ip_nat.c revision 67614
1/* 2 * Copyright (C) 1995-2000 by Darren Reed. 3 * 4 * Redistribution and use in source and binary forms are permitted 5 * provided that this notice is preserved and due credit is given 6 * to the original author and the contributors. 7 * 8 * Added redirect stuff and a LOT of bug fixes. (mcn@EnGarde.com) 9 */ 10#if !defined(lint) 11static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed"; 12/*static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.16 2000/07/18 13:57:40 darrenr Exp $";*/ 13static const char rcsid[] = "@(#)$FreeBSD: head/sys/contrib/ipfilter/netinet/ip_nat.c 67614 2000-10-26 12:33:42Z darrenr $"; 14#endif 15 16#if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL) 17#define _KERNEL 18#endif 19 20#include <sys/errno.h> 21#include <sys/types.h> 22#include <sys/param.h> 23#include <sys/time.h> 24#include <sys/file.h> 25#if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \ 26 defined(_KERNEL) 27# include "opt_ipfilter_log.h" 28#endif 29#if !defined(_KERNEL) && !defined(KERNEL) 30# include <stdio.h> 31# include <string.h> 32# include <stdlib.h> 33#endif 34#if (defined(KERNEL) || defined(_KERNEL)) && (__FreeBSD_version >= 220000) 35# include <sys/filio.h> 36# include <sys/fcntl.h> 37#else 38# include <sys/ioctl.h> 39#endif 40#include <sys/fcntl.h> 41#include <sys/uio.h> 42#ifndef linux 43# include <sys/protosw.h> 44#endif 45#include <sys/socket.h> 46#if defined(_KERNEL) && !defined(linux) 47# include <sys/systm.h> 48#endif 49#if !defined(__SVR4) && !defined(__svr4__) 50# ifndef linux 51# include <sys/mbuf.h> 52# endif 53#else 54# include <sys/filio.h> 55# include <sys/byteorder.h> 56# ifdef _KERNEL 57# include <sys/dditypes.h> 58# endif 59# include <sys/stream.h> 60# include <sys/kmem.h> 61#endif 62#if __FreeBSD_version >= 300000 63# include <sys/queue.h> 64#endif 65#include <net/if.h> 66#if __FreeBSD_version >= 300000 67# include <net/if_var.h> 68# if defined(_KERNEL) && !defined(IPFILTER_LKM) 69# include "opt_ipfilter.h" 70# endif 71#endif 72#ifdef sun 73# include <net/af.h> 74#endif 75#include <net/route.h> 76#include <netinet/in.h> 77#include <netinet/in_systm.h> 78#include <netinet/ip.h> 79 80#ifdef __sgi 81# ifdef IFF_DRVRLOCK /* IRIX6 */ 82#include <sys/hashing.h> 83#include <netinet/in_var.h> 84# endif 85#endif 86 87#ifdef RFC1825 88# include <vpn/md5.h> 89# include <vpn/ipsec.h> 90extern struct ifnet vpnif; 91#endif 92 93#ifndef linux 94# include <netinet/ip_var.h> 95#endif 96#include <netinet/tcp.h> 97#include <netinet/udp.h> 98#include <netinet/ip_icmp.h> 99#include "netinet/ip_compat.h" 100#include <netinet/tcpip.h> 101#include "netinet/ip_fil.h" 102#include "netinet/ip_proxy.h" 103#include "netinet/ip_nat.h" 104#include "netinet/ip_frag.h" 105#include "netinet/ip_state.h" 106#if (__FreeBSD_version >= 300000) 107# include <sys/malloc.h> 108#endif 109#ifndef MIN 110# define MIN(a,b) (((a)<(b))?(a):(b)) 111#endif 112#undef SOCKADDR_IN 113#define SOCKADDR_IN struct sockaddr_in 114 115nat_t **nat_table[2] = { NULL, NULL }, 116 *nat_instances = NULL; 117ipnat_t *nat_list = NULL; 118u_int ipf_nattable_sz = NAT_TABLE_SZ; 119u_int ipf_natrules_sz = NAT_SIZE; 120u_int ipf_rdrrules_sz = RDR_SIZE; 121u_int ipf_hostmap_sz = HOSTMAP_SIZE; 122int nat_wilds = 0; 123u_32_t nat_masks = 0; 124u_32_t rdr_masks = 0; 125ipnat_t **nat_rules = NULL; 126ipnat_t **rdr_rules = NULL; 127hostmap_t **maptable = NULL; 128 129u_long fr_defnatage = DEF_NAT_AGE, 130 fr_defnaticmpage = 6; /* 3 seconds */ 131natstat_t nat_stats; 132int fr_nat_lock = 0; 133#if (SOLARIS || defined(__sgi)) && defined(_KERNEL) 134extern kmutex_t ipf_rw, ipf_hostmap; 135extern KRWLOCK_T ipf_nat; 136#endif 137 138static int nat_flushtable __P((void)); 139static int nat_clearlist __P((void)); 140static void nat_addnat __P((struct ipnat *)); 141static void nat_addrdr __P((struct ipnat *)); 142static void nat_delete __P((struct nat *)); 143static void nat_delrdr __P((struct ipnat *)); 144static void nat_delnat __P((struct ipnat *)); 145static int fr_natgetent __P((caddr_t)); 146static int fr_natgetsz __P((caddr_t)); 147static int fr_natputent __P((caddr_t)); 148static void nat_tabmove __P((nat_t *, u_int)); 149static int nat_match __P((fr_info_t *, ipnat_t *, ip_t *)); 150static hostmap_t *nat_hostmap __P((ipnat_t *, struct in_addr, 151 struct in_addr)); 152static void nat_hostmapdel __P((struct hostmap *)); 153 154 155int nat_init() 156{ 157 KMALLOCS(nat_table[0], nat_t **, sizeof(nat_t *) * ipf_nattable_sz); 158 if (nat_table[0] != NULL) 159 bzero((char *)nat_table[0], ipf_nattable_sz * sizeof(nat_t *)); 160 else 161 return -1; 162 163 KMALLOCS(nat_table[1], nat_t **, sizeof(nat_t *) * ipf_nattable_sz); 164 if (nat_table[1] != NULL) 165 bzero((char *)nat_table[1], ipf_nattable_sz * sizeof(nat_t *)); 166 else 167 return -1; 168 169 KMALLOCS(nat_rules, ipnat_t **, sizeof(ipnat_t *) * ipf_natrules_sz); 170 if (nat_rules != NULL) 171 bzero((char *)nat_rules, ipf_natrules_sz * sizeof(ipnat_t *)); 172 else 173 return -1; 174 175 KMALLOCS(rdr_rules, ipnat_t **, sizeof(ipnat_t *) * ipf_rdrrules_sz); 176 if (rdr_rules != NULL) 177 bzero((char *)rdr_rules, ipf_rdrrules_sz * sizeof(ipnat_t *)); 178 else 179 return -1; 180 181 KMALLOCS(maptable, hostmap_t **, sizeof(hostmap_t *) * ipf_hostmap_sz); 182 if (maptable != NULL) 183 bzero((char *)maptable, sizeof(hostmap_t *) * ipf_hostmap_sz); 184 else 185 return -1; 186 return 0; 187} 188 189 190static void nat_addrdr(n) 191ipnat_t *n; 192{ 193 ipnat_t **np; 194 u_32_t j; 195 u_int hv; 196 int k; 197 198 k = countbits(n->in_outmsk); 199 if ((k >= 0) && (k != 32)) 200 rdr_masks |= 1 << k; 201 j = (n->in_outip & n->in_outmsk); 202 hv = NAT_HASH_FN(j, 0, ipf_rdrrules_sz); 203 np = rdr_rules + hv; 204 while (*np != NULL) 205 np = &(*np)->in_rnext; 206 n->in_rnext = NULL; 207 n->in_prnext = np; 208 *np = n; 209} 210 211 212static void nat_addnat(n) 213ipnat_t *n; 214{ 215 ipnat_t **np; 216 u_32_t j; 217 u_int hv; 218 int k; 219 220 k = countbits(n->in_inmsk); 221 if ((k >= 0) && (k != 32)) 222 nat_masks |= 1 << k; 223 j = (n->in_inip & n->in_inmsk); 224 hv = NAT_HASH_FN(j, 0, ipf_natrules_sz); 225 np = nat_rules + hv; 226 while (*np != NULL) 227 np = &(*np)->in_mnext; 228 n->in_mnext = NULL; 229 n->in_pmnext = np; 230 *np = n; 231} 232 233 234static void nat_delrdr(n) 235ipnat_t *n; 236{ 237 if (n->in_rnext) 238 n->in_rnext->in_prnext = n->in_prnext; 239 *n->in_prnext = n->in_rnext; 240} 241 242 243static void nat_delnat(n) 244ipnat_t *n; 245{ 246 if (n->in_mnext) 247 n->in_mnext->in_pmnext = n->in_pmnext; 248 *n->in_pmnext = n->in_mnext; 249} 250 251 252/* 253 * check if an ip address has already been allocated for a given mapping that 254 * is not doing port based translation. 255 */ 256static struct hostmap *nat_hostmap(np, real, map) 257ipnat_t *np; 258struct in_addr real; 259struct in_addr map; 260{ 261 hostmap_t *hm; 262 u_int hv; 263 264 MUTEX_ENTER(&ipf_hostmap); 265 hv = real.s_addr % HOSTMAP_SIZE; 266 for (hm = maptable[hv]; hm; hm = hm->hm_next) 267 if ((hm->hm_realip.s_addr == real.s_addr) && 268 (np == hm->hm_ipnat)) { 269 hm->hm_ref++; 270 MUTEX_EXIT(&ipf_hostmap); 271 return hm; 272 } 273 274 KMALLOC(hm, hostmap_t *); 275 if (hm) { 276 hm->hm_next = maptable[hv]; 277 hm->hm_pnext = maptable + hv; 278 if (maptable[hv]) 279 maptable[hv]->hm_pnext = &hm->hm_next; 280 maptable[hv] = hm; 281 hm->hm_ipnat = np; 282 hm->hm_realip = real; 283 hm->hm_mapip = map; 284 hm->hm_ref = 1; 285 } 286 MUTEX_EXIT(&ipf_hostmap); 287 return hm; 288} 289 290 291static void nat_hostmapdel(hm) 292struct hostmap *hm; 293{ 294 MUTEX_ENTER(&ipf_hostmap); 295 ATOMIC_DEC32(hm->hm_ref); 296 if (hm->hm_ref == 0) { 297 if (hm->hm_next) 298 hm->hm_next->hm_pnext = hm->hm_pnext; 299 *hm->hm_pnext = hm->hm_next; 300 KFREE(hm); 301 } 302 MUTEX_EXIT(&ipf_hostmap); 303} 304 305 306void fix_outcksum(sp, n) 307u_short *sp; 308u_32_t n; 309{ 310 register u_short sumshort; 311 register u_32_t sum1; 312 313 if (!n) 314 return; 315#if SOLARIS2 >= 6 316 else if (n & NAT_HW_CKSUM) { 317 *sp = n & 0xffff; 318 return; 319 } 320#endif 321 sum1 = (~ntohs(*sp)) & 0xffff; 322 sum1 += (n); 323 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 324 /* Again */ 325 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 326 sumshort = ~(u_short)sum1; 327 *(sp) = htons(sumshort); 328} 329 330 331void fix_incksum(sp, n) 332u_short *sp; 333u_32_t n; 334{ 335 register u_short sumshort; 336 register u_32_t sum1; 337 338 if (!n) 339 return; 340#if SOLARIS2 >= 6 341 else if (n & NAT_HW_CKSUM) { 342 *sp = n & 0xffff; 343 return; 344 } 345#endif 346#ifdef sparc 347 sum1 = (~(*sp)) & 0xffff; 348#else 349 sum1 = (~ntohs(*sp)) & 0xffff; 350#endif 351 sum1 += ~(n) & 0xffff; 352 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 353 /* Again */ 354 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 355 sumshort = ~(u_short)sum1; 356 *(sp) = htons(sumshort); 357} 358 359 360/* 361 * fix_datacksum is used *only* for the adjustments of checksums in the data 362 * section of an IP packet. 363 * 364 * The only situation in which you need to do this is when NAT'ing an 365 * ICMP error message. Such a message, contains in its body the IP header 366 * of the original IP packet, that causes the error. 367 * 368 * You can't use fix_incksum or fix_outcksum in that case, because for the 369 * kernel the data section of the ICMP error is just data, and no special 370 * processing like hardware cksum or ntohs processing have been done by the 371 * kernel on the data section. 372 */ 373void fix_datacksum(sp, n) 374u_short *sp; 375u_32_t n; 376{ 377 register u_short sumshort; 378 register u_32_t sum1; 379 380 if (!n) 381 return; 382 383 sum1 = (~ntohs(*sp)) & 0xffff; 384 sum1 += (n); 385 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 386 /* Again */ 387 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 388 sumshort = ~(u_short)sum1; 389 *(sp) = htons(sumshort); 390} 391 392/* 393 * How the NAT is organised and works. 394 * 395 * Inside (interface y) NAT Outside (interface x) 396 * -------------------- -+- ------------------------------------- 397 * Packet going | out, processsed by ip_natout() for x 398 * ------------> | ------------> 399 * src=10.1.1.1 | src=192.1.1.1 400 * | 401 * | in, processed by ip_natin() for x 402 * <------------ | <------------ 403 * dst=10.1.1.1 | dst=192.1.1.1 404 * -------------------- -+- ------------------------------------- 405 * ip_natout() - changes ip_src and if required, sport 406 * - creates a new mapping, if required. 407 * ip_natin() - changes ip_dst and if required, dport 408 * 409 * In the NAT table, internal source is recorded as "in" and externally 410 * seen as "out". 411 */ 412 413/* 414 * Handle ioctls which manipulate the NAT. 415 */ 416int nat_ioctl(data, cmd, mode) 417#if defined(__NetBSD__) || defined(__OpenBSD__) || (__FreeBSD_version >= 300003) 418u_long cmd; 419#else 420int cmd; 421#endif 422caddr_t data; 423int mode; 424{ 425 register ipnat_t *nat, *nt, *n = NULL, **np = NULL; 426 int error = 0, ret, arg; 427 ipnat_t natd; 428 u_32_t i, j; 429 430#if (BSD >= 199306) && defined(_KERNEL) 431 if ((securelevel >= 2) && (mode & FWRITE)) 432 return EPERM; 433#endif 434 435 nat = NULL; /* XXX gcc -Wuninitialized */ 436 KMALLOC(nt, ipnat_t *); 437 if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT)) 438 error = IRCOPYPTR(data, (char *)&natd, sizeof(natd)); 439 else if (cmd == SIOCIPFFL) { /* SIOCFLNAT & SIOCCNATL */ 440 error = IRCOPY(data, (char *)&arg, sizeof(arg)); 441 if (error) 442 error = EFAULT; 443 } 444 445 if (error) 446 goto done; 447 448 /* 449 * For add/delete, look to see if the NAT entry is already present 450 */ 451 WRITE_ENTER(&ipf_nat); 452 if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT)) { 453 nat = &natd; 454 nat->in_flags &= IPN_USERFLAGS; 455 if ((nat->in_redir & NAT_MAPBLK) == 0) { 456 if ((nat->in_flags & IPN_SPLIT) == 0) 457 nat->in_inip &= nat->in_inmsk; 458 if ((nat->in_flags & IPN_IPRANGE) == 0) 459 nat->in_outip &= nat->in_outmsk; 460 } 461 for (np = &nat_list; (n = *np); np = &n->in_next) 462 if (!bcmp((char *)&nat->in_flags, (char *)&n->in_flags, 463 IPN_CMPSIZ)) 464 break; 465 } 466 467 switch (cmd) 468 { 469#ifdef IPFILTER_LOG 470 case SIOCIPFFB : 471 { 472 int tmp; 473 474 if (!(mode & FWRITE)) 475 error = EPERM; 476 else { 477 tmp = ipflog_clear(IPL_LOGNAT); 478 IWCOPY((char *)&tmp, (char *)data, sizeof(tmp)); 479 } 480 break; 481 } 482#endif 483 case SIOCADNAT : 484 if (!(mode & FWRITE)) { 485 error = EPERM; 486 break; 487 } 488 if (n) { 489 error = EEXIST; 490 break; 491 } 492 if (nt == NULL) { 493 error = ENOMEM; 494 break; 495 } 496 n = nt; 497 nt = NULL; 498 bcopy((char *)nat, (char *)n, sizeof(*n)); 499 n->in_ifp = (void *)GETUNIT(n->in_ifname, 4); 500 if (!n->in_ifp) 501 n->in_ifp = (void *)-1; 502 if (n->in_plabel[0] != '\0') { 503 n->in_apr = appr_match(n->in_p, n->in_plabel); 504 if (!n->in_apr) { 505 error = ENOENT; 506 break; 507 } 508 } 509 n->in_next = NULL; 510 *np = n; 511 512 if (n->in_redir & NAT_REDIRECT) { 513 n->in_flags &= ~IPN_NOTDST; 514 nat_addrdr(n); 515 } 516 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) { 517 n->in_flags &= ~IPN_NOTSRC; 518 nat_addnat(n); 519 } 520 521 n->in_use = 0; 522 if (n->in_redir & NAT_MAPBLK) 523 n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk); 524 else if (n->in_flags & IPN_AUTOPORTMAP) 525 n->in_space = USABLE_PORTS * ~ntohl(n->in_inmsk); 526 else if (n->in_flags & IPN_IPRANGE) 527 n->in_space = ntohl(n->in_outmsk) - ntohl(n->in_outip); 528 else if (n->in_flags & IPN_SPLIT) 529 n->in_space = 2; 530 else 531 n->in_space = ~ntohl(n->in_outmsk); 532 /* 533 * Calculate the number of valid IP addresses in the output 534 * mapping range. In all cases, the range is inclusive of 535 * the start and ending IP addresses. 536 * If to a CIDR address, lose 2: broadcast + network address 537 * (so subtract 1) 538 * If to a range, add one. 539 * If to a single IP address, set to 1. 540 */ 541 if (n->in_space) { 542 if ((n->in_flags & IPN_IPRANGE) != 0) 543 n->in_space += 1; 544 else 545 n->in_space -= 1; 546 } else 547 n->in_space = 1; 548 if ((n->in_outmsk != 0xffffffff) && (n->in_outmsk != 0) && 549 ((n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0)) 550 n->in_nip = ntohl(n->in_outip) + 1; 551 else if ((n->in_flags & IPN_SPLIT) && 552 (n->in_redir & NAT_REDIRECT)) 553 n->in_nip = ntohl(n->in_inip); 554 else 555 n->in_nip = ntohl(n->in_outip); 556 if (n->in_redir & NAT_MAP) { 557 n->in_pnext = ntohs(n->in_pmin); 558 /* 559 * Multiply by the number of ports made available. 560 */ 561 if (ntohs(n->in_pmax) >= ntohs(n->in_pmin)) { 562 n->in_space *= (ntohs(n->in_pmax) - 563 ntohs(n->in_pmin) + 1); 564 /* 565 * Because two different sources can map to 566 * different destinations but use the same 567 * local IP#/port #. 568 * If the result is smaller than in_space, then 569 * we may have wrapped around 32bits. 570 */ 571 i = n->in_inmsk; 572 if ((i != 0) && (i != 0xffffffff)) { 573 j = n->in_space * (~ntohl(i) + 1); 574 if (j >= n->in_space) 575 n->in_space = j; 576 else 577 n->in_space = 0xffffffff; 578 } 579 } 580 /* 581 * If no protocol is specified, multiple by 256. 582 */ 583 if ((n->in_flags & IPN_TCPUDP) == 0) { 584 j = n->in_space * 256; 585 if (j >= n->in_space) 586 n->in_space = j; 587 else 588 n->in_space = 0xffffffff; 589 } 590 } 591 /* Otherwise, these fields are preset */ 592 n = NULL; 593 nat_stats.ns_rules++; 594 break; 595 case SIOCRMNAT : 596 if (!(mode & FWRITE)) { 597 error = EPERM; 598 n = NULL; 599 break; 600 } 601 if (!n) { 602 error = ESRCH; 603 break; 604 } 605 if (n->in_redir & NAT_REDIRECT) 606 nat_delrdr(n); 607 if (n->in_redir & (NAT_MAPBLK|NAT_MAP)) 608 nat_delnat(n); 609 if (nat_list == NULL) { 610 nat_masks = 0; 611 rdr_masks = 0; 612 } 613 *np = n->in_next; 614 if (!n->in_use) { 615 if (n->in_apr) 616 appr_free(n->in_apr); 617 KFREE(n); 618 nat_stats.ns_rules--; 619 } else { 620 n->in_flags |= IPN_DELETE; 621 n->in_next = NULL; 622 } 623 n = NULL; 624 break; 625 case SIOCGNATS : 626 MUTEX_DOWNGRADE(&ipf_nat); 627 nat_stats.ns_table[0] = nat_table[0]; 628 nat_stats.ns_table[1] = nat_table[1]; 629 nat_stats.ns_list = nat_list; 630 nat_stats.ns_nattab_sz = ipf_nattable_sz; 631 nat_stats.ns_rultab_sz = ipf_natrules_sz; 632 nat_stats.ns_rdrtab_sz = ipf_rdrrules_sz; 633 nat_stats.ns_instances = nat_instances; 634 nat_stats.ns_apslist = ap_sess_list; 635 error = IWCOPYPTR((char *)&nat_stats, (char *)data, 636 sizeof(nat_stats)); 637 break; 638 case SIOCGNATL : 639 { 640 natlookup_t nl; 641 642 MUTEX_DOWNGRADE(&ipf_nat); 643 error = IRCOPYPTR((char *)data, (char *)&nl, sizeof(nl)); 644 if (error) 645 break; 646 647 if (nat_lookupredir(&nl)) { 648 error = IWCOPYPTR((char *)&nl, (char *)data, 649 sizeof(nl)); 650 } else 651 error = ESRCH; 652 break; 653 } 654 case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */ 655 if (!(mode & FWRITE)) { 656 error = EPERM; 657 break; 658 } 659 error = 0; 660 if (arg == 0) 661 ret = nat_flushtable(); 662 else if (arg == 1) 663 ret = nat_clearlist(); 664 else 665 error = EINVAL; 666 MUTEX_DOWNGRADE(&ipf_nat); 667 if (!error) { 668 error = IWCOPY((caddr_t)&ret, data, sizeof(ret)); 669 if (error) 670 error = EFAULT; 671 } 672 break; 673 case SIOCSTLCK : 674 error = IRCOPY(data, (caddr_t)&arg, sizeof(arg)); 675 if (!error) { 676 error = IWCOPY((caddr_t)&fr_nat_lock, data, 677 sizeof(fr_nat_lock)); 678 if (!error) 679 fr_nat_lock = arg; 680 } else 681 error = EFAULT; 682 break; 683 case SIOCSTPUT : 684 if (fr_nat_lock) 685 error = fr_natputent(data); 686 else 687 error = EACCES; 688 break; 689 case SIOCSTGSZ : 690 if (fr_nat_lock) 691 error = fr_natgetsz(data); 692 else 693 error = EACCES; 694 break; 695 case SIOCSTGET : 696 if (fr_nat_lock) 697 error = fr_natgetent(data); 698 else 699 error = EACCES; 700 break; 701 case FIONREAD : 702#ifdef IPFILTER_LOG 703 MUTEX_DOWNGRADE(&ipf_nat); 704 error = IWCOPY((caddr_t)&iplused[IPL_LOGNAT], (caddr_t)data, 705 sizeof(iplused[IPL_LOGNAT])); 706 if (error) 707 error = EFAULT; 708#endif 709 break; 710 default : 711 error = EINVAL; 712 break; 713 } 714 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */ 715done: 716 if (nt) 717 KFREE(nt); 718 return error; 719} 720 721 722static int fr_natgetsz(data) 723caddr_t data; 724{ 725 ap_session_t *aps; 726 nat_t *nat, *n; 727 int error = 0; 728 natget_t ng; 729 730 error = IRCOPY(data, (caddr_t)&ng, sizeof(ng)); 731 if (error) 732 return EFAULT; 733 734 nat = ng.ng_ptr; 735 if (!nat) { 736 nat = nat_instances; 737 ng.ng_sz = 0; 738 if (nat == NULL) { 739 error = IWCOPY((caddr_t)&ng, data, sizeof(ng)); 740 if (error) 741 error = EFAULT; 742 return error; 743 } 744 } else { 745 /* 746 * Make sure the pointer we're copying from exists in the 747 * current list of entries. Security precaution to prevent 748 * copying of random kernel data. 749 */ 750 for (n = nat_instances; n; n = n->nat_next) 751 if (n == nat) 752 break; 753 if (!n) 754 return ESRCH; 755 } 756 757 ng.ng_sz = sizeof(nat_save_t); 758 aps = nat->nat_aps; 759 if ((aps != NULL) && (aps->aps_data != 0)) { 760 ng.ng_sz += sizeof(ap_session_t); 761 ng.ng_sz += aps->aps_psiz; 762 } 763 764 error = IWCOPY((caddr_t)&ng, data, sizeof(ng)); 765 if (error) 766 error = EFAULT; 767 return error; 768} 769 770 771static int fr_natgetent(data) 772caddr_t data; 773{ 774 nat_save_t ipn, *ipnp, *ipnn = NULL; 775 register nat_t *n, *nat; 776 ap_session_t *aps; 777 int error; 778 779 error = IRCOPY(data, (caddr_t)&ipnp, sizeof(ipnp)); 780 if (error) 781 return EFAULT; 782 error = IRCOPY((caddr_t)ipnp, (caddr_t)&ipn, sizeof(ipn)); 783 if (error) 784 return EFAULT; 785 786 nat = ipn.ipn_next; 787 if (!nat) { 788 nat = nat_instances; 789 if (nat == NULL) { 790 if (nat_instances == NULL) 791 return ENOENT; 792 return 0; 793 } 794 } else { 795 /* 796 * Make sure the pointer we're copying from exists in the 797 * current list of entries. Security precaution to prevent 798 * copying of random kernel data. 799 */ 800 for (n = nat_instances; n; n = n->nat_next) 801 if (n == nat) 802 break; 803 if (!n) 804 return ESRCH; 805 } 806 807 ipn.ipn_next = nat->nat_next; 808 ipn.ipn_dsize = 0; 809 bcopy((char *)nat, (char *)&ipn.ipn_nat, sizeof(ipn.ipn_nat)); 810 ipn.ipn_nat.nat_data = NULL; 811 812 if (nat->nat_ptr) { 813 bcopy((char *)nat->nat_ptr, (char *)&ipn.ipn_ipnat, 814 sizeof(ipn.ipn_ipnat)); 815 } 816 817 if (nat->nat_fr) 818 bcopy((char *)nat->nat_fr, (char *)&ipn.ipn_rule, 819 sizeof(ipn.ipn_rule)); 820 821 if ((aps = nat->nat_aps)) { 822 ipn.ipn_dsize = sizeof(*aps); 823 if (aps->aps_data) 824 ipn.ipn_dsize += aps->aps_psiz; 825 KMALLOCS(ipnn, nat_save_t *, sizeof(*ipnn) + ipn.ipn_dsize); 826 if (ipnn == NULL) 827 return ENOMEM; 828 bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn)); 829 830 bcopy((char *)aps, ipnn->ipn_data, sizeof(*aps)); 831 if (aps->aps_data) { 832 bcopy(aps->aps_data, ipnn->ipn_data + sizeof(*aps), 833 aps->aps_psiz); 834 ipnn->ipn_dsize += aps->aps_psiz; 835 } 836 error = IWCOPY((caddr_t)ipnn, ipnp, 837 sizeof(ipn) + ipn.ipn_dsize); 838 if (error) 839 error = EFAULT; 840 KFREES(ipnn, sizeof(*ipnn) + ipn.ipn_dsize); 841 } else { 842 error = IWCOPY((caddr_t)&ipn, ipnp, sizeof(ipn)); 843 if (error) 844 error = EFAULT; 845 } 846 return error; 847} 848 849 850static int fr_natputent(data) 851caddr_t data; 852{ 853 nat_save_t ipn, *ipnp, *ipnn = NULL; 854 register nat_t *n, *nat; 855 ap_session_t *aps; 856 frentry_t *fr; 857 ipnat_t *in; 858 859 int error; 860 861 error = IRCOPY(data, (caddr_t)&ipnp, sizeof(ipnp)); 862 if (error) 863 return EFAULT; 864 error = IRCOPY((caddr_t)ipnp, (caddr_t)&ipn, sizeof(ipn)); 865 if (error) 866 return EFAULT; 867 nat = NULL; 868 if (ipn.ipn_dsize) { 869 KMALLOCS(ipnn, nat_save_t *, sizeof(ipn) + ipn.ipn_dsize); 870 if (ipnn == NULL) 871 return ENOMEM; 872 bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn)); 873 error = IRCOPY((caddr_t)ipnp, (caddr_t)ipn.ipn_data, 874 ipn.ipn_dsize); 875 if (error) { 876 error = EFAULT; 877 goto junkput; 878 } 879 } else 880 ipnn = NULL; 881 882 KMALLOC(nat, nat_t *); 883 if (nat == NULL) { 884 error = EFAULT; 885 goto junkput; 886 } 887 888 bcopy((char *)&ipn.ipn_nat, (char *)nat, sizeof(*nat)); 889 /* 890 * Initialize all these so that nat_delete() doesn't cause a crash. 891 */ 892 nat->nat_phnext[0] = NULL; 893 nat->nat_phnext[1] = NULL; 894 fr = nat->nat_fr; 895 nat->nat_fr = NULL; 896 aps = nat->nat_aps; 897 nat->nat_aps = NULL; 898 in = nat->nat_ptr; 899 nat->nat_ptr = NULL; 900 nat->nat_data = NULL; 901 902 /* 903 * Restore the rule associated with this nat session 904 */ 905 if (in) { 906 KMALLOC(in, ipnat_t *); 907 if (in == NULL) { 908 error = ENOMEM; 909 goto junkput; 910 } 911 nat->nat_ptr = in; 912 bcopy((char *)&ipn.ipn_ipnat, (char *)in, sizeof(*in)); 913 in->in_use = 1; 914 in->in_flags |= IPN_DELETE; 915 in->in_next = NULL; 916 in->in_rnext = NULL; 917 in->in_prnext = NULL; 918 in->in_mnext = NULL; 919 in->in_pmnext = NULL; 920 in->in_ifp = GETUNIT(in->in_ifname, 4); 921 if (in->in_plabel[0] != '\0') { 922 in->in_apr = appr_match(in->in_p, in->in_plabel); 923 } 924 } 925 926 /* 927 * Restore ap_session_t structure. Include the private data allocated 928 * if it was there. 929 */ 930 if (aps) { 931 KMALLOC(aps, ap_session_t *); 932 if (aps == NULL) { 933 error = ENOMEM; 934 goto junkput; 935 } 936 nat->nat_aps = aps; 937 aps->aps_next = ap_sess_list; 938 ap_sess_list = aps; 939 bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps)); 940 if (in) 941 aps->aps_apr = in->in_apr; 942 if (aps->aps_psiz) { 943 KMALLOCS(aps->aps_data, void *, aps->aps_psiz); 944 if (aps->aps_data == NULL) { 945 error = ENOMEM; 946 goto junkput; 947 } 948 bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data, 949 aps->aps_psiz); 950 } else { 951 aps->aps_psiz = 0; 952 aps->aps_data = NULL; 953 } 954 } 955 956 /* 957 * If there was a filtering rule associated with this entry then 958 * build up a new one. 959 */ 960 if (fr != NULL) { 961 if (nat->nat_flags & FI_NEWFR) { 962 KMALLOC(fr, frentry_t *); 963 nat->nat_fr = fr; 964 if (fr == NULL) { 965 error = ENOMEM; 966 goto junkput; 967 } 968 bcopy((char *)&ipn.ipn_fr, (char *)fr, sizeof(*fr)); 969 ipn.ipn_nat.nat_fr = fr; 970 error = IWCOPY((caddr_t)&ipn, ipnp, sizeof(ipn)); 971 if (error) { 972 error = EFAULT; 973 goto junkput; 974 } 975 } else { 976 for (n = nat_instances; n; n = n->nat_next) 977 if (n->nat_fr == fr) 978 break; 979 if (!n) { 980 error = ESRCH; 981 goto junkput; 982 } 983 } 984 } 985 986 if (ipnn) 987 KFREES(ipnn, sizeof(ipn) + ipn.ipn_dsize); 988 nat_insert(nat); 989 return 0; 990junkput: 991 if (ipnn) 992 KFREES(ipnn, sizeof(ipn) + ipn.ipn_dsize); 993 if (nat) 994 nat_delete(nat); 995 return error; 996} 997 998 999/* 1000 * Delete a nat entry from the various lists and table. 1001 */ 1002static void nat_delete(natd) 1003struct nat *natd; 1004{ 1005 struct ipnat *ipn; 1006 1007 if (natd->nat_flags & FI_WILDP) 1008 nat_wilds--; 1009 if (natd->nat_hnext[0]) 1010 natd->nat_hnext[0]->nat_phnext[0] = natd->nat_phnext[0]; 1011 *natd->nat_phnext[0] = natd->nat_hnext[0]; 1012 if (natd->nat_hnext[1]) 1013 natd->nat_hnext[1]->nat_phnext[1] = natd->nat_phnext[1]; 1014 *natd->nat_phnext[1] = natd->nat_hnext[1]; 1015 1016 if (natd->nat_fr != NULL) { 1017 ATOMIC_DEC32(natd->nat_fr->fr_ref); 1018 } 1019 1020 if (natd->nat_hm != NULL) 1021 nat_hostmapdel(natd->nat_hm); 1022 1023 /* 1024 * If there is an active reference from the nat entry to its parent 1025 * rule, decrement the rule's reference count and free it too if no 1026 * longer being used. 1027 */ 1028 ipn = natd->nat_ptr; 1029 if (ipn != NULL) { 1030 ipn->in_space++; 1031 ipn->in_use--; 1032 if (!ipn->in_use && (ipn->in_flags & IPN_DELETE)) { 1033 if (ipn->in_apr) 1034 appr_free(ipn->in_apr); 1035 KFREE(ipn); 1036 nat_stats.ns_rules--; 1037 } 1038 } 1039 1040 MUTEX_DESTROY(&natd->nat_lock); 1041 /* 1042 * If there's a fragment table entry too for this nat entry, then 1043 * dereference that as well. 1044 */ 1045 ipfr_forget((void *)natd); 1046 aps_free(natd->nat_aps); 1047 nat_stats.ns_inuse--; 1048 KFREE(natd); 1049} 1050 1051 1052/* 1053 * nat_flushtable - clear the NAT table of all mapping entries. 1054 */ 1055static int nat_flushtable() 1056{ 1057 register nat_t *nat, **natp; 1058 register int j = 0; 1059 1060 /* 1061 * ALL NAT mappings deleted, so lets just make the deletions 1062 * quicker. 1063 */ 1064 if (nat_table[0] != NULL) 1065 bzero((char *)nat_table[0], 1066 sizeof(nat_table[0]) * ipf_nattable_sz); 1067 if (nat_table[1] != NULL) 1068 bzero((char *)nat_table[1], 1069 sizeof(nat_table[1]) * ipf_nattable_sz); 1070 1071 for (natp = &nat_instances; (nat = *natp); ) { 1072 *natp = nat->nat_next; 1073 nat_delete(nat); 1074 j++; 1075 } 1076 nat_stats.ns_inuse = 0; 1077 return j; 1078} 1079 1080 1081/* 1082 * nat_clearlist - delete all rules in the active NAT mapping list. 1083 */ 1084static int nat_clearlist() 1085{ 1086 register ipnat_t *n, **np = &nat_list; 1087 int i = 0; 1088 1089 if (nat_rules != NULL) 1090 bzero((char *)nat_rules, sizeof(*nat_rules) * ipf_natrules_sz); 1091 if (rdr_rules != NULL) 1092 bzero((char *)rdr_rules, sizeof(*rdr_rules) * ipf_rdrrules_sz); 1093 1094 while ((n = *np)) { 1095 *np = n->in_next; 1096 if (!n->in_use) { 1097 if (n->in_apr) 1098 appr_free(n->in_apr); 1099 KFREE(n); 1100 nat_stats.ns_rules--; 1101 } else { 1102 n->in_flags |= IPN_DELETE; 1103 n->in_next = NULL; 1104 } 1105 i++; 1106 } 1107 nat_masks = 0; 1108 rdr_masks = 0; 1109 return i; 1110} 1111 1112 1113/* 1114 * Create a new NAT table entry. 1115 * NOTE: assumes write lock on ipf_nat has been obtained already. 1116 */ 1117nat_t *nat_new(np, ip, fin, flags, direction) 1118ipnat_t *np; 1119ip_t *ip; 1120fr_info_t *fin; 1121u_int flags; 1122int direction; 1123{ 1124 register u_32_t sum1, sum2, sumd, l; 1125 u_short port = 0, sport = 0, dport = 0, nport = 0; 1126 struct in_addr in, inb; 1127 tcphdr_t *tcp = NULL; 1128 hostmap_t *hm = NULL; 1129 nat_t *nat, *natl; 1130 u_short nflags; 1131#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) 1132 qif_t *qf = fin->fin_qif; 1133#endif 1134 1135 nflags = flags & np->in_flags; 1136 if (flags & IPN_TCPUDP) { 1137 tcp = (tcphdr_t *)fin->fin_dp; 1138 sport = tcp->th_sport; 1139 dport = tcp->th_dport; 1140 } 1141 1142 /* Give me a new nat */ 1143 KMALLOC(nat, nat_t *); 1144 if (nat == NULL) { 1145 nat_stats.ns_memfail++; 1146 return NULL; 1147 } 1148 1149 bzero((char *)nat, sizeof(*nat)); 1150 nat->nat_flags = flags; 1151 if (flags & FI_WILDP) 1152 nat_wilds++; 1153 /* 1154 * Search the current table for a match. 1155 */ 1156 if (direction == NAT_OUTBOUND) { 1157 /* 1158 * Values at which the search for a free resouce starts. 1159 */ 1160 u_32_t st_ip; 1161 u_short st_port; 1162 1163 /* 1164 * If it's an outbound packet which doesn't match any existing 1165 * record, then create a new port 1166 */ 1167 l = 0; 1168 st_ip = np->in_nip; 1169 st_port = np->in_pnext; 1170 1171 do { 1172 port = 0; 1173 in.s_addr = htonl(np->in_nip); 1174 if (l == 0) { 1175 /* 1176 * Check to see if there is an existing NAT 1177 * setup for this IP address pair. 1178 */ 1179 hm = nat_hostmap(np, ip->ip_src, in); 1180 if (hm != NULL) 1181 in.s_addr = hm->hm_mapip.s_addr; 1182 } else if ((l == 1) && (hm != NULL)) { 1183 nat_hostmapdel(hm); 1184 hm = NULL; 1185 } 1186 in.s_addr = ntohl(in.s_addr); 1187 1188 nat->nat_hm = hm; 1189 1190 if ((np->in_outmsk == 0xffffffff) && 1191 (np->in_pnext == 0)) { 1192 if (l > 0) 1193 goto badnat; 1194 } 1195 1196 if (np->in_redir & NAT_MAPBLK) { 1197 if ((l >= np->in_ppip) || ((l > 0) && 1198 !(flags & IPN_TCPUDP))) 1199 goto badnat; 1200 /* 1201 * map-block - Calculate destination address. 1202 */ 1203 in.s_addr = ntohl(ip->ip_src.s_addr); 1204 in.s_addr &= ntohl(~np->in_inmsk); 1205 inb.s_addr = in.s_addr; 1206 in.s_addr /= np->in_ippip; 1207 in.s_addr &= ntohl(~np->in_outmsk); 1208 in.s_addr += ntohl(np->in_outip); 1209 /* 1210 * Calculate destination port. 1211 */ 1212 if ((flags & IPN_TCPUDP) && 1213 (np->in_ppip != 0)) { 1214 port = ntohs(sport) + l; 1215 port %= np->in_ppip; 1216 port += np->in_ppip * 1217 (inb.s_addr % np->in_ippip); 1218 port += MAPBLK_MINPORT; 1219 port = htons(port); 1220 } 1221 } else if (!np->in_outip && 1222 (np->in_outmsk == 0xffffffff)) { 1223 /* 1224 * 0/32 - use the interface's IP address. 1225 */ 1226 if ((l > 0) || 1227 fr_ifpaddr(4, fin->fin_ifp, &in) == -1) 1228 goto badnat; 1229 in.s_addr = ntohl(in.s_addr); 1230 } else if (!np->in_outip && !np->in_outmsk) { 1231 /* 1232 * 0/0 - use the original source address/port. 1233 */ 1234 if (l > 0) 1235 goto badnat; 1236 in.s_addr = ntohl(ip->ip_src.s_addr); 1237 } else if ((np->in_outmsk != 0xffffffff) && 1238 (np->in_pnext == 0) && 1239 ((l > 0) || (hm == NULL))) 1240 np->in_nip++; 1241 natl = NULL; 1242 1243 if ((nflags & IPN_TCPUDP) && 1244 ((np->in_redir & NAT_MAPBLK) == 0) && 1245 (np->in_flags & IPN_AUTOPORTMAP)) { 1246 if ((l > 0) && (l % np->in_ppip == 0)) { 1247 if (l > np->in_space) { 1248 goto badnat; 1249 } else if ((l > np->in_ppip) && 1250 np->in_outmsk != 0xffffffff) 1251 np->in_nip++; 1252 } 1253 if (np->in_ppip != 0) { 1254 port = ntohs(sport); 1255 port += (l % np->in_ppip); 1256 port %= np->in_ppip; 1257 port += np->in_ppip * 1258 (ntohl(ip->ip_src.s_addr) % 1259 np->in_ippip); 1260 port += MAPBLK_MINPORT; 1261 port = htons(port); 1262 } 1263 } else if (((np->in_redir & NAT_MAPBLK) == 0) && 1264 (nflags & IPN_TCPUDP) && 1265 (np->in_pnext != 0)) { 1266 port = htons(np->in_pnext++); 1267 if (np->in_pnext > ntohs(np->in_pmax)) { 1268 np->in_pnext = ntohs(np->in_pmin); 1269 if (np->in_outmsk != 0xffffffff) 1270 np->in_nip++; 1271 } 1272 } 1273 1274 if (np->in_flags & IPN_IPRANGE) { 1275 if (np->in_nip > ntohl(np->in_outmsk)) 1276 np->in_nip = ntohl(np->in_outip); 1277 } else { 1278 if ((np->in_outmsk != 0xffffffff) && 1279 ((np->in_nip + 1) & ntohl(np->in_outmsk)) > 1280 ntohl(np->in_outip)) 1281 np->in_nip = ntohl(np->in_outip) + 1; 1282 } 1283 1284 if (!port && (flags & IPN_TCPUDP)) 1285 port = sport; 1286 1287 /* 1288 * Here we do a lookup of the connection as seen from 1289 * the outside. If an IP# pair already exists, try 1290 * again. So if you have A->B becomes C->B, you can 1291 * also have D->E become C->E but not D->B causing 1292 * another C->B. Also take protocol and ports into 1293 * account when determining whether a pre-existing 1294 * NAT setup will cause an external conflict where 1295 * this is appropriate. 1296 */ 1297 inb.s_addr = htonl(in.s_addr); 1298 natl = nat_inlookup(fin->fin_ifp, flags & ~FI_WILDP, 1299 (u_int)ip->ip_p, ip->ip_dst, inb, 1300 (port << 16) | dport); 1301 1302 /* 1303 * Has the search wrapped around and come back to the 1304 * start ? 1305 */ 1306 if ((natl != NULL) && 1307 (np->in_pnext != 0) && (st_port == np->in_pnext) && 1308 (np->in_nip != 0) && (st_ip == np->in_nip)) 1309 goto badnat; 1310 l++; 1311 } while (natl != NULL); 1312 1313 if (np->in_space > 0) 1314 np->in_space--; 1315 1316 /* Setup the NAT table */ 1317 nat->nat_inip = ip->ip_src; 1318 nat->nat_outip.s_addr = htonl(in.s_addr); 1319 nat->nat_oip = ip->ip_dst; 1320 if (nat->nat_hm == NULL) 1321 nat->nat_hm = nat_hostmap(np, ip->ip_src, 1322 nat->nat_outip); 1323 1324 sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr)) + ntohs(sport); 1325 sum2 = LONG_SUM(in.s_addr) + ntohs(port); 1326 1327 if (flags & IPN_TCPUDP) { 1328 nat->nat_inport = sport; 1329 nat->nat_outport = port; /* sport */ 1330 nat->nat_oport = dport; 1331 } 1332 } else { 1333 /* 1334 * Otherwise, it's an inbound packet. Most likely, we don't 1335 * want to rewrite source ports and source addresses. Instead, 1336 * we want to rewrite to a fixed internal address and fixed 1337 * internal port. 1338 */ 1339 if (np->in_flags & IPN_SPLIT) { 1340 in.s_addr = np->in_nip; 1341 if (np->in_inip == htonl(in.s_addr)) 1342 np->in_nip = ntohl(np->in_inmsk); 1343 else { 1344 np->in_nip = ntohl(np->in_inip); 1345 if (np->in_flags & IPN_ROUNDR) { 1346 nat_delrdr(np); 1347 nat_addrdr(np); 1348 } 1349 } 1350 } else { 1351 in.s_addr = ntohl(np->in_inip); 1352 if (np->in_flags & IPN_ROUNDR) { 1353 nat_delrdr(np); 1354 nat_addrdr(np); 1355 } 1356 } 1357 if (!np->in_pnext) 1358 nport = dport; 1359 else { 1360 /* 1361 * Whilst not optimized for the case where 1362 * pmin == pmax, the gain is not significant. 1363 */ 1364 nport = ntohs(dport) - ntohs(np->in_pmin) + 1365 ntohs(np->in_pnext); 1366 nport = htons(nport); 1367 } 1368 1369 /* 1370 * When the redirect-to address is set to 0.0.0.0, just 1371 * assume a blank `forwarding' of the packet. We don't 1372 * setup any translation for this either. 1373 */ 1374 if (in.s_addr == 0) { 1375 if (nport == dport) 1376 goto badnat; 1377 in.s_addr = ntohl(ip->ip_dst.s_addr); 1378 } 1379 1380 nat->nat_inip.s_addr = htonl(in.s_addr); 1381 nat->nat_outip = ip->ip_dst; 1382 nat->nat_oip = ip->ip_src; 1383 1384 sum1 = LONG_SUM(ntohl(ip->ip_dst.s_addr)) + ntohs(dport); 1385 sum2 = LONG_SUM(in.s_addr) + ntohs(nport); 1386 1387 if (flags & IPN_TCPUDP) { 1388 nat->nat_inport = nport; 1389 nat->nat_outport = dport; 1390 nat->nat_oport = sport; 1391 } 1392 } 1393 1394 CALC_SUMD(sum1, sum2, sumd); 1395 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 1396#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) 1397 if ((flags == IPN_TCP) && dohwcksum && 1398 (qf->qf_ill->ill_ick.ick_magic == ICK_M_CTL_MAGIC)) { 1399 if (direction == NAT_OUTBOUND) 1400 sum1 = LONG_SUM(ntohl(in.s_addr)); 1401 else 1402 sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr)); 1403 sum1 += LONG_SUM(ntohl(ip->ip_dst.s_addr)); 1404 sum1 += 30; 1405 sum1 = (sum1 & 0xffff) + (sum1 >> 16); 1406 nat->nat_sumd[1] = NAT_HW_CKSUM|(sum1 & 0xffff); 1407 } else 1408#endif 1409 nat->nat_sumd[1] = nat->nat_sumd[0]; 1410 1411 if ((flags & IPN_TCPUDP) && ((sport != port) || (dport != nport))) { 1412 if (direction == NAT_OUTBOUND) 1413 sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr)); 1414 else 1415 sum1 = LONG_SUM(ntohl(ip->ip_dst.s_addr)); 1416 1417 sum2 = LONG_SUM(in.s_addr); 1418 1419 CALC_SUMD(sum1, sum2, sumd); 1420 nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16); 1421 } else 1422 nat->nat_ipsumd = nat->nat_sumd[0]; 1423 1424 in.s_addr = htonl(in.s_addr); 1425 1426#ifdef _KERNEL 1427 strncpy(nat->nat_ifname, IFNAME(fin->fin_ifp), IFNAMSIZ); 1428#endif 1429 nat_insert(nat); 1430 1431 nat->nat_dir = direction; 1432 nat->nat_ifp = fin->fin_ifp; 1433 nat->nat_ptr = np; 1434 nat->nat_p = ip->ip_p; 1435 nat->nat_bytes = 0; 1436 nat->nat_pkts = 0; 1437 nat->nat_fr = fin->fin_fr; 1438 if (nat->nat_fr != NULL) { 1439 ATOMIC_INC32(nat->nat_fr->fr_ref); 1440 } 1441 if (direction == NAT_OUTBOUND) { 1442 if (flags & IPN_TCPUDP) 1443 tcp->th_sport = port; 1444 } else { 1445 if (flags & IPN_TCPUDP) 1446 tcp->th_dport = nport; 1447 } 1448 np->in_use++; 1449 return nat; 1450badnat: 1451 nat_stats.ns_badnat++; 1452 if ((hm = nat->nat_hm) != NULL) 1453 nat_hostmapdel(hm); 1454 KFREE(nat); 1455 return NULL; 1456} 1457 1458 1459void nat_insert(nat) 1460nat_t *nat; 1461{ 1462 nat_t **natp; 1463 u_int hv; 1464 1465 MUTEX_INIT(&nat->nat_lock, "nat entry lock", NULL); 1466 1467 nat->nat_age = fr_defnatage; 1468 nat->nat_ifname[sizeof(nat->nat_ifname) - 1] = '\0'; 1469 if (nat->nat_ifname[0] !='\0') { 1470 nat->nat_ifp = GETUNIT(nat->nat_ifname, 4); 1471 } 1472 1473 nat->nat_next = nat_instances; 1474 nat_instances = nat; 1475 1476 hv = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport, 1477 ipf_nattable_sz); 1478 natp = &nat_table[0][hv]; 1479 if (*natp) 1480 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 1481 nat->nat_phnext[0] = natp; 1482 nat->nat_hnext[0] = *natp; 1483 *natp = nat; 1484 1485 hv = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport, 1486 ipf_nattable_sz); 1487 natp = &nat_table[1][hv]; 1488 if (*natp) 1489 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 1490 nat->nat_phnext[1] = natp; 1491 nat->nat_hnext[1] = *natp; 1492 *natp = nat; 1493 1494 nat_stats.ns_added++; 1495 nat_stats.ns_inuse++; 1496} 1497 1498 1499nat_t *nat_icmplookup(ip, fin, dir) 1500ip_t *ip; 1501fr_info_t *fin; 1502int dir; 1503{ 1504 icmphdr_t *icmp; 1505 tcphdr_t *tcp = NULL; 1506 ip_t *oip; 1507 int flags = 0, type, minlen; 1508 1509 icmp = (icmphdr_t *)fin->fin_dp; 1510 /* 1511 * Does it at least have the return (basic) IP header ? 1512 * Only a basic IP header (no options) should be with an ICMP error 1513 * header. 1514 */ 1515 if ((ip->ip_hl != 5) || (ip->ip_len < ICMPERR_MINPKTLEN)) 1516 return NULL; 1517 type = icmp->icmp_type; 1518 /* 1519 * If it's not an error type, then return. 1520 */ 1521 if ((type != ICMP_UNREACH) && (type != ICMP_SOURCEQUENCH) && 1522 (type != ICMP_REDIRECT) && (type != ICMP_TIMXCEED) && 1523 (type != ICMP_PARAMPROB)) 1524 return NULL; 1525 1526 oip = (ip_t *)((char *)fin->fin_dp + 8); 1527 minlen = (oip->ip_hl << 2); 1528 if (minlen < sizeof(ip_t)) 1529 return NULL; 1530 if (ip->ip_len < ICMPERR_IPICMPHLEN + minlen) 1531 return NULL; 1532 /* 1533 * Is the buffer big enough for all of it ? It's the size of the IP 1534 * header claimed in the encapsulated part which is of concern. It 1535 * may be too big to be in this buffer but not so big that it's 1536 * outside the ICMP packet, leading to TCP deref's causing problems. 1537 * This is possible because we don't know how big oip_hl is when we 1538 * do the pullup early in fr_check() and thus can't gaurantee it is 1539 * all here now. 1540 */ 1541#ifdef _KERNEL 1542 { 1543 mb_t *m; 1544 1545# if SOLARIS 1546 m = fin->fin_qfm; 1547 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > (char *)m->b_wptr) 1548 return NULL; 1549# else 1550 m = *(mb_t **)fin->fin_mp; 1551 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > 1552 (char *)ip + m->m_len) 1553 return NULL; 1554# endif 1555 } 1556#endif 1557 1558 if (oip->ip_p == IPPROTO_TCP) 1559 flags = IPN_TCP; 1560 else if (oip->ip_p == IPPROTO_UDP) 1561 flags = IPN_UDP; 1562 if (flags & IPN_TCPUDP) { 1563 minlen += 8; /* + 64bits of data to get ports */ 1564 if (ip->ip_len < ICMPERR_IPICMPHLEN + minlen) 1565 return NULL; 1566 tcp = (tcphdr_t *)((char *)oip + (oip->ip_hl << 2)); 1567 if (dir == NAT_INBOUND) 1568 return nat_inlookup(fin->fin_ifp, flags, 1569 (u_int)oip->ip_p, oip->ip_dst, oip->ip_src, 1570 (tcp->th_sport << 16) | tcp->th_dport); 1571 else 1572 return nat_outlookup(fin->fin_ifp, flags, 1573 (u_int)oip->ip_p, oip->ip_dst, oip->ip_src, 1574 (tcp->th_sport << 16) | tcp->th_dport); 1575 } 1576 if (dir == NAT_INBOUND) 1577 return nat_inlookup(fin->fin_ifp, 0, (u_int)oip->ip_p, 1578 oip->ip_dst, oip->ip_src, 0); 1579 else 1580 return nat_outlookup(fin->fin_ifp, 0, (u_int)oip->ip_p, 1581 oip->ip_dst, oip->ip_src, 0); 1582} 1583 1584 1585/* 1586 * This should *ONLY* be used for incoming packets to make sure a NAT'd ICMP 1587 * packet gets correctly recognised. 1588 */ 1589nat_t *nat_icmp(ip, fin, nflags, dir) 1590ip_t *ip; 1591fr_info_t *fin; 1592u_int *nflags; 1593int dir; 1594{ 1595 u_32_t sum1, sum2, sumd; 1596 struct in_addr in; 1597 icmphdr_t *icmp; 1598 udphdr_t *udp; 1599 nat_t *nat; 1600 ip_t *oip; 1601 int flags = 0; 1602 1603 if ((fin->fin_fi.fi_fl & FI_SHORT) || (ip->ip_off & IP_OFFMASK)) 1604 return NULL; 1605 /* 1606 * nat_icmplookup() will return NULL for `defective' packets. 1607 */ 1608 if ((ip->ip_v != 4) || !(nat = nat_icmplookup(ip, fin, dir))) 1609 return NULL; 1610 *nflags = IPN_ICMPERR; 1611 icmp = (icmphdr_t *)fin->fin_dp; 1612 oip = (ip_t *)&icmp->icmp_ip; 1613 if (oip->ip_p == IPPROTO_TCP) 1614 flags = IPN_TCP; 1615 else if (oip->ip_p == IPPROTO_UDP) 1616 flags = IPN_UDP; 1617 udp = (udphdr_t *)((((char *)oip) + (oip->ip_hl << 2))); 1618 /* 1619 * Need to adjust ICMP header to include the real IP#'s and 1620 * port #'s. Only apply a checksum change relative to the 1621 * IP address change as it will be modified again in ip_natout 1622 * for both address and port. Two checksum changes are 1623 * necessary for the two header address changes. Be careful 1624 * to only modify the checksum once for the port # and twice 1625 * for the IP#. 1626 */ 1627 1628 /* 1629 * Step 1 1630 * Fix the IP addresses in the offending IP packet. You also need 1631 * to adjust the IP header checksum of that offending IP packet 1632 * and the ICMP checksum of the ICMP error message itself. 1633 * 1634 * Unfortunately, for UDP and TCP, the IP addresses are also contained 1635 * in the pseudo header that is used to compute the UDP resp. TCP 1636 * checksum. So, we must compensate that as well. Even worse, the 1637 * change in the UDP and TCP checksums require yet another 1638 * adjustment of the ICMP checksum of the ICMP error message. 1639 * 1640 * For the moment we forget about TCP, because that checksum is not 1641 * in the first 8 bytes, so it will not be available in most cases. 1642 */ 1643 1644 if (nat->nat_dir == NAT_OUTBOUND) { 1645 sum1 = LONG_SUM(ntohl(oip->ip_src.s_addr)); 1646 in = nat->nat_inip; 1647 oip->ip_src = in; 1648 } else { 1649 sum1 = LONG_SUM(ntohl(oip->ip_dst.s_addr)); 1650 in = nat->nat_outip; 1651 oip->ip_dst = in; 1652 } 1653 1654 sum2 = LONG_SUM(ntohl(in.s_addr)); 1655 1656 CALC_SUMD(sum1, sum2, sumd); 1657 1658 if (nat->nat_dir == NAT_OUTBOUND) { 1659 /* 1660 * Fix IP checksum of the offending IP packet to adjust for 1661 * the change in the IP address. 1662 * 1663 * Normally, you would expect that the ICMP checksum of the 1664 * ICMP error message needs to be adjusted as well for the 1665 * IP address change in oip. 1666 * However, this is a NOP, because the ICMP checksum is 1667 * calculated over the complete ICMP packet, which includes the 1668 * changed oip IP addresses and oip->ip_sum. However, these 1669 * two changes cancel each other out (if the delta for 1670 * the IP address is x, then the delta for ip_sum is minus x), 1671 * so no change in the icmp_cksum is necessary. 1672 * 1673 * Be careful that nat_dir refers to the direction of the 1674 * offending IP packet (oip), not to its ICMP response (icmp) 1675 */ 1676 fix_datacksum(&oip->ip_sum, sumd); 1677 1678 /* 1679 * Fix UDP pseudo header checksum to compensate for the 1680 * IP address change. 1681 */ 1682 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) { 1683 /* 1684 * The UDP checksum is optional, only adjust it 1685 * if it has been set. 1686 */ 1687 sum1 = ntohs(udp->uh_sum); 1688 fix_datacksum(&udp->uh_sum, sumd); 1689 sum2 = ntohs(udp->uh_sum); 1690 1691 /* 1692 * Fix ICMP checksum to compensate the UDP 1693 * checksum adjustment. 1694 */ 1695 CALC_SUMD(sum1, sum2, sumd); 1696 fix_outcksum(&icmp->icmp_cksum, sumd); 1697 } 1698 1699#if 0 1700 /* 1701 * Fix TCP pseudo header checksum to compensate for the 1702 * IP address change. Before we can do the change, we 1703 * must make sure that oip is sufficient large to hold 1704 * the TCP checksum (normally it does not!). 1705 */ 1706 if (oip->ip_p == IPPROTO_TCP) { 1707 1708 } 1709#endif 1710 } else { 1711 1712 /* 1713 * Fix IP checksum of the offending IP packet to adjust for 1714 * the change in the IP address. 1715 * 1716 * Normally, you would expect that the ICMP checksum of the 1717 * ICMP error message needs to be adjusted as well for the 1718 * IP address change in oip. 1719 * However, this is a NOP, because the ICMP checksum is 1720 * calculated over the complete ICMP packet, which includes the 1721 * changed oip IP addresses and oip->ip_sum. However, these 1722 * two changes cancel each other out (if the delta for 1723 * the IP address is x, then the delta for ip_sum is minus x), 1724 * so no change in the icmp_cksum is necessary. 1725 * 1726 * Be careful that nat_dir refers to the direction of the 1727 * offending IP packet (oip), not to its ICMP response (icmp) 1728 */ 1729 fix_datacksum(&oip->ip_sum, sumd); 1730 1731/* XXX FV : without having looked at Solaris source code, it seems unlikely 1732 * that SOLARIS would compensate this in the kernel (a body of an IP packet 1733 * in the data section of an ICMP packet). I have the feeling that this should 1734 * be unconditional, but I'm not in a position to check. 1735 */ 1736#if !SOLARIS && !defined(__sgi) 1737 /* 1738 * Fix UDP pseudo header checksum to compensate for the 1739 * IP address change. 1740 */ 1741 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) { 1742 /* 1743 * The UDP checksum is optional, only adjust it 1744 * if it has been set 1745 */ 1746 sum1 = ntohs(udp->uh_sum); 1747 fix_datacksum(&udp->uh_sum, sumd); 1748 sum2 = ntohs(udp->uh_sum); 1749 1750 /* 1751 * Fix ICMP checksum to compensate the UDP 1752 * checksum adjustment. 1753 */ 1754 CALC_SUMD(sum1, sum2, sumd); 1755 fix_incksum(&icmp->icmp_cksum, sumd); 1756 } 1757 1758#if 0 1759 /* 1760 * Fix TCP pseudo header checksum to compensate for the 1761 * IP address change. Before we can do the change, we 1762 * must make sure that oip is sufficient large to hold 1763 * the TCP checksum (normally it does not!). 1764 */ 1765 if (oip->ip_p == IPPROTO_TCP) { 1766 1767 }; 1768#endif 1769 1770#endif 1771 } 1772 1773 if ((flags & IPN_TCPUDP) != 0) { 1774 tcphdr_t *tcp; 1775 1776 /* 1777 * XXX - what if this is bogus hl and we go off the end ? 1778 * In this case, nat_icmpinlookup() will have returned NULL. 1779 */ 1780 tcp = (tcphdr_t *)udp; 1781 1782 /* 1783 * Step 2 : 1784 * For offending TCP/UDP IP packets, translate the ports as 1785 * well, based on the NAT specification. Of course such 1786 * a change must be reflected in the ICMP checksum as well. 1787 * 1788 * Advance notice : Now it becomes complicated :-) 1789 * 1790 * Since the port fields are part of the TCP/UDP checksum 1791 * of the offending IP packet, you need to adjust that checksum 1792 * as well... but, if you change, you must change the icmp 1793 * checksum *again*, to reflect that change. 1794 * 1795 * To further complicate: the TCP checksum is not in the first 1796 * 8 bytes of the offending ip packet, so it most likely is not 1797 * available (we might have to fix that if the encounter a 1798 * device that returns more than 8 data bytes on icmp error) 1799 */ 1800 1801 if (nat->nat_dir == NAT_OUTBOUND) { 1802 if (tcp->th_sport != nat->nat_inport) { 1803 /* 1804 * Fix ICMP checksum to compensate port 1805 * adjustment. 1806 */ 1807 sum1 = ntohs(tcp->th_sport); 1808 sum2 = ntohs(nat->nat_inport); 1809 CALC_SUMD(sum1, sum2, sumd); 1810 tcp->th_sport = nat->nat_inport; 1811 fix_outcksum(&icmp->icmp_cksum, sumd); 1812 1813 /* 1814 * Fix udp checksum to compensate port 1815 * adjustment. NOTE : the offending IP packet 1816 * flows the other direction compared to the 1817 * ICMP message. 1818 * 1819 * The UDP checksum is optional, only adjust 1820 * it if it has been set. 1821 */ 1822 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) { 1823 1824 sum1 = ntohs(udp->uh_sum); 1825 fix_datacksum(&udp->uh_sum, sumd); 1826 sum2 = ntohs(udp->uh_sum); 1827 1828 /* 1829 * Fix ICMP checksum to 1830 * compensate UDP checksum 1831 * adjustment. 1832 */ 1833 CALC_SUMD(sum1, sum2, sumd); 1834 fix_outcksum(&icmp->icmp_cksum, sumd); 1835 } 1836 } 1837 } else { 1838 1839 if (tcp->th_dport != nat->nat_outport) { 1840 /* 1841 * Fix ICMP checksum to compensate port 1842 * adjustment. 1843 */ 1844 sum1 = ntohs(tcp->th_dport); 1845 sum2 = ntohs(nat->nat_outport); 1846 CALC_SUMD(sum1, sum2, sumd); 1847 tcp->th_dport = nat->nat_outport; 1848 fix_incksum(&icmp->icmp_cksum, sumd); 1849 1850 /* 1851 * Fix udp checksum to compensate port 1852 * adjustment. NOTE : the offending IP 1853 * packet flows the other direction compared 1854 * to the ICMP message. 1855 * 1856 * The UDP checksum is optional, only adjust 1857 * it if it has been set. 1858 */ 1859 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) { 1860 1861 sum1 = ntohs(udp->uh_sum); 1862 fix_datacksum(&udp->uh_sum, sumd); 1863 sum2 = ntohs(udp->uh_sum); 1864 1865 /* 1866 * Fix ICMP checksum to compensate 1867 * UDP checksum adjustment. 1868 */ 1869 CALC_SUMD(sum1, sum2, sumd); 1870 fix_incksum(&icmp->icmp_cksum, sumd); 1871 } 1872 } 1873 } 1874 } 1875 nat->nat_age = fr_defnaticmpage; 1876 return nat; 1877} 1878 1879 1880/* 1881 * NB: these lookups don't lock access to the list, it assume it has already 1882 * been done! 1883 */ 1884/* 1885 * Lookup a nat entry based on the mapped destination ip address/port and 1886 * real source address/port. We use this lookup when receiving a packet, 1887 * we're looking for a table entry, based on the destination address. 1888 * NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. 1889 */ 1890nat_t *nat_inlookup(ifp, flags, p, src, mapdst, ports) 1891void *ifp; 1892register u_int flags, p; 1893struct in_addr src , mapdst; 1894u_32_t ports; 1895{ 1896 register u_short sport, dport; 1897 register nat_t *nat; 1898 register int nflags; 1899 register u_32_t dst; 1900 u_int hv; 1901 1902 dst = mapdst.s_addr; 1903 dport = ports >> 16; 1904 sport = ports & 0xffff; 1905 flags &= IPN_TCPUDP; 1906 1907 hv = NAT_HASH_FN(dst, dport, ipf_nattable_sz); 1908 nat = nat_table[1][hv]; 1909 for (; nat; nat = nat->nat_hnext[1]) { 1910 nflags = nat->nat_flags; 1911 if ((!ifp || ifp == nat->nat_ifp) && 1912 nat->nat_oip.s_addr == src.s_addr && 1913 nat->nat_outip.s_addr == dst && 1914 (((p == 0) && (flags == (nat->nat_flags & IPN_TCPUDP))) 1915 || (p == nat->nat_p)) && (!flags || 1916 (((nat->nat_oport == sport) || (nflags & FI_W_DPORT)) && 1917 ((nat->nat_outport == dport) || (nflags & FI_W_SPORT))))) 1918 return nat; 1919 } 1920 if (!nat_wilds || !(flags & IPN_TCPUDP)) 1921 return NULL; 1922 RWLOCK_EXIT(&ipf_nat); 1923 hv = NAT_HASH_FN(dst, 0, ipf_nattable_sz); 1924 WRITE_ENTER(&ipf_nat); 1925 nat = nat_table[1][hv]; 1926 for (; nat; nat = nat->nat_hnext[1]) { 1927 nflags = nat->nat_flags; 1928 if (ifp && ifp != nat->nat_ifp) 1929 continue; 1930 if (!(nflags & IPN_TCPUDP)) 1931 continue; 1932 if (!(nflags & FI_WILDP)) 1933 continue; 1934 if (nat->nat_oip.s_addr != src.s_addr || 1935 nat->nat_outip.s_addr != dst) 1936 continue; 1937 if (((nat->nat_oport == sport) || (nflags & FI_W_DPORT)) && 1938 ((nat->nat_outport == dport) || (nflags & FI_W_SPORT))) { 1939 hv = NAT_HASH_FN(dst, dport, ipf_nattable_sz); 1940 nat_tabmove(nat, hv); 1941 break; 1942 } 1943 } 1944 MUTEX_DOWNGRADE(&ipf_nat); 1945 return nat; 1946} 1947 1948 1949static void nat_tabmove(nat, hv) 1950nat_t *nat; 1951u_int hv; 1952{ 1953 nat_t **natp; 1954 1955 /* 1956 * Remove the NAT entry from the old location 1957 */ 1958 if (nat->nat_hnext[0]) 1959 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; 1960 *nat->nat_phnext[0] = nat->nat_hnext[0]; 1961 1962 if (nat->nat_hnext[1]) 1963 nat->nat_hnext[0]->nat_phnext[1] = nat->nat_phnext[1]; 1964 *nat->nat_phnext[1] = nat->nat_hnext[1]; 1965 1966 natp = &nat_table[0][hv]; 1967 if (*natp) 1968 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 1969 nat->nat_phnext[0] = natp; 1970 nat->nat_hnext[0] = *natp; 1971 *natp = nat; 1972 1973 /* 1974 * Add into the NAT table in the new position 1975 */ 1976 natp = &nat_table[1][hv]; 1977 if (*natp) 1978 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 1979 nat->nat_phnext[1] = natp; 1980 nat->nat_hnext[1] = *natp; 1981 *natp = nat; 1982} 1983 1984 1985/* 1986 * Lookup a nat entry based on the source 'real' ip address/port and 1987 * destination address/port. We use this lookup when sending a packet out, 1988 * we're looking for a table entry, based on the source address. 1989 * NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. 1990 */ 1991nat_t *nat_outlookup(ifp, flags, p, src, dst, ports) 1992void *ifp; 1993register u_int flags, p; 1994struct in_addr src , dst; 1995u_32_t ports; 1996{ 1997 register u_short sport, dport; 1998 register nat_t *nat; 1999 register int nflags; 2000 u_32_t srcip; 2001 u_int hv; 2002 2003 sport = ports & 0xffff; 2004 dport = ports >> 16; 2005 flags &= IPN_TCPUDP; 2006 srcip = src.s_addr; 2007 2008 hv = NAT_HASH_FN(srcip, sport, ipf_nattable_sz); 2009 nat = nat_table[0][hv]; 2010 for (; nat; nat = nat->nat_hnext[0]) { 2011 nflags = nat->nat_flags; 2012 2013 if ((!ifp || ifp == nat->nat_ifp) && 2014 nat->nat_inip.s_addr == srcip && 2015 nat->nat_oip.s_addr == dst.s_addr && 2016 (((p == 0) && (flags == (nat->nat_flags & IPN_TCPUDP))) 2017 || (p == nat->nat_p)) && (!flags || 2018 ((nat->nat_inport == sport || nflags & FI_W_SPORT) && 2019 (nat->nat_oport == dport || nflags & FI_W_DPORT)))) 2020 return nat; 2021 } 2022 if (!nat_wilds || !(flags & IPN_TCPUDP)) 2023 return NULL; 2024 RWLOCK_EXIT(&ipf_nat); 2025 hv = NAT_HASH_FN(srcip, 0, ipf_nattable_sz); 2026 WRITE_ENTER(&ipf_nat); 2027 nat = nat_table[0][hv]; 2028 for (; nat; nat = nat->nat_hnext[0]) { 2029 nflags = nat->nat_flags; 2030 if (ifp && ifp != nat->nat_ifp) 2031 continue; 2032 if (!(nflags & IPN_TCPUDP)) 2033 continue; 2034 if (!(nflags & FI_WILDP)) 2035 continue; 2036 if ((nat->nat_inip.s_addr != srcip) || 2037 (nat->nat_oip.s_addr != dst.s_addr)) 2038 continue; 2039 if (((nat->nat_inport == sport) || (nflags & FI_W_DPORT)) && 2040 ((nat->nat_oport == dport) || (nflags & FI_W_SPORT))) { 2041 hv = NAT_HASH_FN(srcip, sport, ipf_nattable_sz); 2042 nat_tabmove(nat, hv); 2043 break; 2044 } 2045 } 2046 MUTEX_DOWNGRADE(&ipf_nat); 2047 return nat; 2048} 2049 2050 2051/* 2052 * Lookup the NAT tables to search for a matching redirect 2053 */ 2054nat_t *nat_lookupredir(np) 2055register natlookup_t *np; 2056{ 2057 u_32_t ports; 2058 nat_t *nat; 2059 2060 ports = (np->nl_outport << 16) | np->nl_inport; 2061 /* 2062 * If nl_inip is non null, this is a lookup based on the real 2063 * ip address. Else, we use the fake. 2064 */ 2065 if ((nat = nat_outlookup(NULL, np->nl_flags, 0, np->nl_inip, 2066 np->nl_outip, ports))) { 2067 np->nl_realip = nat->nat_outip; 2068 np->nl_realport = nat->nat_outport; 2069 } 2070 return nat; 2071} 2072 2073 2074static int nat_match(fin, np, ip) 2075fr_info_t *fin; 2076ipnat_t *np; 2077ip_t *ip; 2078{ 2079 frtuc_t *ft; 2080 2081 if (ip->ip_v != 4) 2082 return 0; 2083 2084 if (np->in_p && ip->ip_p != np->in_p) 2085 return 0; 2086 if (fin->fin_out) { 2087 if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK))) 2088 return 0; 2089 if (((fin->fin_fi.fi_saddr & np->in_inmsk) != np->in_inip) 2090 ^ ((np->in_flags & IPN_NOTSRC) != 0)) 2091 return 0; 2092 if (((fin->fin_fi.fi_daddr & np->in_srcmsk) != np->in_srcip) 2093 ^ ((np->in_flags & IPN_NOTDST) != 0)) 2094 return 0; 2095 } else { 2096 if (!(np->in_redir & NAT_REDIRECT)) 2097 return 0; 2098 if (((fin->fin_fi.fi_saddr & np->in_srcmsk) != np->in_srcip) 2099 ^ ((np->in_flags & IPN_NOTSRC) != 0)) 2100 return 0; 2101 if (((fin->fin_fi.fi_daddr & np->in_outmsk) != np->in_outip) 2102 ^ ((np->in_flags & IPN_NOTDST) != 0)) 2103 return 0; 2104 } 2105 2106 ft = &np->in_tuc; 2107 if (!(fin->fin_fi.fi_fl & FI_TCPUDP) || 2108 (fin->fin_fi.fi_fl & FI_SHORT) || (ip->ip_off & IP_OFFMASK)) { 2109 if (ft->ftu_scmp || ft->ftu_dcmp) 2110 return 0; 2111 return 1; 2112 } 2113 2114 return fr_tcpudpchk(ft, fin); 2115} 2116 2117 2118/* 2119 * Packets going out on the external interface go through this. 2120 * Here, the source address requires alteration, if anything. 2121 */ 2122int ip_natout(ip, fin) 2123ip_t *ip; 2124fr_info_t *fin; 2125{ 2126 register ipnat_t *np = NULL; 2127 register u_32_t ipa; 2128 tcphdr_t *tcp = NULL; 2129 u_short sport = 0, dport = 0, *csump = NULL; 2130 struct ifnet *ifp; 2131 int natadd = 1; 2132 frentry_t *fr; 2133 u_int nflags = 0, hv, msk; 2134 u_32_t iph; 2135 nat_t *nat; 2136 int i; 2137 2138 if (nat_list == NULL || (fr_nat_lock)) 2139 return 0; 2140 2141 if ((fr = fin->fin_fr) && !(fr->fr_flags & FR_DUP) && 2142 fr->fr_tif.fd_ifp && fr->fr_tif.fd_ifp != (void *)-1) 2143 ifp = fr->fr_tif.fd_ifp; 2144 else 2145 ifp = fin->fin_ifp; 2146 2147 if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) { 2148 if (ip->ip_p == IPPROTO_TCP) 2149 nflags = IPN_TCP; 2150 else if (ip->ip_p == IPPROTO_UDP) 2151 nflags = IPN_UDP; 2152 if ((nflags & IPN_TCPUDP)) { 2153 tcp = (tcphdr_t *)fin->fin_dp; 2154 sport = tcp->th_sport; 2155 dport = tcp->th_dport; 2156 } 2157 } 2158 2159 ipa = ip->ip_src.s_addr; 2160 2161 READ_ENTER(&ipf_nat); 2162 2163 if ((ip->ip_p == IPPROTO_ICMP) && 2164 (nat = nat_icmp(ip, fin, &nflags, NAT_OUTBOUND))) 2165 ; 2166 else if ((ip->ip_off & (IP_OFFMASK|IP_MF)) && 2167 (nat = ipfr_nat_knownfrag(ip, fin))) 2168 natadd = 0; 2169 else if ((nat = nat_outlookup(ifp, nflags, (u_int)ip->ip_p, ip->ip_src, 2170 ip->ip_dst, (dport << 16) | sport))) { 2171 nflags = nat->nat_flags; 2172 if ((nflags & (FI_W_SPORT|FI_W_DPORT)) != 0) { 2173 if ((nflags & FI_W_SPORT) && 2174 (nat->nat_inport != sport)) 2175 nat->nat_inport = sport; 2176 else if ((nflags & FI_W_DPORT) && 2177 (nat->nat_oport != dport)) 2178 nat->nat_oport = dport; 2179 if (nat->nat_outport == 0) 2180 nat->nat_outport = sport; 2181 nat->nat_flags &= ~(FI_W_DPORT|FI_W_SPORT); 2182 nflags = nat->nat_flags; 2183 nat_wilds--; 2184 } 2185 } else { 2186 RWLOCK_EXIT(&ipf_nat); 2187 WRITE_ENTER(&ipf_nat); 2188 /* 2189 * If there is no current entry in the nat table for this IP#, 2190 * create one for it (if there is a matching rule). 2191 */ 2192 msk = 0xffffffff; 2193 i = 32; 2194maskloop: 2195 iph = ipa & htonl(msk); 2196 hv = NAT_HASH_FN(iph, 0, ipf_natrules_sz); 2197 for (np = nat_rules[hv]; np; np = np->in_mnext) 2198 { 2199 if ((np->in_ifp && (np->in_ifp != ifp)) || 2200 !np->in_space) 2201 continue; 2202 if ((np->in_flags & IPN_RF) && 2203 !(np->in_flags & nflags)) 2204 continue; 2205 if (np->in_flags & IPN_FILTER) { 2206 if (!nat_match(fin, np, ip)) 2207 continue; 2208 } else if ((ipa & np->in_inmsk) != np->in_inip) 2209 continue; 2210 if (np->in_redir & (NAT_MAP|NAT_MAPBLK)) { 2211 if (*np->in_plabel && !appr_ok(ip, tcp, np)) 2212 continue; 2213 /* 2214 * If it's a redirection, then we don't want to 2215 * create new outgoing port stuff. 2216 * Redirections are only for incoming 2217 * connections. 2218 */ 2219 if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK))) 2220 continue; 2221 if ((nat = nat_new(np, ip, fin, (u_int)nflags, 2222 NAT_OUTBOUND))) { 2223 np->in_hits++; 2224#ifdef IPFILTER_LOG 2225 nat_log(nat, (u_int)np->in_redir); 2226#endif 2227 break; 2228 } 2229 } 2230 } 2231 if ((np == NULL) && (i > 0)) { 2232 do { 2233 i--; 2234 msk <<= 1; 2235 } while ((i >= 0) && ((nat_masks & (1 << i)) == 0)); 2236 if (i >= 0) 2237 goto maskloop; 2238 } 2239 MUTEX_DOWNGRADE(&ipf_nat); 2240 } 2241 2242 if (nat) { 2243 np = nat->nat_ptr; 2244 if (natadd && fin->fin_fi.fi_fl & FI_FRAG) 2245 ipfr_nat_newfrag(ip, fin, 0, nat); 2246 MUTEX_ENTER(&nat->nat_lock); 2247 nat->nat_age = fr_defnatage; 2248 nat->nat_bytes += ip->ip_len; 2249 nat->nat_pkts++; 2250 MUTEX_EXIT(&nat->nat_lock); 2251 2252 /* 2253 * Fix up checksums, not by recalculating them, but 2254 * simply computing adjustments. 2255 */ 2256 if (nflags == IPN_ICMPERR) { 2257 u_32_t s1, s2, sumd; 2258 2259 s1 = LONG_SUM(ntohl(ip->ip_src.s_addr)); 2260 s2 = LONG_SUM(ntohl(nat->nat_outip.s_addr)); 2261 CALC_SUMD(s1, s2, sumd); 2262 2263 if (nat->nat_dir == NAT_OUTBOUND) 2264 fix_incksum(&ip->ip_sum, sumd); 2265 else 2266 fix_outcksum(&ip->ip_sum, sumd); 2267 } 2268#if SOLARIS || defined(__sgi) 2269 else { 2270 if (nat->nat_dir == NAT_OUTBOUND) 2271 fix_outcksum(&ip->ip_sum, nat->nat_ipsumd); 2272 else 2273 fix_incksum(&ip->ip_sum, nat->nat_ipsumd); 2274 } 2275#endif 2276 ip->ip_src = nat->nat_outip; 2277 2278 if (!(ip->ip_off & IP_OFFMASK) && 2279 !(fin->fin_fi.fi_fl & FI_SHORT)) { 2280 2281 if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) { 2282 tcp->th_sport = nat->nat_outport; 2283 fin->fin_data[0] = ntohs(tcp->th_sport); 2284 } 2285 2286 if (ip->ip_p == IPPROTO_TCP) { 2287 csump = &tcp->th_sum; 2288 MUTEX_ENTER(&nat->nat_lock); 2289 fr_tcp_age(&nat->nat_age, 2290 nat->nat_tcpstate, fin, 1); 2291 if (nat->nat_age < fr_defnaticmpage) 2292 nat->nat_age = fr_defnaticmpage; 2293#ifdef LARGE_NAT 2294 else if (nat->nat_age > fr_defnatage) 2295 nat->nat_age = fr_defnatage; 2296#endif 2297 /* 2298 * Increase this because we may have 2299 * "keep state" following this too and 2300 * packet storms can occur if this is 2301 * removed too quickly. 2302 */ 2303 if (nat->nat_age == fr_tcpclosed) 2304 nat->nat_age = fr_tcplastack; 2305 MUTEX_EXIT(&nat->nat_lock); 2306 } else if (ip->ip_p == IPPROTO_UDP) { 2307 udphdr_t *udp = (udphdr_t *)tcp; 2308 2309 if (udp->uh_sum) 2310 csump = &udp->uh_sum; 2311 } else if (ip->ip_p == IPPROTO_ICMP) { 2312 nat->nat_age = fr_defnaticmpage; 2313 } 2314 2315 if (csump) { 2316 if (nat->nat_dir == NAT_OUTBOUND) 2317 fix_outcksum(csump, nat->nat_sumd[1]); 2318 else 2319 fix_incksum(csump, nat->nat_sumd[1]); 2320 } 2321 } 2322 2323 if ((np->in_apr != NULL) && (np->in_dport == 0 || 2324 (tcp != NULL && dport == np->in_dport))) { 2325 i = appr_check(ip, fin, nat); 2326 if (i == 0) 2327 i = 1; 2328 } else 2329 i = 1; 2330 ATOMIC_INCL(nat_stats.ns_mapped[1]); 2331 RWLOCK_EXIT(&ipf_nat); /* READ */ 2332 return i; 2333 } 2334 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */ 2335 return 0; 2336} 2337 2338 2339/* 2340 * Packets coming in from the external interface go through this. 2341 * Here, the destination address requires alteration, if anything. 2342 */ 2343int ip_natin(ip, fin) 2344ip_t *ip; 2345fr_info_t *fin; 2346{ 2347 register struct in_addr src; 2348 register struct in_addr in; 2349 register ipnat_t *np; 2350 u_int nflags = 0, natadd = 1, hv, msk; 2351 struct ifnet *ifp = fin->fin_ifp; 2352 tcphdr_t *tcp = NULL; 2353 u_short sport = 0, dport = 0, *csump = NULL; 2354 nat_t *nat; 2355 u_32_t iph; 2356 int i; 2357 2358 if ((nat_list == NULL) || (ip->ip_v != 4) || (fr_nat_lock)) 2359 return 0; 2360 2361 if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) { 2362 if (ip->ip_p == IPPROTO_TCP) 2363 nflags = IPN_TCP; 2364 else if (ip->ip_p == IPPROTO_UDP) 2365 nflags = IPN_UDP; 2366 if ((nflags & IPN_TCPUDP)) { 2367 tcp = (tcphdr_t *)fin->fin_dp; 2368 dport = tcp->th_dport; 2369 sport = tcp->th_sport; 2370 } 2371 } 2372 2373 in = ip->ip_dst; 2374 /* make sure the source address is to be redirected */ 2375 src = ip->ip_src; 2376 2377 READ_ENTER(&ipf_nat); 2378 2379 if ((ip->ip_p == IPPROTO_ICMP) && 2380 (nat = nat_icmp(ip, fin, &nflags, NAT_INBOUND))) 2381 ; 2382 else if ((ip->ip_off & (IP_OFFMASK|IP_MF)) && 2383 (nat = ipfr_nat_knownfrag(ip, fin))) 2384 natadd = 0; 2385 else if ((nat = nat_inlookup(fin->fin_ifp, nflags, (u_int)ip->ip_p, 2386 ip->ip_src, in, (dport << 16) | sport))) { 2387 nflags = nat->nat_flags; 2388 if ((nflags & (FI_W_SPORT|FI_W_DPORT)) != 0) { 2389 if ((nat->nat_oport != sport) && (nflags & FI_W_DPORT)) 2390 nat->nat_oport = sport; 2391 else if ((nat->nat_outport != dport) && 2392 (nflags & FI_W_SPORT)) 2393 nat->nat_outport = dport; 2394 nat->nat_flags &= ~(FI_W_SPORT|FI_W_DPORT); 2395 nflags = nat->nat_flags; 2396 nat_wilds--; 2397 } 2398 } else { 2399 RWLOCK_EXIT(&ipf_nat); 2400 WRITE_ENTER(&ipf_nat); 2401 /* 2402 * If there is no current entry in the nat table for this IP#, 2403 * create one for it (if there is a matching rule). 2404 */ 2405 msk = 0xffffffff; 2406 i = 32; 2407maskloop: 2408 iph = in.s_addr & htonl(msk); 2409 hv = NAT_HASH_FN(iph, 0, ipf_rdrrules_sz); 2410 for (np = rdr_rules[hv]; np; np = np->in_rnext) { 2411 if ((np->in_ifp && (np->in_ifp != ifp)) || 2412 (np->in_p && (np->in_p != ip->ip_p)) || 2413 (np->in_flags && !(nflags & np->in_flags))) 2414 continue; 2415 if (np->in_flags & IPN_FILTER) { 2416 if (!nat_match(fin, np, ip)) 2417 continue; 2418 } else if ((in.s_addr & np->in_outmsk) != np->in_outip) 2419 continue; 2420 if ((np->in_redir & NAT_REDIRECT) && 2421 (!np->in_pmin || (np->in_flags & IPN_FILTER) || 2422 ((ntohs(np->in_pmax) >= ntohs(dport)) && 2423 (ntohs(dport) >= ntohs(np->in_pmin))))) 2424 if ((nat = nat_new(np, ip, fin, nflags, 2425 NAT_INBOUND))) { 2426 np->in_hits++; 2427#ifdef IPFILTER_LOG 2428 nat_log(nat, (u_int)np->in_redir); 2429#endif 2430 break; 2431 } 2432 } 2433 2434 if ((np == NULL) && (i > 0)) { 2435 do { 2436 i--; 2437 msk <<= 1; 2438 } while ((i >= 0) && ((rdr_masks & (1 << i)) == 0)); 2439 if (i >= 0) 2440 goto maskloop; 2441 } 2442 MUTEX_DOWNGRADE(&ipf_nat); 2443 } 2444 if (nat) { 2445 np = nat->nat_ptr; 2446 fin->fin_fr = nat->nat_fr; 2447 if (natadd && fin->fin_fi.fi_fl & FI_FRAG) 2448 ipfr_nat_newfrag(ip, fin, 0, nat); 2449 if ((np->in_apr != NULL) && (np->in_dport == 0 || 2450 (tcp != NULL && sport == np->in_dport))) { 2451 i = appr_check(ip, fin, nat); 2452 if (i == -1) { 2453 RWLOCK_EXIT(&ipf_nat); 2454 return i; 2455 } 2456 } 2457 2458 MUTEX_ENTER(&nat->nat_lock); 2459 if (nflags != IPN_ICMPERR) 2460 nat->nat_age = fr_defnatage; 2461 2462 nat->nat_bytes += ip->ip_len; 2463 nat->nat_pkts++; 2464 MUTEX_EXIT(&nat->nat_lock); 2465 ip->ip_dst = nat->nat_inip; 2466 fin->fin_fi.fi_daddr = nat->nat_inip.s_addr; 2467 2468 /* 2469 * Fix up checksums, not by recalculating them, but 2470 * simply computing adjustments. 2471 */ 2472#if SOLARIS || defined(__sgi) 2473 if (nat->nat_dir == NAT_OUTBOUND) 2474 fix_incksum(&ip->ip_sum, nat->nat_ipsumd); 2475 else 2476 fix_outcksum(&ip->ip_sum, nat->nat_ipsumd); 2477#endif 2478 if (!(ip->ip_off & IP_OFFMASK) && 2479 !(fin->fin_fi.fi_fl & FI_SHORT)) { 2480 2481 if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) { 2482 tcp->th_dport = nat->nat_inport; 2483 fin->fin_data[1] = ntohs(tcp->th_dport); 2484 } 2485 2486 if (ip->ip_p == IPPROTO_TCP) { 2487 csump = &tcp->th_sum; 2488 MUTEX_ENTER(&nat->nat_lock); 2489 fr_tcp_age(&nat->nat_age, 2490 nat->nat_tcpstate, fin, 0); 2491 if (nat->nat_age < fr_defnaticmpage) 2492 nat->nat_age = fr_defnaticmpage; 2493#ifdef LARGE_NAT 2494 else if (nat->nat_age > fr_defnatage) 2495 nat->nat_age = fr_defnatage; 2496#endif 2497 /* 2498 * Increase this because we may have 2499 * "keep state" following this too and 2500 * packet storms can occur if this is 2501 * removed too quickly. 2502 */ 2503 if (nat->nat_age == fr_tcpclosed) 2504 nat->nat_age = fr_tcplastack; 2505 MUTEX_EXIT(&nat->nat_lock); 2506 } else if (ip->ip_p == IPPROTO_UDP) { 2507 udphdr_t *udp = (udphdr_t *)tcp; 2508 2509 if (udp->uh_sum) 2510 csump = &udp->uh_sum; 2511 } else if (ip->ip_p == IPPROTO_ICMP) { 2512 nat->nat_age = fr_defnaticmpage; 2513 } 2514 2515 if (csump) { 2516 if (nat->nat_dir == NAT_OUTBOUND) 2517 fix_incksum(csump, nat->nat_sumd[0]); 2518 else 2519 fix_outcksum(csump, nat->nat_sumd[0]); 2520 } 2521 } 2522 ATOMIC_INCL(nat_stats.ns_mapped[0]); 2523 RWLOCK_EXIT(&ipf_nat); /* READ */ 2524 return 1; 2525 } 2526 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */ 2527 return 0; 2528} 2529 2530 2531/* 2532 * Free all memory used by NAT structures allocated at runtime. 2533 */ 2534void ip_natunload() 2535{ 2536 WRITE_ENTER(&ipf_nat); 2537 (void) nat_clearlist(); 2538 (void) nat_flushtable(); 2539 RWLOCK_EXIT(&ipf_nat); 2540 2541 if (nat_table[0] != NULL) { 2542 KFREES(nat_table[0], sizeof(nat_t *) * ipf_nattable_sz); 2543 nat_table[0] = NULL; 2544 } 2545 if (nat_table[1] != NULL) { 2546 KFREES(nat_table[1], sizeof(nat_t *) * ipf_nattable_sz); 2547 nat_table[1] = NULL; 2548 } 2549 if (nat_rules != NULL) { 2550 KFREES(nat_rules, sizeof(ipnat_t *) * ipf_natrules_sz); 2551 nat_rules = NULL; 2552 } 2553 if (rdr_rules != NULL) { 2554 KFREES(rdr_rules, sizeof(ipnat_t *) * ipf_rdrrules_sz); 2555 rdr_rules = NULL; 2556 } 2557 if (maptable != NULL) { 2558 KFREES(maptable, sizeof(hostmap_t *) * ipf_hostmap_sz); 2559 maptable = NULL; 2560 } 2561} 2562 2563 2564/* 2565 * Slowly expire held state for NAT entries. Timeouts are set in 2566 * expectation of this being called twice per second. 2567 */ 2568void ip_natexpire() 2569{ 2570 register struct nat *nat, **natp; 2571#if defined(_KERNEL) && !SOLARIS 2572 int s; 2573#endif 2574 2575 SPL_NET(s); 2576 WRITE_ENTER(&ipf_nat); 2577 for (natp = &nat_instances; (nat = *natp); ) { 2578 nat->nat_age--; 2579 if (nat->nat_age) { 2580 natp = &nat->nat_next; 2581 continue; 2582 } 2583 *natp = nat->nat_next; 2584#ifdef IPFILTER_LOG 2585 nat_log(nat, NL_EXPIRE); 2586#endif 2587 nat_delete(nat); 2588 nat_stats.ns_expire++; 2589 } 2590 RWLOCK_EXIT(&ipf_nat); 2591 SPL_X(s); 2592} 2593 2594 2595/* 2596 */ 2597void ip_natsync(ifp) 2598void *ifp; 2599{ 2600 register ipnat_t *n; 2601 register nat_t *nat; 2602 register u_32_t sum1, sum2, sumd; 2603 struct in_addr in; 2604 ipnat_t *np; 2605 void *ifp2; 2606#if defined(_KERNEL) && !SOLARIS 2607 int s; 2608#endif 2609 2610 /* 2611 * Change IP addresses for NAT sessions for any protocol except TCP 2612 * since it will break the TCP connection anyway. 2613 */ 2614 SPL_NET(s); 2615 WRITE_ENTER(&ipf_nat); 2616 for (nat = nat_instances; nat; nat = nat->nat_next) 2617 if (((ifp == NULL) || (ifp == nat->nat_ifp)) && 2618 !(nat->nat_flags & IPN_TCP) && (np = nat->nat_ptr) && 2619 (np->in_outmsk == 0xffffffff) && !np->in_nip) { 2620 ifp2 = nat->nat_ifp; 2621 /* 2622 * Change the map-to address to be the same as the 2623 * new one. 2624 */ 2625 sum1 = nat->nat_outip.s_addr; 2626 if (fr_ifpaddr(4, ifp2, &in) != -1) 2627 nat->nat_outip = in; 2628 sum2 = nat->nat_outip.s_addr; 2629 2630 if (sum1 == sum2) 2631 continue; 2632 /* 2633 * Readjust the checksum adjustment to take into 2634 * account the new IP#. 2635 */ 2636 CALC_SUMD(sum1, sum2, sumd); 2637 /* XXX - dont change for TCP when solaris does 2638 * hardware checksumming. 2639 */ 2640 sumd += nat->nat_sumd[0]; 2641 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 2642 nat->nat_sumd[1] = nat->nat_sumd[0]; 2643 } 2644 2645 for (n = nat_list; (n != NULL); n = n->in_next) 2646 if (n->in_ifp == ifp) { 2647 n->in_ifp = (void *)GETUNIT(n->in_ifname, 4); 2648 if (!n->in_ifp) 2649 n->in_ifp = (void *)-1; 2650 } 2651 RWLOCK_EXIT(&ipf_nat); 2652 SPL_X(s); 2653} 2654 2655 2656#ifdef IPFILTER_LOG 2657void nat_log(nat, type) 2658struct nat *nat; 2659u_int type; 2660{ 2661 struct ipnat *np; 2662 struct natlog natl; 2663 void *items[1]; 2664 size_t sizes[1]; 2665 int rulen, types[1]; 2666 2667 natl.nl_inip = nat->nat_inip; 2668 natl.nl_outip = nat->nat_outip; 2669 natl.nl_origip = nat->nat_oip; 2670 natl.nl_bytes = nat->nat_bytes; 2671 natl.nl_pkts = nat->nat_pkts; 2672 natl.nl_origport = nat->nat_oport; 2673 natl.nl_inport = nat->nat_inport; 2674 natl.nl_outport = nat->nat_outport; 2675 natl.nl_p = nat->nat_p; 2676 natl.nl_type = type; 2677 natl.nl_rule = -1; 2678#ifndef LARGE_NAT 2679 if (nat->nat_ptr != NULL) { 2680 for (rulen = 0, np = nat_list; np; np = np->in_next, rulen++) 2681 if (np == nat->nat_ptr) { 2682 natl.nl_rule = rulen; 2683 break; 2684 } 2685 } 2686#endif 2687 items[0] = &natl; 2688 sizes[0] = sizeof(natl); 2689 types[0] = 0; 2690 2691 (void) ipllog(IPL_LOGNAT, NULL, items, sizes, types, 1); 2692} 2693#endif 2694