1/*
| 1/*
|
2 * Copyright (C) 1995-2000 by Darren Reed.
| 2 * Copyright (C) 1995-2001 by Darren Reed.
|
3 *
| 3 *
|
4 * Redistribution and use in source and binary forms are permitted
5 * provided that this notice is preserved and due credit is given
6 * to the original author and the contributors.
| 4 * See the IPFILTER.LICENCE file for details on licencing.
|
7 *
8 * Added redirect stuff and a LOT of bug fixes. (mcn@EnGarde.com)
9 */
| 5 *
6 * Added redirect stuff and a LOT of bug fixes. (mcn@EnGarde.com)
7 */
|
10#if !defined(lint)
11/*static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.16 2000/07/18 13:57:40 darrenr Exp $";*/
12static const char rcsid[] = "@(#)$FreeBSD: head/sys/contrib/ipfilter/netinet/ip_nat.c 75262 2001-04-06 15:52:28Z darrenr $";
13#endif
| |
14
15#if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
16#define _KERNEL
17#endif
18
19#include <sys/errno.h>
20#include <sys/types.h>
21#include <sys/param.h>
22#include <sys/time.h>
23#include <sys/file.h>
24#if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
25 defined(_KERNEL)
26# include "opt_ipfilter_log.h"
27#endif
28#if !defined(_KERNEL) && !defined(KERNEL)
29# include <stdio.h>
30# include <string.h>
31# include <stdlib.h>
32#endif
33#if (defined(KERNEL) || defined(_KERNEL)) && (__FreeBSD_version >= 220000)
34# include <sys/filio.h>
35# include <sys/fcntl.h>
36#else
37# include <sys/ioctl.h>
38#endif
39#include <sys/fcntl.h>
40#include <sys/uio.h>
41#ifndef linux
42# include <sys/protosw.h>
43#endif
44#include <sys/socket.h>
45#if defined(_KERNEL) && !defined(linux)
46# include <sys/systm.h>
47#endif
48#if !defined(__SVR4) && !defined(__svr4__)
49# ifndef linux
50# include <sys/mbuf.h>
51# endif
52#else
53# include <sys/filio.h>
54# include <sys/byteorder.h>
55# ifdef _KERNEL
56# include <sys/dditypes.h>
57# endif
58# include <sys/stream.h>
59# include <sys/kmem.h>
60#endif
61#if __FreeBSD_version >= 300000
62# include <sys/queue.h>
63#endif
64#include <net/if.h>
65#if __FreeBSD_version >= 300000
66# include <net/if_var.h>
67# if defined(_KERNEL) && !defined(IPFILTER_LKM)
68# include "opt_ipfilter.h"
69# endif
70#endif
71#ifdef sun
72# include <net/af.h>
73#endif
74#include <net/route.h>
75#include <netinet/in.h>
76#include <netinet/in_systm.h>
77#include <netinet/ip.h>
78
79#ifdef __sgi
80# ifdef IFF_DRVRLOCK /* IRIX6 */
81#include <sys/hashing.h>
82#include <netinet/in_var.h>
83# endif
84#endif
85
86#ifdef RFC1825
87# include <vpn/md5.h>
88# include <vpn/ipsec.h>
89extern struct ifnet vpnif;
90#endif
91
92#ifndef linux
93# include <netinet/ip_var.h>
| 8
9#if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
10#define _KERNEL
11#endif
12
13#include <sys/errno.h>
14#include <sys/types.h>
15#include <sys/param.h>
16#include <sys/time.h>
17#include <sys/file.h>
18#if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
19 defined(_KERNEL)
20# include "opt_ipfilter_log.h"
21#endif
22#if !defined(_KERNEL) && !defined(KERNEL)
23# include <stdio.h>
24# include <string.h>
25# include <stdlib.h>
26#endif
27#if (defined(KERNEL) || defined(_KERNEL)) && (__FreeBSD_version >= 220000)
28# include <sys/filio.h>
29# include <sys/fcntl.h>
30#else
31# include <sys/ioctl.h>
32#endif
33#include <sys/fcntl.h>
34#include <sys/uio.h>
35#ifndef linux
36# include <sys/protosw.h>
37#endif
38#include <sys/socket.h>
39#if defined(_KERNEL) && !defined(linux)
40# include <sys/systm.h>
41#endif
42#if !defined(__SVR4) && !defined(__svr4__)
43# ifndef linux
44# include <sys/mbuf.h>
45# endif
46#else
47# include <sys/filio.h>
48# include <sys/byteorder.h>
49# ifdef _KERNEL
50# include <sys/dditypes.h>
51# endif
52# include <sys/stream.h>
53# include <sys/kmem.h>
54#endif
55#if __FreeBSD_version >= 300000
56# include <sys/queue.h>
57#endif
58#include <net/if.h>
59#if __FreeBSD_version >= 300000
60# include <net/if_var.h>
61# if defined(_KERNEL) && !defined(IPFILTER_LKM)
62# include "opt_ipfilter.h"
63# endif
64#endif
65#ifdef sun
66# include <net/af.h>
67#endif
68#include <net/route.h>
69#include <netinet/in.h>
70#include <netinet/in_systm.h>
71#include <netinet/ip.h>
72
73#ifdef __sgi
74# ifdef IFF_DRVRLOCK /* IRIX6 */
75#include <sys/hashing.h>
76#include <netinet/in_var.h>
77# endif
78#endif
79
80#ifdef RFC1825
81# include <vpn/md5.h>
82# include <vpn/ipsec.h>
83extern struct ifnet vpnif;
84#endif
85
86#ifndef linux
87# include <netinet/ip_var.h>
|
| 88# include <netinet/tcp_fsm.h>
|
94#endif
95#include <netinet/tcp.h>
96#include <netinet/udp.h>
97#include <netinet/ip_icmp.h>
98#include "netinet/ip_compat.h"
99#include <netinet/tcpip.h>
100#include "netinet/ip_fil.h"
101#include "netinet/ip_proxy.h"
102#include "netinet/ip_nat.h"
103#include "netinet/ip_frag.h"
104#include "netinet/ip_state.h"
105#if (__FreeBSD_version >= 300000)
106# include <sys/malloc.h>
107#endif
108#ifndef MIN
109# define MIN(a,b) (((a)<(b))?(a):(b))
110#endif
111#undef SOCKADDR_IN
112#define SOCKADDR_IN struct sockaddr_in
113
| 89#endif
90#include <netinet/tcp.h>
91#include <netinet/udp.h>
92#include <netinet/ip_icmp.h>
93#include "netinet/ip_compat.h"
94#include <netinet/tcpip.h>
95#include "netinet/ip_fil.h"
96#include "netinet/ip_proxy.h"
97#include "netinet/ip_nat.h"
98#include "netinet/ip_frag.h"
99#include "netinet/ip_state.h"
100#if (__FreeBSD_version >= 300000)
101# include <sys/malloc.h>
102#endif
103#ifndef MIN
104# define MIN(a,b) (((a)<(b))?(a):(b))
105#endif
106#undef SOCKADDR_IN
107#define SOCKADDR_IN struct sockaddr_in
108
|
| 109#if !defined(lint)
110static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
111/* static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.44 2001/07/21 07:17:22 darrenr Exp $"; */
112static const char rcsid[] = "@(#)$FreeBSD: head/sys/contrib/ipfilter/netinet/ip_nat.c 80482 2001-07-28 11:58:26Z darrenr $";
113#endif
114
|
114nat_t **nat_table[2] = { NULL, NULL },
115 *nat_instances = NULL;
116ipnat_t *nat_list = NULL;
117u_int ipf_nattable_sz = NAT_TABLE_SZ;
118u_int ipf_natrules_sz = NAT_SIZE;
119u_int ipf_rdrrules_sz = RDR_SIZE;
120u_int ipf_hostmap_sz = HOSTMAP_SIZE;
121u_32_t nat_masks = 0;
122u_32_t rdr_masks = 0;
123ipnat_t **nat_rules = NULL;
124ipnat_t **rdr_rules = NULL;
125hostmap_t **maptable = NULL;
126
127u_long fr_defnatage = DEF_NAT_AGE,
128 fr_defnaticmpage = 6; /* 3 seconds */
129natstat_t nat_stats;
130int fr_nat_lock = 0;
131#if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
132extern kmutex_t ipf_rw;
133extern KRWLOCK_T ipf_nat;
134#endif
135
136static int nat_flushtable __P((void));
137static int nat_clearlist __P((void));
138static void nat_addnat __P((struct ipnat *));
139static void nat_addrdr __P((struct ipnat *));
140static void nat_delete __P((struct nat *));
141static void nat_delrdr __P((struct ipnat *));
142static void nat_delnat __P((struct ipnat *));
143static int fr_natgetent __P((caddr_t));
144static int fr_natgetsz __P((caddr_t));
145static int fr_natputent __P((caddr_t));
146static void nat_tabmove __P((nat_t *, u_32_t));
147static int nat_match __P((fr_info_t *, ipnat_t *, ip_t *));
148static hostmap_t *nat_hostmap __P((ipnat_t *, struct in_addr,
149 struct in_addr));
150static void nat_hostmapdel __P((struct hostmap *));
151
152
153int nat_init()
154{
155 KMALLOCS(nat_table[0], nat_t **, sizeof(nat_t *) * ipf_nattable_sz);
156 if (nat_table[0] != NULL)
157 bzero((char *)nat_table[0], ipf_nattable_sz * sizeof(nat_t *));
158 else
159 return -1;
160
161 KMALLOCS(nat_table[1], nat_t **, sizeof(nat_t *) * ipf_nattable_sz);
162 if (nat_table[1] != NULL)
163 bzero((char *)nat_table[1], ipf_nattable_sz * sizeof(nat_t *));
164 else
165 return -1;
166
167 KMALLOCS(nat_rules, ipnat_t **, sizeof(ipnat_t *) * ipf_natrules_sz);
168 if (nat_rules != NULL)
169 bzero((char *)nat_rules, ipf_natrules_sz * sizeof(ipnat_t *));
170 else
171 return -1;
172
173 KMALLOCS(rdr_rules, ipnat_t **, sizeof(ipnat_t *) * ipf_rdrrules_sz);
174 if (rdr_rules != NULL)
175 bzero((char *)rdr_rules, ipf_rdrrules_sz * sizeof(ipnat_t *));
176 else
177 return -1;
178
179 KMALLOCS(maptable, hostmap_t **, sizeof(hostmap_t *) * ipf_hostmap_sz);
180 if (maptable != NULL)
181 bzero((char *)maptable, sizeof(hostmap_t *) * ipf_hostmap_sz);
182 else
183 return -1;
184 return 0;
185}
186
187
188static void nat_addrdr(n)
189ipnat_t *n;
190{
191 ipnat_t **np;
192 u_32_t j;
193 u_int hv;
194 int k;
195
196 k = countbits(n->in_outmsk);
197 if ((k >= 0) && (k != 32))
198 rdr_masks |= 1 << k;
199 j = (n->in_outip & n->in_outmsk);
200 hv = NAT_HASH_FN(j, 0, ipf_rdrrules_sz);
201 np = rdr_rules + hv;
202 while (*np != NULL)
203 np = &(*np)->in_rnext;
204 n->in_rnext = NULL;
205 n->in_prnext = np;
206 *np = n;
207}
208
209
210static void nat_addnat(n)
211ipnat_t *n;
212{
213 ipnat_t **np;
214 u_32_t j;
215 u_int hv;
216 int k;
217
218 k = countbits(n->in_inmsk);
219 if ((k >= 0) && (k != 32))
220 nat_masks |= 1 << k;
221 j = (n->in_inip & n->in_inmsk);
222 hv = NAT_HASH_FN(j, 0, ipf_natrules_sz);
223 np = nat_rules + hv;
224 while (*np != NULL)
225 np = &(*np)->in_mnext;
226 n->in_mnext = NULL;
227 n->in_pmnext = np;
228 *np = n;
229}
230
231
232static void nat_delrdr(n)
233ipnat_t *n;
234{
235 if (n->in_rnext)
236 n->in_rnext->in_prnext = n->in_prnext;
237 *n->in_prnext = n->in_rnext;
238}
239
240
241static void nat_delnat(n)
242ipnat_t *n;
243{
244 if (n->in_mnext)
245 n->in_mnext->in_pmnext = n->in_pmnext;
246 *n->in_pmnext = n->in_mnext;
247}
248
249
250/*
251 * check if an ip address has already been allocated for a given mapping that
252 * is not doing port based translation.
253 *
254 * Must be called with ipf_nat held as a write lock.
255 */
256static struct hostmap *nat_hostmap(np, real, map)
257ipnat_t *np;
258struct in_addr real;
259struct in_addr map;
260{
261 hostmap_t *hm;
262 u_int hv;
263
264 hv = real.s_addr % HOSTMAP_SIZE;
265 for (hm = maptable[hv]; hm; hm = hm->hm_next)
266 if ((hm->hm_realip.s_addr == real.s_addr) &&
267 (np == hm->hm_ipnat)) {
268 hm->hm_ref++;
269 return hm;
270 }
271
272 KMALLOC(hm, hostmap_t *);
273 if (hm) {
274 hm->hm_next = maptable[hv];
275 hm->hm_pnext = maptable + hv;
276 if (maptable[hv])
277 maptable[hv]->hm_pnext = &hm->hm_next;
278 maptable[hv] = hm;
279 hm->hm_ipnat = np;
280 hm->hm_realip = real;
281 hm->hm_mapip = map;
282 hm->hm_ref = 1;
283 }
284 return hm;
285}
286
287
288/*
289 * Must be called with ipf_nat held as a write lock.
290 */
291static void nat_hostmapdel(hm)
292struct hostmap *hm;
293{
294 ATOMIC_DEC32(hm->hm_ref);
295 if (hm->hm_ref == 0) {
296 if (hm->hm_next)
297 hm->hm_next->hm_pnext = hm->hm_pnext;
298 *hm->hm_pnext = hm->hm_next;
299 KFREE(hm);
300 }
301}
302
303
| 115nat_t **nat_table[2] = { NULL, NULL },
116 *nat_instances = NULL;
117ipnat_t *nat_list = NULL;
118u_int ipf_nattable_sz = NAT_TABLE_SZ;
119u_int ipf_natrules_sz = NAT_SIZE;
120u_int ipf_rdrrules_sz = RDR_SIZE;
121u_int ipf_hostmap_sz = HOSTMAP_SIZE;
122u_32_t nat_masks = 0;
123u_32_t rdr_masks = 0;
124ipnat_t **nat_rules = NULL;
125ipnat_t **rdr_rules = NULL;
126hostmap_t **maptable = NULL;
127
128u_long fr_defnatage = DEF_NAT_AGE,
129 fr_defnaticmpage = 6; /* 3 seconds */
130natstat_t nat_stats;
131int fr_nat_lock = 0;
132#if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
133extern kmutex_t ipf_rw;
134extern KRWLOCK_T ipf_nat;
135#endif
136
137static int nat_flushtable __P((void));
138static int nat_clearlist __P((void));
139static void nat_addnat __P((struct ipnat *));
140static void nat_addrdr __P((struct ipnat *));
141static void nat_delete __P((struct nat *));
142static void nat_delrdr __P((struct ipnat *));
143static void nat_delnat __P((struct ipnat *));
144static int fr_natgetent __P((caddr_t));
145static int fr_natgetsz __P((caddr_t));
146static int fr_natputent __P((caddr_t));
147static void nat_tabmove __P((nat_t *, u_32_t));
148static int nat_match __P((fr_info_t *, ipnat_t *, ip_t *));
149static hostmap_t *nat_hostmap __P((ipnat_t *, struct in_addr,
150 struct in_addr));
151static void nat_hostmapdel __P((struct hostmap *));
152
153
154int nat_init()
155{
156 KMALLOCS(nat_table[0], nat_t **, sizeof(nat_t *) * ipf_nattable_sz);
157 if (nat_table[0] != NULL)
158 bzero((char *)nat_table[0], ipf_nattable_sz * sizeof(nat_t *));
159 else
160 return -1;
161
162 KMALLOCS(nat_table[1], nat_t **, sizeof(nat_t *) * ipf_nattable_sz);
163 if (nat_table[1] != NULL)
164 bzero((char *)nat_table[1], ipf_nattable_sz * sizeof(nat_t *));
165 else
166 return -1;
167
168 KMALLOCS(nat_rules, ipnat_t **, sizeof(ipnat_t *) * ipf_natrules_sz);
169 if (nat_rules != NULL)
170 bzero((char *)nat_rules, ipf_natrules_sz * sizeof(ipnat_t *));
171 else
172 return -1;
173
174 KMALLOCS(rdr_rules, ipnat_t **, sizeof(ipnat_t *) * ipf_rdrrules_sz);
175 if (rdr_rules != NULL)
176 bzero((char *)rdr_rules, ipf_rdrrules_sz * sizeof(ipnat_t *));
177 else
178 return -1;
179
180 KMALLOCS(maptable, hostmap_t **, sizeof(hostmap_t *) * ipf_hostmap_sz);
181 if (maptable != NULL)
182 bzero((char *)maptable, sizeof(hostmap_t *) * ipf_hostmap_sz);
183 else
184 return -1;
185 return 0;
186}
187
188
189static void nat_addrdr(n)
190ipnat_t *n;
191{
192 ipnat_t **np;
193 u_32_t j;
194 u_int hv;
195 int k;
196
197 k = countbits(n->in_outmsk);
198 if ((k >= 0) && (k != 32))
199 rdr_masks |= 1 << k;
200 j = (n->in_outip & n->in_outmsk);
201 hv = NAT_HASH_FN(j, 0, ipf_rdrrules_sz);
202 np = rdr_rules + hv;
203 while (*np != NULL)
204 np = &(*np)->in_rnext;
205 n->in_rnext = NULL;
206 n->in_prnext = np;
207 *np = n;
208}
209
210
211static void nat_addnat(n)
212ipnat_t *n;
213{
214 ipnat_t **np;
215 u_32_t j;
216 u_int hv;
217 int k;
218
219 k = countbits(n->in_inmsk);
220 if ((k >= 0) && (k != 32))
221 nat_masks |= 1 << k;
222 j = (n->in_inip & n->in_inmsk);
223 hv = NAT_HASH_FN(j, 0, ipf_natrules_sz);
224 np = nat_rules + hv;
225 while (*np != NULL)
226 np = &(*np)->in_mnext;
227 n->in_mnext = NULL;
228 n->in_pmnext = np;
229 *np = n;
230}
231
232
233static void nat_delrdr(n)
234ipnat_t *n;
235{
236 if (n->in_rnext)
237 n->in_rnext->in_prnext = n->in_prnext;
238 *n->in_prnext = n->in_rnext;
239}
240
241
242static void nat_delnat(n)
243ipnat_t *n;
244{
245 if (n->in_mnext)
246 n->in_mnext->in_pmnext = n->in_pmnext;
247 *n->in_pmnext = n->in_mnext;
248}
249
250
251/*
252 * check if an ip address has already been allocated for a given mapping that
253 * is not doing port based translation.
254 *
255 * Must be called with ipf_nat held as a write lock.
256 */
257static struct hostmap *nat_hostmap(np, real, map)
258ipnat_t *np;
259struct in_addr real;
260struct in_addr map;
261{
262 hostmap_t *hm;
263 u_int hv;
264
265 hv = real.s_addr % HOSTMAP_SIZE;
266 for (hm = maptable[hv]; hm; hm = hm->hm_next)
267 if ((hm->hm_realip.s_addr == real.s_addr) &&
268 (np == hm->hm_ipnat)) {
269 hm->hm_ref++;
270 return hm;
271 }
272
273 KMALLOC(hm, hostmap_t *);
274 if (hm) {
275 hm->hm_next = maptable[hv];
276 hm->hm_pnext = maptable + hv;
277 if (maptable[hv])
278 maptable[hv]->hm_pnext = &hm->hm_next;
279 maptable[hv] = hm;
280 hm->hm_ipnat = np;
281 hm->hm_realip = real;
282 hm->hm_mapip = map;
283 hm->hm_ref = 1;
284 }
285 return hm;
286}
287
288
289/*
290 * Must be called with ipf_nat held as a write lock.
291 */
292static void nat_hostmapdel(hm)
293struct hostmap *hm;
294{
295 ATOMIC_DEC32(hm->hm_ref);
296 if (hm->hm_ref == 0) {
297 if (hm->hm_next)
298 hm->hm_next->hm_pnext = hm->hm_pnext;
299 *hm->hm_pnext = hm->hm_next;
300 KFREE(hm);
301 }
302}
303
304
|
304void fix_outcksum(sp, n)
| 305void fix_outcksum(fin, sp, n)
306fr_info_t *fin;
|
305u_short *sp;
306u_32_t n;
307{
308 register u_short sumshort;
309 register u_32_t sum1;
310
311 if (!n)
312 return;
| 307u_short *sp;
308u_32_t n;
309{
310 register u_short sumshort;
311 register u_32_t sum1;
312
313 if (!n)
314 return;
|
313#if SOLARIS2 >= 6
| |
314 else if (n & NAT_HW_CKSUM) {
| 315 else if (n & NAT_HW_CKSUM) {
|
| 316 n &= 0xffff;
317 n += fin->fin_dlen;
318 n = (n & 0xffff) + (n >> 16);
|
315 *sp = n & 0xffff;
316 return;
317 }
| 319 *sp = n & 0xffff;
320 return;
321 }
|
318#endif
| |
319 sum1 = (~ntohs(*sp)) & 0xffff;
320 sum1 += (n);
321 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
322 /* Again */
323 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
324 sumshort = ~(u_short)sum1;
325 *(sp) = htons(sumshort);
326}
327
328
| 322 sum1 = (~ntohs(*sp)) & 0xffff;
323 sum1 += (n);
324 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
325 /* Again */
326 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
327 sumshort = ~(u_short)sum1;
328 *(sp) = htons(sumshort);
329}
330
331
|
329void fix_incksum(sp, n)
| 332void fix_incksum(fin, sp, n)
333fr_info_t *fin;
|
330u_short *sp;
331u_32_t n;
332{
333 register u_short sumshort;
334 register u_32_t sum1;
335
336 if (!n)
337 return;
| 334u_short *sp;
335u_32_t n;
336{
337 register u_short sumshort;
338 register u_32_t sum1;
339
340 if (!n)
341 return;
|
338#if SOLARIS2 >= 6
| |
339 else if (n & NAT_HW_CKSUM) {
| 342 else if (n & NAT_HW_CKSUM) {
|
| 343 n &= 0xffff;
344 n += fin->fin_dlen;
345 n = (n & 0xffff) + (n >> 16);
|
340 *sp = n & 0xffff;
341 return;
342 }
| 346 *sp = n & 0xffff;
347 return;
348 }
|
343#endif
| |
344#ifdef sparc
345 sum1 = (~(*sp)) & 0xffff;
346#else
347 sum1 = (~ntohs(*sp)) & 0xffff;
348#endif
349 sum1 += ~(n) & 0xffff;
350 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
351 /* Again */
352 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
353 sumshort = ~(u_short)sum1;
354 *(sp) = htons(sumshort);
355}
356
357
358/*
359 * fix_datacksum is used *only* for the adjustments of checksums in the data
360 * section of an IP packet.
361 *
362 * The only situation in which you need to do this is when NAT'ing an
363 * ICMP error message. Such a message, contains in its body the IP header
364 * of the original IP packet, that causes the error.
365 *
366 * You can't use fix_incksum or fix_outcksum in that case, because for the
367 * kernel the data section of the ICMP error is just data, and no special
368 * processing like hardware cksum or ntohs processing have been done by the
369 * kernel on the data section.
370 */
371void fix_datacksum(sp, n)
372u_short *sp;
373u_32_t n;
374{
375 register u_short sumshort;
376 register u_32_t sum1;
377
378 if (!n)
379 return;
380
381 sum1 = (~ntohs(*sp)) & 0xffff;
382 sum1 += (n);
383 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
384 /* Again */
385 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
386 sumshort = ~(u_short)sum1;
387 *(sp) = htons(sumshort);
388}
389
390/*
391 * How the NAT is organised and works.
392 *
393 * Inside (interface y) NAT Outside (interface x)
394 * -------------------- -+- -------------------------------------
395 * Packet going | out, processsed by ip_natout() for x
396 * ------------> | ------------>
397 * src=10.1.1.1 | src=192.1.1.1
398 * |
399 * | in, processed by ip_natin() for x
400 * <------------ | <------------
401 * dst=10.1.1.1 | dst=192.1.1.1
402 * -------------------- -+- -------------------------------------
403 * ip_natout() - changes ip_src and if required, sport
404 * - creates a new mapping, if required.
405 * ip_natin() - changes ip_dst and if required, dport
406 *
407 * In the NAT table, internal source is recorded as "in" and externally
408 * seen as "out".
409 */
410
411/*
412 * Handle ioctls which manipulate the NAT.
413 */
414int nat_ioctl(data, cmd, mode)
415#if defined(__NetBSD__) || defined(__OpenBSD__) || (__FreeBSD_version >= 300003)
416u_long cmd;
417#else
418int cmd;
419#endif
420caddr_t data;
421int mode;
422{
423 register ipnat_t *nat, *nt, *n = NULL, **np = NULL;
424 int error = 0, ret, arg;
425 ipnat_t natd;
426 u_32_t i, j;
427
428#if (BSD >= 199306) && defined(_KERNEL)
429 if ((securelevel >= 2) && (mode & FWRITE))
430 return EPERM;
431#endif
432
433 nat = NULL; /* XXX gcc -Wuninitialized */
434 KMALLOC(nt, ipnat_t *);
435 if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT))
436 error = IRCOPYPTR(data, (char *)&natd, sizeof(natd));
437 else if (cmd == SIOCIPFFL) { /* SIOCFLNAT & SIOCCNATL */
438 error = IRCOPY(data, (char *)&arg, sizeof(arg));
439 if (error)
440 error = EFAULT;
441 }
442
443 if (error)
444 goto done;
445
446 /*
447 * For add/delete, look to see if the NAT entry is already present
448 */
449 WRITE_ENTER(&ipf_nat);
450 if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT)) {
451 nat = &natd;
452 nat->in_flags &= IPN_USERFLAGS;
453 if ((nat->in_redir & NAT_MAPBLK) == 0) {
454 if ((nat->in_flags & IPN_SPLIT) == 0)
455 nat->in_inip &= nat->in_inmsk;
456 if ((nat->in_flags & IPN_IPRANGE) == 0)
457 nat->in_outip &= nat->in_outmsk;
458 }
459 for (np = &nat_list; (n = *np); np = &n->in_next)
460 if (!bcmp((char *)&nat->in_flags, (char *)&n->in_flags,
461 IPN_CMPSIZ))
462 break;
463 }
464
465 switch (cmd)
466 {
467#ifdef IPFILTER_LOG
468 case SIOCIPFFB :
469 {
470 int tmp;
471
472 if (!(mode & FWRITE))
473 error = EPERM;
474 else {
475 tmp = ipflog_clear(IPL_LOGNAT);
476 IWCOPY((char *)&tmp, (char *)data, sizeof(tmp));
477 }
478 break;
479 }
480#endif
481 case SIOCADNAT :
482 if (!(mode & FWRITE)) {
483 error = EPERM;
484 break;
485 }
486 if (n) {
487 error = EEXIST;
488 break;
489 }
490 if (nt == NULL) {
491 error = ENOMEM;
492 break;
493 }
494 n = nt;
495 nt = NULL;
496 bcopy((char *)nat, (char *)n, sizeof(*n));
497 n->in_ifp = (void *)GETUNIT(n->in_ifname, 4);
498 if (!n->in_ifp)
499 n->in_ifp = (void *)-1;
500 if (n->in_plabel[0] != '\0') {
501 n->in_apr = appr_match(n->in_p, n->in_plabel);
502 if (!n->in_apr) {
503 error = ENOENT;
504 break;
505 }
506 }
507 n->in_next = NULL;
508 *np = n;
509
510 if (n->in_redir & NAT_REDIRECT) {
511 n->in_flags &= ~IPN_NOTDST;
512 nat_addrdr(n);
513 }
514 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
515 n->in_flags &= ~IPN_NOTSRC;
516 nat_addnat(n);
517 }
518
519 n->in_use = 0;
520 if (n->in_redir & NAT_MAPBLK)
521 n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk);
522 else if (n->in_flags & IPN_AUTOPORTMAP)
523 n->in_space = USABLE_PORTS * ~ntohl(n->in_inmsk);
524 else if (n->in_flags & IPN_IPRANGE)
525 n->in_space = ntohl(n->in_outmsk) - ntohl(n->in_outip);
526 else if (n->in_flags & IPN_SPLIT)
527 n->in_space = 2;
528 else
529 n->in_space = ~ntohl(n->in_outmsk);
530 /*
531 * Calculate the number of valid IP addresses in the output
532 * mapping range. In all cases, the range is inclusive of
533 * the start and ending IP addresses.
534 * If to a CIDR address, lose 2: broadcast + network address
535 * (so subtract 1)
536 * If to a range, add one.
537 * If to a single IP address, set to 1.
538 */
539 if (n->in_space) {
540 if ((n->in_flags & IPN_IPRANGE) != 0)
541 n->in_space += 1;
542 else
543 n->in_space -= 1;
544 } else
545 n->in_space = 1;
546 if ((n->in_outmsk != 0xffffffff) && (n->in_outmsk != 0) &&
547 ((n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0))
548 n->in_nip = ntohl(n->in_outip) + 1;
549 else if ((n->in_flags & IPN_SPLIT) &&
550 (n->in_redir & NAT_REDIRECT))
551 n->in_nip = ntohl(n->in_inip);
552 else
553 n->in_nip = ntohl(n->in_outip);
554 if (n->in_redir & NAT_MAP) {
555 n->in_pnext = ntohs(n->in_pmin);
556 /*
557 * Multiply by the number of ports made available.
558 */
559 if (ntohs(n->in_pmax) >= ntohs(n->in_pmin)) {
560 n->in_space *= (ntohs(n->in_pmax) -
561 ntohs(n->in_pmin) + 1);
562 /*
563 * Because two different sources can map to
564 * different destinations but use the same
565 * local IP#/port #.
566 * If the result is smaller than in_space, then
567 * we may have wrapped around 32bits.
568 */
569 i = n->in_inmsk;
570 if ((i != 0) && (i != 0xffffffff)) {
571 j = n->in_space * (~ntohl(i) + 1);
572 if (j >= n->in_space)
573 n->in_space = j;
574 else
575 n->in_space = 0xffffffff;
576 }
577 }
578 /*
579 * If no protocol is specified, multiple by 256.
580 */
581 if ((n->in_flags & IPN_TCPUDP) == 0) {
582 j = n->in_space * 256;
583 if (j >= n->in_space)
584 n->in_space = j;
585 else
586 n->in_space = 0xffffffff;
587 }
588 }
589 /* Otherwise, these fields are preset */
590 n = NULL;
591 nat_stats.ns_rules++;
592 break;
593 case SIOCRMNAT :
594 if (!(mode & FWRITE)) {
595 error = EPERM;
596 n = NULL;
597 break;
598 }
599 if (!n) {
600 error = ESRCH;
601 break;
602 }
603 if (n->in_redir & NAT_REDIRECT)
604 nat_delrdr(n);
605 if (n->in_redir & (NAT_MAPBLK|NAT_MAP))
606 nat_delnat(n);
607 if (nat_list == NULL) {
608 nat_masks = 0;
609 rdr_masks = 0;
610 }
611 *np = n->in_next;
612 if (!n->in_use) {
613 if (n->in_apr)
614 appr_free(n->in_apr);
615 KFREE(n);
616 nat_stats.ns_rules--;
617 } else {
618 n->in_flags |= IPN_DELETE;
619 n->in_next = NULL;
620 }
621 n = NULL;
622 break;
623 case SIOCGNATS :
624 MUTEX_DOWNGRADE(&ipf_nat);
625 nat_stats.ns_table[0] = nat_table[0];
626 nat_stats.ns_table[1] = nat_table[1];
627 nat_stats.ns_list = nat_list;
| 349#ifdef sparc
350 sum1 = (~(*sp)) & 0xffff;
351#else
352 sum1 = (~ntohs(*sp)) & 0xffff;
353#endif
354 sum1 += ~(n) & 0xffff;
355 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
356 /* Again */
357 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
358 sumshort = ~(u_short)sum1;
359 *(sp) = htons(sumshort);
360}
361
362
363/*
364 * fix_datacksum is used *only* for the adjustments of checksums in the data
365 * section of an IP packet.
366 *
367 * The only situation in which you need to do this is when NAT'ing an
368 * ICMP error message. Such a message, contains in its body the IP header
369 * of the original IP packet, that causes the error.
370 *
371 * You can't use fix_incksum or fix_outcksum in that case, because for the
372 * kernel the data section of the ICMP error is just data, and no special
373 * processing like hardware cksum or ntohs processing have been done by the
374 * kernel on the data section.
375 */
376void fix_datacksum(sp, n)
377u_short *sp;
378u_32_t n;
379{
380 register u_short sumshort;
381 register u_32_t sum1;
382
383 if (!n)
384 return;
385
386 sum1 = (~ntohs(*sp)) & 0xffff;
387 sum1 += (n);
388 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
389 /* Again */
390 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
391 sumshort = ~(u_short)sum1;
392 *(sp) = htons(sumshort);
393}
394
395/*
396 * How the NAT is organised and works.
397 *
398 * Inside (interface y) NAT Outside (interface x)
399 * -------------------- -+- -------------------------------------
400 * Packet going | out, processsed by ip_natout() for x
401 * ------------> | ------------>
402 * src=10.1.1.1 | src=192.1.1.1
403 * |
404 * | in, processed by ip_natin() for x
405 * <------------ | <------------
406 * dst=10.1.1.1 | dst=192.1.1.1
407 * -------------------- -+- -------------------------------------
408 * ip_natout() - changes ip_src and if required, sport
409 * - creates a new mapping, if required.
410 * ip_natin() - changes ip_dst and if required, dport
411 *
412 * In the NAT table, internal source is recorded as "in" and externally
413 * seen as "out".
414 */
415
416/*
417 * Handle ioctls which manipulate the NAT.
418 */
419int nat_ioctl(data, cmd, mode)
420#if defined(__NetBSD__) || defined(__OpenBSD__) || (__FreeBSD_version >= 300003)
421u_long cmd;
422#else
423int cmd;
424#endif
425caddr_t data;
426int mode;
427{
428 register ipnat_t *nat, *nt, *n = NULL, **np = NULL;
429 int error = 0, ret, arg;
430 ipnat_t natd;
431 u_32_t i, j;
432
433#if (BSD >= 199306) && defined(_KERNEL)
434 if ((securelevel >= 2) && (mode & FWRITE))
435 return EPERM;
436#endif
437
438 nat = NULL; /* XXX gcc -Wuninitialized */
439 KMALLOC(nt, ipnat_t *);
440 if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT))
441 error = IRCOPYPTR(data, (char *)&natd, sizeof(natd));
442 else if (cmd == SIOCIPFFL) { /* SIOCFLNAT & SIOCCNATL */
443 error = IRCOPY(data, (char *)&arg, sizeof(arg));
444 if (error)
445 error = EFAULT;
446 }
447
448 if (error)
449 goto done;
450
451 /*
452 * For add/delete, look to see if the NAT entry is already present
453 */
454 WRITE_ENTER(&ipf_nat);
455 if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT)) {
456 nat = &natd;
457 nat->in_flags &= IPN_USERFLAGS;
458 if ((nat->in_redir & NAT_MAPBLK) == 0) {
459 if ((nat->in_flags & IPN_SPLIT) == 0)
460 nat->in_inip &= nat->in_inmsk;
461 if ((nat->in_flags & IPN_IPRANGE) == 0)
462 nat->in_outip &= nat->in_outmsk;
463 }
464 for (np = &nat_list; (n = *np); np = &n->in_next)
465 if (!bcmp((char *)&nat->in_flags, (char *)&n->in_flags,
466 IPN_CMPSIZ))
467 break;
468 }
469
470 switch (cmd)
471 {
472#ifdef IPFILTER_LOG
473 case SIOCIPFFB :
474 {
475 int tmp;
476
477 if (!(mode & FWRITE))
478 error = EPERM;
479 else {
480 tmp = ipflog_clear(IPL_LOGNAT);
481 IWCOPY((char *)&tmp, (char *)data, sizeof(tmp));
482 }
483 break;
484 }
485#endif
486 case SIOCADNAT :
487 if (!(mode & FWRITE)) {
488 error = EPERM;
489 break;
490 }
491 if (n) {
492 error = EEXIST;
493 break;
494 }
495 if (nt == NULL) {
496 error = ENOMEM;
497 break;
498 }
499 n = nt;
500 nt = NULL;
501 bcopy((char *)nat, (char *)n, sizeof(*n));
502 n->in_ifp = (void *)GETUNIT(n->in_ifname, 4);
503 if (!n->in_ifp)
504 n->in_ifp = (void *)-1;
505 if (n->in_plabel[0] != '\0') {
506 n->in_apr = appr_match(n->in_p, n->in_plabel);
507 if (!n->in_apr) {
508 error = ENOENT;
509 break;
510 }
511 }
512 n->in_next = NULL;
513 *np = n;
514
515 if (n->in_redir & NAT_REDIRECT) {
516 n->in_flags &= ~IPN_NOTDST;
517 nat_addrdr(n);
518 }
519 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
520 n->in_flags &= ~IPN_NOTSRC;
521 nat_addnat(n);
522 }
523
524 n->in_use = 0;
525 if (n->in_redir & NAT_MAPBLK)
526 n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk);
527 else if (n->in_flags & IPN_AUTOPORTMAP)
528 n->in_space = USABLE_PORTS * ~ntohl(n->in_inmsk);
529 else if (n->in_flags & IPN_IPRANGE)
530 n->in_space = ntohl(n->in_outmsk) - ntohl(n->in_outip);
531 else if (n->in_flags & IPN_SPLIT)
532 n->in_space = 2;
533 else
534 n->in_space = ~ntohl(n->in_outmsk);
535 /*
536 * Calculate the number of valid IP addresses in the output
537 * mapping range. In all cases, the range is inclusive of
538 * the start and ending IP addresses.
539 * If to a CIDR address, lose 2: broadcast + network address
540 * (so subtract 1)
541 * If to a range, add one.
542 * If to a single IP address, set to 1.
543 */
544 if (n->in_space) {
545 if ((n->in_flags & IPN_IPRANGE) != 0)
546 n->in_space += 1;
547 else
548 n->in_space -= 1;
549 } else
550 n->in_space = 1;
551 if ((n->in_outmsk != 0xffffffff) && (n->in_outmsk != 0) &&
552 ((n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0))
553 n->in_nip = ntohl(n->in_outip) + 1;
554 else if ((n->in_flags & IPN_SPLIT) &&
555 (n->in_redir & NAT_REDIRECT))
556 n->in_nip = ntohl(n->in_inip);
557 else
558 n->in_nip = ntohl(n->in_outip);
559 if (n->in_redir & NAT_MAP) {
560 n->in_pnext = ntohs(n->in_pmin);
561 /*
562 * Multiply by the number of ports made available.
563 */
564 if (ntohs(n->in_pmax) >= ntohs(n->in_pmin)) {
565 n->in_space *= (ntohs(n->in_pmax) -
566 ntohs(n->in_pmin) + 1);
567 /*
568 * Because two different sources can map to
569 * different destinations but use the same
570 * local IP#/port #.
571 * If the result is smaller than in_space, then
572 * we may have wrapped around 32bits.
573 */
574 i = n->in_inmsk;
575 if ((i != 0) && (i != 0xffffffff)) {
576 j = n->in_space * (~ntohl(i) + 1);
577 if (j >= n->in_space)
578 n->in_space = j;
579 else
580 n->in_space = 0xffffffff;
581 }
582 }
583 /*
584 * If no protocol is specified, multiple by 256.
585 */
586 if ((n->in_flags & IPN_TCPUDP) == 0) {
587 j = n->in_space * 256;
588 if (j >= n->in_space)
589 n->in_space = j;
590 else
591 n->in_space = 0xffffffff;
592 }
593 }
594 /* Otherwise, these fields are preset */
595 n = NULL;
596 nat_stats.ns_rules++;
597 break;
598 case SIOCRMNAT :
599 if (!(mode & FWRITE)) {
600 error = EPERM;
601 n = NULL;
602 break;
603 }
604 if (!n) {
605 error = ESRCH;
606 break;
607 }
608 if (n->in_redir & NAT_REDIRECT)
609 nat_delrdr(n);
610 if (n->in_redir & (NAT_MAPBLK|NAT_MAP))
611 nat_delnat(n);
612 if (nat_list == NULL) {
613 nat_masks = 0;
614 rdr_masks = 0;
615 }
616 *np = n->in_next;
617 if (!n->in_use) {
618 if (n->in_apr)
619 appr_free(n->in_apr);
620 KFREE(n);
621 nat_stats.ns_rules--;
622 } else {
623 n->in_flags |= IPN_DELETE;
624 n->in_next = NULL;
625 }
626 n = NULL;
627 break;
628 case SIOCGNATS :
629 MUTEX_DOWNGRADE(&ipf_nat);
630 nat_stats.ns_table[0] = nat_table[0];
631 nat_stats.ns_table[1] = nat_table[1];
632 nat_stats.ns_list = nat_list;
|
| 633 nat_stats.ns_maptable = maptable;
|
628 nat_stats.ns_nattab_sz = ipf_nattable_sz;
629 nat_stats.ns_rultab_sz = ipf_natrules_sz;
630 nat_stats.ns_rdrtab_sz = ipf_rdrrules_sz;
| 634 nat_stats.ns_nattab_sz = ipf_nattable_sz;
635 nat_stats.ns_rultab_sz = ipf_natrules_sz;
636 nat_stats.ns_rdrtab_sz = ipf_rdrrules_sz;
|
| 637 nat_stats.ns_hostmap_sz = ipf_hostmap_sz;
|
631 nat_stats.ns_instances = nat_instances;
632 nat_stats.ns_apslist = ap_sess_list;
633 error = IWCOPYPTR((char *)&nat_stats, (char *)data,
634 sizeof(nat_stats));
635 break;
636 case SIOCGNATL :
637 {
638 natlookup_t nl;
639
640 MUTEX_DOWNGRADE(&ipf_nat);
641 error = IRCOPYPTR((char *)data, (char *)&nl, sizeof(nl));
642 if (error)
643 break;
644
645 if (nat_lookupredir(&nl)) {
646 error = IWCOPYPTR((char *)&nl, (char *)data,
647 sizeof(nl));
648 } else
649 error = ESRCH;
650 break;
651 }
652 case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */
653 if (!(mode & FWRITE)) {
654 error = EPERM;
655 break;
656 }
657 error = 0;
658 if (arg == 0)
659 ret = nat_flushtable();
660 else if (arg == 1)
661 ret = nat_clearlist();
662 else
663 error = EINVAL;
664 MUTEX_DOWNGRADE(&ipf_nat);
665 if (!error) {
666 error = IWCOPY((caddr_t)&ret, data, sizeof(ret));
667 if (error)
668 error = EFAULT;
669 }
670 break;
671 case SIOCSTLCK :
672 error = IRCOPY(data, (caddr_t)&arg, sizeof(arg));
673 if (!error) {
674 error = IWCOPY((caddr_t)&fr_nat_lock, data,
675 sizeof(fr_nat_lock));
676 if (!error)
677 fr_nat_lock = arg;
678 } else
679 error = EFAULT;
680 break;
681 case SIOCSTPUT :
682 if (fr_nat_lock)
683 error = fr_natputent(data);
684 else
685 error = EACCES;
686 break;
687 case SIOCSTGSZ :
688 if (fr_nat_lock)
689 error = fr_natgetsz(data);
690 else
691 error = EACCES;
692 break;
693 case SIOCSTGET :
694 if (fr_nat_lock)
695 error = fr_natgetent(data);
696 else
697 error = EACCES;
698 break;
699 case FIONREAD :
700#ifdef IPFILTER_LOG
701 arg = (int)iplused[IPL_LOGNAT];
702 MUTEX_DOWNGRADE(&ipf_nat);
703 error = IWCOPY((caddr_t)&arg, (caddr_t)data, sizeof(arg));
704 if (error)
705 error = EFAULT;
706#endif
707 break;
708 default :
709 error = EINVAL;
710 break;
711 }
712 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */
713done:
714 if (nt)
715 KFREE(nt);
716 return error;
717}
718
719
720static int fr_natgetsz(data)
721caddr_t data;
722{
723 ap_session_t *aps;
724 nat_t *nat, *n;
725 int error = 0;
726 natget_t ng;
727
728 error = IRCOPY(data, (caddr_t)&ng, sizeof(ng));
729 if (error)
730 return EFAULT;
731
732 nat = ng.ng_ptr;
733 if (!nat) {
734 nat = nat_instances;
735 ng.ng_sz = 0;
736 if (nat == NULL) {
737 error = IWCOPY((caddr_t)&ng, data, sizeof(ng));
738 if (error)
739 error = EFAULT;
740 return error;
741 }
742 } else {
743 /*
744 * Make sure the pointer we're copying from exists in the
745 * current list of entries. Security precaution to prevent
746 * copying of random kernel data.
747 */
748 for (n = nat_instances; n; n = n->nat_next)
749 if (n == nat)
750 break;
751 if (!n)
752 return ESRCH;
753 }
754
755 ng.ng_sz = sizeof(nat_save_t);
756 aps = nat->nat_aps;
757 if ((aps != NULL) && (aps->aps_data != 0)) {
758 ng.ng_sz += sizeof(ap_session_t);
759 ng.ng_sz += aps->aps_psiz;
760 }
761
762 error = IWCOPY((caddr_t)&ng, data, sizeof(ng));
763 if (error)
764 error = EFAULT;
765 return error;
766}
767
768
769static int fr_natgetent(data)
770caddr_t data;
771{
772 nat_save_t ipn, *ipnp, *ipnn = NULL;
773 register nat_t *n, *nat;
774 ap_session_t *aps;
775 int error;
776
777 error = IRCOPY(data, (caddr_t)&ipnp, sizeof(ipnp));
778 if (error)
779 return EFAULT;
780 error = IRCOPY((caddr_t)ipnp, (caddr_t)&ipn, sizeof(ipn));
781 if (error)
782 return EFAULT;
783
784 nat = ipn.ipn_next;
785 if (!nat) {
786 nat = nat_instances;
787 if (nat == NULL) {
788 if (nat_instances == NULL)
789 return ENOENT;
790 return 0;
791 }
792 } else {
793 /*
794 * Make sure the pointer we're copying from exists in the
795 * current list of entries. Security precaution to prevent
796 * copying of random kernel data.
797 */
798 for (n = nat_instances; n; n = n->nat_next)
799 if (n == nat)
800 break;
801 if (!n)
802 return ESRCH;
803 }
804
805 ipn.ipn_next = nat->nat_next;
806 ipn.ipn_dsize = 0;
807 bcopy((char *)nat, (char *)&ipn.ipn_nat, sizeof(ipn.ipn_nat));
808 ipn.ipn_nat.nat_data = NULL;
809
810 if (nat->nat_ptr) {
811 bcopy((char *)nat->nat_ptr, (char *)&ipn.ipn_ipnat,
812 sizeof(ipn.ipn_ipnat));
813 }
814
815 if (nat->nat_fr)
816 bcopy((char *)nat->nat_fr, (char *)&ipn.ipn_rule,
817 sizeof(ipn.ipn_rule));
818
819 if ((aps = nat->nat_aps)) {
820 ipn.ipn_dsize = sizeof(*aps);
821 if (aps->aps_data)
822 ipn.ipn_dsize += aps->aps_psiz;
823 KMALLOCS(ipnn, nat_save_t *, sizeof(*ipnn) + ipn.ipn_dsize);
824 if (ipnn == NULL)
825 return ENOMEM;
826 bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn));
827
828 bcopy((char *)aps, ipnn->ipn_data, sizeof(*aps));
829 if (aps->aps_data) {
830 bcopy(aps->aps_data, ipnn->ipn_data + sizeof(*aps),
831 aps->aps_psiz);
832 ipnn->ipn_dsize += aps->aps_psiz;
833 }
834 error = IWCOPY((caddr_t)ipnn, ipnp,
835 sizeof(ipn) + ipn.ipn_dsize);
836 if (error)
837 error = EFAULT;
838 KFREES(ipnn, sizeof(*ipnn) + ipn.ipn_dsize);
839 } else {
840 error = IWCOPY((caddr_t)&ipn, ipnp, sizeof(ipn));
841 if (error)
842 error = EFAULT;
843 }
844 return error;
845}
846
847
848static int fr_natputent(data)
849caddr_t data;
850{
851 nat_save_t ipn, *ipnp, *ipnn = NULL;
852 register nat_t *n, *nat;
853 ap_session_t *aps;
854 frentry_t *fr;
855 ipnat_t *in;
856
857 int error;
858
859 error = IRCOPY(data, (caddr_t)&ipnp, sizeof(ipnp));
860 if (error)
861 return EFAULT;
862 error = IRCOPY((caddr_t)ipnp, (caddr_t)&ipn, sizeof(ipn));
863 if (error)
864 return EFAULT;
865 nat = NULL;
866 if (ipn.ipn_dsize) {
867 KMALLOCS(ipnn, nat_save_t *, sizeof(ipn) + ipn.ipn_dsize);
868 if (ipnn == NULL)
869 return ENOMEM;
870 bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn));
871 error = IRCOPY((caddr_t)ipnp, (caddr_t)ipn.ipn_data,
872 ipn.ipn_dsize);
873 if (error) {
874 error = EFAULT;
875 goto junkput;
876 }
877 } else
878 ipnn = NULL;
879
880 KMALLOC(nat, nat_t *);
881 if (nat == NULL) {
882 error = EFAULT;
883 goto junkput;
884 }
885
886 bcopy((char *)&ipn.ipn_nat, (char *)nat, sizeof(*nat));
887 /*
888 * Initialize all these so that nat_delete() doesn't cause a crash.
889 */
890 nat->nat_phnext[0] = NULL;
891 nat->nat_phnext[1] = NULL;
892 fr = nat->nat_fr;
893 nat->nat_fr = NULL;
894 aps = nat->nat_aps;
895 nat->nat_aps = NULL;
896 in = nat->nat_ptr;
897 nat->nat_ptr = NULL;
898 nat->nat_data = NULL;
899
900 /*
901 * Restore the rule associated with this nat session
902 */
903 if (in) {
904 KMALLOC(in, ipnat_t *);
905 if (in == NULL) {
906 error = ENOMEM;
907 goto junkput;
908 }
909 nat->nat_ptr = in;
910 bcopy((char *)&ipn.ipn_ipnat, (char *)in, sizeof(*in));
911 in->in_use = 1;
912 in->in_flags |= IPN_DELETE;
913 in->in_next = NULL;
914 in->in_rnext = NULL;
915 in->in_prnext = NULL;
916 in->in_mnext = NULL;
917 in->in_pmnext = NULL;
918 in->in_ifp = GETUNIT(in->in_ifname, 4);
919 if (in->in_plabel[0] != '\0') {
920 in->in_apr = appr_match(in->in_p, in->in_plabel);
921 }
922 }
923
924 /*
925 * Restore ap_session_t structure. Include the private data allocated
926 * if it was there.
927 */
928 if (aps) {
929 KMALLOC(aps, ap_session_t *);
930 if (aps == NULL) {
931 error = ENOMEM;
932 goto junkput;
933 }
934 nat->nat_aps = aps;
935 aps->aps_next = ap_sess_list;
936 ap_sess_list = aps;
937 bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps));
938 if (in)
939 aps->aps_apr = in->in_apr;
940 if (aps->aps_psiz) {
941 KMALLOCS(aps->aps_data, void *, aps->aps_psiz);
942 if (aps->aps_data == NULL) {
943 error = ENOMEM;
944 goto junkput;
945 }
946 bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data,
947 aps->aps_psiz);
948 } else {
949 aps->aps_psiz = 0;
950 aps->aps_data = NULL;
951 }
952 }
953
954 /*
955 * If there was a filtering rule associated with this entry then
956 * build up a new one.
957 */
958 if (fr != NULL) {
959 if (nat->nat_flags & FI_NEWFR) {
960 KMALLOC(fr, frentry_t *);
961 nat->nat_fr = fr;
962 if (fr == NULL) {
963 error = ENOMEM;
964 goto junkput;
965 }
966 bcopy((char *)&ipn.ipn_fr, (char *)fr, sizeof(*fr));
967 ipn.ipn_nat.nat_fr = fr;
968 error = IWCOPY((caddr_t)&ipn, ipnp, sizeof(ipn));
969 if (error) {
970 error = EFAULT;
971 goto junkput;
972 }
973 } else {
974 for (n = nat_instances; n; n = n->nat_next)
975 if (n->nat_fr == fr)
976 break;
977 if (!n) {
978 error = ESRCH;
979 goto junkput;
980 }
981 }
982 }
983
984 if (ipnn)
985 KFREES(ipnn, sizeof(ipn) + ipn.ipn_dsize);
986 nat_insert(nat);
987 return 0;
988junkput:
989 if (ipnn)
990 KFREES(ipnn, sizeof(ipn) + ipn.ipn_dsize);
991 if (nat)
992 nat_delete(nat);
993 return error;
994}
995
996
997/*
998 * Delete a nat entry from the various lists and table.
999 */
1000static void nat_delete(natd)
1001struct nat *natd;
1002{
1003 struct ipnat *ipn;
1004
1005 if (natd->nat_flags & FI_WILDP)
1006 nat_stats.ns_wilds--;
1007 if (natd->nat_hnext[0])
1008 natd->nat_hnext[0]->nat_phnext[0] = natd->nat_phnext[0];
1009 *natd->nat_phnext[0] = natd->nat_hnext[0];
1010 if (natd->nat_hnext[1])
1011 natd->nat_hnext[1]->nat_phnext[1] = natd->nat_phnext[1];
1012 *natd->nat_phnext[1] = natd->nat_hnext[1];
1013
1014 if (natd->nat_fr != NULL) {
1015 ATOMIC_DEC32(natd->nat_fr->fr_ref);
1016 }
1017
1018 if (natd->nat_hm != NULL)
1019 nat_hostmapdel(natd->nat_hm);
1020
1021 /*
1022 * If there is an active reference from the nat entry to its parent
1023 * rule, decrement the rule's reference count and free it too if no
1024 * longer being used.
1025 */
1026 ipn = natd->nat_ptr;
1027 if (ipn != NULL) {
1028 ipn->in_space++;
1029 ipn->in_use--;
1030 if (!ipn->in_use && (ipn->in_flags & IPN_DELETE)) {
1031 if (ipn->in_apr)
1032 appr_free(ipn->in_apr);
1033 KFREE(ipn);
1034 nat_stats.ns_rules--;
1035 }
1036 }
1037
1038 MUTEX_DESTROY(&natd->nat_lock);
1039 /*
1040 * If there's a fragment table entry too for this nat entry, then
1041 * dereference that as well.
1042 */
1043 ipfr_forget((void *)natd);
1044 aps_free(natd->nat_aps);
1045 nat_stats.ns_inuse--;
1046 KFREE(natd);
1047}
1048
1049
1050/*
1051 * nat_flushtable - clear the NAT table of all mapping entries.
1052 */
1053static int nat_flushtable()
1054{
1055 register nat_t *nat, **natp;
1056 register int j = 0;
1057
1058 /*
1059 * ALL NAT mappings deleted, so lets just make the deletions
1060 * quicker.
1061 */
1062 if (nat_table[0] != NULL)
1063 bzero((char *)nat_table[0],
1064 sizeof(nat_table[0]) * ipf_nattable_sz);
1065 if (nat_table[1] != NULL)
1066 bzero((char *)nat_table[1],
1067 sizeof(nat_table[1]) * ipf_nattable_sz);
1068
1069 for (natp = &nat_instances; (nat = *natp); ) {
1070 *natp = nat->nat_next;
1071#ifdef IPFILTER_LOG
1072 nat_log(nat, NL_FLUSH);
1073#endif
1074 nat_delete(nat);
1075 j++;
1076 }
1077 nat_stats.ns_inuse = 0;
1078 return j;
1079}
1080
1081
1082/*
1083 * nat_clearlist - delete all rules in the active NAT mapping list.
1084 */
1085static int nat_clearlist()
1086{
1087 register ipnat_t *n, **np = &nat_list;
1088 int i = 0;
1089
1090 if (nat_rules != NULL)
1091 bzero((char *)nat_rules, sizeof(*nat_rules) * ipf_natrules_sz);
1092 if (rdr_rules != NULL)
1093 bzero((char *)rdr_rules, sizeof(*rdr_rules) * ipf_rdrrules_sz);
1094
1095 while ((n = *np)) {
1096 *np = n->in_next;
1097 if (!n->in_use) {
1098 if (n->in_apr)
1099 appr_free(n->in_apr);
1100 KFREE(n);
1101 nat_stats.ns_rules--;
1102 } else {
1103 n->in_flags |= IPN_DELETE;
1104 n->in_next = NULL;
1105 }
1106 i++;
1107 }
1108 nat_masks = 0;
1109 rdr_masks = 0;
1110 return i;
1111}
1112
1113
1114/*
1115 * Create a new NAT table entry.
1116 * NOTE: assumes write lock on ipf_nat has been obtained already.
1117 */
1118nat_t *nat_new(np, ip, fin, flags, direction)
1119ipnat_t *np;
1120ip_t *ip;
1121fr_info_t *fin;
1122u_int flags;
1123int direction;
1124{
1125 register u_32_t sum1, sum2, sumd, l;
1126 u_short port = 0, sport = 0, dport = 0, nport = 0;
1127 struct in_addr in, inb;
1128 tcphdr_t *tcp = NULL;
1129 hostmap_t *hm = NULL;
1130 nat_t *nat, *natl;
1131 u_short nflags;
1132#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
1133 qif_t *qf = fin->fin_qif;
1134#endif
1135
1136 nflags = flags & np->in_flags;
1137 if (flags & IPN_TCPUDP) {
1138 tcp = (tcphdr_t *)fin->fin_dp;
1139 sport = tcp->th_sport;
1140 dport = tcp->th_dport;
1141 }
1142
1143 /* Give me a new nat */
1144 KMALLOC(nat, nat_t *);
1145 if (nat == NULL) {
1146 nat_stats.ns_memfail++;
1147 return NULL;
1148 }
1149
1150 bzero((char *)nat, sizeof(*nat));
1151 nat->nat_flags = flags;
1152 if (flags & FI_WILDP)
1153 nat_stats.ns_wilds++;
1154 /*
1155 * Search the current table for a match.
1156 */
1157 if (direction == NAT_OUTBOUND) {
1158 /*
1159 * Values at which the search for a free resouce starts.
1160 */
1161 u_32_t st_ip;
1162 u_short st_port;
1163
1164 /*
1165 * If it's an outbound packet which doesn't match any existing
1166 * record, then create a new port
1167 */
1168 l = 0;
1169 st_ip = np->in_nip;
1170 st_port = np->in_pnext;
1171
1172 do {
1173 port = 0;
1174 in.s_addr = htonl(np->in_nip);
1175 if (l == 0) {
1176 /*
1177 * Check to see if there is an existing NAT
1178 * setup for this IP address pair.
1179 */
1180 hm = nat_hostmap(np, ip->ip_src, in);
1181 if (hm != NULL)
1182 in.s_addr = hm->hm_mapip.s_addr;
1183 } else if ((l == 1) && (hm != NULL)) {
1184 nat_hostmapdel(hm);
1185 hm = NULL;
1186 }
1187 in.s_addr = ntohl(in.s_addr);
1188
1189 nat->nat_hm = hm;
1190
1191 if ((np->in_outmsk == 0xffffffff) &&
1192 (np->in_pnext == 0)) {
1193 if (l > 0)
1194 goto badnat;
1195 }
1196
1197 if (np->in_redir & NAT_MAPBLK) {
1198 if ((l >= np->in_ppip) || ((l > 0) &&
1199 !(flags & IPN_TCPUDP)))
1200 goto badnat;
1201 /*
1202 * map-block - Calculate destination address.
1203 */
1204 in.s_addr = ntohl(ip->ip_src.s_addr);
1205 in.s_addr &= ntohl(~np->in_inmsk);
1206 inb.s_addr = in.s_addr;
1207 in.s_addr /= np->in_ippip;
1208 in.s_addr &= ntohl(~np->in_outmsk);
1209 in.s_addr += ntohl(np->in_outip);
1210 /*
1211 * Calculate destination port.
1212 */
1213 if ((flags & IPN_TCPUDP) &&
1214 (np->in_ppip != 0)) {
1215 port = ntohs(sport) + l;
1216 port %= np->in_ppip;
1217 port += np->in_ppip *
1218 (inb.s_addr % np->in_ippip);
1219 port += MAPBLK_MINPORT;
1220 port = htons(port);
1221 }
1222 } else if (!np->in_outip &&
1223 (np->in_outmsk == 0xffffffff)) {
1224 /*
1225 * 0/32 - use the interface's IP address.
1226 */
1227 if ((l > 0) ||
1228 fr_ifpaddr(4, fin->fin_ifp, &in) == -1)
1229 goto badnat;
1230 in.s_addr = ntohl(in.s_addr);
1231 } else if (!np->in_outip && !np->in_outmsk) {
1232 /*
1233 * 0/0 - use the original source address/port.
1234 */
1235 if (l > 0)
1236 goto badnat;
1237 in.s_addr = ntohl(ip->ip_src.s_addr);
1238 } else if ((np->in_outmsk != 0xffffffff) &&
1239 (np->in_pnext == 0) &&
1240 ((l > 0) || (hm == NULL)))
1241 np->in_nip++;
1242 natl = NULL;
1243
1244 if ((nflags & IPN_TCPUDP) &&
1245 ((np->in_redir & NAT_MAPBLK) == 0) &&
1246 (np->in_flags & IPN_AUTOPORTMAP)) {
1247 if ((l > 0) && (l % np->in_ppip == 0)) {
1248 if (l > np->in_space) {
1249 goto badnat;
1250 } else if ((l > np->in_ppip) &&
1251 np->in_outmsk != 0xffffffff)
1252 np->in_nip++;
1253 }
1254 if (np->in_ppip != 0) {
1255 port = ntohs(sport);
1256 port += (l % np->in_ppip);
1257 port %= np->in_ppip;
1258 port += np->in_ppip *
1259 (ntohl(ip->ip_src.s_addr) %
1260 np->in_ippip);
1261 port += MAPBLK_MINPORT;
1262 port = htons(port);
1263 }
1264 } else if (((np->in_redir & NAT_MAPBLK) == 0) &&
1265 (nflags & IPN_TCPUDP) &&
1266 (np->in_pnext != 0)) {
1267 port = htons(np->in_pnext++);
1268 if (np->in_pnext > ntohs(np->in_pmax)) {
1269 np->in_pnext = ntohs(np->in_pmin);
1270 if (np->in_outmsk != 0xffffffff)
1271 np->in_nip++;
1272 }
1273 }
1274
1275 if (np->in_flags & IPN_IPRANGE) {
1276 if (np->in_nip > ntohl(np->in_outmsk))
1277 np->in_nip = ntohl(np->in_outip);
1278 } else {
1279 if ((np->in_outmsk != 0xffffffff) &&
1280 ((np->in_nip + 1) & ntohl(np->in_outmsk)) >
1281 ntohl(np->in_outip))
1282 np->in_nip = ntohl(np->in_outip) + 1;
1283 }
1284
1285 if (!port && (flags & IPN_TCPUDP))
1286 port = sport;
1287
1288 /*
1289 * Here we do a lookup of the connection as seen from
1290 * the outside. If an IP# pair already exists, try
1291 * again. So if you have A->B becomes C->B, you can
1292 * also have D->E become C->E but not D->B causing
1293 * another C->B. Also take protocol and ports into
1294 * account when determining whether a pre-existing
1295 * NAT setup will cause an external conflict where
1296 * this is appropriate.
1297 */
1298 inb.s_addr = htonl(in.s_addr);
1299 natl = nat_inlookup(fin->fin_ifp, flags & ~FI_WILDP,
1300 (u_int)ip->ip_p, ip->ip_dst, inb,
1301 (port << 16) | dport, 1);
1302
1303 /*
1304 * Has the search wrapped around and come back to the
1305 * start ?
1306 */
1307 if ((natl != NULL) &&
1308 (np->in_pnext != 0) && (st_port == np->in_pnext) &&
1309 (np->in_nip != 0) && (st_ip == np->in_nip))
1310 goto badnat;
1311 l++;
1312 } while (natl != NULL);
1313
1314 if (np->in_space > 0)
1315 np->in_space--;
1316
1317 /* Setup the NAT table */
1318 nat->nat_inip = ip->ip_src;
1319 nat->nat_outip.s_addr = htonl(in.s_addr);
1320 nat->nat_oip = ip->ip_dst;
1321 if (nat->nat_hm == NULL)
1322 nat->nat_hm = nat_hostmap(np, ip->ip_src,
1323 nat->nat_outip);
1324
1325 sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr)) + ntohs(sport);
1326 sum2 = LONG_SUM(in.s_addr) + ntohs(port);
1327
1328 if (flags & IPN_TCPUDP) {
1329 nat->nat_inport = sport;
1330 nat->nat_outport = port; /* sport */
1331 nat->nat_oport = dport;
1332 }
1333 } else {
1334 /*
1335 * Otherwise, it's an inbound packet. Most likely, we don't
1336 * want to rewrite source ports and source addresses. Instead,
1337 * we want to rewrite to a fixed internal address and fixed
1338 * internal port.
1339 */
1340 if (np->in_flags & IPN_SPLIT) {
1341 in.s_addr = np->in_nip;
1342 if (np->in_inip == htonl(in.s_addr))
1343 np->in_nip = ntohl(np->in_inmsk);
1344 else {
1345 np->in_nip = ntohl(np->in_inip);
1346 if (np->in_flags & IPN_ROUNDR) {
1347 nat_delrdr(np);
1348 nat_addrdr(np);
1349 }
1350 }
1351 } else {
1352 in.s_addr = ntohl(np->in_inip);
1353 if (np->in_flags & IPN_ROUNDR) {
1354 nat_delrdr(np);
1355 nat_addrdr(np);
1356 }
1357 }
1358 if (!np->in_pnext)
1359 nport = dport;
1360 else {
1361 /*
1362 * Whilst not optimized for the case where
1363 * pmin == pmax, the gain is not significant.
1364 */
1365 nport = ntohs(dport) - ntohs(np->in_pmin) +
1366 ntohs(np->in_pnext);
1367 nport = htons(nport);
1368 }
1369
1370 /*
1371 * When the redirect-to address is set to 0.0.0.0, just
1372 * assume a blank `forwarding' of the packet. We don't
1373 * setup any translation for this either.
1374 */
1375 if (in.s_addr == 0) {
1376 if (nport == dport)
1377 goto badnat;
1378 in.s_addr = ntohl(ip->ip_dst.s_addr);
1379 }
1380
1381 nat->nat_inip.s_addr = htonl(in.s_addr);
1382 nat->nat_outip = ip->ip_dst;
1383 nat->nat_oip = ip->ip_src;
1384
1385 sum1 = LONG_SUM(ntohl(ip->ip_dst.s_addr)) + ntohs(dport);
1386 sum2 = LONG_SUM(in.s_addr) + ntohs(nport);
1387
1388 if (flags & IPN_TCPUDP) {
1389 nat->nat_inport = nport;
1390 nat->nat_outport = dport;
1391 nat->nat_oport = sport;
1392 }
1393 }
1394
1395 CALC_SUMD(sum1, sum2, sumd);
1396 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
1397#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
| 638 nat_stats.ns_instances = nat_instances;
639 nat_stats.ns_apslist = ap_sess_list;
640 error = IWCOPYPTR((char *)&nat_stats, (char *)data,
641 sizeof(nat_stats));
642 break;
643 case SIOCGNATL :
644 {
645 natlookup_t nl;
646
647 MUTEX_DOWNGRADE(&ipf_nat);
648 error = IRCOPYPTR((char *)data, (char *)&nl, sizeof(nl));
649 if (error)
650 break;
651
652 if (nat_lookupredir(&nl)) {
653 error = IWCOPYPTR((char *)&nl, (char *)data,
654 sizeof(nl));
655 } else
656 error = ESRCH;
657 break;
658 }
659 case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */
660 if (!(mode & FWRITE)) {
661 error = EPERM;
662 break;
663 }
664 error = 0;
665 if (arg == 0)
666 ret = nat_flushtable();
667 else if (arg == 1)
668 ret = nat_clearlist();
669 else
670 error = EINVAL;
671 MUTEX_DOWNGRADE(&ipf_nat);
672 if (!error) {
673 error = IWCOPY((caddr_t)&ret, data, sizeof(ret));
674 if (error)
675 error = EFAULT;
676 }
677 break;
678 case SIOCSTLCK :
679 error = IRCOPY(data, (caddr_t)&arg, sizeof(arg));
680 if (!error) {
681 error = IWCOPY((caddr_t)&fr_nat_lock, data,
682 sizeof(fr_nat_lock));
683 if (!error)
684 fr_nat_lock = arg;
685 } else
686 error = EFAULT;
687 break;
688 case SIOCSTPUT :
689 if (fr_nat_lock)
690 error = fr_natputent(data);
691 else
692 error = EACCES;
693 break;
694 case SIOCSTGSZ :
695 if (fr_nat_lock)
696 error = fr_natgetsz(data);
697 else
698 error = EACCES;
699 break;
700 case SIOCSTGET :
701 if (fr_nat_lock)
702 error = fr_natgetent(data);
703 else
704 error = EACCES;
705 break;
706 case FIONREAD :
707#ifdef IPFILTER_LOG
708 arg = (int)iplused[IPL_LOGNAT];
709 MUTEX_DOWNGRADE(&ipf_nat);
710 error = IWCOPY((caddr_t)&arg, (caddr_t)data, sizeof(arg));
711 if (error)
712 error = EFAULT;
713#endif
714 break;
715 default :
716 error = EINVAL;
717 break;
718 }
719 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */
720done:
721 if (nt)
722 KFREE(nt);
723 return error;
724}
725
726
727static int fr_natgetsz(data)
728caddr_t data;
729{
730 ap_session_t *aps;
731 nat_t *nat, *n;
732 int error = 0;
733 natget_t ng;
734
735 error = IRCOPY(data, (caddr_t)&ng, sizeof(ng));
736 if (error)
737 return EFAULT;
738
739 nat = ng.ng_ptr;
740 if (!nat) {
741 nat = nat_instances;
742 ng.ng_sz = 0;
743 if (nat == NULL) {
744 error = IWCOPY((caddr_t)&ng, data, sizeof(ng));
745 if (error)
746 error = EFAULT;
747 return error;
748 }
749 } else {
750 /*
751 * Make sure the pointer we're copying from exists in the
752 * current list of entries. Security precaution to prevent
753 * copying of random kernel data.
754 */
755 for (n = nat_instances; n; n = n->nat_next)
756 if (n == nat)
757 break;
758 if (!n)
759 return ESRCH;
760 }
761
762 ng.ng_sz = sizeof(nat_save_t);
763 aps = nat->nat_aps;
764 if ((aps != NULL) && (aps->aps_data != 0)) {
765 ng.ng_sz += sizeof(ap_session_t);
766 ng.ng_sz += aps->aps_psiz;
767 }
768
769 error = IWCOPY((caddr_t)&ng, data, sizeof(ng));
770 if (error)
771 error = EFAULT;
772 return error;
773}
774
775
776static int fr_natgetent(data)
777caddr_t data;
778{
779 nat_save_t ipn, *ipnp, *ipnn = NULL;
780 register nat_t *n, *nat;
781 ap_session_t *aps;
782 int error;
783
784 error = IRCOPY(data, (caddr_t)&ipnp, sizeof(ipnp));
785 if (error)
786 return EFAULT;
787 error = IRCOPY((caddr_t)ipnp, (caddr_t)&ipn, sizeof(ipn));
788 if (error)
789 return EFAULT;
790
791 nat = ipn.ipn_next;
792 if (!nat) {
793 nat = nat_instances;
794 if (nat == NULL) {
795 if (nat_instances == NULL)
796 return ENOENT;
797 return 0;
798 }
799 } else {
800 /*
801 * Make sure the pointer we're copying from exists in the
802 * current list of entries. Security precaution to prevent
803 * copying of random kernel data.
804 */
805 for (n = nat_instances; n; n = n->nat_next)
806 if (n == nat)
807 break;
808 if (!n)
809 return ESRCH;
810 }
811
812 ipn.ipn_next = nat->nat_next;
813 ipn.ipn_dsize = 0;
814 bcopy((char *)nat, (char *)&ipn.ipn_nat, sizeof(ipn.ipn_nat));
815 ipn.ipn_nat.nat_data = NULL;
816
817 if (nat->nat_ptr) {
818 bcopy((char *)nat->nat_ptr, (char *)&ipn.ipn_ipnat,
819 sizeof(ipn.ipn_ipnat));
820 }
821
822 if (nat->nat_fr)
823 bcopy((char *)nat->nat_fr, (char *)&ipn.ipn_rule,
824 sizeof(ipn.ipn_rule));
825
826 if ((aps = nat->nat_aps)) {
827 ipn.ipn_dsize = sizeof(*aps);
828 if (aps->aps_data)
829 ipn.ipn_dsize += aps->aps_psiz;
830 KMALLOCS(ipnn, nat_save_t *, sizeof(*ipnn) + ipn.ipn_dsize);
831 if (ipnn == NULL)
832 return ENOMEM;
833 bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn));
834
835 bcopy((char *)aps, ipnn->ipn_data, sizeof(*aps));
836 if (aps->aps_data) {
837 bcopy(aps->aps_data, ipnn->ipn_data + sizeof(*aps),
838 aps->aps_psiz);
839 ipnn->ipn_dsize += aps->aps_psiz;
840 }
841 error = IWCOPY((caddr_t)ipnn, ipnp,
842 sizeof(ipn) + ipn.ipn_dsize);
843 if (error)
844 error = EFAULT;
845 KFREES(ipnn, sizeof(*ipnn) + ipn.ipn_dsize);
846 } else {
847 error = IWCOPY((caddr_t)&ipn, ipnp, sizeof(ipn));
848 if (error)
849 error = EFAULT;
850 }
851 return error;
852}
853
854
855static int fr_natputent(data)
856caddr_t data;
857{
858 nat_save_t ipn, *ipnp, *ipnn = NULL;
859 register nat_t *n, *nat;
860 ap_session_t *aps;
861 frentry_t *fr;
862 ipnat_t *in;
863
864 int error;
865
866 error = IRCOPY(data, (caddr_t)&ipnp, sizeof(ipnp));
867 if (error)
868 return EFAULT;
869 error = IRCOPY((caddr_t)ipnp, (caddr_t)&ipn, sizeof(ipn));
870 if (error)
871 return EFAULT;
872 nat = NULL;
873 if (ipn.ipn_dsize) {
874 KMALLOCS(ipnn, nat_save_t *, sizeof(ipn) + ipn.ipn_dsize);
875 if (ipnn == NULL)
876 return ENOMEM;
877 bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn));
878 error = IRCOPY((caddr_t)ipnp, (caddr_t)ipn.ipn_data,
879 ipn.ipn_dsize);
880 if (error) {
881 error = EFAULT;
882 goto junkput;
883 }
884 } else
885 ipnn = NULL;
886
887 KMALLOC(nat, nat_t *);
888 if (nat == NULL) {
889 error = EFAULT;
890 goto junkput;
891 }
892
893 bcopy((char *)&ipn.ipn_nat, (char *)nat, sizeof(*nat));
894 /*
895 * Initialize all these so that nat_delete() doesn't cause a crash.
896 */
897 nat->nat_phnext[0] = NULL;
898 nat->nat_phnext[1] = NULL;
899 fr = nat->nat_fr;
900 nat->nat_fr = NULL;
901 aps = nat->nat_aps;
902 nat->nat_aps = NULL;
903 in = nat->nat_ptr;
904 nat->nat_ptr = NULL;
905 nat->nat_data = NULL;
906
907 /*
908 * Restore the rule associated with this nat session
909 */
910 if (in) {
911 KMALLOC(in, ipnat_t *);
912 if (in == NULL) {
913 error = ENOMEM;
914 goto junkput;
915 }
916 nat->nat_ptr = in;
917 bcopy((char *)&ipn.ipn_ipnat, (char *)in, sizeof(*in));
918 in->in_use = 1;
919 in->in_flags |= IPN_DELETE;
920 in->in_next = NULL;
921 in->in_rnext = NULL;
922 in->in_prnext = NULL;
923 in->in_mnext = NULL;
924 in->in_pmnext = NULL;
925 in->in_ifp = GETUNIT(in->in_ifname, 4);
926 if (in->in_plabel[0] != '\0') {
927 in->in_apr = appr_match(in->in_p, in->in_plabel);
928 }
929 }
930
931 /*
932 * Restore ap_session_t structure. Include the private data allocated
933 * if it was there.
934 */
935 if (aps) {
936 KMALLOC(aps, ap_session_t *);
937 if (aps == NULL) {
938 error = ENOMEM;
939 goto junkput;
940 }
941 nat->nat_aps = aps;
942 aps->aps_next = ap_sess_list;
943 ap_sess_list = aps;
944 bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps));
945 if (in)
946 aps->aps_apr = in->in_apr;
947 if (aps->aps_psiz) {
948 KMALLOCS(aps->aps_data, void *, aps->aps_psiz);
949 if (aps->aps_data == NULL) {
950 error = ENOMEM;
951 goto junkput;
952 }
953 bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data,
954 aps->aps_psiz);
955 } else {
956 aps->aps_psiz = 0;
957 aps->aps_data = NULL;
958 }
959 }
960
961 /*
962 * If there was a filtering rule associated with this entry then
963 * build up a new one.
964 */
965 if (fr != NULL) {
966 if (nat->nat_flags & FI_NEWFR) {
967 KMALLOC(fr, frentry_t *);
968 nat->nat_fr = fr;
969 if (fr == NULL) {
970 error = ENOMEM;
971 goto junkput;
972 }
973 bcopy((char *)&ipn.ipn_fr, (char *)fr, sizeof(*fr));
974 ipn.ipn_nat.nat_fr = fr;
975 error = IWCOPY((caddr_t)&ipn, ipnp, sizeof(ipn));
976 if (error) {
977 error = EFAULT;
978 goto junkput;
979 }
980 } else {
981 for (n = nat_instances; n; n = n->nat_next)
982 if (n->nat_fr == fr)
983 break;
984 if (!n) {
985 error = ESRCH;
986 goto junkput;
987 }
988 }
989 }
990
991 if (ipnn)
992 KFREES(ipnn, sizeof(ipn) + ipn.ipn_dsize);
993 nat_insert(nat);
994 return 0;
995junkput:
996 if (ipnn)
997 KFREES(ipnn, sizeof(ipn) + ipn.ipn_dsize);
998 if (nat)
999 nat_delete(nat);
1000 return error;
1001}
1002
1003
1004/*
1005 * Delete a nat entry from the various lists and table.
1006 */
1007static void nat_delete(natd)
1008struct nat *natd;
1009{
1010 struct ipnat *ipn;
1011
1012 if (natd->nat_flags & FI_WILDP)
1013 nat_stats.ns_wilds--;
1014 if (natd->nat_hnext[0])
1015 natd->nat_hnext[0]->nat_phnext[0] = natd->nat_phnext[0];
1016 *natd->nat_phnext[0] = natd->nat_hnext[0];
1017 if (natd->nat_hnext[1])
1018 natd->nat_hnext[1]->nat_phnext[1] = natd->nat_phnext[1];
1019 *natd->nat_phnext[1] = natd->nat_hnext[1];
1020
1021 if (natd->nat_fr != NULL) {
1022 ATOMIC_DEC32(natd->nat_fr->fr_ref);
1023 }
1024
1025 if (natd->nat_hm != NULL)
1026 nat_hostmapdel(natd->nat_hm);
1027
1028 /*
1029 * If there is an active reference from the nat entry to its parent
1030 * rule, decrement the rule's reference count and free it too if no
1031 * longer being used.
1032 */
1033 ipn = natd->nat_ptr;
1034 if (ipn != NULL) {
1035 ipn->in_space++;
1036 ipn->in_use--;
1037 if (!ipn->in_use && (ipn->in_flags & IPN_DELETE)) {
1038 if (ipn->in_apr)
1039 appr_free(ipn->in_apr);
1040 KFREE(ipn);
1041 nat_stats.ns_rules--;
1042 }
1043 }
1044
1045 MUTEX_DESTROY(&natd->nat_lock);
1046 /*
1047 * If there's a fragment table entry too for this nat entry, then
1048 * dereference that as well.
1049 */
1050 ipfr_forget((void *)natd);
1051 aps_free(natd->nat_aps);
1052 nat_stats.ns_inuse--;
1053 KFREE(natd);
1054}
1055
1056
1057/*
1058 * nat_flushtable - clear the NAT table of all mapping entries.
1059 */
1060static int nat_flushtable()
1061{
1062 register nat_t *nat, **natp;
1063 register int j = 0;
1064
1065 /*
1066 * ALL NAT mappings deleted, so lets just make the deletions
1067 * quicker.
1068 */
1069 if (nat_table[0] != NULL)
1070 bzero((char *)nat_table[0],
1071 sizeof(nat_table[0]) * ipf_nattable_sz);
1072 if (nat_table[1] != NULL)
1073 bzero((char *)nat_table[1],
1074 sizeof(nat_table[1]) * ipf_nattable_sz);
1075
1076 for (natp = &nat_instances; (nat = *natp); ) {
1077 *natp = nat->nat_next;
1078#ifdef IPFILTER_LOG
1079 nat_log(nat, NL_FLUSH);
1080#endif
1081 nat_delete(nat);
1082 j++;
1083 }
1084 nat_stats.ns_inuse = 0;
1085 return j;
1086}
1087
1088
1089/*
1090 * nat_clearlist - delete all rules in the active NAT mapping list.
1091 */
1092static int nat_clearlist()
1093{
1094 register ipnat_t *n, **np = &nat_list;
1095 int i = 0;
1096
1097 if (nat_rules != NULL)
1098 bzero((char *)nat_rules, sizeof(*nat_rules) * ipf_natrules_sz);
1099 if (rdr_rules != NULL)
1100 bzero((char *)rdr_rules, sizeof(*rdr_rules) * ipf_rdrrules_sz);
1101
1102 while ((n = *np)) {
1103 *np = n->in_next;
1104 if (!n->in_use) {
1105 if (n->in_apr)
1106 appr_free(n->in_apr);
1107 KFREE(n);
1108 nat_stats.ns_rules--;
1109 } else {
1110 n->in_flags |= IPN_DELETE;
1111 n->in_next = NULL;
1112 }
1113 i++;
1114 }
1115 nat_masks = 0;
1116 rdr_masks = 0;
1117 return i;
1118}
1119
1120
1121/*
1122 * Create a new NAT table entry.
1123 * NOTE: assumes write lock on ipf_nat has been obtained already.
1124 */
1125nat_t *nat_new(np, ip, fin, flags, direction)
1126ipnat_t *np;
1127ip_t *ip;
1128fr_info_t *fin;
1129u_int flags;
1130int direction;
1131{
1132 register u_32_t sum1, sum2, sumd, l;
1133 u_short port = 0, sport = 0, dport = 0, nport = 0;
1134 struct in_addr in, inb;
1135 tcphdr_t *tcp = NULL;
1136 hostmap_t *hm = NULL;
1137 nat_t *nat, *natl;
1138 u_short nflags;
1139#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
1140 qif_t *qf = fin->fin_qif;
1141#endif
1142
1143 nflags = flags & np->in_flags;
1144 if (flags & IPN_TCPUDP) {
1145 tcp = (tcphdr_t *)fin->fin_dp;
1146 sport = tcp->th_sport;
1147 dport = tcp->th_dport;
1148 }
1149
1150 /* Give me a new nat */
1151 KMALLOC(nat, nat_t *);
1152 if (nat == NULL) {
1153 nat_stats.ns_memfail++;
1154 return NULL;
1155 }
1156
1157 bzero((char *)nat, sizeof(*nat));
1158 nat->nat_flags = flags;
1159 if (flags & FI_WILDP)
1160 nat_stats.ns_wilds++;
1161 /*
1162 * Search the current table for a match.
1163 */
1164 if (direction == NAT_OUTBOUND) {
1165 /*
1166 * Values at which the search for a free resouce starts.
1167 */
1168 u_32_t st_ip;
1169 u_short st_port;
1170
1171 /*
1172 * If it's an outbound packet which doesn't match any existing
1173 * record, then create a new port
1174 */
1175 l = 0;
1176 st_ip = np->in_nip;
1177 st_port = np->in_pnext;
1178
1179 do {
1180 port = 0;
1181 in.s_addr = htonl(np->in_nip);
1182 if (l == 0) {
1183 /*
1184 * Check to see if there is an existing NAT
1185 * setup for this IP address pair.
1186 */
1187 hm = nat_hostmap(np, ip->ip_src, in);
1188 if (hm != NULL)
1189 in.s_addr = hm->hm_mapip.s_addr;
1190 } else if ((l == 1) && (hm != NULL)) {
1191 nat_hostmapdel(hm);
1192 hm = NULL;
1193 }
1194 in.s_addr = ntohl(in.s_addr);
1195
1196 nat->nat_hm = hm;
1197
1198 if ((np->in_outmsk == 0xffffffff) &&
1199 (np->in_pnext == 0)) {
1200 if (l > 0)
1201 goto badnat;
1202 }
1203
1204 if (np->in_redir & NAT_MAPBLK) {
1205 if ((l >= np->in_ppip) || ((l > 0) &&
1206 !(flags & IPN_TCPUDP)))
1207 goto badnat;
1208 /*
1209 * map-block - Calculate destination address.
1210 */
1211 in.s_addr = ntohl(ip->ip_src.s_addr);
1212 in.s_addr &= ntohl(~np->in_inmsk);
1213 inb.s_addr = in.s_addr;
1214 in.s_addr /= np->in_ippip;
1215 in.s_addr &= ntohl(~np->in_outmsk);
1216 in.s_addr += ntohl(np->in_outip);
1217 /*
1218 * Calculate destination port.
1219 */
1220 if ((flags & IPN_TCPUDP) &&
1221 (np->in_ppip != 0)) {
1222 port = ntohs(sport) + l;
1223 port %= np->in_ppip;
1224 port += np->in_ppip *
1225 (inb.s_addr % np->in_ippip);
1226 port += MAPBLK_MINPORT;
1227 port = htons(port);
1228 }
1229 } else if (!np->in_outip &&
1230 (np->in_outmsk == 0xffffffff)) {
1231 /*
1232 * 0/32 - use the interface's IP address.
1233 */
1234 if ((l > 0) ||
1235 fr_ifpaddr(4, fin->fin_ifp, &in) == -1)
1236 goto badnat;
1237 in.s_addr = ntohl(in.s_addr);
1238 } else if (!np->in_outip && !np->in_outmsk) {
1239 /*
1240 * 0/0 - use the original source address/port.
1241 */
1242 if (l > 0)
1243 goto badnat;
1244 in.s_addr = ntohl(ip->ip_src.s_addr);
1245 } else if ((np->in_outmsk != 0xffffffff) &&
1246 (np->in_pnext == 0) &&
1247 ((l > 0) || (hm == NULL)))
1248 np->in_nip++;
1249 natl = NULL;
1250
1251 if ((nflags & IPN_TCPUDP) &&
1252 ((np->in_redir & NAT_MAPBLK) == 0) &&
1253 (np->in_flags & IPN_AUTOPORTMAP)) {
1254 if ((l > 0) && (l % np->in_ppip == 0)) {
1255 if (l > np->in_space) {
1256 goto badnat;
1257 } else if ((l > np->in_ppip) &&
1258 np->in_outmsk != 0xffffffff)
1259 np->in_nip++;
1260 }
1261 if (np->in_ppip != 0) {
1262 port = ntohs(sport);
1263 port += (l % np->in_ppip);
1264 port %= np->in_ppip;
1265 port += np->in_ppip *
1266 (ntohl(ip->ip_src.s_addr) %
1267 np->in_ippip);
1268 port += MAPBLK_MINPORT;
1269 port = htons(port);
1270 }
1271 } else if (((np->in_redir & NAT_MAPBLK) == 0) &&
1272 (nflags & IPN_TCPUDP) &&
1273 (np->in_pnext != 0)) {
1274 port = htons(np->in_pnext++);
1275 if (np->in_pnext > ntohs(np->in_pmax)) {
1276 np->in_pnext = ntohs(np->in_pmin);
1277 if (np->in_outmsk != 0xffffffff)
1278 np->in_nip++;
1279 }
1280 }
1281
1282 if (np->in_flags & IPN_IPRANGE) {
1283 if (np->in_nip > ntohl(np->in_outmsk))
1284 np->in_nip = ntohl(np->in_outip);
1285 } else {
1286 if ((np->in_outmsk != 0xffffffff) &&
1287 ((np->in_nip + 1) & ntohl(np->in_outmsk)) >
1288 ntohl(np->in_outip))
1289 np->in_nip = ntohl(np->in_outip) + 1;
1290 }
1291
1292 if (!port && (flags & IPN_TCPUDP))
1293 port = sport;
1294
1295 /*
1296 * Here we do a lookup of the connection as seen from
1297 * the outside. If an IP# pair already exists, try
1298 * again. So if you have A->B becomes C->B, you can
1299 * also have D->E become C->E but not D->B causing
1300 * another C->B. Also take protocol and ports into
1301 * account when determining whether a pre-existing
1302 * NAT setup will cause an external conflict where
1303 * this is appropriate.
1304 */
1305 inb.s_addr = htonl(in.s_addr);
1306 natl = nat_inlookup(fin->fin_ifp, flags & ~FI_WILDP,
1307 (u_int)ip->ip_p, ip->ip_dst, inb,
1308 (port << 16) | dport, 1);
1309
1310 /*
1311 * Has the search wrapped around and come back to the
1312 * start ?
1313 */
1314 if ((natl != NULL) &&
1315 (np->in_pnext != 0) && (st_port == np->in_pnext) &&
1316 (np->in_nip != 0) && (st_ip == np->in_nip))
1317 goto badnat;
1318 l++;
1319 } while (natl != NULL);
1320
1321 if (np->in_space > 0)
1322 np->in_space--;
1323
1324 /* Setup the NAT table */
1325 nat->nat_inip = ip->ip_src;
1326 nat->nat_outip.s_addr = htonl(in.s_addr);
1327 nat->nat_oip = ip->ip_dst;
1328 if (nat->nat_hm == NULL)
1329 nat->nat_hm = nat_hostmap(np, ip->ip_src,
1330 nat->nat_outip);
1331
1332 sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr)) + ntohs(sport);
1333 sum2 = LONG_SUM(in.s_addr) + ntohs(port);
1334
1335 if (flags & IPN_TCPUDP) {
1336 nat->nat_inport = sport;
1337 nat->nat_outport = port; /* sport */
1338 nat->nat_oport = dport;
1339 }
1340 } else {
1341 /*
1342 * Otherwise, it's an inbound packet. Most likely, we don't
1343 * want to rewrite source ports and source addresses. Instead,
1344 * we want to rewrite to a fixed internal address and fixed
1345 * internal port.
1346 */
1347 if (np->in_flags & IPN_SPLIT) {
1348 in.s_addr = np->in_nip;
1349 if (np->in_inip == htonl(in.s_addr))
1350 np->in_nip = ntohl(np->in_inmsk);
1351 else {
1352 np->in_nip = ntohl(np->in_inip);
1353 if (np->in_flags & IPN_ROUNDR) {
1354 nat_delrdr(np);
1355 nat_addrdr(np);
1356 }
1357 }
1358 } else {
1359 in.s_addr = ntohl(np->in_inip);
1360 if (np->in_flags & IPN_ROUNDR) {
1361 nat_delrdr(np);
1362 nat_addrdr(np);
1363 }
1364 }
1365 if (!np->in_pnext)
1366 nport = dport;
1367 else {
1368 /*
1369 * Whilst not optimized for the case where
1370 * pmin == pmax, the gain is not significant.
1371 */
1372 nport = ntohs(dport) - ntohs(np->in_pmin) +
1373 ntohs(np->in_pnext);
1374 nport = htons(nport);
1375 }
1376
1377 /*
1378 * When the redirect-to address is set to 0.0.0.0, just
1379 * assume a blank `forwarding' of the packet. We don't
1380 * setup any translation for this either.
1381 */
1382 if (in.s_addr == 0) {
1383 if (nport == dport)
1384 goto badnat;
1385 in.s_addr = ntohl(ip->ip_dst.s_addr);
1386 }
1387
1388 nat->nat_inip.s_addr = htonl(in.s_addr);
1389 nat->nat_outip = ip->ip_dst;
1390 nat->nat_oip = ip->ip_src;
1391
1392 sum1 = LONG_SUM(ntohl(ip->ip_dst.s_addr)) + ntohs(dport);
1393 sum2 = LONG_SUM(in.s_addr) + ntohs(nport);
1394
1395 if (flags & IPN_TCPUDP) {
1396 nat->nat_inport = nport;
1397 nat->nat_outport = dport;
1398 nat->nat_oport = sport;
1399 }
1400 }
1401
1402 CALC_SUMD(sum1, sum2, sumd);
1403 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
1404#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
|
1398 if ((flags == IPN_TCP) && dohwcksum &&
| 1405 if ((flags & IPN_TCPUDP) && dohwcksum &&
|
1399 (qf->qf_ill->ill_ick.ick_magic == ICK_M_CTL_MAGIC)) {
1400 if (direction == NAT_OUTBOUND)
1401 sum1 = LONG_SUM(ntohl(in.s_addr));
1402 else
1403 sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr));
1404 sum1 += LONG_SUM(ntohl(ip->ip_dst.s_addr));
| 1406 (qf->qf_ill->ill_ick.ick_magic == ICK_M_CTL_MAGIC)) {
1407 if (direction == NAT_OUTBOUND)
1408 sum1 = LONG_SUM(ntohl(in.s_addr));
1409 else
1410 sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr));
1411 sum1 += LONG_SUM(ntohl(ip->ip_dst.s_addr));
|
1405 sum1 += 30;
| 1412 sum1 += IPPROTO_TCP;
|
1406 sum1 = (sum1 & 0xffff) + (sum1 >> 16);
1407 nat->nat_sumd[1] = NAT_HW_CKSUM|(sum1 & 0xffff);
1408 } else
1409#endif
1410 nat->nat_sumd[1] = nat->nat_sumd[0];
1411
1412 if ((flags & IPN_TCPUDP) && ((sport != port) || (dport != nport))) {
1413 if (direction == NAT_OUTBOUND)
1414 sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr));
1415 else
1416 sum1 = LONG_SUM(ntohl(ip->ip_dst.s_addr));
1417
1418 sum2 = LONG_SUM(in.s_addr);
1419
1420 CALC_SUMD(sum1, sum2, sumd);
1421 nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16);
1422 } else
1423 nat->nat_ipsumd = nat->nat_sumd[0];
1424
1425 in.s_addr = htonl(in.s_addr);
1426
1427#ifdef _KERNEL
1428 strncpy(nat->nat_ifname, IFNAME(fin->fin_ifp), IFNAMSIZ);
1429#endif
1430 nat_insert(nat);
1431
1432 nat->nat_dir = direction;
1433 nat->nat_ifp = fin->fin_ifp;
1434 nat->nat_ptr = np;
1435 nat->nat_p = ip->ip_p;
1436 nat->nat_bytes = 0;
1437 nat->nat_pkts = 0;
1438 nat->nat_fr = fin->fin_fr;
1439 if (nat->nat_fr != NULL) {
1440 ATOMIC_INC32(nat->nat_fr->fr_ref);
1441 }
1442 if (direction == NAT_OUTBOUND) {
1443 if (flags & IPN_TCPUDP)
1444 tcp->th_sport = port;
1445 } else {
1446 if (flags & IPN_TCPUDP)
1447 tcp->th_dport = nport;
1448 }
1449 np->in_use++;
1450#ifdef IPFILTER_LOG
1451 nat_log(nat, (u_int)np->in_redir);
1452#endif
1453 return nat;
1454badnat:
1455 nat_stats.ns_badnat++;
1456 if ((hm = nat->nat_hm) != NULL)
1457 nat_hostmapdel(hm);
1458 KFREE(nat);
1459 return NULL;
1460}
1461
1462
1463void nat_insert(nat)
1464nat_t *nat;
1465{
| 1413 sum1 = (sum1 & 0xffff) + (sum1 >> 16);
1414 nat->nat_sumd[1] = NAT_HW_CKSUM|(sum1 & 0xffff);
1415 } else
1416#endif
1417 nat->nat_sumd[1] = nat->nat_sumd[0];
1418
1419 if ((flags & IPN_TCPUDP) && ((sport != port) || (dport != nport))) {
1420 if (direction == NAT_OUTBOUND)
1421 sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr));
1422 else
1423 sum1 = LONG_SUM(ntohl(ip->ip_dst.s_addr));
1424
1425 sum2 = LONG_SUM(in.s_addr);
1426
1427 CALC_SUMD(sum1, sum2, sumd);
1428 nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16);
1429 } else
1430 nat->nat_ipsumd = nat->nat_sumd[0];
1431
1432 in.s_addr = htonl(in.s_addr);
1433
1434#ifdef _KERNEL
1435 strncpy(nat->nat_ifname, IFNAME(fin->fin_ifp), IFNAMSIZ);
1436#endif
1437 nat_insert(nat);
1438
1439 nat->nat_dir = direction;
1440 nat->nat_ifp = fin->fin_ifp;
1441 nat->nat_ptr = np;
1442 nat->nat_p = ip->ip_p;
1443 nat->nat_bytes = 0;
1444 nat->nat_pkts = 0;
1445 nat->nat_fr = fin->fin_fr;
1446 if (nat->nat_fr != NULL) {
1447 ATOMIC_INC32(nat->nat_fr->fr_ref);
1448 }
1449 if (direction == NAT_OUTBOUND) {
1450 if (flags & IPN_TCPUDP)
1451 tcp->th_sport = port;
1452 } else {
1453 if (flags & IPN_TCPUDP)
1454 tcp->th_dport = nport;
1455 }
1456 np->in_use++;
1457#ifdef IPFILTER_LOG
1458 nat_log(nat, (u_int)np->in_redir);
1459#endif
1460 return nat;
1461badnat:
1462 nat_stats.ns_badnat++;
1463 if ((hm = nat->nat_hm) != NULL)
1464 nat_hostmapdel(hm);
1465 KFREE(nat);
1466 return NULL;
1467}
1468
1469
1470void nat_insert(nat)
1471nat_t *nat;
1472{
|
| 1473 u_int hv1, hv2;
|
1466 nat_t **natp;
| 1474 nat_t **natp;
|
1467 u_int hv;
| |
1468
1469 MUTEX_INIT(&nat->nat_lock, "nat entry lock", NULL);
1470
1471 nat->nat_age = fr_defnatage;
1472 nat->nat_ifname[sizeof(nat->nat_ifname) - 1] = '\0';
1473 if (nat->nat_ifname[0] !='\0') {
1474 nat->nat_ifp = GETUNIT(nat->nat_ifname, 4);
1475 }
1476
1477 nat->nat_next = nat_instances;
1478 nat_instances = nat;
1479
| 1475
1476 MUTEX_INIT(&nat->nat_lock, "nat entry lock", NULL);
1477
1478 nat->nat_age = fr_defnatage;
1479 nat->nat_ifname[sizeof(nat->nat_ifname) - 1] = '\0';
1480 if (nat->nat_ifname[0] !='\0') {
1481 nat->nat_ifp = GETUNIT(nat->nat_ifname, 4);
1482 }
1483
1484 nat->nat_next = nat_instances;
1485 nat_instances = nat;
1486
|
1480 hv = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport,
1481 ipf_nattable_sz);
1482 natp = &nat_table[0][hv];
| 1487 if (!(nat->nat_flags & (FI_W_SPORT|FI_W_DPORT))) {
1488 hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport,
1489 0xffffffff);
1490 hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1 + nat->nat_oport,
1491 ipf_nattable_sz);
1492 hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport,
1493 0xffffffff);
1494 hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2 + nat->nat_oport,
1495 ipf_nattable_sz);
1496 } else {
1497 hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, 0, 0xffffffff);
1498 hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1, ipf_nattable_sz);
1499 hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, 0, 0xffffffff);
1500 hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2, ipf_nattable_sz);
1501 }
1502
1503 natp = &nat_table[0][hv1];
|
1483 if (*natp)
1484 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
1485 nat->nat_phnext[0] = natp;
1486 nat->nat_hnext[0] = *natp;
1487 *natp = nat;
1488
| 1504 if (*natp)
1505 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
1506 nat->nat_phnext[0] = natp;
1507 nat->nat_hnext[0] = *natp;
1508 *natp = nat;
1509
|
1489 hv = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport,
1490 ipf_nattable_sz);
1491 natp = &nat_table[1][hv];
| 1510 natp = &nat_table[1][hv2];
|
1492 if (*natp)
1493 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
1494 nat->nat_phnext[1] = natp;
1495 nat->nat_hnext[1] = *natp;
1496 *natp = nat;
1497
1498 nat_stats.ns_added++;
1499 nat_stats.ns_inuse++;
1500}
1501
1502
1503nat_t *nat_icmplookup(ip, fin, dir)
1504ip_t *ip;
1505fr_info_t *fin;
1506int dir;
1507{
1508 icmphdr_t *icmp;
1509 tcphdr_t *tcp = NULL;
1510 ip_t *oip;
1511 int flags = 0, type, minlen;
1512
1513 icmp = (icmphdr_t *)fin->fin_dp;
1514 /*
1515 * Does it at least have the return (basic) IP header ?
1516 * Only a basic IP header (no options) should be with an ICMP error
1517 * header.
1518 */
1519 if ((ip->ip_hl != 5) || (ip->ip_len < ICMPERR_MINPKTLEN))
1520 return NULL;
1521 type = icmp->icmp_type;
1522 /*
1523 * If it's not an error type, then return.
1524 */
1525 if ((type != ICMP_UNREACH) && (type != ICMP_SOURCEQUENCH) &&
1526 (type != ICMP_REDIRECT) && (type != ICMP_TIMXCEED) &&
1527 (type != ICMP_PARAMPROB))
1528 return NULL;
1529
1530 oip = (ip_t *)((char *)fin->fin_dp + 8);
1531 minlen = (oip->ip_hl << 2);
1532 if (minlen < sizeof(ip_t))
1533 return NULL;
1534 if (ip->ip_len < ICMPERR_IPICMPHLEN + minlen)
1535 return NULL;
1536 /*
1537 * Is the buffer big enough for all of it ? It's the size of the IP
1538 * header claimed in the encapsulated part which is of concern. It
1539 * may be too big to be in this buffer but not so big that it's
1540 * outside the ICMP packet, leading to TCP deref's causing problems.
1541 * This is possible because we don't know how big oip_hl is when we
1542 * do the pullup early in fr_check() and thus can't gaurantee it is
1543 * all here now.
1544 */
1545#ifdef _KERNEL
1546 {
1547 mb_t *m;
1548
1549# if SOLARIS
1550 m = fin->fin_qfm;
1551 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > (char *)m->b_wptr)
1552 return NULL;
1553# else
1554 m = *(mb_t **)fin->fin_mp;
1555 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
1556 (char *)ip + m->m_len)
1557 return NULL;
1558# endif
1559 }
1560#endif
1561
1562 if (oip->ip_p == IPPROTO_TCP)
1563 flags = IPN_TCP;
1564 else if (oip->ip_p == IPPROTO_UDP)
1565 flags = IPN_UDP;
1566 if (flags & IPN_TCPUDP) {
1567 minlen += 8; /* + 64bits of data to get ports */
1568 if (ip->ip_len < ICMPERR_IPICMPHLEN + minlen)
1569 return NULL;
1570 tcp = (tcphdr_t *)((char *)oip + (oip->ip_hl << 2));
1571 if (dir == NAT_INBOUND)
1572 return nat_inlookup(fin->fin_ifp, flags,
1573 (u_int)oip->ip_p, oip->ip_dst, oip->ip_src,
1574 (tcp->th_sport << 16) | tcp->th_dport, 0);
1575 else
1576 return nat_outlookup(fin->fin_ifp, flags,
1577 (u_int)oip->ip_p, oip->ip_dst, oip->ip_src,
1578 (tcp->th_sport << 16) | tcp->th_dport, 0);
1579 }
1580 if (dir == NAT_INBOUND)
1581 return nat_inlookup(fin->fin_ifp, 0, (u_int)oip->ip_p,
1582 oip->ip_dst, oip->ip_src, 0, 0);
1583 else
1584 return nat_outlookup(fin->fin_ifp, 0, (u_int)oip->ip_p,
1585 oip->ip_dst, oip->ip_src, 0, 0);
1586}
1587
1588
1589/*
1590 * This should *ONLY* be used for incoming packets to make sure a NAT'd ICMP
1591 * packet gets correctly recognised.
1592 */
1593nat_t *nat_icmp(ip, fin, nflags, dir)
1594ip_t *ip;
1595fr_info_t *fin;
1596u_int *nflags;
1597int dir;
1598{
1599 u_32_t sum1, sum2, sumd, sumd2 = 0;
1600 struct in_addr in;
1601 icmphdr_t *icmp;
1602 udphdr_t *udp;
1603 nat_t *nat;
1604 ip_t *oip;
1605 int flags = 0;
1606
| 1511 if (*natp)
1512 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
1513 nat->nat_phnext[1] = natp;
1514 nat->nat_hnext[1] = *natp;
1515 *natp = nat;
1516
1517 nat_stats.ns_added++;
1518 nat_stats.ns_inuse++;
1519}
1520
1521
1522nat_t *nat_icmplookup(ip, fin, dir)
1523ip_t *ip;
1524fr_info_t *fin;
1525int dir;
1526{
1527 icmphdr_t *icmp;
1528 tcphdr_t *tcp = NULL;
1529 ip_t *oip;
1530 int flags = 0, type, minlen;
1531
1532 icmp = (icmphdr_t *)fin->fin_dp;
1533 /*
1534 * Does it at least have the return (basic) IP header ?
1535 * Only a basic IP header (no options) should be with an ICMP error
1536 * header.
1537 */
1538 if ((ip->ip_hl != 5) || (ip->ip_len < ICMPERR_MINPKTLEN))
1539 return NULL;
1540 type = icmp->icmp_type;
1541 /*
1542 * If it's not an error type, then return.
1543 */
1544 if ((type != ICMP_UNREACH) && (type != ICMP_SOURCEQUENCH) &&
1545 (type != ICMP_REDIRECT) && (type != ICMP_TIMXCEED) &&
1546 (type != ICMP_PARAMPROB))
1547 return NULL;
1548
1549 oip = (ip_t *)((char *)fin->fin_dp + 8);
1550 minlen = (oip->ip_hl << 2);
1551 if (minlen < sizeof(ip_t))
1552 return NULL;
1553 if (ip->ip_len < ICMPERR_IPICMPHLEN + minlen)
1554 return NULL;
1555 /*
1556 * Is the buffer big enough for all of it ? It's the size of the IP
1557 * header claimed in the encapsulated part which is of concern. It
1558 * may be too big to be in this buffer but not so big that it's
1559 * outside the ICMP packet, leading to TCP deref's causing problems.
1560 * This is possible because we don't know how big oip_hl is when we
1561 * do the pullup early in fr_check() and thus can't gaurantee it is
1562 * all here now.
1563 */
1564#ifdef _KERNEL
1565 {
1566 mb_t *m;
1567
1568# if SOLARIS
1569 m = fin->fin_qfm;
1570 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > (char *)m->b_wptr)
1571 return NULL;
1572# else
1573 m = *(mb_t **)fin->fin_mp;
1574 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
1575 (char *)ip + m->m_len)
1576 return NULL;
1577# endif
1578 }
1579#endif
1580
1581 if (oip->ip_p == IPPROTO_TCP)
1582 flags = IPN_TCP;
1583 else if (oip->ip_p == IPPROTO_UDP)
1584 flags = IPN_UDP;
1585 if (flags & IPN_TCPUDP) {
1586 minlen += 8; /* + 64bits of data to get ports */
1587 if (ip->ip_len < ICMPERR_IPICMPHLEN + minlen)
1588 return NULL;
1589 tcp = (tcphdr_t *)((char *)oip + (oip->ip_hl << 2));
1590 if (dir == NAT_INBOUND)
1591 return nat_inlookup(fin->fin_ifp, flags,
1592 (u_int)oip->ip_p, oip->ip_dst, oip->ip_src,
1593 (tcp->th_sport << 16) | tcp->th_dport, 0);
1594 else
1595 return nat_outlookup(fin->fin_ifp, flags,
1596 (u_int)oip->ip_p, oip->ip_dst, oip->ip_src,
1597 (tcp->th_sport << 16) | tcp->th_dport, 0);
1598 }
1599 if (dir == NAT_INBOUND)
1600 return nat_inlookup(fin->fin_ifp, 0, (u_int)oip->ip_p,
1601 oip->ip_dst, oip->ip_src, 0, 0);
1602 else
1603 return nat_outlookup(fin->fin_ifp, 0, (u_int)oip->ip_p,
1604 oip->ip_dst, oip->ip_src, 0, 0);
1605}
1606
1607
1608/*
1609 * This should *ONLY* be used for incoming packets to make sure a NAT'd ICMP
1610 * packet gets correctly recognised.
1611 */
1612nat_t *nat_icmp(ip, fin, nflags, dir)
1613ip_t *ip;
1614fr_info_t *fin;
1615u_int *nflags;
1616int dir;
1617{
1618 u_32_t sum1, sum2, sumd, sumd2 = 0;
1619 struct in_addr in;
1620 icmphdr_t *icmp;
1621 udphdr_t *udp;
1622 nat_t *nat;
1623 ip_t *oip;
1624 int flags = 0;
1625
|
1607 if ((fin->fin_fi.fi_fl & FI_SHORT) || (ip->ip_off & IP_OFFMASK))
| 1626 if ((fin->fin_fl & FI_SHORT) || (fin->fin_off != 0))
|
1608 return NULL;
1609 /*
1610 * nat_icmplookup() will return NULL for `defective' packets.
1611 */
1612 if ((ip->ip_v != 4) || !(nat = nat_icmplookup(ip, fin, dir)))
1613 return NULL;
1614 *nflags = IPN_ICMPERR;
1615 icmp = (icmphdr_t *)fin->fin_dp;
1616 oip = (ip_t *)&icmp->icmp_ip;
1617 if (oip->ip_p == IPPROTO_TCP)
1618 flags = IPN_TCP;
1619 else if (oip->ip_p == IPPROTO_UDP)
1620 flags = IPN_UDP;
1621 udp = (udphdr_t *)((((char *)oip) + (oip->ip_hl << 2)));
1622 /*
1623 * Need to adjust ICMP header to include the real IP#'s and
1624 * port #'s. Only apply a checksum change relative to the
1625 * IP address change as it will be modified again in ip_natout
1626 * for both address and port. Two checksum changes are
1627 * necessary for the two header address changes. Be careful
1628 * to only modify the checksum once for the port # and twice
1629 * for the IP#.
1630 */
1631
1632 /*
1633 * Step 1
1634 * Fix the IP addresses in the offending IP packet. You also need
1635 * to adjust the IP header checksum of that offending IP packet
1636 * and the ICMP checksum of the ICMP error message itself.
1637 *
1638 * Unfortunately, for UDP and TCP, the IP addresses are also contained
1639 * in the pseudo header that is used to compute the UDP resp. TCP
1640 * checksum. So, we must compensate that as well. Even worse, the
1641 * change in the UDP and TCP checksums require yet another
1642 * adjustment of the ICMP checksum of the ICMP error message.
1643 *
1644 * For the moment we forget about TCP, because that checksum is not
1645 * in the first 8 bytes, so it will not be available in most cases.
1646 */
1647
1648 if (oip->ip_dst.s_addr == nat->nat_oip.s_addr) {
1649 sum1 = LONG_SUM(ntohl(oip->ip_src.s_addr));
1650 in = nat->nat_inip;
1651 oip->ip_src = in;
1652 } else {
1653 sum1 = LONG_SUM(ntohl(oip->ip_dst.s_addr));
1654 in = nat->nat_outip;
1655 oip->ip_dst = in;
1656 }
1657
1658 sum2 = LONG_SUM(ntohl(in.s_addr));
1659
1660 CALC_SUMD(sum1, sum2, sumd);
1661
1662 if (nat->nat_dir == NAT_OUTBOUND) {
1663 /*
1664 * Fix IP checksum of the offending IP packet to adjust for
1665 * the change in the IP address.
1666 *
1667 * Normally, you would expect that the ICMP checksum of the
1668 * ICMP error message needs to be adjusted as well for the
1669 * IP address change in oip.
1670 * However, this is a NOP, because the ICMP checksum is
1671 * calculated over the complete ICMP packet, which includes the
1672 * changed oip IP addresses and oip->ip_sum. However, these
1673 * two changes cancel each other out (if the delta for
1674 * the IP address is x, then the delta for ip_sum is minus x),
1675 * so no change in the icmp_cksum is necessary.
1676 *
1677 * Be careful that nat_dir refers to the direction of the
1678 * offending IP packet (oip), not to its ICMP response (icmp)
1679 */
1680 fix_datacksum(&oip->ip_sum, sumd);
1681
1682 /*
1683 * Fix UDP pseudo header checksum to compensate for the
1684 * IP address change.
1685 */
1686 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
1687 /*
1688 * The UDP checksum is optional, only adjust it
1689 * if it has been set.
1690 */
1691 sum1 = ntohs(udp->uh_sum);
1692 fix_datacksum(&udp->uh_sum, sumd);
1693 sum2 = ntohs(udp->uh_sum);
1694
1695 /*
1696 * Fix ICMP checksum to compensate the UDP
1697 * checksum adjustment.
1698 */
1699 CALC_SUMD(sum1, sum2, sumd);
1700 sumd2 = sumd;
1701 }
1702
1703#if 0
1704 /*
1705 * Fix TCP pseudo header checksum to compensate for the
1706 * IP address change. Before we can do the change, we
1707 * must make sure that oip is sufficient large to hold
1708 * the TCP checksum (normally it does not!).
1709 */
1710 if (oip->ip_p == IPPROTO_TCP) {
1711
1712 }
1713#endif
1714 } else {
1715
1716 /*
1717 * Fix IP checksum of the offending IP packet to adjust for
1718 * the change in the IP address.
1719 *
1720 * Normally, you would expect that the ICMP checksum of the
1721 * ICMP error message needs to be adjusted as well for the
1722 * IP address change in oip.
1723 * However, this is a NOP, because the ICMP checksum is
1724 * calculated over the complete ICMP packet, which includes the
1725 * changed oip IP addresses and oip->ip_sum. However, these
1726 * two changes cancel each other out (if the delta for
1727 * the IP address is x, then the delta for ip_sum is minus x),
1728 * so no change in the icmp_cksum is necessary.
1729 *
1730 * Be careful that nat_dir refers to the direction of the
1731 * offending IP packet (oip), not to its ICMP response (icmp)
1732 */
1733 fix_datacksum(&oip->ip_sum, sumd);
1734
1735/* XXX FV : without having looked at Solaris source code, it seems unlikely
1736 * that SOLARIS would compensate this in the kernel (a body of an IP packet
1737 * in the data section of an ICMP packet). I have the feeling that this should
1738 * be unconditional, but I'm not in a position to check.
1739 */
1740#if !SOLARIS && !defined(__sgi)
1741 /*
1742 * Fix UDP pseudo header checksum to compensate for the
1743 * IP address change.
1744 */
1745 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
1746 /*
1747 * The UDP checksum is optional, only adjust it
1748 * if it has been set
1749 */
1750 sum1 = ntohs(udp->uh_sum);
1751 fix_datacksum(&udp->uh_sum, sumd);
1752 sum2 = ntohs(udp->uh_sum);
1753
1754 /*
1755 * Fix ICMP checksum to compensate the UDP
1756 * checksum adjustment.
1757 */
1758 CALC_SUMD(sum1, sum2, sumd);
1759 sumd2 = sumd;
1760 }
1761
1762#if 0
1763 /*
1764 * Fix TCP pseudo header checksum to compensate for the
1765 * IP address change. Before we can do the change, we
1766 * must make sure that oip is sufficient large to hold
1767 * the TCP checksum (normally it does not!).
1768 */
1769 if (oip->ip_p == IPPROTO_TCP) {
1770
1771 };
1772#endif
1773
1774#endif
1775 }
1776
1777 if ((flags & IPN_TCPUDP) != 0) {
1778 tcphdr_t *tcp;
1779
1780 /*
1781 * XXX - what if this is bogus hl and we go off the end ?
1782 * In this case, nat_icmpinlookup() will have returned NULL.
1783 */
1784 tcp = (tcphdr_t *)udp;
1785
1786 /*
1787 * Step 2 :
1788 * For offending TCP/UDP IP packets, translate the ports as
1789 * well, based on the NAT specification. Of course such
1790 * a change must be reflected in the ICMP checksum as well.
1791 *
1792 * Advance notice : Now it becomes complicated :-)
1793 *
1794 * Since the port fields are part of the TCP/UDP checksum
1795 * of the offending IP packet, you need to adjust that checksum
1796 * as well... but, if you change, you must change the icmp
1797 * checksum *again*, to reflect that change.
1798 *
1799 * To further complicate: the TCP checksum is not in the first
1800 * 8 bytes of the offending ip packet, so it most likely is not
1801 * available (we might have to fix that if the encounter a
1802 * device that returns more than 8 data bytes on icmp error)
1803 */
1804
1805 if (nat->nat_oport == tcp->th_dport) {
1806 if (tcp->th_sport != nat->nat_inport) {
1807 /*
1808 * Fix ICMP checksum to compensate port
1809 * adjustment.
1810 */
1811 sum1 = ntohs(tcp->th_sport);
1812 sum2 = ntohs(nat->nat_inport);
1813 CALC_SUMD(sum1, sum2, sumd);
1814 sumd2 += sumd;
1815 tcp->th_sport = nat->nat_inport;
1816
1817 /*
1818 * Fix udp checksum to compensate port
1819 * adjustment. NOTE : the offending IP packet
1820 * flows the other direction compared to the
1821 * ICMP message.
1822 *
1823 * The UDP checksum is optional, only adjust
1824 * it if it has been set.
1825 */
1826 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
1827
1828 sum1 = ntohs(udp->uh_sum);
1829 fix_datacksum(&udp->uh_sum, sumd);
1830 sum2 = ntohs(udp->uh_sum);
1831
1832 /*
1833 * Fix ICMP checksum to
1834 * compensate UDP checksum
1835 * adjustment.
1836 */
1837 CALC_SUMD(sum1, sum2, sumd);
1838 sumd2 += sumd;
1839 }
1840 }
1841 } else {
1842 if (tcp->th_dport != nat->nat_outport) {
1843 /*
1844 * Fix ICMP checksum to compensate port
1845 * adjustment.
1846 */
1847 sum1 = ntohs(tcp->th_dport);
1848 sum2 = ntohs(nat->nat_outport);
1849 CALC_SUMD(sum1, sum2, sumd);
1850 sumd2 += sumd;
1851 tcp->th_dport = nat->nat_outport;
1852
1853 /*
1854 * Fix udp checksum to compensate port
1855 * adjustment. NOTE : the offending IP
1856 * packet flows the other direction compared
1857 * to the ICMP message.
1858 *
1859 * The UDP checksum is optional, only adjust
1860 * it if it has been set.
1861 */
1862 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
1863
1864 sum1 = ntohs(udp->uh_sum);
1865 fix_datacksum(&udp->uh_sum, sumd);
1866 sum2 = ntohs(udp->uh_sum);
1867
1868 /*
1869 * Fix ICMP checksum to compensate
1870 * UDP checksum adjustment.
1871 */
1872 CALC_SUMD(sum1, sum2, sumd);
1873 sumd2 += sumd;
1874 }
1875 }
1876 }
1877 if (sumd2) {
1878 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
1879 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
1880 if (nat->nat_dir == NAT_OUTBOUND) {
| 1627 return NULL;
1628 /*
1629 * nat_icmplookup() will return NULL for `defective' packets.
1630 */
1631 if ((ip->ip_v != 4) || !(nat = nat_icmplookup(ip, fin, dir)))
1632 return NULL;
1633 *nflags = IPN_ICMPERR;
1634 icmp = (icmphdr_t *)fin->fin_dp;
1635 oip = (ip_t *)&icmp->icmp_ip;
1636 if (oip->ip_p == IPPROTO_TCP)
1637 flags = IPN_TCP;
1638 else if (oip->ip_p == IPPROTO_UDP)
1639 flags = IPN_UDP;
1640 udp = (udphdr_t *)((((char *)oip) + (oip->ip_hl << 2)));
1641 /*
1642 * Need to adjust ICMP header to include the real IP#'s and
1643 * port #'s. Only apply a checksum change relative to the
1644 * IP address change as it will be modified again in ip_natout
1645 * for both address and port. Two checksum changes are
1646 * necessary for the two header address changes. Be careful
1647 * to only modify the checksum once for the port # and twice
1648 * for the IP#.
1649 */
1650
1651 /*
1652 * Step 1
1653 * Fix the IP addresses in the offending IP packet. You also need
1654 * to adjust the IP header checksum of that offending IP packet
1655 * and the ICMP checksum of the ICMP error message itself.
1656 *
1657 * Unfortunately, for UDP and TCP, the IP addresses are also contained
1658 * in the pseudo header that is used to compute the UDP resp. TCP
1659 * checksum. So, we must compensate that as well. Even worse, the
1660 * change in the UDP and TCP checksums require yet another
1661 * adjustment of the ICMP checksum of the ICMP error message.
1662 *
1663 * For the moment we forget about TCP, because that checksum is not
1664 * in the first 8 bytes, so it will not be available in most cases.
1665 */
1666
1667 if (oip->ip_dst.s_addr == nat->nat_oip.s_addr) {
1668 sum1 = LONG_SUM(ntohl(oip->ip_src.s_addr));
1669 in = nat->nat_inip;
1670 oip->ip_src = in;
1671 } else {
1672 sum1 = LONG_SUM(ntohl(oip->ip_dst.s_addr));
1673 in = nat->nat_outip;
1674 oip->ip_dst = in;
1675 }
1676
1677 sum2 = LONG_SUM(ntohl(in.s_addr));
1678
1679 CALC_SUMD(sum1, sum2, sumd);
1680
1681 if (nat->nat_dir == NAT_OUTBOUND) {
1682 /*
1683 * Fix IP checksum of the offending IP packet to adjust for
1684 * the change in the IP address.
1685 *
1686 * Normally, you would expect that the ICMP checksum of the
1687 * ICMP error message needs to be adjusted as well for the
1688 * IP address change in oip.
1689 * However, this is a NOP, because the ICMP checksum is
1690 * calculated over the complete ICMP packet, which includes the
1691 * changed oip IP addresses and oip->ip_sum. However, these
1692 * two changes cancel each other out (if the delta for
1693 * the IP address is x, then the delta for ip_sum is minus x),
1694 * so no change in the icmp_cksum is necessary.
1695 *
1696 * Be careful that nat_dir refers to the direction of the
1697 * offending IP packet (oip), not to its ICMP response (icmp)
1698 */
1699 fix_datacksum(&oip->ip_sum, sumd);
1700
1701 /*
1702 * Fix UDP pseudo header checksum to compensate for the
1703 * IP address change.
1704 */
1705 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
1706 /*
1707 * The UDP checksum is optional, only adjust it
1708 * if it has been set.
1709 */
1710 sum1 = ntohs(udp->uh_sum);
1711 fix_datacksum(&udp->uh_sum, sumd);
1712 sum2 = ntohs(udp->uh_sum);
1713
1714 /*
1715 * Fix ICMP checksum to compensate the UDP
1716 * checksum adjustment.
1717 */
1718 CALC_SUMD(sum1, sum2, sumd);
1719 sumd2 = sumd;
1720 }
1721
1722#if 0
1723 /*
1724 * Fix TCP pseudo header checksum to compensate for the
1725 * IP address change. Before we can do the change, we
1726 * must make sure that oip is sufficient large to hold
1727 * the TCP checksum (normally it does not!).
1728 */
1729 if (oip->ip_p == IPPROTO_TCP) {
1730
1731 }
1732#endif
1733 } else {
1734
1735 /*
1736 * Fix IP checksum of the offending IP packet to adjust for
1737 * the change in the IP address.
1738 *
1739 * Normally, you would expect that the ICMP checksum of the
1740 * ICMP error message needs to be adjusted as well for the
1741 * IP address change in oip.
1742 * However, this is a NOP, because the ICMP checksum is
1743 * calculated over the complete ICMP packet, which includes the
1744 * changed oip IP addresses and oip->ip_sum. However, these
1745 * two changes cancel each other out (if the delta for
1746 * the IP address is x, then the delta for ip_sum is minus x),
1747 * so no change in the icmp_cksum is necessary.
1748 *
1749 * Be careful that nat_dir refers to the direction of the
1750 * offending IP packet (oip), not to its ICMP response (icmp)
1751 */
1752 fix_datacksum(&oip->ip_sum, sumd);
1753
1754/* XXX FV : without having looked at Solaris source code, it seems unlikely
1755 * that SOLARIS would compensate this in the kernel (a body of an IP packet
1756 * in the data section of an ICMP packet). I have the feeling that this should
1757 * be unconditional, but I'm not in a position to check.
1758 */
1759#if !SOLARIS && !defined(__sgi)
1760 /*
1761 * Fix UDP pseudo header checksum to compensate for the
1762 * IP address change.
1763 */
1764 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
1765 /*
1766 * The UDP checksum is optional, only adjust it
1767 * if it has been set
1768 */
1769 sum1 = ntohs(udp->uh_sum);
1770 fix_datacksum(&udp->uh_sum, sumd);
1771 sum2 = ntohs(udp->uh_sum);
1772
1773 /*
1774 * Fix ICMP checksum to compensate the UDP
1775 * checksum adjustment.
1776 */
1777 CALC_SUMD(sum1, sum2, sumd);
1778 sumd2 = sumd;
1779 }
1780
1781#if 0
1782 /*
1783 * Fix TCP pseudo header checksum to compensate for the
1784 * IP address change. Before we can do the change, we
1785 * must make sure that oip is sufficient large to hold
1786 * the TCP checksum (normally it does not!).
1787 */
1788 if (oip->ip_p == IPPROTO_TCP) {
1789
1790 };
1791#endif
1792
1793#endif
1794 }
1795
1796 if ((flags & IPN_TCPUDP) != 0) {
1797 tcphdr_t *tcp;
1798
1799 /*
1800 * XXX - what if this is bogus hl and we go off the end ?
1801 * In this case, nat_icmpinlookup() will have returned NULL.
1802 */
1803 tcp = (tcphdr_t *)udp;
1804
1805 /*
1806 * Step 2 :
1807 * For offending TCP/UDP IP packets, translate the ports as
1808 * well, based on the NAT specification. Of course such
1809 * a change must be reflected in the ICMP checksum as well.
1810 *
1811 * Advance notice : Now it becomes complicated :-)
1812 *
1813 * Since the port fields are part of the TCP/UDP checksum
1814 * of the offending IP packet, you need to adjust that checksum
1815 * as well... but, if you change, you must change the icmp
1816 * checksum *again*, to reflect that change.
1817 *
1818 * To further complicate: the TCP checksum is not in the first
1819 * 8 bytes of the offending ip packet, so it most likely is not
1820 * available (we might have to fix that if the encounter a
1821 * device that returns more than 8 data bytes on icmp error)
1822 */
1823
1824 if (nat->nat_oport == tcp->th_dport) {
1825 if (tcp->th_sport != nat->nat_inport) {
1826 /*
1827 * Fix ICMP checksum to compensate port
1828 * adjustment.
1829 */
1830 sum1 = ntohs(tcp->th_sport);
1831 sum2 = ntohs(nat->nat_inport);
1832 CALC_SUMD(sum1, sum2, sumd);
1833 sumd2 += sumd;
1834 tcp->th_sport = nat->nat_inport;
1835
1836 /*
1837 * Fix udp checksum to compensate port
1838 * adjustment. NOTE : the offending IP packet
1839 * flows the other direction compared to the
1840 * ICMP message.
1841 *
1842 * The UDP checksum is optional, only adjust
1843 * it if it has been set.
1844 */
1845 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
1846
1847 sum1 = ntohs(udp->uh_sum);
1848 fix_datacksum(&udp->uh_sum, sumd);
1849 sum2 = ntohs(udp->uh_sum);
1850
1851 /*
1852 * Fix ICMP checksum to
1853 * compensate UDP checksum
1854 * adjustment.
1855 */
1856 CALC_SUMD(sum1, sum2, sumd);
1857 sumd2 += sumd;
1858 }
1859 }
1860 } else {
1861 if (tcp->th_dport != nat->nat_outport) {
1862 /*
1863 * Fix ICMP checksum to compensate port
1864 * adjustment.
1865 */
1866 sum1 = ntohs(tcp->th_dport);
1867 sum2 = ntohs(nat->nat_outport);
1868 CALC_SUMD(sum1, sum2, sumd);
1869 sumd2 += sumd;
1870 tcp->th_dport = nat->nat_outport;
1871
1872 /*
1873 * Fix udp checksum to compensate port
1874 * adjustment. NOTE : the offending IP
1875 * packet flows the other direction compared
1876 * to the ICMP message.
1877 *
1878 * The UDP checksum is optional, only adjust
1879 * it if it has been set.
1880 */
1881 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
1882
1883 sum1 = ntohs(udp->uh_sum);
1884 fix_datacksum(&udp->uh_sum, sumd);
1885 sum2 = ntohs(udp->uh_sum);
1886
1887 /*
1888 * Fix ICMP checksum to compensate
1889 * UDP checksum adjustment.
1890 */
1891 CALC_SUMD(sum1, sum2, sumd);
1892 sumd2 += sumd;
1893 }
1894 }
1895 }
1896 if (sumd2) {
1897 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
1898 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
1899 if (nat->nat_dir == NAT_OUTBOUND) {
|
1881 fix_outcksum(&icmp->icmp_cksum, sumd2);
| 1900 fix_outcksum(fin, &icmp->icmp_cksum, sumd2);
|
1882 } else {
| 1901 } else {
|
1883 fix_incksum(&icmp->icmp_cksum, sumd2);
| 1902 fix_incksum(fin, &icmp->icmp_cksum, sumd2);
|
1884 }
1885 }
1886 }
| 1903 }
1904 }
1905 }
|
1887 nat->nat_age = fr_defnaticmpage;
| 1906 if (oip->ip_p == IPPROTO_ICMP)
1907 nat->nat_age = fr_defnaticmpage;
|
1888 return nat;
1889}
1890
1891
1892/*
1893 * NB: these lookups don't lock access to the list, it assume it has already
1894 * been done!
1895 */
1896/*
1897 * Lookup a nat entry based on the mapped destination ip address/port and
1898 * real source address/port. We use this lookup when receiving a packet,
1899 * we're looking for a table entry, based on the destination address.
1900 * NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY.
1901 */
1902nat_t *nat_inlookup(ifp, flags, p, src, mapdst, ports, rw)
1903void *ifp;
1904register u_int flags, p;
1905struct in_addr src , mapdst;
1906u_32_t ports;
1907int rw;
1908{
1909 register u_short sport, dport;
1910 register nat_t *nat;
1911 register int nflags;
1912 register u_32_t dst;
1913 u_int hv;
1914
1915 dst = mapdst.s_addr;
1916 dport = ports >> 16;
1917 sport = ports & 0xffff;
1918 flags &= IPN_TCPUDP;
1919
| 1908 return nat;
1909}
1910
1911
1912/*
1913 * NB: these lookups don't lock access to the list, it assume it has already
1914 * been done!
1915 */
1916/*
1917 * Lookup a nat entry based on the mapped destination ip address/port and
1918 * real source address/port. We use this lookup when receiving a packet,
1919 * we're looking for a table entry, based on the destination address.
1920 * NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY.
1921 */
1922nat_t *nat_inlookup(ifp, flags, p, src, mapdst, ports, rw)
1923void *ifp;
1924register u_int flags, p;
1925struct in_addr src , mapdst;
1926u_32_t ports;
1927int rw;
1928{
1929 register u_short sport, dport;
1930 register nat_t *nat;
1931 register int nflags;
1932 register u_32_t dst;
1933 u_int hv;
1934
1935 dst = mapdst.s_addr;
1936 dport = ports >> 16;
1937 sport = ports & 0xffff;
1938 flags &= IPN_TCPUDP;
1939
|
1920 hv = NAT_HASH_FN(dst, dport, ipf_nattable_sz);
| 1940 hv = NAT_HASH_FN(dst, dport, 0xffffffff);
1941 hv = NAT_HASH_FN(src.s_addr, hv + sport, ipf_nattable_sz);
|
1921 nat = nat_table[1][hv];
1922 for (; nat; nat = nat->nat_hnext[1]) {
1923 nflags = nat->nat_flags;
1924 if ((!ifp || ifp == nat->nat_ifp) &&
1925 nat->nat_oip.s_addr == src.s_addr &&
1926 nat->nat_outip.s_addr == dst &&
1927 (((p == 0) && (flags == (nat->nat_flags & IPN_TCPUDP)))
1928 || (p == nat->nat_p)) && (!flags ||
1929 (((nat->nat_oport == sport) || (nflags & FI_W_DPORT)) &&
1930 ((nat->nat_outport == dport) || (nflags & FI_W_SPORT)))))
1931 return nat;
1932 }
1933 if (!nat_stats.ns_wilds || !(flags & IPN_TCPUDP))
1934 return NULL;
1935 if (!rw) {
1936 RWLOCK_EXIT(&ipf_nat);
1937 }
| 1942 nat = nat_table[1][hv];
1943 for (; nat; nat = nat->nat_hnext[1]) {
1944 nflags = nat->nat_flags;
1945 if ((!ifp || ifp == nat->nat_ifp) &&
1946 nat->nat_oip.s_addr == src.s_addr &&
1947 nat->nat_outip.s_addr == dst &&
1948 (((p == 0) && (flags == (nat->nat_flags & IPN_TCPUDP)))
1949 || (p == nat->nat_p)) && (!flags ||
1950 (((nat->nat_oport == sport) || (nflags & FI_W_DPORT)) &&
1951 ((nat->nat_outport == dport) || (nflags & FI_W_SPORT)))))
1952 return nat;
1953 }
1954 if (!nat_stats.ns_wilds || !(flags & IPN_TCPUDP))
1955 return NULL;
1956 if (!rw) {
1957 RWLOCK_EXIT(&ipf_nat);
1958 }
|
1938 hv = NAT_HASH_FN(dst, 0, ipf_nattable_sz);
| 1959 hv = NAT_HASH_FN(dst, 0, 0xffffffff);
1960 hv = NAT_HASH_FN(src.s_addr, hv, ipf_nattable_sz);
|
1939 if (!rw) {
1940 WRITE_ENTER(&ipf_nat);
1941 }
1942 nat = nat_table[1][hv];
1943 for (; nat; nat = nat->nat_hnext[1]) {
1944 nflags = nat->nat_flags;
1945 if (ifp && ifp != nat->nat_ifp)
1946 continue;
1947 if (!(nflags & IPN_TCPUDP))
1948 continue;
1949 if (!(nflags & FI_WILDP))
1950 continue;
1951 if (nat->nat_oip.s_addr != src.s_addr ||
1952 nat->nat_outip.s_addr != dst)
1953 continue;
1954 if (((nat->nat_oport == sport) || (nflags & FI_W_DPORT)) &&
1955 ((nat->nat_outport == dport) || (nflags & FI_W_SPORT))) {
1956 nat_tabmove(nat, ports);
1957 break;
1958 }
1959 }
1960 if (!rw) {
1961 MUTEX_DOWNGRADE(&ipf_nat);
1962 }
1963 return nat;
1964}
1965
1966
1967/*
1968 * This function is only called for TCP/UDP NAT table entries where the
1969 * original was placed in the table without hashing on the ports and we now
1970 * want to include hashing on port numbers.
1971 */
1972static void nat_tabmove(nat, ports)
1973nat_t *nat;
1974u_32_t ports;
1975{
1976 register u_short sport, dport;
1977 nat_t **natp;
1978 u_int hv;
1979
1980 dport = ports >> 16;
1981 sport = ports & 0xffff;
1982
1983 if (nat->nat_oport == dport) {
1984 nat->nat_inport = sport;
1985 nat->nat_outport = sport;
1986 }
1987
1988 /*
1989 * Remove the NAT entry from the old location
1990 */
1991 if (nat->nat_hnext[0])
1992 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
1993 *nat->nat_phnext[0] = nat->nat_hnext[0];
1994
1995 if (nat->nat_hnext[1])
1996 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
1997 *nat->nat_phnext[1] = nat->nat_hnext[1];
1998
1999 /*
2000 * Add into the NAT table in the new position
2001 */
| 1961 if (!rw) {
1962 WRITE_ENTER(&ipf_nat);
1963 }
1964 nat = nat_table[1][hv];
1965 for (; nat; nat = nat->nat_hnext[1]) {
1966 nflags = nat->nat_flags;
1967 if (ifp && ifp != nat->nat_ifp)
1968 continue;
1969 if (!(nflags & IPN_TCPUDP))
1970 continue;
1971 if (!(nflags & FI_WILDP))
1972 continue;
1973 if (nat->nat_oip.s_addr != src.s_addr ||
1974 nat->nat_outip.s_addr != dst)
1975 continue;
1976 if (((nat->nat_oport == sport) || (nflags & FI_W_DPORT)) &&
1977 ((nat->nat_outport == dport) || (nflags & FI_W_SPORT))) {
1978 nat_tabmove(nat, ports);
1979 break;
1980 }
1981 }
1982 if (!rw) {
1983 MUTEX_DOWNGRADE(&ipf_nat);
1984 }
1985 return nat;
1986}
1987
1988
1989/*
1990 * This function is only called for TCP/UDP NAT table entries where the
1991 * original was placed in the table without hashing on the ports and we now
1992 * want to include hashing on port numbers.
1993 */
1994static void nat_tabmove(nat, ports)
1995nat_t *nat;
1996u_32_t ports;
1997{
1998 register u_short sport, dport;
1999 nat_t **natp;
2000 u_int hv;
2001
2002 dport = ports >> 16;
2003 sport = ports & 0xffff;
2004
2005 if (nat->nat_oport == dport) {
2006 nat->nat_inport = sport;
2007 nat->nat_outport = sport;
2008 }
2009
2010 /*
2011 * Remove the NAT entry from the old location
2012 */
2013 if (nat->nat_hnext[0])
2014 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
2015 *nat->nat_phnext[0] = nat->nat_hnext[0];
2016
2017 if (nat->nat_hnext[1])
2018 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
2019 *nat->nat_phnext[1] = nat->nat_hnext[1];
2020
2021 /*
2022 * Add into the NAT table in the new position
2023 */
|
2002 hv = NAT_HASH_FN(nat->nat_inip.s_addr, sport, ipf_nattable_sz);
| 2024 hv = NAT_HASH_FN(nat->nat_inip.s_addr, sport, 0xffffffff);
2025 hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + dport, ipf_nattable_sz);
|
2003 natp = &nat_table[0][hv];
2004 if (*natp)
2005 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
2006 nat->nat_phnext[0] = natp;
2007 nat->nat_hnext[0] = *natp;
2008 *natp = nat;
2009
| 2026 natp = &nat_table[0][hv];
2027 if (*natp)
2028 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
2029 nat->nat_phnext[0] = natp;
2030 nat->nat_hnext[0] = *natp;
2031 *natp = nat;
2032
|
2010 hv = NAT_HASH_FN(nat->nat_outip.s_addr, sport, ipf_nattable_sz);
| 2033 hv = NAT_HASH_FN(nat->nat_outip.s_addr, sport, 0xffffffff);
2034 hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + dport, ipf_nattable_sz);
|
2011 natp = &nat_table[1][hv];
2012 if (*natp)
2013 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
2014 nat->nat_phnext[1] = natp;
2015 nat->nat_hnext[1] = *natp;
2016 *natp = nat;
2017}
2018
2019
2020/*
2021 * Lookup a nat entry based on the source 'real' ip address/port and
2022 * destination address/port. We use this lookup when sending a packet out,
2023 * we're looking for a table entry, based on the source address.
2024 * NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY.
2025 */
2026nat_t *nat_outlookup(ifp, flags, p, src, dst, ports, rw)
2027void *ifp;
2028register u_int flags, p;
2029struct in_addr src , dst;
2030u_32_t ports;
2031int rw;
2032{
2033 register u_short sport, dport;
2034 register nat_t *nat;
2035 register int nflags;
2036 u_32_t srcip;
2037 u_int hv;
2038
2039 sport = ports & 0xffff;
2040 dport = ports >> 16;
2041 flags &= IPN_TCPUDP;
2042 srcip = src.s_addr;
2043
| 2035 natp = &nat_table[1][hv];
2036 if (*natp)
2037 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
2038 nat->nat_phnext[1] = natp;
2039 nat->nat_hnext[1] = *natp;
2040 *natp = nat;
2041}
2042
2043
2044/*
2045 * Lookup a nat entry based on the source 'real' ip address/port and
2046 * destination address/port. We use this lookup when sending a packet out,
2047 * we're looking for a table entry, based on the source address.
2048 * NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY.
2049 */
2050nat_t *nat_outlookup(ifp, flags, p, src, dst, ports, rw)
2051void *ifp;
2052register u_int flags, p;
2053struct in_addr src , dst;
2054u_32_t ports;
2055int rw;
2056{
2057 register u_short sport, dport;
2058 register nat_t *nat;
2059 register int nflags;
2060 u_32_t srcip;
2061 u_int hv;
2062
2063 sport = ports & 0xffff;
2064 dport = ports >> 16;
2065 flags &= IPN_TCPUDP;
2066 srcip = src.s_addr;
2067
|
2044 hv = NAT_HASH_FN(srcip, sport, ipf_nattable_sz);
| 2068 hv = NAT_HASH_FN(srcip, sport, 0xffffffff);
2069 hv = NAT_HASH_FN(dst.s_addr, hv + dport, ipf_nattable_sz);
|
2045 nat = nat_table[0][hv];
2046 for (; nat; nat = nat->nat_hnext[0]) {
2047 nflags = nat->nat_flags;
2048
2049 if ((!ifp || ifp == nat->nat_ifp) &&
2050 nat->nat_inip.s_addr == srcip &&
2051 nat->nat_oip.s_addr == dst.s_addr &&
2052 (((p == 0) && (flags == (nflags & IPN_TCPUDP)))
2053 || (p == nat->nat_p)) && (!flags ||
2054 ((nat->nat_inport == sport || nflags & FI_W_SPORT) &&
2055 (nat->nat_oport == dport || nflags & FI_W_DPORT))))
2056 return nat;
2057 }
2058 if (!nat_stats.ns_wilds || !(flags & IPN_TCPUDP))
2059 return NULL;
2060 if (!rw) {
2061 RWLOCK_EXIT(&ipf_nat);
2062 }
2063 hv = NAT_HASH_FN(srcip, 0, ipf_nattable_sz);
| 2070 nat = nat_table[0][hv];
2071 for (; nat; nat = nat->nat_hnext[0]) {
2072 nflags = nat->nat_flags;
2073
2074 if ((!ifp || ifp == nat->nat_ifp) &&
2075 nat->nat_inip.s_addr == srcip &&
2076 nat->nat_oip.s_addr == dst.s_addr &&
2077 (((p == 0) && (flags == (nflags & IPN_TCPUDP)))
2078 || (p == nat->nat_p)) && (!flags ||
2079 ((nat->nat_inport == sport || nflags & FI_W_SPORT) &&
2080 (nat->nat_oport == dport || nflags & FI_W_DPORT))))
2081 return nat;
2082 }
2083 if (!nat_stats.ns_wilds || !(flags & IPN_TCPUDP))
2084 return NULL;
2085 if (!rw) {
2086 RWLOCK_EXIT(&ipf_nat);
2087 }
2088 hv = NAT_HASH_FN(srcip, 0, ipf_nattable_sz);
|
| 2089 hv = NAT_HASH_FN(dst.s_addr, hv, ipf_nattable_sz);
|
2064 if (!rw) {
2065 WRITE_ENTER(&ipf_nat);
2066 }
2067 nat = nat_table[0][hv];
2068 for (; nat; nat = nat->nat_hnext[0]) {
2069 nflags = nat->nat_flags;
2070 if (ifp && ifp != nat->nat_ifp)
2071 continue;
2072 if (!(nflags & IPN_TCPUDP))
2073 continue;
2074 if (!(nflags & FI_WILDP))
2075 continue;
2076 if ((nat->nat_inip.s_addr != srcip) ||
2077 (nat->nat_oip.s_addr != dst.s_addr))
2078 continue;
2079 if (((nat->nat_inport == sport) || (nflags & FI_W_SPORT)) &&
2080 ((nat->nat_oport == dport) || (nflags & FI_W_DPORT))) {
2081 nat_tabmove(nat, ports);
2082 break;
2083 }
2084 }
2085 if (!rw) {
2086 MUTEX_DOWNGRADE(&ipf_nat);
2087 }
2088 return nat;
2089}
2090
2091
2092/*
2093 * Lookup the NAT tables to search for a matching redirect
2094 */
2095nat_t *nat_lookupredir(np)
2096register natlookup_t *np;
2097{
2098 u_32_t ports;
2099 nat_t *nat;
2100
2101 ports = (np->nl_outport << 16) | np->nl_inport;
2102 /*
2103 * If nl_inip is non null, this is a lookup based on the real
2104 * ip address. Else, we use the fake.
2105 */
2106 if ((nat = nat_outlookup(NULL, np->nl_flags, 0, np->nl_inip,
2107 np->nl_outip, ports, 0))) {
2108 np->nl_realip = nat->nat_outip;
2109 np->nl_realport = nat->nat_outport;
2110 }
2111 return nat;
2112}
2113
2114
2115static int nat_match(fin, np, ip)
2116fr_info_t *fin;
2117ipnat_t *np;
2118ip_t *ip;
2119{
2120 frtuc_t *ft;
2121
2122 if (ip->ip_v != 4)
2123 return 0;
2124
2125 if (np->in_p && ip->ip_p != np->in_p)
2126 return 0;
2127 if (fin->fin_out) {
2128 if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK)))
2129 return 0;
2130 if (((fin->fin_fi.fi_saddr & np->in_inmsk) != np->in_inip)
2131 ^ ((np->in_flags & IPN_NOTSRC) != 0))
2132 return 0;
2133 if (((fin->fin_fi.fi_daddr & np->in_srcmsk) != np->in_srcip)
2134 ^ ((np->in_flags & IPN_NOTDST) != 0))
2135 return 0;
2136 } else {
2137 if (!(np->in_redir & NAT_REDIRECT))
2138 return 0;
2139 if (((fin->fin_fi.fi_saddr & np->in_srcmsk) != np->in_srcip)
2140 ^ ((np->in_flags & IPN_NOTSRC) != 0))
2141 return 0;
2142 if (((fin->fin_fi.fi_daddr & np->in_outmsk) != np->in_outip)
2143 ^ ((np->in_flags & IPN_NOTDST) != 0))
2144 return 0;
2145 }
2146
2147 ft = &np->in_tuc;
| 2090 if (!rw) {
2091 WRITE_ENTER(&ipf_nat);
2092 }
2093 nat = nat_table[0][hv];
2094 for (; nat; nat = nat->nat_hnext[0]) {
2095 nflags = nat->nat_flags;
2096 if (ifp && ifp != nat->nat_ifp)
2097 continue;
2098 if (!(nflags & IPN_TCPUDP))
2099 continue;
2100 if (!(nflags & FI_WILDP))
2101 continue;
2102 if ((nat->nat_inip.s_addr != srcip) ||
2103 (nat->nat_oip.s_addr != dst.s_addr))
2104 continue;
2105 if (((nat->nat_inport == sport) || (nflags & FI_W_SPORT)) &&
2106 ((nat->nat_oport == dport) || (nflags & FI_W_DPORT))) {
2107 nat_tabmove(nat, ports);
2108 break;
2109 }
2110 }
2111 if (!rw) {
2112 MUTEX_DOWNGRADE(&ipf_nat);
2113 }
2114 return nat;
2115}
2116
2117
2118/*
2119 * Lookup the NAT tables to search for a matching redirect
2120 */
2121nat_t *nat_lookupredir(np)
2122register natlookup_t *np;
2123{
2124 u_32_t ports;
2125 nat_t *nat;
2126
2127 ports = (np->nl_outport << 16) | np->nl_inport;
2128 /*
2129 * If nl_inip is non null, this is a lookup based on the real
2130 * ip address. Else, we use the fake.
2131 */
2132 if ((nat = nat_outlookup(NULL, np->nl_flags, 0, np->nl_inip,
2133 np->nl_outip, ports, 0))) {
2134 np->nl_realip = nat->nat_outip;
2135 np->nl_realport = nat->nat_outport;
2136 }
2137 return nat;
2138}
2139
2140
2141static int nat_match(fin, np, ip)
2142fr_info_t *fin;
2143ipnat_t *np;
2144ip_t *ip;
2145{
2146 frtuc_t *ft;
2147
2148 if (ip->ip_v != 4)
2149 return 0;
2150
2151 if (np->in_p && ip->ip_p != np->in_p)
2152 return 0;
2153 if (fin->fin_out) {
2154 if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK)))
2155 return 0;
2156 if (((fin->fin_fi.fi_saddr & np->in_inmsk) != np->in_inip)
2157 ^ ((np->in_flags & IPN_NOTSRC) != 0))
2158 return 0;
2159 if (((fin->fin_fi.fi_daddr & np->in_srcmsk) != np->in_srcip)
2160 ^ ((np->in_flags & IPN_NOTDST) != 0))
2161 return 0;
2162 } else {
2163 if (!(np->in_redir & NAT_REDIRECT))
2164 return 0;
2165 if (((fin->fin_fi.fi_saddr & np->in_srcmsk) != np->in_srcip)
2166 ^ ((np->in_flags & IPN_NOTSRC) != 0))
2167 return 0;
2168 if (((fin->fin_fi.fi_daddr & np->in_outmsk) != np->in_outip)
2169 ^ ((np->in_flags & IPN_NOTDST) != 0))
2170 return 0;
2171 }
2172
2173 ft = &np->in_tuc;
|
2148 if (!(fin->fin_fi.fi_fl & FI_TCPUDP) ||
2149 (fin->fin_fi.fi_fl & FI_SHORT) || (ip->ip_off & IP_OFFMASK)) {
| 2174 if (!(fin->fin_fl & FI_TCPUDP) ||
2175 (fin->fin_fl & FI_SHORT) || (fin->fin_off != 0)) {
|
2150 if (ft->ftu_scmp || ft->ftu_dcmp)
2151 return 0;
2152 return 1;
2153 }
2154
2155 return fr_tcpudpchk(ft, fin);
2156}
2157
2158
2159/*
2160 * Packets going out on the external interface go through this.
2161 * Here, the source address requires alteration, if anything.
2162 */
2163int ip_natout(ip, fin)
2164ip_t *ip;
2165fr_info_t *fin;
2166{
2167 register ipnat_t *np = NULL;
2168 register u_32_t ipa;
2169 tcphdr_t *tcp = NULL;
2170 u_short sport = 0, dport = 0, *csump = NULL;
| 2176 if (ft->ftu_scmp || ft->ftu_dcmp)
2177 return 0;
2178 return 1;
2179 }
2180
2181 return fr_tcpudpchk(ft, fin);
2182}
2183
2184
2185/*
2186 * Packets going out on the external interface go through this.
2187 * Here, the source address requires alteration, if anything.
2188 */
2189int ip_natout(ip, fin)
2190ip_t *ip;
2191fr_info_t *fin;
2192{
2193 register ipnat_t *np = NULL;
2194 register u_32_t ipa;
2195 tcphdr_t *tcp = NULL;
2196 u_short sport = 0, dport = 0, *csump = NULL;
|
| 2197 int natadd = 1, i, icmpset = 1;
2198 u_int nflags = 0, hv, msk;
|
2171 struct ifnet *ifp;
| 2199 struct ifnet *ifp;
|
2172 int natadd = 1;
| |
2173 frentry_t *fr;
| 2200 frentry_t *fr;
|
2174 u_int nflags = 0, hv, msk;
| |
2175 u_32_t iph;
2176 nat_t *nat;
| 2201 u_32_t iph;
2202 nat_t *nat;
|
2177 int i;
| |
2178
2179 if (nat_list == NULL || (fr_nat_lock))
2180 return 0;
2181
2182 if ((fr = fin->fin_fr) && !(fr->fr_flags & FR_DUP) &&
2183 fr->fr_tif.fd_ifp && fr->fr_tif.fd_ifp != (void *)-1)
2184 ifp = fr->fr_tif.fd_ifp;
2185 else
2186 ifp = fin->fin_ifp;
2187
| 2203
2204 if (nat_list == NULL || (fr_nat_lock))
2205 return 0;
2206
2207 if ((fr = fin->fin_fr) && !(fr->fr_flags & FR_DUP) &&
2208 fr->fr_tif.fd_ifp && fr->fr_tif.fd_ifp != (void *)-1)
2209 ifp = fr->fr_tif.fd_ifp;
2210 else
2211 ifp = fin->fin_ifp;
2212
|
2188 if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) {
| 2213 if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
|
2189 if (ip->ip_p == IPPROTO_TCP)
2190 nflags = IPN_TCP;
2191 else if (ip->ip_p == IPPROTO_UDP)
2192 nflags = IPN_UDP;
2193 if ((nflags & IPN_TCPUDP)) {
2194 tcp = (tcphdr_t *)fin->fin_dp;
2195 sport = tcp->th_sport;
2196 dport = tcp->th_dport;
2197 }
2198 }
2199
2200 ipa = ip->ip_src.s_addr;
2201
2202 READ_ENTER(&ipf_nat);
2203
2204 if ((ip->ip_p == IPPROTO_ICMP) &&
2205 (nat = nat_icmp(ip, fin, &nflags, NAT_OUTBOUND)))
| 2214 if (ip->ip_p == IPPROTO_TCP)
2215 nflags = IPN_TCP;
2216 else if (ip->ip_p == IPPROTO_UDP)
2217 nflags = IPN_UDP;
2218 if ((nflags & IPN_TCPUDP)) {
2219 tcp = (tcphdr_t *)fin->fin_dp;
2220 sport = tcp->th_sport;
2221 dport = tcp->th_dport;
2222 }
2223 }
2224
2225 ipa = ip->ip_src.s_addr;
2226
2227 READ_ENTER(&ipf_nat);
2228
2229 if ((ip->ip_p == IPPROTO_ICMP) &&
2230 (nat = nat_icmp(ip, fin, &nflags, NAT_OUTBOUND)))
|
2206 ;
2207 else if ((ip->ip_off & (IP_OFFMASK|IP_MF)) &&
| 2231 icmpset = 1;
2232 else if ((fin->fin_fl & FI_FRAG) &&
|
2208 (nat = ipfr_nat_knownfrag(ip, fin)))
2209 natadd = 0;
2210 else if ((nat = nat_outlookup(ifp, nflags, (u_int)ip->ip_p,
2211 ip->ip_src, ip->ip_dst,
2212 (dport << 16) | sport, 0))) {
2213 nflags = nat->nat_flags;
2214 if ((nflags & (FI_W_SPORT|FI_W_DPORT)) != 0) {
2215 if ((nflags & FI_W_SPORT) &&
2216 (nat->nat_inport != sport))
2217 nat->nat_inport = sport;
2218 else if ((nflags & FI_W_DPORT) &&
2219 (nat->nat_oport != dport))
2220 nat->nat_oport = dport;
2221 if (nat->nat_outport == 0)
2222 nat->nat_outport = sport;
2223 nat->nat_flags &= ~(FI_W_DPORT|FI_W_SPORT);
2224 nflags = nat->nat_flags;
2225 nat_stats.ns_wilds--;
2226 }
2227 } else {
2228 RWLOCK_EXIT(&ipf_nat);
2229 WRITE_ENTER(&ipf_nat);
2230 /*
2231 * If there is no current entry in the nat table for this IP#,
2232 * create one for it (if there is a matching rule).
2233 */
2234 msk = 0xffffffff;
2235 i = 32;
2236maskloop:
2237 iph = ipa & htonl(msk);
2238 hv = NAT_HASH_FN(iph, 0, ipf_natrules_sz);
2239 for (np = nat_rules[hv]; np; np = np->in_mnext)
2240 {
| 2233 (nat = ipfr_nat_knownfrag(ip, fin)))
2234 natadd = 0;
2235 else if ((nat = nat_outlookup(ifp, nflags, (u_int)ip->ip_p,
2236 ip->ip_src, ip->ip_dst,
2237 (dport << 16) | sport, 0))) {
2238 nflags = nat->nat_flags;
2239 if ((nflags & (FI_W_SPORT|FI_W_DPORT)) != 0) {
2240 if ((nflags & FI_W_SPORT) &&
2241 (nat->nat_inport != sport))
2242 nat->nat_inport = sport;
2243 else if ((nflags & FI_W_DPORT) &&
2244 (nat->nat_oport != dport))
2245 nat->nat_oport = dport;
2246 if (nat->nat_outport == 0)
2247 nat->nat_outport = sport;
2248 nat->nat_flags &= ~(FI_W_DPORT|FI_W_SPORT);
2249 nflags = nat->nat_flags;
2250 nat_stats.ns_wilds--;
2251 }
2252 } else {
2253 RWLOCK_EXIT(&ipf_nat);
2254 WRITE_ENTER(&ipf_nat);
2255 /*
2256 * If there is no current entry in the nat table for this IP#,
2257 * create one for it (if there is a matching rule).
2258 */
2259 msk = 0xffffffff;
2260 i = 32;
2261maskloop:
2262 iph = ipa & htonl(msk);
2263 hv = NAT_HASH_FN(iph, 0, ipf_natrules_sz);
2264 for (np = nat_rules[hv]; np; np = np->in_mnext)
2265 {
|
2241 if ((np->in_ifp && (np->in_ifp != ifp)) ||
2242 !np->in_space)
| 2266 if (np->in_ifp && (np->in_ifp != ifp))
|
2243 continue;
2244 if ((np->in_flags & IPN_RF) &&
2245 !(np->in_flags & nflags))
2246 continue;
2247 if (np->in_flags & IPN_FILTER) {
2248 if (!nat_match(fin, np, ip))
2249 continue;
2250 } else if ((ipa & np->in_inmsk) != np->in_inip)
2251 continue;
2252 if (np->in_redir & (NAT_MAP|NAT_MAPBLK)) {
2253 if (*np->in_plabel && !appr_ok(ip, tcp, np))
2254 continue;
2255 /*
2256 * If it's a redirection, then we don't want to
2257 * create new outgoing port stuff.
2258 * Redirections are only for incoming
2259 * connections.
2260 */
2261 if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK)))
2262 continue;
2263 if ((nat = nat_new(np, ip, fin, (u_int)nflags,
2264 NAT_OUTBOUND))) {
2265 np->in_hits++;
2266 break;
2267 }
2268 }
2269 }
2270 if ((np == NULL) && (i > 0)) {
2271 do {
2272 i--;
2273 msk <<= 1;
2274 } while ((i >= 0) && ((nat_masks & (1 << i)) == 0));
2275 if (i >= 0)
2276 goto maskloop;
2277 }
2278 MUTEX_DOWNGRADE(&ipf_nat);
2279 }
2280
2281 /*
2282 * NOTE: ipf_nat must now only be held as a read lock
2283 */
2284 if (nat) {
2285 np = nat->nat_ptr;
| 2267 continue;
2268 if ((np->in_flags & IPN_RF) &&
2269 !(np->in_flags & nflags))
2270 continue;
2271 if (np->in_flags & IPN_FILTER) {
2272 if (!nat_match(fin, np, ip))
2273 continue;
2274 } else if ((ipa & np->in_inmsk) != np->in_inip)
2275 continue;
2276 if (np->in_redir & (NAT_MAP|NAT_MAPBLK)) {
2277 if (*np->in_plabel && !appr_ok(ip, tcp, np))
2278 continue;
2279 /*
2280 * If it's a redirection, then we don't want to
2281 * create new outgoing port stuff.
2282 * Redirections are only for incoming
2283 * connections.
2284 */
2285 if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK)))
2286 continue;
2287 if ((nat = nat_new(np, ip, fin, (u_int)nflags,
2288 NAT_OUTBOUND))) {
2289 np->in_hits++;
2290 break;
2291 }
2292 }
2293 }
2294 if ((np == NULL) && (i > 0)) {
2295 do {
2296 i--;
2297 msk <<= 1;
2298 } while ((i >= 0) && ((nat_masks & (1 << i)) == 0));
2299 if (i >= 0)
2300 goto maskloop;
2301 }
2302 MUTEX_DOWNGRADE(&ipf_nat);
2303 }
2304
2305 /*
2306 * NOTE: ipf_nat must now only be held as a read lock
2307 */
2308 if (nat) {
2309 np = nat->nat_ptr;
|
2286 if (natadd && (fin->fin_fi.fi_fl & FI_FRAG) &&
2287 np && (np->in_flags & IPN_FRAG))
| 2310 if (natadd && (fin->fin_fl & FI_FRAG) && np)
|
2288 ipfr_nat_newfrag(ip, fin, 0, nat);
2289 MUTEX_ENTER(&nat->nat_lock);
2290 nat->nat_age = fr_defnatage;
2291 nat->nat_bytes += ip->ip_len;
2292 nat->nat_pkts++;
2293 MUTEX_EXIT(&nat->nat_lock);
2294
2295 /*
2296 * Fix up checksums, not by recalculating them, but
2297 * simply computing adjustments.
2298 */
2299 if (nflags == IPN_ICMPERR) {
2300 u_32_t s1, s2, sumd;
2301
2302 s1 = LONG_SUM(ntohl(ip->ip_src.s_addr));
2303 s2 = LONG_SUM(ntohl(nat->nat_outip.s_addr));
2304 CALC_SUMD(s1, s2, sumd);
2305
2306 if (nat->nat_dir == NAT_OUTBOUND)
| 2311 ipfr_nat_newfrag(ip, fin, 0, nat);
2312 MUTEX_ENTER(&nat->nat_lock);
2313 nat->nat_age = fr_defnatage;
2314 nat->nat_bytes += ip->ip_len;
2315 nat->nat_pkts++;
2316 MUTEX_EXIT(&nat->nat_lock);
2317
2318 /*
2319 * Fix up checksums, not by recalculating them, but
2320 * simply computing adjustments.
2321 */
2322 if (nflags == IPN_ICMPERR) {
2323 u_32_t s1, s2, sumd;
2324
2325 s1 = LONG_SUM(ntohl(ip->ip_src.s_addr));
2326 s2 = LONG_SUM(ntohl(nat->nat_outip.s_addr));
2327 CALC_SUMD(s1, s2, sumd);
2328
2329 if (nat->nat_dir == NAT_OUTBOUND)
|
2307 fix_incksum(&ip->ip_sum, sumd);
| 2330 fix_incksum(fin, &ip->ip_sum, sumd);
|
2308 else
| 2331 else
|
2309 fix_outcksum(&ip->ip_sum, sumd);
| 2332 fix_outcksum(fin, &ip->ip_sum, sumd);
|
2310 }
2311#if SOLARIS || defined(__sgi)
2312 else {
2313 if (nat->nat_dir == NAT_OUTBOUND)
| 2333 }
2334#if SOLARIS || defined(__sgi)
2335 else {
2336 if (nat->nat_dir == NAT_OUTBOUND)
|
2314 fix_outcksum(&ip->ip_sum, nat->nat_ipsumd);
| 2337 fix_outcksum(fin, &ip->ip_sum, nat->nat_ipsumd);
|
2315 else
| 2338 else
|
2316 fix_incksum(&ip->ip_sum, nat->nat_ipsumd);
| 2339 fix_incksum(fin, &ip->ip_sum, nat->nat_ipsumd);
|
2317 }
2318#endif
2319 ip->ip_src = nat->nat_outip;
2320
| 2340 }
2341#endif
2342 ip->ip_src = nat->nat_outip;
2343
|
2321 if (!(ip->ip_off & IP_OFFMASK) &&
2322 !(fin->fin_fi.fi_fl & FI_SHORT)) {
| 2344 if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
|
2323
2324 if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) {
2325 tcp->th_sport = nat->nat_outport;
2326 fin->fin_data[0] = ntohs(tcp->th_sport);
2327 }
2328
2329 if (ip->ip_p == IPPROTO_TCP) {
2330 csump = &tcp->th_sum;
2331 MUTEX_ENTER(&nat->nat_lock);
2332 fr_tcp_age(&nat->nat_age,
2333 nat->nat_tcpstate, fin, 1);
2334 if (nat->nat_age < fr_defnaticmpage)
2335 nat->nat_age = fr_defnaticmpage;
2336#ifdef LARGE_NAT
2337 else if (nat->nat_age > fr_defnatage)
2338 nat->nat_age = fr_defnatage;
2339#endif
2340 /*
2341 * Increase this because we may have
2342 * "keep state" following this too and
2343 * packet storms can occur if this is
2344 * removed too quickly.
2345 */
2346 if (nat->nat_age == fr_tcpclosed)
2347 nat->nat_age = fr_tcplastack;
2348 MUTEX_EXIT(&nat->nat_lock);
2349 } else if (ip->ip_p == IPPROTO_UDP) {
2350 udphdr_t *udp = (udphdr_t *)tcp;
2351
2352 if (udp->uh_sum)
2353 csump = &udp->uh_sum;
2354 } else if (ip->ip_p == IPPROTO_ICMP) {
| 2345
2346 if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) {
2347 tcp->th_sport = nat->nat_outport;
2348 fin->fin_data[0] = ntohs(tcp->th_sport);
2349 }
2350
2351 if (ip->ip_p == IPPROTO_TCP) {
2352 csump = &tcp->th_sum;
2353 MUTEX_ENTER(&nat->nat_lock);
2354 fr_tcp_age(&nat->nat_age,
2355 nat->nat_tcpstate, fin, 1);
2356 if (nat->nat_age < fr_defnaticmpage)
2357 nat->nat_age = fr_defnaticmpage;
2358#ifdef LARGE_NAT
2359 else if (nat->nat_age > fr_defnatage)
2360 nat->nat_age = fr_defnatage;
2361#endif
2362 /*
2363 * Increase this because we may have
2364 * "keep state" following this too and
2365 * packet storms can occur if this is
2366 * removed too quickly.
2367 */
2368 if (nat->nat_age == fr_tcpclosed)
2369 nat->nat_age = fr_tcplastack;
2370 MUTEX_EXIT(&nat->nat_lock);
2371 } else if (ip->ip_p == IPPROTO_UDP) {
2372 udphdr_t *udp = (udphdr_t *)tcp;
2373
2374 if (udp->uh_sum)
2375 csump = &udp->uh_sum;
2376 } else if (ip->ip_p == IPPROTO_ICMP) {
|
2355 nat->nat_age = fr_defnaticmpage;
| 2377 if (!icmpset)
2378 nat->nat_age = fr_defnaticmpage;
|
2356 }
2357
2358 if (csump) {
2359 if (nat->nat_dir == NAT_OUTBOUND)
| 2379 }
2380
2381 if (csump) {
2382 if (nat->nat_dir == NAT_OUTBOUND)
|
2360 fix_outcksum(csump, nat->nat_sumd[1]);
| 2383 fix_outcksum(fin, csump, nat->nat_sumd[1]);
|
2361 else
| 2384 else
|
2362 fix_incksum(csump, nat->nat_sumd[1]);
| 2385 fix_incksum(fin, csump, nat->nat_sumd[1]);
|
2363 }
2364 }
2365
2366 if ((np->in_apr != NULL) && (np->in_dport == 0 ||
2367 (tcp != NULL && dport == np->in_dport))) {
2368 i = appr_check(ip, fin, nat);
2369 if (i == 0)
2370 i = 1;
2371 } else
2372 i = 1;
2373 ATOMIC_INCL(nat_stats.ns_mapped[1]);
2374 RWLOCK_EXIT(&ipf_nat); /* READ */
2375 return i;
2376 }
2377 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */
2378 return 0;
2379}
2380
2381
2382/*
2383 * Packets coming in from the external interface go through this.
2384 * Here, the destination address requires alteration, if anything.
2385 */
2386int ip_natin(ip, fin)
2387ip_t *ip;
2388fr_info_t *fin;
2389{
2390 register struct in_addr src;
2391 register struct in_addr in;
2392 register ipnat_t *np;
| 2386 }
2387 }
2388
2389 if ((np->in_apr != NULL) && (np->in_dport == 0 ||
2390 (tcp != NULL && dport == np->in_dport))) {
2391 i = appr_check(ip, fin, nat);
2392 if (i == 0)
2393 i = 1;
2394 } else
2395 i = 1;
2396 ATOMIC_INCL(nat_stats.ns_mapped[1]);
2397 RWLOCK_EXIT(&ipf_nat); /* READ */
2398 return i;
2399 }
2400 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */
2401 return 0;
2402}
2403
2404
2405/*
2406 * Packets coming in from the external interface go through this.
2407 * Here, the destination address requires alteration, if anything.
2408 */
2409int ip_natin(ip, fin)
2410ip_t *ip;
2411fr_info_t *fin;
2412{
2413 register struct in_addr src;
2414 register struct in_addr in;
2415 register ipnat_t *np;
|
| 2416 u_short sport = 0, dport = 0, *csump = NULL;
|
2393 u_int nflags = 0, natadd = 1, hv, msk;
2394 struct ifnet *ifp = fin->fin_ifp;
2395 tcphdr_t *tcp = NULL;
| 2417 u_int nflags = 0, natadd = 1, hv, msk;
2418 struct ifnet *ifp = fin->fin_ifp;
2419 tcphdr_t *tcp = NULL;
|
2396 u_short sport = 0, dport = 0, *csump = NULL;
| 2420 int i, icmpset = 0;
|
2397 nat_t *nat;
2398 u_32_t iph;
| 2421 nat_t *nat;
2422 u_32_t iph;
|
2399 int i;
| |
2400
2401 if ((nat_list == NULL) || (ip->ip_v != 4) || (fr_nat_lock))
2402 return 0;
2403
| 2423
2424 if ((nat_list == NULL) || (ip->ip_v != 4) || (fr_nat_lock))
2425 return 0;
2426
|
2404 if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) {
| 2427 if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
|
2405 if (ip->ip_p == IPPROTO_TCP)
2406 nflags = IPN_TCP;
2407 else if (ip->ip_p == IPPROTO_UDP)
2408 nflags = IPN_UDP;
2409 if ((nflags & IPN_TCPUDP)) {
2410 tcp = (tcphdr_t *)fin->fin_dp;
2411 dport = tcp->th_dport;
2412 sport = tcp->th_sport;
2413 }
2414 }
2415
2416 in = ip->ip_dst;
2417 /* make sure the source address is to be redirected */
2418 src = ip->ip_src;
2419
2420 READ_ENTER(&ipf_nat);
2421
2422 if ((ip->ip_p == IPPROTO_ICMP) &&
2423 (nat = nat_icmp(ip, fin, &nflags, NAT_INBOUND)))
| 2428 if (ip->ip_p == IPPROTO_TCP)
2429 nflags = IPN_TCP;
2430 else if (ip->ip_p == IPPROTO_UDP)
2431 nflags = IPN_UDP;
2432 if ((nflags & IPN_TCPUDP)) {
2433 tcp = (tcphdr_t *)fin->fin_dp;
2434 dport = tcp->th_dport;
2435 sport = tcp->th_sport;
2436 }
2437 }
2438
2439 in = ip->ip_dst;
2440 /* make sure the source address is to be redirected */
2441 src = ip->ip_src;
2442
2443 READ_ENTER(&ipf_nat);
2444
2445 if ((ip->ip_p == IPPROTO_ICMP) &&
2446 (nat = nat_icmp(ip, fin, &nflags, NAT_INBOUND)))
|
2424 ;
2425 else if ((ip->ip_off & (IP_OFFMASK|IP_MF)) &&
| 2447 icmpset = 1;
2448 else if ((fin->fin_fl & FI_FRAG) &&
|
2426 (nat = ipfr_nat_knownfrag(ip, fin)))
2427 natadd = 0;
2428 else if ((nat = nat_inlookup(fin->fin_ifp, nflags, (u_int)ip->ip_p,
2429 ip->ip_src, in, (dport << 16) | sport,
2430 0))) {
2431 nflags = nat->nat_flags;
2432 if ((nflags & (FI_W_SPORT|FI_W_DPORT)) != 0) {
2433 if ((nat->nat_oport != sport) && (nflags & FI_W_DPORT))
2434 nat->nat_oport = sport;
2435 else if ((nat->nat_outport != dport) &&
2436 (nflags & FI_W_SPORT))
2437 nat->nat_outport = dport;
2438 nat->nat_flags &= ~(FI_W_SPORT|FI_W_DPORT);
2439 nflags = nat->nat_flags;
2440 nat_stats.ns_wilds--;
2441 }
2442 } else {
2443 RWLOCK_EXIT(&ipf_nat);
2444 WRITE_ENTER(&ipf_nat);
2445 /*
2446 * If there is no current entry in the nat table for this IP#,
2447 * create one for it (if there is a matching rule).
2448 */
2449 msk = 0xffffffff;
2450 i = 32;
2451maskloop:
2452 iph = in.s_addr & htonl(msk);
2453 hv = NAT_HASH_FN(iph, 0, ipf_rdrrules_sz);
2454 for (np = rdr_rules[hv]; np; np = np->in_rnext) {
2455 if ((np->in_ifp && (np->in_ifp != ifp)) ||
2456 (np->in_p && (np->in_p != ip->ip_p)) ||
2457 (np->in_flags && !(nflags & np->in_flags)))
2458 continue;
2459 if (np->in_flags & IPN_FILTER) {
2460 if (!nat_match(fin, np, ip))
2461 continue;
2462 } else if ((in.s_addr & np->in_outmsk) != np->in_outip)
2463 continue;
2464 if ((np->in_redir & NAT_REDIRECT) &&
2465 (!np->in_pmin || (np->in_flags & IPN_FILTER) ||
2466 ((ntohs(np->in_pmax) >= ntohs(dport)) &&
2467 (ntohs(dport) >= ntohs(np->in_pmin)))))
2468 if ((nat = nat_new(np, ip, fin, nflags,
2469 NAT_INBOUND))) {
2470 np->in_hits++;
2471 break;
2472 }
2473 }
2474
2475 if ((np == NULL) && (i > 0)) {
2476 do {
2477 i--;
2478 msk <<= 1;
2479 } while ((i >= 0) && ((rdr_masks & (1 << i)) == 0));
2480 if (i >= 0)
2481 goto maskloop;
2482 }
2483 MUTEX_DOWNGRADE(&ipf_nat);
2484 }
2485
2486 /*
2487 * NOTE: ipf_nat must now only be held as a read lock
2488 */
2489 if (nat) {
2490 np = nat->nat_ptr;
2491 fin->fin_fr = nat->nat_fr;
| 2449 (nat = ipfr_nat_knownfrag(ip, fin)))
2450 natadd = 0;
2451 else if ((nat = nat_inlookup(fin->fin_ifp, nflags, (u_int)ip->ip_p,
2452 ip->ip_src, in, (dport << 16) | sport,
2453 0))) {
2454 nflags = nat->nat_flags;
2455 if ((nflags & (FI_W_SPORT|FI_W_DPORT)) != 0) {
2456 if ((nat->nat_oport != sport) && (nflags & FI_W_DPORT))
2457 nat->nat_oport = sport;
2458 else if ((nat->nat_outport != dport) &&
2459 (nflags & FI_W_SPORT))
2460 nat->nat_outport = dport;
2461 nat->nat_flags &= ~(FI_W_SPORT|FI_W_DPORT);
2462 nflags = nat->nat_flags;
2463 nat_stats.ns_wilds--;
2464 }
2465 } else {
2466 RWLOCK_EXIT(&ipf_nat);
2467 WRITE_ENTER(&ipf_nat);
2468 /*
2469 * If there is no current entry in the nat table for this IP#,
2470 * create one for it (if there is a matching rule).
2471 */
2472 msk = 0xffffffff;
2473 i = 32;
2474maskloop:
2475 iph = in.s_addr & htonl(msk);
2476 hv = NAT_HASH_FN(iph, 0, ipf_rdrrules_sz);
2477 for (np = rdr_rules[hv]; np; np = np->in_rnext) {
2478 if ((np->in_ifp && (np->in_ifp != ifp)) ||
2479 (np->in_p && (np->in_p != ip->ip_p)) ||
2480 (np->in_flags && !(nflags & np->in_flags)))
2481 continue;
2482 if (np->in_flags & IPN_FILTER) {
2483 if (!nat_match(fin, np, ip))
2484 continue;
2485 } else if ((in.s_addr & np->in_outmsk) != np->in_outip)
2486 continue;
2487 if ((np->in_redir & NAT_REDIRECT) &&
2488 (!np->in_pmin || (np->in_flags & IPN_FILTER) ||
2489 ((ntohs(np->in_pmax) >= ntohs(dport)) &&
2490 (ntohs(dport) >= ntohs(np->in_pmin)))))
2491 if ((nat = nat_new(np, ip, fin, nflags,
2492 NAT_INBOUND))) {
2493 np->in_hits++;
2494 break;
2495 }
2496 }
2497
2498 if ((np == NULL) && (i > 0)) {
2499 do {
2500 i--;
2501 msk <<= 1;
2502 } while ((i >= 0) && ((rdr_masks & (1 << i)) == 0));
2503 if (i >= 0)
2504 goto maskloop;
2505 }
2506 MUTEX_DOWNGRADE(&ipf_nat);
2507 }
2508
2509 /*
2510 * NOTE: ipf_nat must now only be held as a read lock
2511 */
2512 if (nat) {
2513 np = nat->nat_ptr;
2514 fin->fin_fr = nat->nat_fr;
|
2492 if (natadd && (fin->fin_fi.fi_fl & FI_FRAG) &&
2493 np && (np->in_flags & IPN_FRAG))
| 2515 if (natadd && (fin->fin_fl & FI_FRAG) && np)
|
2494 ipfr_nat_newfrag(ip, fin, 0, nat);
2495 if ((np->in_apr != NULL) && (np->in_dport == 0 ||
2496 (tcp != NULL && sport == np->in_dport))) {
2497 i = appr_check(ip, fin, nat);
2498 if (i == -1) {
2499 RWLOCK_EXIT(&ipf_nat);
2500 return i;
2501 }
2502 }
2503
2504 MUTEX_ENTER(&nat->nat_lock);
2505 if (nflags != IPN_ICMPERR)
2506 nat->nat_age = fr_defnatage;
2507
2508 nat->nat_bytes += ip->ip_len;
2509 nat->nat_pkts++;
2510 MUTEX_EXIT(&nat->nat_lock);
2511 ip->ip_dst = nat->nat_inip;
2512 fin->fin_fi.fi_daddr = nat->nat_inip.s_addr;
2513
2514 /*
2515 * Fix up checksums, not by recalculating them, but
2516 * simply computing adjustments.
2517 */
2518#if SOLARIS || defined(__sgi)
2519 if (nat->nat_dir == NAT_OUTBOUND)
| 2516 ipfr_nat_newfrag(ip, fin, 0, nat);
2517 if ((np->in_apr != NULL) && (np->in_dport == 0 ||
2518 (tcp != NULL && sport == np->in_dport))) {
2519 i = appr_check(ip, fin, nat);
2520 if (i == -1) {
2521 RWLOCK_EXIT(&ipf_nat);
2522 return i;
2523 }
2524 }
2525
2526 MUTEX_ENTER(&nat->nat_lock);
2527 if (nflags != IPN_ICMPERR)
2528 nat->nat_age = fr_defnatage;
2529
2530 nat->nat_bytes += ip->ip_len;
2531 nat->nat_pkts++;
2532 MUTEX_EXIT(&nat->nat_lock);
2533 ip->ip_dst = nat->nat_inip;
2534 fin->fin_fi.fi_daddr = nat->nat_inip.s_addr;
2535
2536 /*
2537 * Fix up checksums, not by recalculating them, but
2538 * simply computing adjustments.
2539 */
2540#if SOLARIS || defined(__sgi)
2541 if (nat->nat_dir == NAT_OUTBOUND)
|
2520 fix_incksum(&ip->ip_sum, nat->nat_ipsumd);
| 2542 fix_incksum(fin, &ip->ip_sum, nat->nat_ipsumd);
|
2521 else
| 2543 else
|
2522 fix_outcksum(&ip->ip_sum, nat->nat_ipsumd);
| 2544 fix_outcksum(fin, &ip->ip_sum, nat->nat_ipsumd);
|
2523#endif
| 2545#endif
|
2524 if (!(ip->ip_off & IP_OFFMASK) &&
2525 !(fin->fin_fi.fi_fl & FI_SHORT)) {
| 2546 if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
|
2526
2527 if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) {
2528 tcp->th_dport = nat->nat_inport;
2529 fin->fin_data[1] = ntohs(tcp->th_dport);
2530 }
2531
2532 if (ip->ip_p == IPPROTO_TCP) {
2533 csump = &tcp->th_sum;
2534 MUTEX_ENTER(&nat->nat_lock);
2535 fr_tcp_age(&nat->nat_age,
2536 nat->nat_tcpstate, fin, 0);
2537 if (nat->nat_age < fr_defnaticmpage)
2538 nat->nat_age = fr_defnaticmpage;
2539#ifdef LARGE_NAT
2540 else if (nat->nat_age > fr_defnatage)
2541 nat->nat_age = fr_defnatage;
2542#endif
2543 /*
2544 * Increase this because we may have
2545 * "keep state" following this too and
2546 * packet storms can occur if this is
2547 * removed too quickly.
2548 */
2549 if (nat->nat_age == fr_tcpclosed)
2550 nat->nat_age = fr_tcplastack;
2551 MUTEX_EXIT(&nat->nat_lock);
2552 } else if (ip->ip_p == IPPROTO_UDP) {
2553 udphdr_t *udp = (udphdr_t *)tcp;
2554
2555 if (udp->uh_sum)
2556 csump = &udp->uh_sum;
2557 } else if (ip->ip_p == IPPROTO_ICMP) {
| 2547
2548 if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) {
2549 tcp->th_dport = nat->nat_inport;
2550 fin->fin_data[1] = ntohs(tcp->th_dport);
2551 }
2552
2553 if (ip->ip_p == IPPROTO_TCP) {
2554 csump = &tcp->th_sum;
2555 MUTEX_ENTER(&nat->nat_lock);
2556 fr_tcp_age(&nat->nat_age,
2557 nat->nat_tcpstate, fin, 0);
2558 if (nat->nat_age < fr_defnaticmpage)
2559 nat->nat_age = fr_defnaticmpage;
2560#ifdef LARGE_NAT
2561 else if (nat->nat_age > fr_defnatage)
2562 nat->nat_age = fr_defnatage;
2563#endif
2564 /*
2565 * Increase this because we may have
2566 * "keep state" following this too and
2567 * packet storms can occur if this is
2568 * removed too quickly.
2569 */
2570 if (nat->nat_age == fr_tcpclosed)
2571 nat->nat_age = fr_tcplastack;
2572 MUTEX_EXIT(&nat->nat_lock);
2573 } else if (ip->ip_p == IPPROTO_UDP) {
2574 udphdr_t *udp = (udphdr_t *)tcp;
2575
2576 if (udp->uh_sum)
2577 csump = &udp->uh_sum;
2578 } else if (ip->ip_p == IPPROTO_ICMP) {
|
2558 nat->nat_age = fr_defnaticmpage;
| 2579 if (!icmpset)
2580 nat->nat_age = fr_defnaticmpage;
|
2559 }
2560
2561 if (csump) {
2562 if (nat->nat_dir == NAT_OUTBOUND)
| 2581 }
2582
2583 if (csump) {
2584 if (nat->nat_dir == NAT_OUTBOUND)
|
2563 fix_incksum(csump, nat->nat_sumd[0]);
| 2585 fix_incksum(fin, csump, nat->nat_sumd[0]);
|
2564 else
| 2586 else
|
2565 fix_outcksum(csump, nat->nat_sumd[0]);
| 2587 fix_outcksum(fin, csump, nat->nat_sumd[0]);
|
2566 }
2567 }
2568 ATOMIC_INCL(nat_stats.ns_mapped[0]);
2569 RWLOCK_EXIT(&ipf_nat); /* READ */
2570 return 1;
2571 }
2572 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */
2573 return 0;
2574}
2575
2576
2577/*
2578 * Free all memory used by NAT structures allocated at runtime.
2579 */
2580void ip_natunload()
2581{
2582 WRITE_ENTER(&ipf_nat);
2583 (void) nat_clearlist();
2584 (void) nat_flushtable();
2585 RWLOCK_EXIT(&ipf_nat);
2586
2587 if (nat_table[0] != NULL) {
2588 KFREES(nat_table[0], sizeof(nat_t *) * ipf_nattable_sz);
2589 nat_table[0] = NULL;
2590 }
2591 if (nat_table[1] != NULL) {
2592 KFREES(nat_table[1], sizeof(nat_t *) * ipf_nattable_sz);
2593 nat_table[1] = NULL;
2594 }
2595 if (nat_rules != NULL) {
2596 KFREES(nat_rules, sizeof(ipnat_t *) * ipf_natrules_sz);
2597 nat_rules = NULL;
2598 }
2599 if (rdr_rules != NULL) {
2600 KFREES(rdr_rules, sizeof(ipnat_t *) * ipf_rdrrules_sz);
2601 rdr_rules = NULL;
2602 }
2603 if (maptable != NULL) {
2604 KFREES(maptable, sizeof(hostmap_t *) * ipf_hostmap_sz);
2605 maptable = NULL;
2606 }
2607}
2608
2609
2610/*
2611 * Slowly expire held state for NAT entries. Timeouts are set in
2612 * expectation of this being called twice per second.
2613 */
2614void ip_natexpire()
2615{
2616 register struct nat *nat, **natp;
2617#if defined(_KERNEL) && !SOLARIS
2618 int s;
2619#endif
2620
2621 SPL_NET(s);
2622 WRITE_ENTER(&ipf_nat);
2623 for (natp = &nat_instances; (nat = *natp); ) {
2624 nat->nat_age--;
2625 if (nat->nat_age) {
2626 natp = &nat->nat_next;
2627 continue;
2628 }
2629 *natp = nat->nat_next;
2630#ifdef IPFILTER_LOG
2631 nat_log(nat, NL_EXPIRE);
2632#endif
2633 nat_delete(nat);
2634 nat_stats.ns_expire++;
2635 }
2636 RWLOCK_EXIT(&ipf_nat);
2637 SPL_X(s);
2638}
2639
2640
2641/*
2642 */
2643void ip_natsync(ifp)
2644void *ifp;
2645{
2646 register ipnat_t *n;
2647 register nat_t *nat;
2648 register u_32_t sum1, sum2, sumd;
2649 struct in_addr in;
2650 ipnat_t *np;
2651 void *ifp2;
2652#if defined(_KERNEL) && !SOLARIS
2653 int s;
2654#endif
2655
2656 /*
2657 * Change IP addresses for NAT sessions for any protocol except TCP
2658 * since it will break the TCP connection anyway.
2659 */
2660 SPL_NET(s);
2661 WRITE_ENTER(&ipf_nat);
2662 for (nat = nat_instances; nat; nat = nat->nat_next)
2663 if (((ifp == NULL) || (ifp == nat->nat_ifp)) &&
2664 !(nat->nat_flags & IPN_TCP) && (np = nat->nat_ptr) &&
2665 (np->in_outmsk == 0xffffffff) && !np->in_nip) {
2666 ifp2 = nat->nat_ifp;
2667 /*
2668 * Change the map-to address to be the same as the
2669 * new one.
2670 */
2671 sum1 = nat->nat_outip.s_addr;
2672 if (fr_ifpaddr(4, ifp2, &in) != -1)
2673 nat->nat_outip = in;
2674 sum2 = nat->nat_outip.s_addr;
2675
2676 if (sum1 == sum2)
2677 continue;
2678 /*
2679 * Readjust the checksum adjustment to take into
2680 * account the new IP#.
2681 */
2682 CALC_SUMD(sum1, sum2, sumd);
2683 /* XXX - dont change for TCP when solaris does
2684 * hardware checksumming.
2685 */
2686 sumd += nat->nat_sumd[0];
2687 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
2688 nat->nat_sumd[1] = nat->nat_sumd[0];
2689 }
2690
2691 for (n = nat_list; (n != NULL); n = n->in_next)
2692 if (n->in_ifp == ifp) {
2693 n->in_ifp = (void *)GETUNIT(n->in_ifname, 4);
2694 if (!n->in_ifp)
2695 n->in_ifp = (void *)-1;
2696 }
2697 RWLOCK_EXIT(&ipf_nat);
2698 SPL_X(s);
2699}
2700
2701
2702#ifdef IPFILTER_LOG
2703void nat_log(nat, type)
2704struct nat *nat;
2705u_int type;
2706{
2707 struct ipnat *np;
2708 struct natlog natl;
2709 void *items[1];
2710 size_t sizes[1];
2711 int rulen, types[1];
2712
2713 natl.nl_inip = nat->nat_inip;
2714 natl.nl_outip = nat->nat_outip;
2715 natl.nl_origip = nat->nat_oip;
2716 natl.nl_bytes = nat->nat_bytes;
2717 natl.nl_pkts = nat->nat_pkts;
2718 natl.nl_origport = nat->nat_oport;
2719 natl.nl_inport = nat->nat_inport;
2720 natl.nl_outport = nat->nat_outport;
2721 natl.nl_p = nat->nat_p;
2722 natl.nl_type = type;
2723 natl.nl_rule = -1;
2724#ifndef LARGE_NAT
2725 if (nat->nat_ptr != NULL) {
2726 for (rulen = 0, np = nat_list; np; np = np->in_next, rulen++)
2727 if (np == nat->nat_ptr) {
2728 natl.nl_rule = rulen;
2729 break;
2730 }
2731 }
2732#endif
2733 items[0] = &natl;
2734 sizes[0] = sizeof(natl);
2735 types[0] = 0;
2736
2737 (void) ipllog(IPL_LOGNAT, NULL, items, sizes, types, 1);
2738}
2739#endif
| 2588 }
2589 }
2590 ATOMIC_INCL(nat_stats.ns_mapped[0]);
2591 RWLOCK_EXIT(&ipf_nat); /* READ */
2592 return 1;
2593 }
2594 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */
2595 return 0;
2596}
2597
2598
2599/*
2600 * Free all memory used by NAT structures allocated at runtime.
2601 */
2602void ip_natunload()
2603{
2604 WRITE_ENTER(&ipf_nat);
2605 (void) nat_clearlist();
2606 (void) nat_flushtable();
2607 RWLOCK_EXIT(&ipf_nat);
2608
2609 if (nat_table[0] != NULL) {
2610 KFREES(nat_table[0], sizeof(nat_t *) * ipf_nattable_sz);
2611 nat_table[0] = NULL;
2612 }
2613 if (nat_table[1] != NULL) {
2614 KFREES(nat_table[1], sizeof(nat_t *) * ipf_nattable_sz);
2615 nat_table[1] = NULL;
2616 }
2617 if (nat_rules != NULL) {
2618 KFREES(nat_rules, sizeof(ipnat_t *) * ipf_natrules_sz);
2619 nat_rules = NULL;
2620 }
2621 if (rdr_rules != NULL) {
2622 KFREES(rdr_rules, sizeof(ipnat_t *) * ipf_rdrrules_sz);
2623 rdr_rules = NULL;
2624 }
2625 if (maptable != NULL) {
2626 KFREES(maptable, sizeof(hostmap_t *) * ipf_hostmap_sz);
2627 maptable = NULL;
2628 }
2629}
2630
2631
2632/*
2633 * Slowly expire held state for NAT entries. Timeouts are set in
2634 * expectation of this being called twice per second.
2635 */
2636void ip_natexpire()
2637{
2638 register struct nat *nat, **natp;
2639#if defined(_KERNEL) && !SOLARIS
2640 int s;
2641#endif
2642
2643 SPL_NET(s);
2644 WRITE_ENTER(&ipf_nat);
2645 for (natp = &nat_instances; (nat = *natp); ) {
2646 nat->nat_age--;
2647 if (nat->nat_age) {
2648 natp = &nat->nat_next;
2649 continue;
2650 }
2651 *natp = nat->nat_next;
2652#ifdef IPFILTER_LOG
2653 nat_log(nat, NL_EXPIRE);
2654#endif
2655 nat_delete(nat);
2656 nat_stats.ns_expire++;
2657 }
2658 RWLOCK_EXIT(&ipf_nat);
2659 SPL_X(s);
2660}
2661
2662
2663/*
2664 */
2665void ip_natsync(ifp)
2666void *ifp;
2667{
2668 register ipnat_t *n;
2669 register nat_t *nat;
2670 register u_32_t sum1, sum2, sumd;
2671 struct in_addr in;
2672 ipnat_t *np;
2673 void *ifp2;
2674#if defined(_KERNEL) && !SOLARIS
2675 int s;
2676#endif
2677
2678 /*
2679 * Change IP addresses for NAT sessions for any protocol except TCP
2680 * since it will break the TCP connection anyway.
2681 */
2682 SPL_NET(s);
2683 WRITE_ENTER(&ipf_nat);
2684 for (nat = nat_instances; nat; nat = nat->nat_next)
2685 if (((ifp == NULL) || (ifp == nat->nat_ifp)) &&
2686 !(nat->nat_flags & IPN_TCP) && (np = nat->nat_ptr) &&
2687 (np->in_outmsk == 0xffffffff) && !np->in_nip) {
2688 ifp2 = nat->nat_ifp;
2689 /*
2690 * Change the map-to address to be the same as the
2691 * new one.
2692 */
2693 sum1 = nat->nat_outip.s_addr;
2694 if (fr_ifpaddr(4, ifp2, &in) != -1)
2695 nat->nat_outip = in;
2696 sum2 = nat->nat_outip.s_addr;
2697
2698 if (sum1 == sum2)
2699 continue;
2700 /*
2701 * Readjust the checksum adjustment to take into
2702 * account the new IP#.
2703 */
2704 CALC_SUMD(sum1, sum2, sumd);
2705 /* XXX - dont change for TCP when solaris does
2706 * hardware checksumming.
2707 */
2708 sumd += nat->nat_sumd[0];
2709 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
2710 nat->nat_sumd[1] = nat->nat_sumd[0];
2711 }
2712
2713 for (n = nat_list; (n != NULL); n = n->in_next)
2714 if (n->in_ifp == ifp) {
2715 n->in_ifp = (void *)GETUNIT(n->in_ifname, 4);
2716 if (!n->in_ifp)
2717 n->in_ifp = (void *)-1;
2718 }
2719 RWLOCK_EXIT(&ipf_nat);
2720 SPL_X(s);
2721}
2722
2723
2724#ifdef IPFILTER_LOG
2725void nat_log(nat, type)
2726struct nat *nat;
2727u_int type;
2728{
2729 struct ipnat *np;
2730 struct natlog natl;
2731 void *items[1];
2732 size_t sizes[1];
2733 int rulen, types[1];
2734
2735 natl.nl_inip = nat->nat_inip;
2736 natl.nl_outip = nat->nat_outip;
2737 natl.nl_origip = nat->nat_oip;
2738 natl.nl_bytes = nat->nat_bytes;
2739 natl.nl_pkts = nat->nat_pkts;
2740 natl.nl_origport = nat->nat_oport;
2741 natl.nl_inport = nat->nat_inport;
2742 natl.nl_outport = nat->nat_outport;
2743 natl.nl_p = nat->nat_p;
2744 natl.nl_type = type;
2745 natl.nl_rule = -1;
2746#ifndef LARGE_NAT
2747 if (nat->nat_ptr != NULL) {
2748 for (rulen = 0, np = nat_list; np; np = np->in_next, rulen++)
2749 if (np == nat->nat_ptr) {
2750 natl.nl_rule = rulen;
2751 break;
2752 }
2753 }
2754#endif
2755 items[0] = &natl;
2756 sizes[0] = sizeof(natl);
2757 types[0] = 0;
2758
2759 (void) ipllog(IPL_LOGNAT, NULL, items, sizes, types, 1);
2760}
2761#endif
|