0a1,2
> /* $FreeBSD: head/sys/contrib/ipfilter/netinet/ip_nat.h 145522 2005-04-25 18:43:14Z darrenr $ */
>
2c4
< * Copyright (C) 1995-2001 by Darren Reed.
---
> * Copyright (C) 1995-2001, 2003 by Darren Reed.
7,8c9,10
< * $Id: ip_nat.h,v 2.17.2.14 2000/11/18 03:58:04 darrenr Exp $
< * $FreeBSD: head/sys/contrib/ipfilter/netinet/ip_nat.h 139255 2004-12-24 09:14:26Z darrenr $
---
> * $FreeBSD: head/sys/contrib/ipfilter/netinet/ip_nat.h 145522 2005-04-25 18:43:14Z darrenr $
> * Id: ip_nat.h,v 2.90.2.9 2005/03/28 11:09:55 darrenr Exp
15c17
< #define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
---
> #define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
19,22c21,25
< #define SIOCADNAT _IOW('r', 60, struct ipnat *)
< #define SIOCRMNAT _IOW('r', 61, struct ipnat *)
< #define SIOCGNATS _IOWR('r', 62, struct natstat *)
< #define SIOCGNATL _IOWR('r', 63, struct natlookup *)
---
> #define SIOCADNAT _IOW('r', 60, struct ipfobj)
> #define SIOCRMNAT _IOW('r', 61, struct ipfobj)
> #define SIOCGNATS _IOWR('r', 62, struct ipfobj)
> #define SIOCGNATL _IOWR('r', 63, struct ipfobj)
> #define SIOCPROXY _IOWR('r', 64, struct ap_control)
24,27c27,31
< #define SIOCADNAT _IOW(r, 60, struct ipnat *)
< #define SIOCRMNAT _IOW(r, 61, struct ipnat *)
< #define SIOCGNATS _IOWR(r, 62, struct natstat *)
< #define SIOCGNATL _IOWR(r, 63, struct natlookup *)
---
> #define SIOCADNAT _IOW(r, 60, struct ipfobj)
> #define SIOCRMNAT _IOW(r, 61, struct ipfobj)
> #define SIOCGNATS _IOWR(r, 62, struct ipfobj)
> #define SIOCGNATL _IOWR(r, 63, struct ipfobj)
> #define SIOCPROXY _IOWR(r, 64, struct ap_control)
30c34
< #undef LARGE_NAT /* define this if you're setting up a system to NAT
---
> #undef LARGE_NAT /* define this if you're setting up a system to NAT
37,38c41,42
< #ifndef NAT_SIZE
< # ifdef LARGE_NAT
---
> #ifndef NAT_SIZE
> # ifdef LARGE_NAT
44,45c48,49
< #ifndef RDR_SIZE
< # ifdef LARGE_NAT
---
> #ifndef RDR_SIZE
> # ifdef LARGE_NAT
51,52c55,56
< #ifndef HOSTMAP_SIZE
< # ifdef LARGE_NAT
---
> #ifndef HOSTMAP_SIZE
> # ifdef LARGE_NAT
58a63,66
> /*
> * This is newly introduced and for the sake of "least surprise", the numbers
> * present aren't what we'd normally use for creating a proper hash table.
> */
65,66c73,74
< #ifndef NAT_TABLE_SZ
< # ifdef LARGE_NAT
---
> #ifndef NAT_TABLE_SZ
> # ifdef LARGE_NAT
78a87
> struct ipstate;
82,103c91
< u_long nat_age;
< int nat_flags;
< u_32_t nat_sumd[2];
< u_32_t nat_ipsumd;
< void *nat_data;
< struct ap_session *nat_aps; /* proxy session */
< struct frentry *nat_fr; /* filter rule ptr if appropriate */
< struct in_addr nat_inip;
< struct in_addr nat_outip;
< struct in_addr nat_oip; /* other ip */
< U_QUAD_T nat_pkts;
< U_QUAD_T nat_bytes;
< u_int nat_drop[2];
< u_short nat_oport; /* other port */
< u_short nat_inport;
< u_short nat_outport;
< u_short nat_use;
< u_char nat_tcpstate[2];
< u_char nat_p; /* protocol for NAT */
< u_32_t nat_mssclamp; /* if != zero clamp MSS to this */
< struct ipnat *nat_ptr; /* pointer back to the rule */
< struct hostmap *nat_hm;
---
> ipfmutex_t nat_lock;
104a93
> struct nat **nat_pnext;
106a96,97
> struct hostmap *nat_hm;
> void *nat_data;
108,113c99,128
< void *nat_ifp;
< int nat_dir;
< char nat_ifname[IFNAMSIZ];
< #if SOLARIS || defined(__sgi) || (__FreeBSD_version >= 500043)
< kmutex_t nat_lock;
< #endif
---
> struct ipstate *nat_state;
> struct ap_session *nat_aps; /* proxy session */
> frentry_t *nat_fr; /* filter rule ptr if appropriate */
> struct ipnat *nat_ptr; /* pointer back to the rule */
> void *nat_ifps[2];
> void *nat_sync;
> ipftqent_t nat_tqe;
> u_32_t nat_flags;
> u_32_t nat_sumd[2]; /* ip checksum delta for data segment*/
> u_32_t nat_ipsumd; /* ip checksum delta for ip header */
> u_32_t nat_mssclamp; /* if != zero clamp MSS to this */
> i6addr_t nat_inip6;
> i6addr_t nat_outip6;
> i6addr_t nat_oip6; /* other ip */
> U_QUAD_T nat_pkts[2];
> U_QUAD_T nat_bytes[2];
> union {
> udpinfo_t nat_unu;
> tcpinfo_t nat_unt;
> icmpinfo_t nat_uni;
> greinfo_t nat_ugre;
> } nat_un;
> u_short nat_oport; /* other port */
> u_short nat_use;
> u_char nat_p; /* protocol for NAT */
> int nat_dir;
> int nat_ref; /* reference count */
> int nat_hv[2];
> char nat_ifnames[2][LIFNAMSIZ];
> int nat_rev; /* 0 = forward, 1 = reverse */
115a131,174
> #define nat_inip nat_inip6.in4
> #define nat_outip nat_outip6.in4
> #define nat_oip nat_oip6.in4
> #define nat_age nat_tqe.tqe_die
> #define nat_inport nat_un.nat_unt.ts_sport
> #define nat_outport nat_un.nat_unt.ts_dport
> #define nat_type nat_un.nat_uni.ici_type
> #define nat_seq nat_un.nat_uni.ici_seq
> #define nat_id nat_un.nat_uni.ici_id
> #define nat_tcpstate nat_tqe.tqe_state
>
> /*
> * Values for nat_dir
> */
> #define NAT_INBOUND 0
> #define NAT_OUTBOUND 1
>
> /*
> * Definitions for nat_flags
> */
> #define NAT_TCP 0x0001 /* IPN_TCP */
> #define NAT_UDP 0x0002 /* IPN_UDP */
> #define NAT_ICMPERR 0x0004 /* IPN_ICMPERR */
> #define NAT_ICMPQUERY 0x0008 /* IPN_ICMPQUERY */
> #define NAT_SEARCH 0x0010
> #define NAT_SLAVE 0x0020 /* Slave connection for a proxy */
> #define NAT_NOTRULEPORT 0x0040
>
> #define NAT_TCPUDP (NAT_TCP|NAT_UDP)
> #define NAT_TCPUDPICMP (NAT_TCP|NAT_UDP|NAT_ICMPERR)
> #define NAT_TCPUDPICMPQ (NAT_TCP|NAT_UDP|NAT_ICMPQUERY)
> #define NAT_FROMRULE (NAT_TCP|NAT_UDP)
>
> /* 0x0100 reserved for FI_W_SPORT */
> /* 0x0200 reserved for FI_W_DPORT */
> /* 0x0400 reserved for FI_W_SADDR */
> /* 0x0800 reserved for FI_W_DADDR */
> /* 0x1000 reserved for FI_W_NEWFR */
> /* 0x2000 reserved for SI_CLONE */
> /* 0x4000 reserved for SI_CLONED */
> /* 0x8000 reserved for SI_IGNOREPKT */
>
> #define NAT_DEBUG 0x800000
>
117,143c176,209
< struct ipnat *in_next;
< struct ipnat *in_rnext;
< struct ipnat **in_prnext;
< struct ipnat *in_mnext;
< struct ipnat **in_pmnext;
< void *in_ifp;
< void *in_apr;
< u_long in_space;
< u_int in_use;
< u_int in_hits;
< struct in_addr in_nextip;
< u_short in_pnext;
< u_short in_ippip; /* IP #'s per IP# */
< u_32_t in_flags; /* From here to in_dport must be reflected */
< u_32_t in_mssclamp; /* if != zero clamp MSS to this */
< u_short in_spare;
< u_short in_ppip; /* ports per IP */
< u_short in_port[2]; /* correctly in IPN_CMPSIZ */
< struct in_addr in_in[2];
< struct in_addr in_out[2];
< struct in_addr in_src[2];
< struct frtuc in_tuc;
< u_int in_age[2]; /* Aging for NAT entries. Not for TCP */
< int in_redir; /* 0 if it's a mapping, 1 if it's a hard redir */
< char in_ifname[IFNAMSIZ];
< char in_plabel[APR_LABELLEN]; /* proxy label */
< char in_p; /* protocol */
---
> struct ipnat *in_next; /* NAT rule list next */
> struct ipnat *in_rnext; /* rdr rule hash next */
> struct ipnat **in_prnext; /* prior rdr next ptr */
> struct ipnat *in_mnext; /* map rule hash next */
> struct ipnat **in_pmnext; /* prior map next ptr */
> struct ipftq *in_tqehead[2];
> void *in_ifps[2];
> void *in_apr;
> char *in_comment;
> i6addr_t in_next6;
> u_long in_space;
> u_long in_hits;
> u_int in_use;
> u_int in_hv;
> int in_flineno; /* conf. file line number */
> u_short in_pnext;
> u_char in_v;
> u_char in_xxx;
> /* From here to the end is covered by IPN_CMPSIZ */
> u_32_t in_flags;
> u_32_t in_mssclamp; /* if != 0 clamp MSS to this */
> u_int in_age[2];
> int in_redir; /* see below for values */
> int in_p; /* protocol. */
> i6addr_t in_in[2];
> i6addr_t in_out[2];
> i6addr_t in_src[2];
> frtuc_t in_tuc;
> u_short in_port[2];
> u_short in_ppip; /* ports per IP. */
> u_short in_ippip; /* IP #'s per IP# */
> char in_ifnames[2][LIFNAMSIZ];
> char in_plabel[APR_LABELLEN]; /* proxy label. */
> ipftag_t in_tag;
148,154c214,221
< #define in_nip in_nextip.s_addr
< #define in_inip in_in[0].s_addr
< #define in_inmsk in_in[1].s_addr
< #define in_outip in_out[0].s_addr
< #define in_outmsk in_out[1].s_addr
< #define in_srcip in_src[0].s_addr
< #define in_srcmsk in_src[1].s_addr
---
> #define in_nextip in_next6.in4
> #define in_nip in_next6.in4.s_addr
> #define in_inip in_in[0].in4.s_addr
> #define in_inmsk in_in[1].in4.s_addr
> #define in_outip in_out[0].in4.s_addr
> #define in_outmsk in_out[1].in4.s_addr
> #define in_srcip in_src[0].in4.s_addr
> #define in_srcmsk in_src[1].in4.s_addr
162,163c229,258
< #define NAT_OUTBOUND 0
< #define NAT_INBOUND 1
---
> /*
> * Bit definitions for in_flags
> */
> #define IPN_ANY 0x00000
> #define IPN_TCP 0x00001
> #define IPN_UDP 0x00002
> #define IPN_TCPUDP (IPN_TCP|IPN_UDP)
> #define IPN_ICMPERR 0x00004
> #define IPN_TCPUDPICMP (IPN_TCP|IPN_UDP|IPN_ICMPERR)
> #define IPN_ICMPQUERY 0x00008
> #define IPN_TCPUDPICMPQ (IPN_TCP|IPN_UDP|IPN_ICMPQUERY)
> #define IPN_RF (IPN_TCPUDP|IPN_DELETE|IPN_ICMPERR)
> #define IPN_AUTOPORTMAP 0x00010
> #define IPN_IPRANGE 0x00020
> #define IPN_FILTER 0x00040
> #define IPN_SPLIT 0x00080
> #define IPN_ROUNDR 0x00100
> #define IPN_NOTSRC 0x04000
> #define IPN_NOTDST 0x08000
> #define IPN_DYNSRCIP 0x10000 /* dynamic src IP# */
> #define IPN_DYNDSTIP 0x20000 /* dynamic dst IP# */
> #define IPN_DELETE 0x40000
> #define IPN_STICKY 0x80000
> #define IPN_FRAG 0x100000
> #define IPN_FIXEDDPORT 0x200000
> #define IPN_FINDFORWARD 0x400000
> #define IPN_IN 0x800000
> #define IPN_USERFLAGS (IPN_TCPUDP|IPN_AUTOPORTMAP|IPN_IPRANGE|IPN_SPLIT|\
> IPN_ROUNDR|IPN_FILTER|IPN_NOTSRC|IPN_NOTDST|\
> IPN_FRAG|IPN_STICKY|IPN_FIXEDDPORT|IPN_ICMPQUERY)
164a260,262
> /*
> * Values for in_redir
> */
169,173d266
< /* 0x100 reserved for FI_W_SPORT */
< /* 0x200 reserved for FI_W_DPORT */
< /* 0x400 reserved for FI_W_SADDR */
< /* 0x800 reserved for FI_W_DADDR */
< /* 0x1000 reserved for FI_W_NEWFR */
207a301,324
> typedef struct nattrpnt {
> struct in_addr tr_dstip; /* real destination IP# */
> struct in_addr tr_srcip; /* real source IP# */
> struct in_addr tr_locip; /* local source IP# */
> u_int tr_flags;
> int tr_expire;
> u_short tr_dstport; /* real destination port# */
> u_short tr_srcport; /* real source port# */
> u_short tr_locport; /* local source port# */
> struct nattrpnt *tr_hnext;
> struct nattrpnt **tr_phnext;
> struct nattrpnt *tr_next;
> struct nattrpnt **tr_pnext; /* previous next */
> } nattrpnt_t;
>
> #define TN_CMPSIZ offsetof(nattrpnt_t, tr_hnext)
>
>
> /*
> * This structure gets used to help NAT sessions keep the same NAT rule (and
> * thus translation for IP address) when:
> * (a) round-robin redirects are in use
> * (b) different IP add
> */
212c329,330
< struct in_addr hm_realip;
---
> struct in_addr hm_srcip;
> struct in_addr hm_dstip;
214c332,333
< int hm_ref;
---
> u_32_t hm_port;
> int hm_ref;
217a337,353
> /*
> * Structure used to pass information in to nat_newmap and nat_newrdr.
> */
> typedef struct natinfo {
> ipnat_t *nai_np;
> u_32_t nai_sum1;
> u_32_t nai_sum2;
> u_32_t nai_nflags;
> u_32_t nai_flags;
> struct in_addr nai_ip;
> u_short nai_port;
> u_short nai_nport;
> u_short nai_sport;
> u_short nai_dport;
> } natinfo_t;
>
>
227a364
> u_long ns_addtrpnt;
231a369
> u_int ns_wilds;
232a371
> u_int ns_nattab_max;
234a374
> u_int ns_trpntab_sz;
237c377,378
< u_int ns_wilds;
---
> nattrpnt_t *ns_trpntlist;
> u_long *ns_bucketlen[2];
240,258d380
< #define IPN_ANY 0x000
< #define IPN_TCP 0x001
< #define IPN_UDP 0x002
< #define IPN_TCPUDP (IPN_TCP|IPN_UDP)
< #define IPN_DELETE 0x004
< #define IPN_ICMPERR 0x008
< #define IPN_RF (IPN_TCPUDP|IPN_DELETE|IPN_ICMPERR)
< #define IPN_AUTOPORTMAP 0x010
< #define IPN_IPRANGE 0x020
< #define IPN_USERFLAGS (IPN_TCPUDP|IPN_AUTOPORTMAP|IPN_IPRANGE|IPN_SPLIT|\
< IPN_ROUNDR|IPN_FILTER|IPN_NOTSRC|IPN_NOTDST|IPN_FRAG)
< #define IPN_FILTER 0x040
< #define IPN_SPLIT 0x080
< #define IPN_ROUNDR 0x100
< #define IPN_NOTSRC 0x080000
< #define IPN_NOTDST 0x100000
< #define IPN_FRAG 0x200000
<
<
268,269c390,391
< U_QUAD_T nl_pkts;
< U_QUAD_T nl_bytes;
---
> U_QUAD_T nl_pkts[2];
> U_QUAD_T nl_bytes[2];
277a400
> #define NL_CLONE 0xfffd
298a422
>
299a424
> extern u_int ipf_nattable_max;
301a427,429
> extern u_int ipf_hostmap_sz;
> extern u_int fr_nat_maxbucket;
> extern u_int fr_nat_maxbucket_reset;
303c431
< extern void ip_natsync __P((void *));
---
> extern void fr_natsync __P((void *));
305a434,436
> extern u_long fr_defnatipage;
> /* nat_table[0] -> hashed list sorted by inside (ip, port) */
> /* nat_table[1] -> hashed list sorted by outside (ip, port) */
307a439
> extern ipnat_t *nat_list;
310c442
< extern ipnat_t *nat_list;
---
> extern ipftq_t *nat_utqe;
311a444
>
315,322c448,450
< #if defined(__NetBSD__) || defined(__OpenBSD__) || (__FreeBSD_version >= 300003)
< extern int nat_ioctl __P((caddr_t, u_long, int));
< #else
< extern int nat_ioctl __P((caddr_t, int, int));
< #endif
< extern int nat_init __P((void));
< extern nat_t *nat_new __P((fr_info_t *, ip_t *, ipnat_t *, nat_t **,
< u_int, int));
---
> extern int fr_nat_ioctl __P((caddr_t, ioctlcmd_t, int));
> extern int fr_natinit __P((void));
> extern nat_t *nat_new __P((fr_info_t *, ipnat_t *, nat_t **, u_int, int));
324c452,453
< struct in_addr, int));
---
> struct in_addr));
> extern void fix_datacksum __P((u_short *, u_32_t));
326c455,458
< struct in_addr, int));
---
> struct in_addr));
> extern nat_t *nat_tnlookup __P((fr_info_t *, int));
> extern nat_t *nat_maplookup __P((void *, u_int, struct in_addr,
> struct in_addr));
328,331c460,462
< extern nat_t *nat_icmplookup __P((ip_t *, fr_info_t *, int));
< extern nat_t *nat_icmp __P((ip_t *, fr_info_t *, u_int *, int));
< extern int nat_clearlist __P((void));
< extern void nat_insert __P((nat_t *));
---
> extern nat_t *nat_icmperrorlookup __P((fr_info_t *, int));
> extern nat_t *nat_icmperror __P((fr_info_t *, u_int *, int));
> extern int nat_insert __P((nat_t *, int));
333,335c464,469
< extern int ip_natout __P((ip_t *, fr_info_t *));
< extern int ip_natin __P((ip_t *, fr_info_t *));
< extern void ip_natunload __P((void)), ip_natexpire __P((void));
---
> extern int fr_checknatout __P((fr_info_t *, u_32_t *));
> extern int fr_natout __P((fr_info_t *, nat_t *, int, u_32_t));
> extern int fr_checknatin __P((fr_info_t *, u_32_t *));
> extern int fr_natin __P((fr_info_t *, nat_t *, int, u_32_t));
> extern void fr_natunload __P((void));
> extern void fr_natexpire __P((void));
339c473,476
< extern void fix_datacksum __P((u_short *, u_32_t));
---
> extern void fr_natderef __P((nat_t **));
> extern u_short *nat_proto __P((fr_info_t *, nat_t *, u_int));
> extern void nat_update __P((fr_info_t *, nat_t *, ipnat_t *));
> extern void fr_setnatqueue __P((nat_t *, int));
> /* $FreeBSD: head/sys/contrib/ipfilter/netinet/ip_nat.h 145522 2005-04-25 18:43:14Z darrenr $ */
>
2c4
< * Copyright (C) 1995-2001 by Darren Reed.
---
> * Copyright (C) 1995-2001, 2003 by Darren Reed.
7,8c9,10
< * $Id: ip_nat.h,v 2.17.2.14 2000/11/18 03:58:04 darrenr Exp $
< * $FreeBSD: head/sys/contrib/ipfilter/netinet/ip_nat.h 139255 2004-12-24 09:14:26Z darrenr $
---
> * $FreeBSD: head/sys/contrib/ipfilter/netinet/ip_nat.h 145522 2005-04-25 18:43:14Z darrenr $
> * Id: ip_nat.h,v 2.90.2.9 2005/03/28 11:09:55 darrenr Exp
15c17
< #define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
---
> #define SOLARIS (defined(sun) && (defined(__svr4__) || defined(__SVR4)))
19,22c21,25
< #define SIOCADNAT _IOW('r', 60, struct ipnat *)
< #define SIOCRMNAT _IOW('r', 61, struct ipnat *)
< #define SIOCGNATS _IOWR('r', 62, struct natstat *)
< #define SIOCGNATL _IOWR('r', 63, struct natlookup *)
---
> #define SIOCADNAT _IOW('r', 60, struct ipfobj)
> #define SIOCRMNAT _IOW('r', 61, struct ipfobj)
> #define SIOCGNATS _IOWR('r', 62, struct ipfobj)
> #define SIOCGNATL _IOWR('r', 63, struct ipfobj)
> #define SIOCPROXY _IOWR('r', 64, struct ap_control)
24,27c27,31
< #define SIOCADNAT _IOW(r, 60, struct ipnat *)
< #define SIOCRMNAT _IOW(r, 61, struct ipnat *)
< #define SIOCGNATS _IOWR(r, 62, struct natstat *)
< #define SIOCGNATL _IOWR(r, 63, struct natlookup *)
---
> #define SIOCADNAT _IOW(r, 60, struct ipfobj)
> #define SIOCRMNAT _IOW(r, 61, struct ipfobj)
> #define SIOCGNATS _IOWR(r, 62, struct ipfobj)
> #define SIOCGNATL _IOWR(r, 63, struct ipfobj)
> #define SIOCPROXY _IOWR(r, 64, struct ap_control)
30c34
< #undef LARGE_NAT /* define this if you're setting up a system to NAT
---
> #undef LARGE_NAT /* define this if you're setting up a system to NAT
37,38c41,42
< #ifndef NAT_SIZE
< # ifdef LARGE_NAT
---
> #ifndef NAT_SIZE
> # ifdef LARGE_NAT
44,45c48,49
< #ifndef RDR_SIZE
< # ifdef LARGE_NAT
---
> #ifndef RDR_SIZE
> # ifdef LARGE_NAT
51,52c55,56
< #ifndef HOSTMAP_SIZE
< # ifdef LARGE_NAT
---
> #ifndef HOSTMAP_SIZE
> # ifdef LARGE_NAT
58a63,66
> /*
> * This is newly introduced and for the sake of "least surprise", the numbers
> * present aren't what we'd normally use for creating a proper hash table.
> */
65,66c73,74
< #ifndef NAT_TABLE_SZ
< # ifdef LARGE_NAT
---
> #ifndef NAT_TABLE_SZ
> # ifdef LARGE_NAT
78a87
> struct ipstate;
82,103c91
< u_long nat_age;
< int nat_flags;
< u_32_t nat_sumd[2];
< u_32_t nat_ipsumd;
< void *nat_data;
< struct ap_session *nat_aps; /* proxy session */
< struct frentry *nat_fr; /* filter rule ptr if appropriate */
< struct in_addr nat_inip;
< struct in_addr nat_outip;
< struct in_addr nat_oip; /* other ip */
< U_QUAD_T nat_pkts;
< U_QUAD_T nat_bytes;
< u_int nat_drop[2];
< u_short nat_oport; /* other port */
< u_short nat_inport;
< u_short nat_outport;
< u_short nat_use;
< u_char nat_tcpstate[2];
< u_char nat_p; /* protocol for NAT */
< u_32_t nat_mssclamp; /* if != zero clamp MSS to this */
< struct ipnat *nat_ptr; /* pointer back to the rule */
< struct hostmap *nat_hm;
---
> ipfmutex_t nat_lock;
104a93
> struct nat **nat_pnext;
106a96,97
> struct hostmap *nat_hm;
> void *nat_data;
108,113c99,128
< void *nat_ifp;
< int nat_dir;
< char nat_ifname[IFNAMSIZ];
< #if SOLARIS || defined(__sgi) || (__FreeBSD_version >= 500043)
< kmutex_t nat_lock;
< #endif
---
> struct ipstate *nat_state;
> struct ap_session *nat_aps; /* proxy session */
> frentry_t *nat_fr; /* filter rule ptr if appropriate */
> struct ipnat *nat_ptr; /* pointer back to the rule */
> void *nat_ifps[2];
> void *nat_sync;
> ipftqent_t nat_tqe;
> u_32_t nat_flags;
> u_32_t nat_sumd[2]; /* ip checksum delta for data segment*/
> u_32_t nat_ipsumd; /* ip checksum delta for ip header */
> u_32_t nat_mssclamp; /* if != zero clamp MSS to this */
> i6addr_t nat_inip6;
> i6addr_t nat_outip6;
> i6addr_t nat_oip6; /* other ip */
> U_QUAD_T nat_pkts[2];
> U_QUAD_T nat_bytes[2];
> union {
> udpinfo_t nat_unu;
> tcpinfo_t nat_unt;
> icmpinfo_t nat_uni;
> greinfo_t nat_ugre;
> } nat_un;
> u_short nat_oport; /* other port */
> u_short nat_use;
> u_char nat_p; /* protocol for NAT */
> int nat_dir;
> int nat_ref; /* reference count */
> int nat_hv[2];
> char nat_ifnames[2][LIFNAMSIZ];
> int nat_rev; /* 0 = forward, 1 = reverse */
115a131,174
> #define nat_inip nat_inip6.in4
> #define nat_outip nat_outip6.in4
> #define nat_oip nat_oip6.in4
> #define nat_age nat_tqe.tqe_die
> #define nat_inport nat_un.nat_unt.ts_sport
> #define nat_outport nat_un.nat_unt.ts_dport
> #define nat_type nat_un.nat_uni.ici_type
> #define nat_seq nat_un.nat_uni.ici_seq
> #define nat_id nat_un.nat_uni.ici_id
> #define nat_tcpstate nat_tqe.tqe_state
>
> /*
> * Values for nat_dir
> */
> #define NAT_INBOUND 0
> #define NAT_OUTBOUND 1
>
> /*
> * Definitions for nat_flags
> */
> #define NAT_TCP 0x0001 /* IPN_TCP */
> #define NAT_UDP 0x0002 /* IPN_UDP */
> #define NAT_ICMPERR 0x0004 /* IPN_ICMPERR */
> #define NAT_ICMPQUERY 0x0008 /* IPN_ICMPQUERY */
> #define NAT_SEARCH 0x0010
> #define NAT_SLAVE 0x0020 /* Slave connection for a proxy */
> #define NAT_NOTRULEPORT 0x0040
>
> #define NAT_TCPUDP (NAT_TCP|NAT_UDP)
> #define NAT_TCPUDPICMP (NAT_TCP|NAT_UDP|NAT_ICMPERR)
> #define NAT_TCPUDPICMPQ (NAT_TCP|NAT_UDP|NAT_ICMPQUERY)
> #define NAT_FROMRULE (NAT_TCP|NAT_UDP)
>
> /* 0x0100 reserved for FI_W_SPORT */
> /* 0x0200 reserved for FI_W_DPORT */
> /* 0x0400 reserved for FI_W_SADDR */
> /* 0x0800 reserved for FI_W_DADDR */
> /* 0x1000 reserved for FI_W_NEWFR */
> /* 0x2000 reserved for SI_CLONE */
> /* 0x4000 reserved for SI_CLONED */
> /* 0x8000 reserved for SI_IGNOREPKT */
>
> #define NAT_DEBUG 0x800000
>
117,143c176,209
< struct ipnat *in_next;
< struct ipnat *in_rnext;
< struct ipnat **in_prnext;
< struct ipnat *in_mnext;
< struct ipnat **in_pmnext;
< void *in_ifp;
< void *in_apr;
< u_long in_space;
< u_int in_use;
< u_int in_hits;
< struct in_addr in_nextip;
< u_short in_pnext;
< u_short in_ippip; /* IP #'s per IP# */
< u_32_t in_flags; /* From here to in_dport must be reflected */
< u_32_t in_mssclamp; /* if != zero clamp MSS to this */
< u_short in_spare;
< u_short in_ppip; /* ports per IP */
< u_short in_port[2]; /* correctly in IPN_CMPSIZ */
< struct in_addr in_in[2];
< struct in_addr in_out[2];
< struct in_addr in_src[2];
< struct frtuc in_tuc;
< u_int in_age[2]; /* Aging for NAT entries. Not for TCP */
< int in_redir; /* 0 if it's a mapping, 1 if it's a hard redir */
< char in_ifname[IFNAMSIZ];
< char in_plabel[APR_LABELLEN]; /* proxy label */
< char in_p; /* protocol */
---
> struct ipnat *in_next; /* NAT rule list next */
> struct ipnat *in_rnext; /* rdr rule hash next */
> struct ipnat **in_prnext; /* prior rdr next ptr */
> struct ipnat *in_mnext; /* map rule hash next */
> struct ipnat **in_pmnext; /* prior map next ptr */
> struct ipftq *in_tqehead[2];
> void *in_ifps[2];
> void *in_apr;
> char *in_comment;
> i6addr_t in_next6;
> u_long in_space;
> u_long in_hits;
> u_int in_use;
> u_int in_hv;
> int in_flineno; /* conf. file line number */
> u_short in_pnext;
> u_char in_v;
> u_char in_xxx;
> /* From here to the end is covered by IPN_CMPSIZ */
> u_32_t in_flags;
> u_32_t in_mssclamp; /* if != 0 clamp MSS to this */
> u_int in_age[2];
> int in_redir; /* see below for values */
> int in_p; /* protocol. */
> i6addr_t in_in[2];
> i6addr_t in_out[2];
> i6addr_t in_src[2];
> frtuc_t in_tuc;
> u_short in_port[2];
> u_short in_ppip; /* ports per IP. */
> u_short in_ippip; /* IP #'s per IP# */
> char in_ifnames[2][LIFNAMSIZ];
> char in_plabel[APR_LABELLEN]; /* proxy label. */
> ipftag_t in_tag;
148,154c214,221
< #define in_nip in_nextip.s_addr
< #define in_inip in_in[0].s_addr
< #define in_inmsk in_in[1].s_addr
< #define in_outip in_out[0].s_addr
< #define in_outmsk in_out[1].s_addr
< #define in_srcip in_src[0].s_addr
< #define in_srcmsk in_src[1].s_addr
---
> #define in_nextip in_next6.in4
> #define in_nip in_next6.in4.s_addr
> #define in_inip in_in[0].in4.s_addr
> #define in_inmsk in_in[1].in4.s_addr
> #define in_outip in_out[0].in4.s_addr
> #define in_outmsk in_out[1].in4.s_addr
> #define in_srcip in_src[0].in4.s_addr
> #define in_srcmsk in_src[1].in4.s_addr
162,163c229,258
< #define NAT_OUTBOUND 0
< #define NAT_INBOUND 1
---
> /*
> * Bit definitions for in_flags
> */
> #define IPN_ANY 0x00000
> #define IPN_TCP 0x00001
> #define IPN_UDP 0x00002
> #define IPN_TCPUDP (IPN_TCP|IPN_UDP)
> #define IPN_ICMPERR 0x00004
> #define IPN_TCPUDPICMP (IPN_TCP|IPN_UDP|IPN_ICMPERR)
> #define IPN_ICMPQUERY 0x00008
> #define IPN_TCPUDPICMPQ (IPN_TCP|IPN_UDP|IPN_ICMPQUERY)
> #define IPN_RF (IPN_TCPUDP|IPN_DELETE|IPN_ICMPERR)
> #define IPN_AUTOPORTMAP 0x00010
> #define IPN_IPRANGE 0x00020
> #define IPN_FILTER 0x00040
> #define IPN_SPLIT 0x00080
> #define IPN_ROUNDR 0x00100
> #define IPN_NOTSRC 0x04000
> #define IPN_NOTDST 0x08000
> #define IPN_DYNSRCIP 0x10000 /* dynamic src IP# */
> #define IPN_DYNDSTIP 0x20000 /* dynamic dst IP# */
> #define IPN_DELETE 0x40000
> #define IPN_STICKY 0x80000
> #define IPN_FRAG 0x100000
> #define IPN_FIXEDDPORT 0x200000
> #define IPN_FINDFORWARD 0x400000
> #define IPN_IN 0x800000
> #define IPN_USERFLAGS (IPN_TCPUDP|IPN_AUTOPORTMAP|IPN_IPRANGE|IPN_SPLIT|\
> IPN_ROUNDR|IPN_FILTER|IPN_NOTSRC|IPN_NOTDST|\
> IPN_FRAG|IPN_STICKY|IPN_FIXEDDPORT|IPN_ICMPQUERY)
164a260,262
> /*
> * Values for in_redir
> */
169,173d266
< /* 0x100 reserved for FI_W_SPORT */
< /* 0x200 reserved for FI_W_DPORT */
< /* 0x400 reserved for FI_W_SADDR */
< /* 0x800 reserved for FI_W_DADDR */
< /* 0x1000 reserved for FI_W_NEWFR */
207a301,324
> typedef struct nattrpnt {
> struct in_addr tr_dstip; /* real destination IP# */
> struct in_addr tr_srcip; /* real source IP# */
> struct in_addr tr_locip; /* local source IP# */
> u_int tr_flags;
> int tr_expire;
> u_short tr_dstport; /* real destination port# */
> u_short tr_srcport; /* real source port# */
> u_short tr_locport; /* local source port# */
> struct nattrpnt *tr_hnext;
> struct nattrpnt **tr_phnext;
> struct nattrpnt *tr_next;
> struct nattrpnt **tr_pnext; /* previous next */
> } nattrpnt_t;
>
> #define TN_CMPSIZ offsetof(nattrpnt_t, tr_hnext)
>
>
> /*
> * This structure gets used to help NAT sessions keep the same NAT rule (and
> * thus translation for IP address) when:
> * (a) round-robin redirects are in use
> * (b) different IP add
> */
212c329,330
< struct in_addr hm_realip;
---
> struct in_addr hm_srcip;
> struct in_addr hm_dstip;
214c332,333
< int hm_ref;
---
> u_32_t hm_port;
> int hm_ref;
217a337,353
> /*
> * Structure used to pass information in to nat_newmap and nat_newrdr.
> */
> typedef struct natinfo {
> ipnat_t *nai_np;
> u_32_t nai_sum1;
> u_32_t nai_sum2;
> u_32_t nai_nflags;
> u_32_t nai_flags;
> struct in_addr nai_ip;
> u_short nai_port;
> u_short nai_nport;
> u_short nai_sport;
> u_short nai_dport;
> } natinfo_t;
>
>
227a364
> u_long ns_addtrpnt;
231a369
> u_int ns_wilds;
232a371
> u_int ns_nattab_max;
234a374
> u_int ns_trpntab_sz;
237c377,378
< u_int ns_wilds;
---
> nattrpnt_t *ns_trpntlist;
> u_long *ns_bucketlen[2];
240,258d380
< #define IPN_ANY 0x000
< #define IPN_TCP 0x001
< #define IPN_UDP 0x002
< #define IPN_TCPUDP (IPN_TCP|IPN_UDP)
< #define IPN_DELETE 0x004
< #define IPN_ICMPERR 0x008
< #define IPN_RF (IPN_TCPUDP|IPN_DELETE|IPN_ICMPERR)
< #define IPN_AUTOPORTMAP 0x010
< #define IPN_IPRANGE 0x020
< #define IPN_USERFLAGS (IPN_TCPUDP|IPN_AUTOPORTMAP|IPN_IPRANGE|IPN_SPLIT|\
< IPN_ROUNDR|IPN_FILTER|IPN_NOTSRC|IPN_NOTDST|IPN_FRAG)
< #define IPN_FILTER 0x040
< #define IPN_SPLIT 0x080
< #define IPN_ROUNDR 0x100
< #define IPN_NOTSRC 0x080000
< #define IPN_NOTDST 0x100000
< #define IPN_FRAG 0x200000
<
<
268,269c390,391
< U_QUAD_T nl_pkts;
< U_QUAD_T nl_bytes;
---
> U_QUAD_T nl_pkts[2];
> U_QUAD_T nl_bytes[2];
277a400
> #define NL_CLONE 0xfffd
298a422
>
299a424
> extern u_int ipf_nattable_max;
301a427,429
> extern u_int ipf_hostmap_sz;
> extern u_int fr_nat_maxbucket;
> extern u_int fr_nat_maxbucket_reset;
303c431
< extern void ip_natsync __P((void *));
---
> extern void fr_natsync __P((void *));
305a434,436
> extern u_long fr_defnatipage;
> /* nat_table[0] -> hashed list sorted by inside (ip, port) */
> /* nat_table[1] -> hashed list sorted by outside (ip, port) */
307a439
> extern ipnat_t *nat_list;
310c442
< extern ipnat_t *nat_list;
---
> extern ipftq_t *nat_utqe;
311a444
>
315,322c448,450
< #if defined(__NetBSD__) || defined(__OpenBSD__) || (__FreeBSD_version >= 300003)
< extern int nat_ioctl __P((caddr_t, u_long, int));
< #else
< extern int nat_ioctl __P((caddr_t, int, int));
< #endif
< extern int nat_init __P((void));
< extern nat_t *nat_new __P((fr_info_t *, ip_t *, ipnat_t *, nat_t **,
< u_int, int));
---
> extern int fr_nat_ioctl __P((caddr_t, ioctlcmd_t, int));
> extern int fr_natinit __P((void));
> extern nat_t *nat_new __P((fr_info_t *, ipnat_t *, nat_t **, u_int, int));
324c452,453
< struct in_addr, int));
---
> struct in_addr));
> extern void fix_datacksum __P((u_short *, u_32_t));
326c455,458
< struct in_addr, int));
---
> struct in_addr));
> extern nat_t *nat_tnlookup __P((fr_info_t *, int));
> extern nat_t *nat_maplookup __P((void *, u_int, struct in_addr,
> struct in_addr));
328,331c460,462
< extern nat_t *nat_icmplookup __P((ip_t *, fr_info_t *, int));
< extern nat_t *nat_icmp __P((ip_t *, fr_info_t *, u_int *, int));
< extern int nat_clearlist __P((void));
< extern void nat_insert __P((nat_t *));
---
> extern nat_t *nat_icmperrorlookup __P((fr_info_t *, int));
> extern nat_t *nat_icmperror __P((fr_info_t *, u_int *, int));
> extern int nat_insert __P((nat_t *, int));
333,335c464,469
< extern int ip_natout __P((ip_t *, fr_info_t *));
< extern int ip_natin __P((ip_t *, fr_info_t *));
< extern void ip_natunload __P((void)), ip_natexpire __P((void));
---
> extern int fr_checknatout __P((fr_info_t *, u_32_t *));
> extern int fr_natout __P((fr_info_t *, nat_t *, int, u_32_t));
> extern int fr_checknatin __P((fr_info_t *, u_32_t *));
> extern int fr_natin __P((fr_info_t *, nat_t *, int, u_32_t));
> extern void fr_natunload __P((void));
> extern void fr_natexpire __P((void));
339c473,476
< extern void fix_datacksum __P((u_short *, u_32_t));
---
> extern void fr_natderef __P((nat_t **));
> extern u_short *nat_proto __P((fr_info_t *, nat_t *, u_int));
> extern void nat_update __P((fr_info_t *, nat_t *, ipnat_t *));
> extern void fr_setnatqueue __P((nat_t *, int));