPN_TCPUDP))
4828 tcp = fin->fin_dp;
4829 }
4830
4831 ipa = fin->fin_saddr;
4832
4833 READ_ENTER(&softc->ipf_nat);
4834
4835 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
4836 (nat = ipf_nat_icmperror(fin, &nflags, NAT_OUTBOUND)))
4837 /*EMPTY*/;
4838 else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin)))
4839 natadd = 0;
4840 else if ((nat = ipf_nat_outlookup(fin, nflags|NAT_SEARCH,
4841 (u_int)fin->fin_p, fin->fin_src,
4842 fin->fin_dst))) {
4843 nflags = nat->nat_flags;
4844 } else if (fin->fin_off == 0) {
4845 u_32_t hv, msk, nmsk = 0;
4846
4847 /*
4848 * If there is no current entry in the nat table for this IP#,
4849 * create one for it (if there is a matching rule).
4850 */
4851 maskloop:
4852 msk = softn->ipf_nat_map_active_masks[nmsk];
4853 iph = ipa & msk;
4854 hv = NAT_HASH_FN(iph, 0, softn->ipf_nat_maprules_sz);
4855 retry_roundrobin:
4856 for (np = softn->ipf_nat_map_rules[hv]; np; np = npnext) {
4857 npnext = np->in_mnext;
4858 if ((np->in_ifps[1] && (np->in_ifps[1] != ifp)))
4859 continue;
4860 if (np->in_v[0] != 4)
4861 continue;
4862 if (np->in_pr[1] && (np->in_pr[1] != fin->fin_p))
4863 continue;
4864 if ((np->in_flags & IPN_RF) &&
4865 !(np->in_flags & nflags))
4866 continue;
4867 if (np->in_flags & IPN_FILTER) {
4868 switch (ipf_nat_match(fin, np))
4869 {
4870 case 0 :
4871 continue;
4872 case -1 :
4873 rval = -3;
4874 goto outmatchfail;
4875 case 1 :
4876 default :
4877 break;
4878 }
4879 } else if ((ipa & np->in_osrcmsk) != np->in_osrcaddr)
4880 continue;
4881
4882 if ((fr != NULL) &&
4883 !ipf_matchtag(&np->in_tag, &fr->fr_nattag))
4884 continue;
4885
4886 if (np->in_plabel != -1) {
4887 if (((np->in_flags & IPN_FILTER) == 0) &&
4888 (np->in_odport != fin->fin_data[1]))
4889 continue;
4890 if (ipf_proxy_ok(fin, tcp, np) == 0)
4891 continue;
4892 }
4893
4894 if (np->in_flags & IPN_NO) {
4895 np->in_hits++;
4896 break;
4897 }
4898 MUTEX_ENTER(&softn->ipf_nat_new);
4899 /*
4900 * If we've matched a round-robin rule but it has
4901 * moved in the list since we got it, start over as
4902 * this is now no longer correct.
4903 */
4904 if (npnext != np->in_mnext) {
4905 if ((np->in_flags & IPN_ROUNDR) != 0) {
4906 MUTEX_EXIT(&softn->ipf_nat_new);
4907 goto retry_roundrobin;
4908 }
4909 npnext = np->in_mnext;
4910 }
4911
4912 nat = ipf_nat_add(fin, np, NULL, nflags, NAT_OUTBOUND);
4913 MUTEX_EXIT(&softn->ipf_nat_new);
4914 if (nat != NULL) {
4915 natfailed = 0;
4916 break;
4917 }
4918 natfailed = -2;
4919 }
4920 if ((np == NULL) && (nmsk < softn->ipf_nat_map_max)) {
4921 nmsk++;
4922 goto maskloop;
4923 }
4924 }
4925
4926 if (nat != NULL) {
4927 rval = ipf_nat_out(fin, nat, natadd, nflags);
4928 if (rval == 1) {
4929 MUTEX_ENTER(&nat->nat_lock);
4930 ipf_nat_update(fin, nat);
4931 nat->nat_bytes[1] += fin->fin_plen;
4932 nat->nat_pkts[1]++;
4933 fin->fin_pktnum = nat->nat_pkts[1];
4934 MUTEX_EXIT(&nat->nat_lock);
4935 }
4936 } else
4937 rval = natfailed;
4938 outmatchfail:
4939 RWLOCK_EXIT(&softc->ipf_nat);
4940
4941 switch (rval)
4942 {
4943 case -3 :
4944 /* ipf_nat_match() failure */
4945 /* FALLTHROUGH */
4946 case -2 :
4947 /* retry_roundrobin loop failure */
4948 /* FALLTHROUGH */
4949 case -1 :
4950 /* proxy failure detected by ipf_nat_out() */
4951 if (passp != NULL) {
4952 DT2(frb_natv4out, fr_info_t *, fin, int, rval);
4953 NBUMPSIDED(1, ns_drop);
4954 *passp = FR_BLOCK;
4955 fin->fin_reason = FRB_NATV4;
4956 }
4957 fin->fin_flx |= FI_BADNAT;
4958 NBUMPSIDED(1, ns_badnat);
4959 rval = -1; /* We only return -1 on error. */
4960 break;
4961 case 0 :
4962 NBUMPSIDE(1, ns_ignored);
4963 break;
4964 case 1 :
4965 NBUMPSIDE(1, ns_translated);
4966 break;
4967 }
4968 fin->fin_ifp = sifp;
4969 return (rval);
4970 }
4971
4972 /* ------------------------------------------------------------------------ */
4973 /* Function: ipf_nat_out */
4974 /* Returns: int - -1 == packet failed NAT checks so block it, */
4975 /* 1 == packet was successfully translated. */
4976 /* Parameters: fin(I) - pointer to packet information */
4977 /* nat(I) - pointer to NAT structure */
4978 /* natadd(I) - flag indicating if it is safe to add frag cache */
4979 /* nflags(I) - NAT flags set for this packet */
4980 /* */
4981 /* Translate a packet coming "out" on an interface. */
4982 /* ------------------------------------------------------------------------ */
4983 int
ipf_nat_out(fr_info_t * fin,nat_t * nat,int natadd,u_32_t nflags)4984 ipf_nat_out(fr_info_t *fin, nat_t *nat, int natadd, u_32_t nflags)
4985 {
4986 ipf_main_softc_t *softc = fin->fin_main_soft;
4987 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4988 icmphdr_t *icmp;
4989 tcphdr_t *tcp;
4990 ipnat_t *np;
4991 int skip;
4992 int i;
4993
4994 tcp = NULL;
4995 icmp = NULL;
4996 np = nat->nat_ptr;
4997
4998 if ((natadd != 0) && (fin->fin_flx & FI_FRAG) && (np != NULL))
4999 (void) ipf_frag_natnew(softc, fin, 0, nat);
5000
5001 /*
5002 * Fix up checksums, not by recalculating them, but
5003 * simply computing adjustments.
5004 * This is only done for STREAMS based IP implementations where the
5005 * checksum has already been calculated by IP. In all other cases,
5006 * IPFilter is called before the checksum needs calculating so there
5007 * is no call to modify whatever is in the header now.
5008 */
5009 if (nflags == IPN_ICMPERR) {
5010 u_32_t s1, s2, sumd, msumd;
5011
5012 s1 = LONG_SUM(ntohl(fin->fin_saddr));
5013 if (nat->nat_dir == NAT_OUTBOUND) {
5014 s2 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
5015 } else {
5016 s2 = LONG_SUM(ntohl(nat->nat_odstaddr));
5017 }
5018 CALC_SUMD(s1, s2, sumd);
5019 msumd = sumd;
5020
5021 s1 = LONG_SUM(ntohl(fin->fin_daddr));
5022 if (nat->nat_dir == NAT_OUTBOUND) {
5023 s2 = LONG_SUM(ntohl(nat->nat_ndstaddr));
5024 } else {
5025 s2 = LONG_SUM(ntohl(nat->nat_osrcaddr));
5026 }
5027 CALC_SUMD(s1, s2, sumd);
5028 msumd += sumd;
5029
5030 ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, msumd, 0);
5031 }
5032 #if !defined(_KERNEL) || SOLARIS || \
5033 defined(BRIDGE_IPF) || defined(__FreeBSD__)
5034 else {
5035 /*
5036 * We always do this on FreeBSD because this code doesn't
5037 * exist in fastforward.
5038 */
5039 switch (nat->nat_dir)
5040 {
5041 case NAT_OUTBOUND :
5042 ipf_fix_outcksum(fin->fin_cksum & FI_CK_L4PART,
5043 &fin->fin_ip->ip_sum,
5044 nat->nat_ipsumd, 0);
5045 break;
5046
5047 case NAT_INBOUND :
5048 ipf_fix_incksum(fin->fin_cksum & FI_CK_L4PART,
5049 &fin->fin_ip->ip_sum,
5050 nat->nat_ipsumd, 0);
5051 break;
5052
5053 default :
5054 break;
5055 }
5056 }
5057 #endif
5058
5059 /*
5060 * Address assignment is after the checksum modification because
5061 * we are using the address in the packet for determining the
5062 * correct checksum offset (the ICMP error could be coming from
5063 * anyone...)
5064 */
5065 switch (nat->nat_dir)
5066 {
5067 case NAT_OUTBOUND :
5068 fin->fin_ip->ip_src = nat->nat_nsrcip;
5069 fin->fin_saddr = nat->nat_nsrcaddr;
5070 fin->fin_ip->ip_dst = nat->nat_ndstip;
5071 fin->fin_daddr = nat->nat_ndstaddr;
5072 break;
5073
5074 case NAT_INBOUND :
5075 fin->fin_ip->ip_src = nat->nat_odstip;
5076 fin->fin_saddr = nat->nat_ndstaddr;
5077 fin->fin_ip->ip_dst = nat->nat_osrcip;
5078 fin->fin_daddr = nat->nat_nsrcaddr;
5079 break;
5080
5081 case NAT_DIVERTIN :
5082 {
5083 mb_t *m;
5084
5085 skip = ipf_nat_decap(fin, nat);
5086 if (skip <= 0) {
5087 NBUMPSIDED(1, ns_decap_fail);
5088 return (-1);
5089 }
5090
5091 m = fin->fin_m;
5092
5093 #if SOLARIS && defined(_KERNEL)
5094 m->b_rptr += skip;
5095 #else
5096 m->m_data += skip;
5097 m->m_len -= skip;
5098
5099 # ifdef M_PKTHDR
5100 if (m->m_flags & M_PKTHDR)
5101 m->m_pkthdr.len -= skip;
5102 # endif
5103 #endif
5104
5105 MUTEX_ENTER(&nat->nat_lock);
5106 ipf_nat_update(fin, nat);
5107 MUTEX_EXIT(&nat->nat_lock);
5108 fin->fin_flx |= FI_NATED;
5109 if (np != NULL && np->in_tag.ipt_num[0] != 0)
5110 fin->fin_nattag = &np->in_tag;
5111 return (1);
5112 /* NOTREACHED */
5113 }
5114
5115 case NAT_DIVERTOUT :
5116 {
5117 u_32_t s1, s2, sumd;
5118 udphdr_t *uh;
5119 ip_t *ip;
5120 mb_t *m;
5121
5122 m = M_DUP(np->in_divmp);
5123 if (m == NULL) {
5124 NBUMPSIDED(1, ns_divert_dup);
5125 return (-1);
5126 }
5127
5128 ip = MTOD(m, ip_t *);
5129 ip_fillid(ip);
5130 s2 = ntohs(ip->ip_id);
5131
5132 s1 = ip->ip_len;
5133 ip->ip_len = ntohs(ip->ip_len);
5134 ip->ip_len += fin->fin_plen;
5135 ip->ip_len = htons(ip->ip_len);
5136 s2 += ntohs(ip->ip_len);
5137 CALC_SUMD(s1, s2, sumd);
5138
5139 uh = (udphdr_t *)(ip + 1);
5140 uh->uh_ulen += fin->fin_plen;
5141 uh->uh_ulen = htons(uh->uh_ulen);
5142 #if !defined(_KERNEL) || SOLARIS || \
5143 defined(BRIDGE_IPF) || defined(__FreeBSD__)
5144 ipf_fix_outcksum(0, &ip->ip_sum, sumd, 0);
5145 #endif
5146
5147 PREP_MB_T(fin, m);
5148
5149 fin->fin_src = ip->ip_src;
5150 fin->fin_dst = ip->ip_dst;
5151 fin->fin_ip = ip;
5152 fin->fin_plen += sizeof(ip_t) + 8; /* UDP + IPv4 hdr */
5153 fin->fin_dlen += sizeof(ip_t) + 8; /* UDP + IPv4 hdr */
5154
5155 nflags &= ~IPN_TCPUDPICMP;
5156
5157 break;
5158 }
5159
5160 default :
5161 break;
5162 }
5163
5164 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5165 u_short *csump;
5166
5167 if ((nat->nat_nsport != 0) && (nflags & IPN_TCPUDP)) {
5168 tcp = fin->fin_dp;
5169
5170 switch (nat->nat_dir)
5171 {
5172 case NAT_OUTBOUND :
5173 tcp->th_sport = nat->nat_nsport;
5174 fin->fin_data[0] = ntohs(nat->nat_nsport);
5175 tcp->th_dport = nat->nat_ndport;
5176 fin->fin_data[1] = ntohs(nat->nat_ndport);
5177 break;
5178
5179 case NAT_INBOUND :
5180 tcp->th_sport = nat->nat_odport;
5181 fin->fin_data[0] = ntohs(nat->nat_odport);
5182 tcp->th_dport = nat->nat_osport;
5183 fin->fin_data[1] = ntohs(nat->nat_osport);
5184 break;
5185 }
5186 }
5187
5188 if ((nat->nat_nsport != 0) && (nflags & IPN_ICMPQUERY)) {
5189 icmp = fin->fin_dp;
5190 icmp->icmp_id = nat->nat_nicmpid;
5191 }
5192
5193 csump = ipf_nat_proto(fin, nat, nflags);
5194
5195 /*
5196 * The above comments do not hold for layer 4 (or higher)
5197 * checksums...
5198 */
5199 if (csump != NULL) {
5200 if (nat->nat_dir == NAT_OUTBOUND)
5201 ipf_fix_outcksum(fin->fin_cksum, csump,
5202 nat->nat_sumd[0],
5203 nat->nat_sumd[1] +
5204 fin->fin_dlen);
5205 else
5206 ipf_fix_incksum(fin->fin_cksum, csump,
5207 nat->nat_sumd[0],
5208 nat->nat_sumd[1] +
5209 fin->fin_dlen);
5210 }
5211 }
5212
5213 ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync);
5214 /* ------------------------------------------------------------- */
5215 /* A few quick notes: */
5216 /* Following are test conditions prior to calling the */
5217 /* ipf_proxy_check routine. */
5218 /* */
5219 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */
5220 /* with a redirect rule, we attempt to match the packet's */
5221 /* source port against in_dport, otherwise we'd compare the */
5222 /* packet's destination. */
5223 /* ------------------------------------------------------------- */
5224 if ((np != NULL) && (np->in_apr != NULL)) {
5225 i = ipf_proxy_check(fin, nat);
5226 if (i == -1) {
5227 NBUMPSIDED(1, ns_ipf_proxy_fail);
5228 }
5229 } else {
5230 i = 1;
5231 }
5232 fin->fin_flx |= FI_NATED;
5233 return (i);
5234 }
5235
5236
5237 /* ------------------------------------------------------------------------ */
5238 /* Function: ipf_nat_checkin */
5239 /* Returns: int - -1 == packet failed NAT checks so block it, */
5240 /* 0 == no packet translation occurred, */
5241 /* 1 == packet was successfully translated. */
5242 /* Parameters: fin(I) - pointer to packet information */
5243 /* passp(I) - pointer to filtering result flags */
5244 /* */
5245 /* Check to see if an incoming packet should be changed. ICMP packets are */
5246 /* first checked to see if they match an existing entry (if an error), */
5247 /* otherwise a search of the current NAT table is made. If neither results */
5248 /* in a match then a search for a matching NAT rule is made. Create a new */
5249 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */
5250 /* packet header(s) as required. */
5251 /* ------------------------------------------------------------------------ */
5252 int
ipf_nat_checkin(fr_info_t * fin,u_32_t * passp)5253 ipf_nat_checkin(fr_info_t *fin, u_32_t *passp)
5254 {
5255 ipf_main_softc_t *softc;
5256 ipf_nat_softc_t *softn;
5257 u_int nflags, natadd;
5258 ipnat_t *np, *npnext;
5259 int rval, natfailed;
5260 struct ifnet *ifp;
5261 struct in_addr in;
5262 icmphdr_t *icmp;
5263 tcphdr_t *tcp;
5264 u_short dport;
5265 nat_t *nat;
5266 u_32_t iph;
5267
5268 softc = fin->fin_main_soft;
5269 softn = softc->ipf_nat_soft;
5270
5271 if (softn->ipf_nat_lock != 0)
5272 return (0);
5273 if (softn->ipf_nat_stats.ns_rules == 0 &&
5274 softn->ipf_nat_instances == NULL)
5275 return (0);
5276
5277 tcp = NULL;
5278 icmp = NULL;
5279 dport = 0;
5280 natadd = 1;
5281 nflags = 0;
5282 natfailed = 0;
5283 ifp = fin->fin_ifp;
5284
5285 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5286 switch (fin->fin_p)
5287 {
5288 case IPPROTO_TCP :
5289 nflags = IPN_TCP;
5290 break;
5291 case IPPROTO_UDP :
5292 nflags = IPN_UDP;
5293 break;
5294 case IPPROTO_ICMP :
5295 icmp = fin->fin_dp;
5296
5297 /*
5298 * This is an incoming packet, so the destination is
5299 * the icmp_id and the source port equals 0
5300 */
5301 if ((fin->fin_flx & FI_ICMPQUERY) != 0) {
5302 nflags = IPN_ICMPQUERY;
5303 dport = icmp->icmp_id;
5304 } break;
5305 default :
5306 break;
5307 }
5308
5309 if ((nflags & IPN_TCPUDP)) {
5310 tcp = fin->fin_dp;
5311 dport = fin->fin_data[1];
5312 }
5313 }
5314
5315 in = fin->fin_dst;
5316
5317 READ_ENTER(&softc->ipf_nat);
5318
5319 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
5320 (nat = ipf_nat_icmperror(fin, &nflags, NAT_INBOUND)))
5321 /*EMPTY*/;
5322 else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin)))
5323 natadd = 0;
5324 else if ((nat = ipf_nat_inlookup(fin, nflags|NAT_SEARCH,
5325 (u_int)fin->fin_p,
5326 fin->fin_src, in))) {
5327 nflags = nat->nat_flags;
5328 } else if (fin->fin_off == 0) {
5329 u_32_t hv, msk, rmsk = 0;
5330
5331 /*
5332 * If there is no current entry in the nat table for this IP#,
5333 * create one for it (if there is a matching rule).
5334 */
5335 maskloop:
5336 msk = softn->ipf_nat_rdr_active_masks[rmsk];
5337 iph = in.s_addr & msk;
5338 hv = NAT_HASH_FN(iph, 0, softn->ipf_nat_rdrrules_sz);
5339 retry_roundrobin:
5340 /* TRACE (iph,msk,rmsk,hv,softn->ipf_nat_rdrrules_sz) */
5341 for (np = softn->ipf_nat_rdr_rules[hv]; np; np = npnext) {
5342 npnext = np->in_rnext;
5343 if (np->in_ifps[0] && (np->in_ifps[0] != ifp))
5344 continue;
5345 if (np->in_v[0] != 4)
5346 continue;
5347 if (np->in_pr[0] && (np->in_pr[0] != fin->fin_p))
5348 continue;
5349 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags))
5350 continue;
5351 if (np->in_flags & IPN_FILTER) {
5352 switch (ipf_nat_match(fin, np))
5353 {
5354 case 0 :
5355 continue;
5356 case -1 :
5357 rval = -3;
5358 goto inmatchfail;
5359 case 1 :
5360 default :
5361 break;
5362 }
5363 } else {
5364 if ((in.s_addr & np->in_odstmsk) !=
5365 np->in_odstaddr)
5366 continue;
5367 if (np->in_odport &&
5368 ((np->in_dtop < dport) ||
5369 (dport < np->in_odport)))
5370 continue;
5371 }
5372
5373 if (np->in_plabel != -1) {
5374 if (!ipf_proxy_ok(fin, tcp, np)) {
5375 continue;
5376 }
5377 }
5378
5379 if (np->in_flags & IPN_NO) {
5380 np->in_hits++;
5381 break;
5382 }
5383
5384 MUTEX_ENTER(&softn->ipf_nat_new);
5385 /*
5386 * If we've matched a round-robin rule but it has
5387 * moved in the list since we got it, start over as
5388 * this is now no longer correct.
5389 */
5390 if (npnext != np->in_rnext) {
5391 if ((np->in_flags & IPN_ROUNDR) != 0) {
5392 MUTEX_EXIT(&softn->ipf_nat_new);
5393 goto retry_roundrobin;
5394 }
5395 npnext = np->in_rnext;
5396 }
5397
5398 nat = ipf_nat_add(fin, np, NULL, nflags, NAT_INBOUND);
5399 MUTEX_EXIT(&softn->ipf_nat_new);
5400 if (nat != NULL) {
5401 natfailed = 0;
5402 break;
5403 }
5404 natfailed = -2;
5405 }
5406 if ((np == NULL) && (rmsk < softn->ipf_nat_rdr_max)) {
5407 rmsk++;
5408 goto maskloop;
5409 }
5410 }
5411
5412 if (nat != NULL) {
5413 rval = ipf_nat_in(fin, nat, natadd, nflags);
5414 if (rval == 1) {
5415 MUTEX_ENTER(&nat->nat_lock);
5416 ipf_nat_update(fin, nat);
5417 nat->nat_bytes[0] += fin->fin_plen;
5418 nat->nat_pkts[0]++;
5419 fin->fin_pktnum = nat->nat_pkts[0];
5420 MUTEX_EXIT(&nat->nat_lock);
5421 }
5422 } else
5423 rval = natfailed;
5424 inmatchfail:
5425 RWLOCK_EXIT(&softc->ipf_nat);
5426
5427 DT2(frb_natv4in, fr_info_t *, fin, int, rval);
5428 switch (rval)
5429 {
5430 case -3 :
5431 /* ipf_nat_match() failure */
5432 /* FALLTHROUGH */
5433 case -2 :
5434 /* retry_roundrobin loop failure */
5435 /* FALLTHROUGH */
5436 case -1 :
5437 /* proxy failure detected by ipf_nat_in() */
5438 if (passp != NULL) {
5439 NBUMPSIDED(0, ns_drop);
5440 *passp = FR_BLOCK;
5441 fin->fin_reason = FRB_NATV4;
5442 }
5443 fin->fin_flx |= FI_BADNAT;
5444 NBUMPSIDED(0, ns_badnat);
5445 rval = -1; /* We only return -1 on error. */
5446 break;
5447 case 0 :
5448 NBUMPSIDE(0, ns_ignored);
5449 break;
5450 case 1 :
5451 NBUMPSIDE(0, ns_translated);
5452 break;
5453 }
5454 return (rval);
5455 }
5456
5457
5458 /* ------------------------------------------------------------------------ */
5459 /* Function: ipf_nat_in */
5460 /* Returns: int - -1 == packet failed NAT checks so block it, */
5461 /* 1 == packet was successfully translated. */
5462 /* Parameters: fin(I) - pointer to packet information */
5463 /* nat(I) - pointer to NAT structure */
5464 /* natadd(I) - flag indicating if it is safe to add frag cache */
5465 /* nflags(I) - NAT flags set for this packet */
5466 /* Locks Held: ipf_nat(READ) */
5467 /* */
5468 /* Translate a packet coming "in" on an interface. */
5469 /* ------------------------------------------------------------------------ */
5470 int
ipf_nat_in(fr_info_t * fin,nat_t * nat,int natadd,u_32_t nflags)5471 ipf_nat_in(fr_info_t *fin, nat_t *nat, int natadd, u_32_t nflags)
5472 {
5473 ipf_main_softc_t *softc = fin->fin_main_soft;
5474 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5475 u_32_t sumd, ipsumd, sum1, sum2;
5476 icmphdr_t *icmp;
5477 tcphdr_t *tcp;
5478 ipnat_t *np;
5479 int skip;
5480 int i;
5481
5482 tcp = NULL;
5483 np = nat->nat_ptr;
5484 fin->fin_fr = nat->nat_fr;
5485
5486 if (np != NULL) {
5487 if ((natadd != 0) && (fin->fin_flx & FI_FRAG))
5488 (void) ipf_frag_natnew(softc, fin, 0, nat);
5489
5490 /* ------------------------------------------------------------- */
5491 /* A few quick notes: */
5492 /* Following are test conditions prior to calling the */
5493 /* ipf_proxy_check routine. */
5494 /* */
5495 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */
5496 /* with a map rule, we attempt to match the packet's */
5497 /* source port against in_dport, otherwise we'd compare the */
5498 /* packet's destination. */
5499 /* ------------------------------------------------------------- */
5500 if (np->in_apr != NULL) {
5501 i = ipf_proxy_check(fin, nat);
5502 if (i == -1) {
5503 NBUMPSIDED(0, ns_ipf_proxy_fail);
5504 return (-1);
5505 }
5506 }
5507 }
5508
5509 ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync);
5510
5511 ipsumd = nat->nat_ipsumd;
5512 /*
5513 * Fix up checksums, not by recalculating them, but
5514 * simply computing adjustments.
5515 * Why only do this for some platforms on inbound packets ?
5516 * Because for those that it is done, IP processing is yet to happen
5517 * and so the IPv4 header checksum has not yet been evaluated.
5518 * Perhaps it should always be done for the benefit of things like
5519 * fast forwarding (so that it doesn't need to be recomputed) but with
5520 * header checksum offloading, perhaps it is a moot point.
5521 */
5522
5523 switch (nat->nat_dir)
5524 {
5525 case NAT_INBOUND :
5526 if ((fin->fin_flx & FI_ICMPERR) == 0) {
5527 fin->fin_ip->ip_src = nat->nat_nsrcip;
5528 fin->fin_saddr = nat->nat_nsrcaddr;
5529 } else {
5530 sum1 = nat->nat_osrcaddr;
5531 sum2 = nat->nat_nsrcaddr;
5532 CALC_SUMD(sum1, sum2, sumd);
5533 ipsumd -= sumd;
5534 }
5535 fin->fin_ip->ip_dst = nat->nat_ndstip;
5536 fin->fin_daddr = nat->nat_ndstaddr;
5537 #if !defined(_KERNEL) || SOLARIS
5538 ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, ipsumd, 0);
5539 #endif
5540 break;
5541
5542 case NAT_OUTBOUND :
5543 if ((fin->fin_flx & FI_ICMPERR) == 0) {
5544 fin->fin_ip->ip_src = nat->nat_odstip;
5545 fin->fin_saddr = nat->nat_odstaddr;
5546 } else {
5547 sum1 = nat->nat_odstaddr;
5548 sum2 = nat->nat_ndstaddr;
5549 CALC_SUMD(sum1, sum2, sumd);
5550 ipsumd -= sumd;
5551 }
5552 fin->fin_ip->ip_dst = nat->nat_osrcip;
5553 fin->fin_daddr = nat->nat_osrcaddr;
5554 #if !defined(_KERNEL) || SOLARIS
5555 ipf_fix_incksum(0, &fin->fin_ip->ip_sum, ipsumd, 0);
5556 #endif
5557 break;
5558
5559 case NAT_DIVERTIN :
5560 {
5561 udphdr_t *uh;
5562 ip_t *ip;
5563 mb_t *m;
5564
5565 m = M_DUP(np->in_divmp);
5566 if (m == NULL) {
5567 NBUMPSIDED(0, ns_divert_dup);
5568 return (-1);
5569 }
5570
5571 ip = MTOD(m, ip_t *);
5572 ip_fillid(ip);
5573 sum1 = ntohs(ip->ip_len);
5574 ip->ip_len = ntohs(ip->ip_len);
5575 ip->ip_len += fin->fin_plen;
5576 ip->ip_len = htons(ip->ip_len);
5577
5578 uh = (udphdr_t *)(ip + 1);
5579 uh->uh_ulen += fin->fin_plen;
5580 uh->uh_ulen = htons(uh->uh_ulen);
5581
5582 sum2 = ntohs(ip->ip_id) + ntohs(ip->ip_len);
5583 sum2 += ntohs(ip->ip_off) & IP_DF;
5584 CALC_SUMD(sum1, sum2, sumd);
5585
5586 #if !defined(_KERNEL) || SOLARIS
5587 ipf_fix_outcksum(0, &ip->ip_sum, sumd, 0);
5588 #endif
5589 PREP_MB_T(fin, m);
5590
5591 fin->fin_ip = ip;
5592 fin->fin_plen += sizeof(ip_t) + 8; /* UDP + new IPv4 hdr */
5593 fin->fin_dlen += sizeof(ip_t) + 8; /* UDP + old IPv4 hdr */
5594
5595 nflags &= ~IPN_TCPUDPICMP;
5596
5597 break;
5598 }
5599
5600 case NAT_DIVERTOUT :
5601 {
5602 mb_t *m;
5603
5604 skip = ipf_nat_decap(fin, nat);
5605 if (skip <= 0) {
5606 NBUMPSIDED(0, ns_decap_fail);
5607 return (-1);
5608 }
5609
5610 m = fin->fin_m;
5611
5612 #if SOLARIS && defined(_KERNEL)
5613 m->b_rptr += skip;
5614 #else
5615 m->m_data += skip;
5616 m->m_len -= skip;
5617
5618 # ifdef M_PKTHDR
5619 if (m->m_flags & M_PKTHDR)
5620 m->m_pkthdr.len -= skip;
5621 # endif
5622 #endif
5623
5624 ipf_nat_update(fin, nat);
5625 nflags &= ~IPN_TCPUDPICMP;
5626 fin->fin_flx |= FI_NATED;
5627 if (np != NULL && np->in_tag.ipt_num[0] != 0)
5628 fin->fin_nattag = &np->in_tag;
5629 return (1);
5630 /* NOTREACHED */
5631 }
5632 }
5633 if (nflags & IPN_TCPUDP)
5634 tcp = fin->fin_dp;
5635
5636 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5637 u_short *csump;
5638
5639 if ((nat->nat_odport != 0) && (nflags & IPN_TCPUDP)) {
5640 switch (nat->nat_dir)
5641 {
5642 case NAT_INBOUND :
5643 tcp->th_sport = nat->nat_nsport;
5644 fin->fin_data[0] = ntohs(nat->nat_nsport);
5645 tcp->th_dport = nat->nat_ndport;
5646 fin->fin_data[1] = ntohs(nat->nat_ndport);
5647 break;
5648
5649 case NAT_OUTBOUND :
5650 tcp->th_sport = nat->nat_odport;
5651 fin->fin_data[0] = ntohs(nat->nat_odport);
5652 tcp->th_dport = nat->nat_osport;
5653 fin->fin_data[1] = ntohs(nat->nat_osport);
5654 break;
5655 }
5656 }
5657
5658
5659 if ((nat->nat_odport != 0) && (nflags & IPN_ICMPQUERY)) {
5660 icmp = fin->fin_dp;
5661
5662 icmp->icmp_id = nat->nat_nicmpid;
5663 }
5664
5665 csump = ipf_nat_proto(fin, nat, nflags);
5666
5667 /*
5668 * The above comments do not hold for layer 4 (or higher)
5669 * checksums...
5670 */
5671 if (csump != NULL) {
5672 if (nat->nat_dir == NAT_OUTBOUND)
5673 ipf_fix_incksum(0, csump, nat->nat_sumd[0], 0);
5674 else
5675 ipf_fix_outcksum(0, csump, nat->nat_sumd[0], 0);
5676 }
5677 }
5678
5679 fin->fin_flx |= FI_NATED;
5680 if (np != NULL && np->in_tag.ipt_num[0] != 0)
5681 fin->fin_nattag = &np->in_tag;
5682 return (1);
5683 }
5684
5685
5686 /* ------------------------------------------------------------------------ */
5687 /* Function: ipf_nat_proto */
5688 /* Returns: u_short* - pointer to transport header checksum to update, */
5689 /* NULL if the transport protocol is not recognised */
5690 /* as needing a checksum update. */
5691 /* Parameters: fin(I) - pointer to packet information */
5692 /* nat(I) - pointer to NAT structure */
5693 /* nflags(I) - NAT flags set for this packet */
5694 /* */
5695 /* Return the pointer to the checksum field for each protocol so understood.*/
5696 /* If support for making other changes to a protocol header is required, */
5697 /* that is not strictly 'address' translation, such as clamping the MSS in */
5698 /* TCP down to a specific value, then do it from here. */
5699 /* ------------------------------------------------------------------------ */
5700 u_short *
ipf_nat_proto(fr_info_t * fin,nat_t * nat,u_int nflags)5701 ipf_nat_proto(fr_info_t *fin, nat_t *nat, u_int nflags)
5702 {
5703 icmphdr_t *icmp;
5704 u_short *csump;
5705 tcphdr_t *tcp;
5706 udphdr_t *udp;
5707
5708 csump = NULL;
5709 if (fin->fin_out == 0) {
5710 fin->fin_rev = (nat->nat_dir & NAT_OUTBOUND);
5711 } else {
5712 fin->fin_rev = ((nat->nat_dir & NAT_OUTBOUND) == 0);
5713 }
5714
5715 switch (fin->fin_p)
5716 {
5717 case IPPROTO_TCP :
5718 tcp = fin->fin_dp;
5719
5720 if ((nflags & IPN_TCP) != 0)
5721 csump = &tcp->th_sum;
5722
5723 /*
5724 * Do a MSS CLAMPING on a SYN packet,
5725 * only deal IPv4 for now.
5726 */
5727 if ((nat->nat_mssclamp != 0) && (tcp->th_flags & TH_SYN) != 0)
5728 ipf_nat_mssclamp(tcp, nat->nat_mssclamp, fin, csump);
5729
5730 break;
5731
5732 case IPPROTO_UDP :
5733 udp = fin->fin_dp;
5734
5735 if ((nflags & IPN_UDP) != 0) {
5736 if (udp->uh_sum != 0)
5737 csump = &udp->uh_sum;
5738 }
5739 break;
5740
5741 case IPPROTO_ICMP :
5742 icmp = fin->fin_dp;
5743
5744 if ((nflags & IPN_ICMPQUERY) != 0) {
5745 if (icmp->icmp_cksum != 0)
5746 csump = &icmp->icmp_cksum;
5747 }
5748 break;
5749
5750 #ifdef USE_INET6
5751 case IPPROTO_ICMPV6 :
5752 {
5753 struct icmp6_hdr *icmp6 = (struct icmp6_hdr *)fin->fin_dp;
5754
5755 icmp6 = fin->fin_dp;
5756
5757 if ((nflags & IPN_ICMPQUERY) != 0) {
5758 if (icmp6->icmp6_cksum != 0)
5759 csump = &icmp6->icmp6_cksum;
5760 }
5761 break;
5762 }
5763 #endif
5764 }
5765 return (csump);
5766 }
5767
5768
5769 /* ------------------------------------------------------------------------ */
5770 /* Function: ipf_nat_expire */
5771 /* Returns: Nil */
5772 /* Parameters: softc(I) - pointer to soft context main structure */
5773 /* */
5774 /* Check all of the timeout queues for entries at the top which need to be */
5775 /* expired. */
5776 /* ------------------------------------------------------------------------ */
5777 void
ipf_nat_expire(ipf_main_softc_t * softc)5778 ipf_nat_expire(ipf_main_softc_t *softc)
5779 {
5780 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5781 ipftq_t *ifq, *ifqnext;
5782 ipftqent_t *tqe, *tqn;
5783 int i;
5784 SPL_INT(s);
5785
5786 SPL_NET(s);
5787 WRITE_ENTER(&softc->ipf_nat);
5788 for (ifq = softn->ipf_nat_tcptq, i = 0; ifq != NULL;
5789 ifq = ifq->ifq_next) {
5790 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
5791 if (tqe->tqe_die > softc->ipf_ticks)
5792 break;
5793 tqn = tqe->tqe_next;
5794 ipf_nat_delete(softc, tqe->tqe_parent, NL_EXPIRE);
5795 }
5796 }
5797
5798 for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifq->ifq_next) {
5799 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
5800 if (tqe->tqe_die > softc->ipf_ticks)
5801 break;
5802 tqn = tqe->tqe_next;
5803 ipf_nat_delete(softc, tqe->tqe_parent, NL_EXPIRE);
5804 }
5805 }
5806
5807 for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifqnext) {
5808 ifqnext = ifq->ifq_next;
5809
5810 if (((ifq->ifq_flags & IFQF_DELETE) != 0) &&
5811 (ifq->ifq_ref == 0)) {
5812 ipf_freetimeoutqueue(softc, ifq);
5813 }
5814 }
5815
5816 if (softn->ipf_nat_doflush != 0) {
5817 ipf_nat_extraflush(softc, softn, 2);
5818 softn->ipf_nat_doflush = 0;
5819 }
5820
5821 RWLOCK_EXIT(&softc->ipf_nat);
5822 SPL_X(s);
5823 }
5824
5825
5826 /* ------------------------------------------------------------------------ */
5827 /* Function: ipf_nat_sync */
5828 /* Returns: Nil */
5829 /* Parameters: softc(I) - pointer to soft context main structure */
5830 /* ifp(I) - pointer to network interface */
5831 /* */
5832 /* Walk through all of the currently active NAT sessions, looking for those */
5833 /* which need to have their translated address updated. */
5834 /* ------------------------------------------------------------------------ */
5835 void
ipf_nat_sync(ipf_main_softc_t * softc,void * ifp)5836 ipf_nat_sync(ipf_main_softc_t *softc, void *ifp)
5837 {
5838 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5839 u_32_t sum1, sum2, sumd;
5840 i6addr_t in;
5841 ipnat_t *n;
5842 nat_t *nat;
5843 void *ifp2;
5844 int idx;
5845 SPL_INT(s);
5846
5847 if (softc->ipf_running <= 0)
5848 return;
5849
5850 /*
5851 * Change IP addresses for NAT sessions for any protocol except TCP
5852 * since it will break the TCP connection anyway. The only rules
5853 * which will get changed are those which are "map ... -> 0/32",
5854 * where the rule specifies the address is taken from the interface.
5855 */
5856 SPL_NET(s);
5857 WRITE_ENTER(&softc->ipf_nat);
5858
5859 if (softc->ipf_running <= 0) {
5860 RWLOCK_EXIT(&softc->ipf_nat);
5861 return;
5862 }
5863
5864 for (nat = softn->ipf_nat_instances; nat; nat = nat->nat_next) {
5865 if ((nat->nat_flags & IPN_TCP) != 0)
5866 continue;
5867
5868 n = nat->nat_ptr;
5869 if (n != NULL) {
5870 if (n->in_v[1] == 4) {
5871 if (n->in_redir & NAT_MAP) {
5872 if ((n->in_nsrcaddr != 0) ||
5873 (n->in_nsrcmsk != 0xffffffff))
5874 continue;
5875 } else if (n->in_redir & NAT_REDIRECT) {
5876 if ((n->in_ndstaddr != 0) ||
5877 (n->in_ndstmsk != 0xffffffff))
5878 continue;
5879 }
5880 }
5881 #ifdef USE_INET6
5882 if (n->in_v[1] == 4) {
5883 if (n->in_redir & NAT_MAP) {
5884 if (!IP6_ISZERO(&n->in_nsrcaddr) ||
5885 !IP6_ISONES(&n->in_nsrcmsk))
5886 continue;
5887 } else if (n->in_redir & NAT_REDIRECT) {
5888 if (!IP6_ISZERO(&n->in_ndstaddr) ||
5889 !IP6_ISONES(&n->in_ndstmsk))
5890 continue;
5891 }
5892 }
5893 #endif
5894 }
5895
5896 if (((ifp == NULL) || (ifp == nat->nat_ifps[0]) ||
5897 (ifp == nat->nat_ifps[1]))) {
5898 nat->nat_ifps[0] = GETIFP(nat->nat_ifnames[0],
5899 nat->nat_v[0]);
5900 if ((nat->nat_ifps[0] != NULL) &&
5901 (nat->nat_ifps[0] != (void *)-1)) {
5902 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
5903 }
5904 if (nat->nat_ifnames[1][0] != '\0') {
5905 nat->nat_ifps[1] = GETIFP(nat->nat_ifnames[1],
5906 nat->nat_v[1]);
5907 } else {
5908 nat->nat_ifps[1] = nat->nat_ifps[0];
5909 }
5910 if ((nat->nat_ifps[1] != NULL) &&
5911 (nat->nat_ifps[1] != (void *)-1)) {
5912 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
5913 }
5914 ifp2 = nat->nat_ifps[0];
5915 if (ifp2 == NULL)
5916 continue;
5917
5918 /*
5919 * Change the map-to address to be the same as the
5920 * new one.
5921 */
5922 sum1 = NATFSUM(nat, nat->nat_v[1], nat_nsrc6);
5923 if (ipf_ifpaddr(softc, nat->nat_v[0], FRI_NORMAL, ifp2,
5924 &in, NULL) != -1) {
5925 if (nat->nat_v[0] == 4)
5926 nat->nat_nsrcip = in.in4;
5927 }
5928 sum2 = NATFSUM(nat, nat->nat_v[1], nat_nsrc6);
5929
5930 if (sum1 == sum2)
5931 continue;
5932 /*
5933 * Readjust the checksum adjustment to take into
5934 * account the new IP#.
5935 */
5936 CALC_SUMD(sum1, sum2, sumd);
5937 /* XXX - dont change for TCP when solaris does
5938 * hardware checksumming.
5939 */
5940 sumd += nat->nat_sumd[0];
5941 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
5942 nat->nat_sumd[1] = nat->nat_sumd[0];
5943 }
5944 }
5945
5946 for (n = softn->ipf_nat_list; (n != NULL); n = n->in_next) {
5947 char *base = n->in_names;
5948
5949 if ((ifp == NULL) || (n->in_ifps[0] == ifp))
5950 n->in_ifps[0] = ipf_resolvenic(softc,
5951 base + n->in_ifnames[0],
5952 n->in_v[0]);
5953 if ((ifp == NULL) || (n->in_ifps[1] == ifp))
5954 n->in_ifps[1] = ipf_resolvenic(softc,
5955 base + n->in_ifnames[1],
5956 n->in_v[1]);
5957
5958 if (n->in_redir & NAT_REDIRECT)
5959 idx = 1;
5960 else
5961 idx = 0;
5962
5963 if (((ifp == NULL) || (n->in_ifps[idx] == ifp)) &&
5964 (n->in_ifps[idx] != NULL &&
5965 n->in_ifps[idx] != (void *)-1)) {
5966
5967 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_osrc,
5968 0, n->in_ifps[idx]);
5969 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_odst,
5970 0, n->in_ifps[idx]);
5971 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_nsrc,
5972 0, n->in_ifps[idx]);
5973 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_ndst,
5974 0, n->in_ifps[idx]);
5975 }
5976 }
5977 RWLOCK_EXIT(&softc->ipf_nat);
5978 SPL_X(s);
5979 }
5980
5981
5982 /* ------------------------------------------------------------------------ */
5983 /* Function: ipf_nat_icmpquerytype */
5984 /* Returns: int - 1 == success, 0 == failure */
5985 /* Parameters: icmptype(I) - ICMP type number */
5986 /* */
5987 /* Tests to see if the ICMP type number passed is a query/response type or */
5988 /* not. */
5989 /* ------------------------------------------------------------------------ */
5990 static int
ipf_nat_icmpquerytype(int icmptype)5991 ipf_nat_icmpquerytype(int icmptype)
5992 {
5993
5994 /*
5995 * For the ICMP query NAT code, it is essential that both the query
5996 * and the reply match on the NAT rule. Because the NAT structure
5997 * does not keep track of the icmptype, and a single NAT structure
5998 * is used for all icmp types with the same src, dest and id, we
5999 * simply define the replies as queries as well. The funny thing is,
6000 * altough it seems silly to call a reply a query, this is exactly
6001 * as it is defined in the IPv4 specification
6002 */
6003 switch (icmptype)
6004 {
6005 case ICMP_ECHOREPLY:
6006 case ICMP_ECHO:
6007 /* route advertisement/solicitation is currently unsupported: */
6008 /* it would require rewriting the ICMP data section */
6009 case ICMP_TSTAMP:
6010 case ICMP_TSTAMPREPLY:
6011 case ICMP_IREQ:
6012 case ICMP_IREQREPLY:
6013 case ICMP_MASKREQ:
6014 case ICMP_MASKREPLY:
6015 return (1);
6016 default:
6017 return (0);
6018 }
6019 }
6020
6021
6022 /* ------------------------------------------------------------------------ */
6023 /* Function: nat_log */
6024 /* Returns: Nil */
6025 /* Parameters: softc(I) - pointer to soft context main structure */
6026 /* softn(I) - pointer to NAT context structure */
6027 /* nat(I) - pointer to NAT structure */
6028 /* action(I) - action related to NAT structure being performed */
6029 /* */
6030 /* Creates a NAT log entry. */
6031 /* ------------------------------------------------------------------------ */
6032 void
ipf_nat_log(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,struct nat * nat,u_int action)6033 ipf_nat_log(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, struct nat *nat,
6034 u_int action)
6035 {
6036 #ifdef IPFILTER_LOG
6037 struct ipnat *np;
6038 int rulen;
6039 struct natlog natl;
6040 void *items[1];
6041 size_t sizes[1];
6042 int types[1];
6043
6044 bcopy((char *)&nat->nat_osrc6, (char *)&natl.nl_osrcip,
6045 sizeof(natl.nl_osrcip));
6046 bcopy((char *)&nat->nat_nsrc6, (char *)&natl.nl_nsrcip,
6047 sizeof(natl.nl_nsrcip));
6048 bcopy((char *)&nat->nat_odst6, (char *)&natl.nl_odstip,
6049 sizeof(natl.nl_odstip));
6050 bcopy((char *)&nat->nat_ndst6, (char *)&natl.nl_ndstip,
6051 sizeof(natl.nl_ndstip));
6052
6053 natl.nl_bytes[0] = nat->nat_bytes[0];
6054 natl.nl_bytes[1] = nat->nat_bytes[1];
6055 natl.nl_pkts[0] = nat->nat_pkts[0];
6056 natl.nl_pkts[1] = nat->nat_pkts[1];
6057 natl.nl_odstport = nat->nat_odport;
6058 natl.nl_osrcport = nat->nat_osport;
6059 natl.nl_nsrcport = nat->nat_nsport;
6060 natl.nl_ndstport = nat->nat_ndport;
6061 natl.nl_p[0] = nat->nat_pr[0];
6062 natl.nl_p[1] = nat->nat_pr[1];
6063 natl.nl_v[0] = nat->nat_v[0];
6064 natl.nl_v[1] = nat->nat_v[1];
6065 natl.nl_type = nat->nat_redir;
6066 natl.nl_action = action;
6067 natl.nl_rule = -1;
6068
6069 bcopy(nat->nat_ifnames[0], natl.nl_ifnames[0],
6070 sizeof(nat->nat_ifnames[0]));
6071 bcopy(nat->nat_ifnames[1], natl.nl_ifnames[1],
6072 sizeof(nat->nat_ifnames[1]));
6073
6074 if (softc->ipf_large_nat && nat->nat_ptr != NULL) {
6075 for (rulen = 0, np = softn->ipf_nat_list; np != NULL;
6076 np = np->in_next, rulen++)
6077 if (np == nat->nat_ptr) {
6078 natl.nl_rule = rulen;
6079 break;
6080 }
6081 }
6082 items[0] = &natl;
6083 sizes[0] = sizeof(natl);
6084 types[0] = 0;
6085
6086 (void) ipf_log_items(softc, IPL_LOGNAT, NULL, items, sizes, types, 1);
6087 #endif
6088 }
6089
6090
6091
6092
6093 /* ------------------------------------------------------------------------ */
6094 /* Function: ipf_nat_rule_deref */
6095 /* Returns: Nil */
6096 /* Parameters: softc(I) - pointer to soft context main structure */
6097 /* inp(I) - pointer to pointer to NAT rule */
6098 /* Write Locks: ipf_nat */
6099 /* */
6100 /* Dropping the refernce count for a rule means that whatever held the */
6101 /* pointer to this rule (*inp) is no longer interested in it and when the */
6102 /* reference count drops to zero, any resources allocated for the rule can */
6103 /* be released and the rule itself free'd. */
6104 /* ------------------------------------------------------------------------ */
6105 void
ipf_nat_rule_deref(ipf_main_softc_t * softc,ipnat_t ** inp)6106 ipf_nat_rule_deref(ipf_main_softc_t *softc, ipnat_t **inp)
6107 {
6108 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6109 ipnat_t *n;
6110
6111 n = *inp;
6112 *inp = NULL;
6113 n->in_use--;
6114 if (n->in_use > 0)
6115 return;
6116
6117 if (n->in_apr != NULL)
6118 ipf_proxy_deref(n->in_apr);
6119
6120 ipf_nat_rule_fini(softc, n);
6121
6122 if (n->in_redir & NAT_REDIRECT) {
6123 if ((n->in_flags & IPN_PROXYRULE) == 0) {
6124 ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules_rdr);
6125 }
6126 }
6127 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
6128 if ((n->in_flags & IPN_PROXYRULE) == 0) {
6129 ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules_map);
6130 }
6131 }
6132
6133 if (n->in_tqehead[0] != NULL) {
6134 if (ipf_deletetimeoutqueue(n->in_tqehead[0]) == 0) {
6135 ipf_freetimeoutqueue(softc, n->in_tqehead[0]);
6136 }
6137 }
6138
6139 if (n->in_tqehead[1] != NULL) {
6140 if (ipf_deletetimeoutqueue(n->in_tqehead[1]) == 0) {
6141 ipf_freetimeoutqueue(softc, n->in_tqehead[1]);
6142 }
6143 }
6144
6145 if ((n->in_flags & IPN_PROXYRULE) == 0) {
6146 ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules);
6147 }
6148
6149 MUTEX_DESTROY(&n->in_lock);
6150
6151 KFREES(n, n->in_size);
6152
6153 #if SOLARIS && !defined(INSTANCES)
6154 if (softn->ipf_nat_stats.ns_rules == 0)
6155 pfil_delayed_copy = 1;
6156 #endif
6157 }
6158
6159
6160 /* ------------------------------------------------------------------------ */
6161 /* Function: ipf_nat_deref */
6162 /* Returns: Nil */
6163 /* Parameters: softc(I) - pointer to soft context main structure */
6164 /* natp(I) - pointer to pointer to NAT table entry */
6165 /* */
6166 /* Decrement the reference counter for this NAT table entry and free it if */
6167 /* there are no more things using it. */
6168 /* */
6169 /* IF nat_ref == 1 when this function is called, then we have an orphan nat */
6170 /* structure *because* it only gets called on paths _after_ nat_ref has been*/
6171 /* incremented. If nat_ref == 1 then we shouldn't decrement it here */
6172 /* because nat_delete() will do that and send nat_ref to -1. */
6173 /* */
6174 /* Holding the lock on nat_lock is required to serialise nat_delete() being */
6175 /* called from a NAT flush ioctl with a deref happening because of a packet.*/
6176 /* ------------------------------------------------------------------------ */
6177 void
ipf_nat_deref(ipf_main_softc_t * softc,nat_t ** natp)6178 ipf_nat_deref(ipf_main_softc_t *softc, nat_t **natp)
6179 {
6180 nat_t *nat;
6181
6182 nat = *natp;
6183 *natp = NULL;
6184
6185 MUTEX_ENTER(&nat->nat_lock);
6186 if (nat->nat_ref > 1) {
6187 nat->nat_ref--;
6188 ASSERT(nat->nat_ref >= 0);
6189 MUTEX_EXIT(&nat->nat_lock);
6190 return;
6191 }
6192 MUTEX_EXIT(&nat->nat_lock);
6193
6194 WRITE_ENTER(&softc->ipf_nat);
6195 ipf_nat_delete(softc, nat, NL_EXPIRE);
6196 RWLOCK_EXIT(&softc->ipf_nat);
6197 }
6198
6199
6200 /* ------------------------------------------------------------------------ */
6201 /* Function: ipf_nat_clone */
6202 /* Returns: ipstate_t* - NULL == cloning failed, */
6203 /* else pointer to new state structure */
6204 /* Parameters: fin(I) - pointer to packet information */
6205 /* is(I) - pointer to master state structure */
6206 /* Write Lock: ipf_nat */
6207 /* */
6208 /* Create a "duplcate" state table entry from the master. */
6209 /* ------------------------------------------------------------------------ */
6210 nat_t *
ipf_nat_clone(fr_info_t * fin,nat_t * nat)6211 ipf_nat_clone(fr_info_t *fin, nat_t *nat)
6212 {
6213 ipf_main_softc_t *softc = fin->fin_main_soft;
6214 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6215 frentry_t *fr;
6216 nat_t *clone;
6217 ipnat_t *np;
6218
6219 KMALLOC(clone, nat_t *);
6220 if (clone == NULL) {
6221 NBUMPSIDED(fin->fin_out, ns_clone_nomem);
6222 return (NULL);
6223 }
6224 bcopy((char *)nat, (char *)clone, sizeof(*clone));
6225
6226 MUTEX_NUKE(&clone->nat_lock);
6227
6228 clone->nat_rev = fin->fin_rev;
6229 clone->nat_aps = NULL;
6230 /*
6231 * Initialize all these so that ipf_nat_delete() doesn't cause a crash.
6232 */
6233 clone->nat_tqe.tqe_pnext = NULL;
6234 clone->nat_tqe.tqe_next = NULL;
6235 clone->nat_tqe.tqe_ifq = NULL;
6236 clone->nat_tqe.tqe_parent = clone;
6237
6238 clone->nat_flags &= ~SI_CLONE;
6239 clone->nat_flags |= SI_CLONED;
6240
6241 if (clone->nat_hm)
6242 clone->nat_hm->hm_ref++;
6243
6244 if (ipf_nat_insert(softc, softn, clone) == -1) {
6245 KFREE(clone);
6246 NBUMPSIDED(fin->fin_out, ns_insert_fail);
6247 return (NULL);
6248 }
6249
6250 np = clone->nat_ptr;
6251 if (np != NULL) {
6252 if (softn->ipf_nat_logging)
6253 ipf_nat_log(softc, softn, clone, NL_CLONE);
6254 np->in_use++;
6255 }
6256 fr = clone->nat_fr;
6257 if (fr != NULL) {
6258 MUTEX_ENTER(&fr->fr_lock);
6259 fr->fr_ref++;
6260 MUTEX_EXIT(&fr->fr_lock);
6261 }
6262
6263
6264 /*
6265 * Because the clone is created outside the normal loop of things and
6266 * TCP has special needs in terms of state, initialise the timeout
6267 * state of the new NAT from here.
6268 */
6269 if (clone->nat_pr[0] == IPPROTO_TCP) {
6270 (void) ipf_tcp_age(&clone->nat_tqe, fin, softn->ipf_nat_tcptq,
6271 clone->nat_flags, 2);
6272 }
6273 clone->nat_sync = ipf_sync_new(softc, SMC_NAT, fin, clone);
6274 if (softn->ipf_nat_logging)
6275 ipf_nat_log(softc, softn, clone, NL_CLONE);
6276 return (clone);
6277 }
6278
6279
6280 /* ------------------------------------------------------------------------ */
6281 /* Function: ipf_nat_wildok */
6282 /* Returns: int - 1 == packet's ports match wildcards */
6283 /* 0 == packet's ports don't match wildcards */
6284 /* Parameters: nat(I) - NAT entry */
6285 /* sport(I) - source port */
6286 /* dport(I) - destination port */
6287 /* flags(I) - wildcard flags */
6288 /* dir(I) - packet direction */
6289 /* */
6290 /* Use NAT entry and packet direction to determine which combination of */
6291 /* wildcard flags should be used. */
6292 /* ------------------------------------------------------------------------ */
6293 int
ipf_nat_wildok(nat_t * nat,int sport,int dport,int flags,int dir)6294 ipf_nat_wildok(nat_t *nat, int sport, int dport, int flags, int dir)
6295 {
6296 /*
6297 * When called by dir is set to
6298 * nat_inlookup NAT_INBOUND (0)
6299 * nat_outlookup NAT_OUTBOUND (1)
6300 *
6301 * We simply combine the packet's direction in dir with the original
6302 * "intended" direction of that NAT entry in nat->nat_dir to decide
6303 * which combination of wildcard flags to allow.
6304 */
6305 switch ((dir << 1) | (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND)))
6306 {
6307 case 3: /* outbound packet / outbound entry */
6308 if (((nat->nat_osport == sport) ||
6309 (flags & SI_W_SPORT)) &&
6310 ((nat->nat_odport == dport) ||
6311 (flags & SI_W_DPORT)))
6312 return (1);
6313 break;
6314 case 2: /* outbound packet / inbound entry */
6315 if (((nat->nat_osport == dport) ||
6316 (flags & SI_W_SPORT)) &&
6317 ((nat->nat_odport == sport) ||
6318 (flags & SI_W_DPORT)))
6319 return (1);
6320 break;
6321 case 1: /* inbound packet / outbound entry */
6322 if (((nat->nat_osport == dport) ||
6323 (flags & SI_W_SPORT)) &&
6324 ((nat->nat_odport == sport) ||
6325 (flags & SI_W_DPORT)))
6326 return (1);
6327 break;
6328 case 0: /* inbound packet / inbound entry */
6329 if (((nat->nat_osport == sport) ||
6330 (flags & SI_W_SPORT)) &&
6331 ((nat->nat_odport == dport) ||
6332 (flags & SI_W_DPORT)))
6333 return (1);
6334 break;
6335 default:
6336 break;
6337 }
6338
6339 return (0);
6340 }
6341
6342
6343 /* ------------------------------------------------------------------------ */
6344 /* Function: nat_mssclamp */
6345 /* Returns: Nil */
6346 /* Parameters: tcp(I) - pointer to TCP header */
6347 /* maxmss(I) - value to clamp the TCP MSS to */
6348 /* fin(I) - pointer to packet information */
6349 /* csump(I) - pointer to TCP checksum */
6350 /* */
6351 /* Check for MSS option and clamp it if necessary. If found and changed, */
6352 /* then the TCP header checksum will be updated to reflect the change in */
6353 /* the MSS. */
6354 /* ------------------------------------------------------------------------ */
6355 static void
ipf_nat_mssclamp(tcphdr_t * tcp,u_32_t maxmss,fr_info_t * fin,u_short * csump)6356 ipf_nat_mssclamp(tcphdr_t *tcp, u_32_t maxmss, fr_info_t *fin, u_short *csump)
6357 {
6358 u_char *cp, *ep, opt;
6359 int hlen, advance;
6360 u_32_t mss, sumd;
6361
6362 hlen = TCP_OFF(tcp) << 2;
6363 if (hlen > sizeof(*tcp)) {
6364 cp = (u_char *)tcp + sizeof(*tcp);
6365 ep = (u_char *)tcp + hlen;
6366
6367 while (cp < ep) {
6368 opt = cp[0];
6369 if (opt == TCPOPT_EOL)
6370 break;
6371 else if (opt == TCPOPT_NOP) {
6372 cp++;
6373 continue;
6374 }
6375
6376 if (cp + 1 >= ep)
6377 break;
6378 advance = cp[1];
6379 if ((cp + advance > ep) || (advance <= 0))
6380 break;
6381 switch (opt)
6382 {
6383 case TCPOPT_MAXSEG:
6384 if (advance != 4)
6385 break;
6386 mss = cp[2] * 256 + cp[3];
6387 if (mss > maxmss) {
6388 cp[2] = maxmss / 256;
6389 cp[3] = maxmss & 0xff;
6390 CALC_SUMD(mss, maxmss, sumd);
6391 ipf_fix_outcksum(0, csump, sumd, 0);
6392 }
6393 break;
6394 default:
6395 /* ignore unknown options */
6396 break;
6397 }
6398
6399 cp += advance;
6400 }
6401 }
6402 }
6403
6404
6405 /* ------------------------------------------------------------------------ */
6406 /* Function: ipf_nat_setqueue */
6407 /* Returns: Nil */
6408 /* Parameters: softc(I) - pointer to soft context main structure */
6409 /* softn(I) - pointer to NAT context structure */
6410 /* nat(I)- pointer to NAT structure */
6411 /* Locks: ipf_nat (read or write) */
6412 /* */
6413 /* Put the NAT entry on its default queue entry, using rev as a helped in */
6414 /* determining which queue it should be placed on. */
6415 /* ------------------------------------------------------------------------ */
6416 void
ipf_nat_setqueue(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,nat_t * nat)6417 ipf_nat_setqueue(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, nat_t *nat)
6418 {
6419 ipftq_t *oifq, *nifq;
6420 int rev = nat->nat_rev;
6421
6422 if (nat->nat_ptr != NULL)
6423 nifq = nat->nat_ptr->in_tqehead[rev];
6424 else
6425 nifq = NULL;
6426
6427 if (nifq == NULL) {
6428 switch (nat->nat_pr[0])
6429 {
6430 case IPPROTO_UDP :
6431 nifq = &softn->ipf_nat_udptq;
6432 break;
6433 case IPPROTO_ICMP :
6434 nifq = &softn->ipf_nat_icmptq;
6435 break;
6436 case IPPROTO_TCP :
6437 nifq = softn->ipf_nat_tcptq +
6438 nat->nat_tqe.tqe_state[rev];
6439 break;
6440 default :
6441 nifq = &softn->ipf_nat_iptq;
6442 break;
6443 }
6444 }
6445
6446 oifq = nat->nat_tqe.tqe_ifq;
6447 /*
6448 * If it's currently on a timeout queue, move it from one queue to
6449 * another, else put it on the end of the newly determined queue.
6450 */
6451 if (oifq != NULL)
6452 ipf_movequeue(softc->ipf_ticks, &nat->nat_tqe, oifq, nifq);
6453 else
6454 ipf_queueappend(softc->ipf_ticks, &nat->nat_tqe, nifq, nat);
6455 return;
6456 }
6457
6458
6459 /* ------------------------------------------------------------------------ */
6460 /* Function: nat_getnext */
6461 /* Returns: int - 0 == ok, else error */
6462 /* Parameters: softc(I) - pointer to soft context main structure */
6463 /* t(I) - pointer to ipftoken structure */
6464 /* itp(I) - pointer to ipfgeniter_t structure */
6465 /* */
6466 /* Fetch the next nat/ipnat structure pointer from the linked list and */
6467 /* copy it out to the storage space pointed to by itp_data. The next item */
6468 /* in the list to look at is put back in the ipftoken struture. */
6469 /* ------------------------------------------------------------------------ */
6470 static int
ipf_nat_getnext(ipf_main_softc_t * softc,ipftoken_t * t,ipfgeniter_t * itp,ipfobj_t * objp)6471 ipf_nat_getnext(ipf_main_softc_t *softc, ipftoken_t *t, ipfgeniter_t *itp,
6472 ipfobj_t *objp)
6473 {
6474 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6475 hostmap_t *hm, *nexthm = NULL, zerohm;
6476 ipnat_t *ipn, *nextipnat = NULL, zeroipn;
6477 nat_t *nat, *nextnat = NULL, zeronat;
6478 int error = 0;
6479 void *nnext;
6480
6481 if (itp->igi_nitems != 1) {
6482 IPFERROR(60075);
6483 return (ENOSPC);
6484 }
6485
6486 READ_ENTER(&softc->ipf_nat);
6487
6488 switch (itp->igi_type)
6489 {
6490 case IPFGENITER_HOSTMAP :
6491 hm = t->ipt_data;
6492 if (hm == NULL) {
6493 nexthm = softn->ipf_hm_maplist;
6494 } else {
6495 nexthm = hm->hm_next;
6496 }
6497 if (nexthm != NULL) {
6498 ATOMIC_INC32(nexthm->hm_ref);
6499 t->ipt_data = nexthm;
6500 } else {
6501 bzero(&zerohm, sizeof(zerohm));
6502 nexthm = &zerohm;
6503 t->ipt_data = NULL;
6504 }
6505 nnext = nexthm->hm_next;
6506 break;
6507
6508 case IPFGENITER_IPNAT :
6509 ipn = t->ipt_data;
6510 if (ipn == NULL) {
6511 nextipnat = softn->ipf_nat_list;
6512 } else {
6513 nextipnat = ipn->in_next;
6514 }
6515 if (nextipnat != NULL) {
6516 ATOMIC_INC32(nextipnat->in_use);
6517 t->ipt_data = nextipnat;
6518 } else {
6519 bzero(&zeroipn, sizeof(zeroipn));
6520 nextipnat = &zeroipn;
6521 t->ipt_data = NULL;
6522 }
6523 nnext = nextipnat->in_next;
6524 break;
6525
6526 case IPFGENITER_NAT :
6527 nat = t->ipt_data;
6528 if (nat == NULL) {
6529 nextnat = softn->ipf_nat_instances;
6530 } else {
6531 nextnat = nat->nat_next;
6532 }
6533 if (nextnat != NULL) {
6534 MUTEX_ENTER(&nextnat->nat_lock);
6535 nextnat->nat_ref++;
6536 MUTEX_EXIT(&nextnat->nat_lock);
6537 t->ipt_data = nextnat;
6538 } else {
6539 bzero(&zeronat, sizeof(zeronat));
6540 nextnat = &zeronat;
6541 t->ipt_data = NULL;
6542 }
6543 nnext = nextnat->nat_next;
6544 break;
6545
6546 default :
6547 RWLOCK_EXIT(&softc->ipf_nat);
6548 IPFERROR(60055);
6549 return (EINVAL);
6550 }
6551
6552 RWLOCK_EXIT(&softc->ipf_nat);
6553
6554 objp->ipfo_ptr = itp->igi_data;
6555
6556 switch (itp->igi_type)
6557 {
6558 case IPFGENITER_HOSTMAP :
6559 error = COPYOUT(nexthm, objp->ipfo_ptr, sizeof(*nexthm));
6560 if (error != 0) {
6561 IPFERROR(60049);
6562 error = EFAULT;
6563 }
6564 if (hm != NULL) {
6565 WRITE_ENTER(&softc->ipf_nat);
6566 ipf_nat_hostmapdel(softc, &hm);
6567 RWLOCK_EXIT(&softc->ipf_nat);
6568 }
6569 break;
6570
6571 case IPFGENITER_IPNAT :
6572 objp->ipfo_size = nextipnat->in_size;
6573 objp->ipfo_type = IPFOBJ_IPNAT;
6574 error = ipf_outobjk(softc, objp, nextipnat);
6575 if (ipn != NULL) {
6576 WRITE_ENTER(&softc->ipf_nat);
6577 ipf_nat_rule_deref(softc, &ipn);
6578 RWLOCK_EXIT(&softc->ipf_nat);
6579 }
6580 break;
6581
6582 case IPFGENITER_NAT :
6583 objp->ipfo_size = sizeof(nat_t);
6584 objp->ipfo_type = IPFOBJ_NAT;
6585 error = ipf_outobjk(softc, objp, nextnat);
6586 if (nat != NULL)
6587 ipf_nat_deref(softc, &nat);
6588
6589 break;
6590 }
6591
6592 if (nnext == NULL)
6593 ipf_token_mark_complete(t);
6594
6595 return (error);
6596 }
6597
6598
6599 /* ------------------------------------------------------------------------ */
6600 /* Function: nat_extraflush */
6601 /* Returns: int - 0 == success, -1 == failure */
6602 /* Parameters: softc(I) - pointer to soft context main structure */
6603 /* softn(I) - pointer to NAT context structure */
6604 /* which(I) - how to flush the active NAT table */
6605 /* Write Locks: ipf_nat */
6606 /* */
6607 /* Flush nat tables. Three actions currently defined: */
6608 /* which == 0 : flush all nat table entries */
6609 /* which == 1 : flush TCP connections which have started to close but are */
6610 /* stuck for some reason. */
6611 /* which == 2 : flush TCP connections which have been idle for a long time, */
6612 /* starting at > 4 days idle and working back in successive half-*/
6613 /* days to at most 12 hours old. If this fails to free enough */
6614 /* slots then work backwards in half hour slots to 30 minutes. */
6615 /* If that too fails, then work backwards in 30 second intervals */
6616 /* for the last 30 minutes to at worst 30 seconds idle. */
6617 /* ------------------------------------------------------------------------ */
6618 static int
ipf_nat_extraflush(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,int which)6619 ipf_nat_extraflush(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, int which)
6620 {
6621 nat_t *nat, **natp;
6622 ipftqent_t *tqn;
6623 ipftq_t *ifq;
6624 int removed;
6625 SPL_INT(s);
6626
6627 removed = 0;
6628
6629 SPL_NET(s);
6630 switch (which)
6631 {
6632 case 0 :
6633 softn->ipf_nat_stats.ns_flush_all++;
6634 /*
6635 * Style 0 flush removes everything...
6636 */
6637 for (natp = &softn->ipf_nat_instances;
6638 ((nat = *natp) != NULL); ) {
6639 ipf_nat_delete(softc, nat, NL_FLUSH);
6640 removed++;
6641 }
6642 break;
6643
6644 case 1 :
6645 softn->ipf_nat_stats.ns_flush_closing++;
6646 /*
6647 * Since we're only interested in things that are closing,
6648 * we can start with the appropriate timeout queue.
6649 */
6650 for (ifq = softn->ipf_nat_tcptq + IPF_TCPS_CLOSE_WAIT;
6651 ifq != NULL; ifq = ifq->ifq_next) {
6652
6653 for (tqn = ifq->ifq_head; tqn != NULL; ) {
6654 nat = tqn->tqe_parent;
6655 tqn = tqn->tqe_next;
6656 if (nat->nat_pr[0] != IPPROTO_TCP ||
6657 nat->nat_pr[1] != IPPROTO_TCP)
6658 break;
6659 ipf_nat_delete(softc, nat, NL_EXPIRE);
6660 removed++;
6661 }
6662 }
6663
6664 /*
6665 * Also need to look through the user defined queues.
6666 */
6667 for (ifq = softn->ipf_nat_utqe; ifq != NULL;
6668 ifq = ifq->ifq_next) {
6669 for (tqn = ifq->ifq_head; tqn != NULL; ) {
6670 nat = tqn->tqe_parent;
6671 tqn = tqn->tqe_next;
6672 if (nat->nat_pr[0] != IPPROTO_TCP ||
6673 nat->nat_pr[1] != IPPROTO_TCP)
6674 continue;
6675
6676 if ((nat->nat_tcpstate[0] >
6677 IPF_TCPS_ESTABLISHED) &&
6678 (nat->nat_tcpstate[1] >
6679 IPF_TCPS_ESTABLISHED)) {
6680 ipf_nat_delete(softc, nat, NL_EXPIRE);
6681 removed++;
6682 }
6683 }
6684 }
6685 break;
6686
6687 /*
6688 * Args 5-11 correspond to flushing those particular states
6689 * for TCP connections.
6690 */
6691 case IPF_TCPS_CLOSE_WAIT :
6692 case IPF_TCPS_FIN_WAIT_1 :
6693 case IPF_TCPS_CLOSING :
6694 case IPF_TCPS_LAST_ACK :
6695 case IPF_TCPS_FIN_WAIT_2 :
6696 case IPF_TCPS_TIME_WAIT :
6697 case IPF_TCPS_CLOSED :
6698 softn->ipf_nat_stats.ns_flush_state++;
6699 tqn = softn->ipf_nat_tcptq[which].ifq_head;
6700 while (tqn != NULL) {
6701 nat = tqn->tqe_parent;
6702 tqn = tqn->tqe_next;
6703 ipf_nat_delete(softc, nat, NL_FLUSH);
6704 removed++;
6705 }
6706 break;
6707
6708 default :
6709 if (which < 30)
6710 break;
6711
6712 softn->ipf_nat_stats.ns_flush_timeout++;
6713 /*
6714 * Take a large arbitrary number to mean the number of seconds
6715 * for which which consider to be the maximum value we'll allow
6716 * the expiration to be.
6717 */
6718 which = IPF_TTLVAL(which);
6719 for (natp = &softn->ipf_nat_instances;
6720 ((nat = *natp) != NULL); ) {
6721 if (softc->ipf_ticks - nat->nat_touched > which) {
6722 ipf_nat_delete(softc, nat, NL_FLUSH);
6723 removed++;
6724 } else
6725 natp = &nat->nat_next;
6726 }
6727 break;
6728 }
6729
6730 if (which != 2) {
6731 SPL_X(s);
6732 return (removed);
6733 }
6734
6735 softn->ipf_nat_stats.ns_flush_queue++;
6736
6737 /*
6738 * Asked to remove inactive entries because the table is full, try
6739 * again, 3 times, if first attempt failed with a different criteria
6740 * each time. The order tried in must be in decreasing age.
6741 * Another alternative is to implement random drop and drop N entries
6742 * at random until N have been freed up.
6743 */
6744 if (softc->ipf_ticks - softn->ipf_nat_last_force_flush >
6745 IPF_TTLVAL(5)) {
6746 softn->ipf_nat_last_force_flush = softc->ipf_ticks;
6747
6748 removed = ipf_queueflush(softc, ipf_nat_flush_entry,
6749 softn->ipf_nat_tcptq,
6750 softn->ipf_nat_utqe,
6751 &softn->ipf_nat_stats.ns_active,
6752 softn->ipf_nat_table_sz,
6753 softn->ipf_nat_table_wm_low);
6754 }
6755
6756 SPL_X(s);
6757 return (removed);
6758 }
6759
6760
6761 /* ------------------------------------------------------------------------ */
6762 /* Function: ipf_nat_flush_entry */
6763 /* Returns: 0 - always succeeds */
6764 /* Parameters: softc(I) - pointer to soft context main structure */
6765 /* entry(I) - pointer to NAT entry */
6766 /* Write Locks: ipf_nat */
6767 /* */
6768 /* This function is a stepping stone between ipf_queueflush() and */
6769 /* nat_dlete(). It is used so we can provide a uniform interface via the */
6770 /* ipf_queueflush() function. Since the nat_delete() function returns void */
6771 /* we translate that to mean it always succeeds in deleting something. */
6772 /* ------------------------------------------------------------------------ */
6773 static int
ipf_nat_flush_entry(ipf_main_softc_t * softc,void * entry)6774 ipf_nat_flush_entry(ipf_main_softc_t *softc, void *entry)
6775 {
6776 ipf_nat_delete(softc, entry, NL_FLUSH);
6777 return (0);
6778 }
6779
6780
6781 /* ------------------------------------------------------------------------ */
6782 /* Function: ipf_nat_iterator */
6783 /* Returns: int - 0 == ok, else error */
6784 /* Parameters: softc(I) - pointer to soft context main structure */
6785 /* token(I) - pointer to ipftoken structure */
6786 /* itp(I) - pointer to ipfgeniter_t structure */
6787 /* obj(I) - pointer to data description structure */
6788 /* */
6789 /* This function acts as a handler for the SIOCGENITER ioctls that use a */
6790 /* generic structure to iterate through a list. There are three different */
6791 /* linked lists of NAT related information to go through: NAT rules, active */
6792 /* NAT mappings and the NAT fragment cache. */
6793 /* ------------------------------------------------------------------------ */
6794 static int
ipf_nat_iterator(ipf_main_softc_t * softc,ipftoken_t * token,ipfgeniter_t * itp,ipfobj_t * obj)6795 ipf_nat_iterator(ipf_main_softc_t *softc, ipftoken_t *token, ipfgeniter_t *itp,
6796 ipfobj_t *obj)
6797 {
6798 int error;
6799
6800 if (itp->igi_data == NULL) {
6801 IPFERROR(60052);
6802 return (EFAULT);
6803 }
6804
6805 switch (itp->igi_type)
6806 {
6807 case IPFGENITER_HOSTMAP :
6808 case IPFGENITER_IPNAT :
6809 case IPFGENITER_NAT :
6810 error = ipf_nat_getnext(softc, token, itp, obj);
6811 break;
6812
6813 case IPFGENITER_NATFRAG :
6814 error = ipf_frag_nat_next(softc, token, itp);
6815 break;
6816 default :
6817 IPFERROR(60053);
6818 error = EINVAL;
6819 break;
6820 }
6821
6822 return (error);
6823 }
6824
6825
6826 /* ------------------------------------------------------------------------ */
6827 /* Function: ipf_nat_setpending */
6828 /* Returns: Nil */
6829 /* Parameters: softc(I) - pointer to soft context main structure */
6830 /* nat(I) - pointer to NAT structure */
6831 /* Locks: ipf_nat (read or write) */
6832 /* */
6833 /* Put the NAT entry on to the pending queue - this queue has a very short */
6834 /* lifetime where items are put that can't be deleted straight away because */
6835 /* of locking issues but we want to delete them ASAP, anyway. In calling */
6836 /* this function, it is assumed that the owner (if there is one, as shown */
6837 /* by nat_me) is no longer interested in it. */
6838 /* ------------------------------------------------------------------------ */
6839 void
ipf_nat_setpending(ipf_main_softc_t * softc,nat_t * nat)6840 ipf_nat_setpending(ipf_main_softc_t *softc, nat_t *nat)
6841 {
6842 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6843 ipftq_t *oifq;
6844
6845 oifq = nat->nat_tqe.tqe_ifq;
6846 if (oifq != NULL)
6847 ipf_movequeue(softc->ipf_ticks, &nat->nat_tqe, oifq,
6848 &softn->ipf_nat_pending);
6849 else
6850 ipf_queueappend(softc->ipf_ticks, &nat->nat_tqe,
6851 &softn->ipf_nat_pending, nat);
6852
6853 if (nat->nat_me != NULL) {
6854 *nat->nat_me = NULL;
6855 nat->nat_me = NULL;
6856 nat->nat_ref--;
6857 ASSERT(nat->nat_ref >= 0);
6858 }
6859 }
6860
6861
6862 /* ------------------------------------------------------------------------ */
6863 /* Function: nat_newrewrite */
6864 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */
6865 /* allow rule to be moved if IPN_ROUNDR is set. */
6866 /* Parameters: fin(I) - pointer to packet information */
6867 /* nat(I) - pointer to NAT entry */
6868 /* ni(I) - pointer to structure with misc. information needed */
6869 /* to create new NAT entry. */
6870 /* Write Lock: ipf_nat */
6871 /* */
6872 /* This function is responsible for setting up an active NAT session where */
6873 /* we are changing both the source and destination parameters at the same */
6874 /* time. The loop in here works differently to elsewhere - each iteration */
6875 /* is responsible for changing a single parameter that can be incremented. */
6876 /* So one pass may increase the source IP#, next source port, next dest. IP#*/
6877 /* and the last destination port for a total of 4 iterations to try each. */
6878 /* This is done to try and exhaustively use the translation space available.*/
6879 /* ------------------------------------------------------------------------ */
6880 static int
ipf_nat_newrewrite(fr_info_t * fin,nat_t * nat,natinfo_t * nai)6881 ipf_nat_newrewrite(fr_info_t *fin, nat_t *nat, natinfo_t *nai)
6882 {
6883 int src_search = 1;
6884 int dst_search = 1;
6885 fr_info_t frnat;
6886 u_32_t flags;
6887 u_short swap;
6888 ipnat_t *np;
6889 nat_t *natl;
6890 int l = 0;
6891 int changed;
6892
6893 natl = NULL;
6894 changed = -1;
6895 np = nai->nai_np;
6896 flags = nat->nat_flags;
6897 bcopy((char *)fin, (char *)&frnat, sizeof(*fin));
6898
6899 nat->nat_hm = NULL;
6900
6901 do {
6902 changed = -1;
6903 /* TRACE (l, src_search, dst_search, np) */
6904 DT4(ipf_nat_rewrite_1, int, l, int, src_search, int, dst_search, ipnat_t *, np);
6905
6906 if ((src_search == 0) && (np->in_spnext == 0) &&
6907 (dst_search == 0) && (np->in_dpnext == 0)) {
6908 if (l > 0)
6909 return (-1);
6910 }
6911
6912 /*
6913 * Find a new source address
6914 */
6915 if (ipf_nat_nextaddr(fin, &np->in_nsrc, &frnat.fin_saddr,
6916 &frnat.fin_saddr) == -1) {
6917 return (-1);
6918 }
6919
6920 if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0xffffffff)) {
6921 src_search = 0;
6922 if (np->in_stepnext == 0)
6923 np->in_stepnext = 1;
6924
6925 } else if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0)) {
6926 src_search = 0;
6927 if (np->in_stepnext == 0)
6928 np->in_stepnext = 1;
6929
6930 } else if (np->in_nsrcmsk == 0xffffffff) {
6931 src_search = 0;
6932 if (np->in_stepnext == 0)
6933 np->in_stepnext = 1;
6934
6935 } else if (np->in_nsrcmsk != 0xffffffff) {
6936 if (np->in_stepnext == 0 && changed == -1) {
6937 np->in_snip++;
6938 np->in_stepnext++;
6939 changed = 0;
6940 }
6941 }
6942
6943 if ((flags & IPN_TCPUDPICMP) != 0) {
6944 if (np->in_spnext != 0)
6945 frnat.fin_data[0] = np->in_spnext;
6946
6947 /*
6948 * Standard port translation. Select next port.
6949 */
6950 if ((flags & IPN_FIXEDSPORT) != 0) {
6951 np->in_stepnext = 2;
6952 } else if ((np->in_stepnext == 1) &&
6953 (changed == -1) && (natl != NULL)) {
6954 np->in_spnext++;
6955 np->in_stepnext++;
6956 changed = 1;
6957 if (np->in_spnext > np->in_spmax)
6958 np->in_spnext = np->in_spmin;
6959 }
6960 } else {
6961 np->in_stepnext = 2;
6962 }
6963 np->in_stepnext &= 0x3;
6964
6965 /*
6966 * Find a new destination address
6967 */
6968 /* TRACE (fin, np, l, frnat) */
6969 DT4(ipf_nat_rewrite_2, frinfo_t *, fin, ipnat_t *, np, int, l, frinfo_t *, &frnat);
6970
6971 if (ipf_nat_nextaddr(fin, &np->in_ndst, &frnat.fin_daddr,
6972 &frnat.fin_daddr) == -1)
6973 return (-1);
6974 if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0xffffffff)) {
6975 dst_search = 0;
6976 if (np->in_stepnext == 2)
6977 np->in_stepnext = 3;
6978
6979 } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0)) {
6980 dst_search = 0;
6981 if (np->in_stepnext == 2)
6982 np->in_stepnext = 3;
6983
6984 } else if (np->in_ndstmsk == 0xffffffff) {
6985 dst_search = 0;
6986 if (np->in_stepnext == 2)
6987 np->in_stepnext = 3;
6988
6989 } else if (np->in_ndstmsk != 0xffffffff) {
6990 if ((np->in_stepnext == 2) && (changed == -1) &&
6991 (natl != NULL)) {
6992 changed = 2;
6993 np->in_stepnext++;
6994 np->in_dnip++;
6995 }
6996 }
6997
6998 if ((flags & IPN_TCPUDPICMP) != 0) {
6999 if (np->in_dpnext != 0)
7000 frnat.fin_data[1] = np->in_dpnext;
7001
7002 /*
7003 * Standard port translation. Select next port.
7004 */
7005 if ((flags & IPN_FIXEDDPORT) != 0) {
7006 np->in_stepnext = 0;
7007 } else if (np->in_stepnext == 3 && changed == -1) {
7008 np->in_dpnext++;
7009 np->in_stepnext++;
7010 changed = 3;
7011 if (np->in_dpnext > np->in_dpmax)
7012 np->in_dpnext = np->in_dpmin;
7013 }
7014 } else {
7015 if (np->in_stepnext == 3)
7016 np->in_stepnext = 0;
7017 }
7018
7019 /* TRACE (frnat) */
7020 DT1(ipf_nat_rewrite_3, frinfo_t *, &frnat);
7021
7022 /*
7023 * Here we do a lookup of the connection as seen from
7024 * the outside. If an IP# pair already exists, try
7025 * again. So if you have A->B becomes C->B, you can
7026 * also have D->E become C->E but not D->B causing
7027 * another C->B. Also take protocol and ports into
7028 * account when determining whether a pre-existing
7029 * NAT setup will cause an external conflict where
7030 * this is appropriate.
7031 *
7032 * fin_data[] is swapped around because we are doing a
7033 * lookup of the packet is if it were moving in the opposite
7034 * direction of the one we are working with now.
7035 */
7036 if (flags & IPN_TCPUDP) {
7037 swap = frnat.fin_data[0];
7038 frnat.fin_data[0] = frnat.fin_data[1];
7039 frnat.fin_data[1] = swap;
7040 }
7041 if (fin->fin_out == 1) {
7042 natl = ipf_nat_inlookup(&frnat,
7043 flags & ~(SI_WILDP|NAT_SEARCH),
7044 (u_int)frnat.fin_p,
7045 frnat.fin_dst, frnat.fin_src);
7046
7047 } else {
7048 natl = ipf_nat_outlookup(&frnat,
7049 flags & ~(SI_WILDP|NAT_SEARCH),
7050 (u_int)frnat.fin_p,
7051 frnat.fin_dst, frnat.fin_src);
7052 }
7053 if (flags & IPN_TCPUDP) {
7054 swap = frnat.fin_data[0];
7055 frnat.fin_data[0] = frnat.fin_data[1];
7056 frnat.fin_data[1] = swap;
7057 }
7058
7059 /* TRACE natl, in_stepnext, l */
7060 DT3(ipf_nat_rewrite_2, nat_t *, natl, ipnat_t *, np , int, l);
7061
7062 if ((natl != NULL) && (l > 8)) /* XXX 8 is arbitrary */
7063 return (-1);
7064
7065 np->in_stepnext &= 0x3;
7066
7067 l++;
7068 changed = -1;
7069 } while (natl != NULL);
7070
7071 nat->nat_osrcip = fin->fin_src;
7072 nat->nat_odstip = fin->fin_dst;
7073 nat->nat_nsrcip = frnat.fin_src;
7074 nat->nat_ndstip = frnat.fin_dst;
7075
7076 if ((flags & IPN_TCPUDP) != 0) {
7077 nat->nat_osport = htons(fin->fin_data[0]);
7078 nat->nat_odport = htons(fin->fin_data[1]);
7079 nat->nat_nsport = htons(frnat.fin_data[0]);
7080 nat->nat_ndport = htons(frnat.fin_data[1]);
7081 } else if ((flags & IPN_ICMPQUERY) != 0) {
7082 nat->nat_oicmpid = fin->fin_data[1];
7083 nat->nat_nicmpid = frnat.fin_data[1];
7084 }
7085
7086 return (0);
7087 }
7088
7089
7090 /* ------------------------------------------------------------------------ */
7091 /* Function: nat_newdivert */
7092 /* Returns: int - -1 == error, 0 == success */
7093 /* Parameters: fin(I) - pointer to packet information */
7094 /* nat(I) - pointer to NAT entry */
7095 /* ni(I) - pointer to structure with misc. information needed */
7096 /* to create new NAT entry. */
7097 /* Write Lock: ipf_nat */
7098 /* */
7099 /* Create a new NAT divert session as defined by the NAT rule. This is */
7100 /* somewhat different to other NAT session creation routines because we */
7101 /* do not iterate through either port numbers or IP addresses, searching */
7102 /* for a unique mapping, however, a complimentary duplicate check is made. */
7103 /* ------------------------------------------------------------------------ */
7104 static int
ipf_nat_newdivert(fr_info_t * fin,nat_t * nat,natinfo_t * nai)7105 ipf_nat_newdivert(fr_info_t *fin, nat_t *nat, natinfo_t *nai)
7106 {
7107 ipf_main_softc_t *softc = fin->fin_main_soft;
7108 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7109 fr_info_t frnat;
7110 ipnat_t *np;
7111 nat_t *natl;
7112 int p;
7113
7114 np = nai->nai_np;
7115 bcopy((char *)fin, (char *)&frnat, sizeof(*fin));
7116
7117 nat->nat_pr[0] = 0;
7118 nat->nat_osrcaddr = fin->fin_saddr;
7119 nat->nat_odstaddr = fin->fin_daddr;
7120 frnat.fin_saddr = htonl(np->in_snip);
7121 frnat.fin_daddr = htonl(np->in_dnip);
7122 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
7123 nat->nat_osport = htons(fin->fin_data[0]);
7124 nat->nat_odport = htons(fin->fin_data[1]);
7125 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
7126 nat->nat_oicmpid = fin->fin_data[1];
7127 }
7128
7129 if (np->in_redir & NAT_DIVERTUDP) {
7130 frnat.fin_data[0] = np->in_spnext;
7131 frnat.fin_data[1] = np->in_dpnext;
7132 frnat.fin_flx |= FI_TCPUDP;
7133 p = IPPROTO_UDP;
7134 } else {
7135 frnat.fin_flx &= ~FI_TCPUDP;
7136 p = IPPROTO_IPIP;
7137 }
7138
7139 if (fin->fin_out == 1) {
7140 natl = ipf_nat_inlookup(&frnat, 0, p,
7141 frnat.fin_dst, frnat.fin_src);
7142
7143 } else {
7144 natl = ipf_nat_outlookup(&frnat, 0, p,
7145 frnat.fin_dst, frnat.fin_src);
7146 }
7147
7148 if (natl != NULL) {
7149 NBUMPSIDED(fin->fin_out, ns_divert_exist);
7150 DT3(ns_divert_exist, fr_info_t *, fin, nat_t *, nat, natinfo_t, nai);
7151 return (-1);
7152 }
7153
7154 nat->nat_nsrcaddr = frnat.fin_saddr;
7155 nat->nat_ndstaddr = frnat.fin_daddr;
7156 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
7157 nat->nat_nsport = htons(frnat.fin_data[0]);
7158 nat->nat_ndport = htons(frnat.fin_data[1]);
7159 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
7160 nat->nat_nicmpid = frnat.fin_data[1];
7161 }
7162
7163 nat->nat_pr[fin->fin_out] = fin->fin_p;
7164 nat->nat_pr[1 - fin->fin_out] = p;
7165
7166 if (np->in_redir & NAT_REDIRECT)
7167 nat->nat_dir = NAT_DIVERTIN;
7168 else
7169 nat->nat_dir = NAT_DIVERTOUT;
7170
7171 return (0);
7172 }
7173
7174
7175 /* ------------------------------------------------------------------------ */
7176 /* Function: nat_builddivertmp */
7177 /* Returns: int - -1 == error, 0 == success */
7178 /* Parameters: softn(I) - pointer to NAT context structure */
7179 /* np(I) - pointer to a NAT rule */
7180 /* */
7181 /* For divert rules, a skeleton packet representing what will be prepended */
7182 /* to the real packet is created. Even though we don't have the full */
7183 /* packet here, a checksum is calculated that we update later when we */
7184 /* fill in the final details. At present a 0 checksum for UDP is being set */
7185 /* here because it is expected that divert will be used for localhost. */
7186 /* ------------------------------------------------------------------------ */
7187 static int
ipf_nat_builddivertmp(ipf_nat_softc_t * softn,ipnat_t * np)7188 ipf_nat_builddivertmp(ipf_nat_softc_t *softn, ipnat_t *np)
7189 {
7190 udphdr_t *uh;
7191 size_t len;
7192 ip_t *ip;
7193
7194 if ((np->in_redir & NAT_DIVERTUDP) != 0)
7195 len = sizeof(ip_t) + sizeof(udphdr_t);
7196 else
7197 len = sizeof(ip_t);
7198
7199 ALLOC_MB_T(np->in_divmp, len);
7200 if (np->in_divmp == NULL) {
7201 NBUMPD(ipf_nat_stats, ns_divert_build);
7202 return (-1);
7203 }
7204
7205 /*
7206 * First, the header to get the packet diverted to the new destination
7207 */
7208 ip = MTOD(np->in_divmp, ip_t *);
7209 IP_V_A(ip, 4);
7210 IP_HL_A(ip, 5);
7211 ip->ip_tos = 0;
7212 if ((np->in_redir & NAT_DIVERTUDP) != 0)
7213 ip->ip_p = IPPROTO_UDP;
7214 else
7215 ip->ip_p = IPPROTO_IPIP;
7216 ip->ip_ttl = 255;
7217 ip->ip_off = 0;
7218 ip->ip_sum = 0;
7219 ip->ip_len = htons(len);
7220 ip->ip_id = 0;
7221 ip->ip_src.s_addr = htonl(np->in_snip);
7222 ip->ip_dst.s_addr = htonl(np->in_dnip);
7223 ip->ip_sum = ipf_cksum((u_short *)ip, sizeof(*ip));
7224
7225 if (np->in_redir & NAT_DIVERTUDP) {
7226 uh = (udphdr_t *)(ip + 1);
7227 uh->uh_sum = 0;
7228 uh->uh_ulen = 8;
7229 uh->uh_sport = htons(np->in_spnext);
7230 uh->uh_dport = htons(np->in_dpnext);
7231 }
7232
7233 return (0);
7234 }
7235
7236
7237 #define MINDECAP (sizeof(ip_t) + sizeof(udphdr_t) + sizeof(ip_t))
7238
7239 /* ------------------------------------------------------------------------ */
7240 /* Function: nat_decap */
7241 /* Returns: int - -1 == error, 0 == success */
7242 /* Parameters: fin(I) - pointer to packet information */
7243 /* nat(I) - pointer to current NAT session */
7244 /* */
7245 /* This function is responsible for undoing a packet's encapsulation in the */
7246 /* reverse of an encap/divert rule. After removing the outer encapsulation */
7247 /* it is necessary to call ipf_makefrip() again so that the contents of 'fin'*/
7248 /* match the "new" packet as it may still be used by IPFilter elsewhere. */
7249 /* We use "dir" here as the basis for some of the expectations about the */
7250 /* outer header. If we return an error, the goal is to leave the original */
7251 /* packet information undisturbed - this falls short at the end where we'd */
7252 /* need to back a backup copy of "fin" - expensive. */
7253 /* ------------------------------------------------------------------------ */
7254 static int
ipf_nat_decap(fr_info_t * fin,nat_t * nat)7255 ipf_nat_decap(fr_info_t *fin, nat_t *nat)
7256 {
7257 ipf_main_softc_t *softc = fin->fin_main_soft;
7258 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7259 char *hdr;
7260 int hlen;
7261 int skip;
7262 mb_t *m;
7263
7264 if ((fin->fin_flx & FI_ICMPERR) != 0) {
7265 /*
7266 * ICMP packets don't get decapsulated, instead what we need
7267 * to do is change the ICMP reply from including (in the data
7268 * portion for errors) the encapsulated packet that we sent
7269 * out to something that resembles the original packet prior
7270 * to encapsulation. This isn't done here - all we're doing
7271 * here is changing the outer address to ensure that it gets
7272 * targetted back to the correct system.
7273 */
7274
7275 if (nat->nat_dir & NAT_OUTBOUND) {
7276 u_32_t sum1, sum2, sumd;
7277
7278 sum1 = ntohl(fin->fin_daddr);
7279 sum2 = ntohl(nat->nat_osrcaddr);
7280 CALC_SUMD(sum1, sum2, sumd);
7281 fin->fin_ip->ip_dst = nat->nat_osrcip;
7282 fin->fin_daddr = nat->nat_osrcaddr;
7283 #if !defined(_KERNEL) || SOLARIS
7284 ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, sumd, 0);
7285 #endif
7286 }
7287 return (0);
7288 }
7289
7290 m = fin->fin_m;
7291 skip = fin->fin_hlen;
7292
7293 switch (nat->nat_dir)
7294 {
7295 case NAT_DIVERTIN :
7296 case NAT_DIVERTOUT :
7297 if (fin->fin_plen < MINDECAP)
7298 return (-1);
7299 skip += sizeof(udphdr_t);
7300 break;
7301
7302 case NAT_ENCAPIN :
7303 case NAT_ENCAPOUT :
7304 if (fin->fin_plen < (skip + sizeof(ip_t)))
7305 return (-1);
7306 break;
7307 default :
7308 return (-1);
7309 /* NOTREACHED */
7310 }
7311
7312 /*
7313 * The aim here is to keep the original packet details in "fin" for
7314 * as long as possible so that returning with an error is for the
7315 * original packet and there is little undoing work to do.
7316 */
7317 if (M_LEN(m) < skip + sizeof(ip_t)) {
7318 if (ipf_pr_pullup(fin, skip + sizeof(ip_t)) == -1)
7319 return (-1);
7320 }
7321
7322 hdr = MTOD(fin->fin_m, char *);
7323 fin->fin_ip = (ip_t *)(hdr + skip);
7324 hlen = IP_HL(fin->fin_ip) << 2;
7325
7326 if (ipf_pr_pullup(fin, skip + hlen) == -1) {
7327 NBUMPSIDED(fin->fin_out, ns_decap_pullup);
7328 return (-1);
7329 }
7330
7331 fin->fin_hlen = hlen;
7332 fin->fin_dlen -= skip;
7333 fin->fin_plen -= skip;
7334 fin->fin_ipoff += skip;
7335
7336 if (ipf_makefrip(hlen, (ip_t *)hdr, fin) == -1) {
7337 NBUMPSIDED(fin->fin_out, ns_decap_bad);
7338 return (-1);
7339 }
7340
7341 return (skip);
7342 }
7343
7344
7345 /* ------------------------------------------------------------------------ */
7346 /* Function: nat_nextaddr */
7347 /* Returns: int - -1 == bad input (no new address), */
7348 /* 0 == success and dst has new address */
7349 /* Parameters: fin(I) - pointer to packet information */
7350 /* na(I) - how to generate new address */
7351 /* old(I) - original address being replaced */
7352 /* dst(O) - where to put the new address */
7353 /* Write Lock: ipf_nat */
7354 /* */
7355 /* This function uses the contents of the "na" structure, in combination */
7356 /* with "old" to produce a new address to store in "dst". Not all of the */
7357 /* possible uses of "na" will result in a new address. */
7358 /* ------------------------------------------------------------------------ */
7359 static int
ipf_nat_nextaddr(fr_info_t * fin,nat_addr_t * na,u_32_t * old,u_32_t * dst)7360 ipf_nat_nextaddr(fr_info_t *fin, nat_addr_t *na, u_32_t *old, u_32_t *dst)
7361 {
7362 ipf_main_softc_t *softc = fin->fin_main_soft;
7363 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7364 u_32_t amin, amax, new;
7365 i6addr_t newip;
7366 int error;
7367
7368 new = 0;
7369 amin = na->na_addr[0].in4.s_addr;
7370
7371 switch (na->na_atype)
7372 {
7373 case FRI_RANGE :
7374 amax = na->na_addr[1].in4.s_addr;
7375 break;
7376
7377 case FRI_NETMASKED :
7378 case FRI_DYNAMIC :
7379 case FRI_NORMAL :
7380 /*
7381 * Compute the maximum address by adding the inverse of the
7382 * netmask to the minimum address.
7383 */
7384 amax = ~na->na_addr[1].in4.s_addr;
7385 amax |= amin;
7386 break;
7387
7388 case FRI_LOOKUP :
7389 break;
7390
7391 case FRI_BROADCAST :
7392 case FRI_PEERADDR :
7393 case FRI_NETWORK :
7394 default :
7395 DT4(ns_na_atype, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7396 return (-1);
7397 }
7398
7399 error = -1;
7400
7401 if (na->na_atype == FRI_LOOKUP) {
7402 if (na->na_type == IPLT_DSTLIST) {
7403 error = ipf_dstlist_select_node(fin, na->na_ptr, dst,
7404 NULL);
7405 } else {
7406 NBUMPSIDE(fin->fin_out, ns_badnextaddr);
7407 DT4(ns_badnextaddr_1, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7408 }
7409
7410 } else if (na->na_atype == IPLT_NONE) {
7411 /*
7412 * 0/0 as the new address means leave it alone.
7413 */
7414 if (na->na_addr[0].in4.s_addr == 0 &&
7415 na->na_addr[1].in4.s_addr == 0) {
7416 new = *old;
7417
7418 /*
7419 * 0/32 means get the interface's address
7420 */
7421 } else if (na->na_addr[0].in4.s_addr == 0 &&
7422 na->na_addr[1].in4.s_addr == 0xffffffff) {
7423 if (ipf_ifpaddr(softc, 4, na->na_atype,
7424 fin->fin_ifp, &newip, NULL) == -1) {
7425 NBUMPSIDED(fin->fin_out, ns_ifpaddrfail);
7426 DT4(ns_ifpaddrfail, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7427 return (-1);
7428 }
7429 new = newip.in4.s_addr;
7430 } else {
7431 new = htonl(na->na_nextip);
7432 }
7433 *dst = new;
7434 error = 0;
7435
7436 } else {
7437 NBUMPSIDE(fin->fin_out, ns_badnextaddr);
7438 DT4(ns_badnextaddr_2, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7439 }
7440
7441 return (error);
7442 }
7443
7444
7445 /* ------------------------------------------------------------------------ */
7446 /* Function: nat_nextaddrinit */
7447 /* Returns: int - 0 == success, else error number */
7448 /* Parameters: softc(I) - pointer to soft context main structure */
7449 /* na(I) - NAT address information for generating new addr*/
7450 /* initial(I) - flag indicating if it is the first call for */
7451 /* this "na" structure. */
7452 /* ifp(I) - network interface to derive address */
7453 /* information from. */
7454 /* */
7455 /* This function is expected to be called in two scenarious: when a new NAT */
7456 /* rule is loaded into the kernel and when the list of NAT rules is sync'd */
7457 /* up with the valid network interfaces (possibly due to them changing.) */
7458 /* To distinguish between these, the "initial" parameter is used. If it is */
7459 /* 1 then this indicates the rule has just been reloaded and 0 for when we */
7460 /* are updating information. This difference is important because in */
7461 /* instances where we are not updating address information associated with */
7462 /* a network interface, we don't want to disturb what the "next" address to */
7463 /* come out of ipf_nat_nextaddr() will be. */
7464 /* ------------------------------------------------------------------------ */
7465 static int
ipf_nat_nextaddrinit(ipf_main_softc_t * softc,char * base,nat_addr_t * na,int initial,void * ifp)7466 ipf_nat_nextaddrinit(ipf_main_softc_t *softc, char *base, nat_addr_t *na,
7467 int initial, void *ifp)
7468 {
7469
7470 switch (na->na_atype)
7471 {
7472 case FRI_LOOKUP :
7473 if (na->na_subtype == 0) {
7474 na->na_ptr = ipf_lookup_res_num(softc, IPL_LOGNAT,
7475 na->na_type,
7476 na->na_num,
7477 &na->na_func);
7478 } else if (na->na_subtype == 1) {
7479 na->na_ptr = ipf_lookup_res_name(softc, IPL_LOGNAT,
7480 na->na_type,
7481 base + na->na_num,
7482 &na->na_func);
7483 }
7484 if (na->na_func == NULL) {
7485 IPFERROR(60060);
7486 return (ESRCH);
7487 }
7488 if (na->na_ptr == NULL) {
7489 IPFERROR(60056);
7490 return (ESRCH);
7491 }
7492 break;
7493
7494 case FRI_DYNAMIC :
7495 case FRI_BROADCAST :
7496 case FRI_NETWORK :
7497 case FRI_NETMASKED :
7498 case FRI_PEERADDR :
7499 if (ifp != NULL)
7500 (void )ipf_ifpaddr(softc, 4, na->na_atype, ifp,
7501 &na->na_addr[0], &na->na_addr[1]);
7502 break;
7503
7504 case FRI_SPLIT :
7505 case FRI_RANGE :
7506 if (initial)
7507 na->na_nextip = ntohl(na->na_addr[0].in4.s_addr);
7508 break;
7509
7510 case FRI_NONE :
7511 na->na_addr[0].in4.s_addr &= na->na_addr[1].in4.s_addr;
7512 return (0);
7513
7514 case FRI_NORMAL :
7515 na->na_addr[0].in4.s_addr &= na->na_addr[1].in4.s_addr;
7516 break;
7517
7518 default :
7519 IPFERROR(60054);
7520 return (EINVAL);
7521 }
7522
7523 if (initial && (na->na_atype == FRI_NORMAL)) {
7524 if (na->na_addr[0].in4.s_addr == 0) {
7525 if ((na->na_addr[1].in4.s_addr == 0xffffffff) ||
7526 (na->na_addr[1].in4.s_addr == 0)) {
7527 return (0);
7528 }
7529 }
7530
7531 if (na->na_addr[1].in4.s_addr == 0xffffffff) {
7532 na->na_nextip = ntohl(na->na_addr[0].in4.s_addr);
7533 } else {
7534 na->na_nextip = ntohl(na->na_addr[0].in4.s_addr) + 1;
7535 }
7536 }
7537
7538 return (0);
7539 }
7540
7541
7542 /* ------------------------------------------------------------------------ */
7543 /* Function: ipf_nat_matchflush */
7544 /* Returns: int - -1 == error, 0 == success */
7545 /* Parameters: softc(I) - pointer to soft context main structure */
7546 /* softn(I) - pointer to NAT context structure */
7547 /* nat(I) - pointer to current NAT session */
7548 /* */
7549 /* ------------------------------------------------------------------------ */
7550 static int
ipf_nat_matchflush(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,caddr_t data)7551 ipf_nat_matchflush(ipf_main_softc_t *softc, ipf_nat_softc_t *softn,
7552 caddr_t data)
7553 {
7554 int *array, flushed, error;
7555 nat_t *nat, *natnext;
7556 ipfobj_t obj;
7557
7558 error = ipf_matcharray_load(softc, data, &obj, &array);
7559 if (error != 0)
7560 return (error);
7561
7562 flushed = 0;
7563
7564 for (nat = softn->ipf_nat_instances; nat != NULL; nat = natnext) {
7565 natnext = nat->nat_next;
7566 if (ipf_nat_matcharray(nat, array, softc->ipf_ticks) == 0) {
7567 ipf_nat_delete(softc, nat, NL_FLUSH);
7568 flushed++;
7569 }
7570 }
7571
7572 obj.ipfo_retval = flushed;
7573 error = BCOPYOUT(&obj, data, sizeof(obj));
7574
7575 KFREES(array, array[0] * sizeof(*array));
7576
7577 return (error);
7578 }
7579
7580
7581 /* ------------------------------------------------------------------------ */
7582 /* Function: ipf_nat_matcharray */
7583 /* Returns: int - -1 == error, 0 == success */
7584 /* Parameters: fin(I) - pointer to packet information */
7585 /* nat(I) - pointer to current NAT session */
7586 /* */
7587 /* ------------------------------------------------------------------------ */
7588 static int
ipf_nat_matcharray(nat_t * nat,int * array,u_long ticks)7589 ipf_nat_matcharray(nat_t *nat, int *array, u_long ticks)
7590 {
7591 int i, n, *x, e, p;
7592
7593 e = 0;
7594 n = array[0];
7595 x = array + 1;
7596
7597 for (; n > 0; x += 3 + x[2]) {
7598 if (x[0] == IPF_EXP_END)
7599 break;
7600 e = 0;
7601
7602 n -= x[2] + 3;
7603 if (n < 0)
7604 break;
7605
7606 p = x[0] >> 16;
7607 if (p != 0 && p != nat->nat_pr[1])
7608 break;
7609
7610 switch (x[0])
7611 {
7612 case IPF_EXP_IP_PR :
7613 for (i = 0; !e && i < x[2]; i++) {
7614 e |= (nat->nat_pr[1] == x[i + 3]);
7615 }
7616 break;
7617
7618 case IPF_EXP_IP_SRCADDR :
7619 if (nat->nat_v[0] == 4) {
7620 for (i = 0; !e && i < x[2]; i++) {
7621 e |= ((nat->nat_osrcaddr & x[i + 4]) ==
7622 x[i + 3]);
7623 }
7624 }
7625 if (nat->nat_v[1] == 4) {
7626 for (i = 0; !e && i < x[2]; i++) {
7627 e |= ((nat->nat_nsrcaddr & x[i + 4]) ==
7628 x[i + 3]);
7629 }
7630 }
7631 break;
7632
7633 case IPF_EXP_IP_DSTADDR :
7634 if (nat->nat_v[0] == 4) {
7635 for (i = 0; !e && i < x[2]; i++) {
7636 e |= ((nat->nat_odstaddr & x[i + 4]) ==
7637 x[i + 3]);
7638 }
7639 }
7640 if (nat->nat_v[1] == 4) {
7641 for (i = 0; !e && i < x[2]; i++) {
7642 e |= ((nat->nat_ndstaddr & x[i + 4]) ==
7643 x[i + 3]);
7644 }
7645 }
7646 break;
7647
7648 case IPF_EXP_IP_ADDR :
7649 for (i = 0; !e && i < x[2]; i++) {
7650 if (nat->nat_v[0] == 4) {
7651 e |= ((nat->nat_osrcaddr & x[i + 4]) ==
7652 x[i + 3]);
7653 }
7654 if (nat->nat_v[1] == 4) {
7655 e |= ((nat->nat_nsrcaddr & x[i + 4]) ==
7656 x[i + 3]);
7657 }
7658 if (nat->nat_v[0] == 4) {
7659 e |= ((nat->nat_odstaddr & x[i + 4]) ==
7660 x[i + 3]);
7661 }
7662 if (nat->nat_v[1] == 4) {
7663 e |= ((nat->nat_ndstaddr & x[i + 4]) ==
7664 x[i + 3]);
7665 }
7666 }
7667 break;
7668
7669 #ifdef USE_INET6
7670 case IPF_EXP_IP6_SRCADDR :
7671 if (nat->nat_v[0] == 6) {
7672 for (i = 0; !e && i < x[3]; i++) {
7673 e |= IP6_MASKEQ(&nat->nat_osrc6,
7674 x + i + 7, x + i + 3);
7675 }
7676 }
7677 if (nat->nat_v[1] == 6) {
7678 for (i = 0; !e && i < x[3]; i++) {
7679 e |= IP6_MASKEQ(&nat->nat_nsrc6,
7680 x + i + 7, x + i + 3);
7681 }
7682 }
7683 break;
7684
7685 case IPF_EXP_IP6_DSTADDR :
7686 if (nat->nat_v[0] == 6) {
7687 for (i = 0; !e && i < x[3]; i++) {
7688 e |= IP6_MASKEQ(&nat->nat_odst6,
7689 x + i + 7,
7690 x + i + 3);
7691 }
7692 }
7693 if (nat->nat_v[1] == 6) {
7694 for (i = 0; !e && i < x[3]; i++) {
7695 e |= IP6_MASKEQ(&nat->nat_ndst6,
7696 x + i + 7,
7697 x + i + 3);
7698 }
7699 }
7700 break;
7701
7702 case IPF_EXP_IP6_ADDR :
7703 for (i = 0; !e && i < x[3]; i++) {
7704 if (nat->nat_v[0] == 6) {
7705 e |= IP6_MASKEQ(&nat->nat_osrc6,
7706 x + i + 7,
7707 x + i + 3);
7708 }
7709 if (nat->nat_v[0] == 6) {
7710 e |= IP6_MASKEQ(&nat->nat_odst6,
7711 x + i + 7,
7712 x + i + 3);
7713 }
7714 if (nat->nat_v[1] == 6) {
7715 e |= IP6_MASKEQ(&nat->nat_nsrc6,
7716 x + i + 7,
7717 x + i + 3);
7718 }
7719 if (nat->nat_v[1] == 6) {
7720 e |= IP6_MASKEQ(&nat->nat_ndst6,
7721 x + i + 7,
7722 x + i + 3);
7723 }
7724 }
7725 break;
7726 #endif
7727
7728 case IPF_EXP_UDP_PORT :
7729 case IPF_EXP_TCP_PORT :
7730 for (i = 0; !e && i < x[2]; i++) {
7731 e |= (nat->nat_nsport == x[i + 3]) ||
7732 (nat->nat_ndport == x[i + 3]);
7733 }
7734 break;
7735
7736 case IPF_EXP_UDP_SPORT :
7737 case IPF_EXP_TCP_SPORT :
7738 for (i = 0; !e && i < x[2]; i++) {
7739 e |= (nat->nat_nsport == x[i + 3]);
7740 }
7741 break;
7742
7743 case IPF_EXP_UDP_DPORT :
7744 case IPF_EXP_TCP_DPORT :
7745 for (i = 0; !e && i < x[2]; i++) {
7746 e |= (nat->nat_ndport == x[i + 3]);
7747 }
7748 break;
7749
7750 case IPF_EXP_TCP_STATE :
7751 for (i = 0; !e && i < x[2]; i++) {
7752 e |= (nat->nat_tcpstate[0] == x[i + 3]) ||
7753 (nat->nat_tcpstate[1] == x[i + 3]);
7754 }
7755 break;
7756
7757 case IPF_EXP_IDLE_GT :
7758 e |= (ticks - nat->nat_touched > x[3]);
7759 break;
7760 }
7761 e ^= x[1];
7762
7763 if (!e)
7764 break;
7765 }
7766
7767 return (e);
7768 }
7769
7770
7771 /* ------------------------------------------------------------------------ */
7772 /* Function: ipf_nat_gettable */
7773 /* Returns: int - 0 = success, else error */
7774 /* Parameters: softc(I) - pointer to soft context main structure */
7775 /* softn(I) - pointer to NAT context structure */
7776 /* data(I) - pointer to ioctl data */
7777 /* */
7778 /* This function handles ioctl requests for tables of nat information. */
7779 /* At present the only table it deals with is the hash bucket statistics. */
7780 /* ------------------------------------------------------------------------ */
7781 static int
ipf_nat_gettable(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,char * data)7782 ipf_nat_gettable(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, char *data)
7783 {
7784 ipftable_t table;
7785 int error;
7786
7787 error = ipf_inobj(softc, data, NULL, &table, IPFOBJ_GTABLE);
7788 if (error != 0)
7789 return (error);
7790
7791 switch (table.ita_type)
7792 {
7793 case IPFTABLE_BUCKETS_NATIN :
7794 error = COPYOUT(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
7795 table.ita_table,
7796 softn->ipf_nat_table_sz * sizeof(u_int));
7797 break;
7798
7799 case IPFTABLE_BUCKETS_NATOUT :
7800 error = COPYOUT(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
7801 table.ita_table,
7802 softn->ipf_nat_table_sz * sizeof(u_int));
7803 break;
7804
7805 default :
7806 IPFERROR(60058);
7807 return (EINVAL);
7808 }
7809
7810 if (error != 0) {
7811 IPFERROR(60059);
7812 error = EFAULT;
7813 }
7814 return (error);
7815 }
7816
7817
7818 /* ------------------------------------------------------------------------ */
7819 /* Function: ipf_nat_settimeout */
7820 /* Returns: int - 0 = success, else failure */
7821 /* Parameters: softc(I) - pointer to soft context main structure */
7822 /* t(I) - pointer to tunable */
7823 /* p(I) - pointer to new tuning data */
7824 /* */
7825 /* Apply the timeout change to the NAT timeout queues. */
7826 /* ------------------------------------------------------------------------ */
7827 int
ipf_nat_settimeout(struct ipf_main_softc_s * softc,ipftuneable_t * t,ipftuneval_t * p)7828 ipf_nat_settimeout(struct ipf_main_softc_s *softc, ipftuneable_t *t,
7829 ipftuneval_t *p)
7830 {
7831 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7832
7833 if (!strncmp(t->ipft_name, "tcp_", 4))
7834 return (ipf_settimeout_tcp(t, p, softn->ipf_nat_tcptq));
7835
7836 if (!strcmp(t->ipft_name, "udp_timeout")) {
7837 ipf_apply_timeout(&softn->ipf_nat_udptq, p->ipftu_int);
7838 } else if (!strcmp(t->ipft_name, "udp_ack_timeout")) {
7839 ipf_apply_timeout(&softn->ipf_nat_udpacktq, p->ipftu_int);
7840 } else if (!strcmp(t->ipft_name, "icmp_timeout")) {
7841 ipf_apply_timeout(&softn->ipf_nat_icmptq, p->ipftu_int);
7842 } else if (!strcmp(t->ipft_name, "icmp_ack_timeout")) {
7843 ipf_apply_timeout(&softn->ipf_nat_icmpacktq, p->ipftu_int);
7844 } else if (!strcmp(t->ipft_name, "ip_timeout")) {
7845 ipf_apply_timeout(&softn->ipf_nat_iptq, p->ipftu_int);
7846 } else {
7847 IPFERROR(60062);
7848 return (ESRCH);
7849 }
7850 return (0);
7851 }
7852
7853
7854 /* ------------------------------------------------------------------------ */
7855 /* Function: ipf_nat_rehash */
7856 /* Returns: int - 0 = success, else failure */
7857 /* Parameters: softc(I) - pointer to soft context main structure */
7858 /* t(I) - pointer to tunable */
7859 /* p(I) - pointer to new tuning data */
7860 /* */
7861 /* To change the size of the basic NAT table, we need to first allocate the */
7862 /* new tables (lest it fails and we've got nowhere to store all of the NAT */
7863 /* sessions currently active) and then walk through the entire list and */
7864 /* insert them into the table. There are two tables here: an inbound one */
7865 /* and an outbound one. Each NAT entry goes into each table once. */
7866 /* ------------------------------------------------------------------------ */
7867 int
ipf_nat_rehash(ipf_main_softc_t * softc,ipftuneable_t * t,ipftuneval_t * p)7868 ipf_nat_rehash(ipf_main_softc_t *softc, ipftuneable_t *t, ipftuneval_t *p)
7869 {
7870 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7871 nat_t **newtab[2], *nat, **natp;
7872 u_int *bucketlens[2];
7873 u_int maxbucket;
7874 u_int newsize;
7875 int error;
7876 u_int hv;
7877 int i;
7878
7879 newsize = p->ipftu_int;
7880 /*
7881 * In case there is nothing to do...
7882 */
7883 if (newsize == softn->ipf_nat_table_sz)
7884 return (0);
7885
7886 newtab[0] = NULL;
7887 newtab[1] = NULL;
7888 bucketlens[0] = NULL;
7889 bucketlens[1] = NULL;
7890 /*
7891 * 4 tables depend on the NAT table size: the inbound looking table,
7892 * the outbound lookup table and the hash chain length for each.
7893 */
7894 KMALLOCS(newtab[0], nat_t **, newsize * sizeof(nat_t *));
7895 if (newtab[0] == NULL) {
7896 error = 60063;
7897 goto badrehash;
7898 }
7899
7900 KMALLOCS(newtab[1], nat_t **, newsize * sizeof(nat_t *));
7901 if (newtab[1] == NULL) {
7902 error = 60064;
7903 goto badrehash;
7904 }
7905
7906 KMALLOCS(bucketlens[0], u_int *, newsize * sizeof(u_int));
7907 if (bucketlens[0] == NULL) {
7908 error = 60065;
7909 goto badrehash;
7910 }
7911
7912 KMALLOCS(bucketlens[1], u_int *, newsize * sizeof(u_int));
7913 if (bucketlens[1] == NULL) {
7914 error = 60066;
7915 goto badrehash;
7916 }
7917
7918 /*
7919 * Recalculate the maximum length based on the new size.
7920 */
7921 for (maxbucket = 0, i = newsize; i > 0; i >>= 1)
7922 maxbucket++;
7923 maxbucket *= 2;
7924
7925 bzero((char *)newtab[0], newsize * sizeof(nat_t *));
7926 bzero((char *)newtab[1], newsize * sizeof(nat_t *));
7927 bzero((char *)bucketlens[0], newsize * sizeof(u_int));
7928 bzero((char *)bucketlens[1], newsize * sizeof(u_int));
7929
7930 WRITE_ENTER(&softc->ipf_nat);
7931
7932 if (softn->ipf_nat_table[0] != NULL) {
7933 KFREES(softn->ipf_nat_table[0],
7934 softn->ipf_nat_table_sz *
7935 sizeof(*softn->ipf_nat_table[0]));
7936 }
7937 softn->ipf_nat_table[0] = newtab[0];
7938
7939 if (softn->ipf_nat_table[1] != NULL) {
7940 KFREES(softn->ipf_nat_table[1],
7941 softn->ipf_nat_table_sz *
7942 sizeof(*softn->ipf_nat_table[1]));
7943 }
7944 softn->ipf_nat_table[1] = newtab[1];
7945
7946 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen != NULL) {
7947 KFREES(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
7948 softn->ipf_nat_table_sz * sizeof(u_int));
7949 }
7950 softn->ipf_nat_stats.ns_side[0].ns_bucketlen = bucketlens[0];
7951
7952 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen != NULL) {
7953 KFREES(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
7954 softn->ipf_nat_table_sz * sizeof(u_int));
7955 }
7956 softn->ipf_nat_stats.ns_side[1].ns_bucketlen = bucketlens[1];
7957
7958 #ifdef USE_INET6
7959 if (softn->ipf_nat_stats.ns_side6[0].ns_bucketlen != NULL) {
7960 KFREES(softn->ipf_nat_stats.ns_side6[0].ns_bucketlen,
7961 softn->ipf_nat_table_sz * sizeof(u_int));
7962 }
7963 softn->ipf_nat_stats.ns_side6[0].ns_bucketlen = bucketlens[0];
7964
7965 if (softn->ipf_nat_stats.ns_side6[1].ns_bucketlen != NULL) {
7966 KFREES(softn->ipf_nat_stats.ns_side6[1].ns_bucketlen,
7967 softn->ipf_nat_table_sz * sizeof(u_int));
7968 }
7969 softn->ipf_nat_stats.ns_side6[1].ns_bucketlen = bucketlens[1];
7970 #endif
7971
7972 softn->ipf_nat_maxbucket = maxbucket;
7973 softn->ipf_nat_table_sz = newsize;
7974 /*
7975 * Walk through the entire list of NAT table entries and put them
7976 * in the new NAT table, somewhere. Because we have a new table,
7977 * we need to restart the counter of how many chains are in use.
7978 */
7979 softn->ipf_nat_stats.ns_side[0].ns_inuse = 0;
7980 softn->ipf_nat_stats.ns_side[1].ns_inuse = 0;
7981 #ifdef USE_INET6
7982 softn->ipf_nat_stats.ns_side6[0].ns_inuse = 0;
7983 softn->ipf_nat_stats.ns_side6[1].ns_inuse = 0;
7984 #endif
7985
7986 for (nat = softn->ipf_nat_instances; nat != NULL; nat = nat->nat_next) {
7987 nat->nat_hnext[0] = NULL;
7988 nat->nat_phnext[0] = NULL;
7989 hv = nat->nat_hv[0] % softn->ipf_nat_table_sz;
7990
7991 natp = &softn->ipf_nat_table[0][hv];
7992 if (*natp) {
7993 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
7994 } else {
7995 NBUMPSIDE(0, ns_inuse);
7996 }
7997 nat->nat_phnext[0] = natp;
7998 nat->nat_hnext[0] = *natp;
7999 *natp = nat;
8000 NBUMPSIDE(0, ns_bucketlen[hv]);
8001
8002 nat->nat_hnext[1] = NULL;
8003 nat->nat_phnext[1] = NULL;
8004 hv = nat->nat_hv[1] % softn->ipf_nat_table_sz;
8005
8006 natp = &softn->ipf_nat_table[1][hv];
8007 if (*natp) {
8008 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
8009 } else {
8010 NBUMPSIDE(1, ns_inuse);
8011 }
8012 nat->nat_phnext[1] = natp;
8013 nat->nat_hnext[1] = *natp;
8014 *natp = nat;
8015 NBUMPSIDE(1, ns_bucketlen[hv]);
8016 }
8017 RWLOCK_EXIT(&softc->ipf_nat);
8018
8019 return (0);
8020
8021 badrehash:
8022 if (bucketlens[1] != NULL) {
8023 KFREES(bucketlens[0], newsize * sizeof(u_int));
8024 }
8025 if (bucketlens[0] != NULL) {
8026 KFREES(bucketlens[0], newsize * sizeof(u_int));
8027 }
8028 if (newtab[0] != NULL) {
8029 KFREES(newtab[0], newsize * sizeof(nat_t *));
8030 }
8031 if (newtab[1] != NULL) {
8032 KFREES(newtab[1], newsize * sizeof(nat_t *));
8033 }
8034 IPFERROR(error);
8035 return (ENOMEM);
8036 }
8037
8038
8039 /* ------------------------------------------------------------------------ */
8040 /* Function: ipf_nat_rehash_rules */
8041 /* Returns: int - 0 = success, else failure */
8042 /* Parameters: softc(I) - pointer to soft context main structure */
8043 /* t(I) - pointer to tunable */
8044 /* p(I) - pointer to new tuning data */
8045 /* */
8046 /* All of the NAT rules hang off of a hash table that is searched with a */
8047 /* hash on address after the netmask is applied. There is a different table*/
8048 /* for both inbound rules (rdr) and outbound (map.) The resizing will only */
8049 /* affect one of these two tables. */
8050 /* ------------------------------------------------------------------------ */
8051 int
ipf_nat_rehash_rules(ipf_main_softc_t * softc,ipftuneable_t * t,ipftuneval_t * p)8052 ipf_nat_rehash_rules(ipf_main_softc_t *softc, ipftuneable_t *t,
8053 ipftuneval_t *p)
8054 {
8055 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8056 ipnat_t **newtab, *np, ***old, **npp;
8057 u_int newsize;
8058 u_int mask;
8059 u_int hv;
8060
8061 newsize = p->ipftu_int;
8062 /*
8063 * In case there is nothing to do...
8064 */
8065 if (newsize == *t->ipft_pint)
8066 return (0);
8067
8068 /*
8069 * All inbound rules have the NAT_REDIRECT bit set in in_redir and
8070 * all outbound rules have either NAT_MAP or MAT_MAPBLK set.
8071 * This if statement allows for some more generic code to be below,
8072 * rather than two huge gobs of code that almost do the same thing.
8073 */
8074 if (t->ipft_pint == &softn->ipf_nat_rdrrules_sz) {
8075 old = &softn->ipf_nat_rdr_rules;
8076 mask = NAT_REDIRECT;
8077 } else {
8078 old = &softn->ipf_nat_map_rules;
8079 mask = NAT_MAP|NAT_MAPBLK;
8080 }
8081
8082 KMALLOCS(newtab, ipnat_t **, newsize * sizeof(ipnat_t *));
8083 if (newtab == NULL) {
8084 IPFERROR(60067);
8085 return (ENOMEM);
8086 }
8087
8088 bzero((char *)newtab, newsize * sizeof(ipnat_t *));
8089
8090 WRITE_ENTER(&softc->ipf_nat);
8091
8092 if (*old != NULL) {
8093 KFREES(*old, *t->ipft_pint * sizeof(ipnat_t **));
8094 }
8095 *old = newtab;
8096 *t->ipft_pint = newsize;
8097
8098 for (np = softn->ipf_nat_list; np != NULL; np = np->in_next) {
8099 if ((np->in_redir & mask) == 0)
8100 continue;
8101
8102 if (np->in_redir & NAT_REDIRECT) {
8103 np->in_rnext = NULL;
8104 hv = np->in_hv[0] % newsize;
8105 for (npp = newtab + hv; *npp != NULL; )
8106 npp = &(*npp)->in_rnext;
8107 np->in_prnext = npp;
8108 *npp = np;
8109 }
8110 if (np->in_redir & NAT_MAP) {
8111 np->in_mnext = NULL;
8112 hv = np->in_hv[1] % newsize;
8113 for (npp = newtab + hv; *npp != NULL; )
8114 npp = &(*npp)->in_mnext;
8115 np->in_pmnext = npp;
8116 *npp = np;
8117 }
8118
8119 }
8120 RWLOCK_EXIT(&softc->ipf_nat);
8121
8122 return (0);
8123 }
8124
8125
8126 /* ------------------------------------------------------------------------ */
8127 /* Function: ipf_nat_hostmap_rehash */
8128 /* Returns: int - 0 = success, else failure */
8129 /* Parameters: softc(I) - pointer to soft context main structure */
8130 /* t(I) - pointer to tunable */
8131 /* p(I) - pointer to new tuning data */
8132 /* */
8133 /* Allocate and populate a new hash table that will contain a reference to */
8134 /* all of the active IP# translations currently in place. */
8135 /* ------------------------------------------------------------------------ */
8136 int
ipf_nat_hostmap_rehash(ipf_main_softc_t * softc,ipftuneable_t * t,ipftuneval_t * p)8137 ipf_nat_hostmap_rehash(ipf_main_softc_t *softc, ipftuneable_t *t,
8138 ipftuneval_t *p)
8139 {
8140 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8141 hostmap_t *hm, **newtab;
8142 u_int newsize;
8143 u_int hv;
8144
8145 newsize = p->ipftu_int;
8146 /*
8147 * In case there is nothing to do...
8148 */
8149 if (newsize == *t->ipft_pint)
8150 return (0);
8151
8152 KMALLOCS(newtab, hostmap_t **, newsize * sizeof(hostmap_t *));
8153 if (newtab == NULL) {
8154 IPFERROR(60068);
8155 return (ENOMEM);
8156 }
8157
8158 bzero((char *)newtab, newsize * sizeof(hostmap_t *));
8159
8160 WRITE_ENTER(&softc->ipf_nat);
8161 if (softn->ipf_hm_maptable != NULL) {
8162 KFREES(softn->ipf_hm_maptable,
8163 softn->ipf_nat_hostmap_sz * sizeof(hostmap_t *));
8164 }
8165 softn->ipf_hm_maptable = newtab;
8166 softn->ipf_nat_hostmap_sz = newsize;
8167
8168 for (hm = softn->ipf_hm_maplist; hm != NULL; hm = hm->hm_next) {
8169 hv = hm->hm_hv % softn->ipf_nat_hostmap_sz;
8170 hm->hm_hnext = softn->ipf_hm_maptable[hv];
8171 hm->hm_phnext = softn->ipf_hm_maptable + hv;
8172 if (softn->ipf_hm_maptable[hv] != NULL)
8173 softn->ipf_hm_maptable[hv]->hm_phnext = &hm->hm_hnext;
8174 softn->ipf_hm_maptable[hv] = hm;
8175 }
8176 RWLOCK_EXIT(&softc->ipf_nat);
8177
8178 return (0);
8179 }
8180
8181
8182 /* ------------------------------------------------------------------------ */
8183 /* Function: ipf_nat_add_tq */
8184 /* Parameters: softc(I) - pointer to soft context main structure */
8185 /* */
8186 /* ------------------------------------------------------------------------ */
8187 ipftq_t *
ipf_nat_add_tq(ipf_main_softc_t * softc,int ttl)8188 ipf_nat_add_tq(ipf_main_softc_t *softc, int ttl)
8189 {
8190 ipf_nat_softc_t *softs = softc->ipf_nat_soft;
8191
8192 return (ipf_addtimeoutqueue(softc, &softs->ipf_nat_utqe, ttl));
8193 }
8194
8195 /* ------------------------------------------------------------------------ */
8196 /* Function: ipf_nat_uncreate */
8197 /* Returns: Nil */
8198 /* Parameters: fin(I) - pointer to packet information */
8199 /* */
8200 /* This function is used to remove a NAT entry from the NAT table when we */
8201 /* decide that the create was actually in error. It is thus assumed that */
8202 /* fin_flx will have both FI_NATED and FI_NATNEW set. Because we're dealing */
8203 /* with the translated packet (not the original), we have to reverse the */
8204 /* lookup. Although doing the lookup is expensive (relatively speaking), it */
8205 /* is not anticipated that this will be a frequent occurance for normal */
8206 /* traffic patterns. */
8207 /* ------------------------------------------------------------------------ */
8208 void
ipf_nat_uncreate(fr_info_t * fin)8209 ipf_nat_uncreate(fr_info_t *fin)
8210 {
8211 ipf_main_softc_t *softc = fin->fin_main_soft;
8212 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8213 int nflags;
8214 nat_t *nat;
8215
8216 switch (fin->fin_p)
8217 {
8218 case IPPROTO_TCP :
8219 nflags = IPN_TCP;
8220 break;
8221 case IPPROTO_UDP :
8222 nflags = IPN_UDP;
8223 break;
8224 default :
8225 nflags = 0;
8226 break;
8227 }
8228
8229 WRITE_ENTER(&softc->ipf_nat);
8230
8231 if (fin->fin_out == 0) {
8232 nat = ipf_nat_outlookup(fin, nflags, (u_int)fin->fin_p,
8233 fin->fin_dst, fin->fin_src);
8234 } else {
8235 nat = ipf_nat_inlookup(fin, nflags, (u_int)fin->fin_p,
8236 fin->fin_src, fin->fin_dst);
8237 }
8238
8239 if (nat != NULL) {
8240 NBUMPSIDE(fin->fin_out, ns_uncreate[0]);
8241 ipf_nat_delete(softc, nat, NL_DESTROY);
8242 } else {
8243 NBUMPSIDE(fin->fin_out, ns_uncreate[1]);
8244 }
8245
8246 RWLOCK_EXIT(&softc->ipf_nat);
8247 }
8248
8249
8250 /* ------------------------------------------------------------------------ */
8251 /* Function: ipf_nat_cmp_rules */
8252 /* Returns: int - 0 == success, else rules do not match. */
8253 /* Parameters: n1(I) - first rule to compare */
8254 /* n2(I) - first rule to compare */
8255 /* */
8256 /* Compare two rules using pointers to each rule. A straight bcmp will not */
8257 /* work as some fields (such as in_dst, in_pkts) actually do change once */
8258 /* the rule has been loaded into the kernel. Whilst this function returns */
8259 /* various non-zero returns, they're strictly to aid in debugging. Use of */
8260 /* this function should simply care if the result is zero or not. */
8261 /* ------------------------------------------------------------------------ */
8262 static int
ipf_nat_cmp_rules(ipnat_t * n1,ipnat_t * n2)8263 ipf_nat_cmp_rules(ipnat_t *n1, ipnat_t *n2)
8264 {
8265 if (n1->in_size != n2->in_size)
8266 return (1);
8267
8268 if (bcmp((char *)&n1->in_v, (char *)&n2->in_v,
8269 offsetof(ipnat_t, in_ndst) - offsetof(ipnat_t, in_v)) != 0)
8270 return (2);
8271
8272 if (bcmp((char *)&n1->in_tuc, (char *)&n2->in_tuc,
8273 n1->in_size - offsetof(ipnat_t, in_tuc)) != 0)
8274 return (3);
8275 if (n1->in_ndst.na_atype != n2->in_ndst.na_atype)
8276 return (5);
8277 if (n1->in_ndst.na_function != n2->in_ndst.na_function)
8278 return (6);
8279 if (bcmp((char *)&n1->in_ndst.na_addr, (char *)&n2->in_ndst.na_addr,
8280 sizeof(n1->in_ndst.na_addr)))
8281 return (7);
8282 if (n1->in_nsrc.na_atype != n2->in_nsrc.na_atype)
8283 return (8);
8284 if (n1->in_nsrc.na_function != n2->in_nsrc.na_function)
8285 return (9);
8286 if (bcmp((char *)&n1->in_nsrc.na_addr, (char *)&n2->in_nsrc.na_addr,
8287 sizeof(n1->in_nsrc.na_addr)))
8288 return (10);
8289 if (n1->in_odst.na_atype != n2->in_odst.na_atype)
8290 return (11);
8291 if (n1->in_odst.na_function != n2->in_odst.na_function)
8292 return (12);
8293 if (bcmp((char *)&n1->in_odst.na_addr, (char *)&n2->in_odst.na_addr,
8294 sizeof(n1->in_odst.na_addr)))
8295 return (13);
8296 if (n1->in_osrc.na_atype != n2->in_osrc.na_atype)
8297 return (14);
8298 if (n1->in_osrc.na_function != n2->in_osrc.na_function)
8299 return (15);
8300 if (bcmp((char *)&n1->in_osrc.na_addr, (char *)&n2->in_osrc.na_addr,
8301 sizeof(n1->in_osrc.na_addr)))
8302 return (16);
8303 return (0);
8304 }
8305
8306
8307 /* ------------------------------------------------------------------------ */
8308 /* Function: ipf_nat_rule_init */
8309 /* Returns: int - 0 == success, else rules do not match. */
8310 /* Parameters: softc(I) - pointer to soft context main structure */
8311 /* softn(I) - pointer to NAT context structure */
8312 /* n(I) - first rule to compare */
8313 /* */
8314 /* ------------------------------------------------------------------------ */
8315 static int
ipf_nat_rule_init(ipf_main_softc_t * softc,ipf_nat_softc_t * softn,ipnat_t * n)8316 ipf_nat_rule_init(ipf_main_softc_t *softc, ipf_nat_softc_t *softn,
8317 ipnat_t *n)
8318 {
8319 int error = 0;
8320
8321 if ((n->in_flags & IPN_SIPRANGE) != 0)
8322 n->in_nsrcatype = FRI_RANGE;
8323
8324 if ((n->in_flags & IPN_DIPRANGE) != 0)
8325 n->in_ndstatype = FRI_RANGE;
8326
8327 if ((n->in_flags & IPN_SPLIT) != 0)
8328 n->in_ndstatype = FRI_SPLIT;
8329
8330 if ((n->in_redir & (NAT_MAP|NAT_REWRITE|NAT_DIVERTUDP)) != 0)
8331 n->in_spnext = n->in_spmin;
8332
8333 if ((n->in_redir & (NAT_REWRITE|NAT_DIVERTUDP)) != 0) {
8334 n->in_dpnext = n->in_dpmin;
8335 } else if (n->in_redir == NAT_REDIRECT) {
8336 n->in_dpnext = n->in_dpmin;
8337 }
8338
8339 n->in_stepnext = 0;
8340
8341 switch (n->in_v[0])
8342 {
8343 case 4 :
8344 error = ipf_nat_ruleaddrinit(softc, softn, n);
8345 if (error != 0)
8346 return (error);
8347 break;
8348 #ifdef USE_INET6
8349 case 6 :
8350 error = ipf_nat6_ruleaddrinit(softc, softn, n);
8351 if (error != 0)
8352 return (error);
8353 break;
8354 #endif
8355 default :
8356 break;
8357 }
8358
8359 if (n->in_redir == (NAT_DIVERTUDP|NAT_MAP)) {
8360 /*
8361 * Prerecord whether or not the destination of the divert
8362 * is local or not to the interface the packet is going
8363 * to be sent out.
8364 */
8365 n->in_dlocal = ipf_deliverlocal(softc, n->in_v[1],
8366 n->in_ifps[1], &n->in_ndstip6);
8367 }
8368
8369 return (error);
8370 }
8371
8372
8373 /* ------------------------------------------------------------------------ */
8374 /* Function: ipf_nat_rule_fini */
8375 /* Returns: int - 0 == success, else rules do not match. */
8376 /* Parameters: softc(I) - pointer to soft context main structure */
8377 /* n(I) - rule to work on */
8378 /* */
8379 /* This function is used to release any objects that were referenced during */
8380 /* the rule initialisation. This is useful both when free'ing the rule and */
8381 /* when handling ioctls that need to initialise these fields but not */
8382 /* actually use them after the ioctl processing has finished. */
8383 /* ------------------------------------------------------------------------ */
8384 static void
ipf_nat_rule_fini(ipf_main_softc_t * softc,ipnat_t * n)8385 ipf_nat_rule_fini(ipf_main_softc_t *softc, ipnat_t *n)
8386 {
8387 if (n->in_odst.na_atype == FRI_LOOKUP && n->in_odst.na_ptr != NULL)
8388 ipf_lookup_deref(softc, n->in_odst.na_type, n->in_odst.na_ptr);
8389
8390 if (n->in_osrc.na_atype == FRI_LOOKUP && n->in_osrc.na_ptr != NULL)
8391 ipf_lookup_deref(softc, n->in_osrc.na_type, n->in_osrc.na_ptr);
8392
8393 if (n->in_ndst.na_atype == FRI_LOOKUP && n->in_ndst.na_ptr != NULL)
8394 ipf_lookup_deref(softc, n->in_ndst.na_type, n->in_ndst.na_ptr);
8395
8396 if (n->in_nsrc.na_atype == FRI_LOOKUP && n->in_nsrc.na_ptr != NULL)
8397 ipf_lookup_deref(softc, n->in_nsrc.na_type, n->in_nsrc.na_ptr);
8398
8399 if (n->in_divmp != NULL)
8400 FREE_MB_T(n->in_divmp);
8401 }
8402