ip_nat.c revision 72006
1/* 2 * Copyright (C) 1995-2000 by Darren Reed. 3 * 4 * Redistribution and use in source and binary forms are permitted 5 * provided that this notice is preserved and due credit is given 6 * to the original author and the contributors. 7 * 8 * Added redirect stuff and a LOT of bug fixes. (mcn@EnGarde.com) 9 */ 10#if !defined(lint) 11static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.32 2001/01/10 06:19:11 darrenr Exp $"; 12/*static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.37.2.16 2000/07/18 13:57:40 darrenr Exp $";*/ 13static const char rcsid[] = "@(#)$FreeBSD: head/sys/contrib/ipfilter/netinet/ip_nat.c 72006 2001-02-04 14:26:56Z darrenr $"; 14#endif 15 16#if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL) 17#define _KERNEL 18#endif 19 20#include <sys/errno.h> 21#include <sys/types.h> 22#include <sys/param.h> 23#include <sys/time.h> 24#include <sys/file.h> 25#if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \ 26 defined(_KERNEL) 27# include "opt_ipfilter_log.h" 28#endif 29#if !defined(_KERNEL) && !defined(KERNEL) 30# include <stdio.h> 31# include <string.h> 32# include <stdlib.h> 33#endif 34#if (defined(KERNEL) || defined(_KERNEL)) && (__FreeBSD_version >= 220000) 35# include <sys/filio.h> 36# include <sys/fcntl.h> 37#else 38# include <sys/ioctl.h> 39#endif 40#include <sys/fcntl.h> 41#include <sys/uio.h> 42#ifndef linux 43# include <sys/protosw.h> 44#endif 45#include <sys/socket.h> 46#if defined(_KERNEL) && !defined(linux) 47# include <sys/systm.h> 48#endif 49#if !defined(__SVR4) && !defined(__svr4__) 50# ifndef linux 51# include <sys/mbuf.h> 52# endif 53#else 54# include <sys/filio.h> 55# include <sys/byteorder.h> 56# ifdef _KERNEL 57# include <sys/dditypes.h> 58# endif 59# include <sys/stream.h> 60# include <sys/kmem.h> 61#endif 62#if __FreeBSD_version >= 300000 63# include <sys/queue.h> 64#endif 65#include <net/if.h> 66#if __FreeBSD_version >= 300000 67# include <net/if_var.h> 68# if defined(_KERNEL) && !defined(IPFILTER_LKM) 69# include "opt_ipfilter.h" 70# endif 71#endif 72#ifdef sun 73# include <net/af.h> 74#endif 75#include <net/route.h> 76#include <netinet/in.h> 77#include <netinet/in_systm.h> 78#include <netinet/ip.h> 79 80#ifdef __sgi 81# ifdef IFF_DRVRLOCK /* IRIX6 */ 82#include <sys/hashing.h> 83#include <netinet/in_var.h> 84# endif 85#endif 86 87#ifdef RFC1825 88# include <vpn/md5.h> 89# include <vpn/ipsec.h> 90extern struct ifnet vpnif; 91#endif 92 93#ifndef linux 94# include <netinet/ip_var.h> 95#endif 96#include <netinet/tcp.h> 97#include <netinet/udp.h> 98#include <netinet/ip_icmp.h> 99#include "netinet/ip_compat.h" 100#include <netinet/tcpip.h> 101#include "netinet/ip_fil.h" 102#include "netinet/ip_proxy.h" 103#include "netinet/ip_nat.h" 104#include "netinet/ip_frag.h" 105#include "netinet/ip_state.h" 106#if (__FreeBSD_version >= 300000) 107# include <sys/malloc.h> 108#endif 109#ifndef MIN 110# define MIN(a,b) (((a)<(b))?(a):(b)) 111#endif 112#undef SOCKADDR_IN 113#define SOCKADDR_IN struct sockaddr_in 114 115nat_t **nat_table[2] = { NULL, NULL }, 116 *nat_instances = NULL; 117ipnat_t *nat_list = NULL; 118u_int ipf_nattable_sz = NAT_TABLE_SZ; 119u_int ipf_natrules_sz = NAT_SIZE; 120u_int ipf_rdrrules_sz = RDR_SIZE; 121u_int ipf_hostmap_sz = HOSTMAP_SIZE; 122u_32_t nat_masks = 0; 123u_32_t rdr_masks = 0; 124ipnat_t **nat_rules = NULL; 125ipnat_t **rdr_rules = NULL; 126hostmap_t **maptable = NULL; 127 128u_long fr_defnatage = DEF_NAT_AGE, 129 fr_defnaticmpage = 6; /* 3 seconds */ 130natstat_t nat_stats; 131int fr_nat_lock = 0; 132#if (SOLARIS || defined(__sgi)) && defined(_KERNEL) 133extern kmutex_t ipf_rw; 134extern KRWLOCK_T ipf_nat; 135#endif 136 137static int nat_flushtable __P((void)); 138static int nat_clearlist __P((void)); 139static void nat_addnat __P((struct ipnat *)); 140static void nat_addrdr __P((struct ipnat *)); 141static void nat_delete __P((struct nat *)); 142static void nat_delrdr __P((struct ipnat *)); 143static void nat_delnat __P((struct ipnat *)); 144static int fr_natgetent __P((caddr_t)); 145static int fr_natgetsz __P((caddr_t)); 146static int fr_natputent __P((caddr_t)); 147static void nat_tabmove __P((nat_t *, u_32_t)); 148static int nat_match __P((fr_info_t *, ipnat_t *, ip_t *)); 149static hostmap_t *nat_hostmap __P((ipnat_t *, struct in_addr, 150 struct in_addr)); 151static void nat_hostmapdel __P((struct hostmap *)); 152 153 154int nat_init() 155{ 156 KMALLOCS(nat_table[0], nat_t **, sizeof(nat_t *) * ipf_nattable_sz); 157 if (nat_table[0] != NULL) 158 bzero((char *)nat_table[0], ipf_nattable_sz * sizeof(nat_t *)); 159 else 160 return -1; 161 162 KMALLOCS(nat_table[1], nat_t **, sizeof(nat_t *) * ipf_nattable_sz); 163 if (nat_table[1] != NULL) 164 bzero((char *)nat_table[1], ipf_nattable_sz * sizeof(nat_t *)); 165 else 166 return -1; 167 168 KMALLOCS(nat_rules, ipnat_t **, sizeof(ipnat_t *) * ipf_natrules_sz); 169 if (nat_rules != NULL) 170 bzero((char *)nat_rules, ipf_natrules_sz * sizeof(ipnat_t *)); 171 else 172 return -1; 173 174 KMALLOCS(rdr_rules, ipnat_t **, sizeof(ipnat_t *) * ipf_rdrrules_sz); 175 if (rdr_rules != NULL) 176 bzero((char *)rdr_rules, ipf_rdrrules_sz * sizeof(ipnat_t *)); 177 else 178 return -1; 179 180 KMALLOCS(maptable, hostmap_t **, sizeof(hostmap_t *) * ipf_hostmap_sz); 181 if (maptable != NULL) 182 bzero((char *)maptable, sizeof(hostmap_t *) * ipf_hostmap_sz); 183 else 184 return -1; 185 return 0; 186} 187 188 189static void nat_addrdr(n) 190ipnat_t *n; 191{ 192 ipnat_t **np; 193 u_32_t j; 194 u_int hv; 195 int k; 196 197 k = countbits(n->in_outmsk); 198 if ((k >= 0) && (k != 32)) 199 rdr_masks |= 1 << k; 200 j = (n->in_outip & n->in_outmsk); 201 hv = NAT_HASH_FN(j, 0, ipf_rdrrules_sz); 202 np = rdr_rules + hv; 203 while (*np != NULL) 204 np = &(*np)->in_rnext; 205 n->in_rnext = NULL; 206 n->in_prnext = np; 207 *np = n; 208} 209 210 211static void nat_addnat(n) 212ipnat_t *n; 213{ 214 ipnat_t **np; 215 u_32_t j; 216 u_int hv; 217 int k; 218 219 k = countbits(n->in_inmsk); 220 if ((k >= 0) && (k != 32)) 221 nat_masks |= 1 << k; 222 j = (n->in_inip & n->in_inmsk); 223 hv = NAT_HASH_FN(j, 0, ipf_natrules_sz); 224 np = nat_rules + hv; 225 while (*np != NULL) 226 np = &(*np)->in_mnext; 227 n->in_mnext = NULL; 228 n->in_pmnext = np; 229 *np = n; 230} 231 232 233static void nat_delrdr(n) 234ipnat_t *n; 235{ 236 if (n->in_rnext) 237 n->in_rnext->in_prnext = n->in_prnext; 238 *n->in_prnext = n->in_rnext; 239} 240 241 242static void nat_delnat(n) 243ipnat_t *n; 244{ 245 if (n->in_mnext) 246 n->in_mnext->in_pmnext = n->in_pmnext; 247 *n->in_pmnext = n->in_mnext; 248} 249 250 251/* 252 * check if an ip address has already been allocated for a given mapping that 253 * is not doing port based translation. 254 * 255 * Must be called with ipf_nat held as a write lock. 256 */ 257static struct hostmap *nat_hostmap(np, real, map) 258ipnat_t *np; 259struct in_addr real; 260struct in_addr map; 261{ 262 hostmap_t *hm; 263 u_int hv; 264 265 hv = real.s_addr % HOSTMAP_SIZE; 266 for (hm = maptable[hv]; hm; hm = hm->hm_next) 267 if ((hm->hm_realip.s_addr == real.s_addr) && 268 (np == hm->hm_ipnat)) { 269 hm->hm_ref++; 270 return hm; 271 } 272 273 KMALLOC(hm, hostmap_t *); 274 if (hm) { 275 hm->hm_next = maptable[hv]; 276 hm->hm_pnext = maptable + hv; 277 if (maptable[hv]) 278 maptable[hv]->hm_pnext = &hm->hm_next; 279 maptable[hv] = hm; 280 hm->hm_ipnat = np; 281 hm->hm_realip = real; 282 hm->hm_mapip = map; 283 hm->hm_ref = 1; 284 } 285 return hm; 286} 287 288 289/* 290 * Must be called with ipf_nat held as a write lock. 291 */ 292static void nat_hostmapdel(hm) 293struct hostmap *hm; 294{ 295 ATOMIC_DEC32(hm->hm_ref); 296 if (hm->hm_ref == 0) { 297 if (hm->hm_next) 298 hm->hm_next->hm_pnext = hm->hm_pnext; 299 *hm->hm_pnext = hm->hm_next; 300 KFREE(hm); 301 } 302} 303 304 305void fix_outcksum(sp, n) 306u_short *sp; 307u_32_t n; 308{ 309 register u_short sumshort; 310 register u_32_t sum1; 311 312 if (!n) 313 return; 314#if SOLARIS2 >= 6 315 else if (n & NAT_HW_CKSUM) { 316 *sp = n & 0xffff; 317 return; 318 } 319#endif 320 sum1 = (~ntohs(*sp)) & 0xffff; 321 sum1 += (n); 322 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 323 /* Again */ 324 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 325 sumshort = ~(u_short)sum1; 326 *(sp) = htons(sumshort); 327} 328 329 330void fix_incksum(sp, n) 331u_short *sp; 332u_32_t n; 333{ 334 register u_short sumshort; 335 register u_32_t sum1; 336 337 if (!n) 338 return; 339#if SOLARIS2 >= 6 340 else if (n & NAT_HW_CKSUM) { 341 *sp = n & 0xffff; 342 return; 343 } 344#endif 345#ifdef sparc 346 sum1 = (~(*sp)) & 0xffff; 347#else 348 sum1 = (~ntohs(*sp)) & 0xffff; 349#endif 350 sum1 += ~(n) & 0xffff; 351 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 352 /* Again */ 353 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 354 sumshort = ~(u_short)sum1; 355 *(sp) = htons(sumshort); 356} 357 358 359/* 360 * fix_datacksum is used *only* for the adjustments of checksums in the data 361 * section of an IP packet. 362 * 363 * The only situation in which you need to do this is when NAT'ing an 364 * ICMP error message. Such a message, contains in its body the IP header 365 * of the original IP packet, that causes the error. 366 * 367 * You can't use fix_incksum or fix_outcksum in that case, because for the 368 * kernel the data section of the ICMP error is just data, and no special 369 * processing like hardware cksum or ntohs processing have been done by the 370 * kernel on the data section. 371 */ 372void fix_datacksum(sp, n) 373u_short *sp; 374u_32_t n; 375{ 376 register u_short sumshort; 377 register u_32_t sum1; 378 379 if (!n) 380 return; 381 382 sum1 = (~ntohs(*sp)) & 0xffff; 383 sum1 += (n); 384 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 385 /* Again */ 386 sum1 = (sum1 >> 16) + (sum1 & 0xffff); 387 sumshort = ~(u_short)sum1; 388 *(sp) = htons(sumshort); 389} 390 391/* 392 * How the NAT is organised and works. 393 * 394 * Inside (interface y) NAT Outside (interface x) 395 * -------------------- -+- ------------------------------------- 396 * Packet going | out, processsed by ip_natout() for x 397 * ------------> | ------------> 398 * src=10.1.1.1 | src=192.1.1.1 399 * | 400 * | in, processed by ip_natin() for x 401 * <------------ | <------------ 402 * dst=10.1.1.1 | dst=192.1.1.1 403 * -------------------- -+- ------------------------------------- 404 * ip_natout() - changes ip_src and if required, sport 405 * - creates a new mapping, if required. 406 * ip_natin() - changes ip_dst and if required, dport 407 * 408 * In the NAT table, internal source is recorded as "in" and externally 409 * seen as "out". 410 */ 411 412/* 413 * Handle ioctls which manipulate the NAT. 414 */ 415int nat_ioctl(data, cmd, mode) 416#if defined(__NetBSD__) || defined(__OpenBSD__) || (__FreeBSD_version >= 300003) 417u_long cmd; 418#else 419int cmd; 420#endif 421caddr_t data; 422int mode; 423{ 424 register ipnat_t *nat, *nt, *n = NULL, **np = NULL; 425 int error = 0, ret, arg; 426 ipnat_t natd; 427 u_32_t i, j; 428 429#if (BSD >= 199306) && defined(_KERNEL) 430 if ((securelevel >= 2) && (mode & FWRITE)) 431 return EPERM; 432#endif 433 434 nat = NULL; /* XXX gcc -Wuninitialized */ 435 KMALLOC(nt, ipnat_t *); 436 if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT)) 437 error = IRCOPYPTR(data, (char *)&natd, sizeof(natd)); 438 else if (cmd == SIOCIPFFL) { /* SIOCFLNAT & SIOCCNATL */ 439 error = IRCOPY(data, (char *)&arg, sizeof(arg)); 440 if (error) 441 error = EFAULT; 442 } 443 444 if (error) 445 goto done; 446 447 /* 448 * For add/delete, look to see if the NAT entry is already present 449 */ 450 WRITE_ENTER(&ipf_nat); 451 if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT)) { 452 nat = &natd; 453 nat->in_flags &= IPN_USERFLAGS; 454 if ((nat->in_redir & NAT_MAPBLK) == 0) { 455 if ((nat->in_flags & IPN_SPLIT) == 0) 456 nat->in_inip &= nat->in_inmsk; 457 if ((nat->in_flags & IPN_IPRANGE) == 0) 458 nat->in_outip &= nat->in_outmsk; 459 } 460 for (np = &nat_list; (n = *np); np = &n->in_next) 461 if (!bcmp((char *)&nat->in_flags, (char *)&n->in_flags, 462 IPN_CMPSIZ)) 463 break; 464 } 465 466 switch (cmd) 467 { 468#ifdef IPFILTER_LOG 469 case SIOCIPFFB : 470 { 471 int tmp; 472 473 if (!(mode & FWRITE)) 474 error = EPERM; 475 else { 476 tmp = ipflog_clear(IPL_LOGNAT); 477 IWCOPY((char *)&tmp, (char *)data, sizeof(tmp)); 478 } 479 break; 480 } 481#endif 482 case SIOCADNAT : 483 if (!(mode & FWRITE)) { 484 error = EPERM; 485 break; 486 } 487 if (n) { 488 error = EEXIST; 489 break; 490 } 491 if (nt == NULL) { 492 error = ENOMEM; 493 break; 494 } 495 n = nt; 496 nt = NULL; 497 bcopy((char *)nat, (char *)n, sizeof(*n)); 498 n->in_ifp = (void *)GETUNIT(n->in_ifname, 4); 499 if (!n->in_ifp) 500 n->in_ifp = (void *)-1; 501 if (n->in_plabel[0] != '\0') { 502 n->in_apr = appr_match(n->in_p, n->in_plabel); 503 if (!n->in_apr) { 504 error = ENOENT; 505 break; 506 } 507 } 508 n->in_next = NULL; 509 *np = n; 510 511 if (n->in_redir & NAT_REDIRECT) { 512 n->in_flags &= ~IPN_NOTDST; 513 nat_addrdr(n); 514 } 515 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) { 516 n->in_flags &= ~IPN_NOTSRC; 517 nat_addnat(n); 518 } 519 520 n->in_use = 0; 521 if (n->in_redir & NAT_MAPBLK) 522 n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk); 523 else if (n->in_flags & IPN_AUTOPORTMAP) 524 n->in_space = USABLE_PORTS * ~ntohl(n->in_inmsk); 525 else if (n->in_flags & IPN_IPRANGE) 526 n->in_space = ntohl(n->in_outmsk) - ntohl(n->in_outip); 527 else if (n->in_flags & IPN_SPLIT) 528 n->in_space = 2; 529 else 530 n->in_space = ~ntohl(n->in_outmsk); 531 /* 532 * Calculate the number of valid IP addresses in the output 533 * mapping range. In all cases, the range is inclusive of 534 * the start and ending IP addresses. 535 * If to a CIDR address, lose 2: broadcast + network address 536 * (so subtract 1) 537 * If to a range, add one. 538 * If to a single IP address, set to 1. 539 */ 540 if (n->in_space) { 541 if ((n->in_flags & IPN_IPRANGE) != 0) 542 n->in_space += 1; 543 else 544 n->in_space -= 1; 545 } else 546 n->in_space = 1; 547 if ((n->in_outmsk != 0xffffffff) && (n->in_outmsk != 0) && 548 ((n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0)) 549 n->in_nip = ntohl(n->in_outip) + 1; 550 else if ((n->in_flags & IPN_SPLIT) && 551 (n->in_redir & NAT_REDIRECT)) 552 n->in_nip = ntohl(n->in_inip); 553 else 554 n->in_nip = ntohl(n->in_outip); 555 if (n->in_redir & NAT_MAP) { 556 n->in_pnext = ntohs(n->in_pmin); 557 /* 558 * Multiply by the number of ports made available. 559 */ 560 if (ntohs(n->in_pmax) >= ntohs(n->in_pmin)) { 561 n->in_space *= (ntohs(n->in_pmax) - 562 ntohs(n->in_pmin) + 1); 563 /* 564 * Because two different sources can map to 565 * different destinations but use the same 566 * local IP#/port #. 567 * If the result is smaller than in_space, then 568 * we may have wrapped around 32bits. 569 */ 570 i = n->in_inmsk; 571 if ((i != 0) && (i != 0xffffffff)) { 572 j = n->in_space * (~ntohl(i) + 1); 573 if (j >= n->in_space) 574 n->in_space = j; 575 else 576 n->in_space = 0xffffffff; 577 } 578 } 579 /* 580 * If no protocol is specified, multiple by 256. 581 */ 582 if ((n->in_flags & IPN_TCPUDP) == 0) { 583 j = n->in_space * 256; 584 if (j >= n->in_space) 585 n->in_space = j; 586 else 587 n->in_space = 0xffffffff; 588 } 589 } 590 /* Otherwise, these fields are preset */ 591 n = NULL; 592 nat_stats.ns_rules++; 593 break; 594 case SIOCRMNAT : 595 if (!(mode & FWRITE)) { 596 error = EPERM; 597 n = NULL; 598 break; 599 } 600 if (!n) { 601 error = ESRCH; 602 break; 603 } 604 if (n->in_redir & NAT_REDIRECT) 605 nat_delrdr(n); 606 if (n->in_redir & (NAT_MAPBLK|NAT_MAP)) 607 nat_delnat(n); 608 if (nat_list == NULL) { 609 nat_masks = 0; 610 rdr_masks = 0; 611 } 612 *np = n->in_next; 613 if (!n->in_use) { 614 if (n->in_apr) 615 appr_free(n->in_apr); 616 KFREE(n); 617 nat_stats.ns_rules--; 618 } else { 619 n->in_flags |= IPN_DELETE; 620 n->in_next = NULL; 621 } 622 n = NULL; 623 break; 624 case SIOCGNATS : 625 MUTEX_DOWNGRADE(&ipf_nat); 626 nat_stats.ns_table[0] = nat_table[0]; 627 nat_stats.ns_table[1] = nat_table[1]; 628 nat_stats.ns_list = nat_list; 629 nat_stats.ns_nattab_sz = ipf_nattable_sz; 630 nat_stats.ns_rultab_sz = ipf_natrules_sz; 631 nat_stats.ns_rdrtab_sz = ipf_rdrrules_sz; 632 nat_stats.ns_instances = nat_instances; 633 nat_stats.ns_apslist = ap_sess_list; 634 error = IWCOPYPTR((char *)&nat_stats, (char *)data, 635 sizeof(nat_stats)); 636 break; 637 case SIOCGNATL : 638 { 639 natlookup_t nl; 640 641 MUTEX_DOWNGRADE(&ipf_nat); 642 error = IRCOPYPTR((char *)data, (char *)&nl, sizeof(nl)); 643 if (error) 644 break; 645 646 if (nat_lookupredir(&nl)) { 647 error = IWCOPYPTR((char *)&nl, (char *)data, 648 sizeof(nl)); 649 } else 650 error = ESRCH; 651 break; 652 } 653 case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */ 654 if (!(mode & FWRITE)) { 655 error = EPERM; 656 break; 657 } 658 error = 0; 659 if (arg == 0) 660 ret = nat_flushtable(); 661 else if (arg == 1) 662 ret = nat_clearlist(); 663 else 664 error = EINVAL; 665 MUTEX_DOWNGRADE(&ipf_nat); 666 if (!error) { 667 error = IWCOPY((caddr_t)&ret, data, sizeof(ret)); 668 if (error) 669 error = EFAULT; 670 } 671 break; 672 case SIOCSTLCK : 673 error = IRCOPY(data, (caddr_t)&arg, sizeof(arg)); 674 if (!error) { 675 error = IWCOPY((caddr_t)&fr_nat_lock, data, 676 sizeof(fr_nat_lock)); 677 if (!error) 678 fr_nat_lock = arg; 679 } else 680 error = EFAULT; 681 break; 682 case SIOCSTPUT : 683 if (fr_nat_lock) 684 error = fr_natputent(data); 685 else 686 error = EACCES; 687 break; 688 case SIOCSTGSZ : 689 if (fr_nat_lock) 690 error = fr_natgetsz(data); 691 else 692 error = EACCES; 693 break; 694 case SIOCSTGET : 695 if (fr_nat_lock) 696 error = fr_natgetent(data); 697 else 698 error = EACCES; 699 break; 700 case FIONREAD : 701#ifdef IPFILTER_LOG 702 arg = (int)iplused[IPL_LOGNAT]; 703 MUTEX_DOWNGRADE(&ipf_nat); 704 error = IWCOPY((caddr_t)&arg, (caddr_t)data, sizeof(arg)); 705 if (error) 706 error = EFAULT; 707#endif 708 break; 709 default : 710 error = EINVAL; 711 break; 712 } 713 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */ 714done: 715 if (nt) 716 KFREE(nt); 717 return error; 718} 719 720 721static int fr_natgetsz(data) 722caddr_t data; 723{ 724 ap_session_t *aps; 725 nat_t *nat, *n; 726 int error = 0; 727 natget_t ng; 728 729 error = IRCOPY(data, (caddr_t)&ng, sizeof(ng)); 730 if (error) 731 return EFAULT; 732 733 nat = ng.ng_ptr; 734 if (!nat) { 735 nat = nat_instances; 736 ng.ng_sz = 0; 737 if (nat == NULL) { 738 error = IWCOPY((caddr_t)&ng, data, sizeof(ng)); 739 if (error) 740 error = EFAULT; 741 return error; 742 } 743 } else { 744 /* 745 * Make sure the pointer we're copying from exists in the 746 * current list of entries. Security precaution to prevent 747 * copying of random kernel data. 748 */ 749 for (n = nat_instances; n; n = n->nat_next) 750 if (n == nat) 751 break; 752 if (!n) 753 return ESRCH; 754 } 755 756 ng.ng_sz = sizeof(nat_save_t); 757 aps = nat->nat_aps; 758 if ((aps != NULL) && (aps->aps_data != 0)) { 759 ng.ng_sz += sizeof(ap_session_t); 760 ng.ng_sz += aps->aps_psiz; 761 } 762 763 error = IWCOPY((caddr_t)&ng, data, sizeof(ng)); 764 if (error) 765 error = EFAULT; 766 return error; 767} 768 769 770static int fr_natgetent(data) 771caddr_t data; 772{ 773 nat_save_t ipn, *ipnp, *ipnn = NULL; 774 register nat_t *n, *nat; 775 ap_session_t *aps; 776 int error; 777 778 error = IRCOPY(data, (caddr_t)&ipnp, sizeof(ipnp)); 779 if (error) 780 return EFAULT; 781 error = IRCOPY((caddr_t)ipnp, (caddr_t)&ipn, sizeof(ipn)); 782 if (error) 783 return EFAULT; 784 785 nat = ipn.ipn_next; 786 if (!nat) { 787 nat = nat_instances; 788 if (nat == NULL) { 789 if (nat_instances == NULL) 790 return ENOENT; 791 return 0; 792 } 793 } else { 794 /* 795 * Make sure the pointer we're copying from exists in the 796 * current list of entries. Security precaution to prevent 797 * copying of random kernel data. 798 */ 799 for (n = nat_instances; n; n = n->nat_next) 800 if (n == nat) 801 break; 802 if (!n) 803 return ESRCH; 804 } 805 806 ipn.ipn_next = nat->nat_next; 807 ipn.ipn_dsize = 0; 808 bcopy((char *)nat, (char *)&ipn.ipn_nat, sizeof(ipn.ipn_nat)); 809 ipn.ipn_nat.nat_data = NULL; 810 811 if (nat->nat_ptr) { 812 bcopy((char *)nat->nat_ptr, (char *)&ipn.ipn_ipnat, 813 sizeof(ipn.ipn_ipnat)); 814 } 815 816 if (nat->nat_fr) 817 bcopy((char *)nat->nat_fr, (char *)&ipn.ipn_rule, 818 sizeof(ipn.ipn_rule)); 819 820 if ((aps = nat->nat_aps)) { 821 ipn.ipn_dsize = sizeof(*aps); 822 if (aps->aps_data) 823 ipn.ipn_dsize += aps->aps_psiz; 824 KMALLOCS(ipnn, nat_save_t *, sizeof(*ipnn) + ipn.ipn_dsize); 825 if (ipnn == NULL) 826 return ENOMEM; 827 bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn)); 828 829 bcopy((char *)aps, ipnn->ipn_data, sizeof(*aps)); 830 if (aps->aps_data) { 831 bcopy(aps->aps_data, ipnn->ipn_data + sizeof(*aps), 832 aps->aps_psiz); 833 ipnn->ipn_dsize += aps->aps_psiz; 834 } 835 error = IWCOPY((caddr_t)ipnn, ipnp, 836 sizeof(ipn) + ipn.ipn_dsize); 837 if (error) 838 error = EFAULT; 839 KFREES(ipnn, sizeof(*ipnn) + ipn.ipn_dsize); 840 } else { 841 error = IWCOPY((caddr_t)&ipn, ipnp, sizeof(ipn)); 842 if (error) 843 error = EFAULT; 844 } 845 return error; 846} 847 848 849static int fr_natputent(data) 850caddr_t data; 851{ 852 nat_save_t ipn, *ipnp, *ipnn = NULL; 853 register nat_t *n, *nat; 854 ap_session_t *aps; 855 frentry_t *fr; 856 ipnat_t *in; 857 858 int error; 859 860 error = IRCOPY(data, (caddr_t)&ipnp, sizeof(ipnp)); 861 if (error) 862 return EFAULT; 863 error = IRCOPY((caddr_t)ipnp, (caddr_t)&ipn, sizeof(ipn)); 864 if (error) 865 return EFAULT; 866 nat = NULL; 867 if (ipn.ipn_dsize) { 868 KMALLOCS(ipnn, nat_save_t *, sizeof(ipn) + ipn.ipn_dsize); 869 if (ipnn == NULL) 870 return ENOMEM; 871 bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn)); 872 error = IRCOPY((caddr_t)ipnp, (caddr_t)ipn.ipn_data, 873 ipn.ipn_dsize); 874 if (error) { 875 error = EFAULT; 876 goto junkput; 877 } 878 } else 879 ipnn = NULL; 880 881 KMALLOC(nat, nat_t *); 882 if (nat == NULL) { 883 error = EFAULT; 884 goto junkput; 885 } 886 887 bcopy((char *)&ipn.ipn_nat, (char *)nat, sizeof(*nat)); 888 /* 889 * Initialize all these so that nat_delete() doesn't cause a crash. 890 */ 891 nat->nat_phnext[0] = NULL; 892 nat->nat_phnext[1] = NULL; 893 fr = nat->nat_fr; 894 nat->nat_fr = NULL; 895 aps = nat->nat_aps; 896 nat->nat_aps = NULL; 897 in = nat->nat_ptr; 898 nat->nat_ptr = NULL; 899 nat->nat_data = NULL; 900 901 /* 902 * Restore the rule associated with this nat session 903 */ 904 if (in) { 905 KMALLOC(in, ipnat_t *); 906 if (in == NULL) { 907 error = ENOMEM; 908 goto junkput; 909 } 910 nat->nat_ptr = in; 911 bcopy((char *)&ipn.ipn_ipnat, (char *)in, sizeof(*in)); 912 in->in_use = 1; 913 in->in_flags |= IPN_DELETE; 914 in->in_next = NULL; 915 in->in_rnext = NULL; 916 in->in_prnext = NULL; 917 in->in_mnext = NULL; 918 in->in_pmnext = NULL; 919 in->in_ifp = GETUNIT(in->in_ifname, 4); 920 if (in->in_plabel[0] != '\0') { 921 in->in_apr = appr_match(in->in_p, in->in_plabel); 922 } 923 } 924 925 /* 926 * Restore ap_session_t structure. Include the private data allocated 927 * if it was there. 928 */ 929 if (aps) { 930 KMALLOC(aps, ap_session_t *); 931 if (aps == NULL) { 932 error = ENOMEM; 933 goto junkput; 934 } 935 nat->nat_aps = aps; 936 aps->aps_next = ap_sess_list; 937 ap_sess_list = aps; 938 bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps)); 939 if (in) 940 aps->aps_apr = in->in_apr; 941 if (aps->aps_psiz) { 942 KMALLOCS(aps->aps_data, void *, aps->aps_psiz); 943 if (aps->aps_data == NULL) { 944 error = ENOMEM; 945 goto junkput; 946 } 947 bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data, 948 aps->aps_psiz); 949 } else { 950 aps->aps_psiz = 0; 951 aps->aps_data = NULL; 952 } 953 } 954 955 /* 956 * If there was a filtering rule associated with this entry then 957 * build up a new one. 958 */ 959 if (fr != NULL) { 960 if (nat->nat_flags & FI_NEWFR) { 961 KMALLOC(fr, frentry_t *); 962 nat->nat_fr = fr; 963 if (fr == NULL) { 964 error = ENOMEM; 965 goto junkput; 966 } 967 bcopy((char *)&ipn.ipn_fr, (char *)fr, sizeof(*fr)); 968 ipn.ipn_nat.nat_fr = fr; 969 error = IWCOPY((caddr_t)&ipn, ipnp, sizeof(ipn)); 970 if (error) { 971 error = EFAULT; 972 goto junkput; 973 } 974 } else { 975 for (n = nat_instances; n; n = n->nat_next) 976 if (n->nat_fr == fr) 977 break; 978 if (!n) { 979 error = ESRCH; 980 goto junkput; 981 } 982 } 983 } 984 985 if (ipnn) 986 KFREES(ipnn, sizeof(ipn) + ipn.ipn_dsize); 987 nat_insert(nat); 988 return 0; 989junkput: 990 if (ipnn) 991 KFREES(ipnn, sizeof(ipn) + ipn.ipn_dsize); 992 if (nat) 993 nat_delete(nat); 994 return error; 995} 996 997 998/* 999 * Delete a nat entry from the various lists and table. 1000 */ 1001static void nat_delete(natd) 1002struct nat *natd; 1003{ 1004 struct ipnat *ipn; 1005 1006 if (natd->nat_flags & FI_WILDP) 1007 nat_stats.ns_wilds--; 1008 if (natd->nat_hnext[0]) 1009 natd->nat_hnext[0]->nat_phnext[0] = natd->nat_phnext[0]; 1010 *natd->nat_phnext[0] = natd->nat_hnext[0]; 1011 if (natd->nat_hnext[1]) 1012 natd->nat_hnext[1]->nat_phnext[1] = natd->nat_phnext[1]; 1013 *natd->nat_phnext[1] = natd->nat_hnext[1]; 1014 1015 if (natd->nat_fr != NULL) { 1016 ATOMIC_DEC32(natd->nat_fr->fr_ref); 1017 } 1018 1019 if (natd->nat_hm != NULL) 1020 nat_hostmapdel(natd->nat_hm); 1021 1022 /* 1023 * If there is an active reference from the nat entry to its parent 1024 * rule, decrement the rule's reference count and free it too if no 1025 * longer being used. 1026 */ 1027 ipn = natd->nat_ptr; 1028 if (ipn != NULL) { 1029 ipn->in_space++; 1030 ipn->in_use--; 1031 if (!ipn->in_use && (ipn->in_flags & IPN_DELETE)) { 1032 if (ipn->in_apr) 1033 appr_free(ipn->in_apr); 1034 KFREE(ipn); 1035 nat_stats.ns_rules--; 1036 } 1037 } 1038 1039 MUTEX_DESTROY(&natd->nat_lock); 1040 /* 1041 * If there's a fragment table entry too for this nat entry, then 1042 * dereference that as well. 1043 */ 1044 ipfr_forget((void *)natd); 1045 aps_free(natd->nat_aps); 1046 nat_stats.ns_inuse--; 1047 KFREE(natd); 1048} 1049 1050 1051/* 1052 * nat_flushtable - clear the NAT table of all mapping entries. 1053 */ 1054static int nat_flushtable() 1055{ 1056 register nat_t *nat, **natp; 1057 register int j = 0; 1058 1059 /* 1060 * ALL NAT mappings deleted, so lets just make the deletions 1061 * quicker. 1062 */ 1063 if (nat_table[0] != NULL) 1064 bzero((char *)nat_table[0], 1065 sizeof(nat_table[0]) * ipf_nattable_sz); 1066 if (nat_table[1] != NULL) 1067 bzero((char *)nat_table[1], 1068 sizeof(nat_table[1]) * ipf_nattable_sz); 1069 1070 for (natp = &nat_instances; (nat = *natp); ) { 1071 *natp = nat->nat_next; 1072#ifdef IPFILTER_LOG 1073 nat_log(nat, NL_FLUSH); 1074#endif 1075 nat_delete(nat); 1076 j++; 1077 } 1078 nat_stats.ns_inuse = 0; 1079 return j; 1080} 1081 1082 1083/* 1084 * nat_clearlist - delete all rules in the active NAT mapping list. 1085 */ 1086static int nat_clearlist() 1087{ 1088 register ipnat_t *n, **np = &nat_list; 1089 int i = 0; 1090 1091 if (nat_rules != NULL) 1092 bzero((char *)nat_rules, sizeof(*nat_rules) * ipf_natrules_sz); 1093 if (rdr_rules != NULL) 1094 bzero((char *)rdr_rules, sizeof(*rdr_rules) * ipf_rdrrules_sz); 1095 1096 while ((n = *np)) { 1097 *np = n->in_next; 1098 if (!n->in_use) { 1099 if (n->in_apr) 1100 appr_free(n->in_apr); 1101 KFREE(n); 1102 nat_stats.ns_rules--; 1103 } else { 1104 n->in_flags |= IPN_DELETE; 1105 n->in_next = NULL; 1106 } 1107 i++; 1108 } 1109 nat_masks = 0; 1110 rdr_masks = 0; 1111 return i; 1112} 1113 1114 1115/* 1116 * Create a new NAT table entry. 1117 * NOTE: assumes write lock on ipf_nat has been obtained already. 1118 */ 1119nat_t *nat_new(np, ip, fin, flags, direction) 1120ipnat_t *np; 1121ip_t *ip; 1122fr_info_t *fin; 1123u_int flags; 1124int direction; 1125{ 1126 register u_32_t sum1, sum2, sumd, l; 1127 u_short port = 0, sport = 0, dport = 0, nport = 0; 1128 struct in_addr in, inb; 1129 tcphdr_t *tcp = NULL; 1130 hostmap_t *hm = NULL; 1131 nat_t *nat, *natl; 1132 u_short nflags; 1133#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) 1134 qif_t *qf = fin->fin_qif; 1135#endif 1136 1137 nflags = flags & np->in_flags; 1138 if (flags & IPN_TCPUDP) { 1139 tcp = (tcphdr_t *)fin->fin_dp; 1140 sport = tcp->th_sport; 1141 dport = tcp->th_dport; 1142 } 1143 1144 /* Give me a new nat */ 1145 KMALLOC(nat, nat_t *); 1146 if (nat == NULL) { 1147 nat_stats.ns_memfail++; 1148 return NULL; 1149 } 1150 1151 bzero((char *)nat, sizeof(*nat)); 1152 nat->nat_flags = flags; 1153 if (flags & FI_WILDP) 1154 nat_stats.ns_wilds++; 1155 /* 1156 * Search the current table for a match. 1157 */ 1158 if (direction == NAT_OUTBOUND) { 1159 /* 1160 * Values at which the search for a free resouce starts. 1161 */ 1162 u_32_t st_ip; 1163 u_short st_port; 1164 1165 /* 1166 * If it's an outbound packet which doesn't match any existing 1167 * record, then create a new port 1168 */ 1169 l = 0; 1170 st_ip = np->in_nip; 1171 st_port = np->in_pnext; 1172 1173 do { 1174 port = 0; 1175 in.s_addr = htonl(np->in_nip); 1176 if (l == 0) { 1177 /* 1178 * Check to see if there is an existing NAT 1179 * setup for this IP address pair. 1180 */ 1181 hm = nat_hostmap(np, ip->ip_src, in); 1182 if (hm != NULL) 1183 in.s_addr = hm->hm_mapip.s_addr; 1184 } else if ((l == 1) && (hm != NULL)) { 1185 nat_hostmapdel(hm); 1186 hm = NULL; 1187 } 1188 in.s_addr = ntohl(in.s_addr); 1189 1190 nat->nat_hm = hm; 1191 1192 if ((np->in_outmsk == 0xffffffff) && 1193 (np->in_pnext == 0)) { 1194 if (l > 0) 1195 goto badnat; 1196 } 1197 1198 if (np->in_redir & NAT_MAPBLK) { 1199 if ((l >= np->in_ppip) || ((l > 0) && 1200 !(flags & IPN_TCPUDP))) 1201 goto badnat; 1202 /* 1203 * map-block - Calculate destination address. 1204 */ 1205 in.s_addr = ntohl(ip->ip_src.s_addr); 1206 in.s_addr &= ntohl(~np->in_inmsk); 1207 inb.s_addr = in.s_addr; 1208 in.s_addr /= np->in_ippip; 1209 in.s_addr &= ntohl(~np->in_outmsk); 1210 in.s_addr += ntohl(np->in_outip); 1211 /* 1212 * Calculate destination port. 1213 */ 1214 if ((flags & IPN_TCPUDP) && 1215 (np->in_ppip != 0)) { 1216 port = ntohs(sport) + l; 1217 port %= np->in_ppip; 1218 port += np->in_ppip * 1219 (inb.s_addr % np->in_ippip); 1220 port += MAPBLK_MINPORT; 1221 port = htons(port); 1222 } 1223 } else if (!np->in_outip && 1224 (np->in_outmsk == 0xffffffff)) { 1225 /* 1226 * 0/32 - use the interface's IP address. 1227 */ 1228 if ((l > 0) || 1229 fr_ifpaddr(4, fin->fin_ifp, &in) == -1) 1230 goto badnat; 1231 in.s_addr = ntohl(in.s_addr); 1232 } else if (!np->in_outip && !np->in_outmsk) { 1233 /* 1234 * 0/0 - use the original source address/port. 1235 */ 1236 if (l > 0) 1237 goto badnat; 1238 in.s_addr = ntohl(ip->ip_src.s_addr); 1239 } else if ((np->in_outmsk != 0xffffffff) && 1240 (np->in_pnext == 0) && 1241 ((l > 0) || (hm == NULL))) 1242 np->in_nip++; 1243 natl = NULL; 1244 1245 if ((nflags & IPN_TCPUDP) && 1246 ((np->in_redir & NAT_MAPBLK) == 0) && 1247 (np->in_flags & IPN_AUTOPORTMAP)) { 1248 if ((l > 0) && (l % np->in_ppip == 0)) { 1249 if (l > np->in_space) { 1250 goto badnat; 1251 } else if ((l > np->in_ppip) && 1252 np->in_outmsk != 0xffffffff) 1253 np->in_nip++; 1254 } 1255 if (np->in_ppip != 0) { 1256 port = ntohs(sport); 1257 port += (l % np->in_ppip); 1258 port %= np->in_ppip; 1259 port += np->in_ppip * 1260 (ntohl(ip->ip_src.s_addr) % 1261 np->in_ippip); 1262 port += MAPBLK_MINPORT; 1263 port = htons(port); 1264 } 1265 } else if (((np->in_redir & NAT_MAPBLK) == 0) && 1266 (nflags & IPN_TCPUDP) && 1267 (np->in_pnext != 0)) { 1268 port = htons(np->in_pnext++); 1269 if (np->in_pnext > ntohs(np->in_pmax)) { 1270 np->in_pnext = ntohs(np->in_pmin); 1271 if (np->in_outmsk != 0xffffffff) 1272 np->in_nip++; 1273 } 1274 } 1275 1276 if (np->in_flags & IPN_IPRANGE) { 1277 if (np->in_nip > ntohl(np->in_outmsk)) 1278 np->in_nip = ntohl(np->in_outip); 1279 } else { 1280 if ((np->in_outmsk != 0xffffffff) && 1281 ((np->in_nip + 1) & ntohl(np->in_outmsk)) > 1282 ntohl(np->in_outip)) 1283 np->in_nip = ntohl(np->in_outip) + 1; 1284 } 1285 1286 if (!port && (flags & IPN_TCPUDP)) 1287 port = sport; 1288 1289 /* 1290 * Here we do a lookup of the connection as seen from 1291 * the outside. If an IP# pair already exists, try 1292 * again. So if you have A->B becomes C->B, you can 1293 * also have D->E become C->E but not D->B causing 1294 * another C->B. Also take protocol and ports into 1295 * account when determining whether a pre-existing 1296 * NAT setup will cause an external conflict where 1297 * this is appropriate. 1298 */ 1299 inb.s_addr = htonl(in.s_addr); 1300 natl = nat_inlookup(fin->fin_ifp, flags & ~FI_WILDP, 1301 (u_int)ip->ip_p, ip->ip_dst, inb, 1302 (port << 16) | dport, 1); 1303 1304 /* 1305 * Has the search wrapped around and come back to the 1306 * start ? 1307 */ 1308 if ((natl != NULL) && 1309 (np->in_pnext != 0) && (st_port == np->in_pnext) && 1310 (np->in_nip != 0) && (st_ip == np->in_nip)) 1311 goto badnat; 1312 l++; 1313 } while (natl != NULL); 1314 1315 if (np->in_space > 0) 1316 np->in_space--; 1317 1318 /* Setup the NAT table */ 1319 nat->nat_inip = ip->ip_src; 1320 nat->nat_outip.s_addr = htonl(in.s_addr); 1321 nat->nat_oip = ip->ip_dst; 1322 if (nat->nat_hm == NULL) 1323 nat->nat_hm = nat_hostmap(np, ip->ip_src, 1324 nat->nat_outip); 1325 1326 sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr)) + ntohs(sport); 1327 sum2 = LONG_SUM(in.s_addr) + ntohs(port); 1328 1329 if (flags & IPN_TCPUDP) { 1330 nat->nat_inport = sport; 1331 nat->nat_outport = port; /* sport */ 1332 nat->nat_oport = dport; 1333 } 1334 } else { 1335 /* 1336 * Otherwise, it's an inbound packet. Most likely, we don't 1337 * want to rewrite source ports and source addresses. Instead, 1338 * we want to rewrite to a fixed internal address and fixed 1339 * internal port. 1340 */ 1341 if (np->in_flags & IPN_SPLIT) { 1342 in.s_addr = np->in_nip; 1343 if (np->in_inip == htonl(in.s_addr)) 1344 np->in_nip = ntohl(np->in_inmsk); 1345 else { 1346 np->in_nip = ntohl(np->in_inip); 1347 if (np->in_flags & IPN_ROUNDR) { 1348 nat_delrdr(np); 1349 nat_addrdr(np); 1350 } 1351 } 1352 } else { 1353 in.s_addr = ntohl(np->in_inip); 1354 if (np->in_flags & IPN_ROUNDR) { 1355 nat_delrdr(np); 1356 nat_addrdr(np); 1357 } 1358 } 1359 if (!np->in_pnext) 1360 nport = dport; 1361 else { 1362 /* 1363 * Whilst not optimized for the case where 1364 * pmin == pmax, the gain is not significant. 1365 */ 1366 nport = ntohs(dport) - ntohs(np->in_pmin) + 1367 ntohs(np->in_pnext); 1368 nport = htons(nport); 1369 } 1370 1371 /* 1372 * When the redirect-to address is set to 0.0.0.0, just 1373 * assume a blank `forwarding' of the packet. We don't 1374 * setup any translation for this either. 1375 */ 1376 if (in.s_addr == 0) { 1377 if (nport == dport) 1378 goto badnat; 1379 in.s_addr = ntohl(ip->ip_dst.s_addr); 1380 } 1381 1382 nat->nat_inip.s_addr = htonl(in.s_addr); 1383 nat->nat_outip = ip->ip_dst; 1384 nat->nat_oip = ip->ip_src; 1385 1386 sum1 = LONG_SUM(ntohl(ip->ip_dst.s_addr)) + ntohs(dport); 1387 sum2 = LONG_SUM(in.s_addr) + ntohs(nport); 1388 1389 if (flags & IPN_TCPUDP) { 1390 nat->nat_inport = nport; 1391 nat->nat_outport = dport; 1392 nat->nat_oport = sport; 1393 } 1394 } 1395 1396 CALC_SUMD(sum1, sum2, sumd); 1397 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 1398#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) 1399 if ((flags == IPN_TCP) && dohwcksum && 1400 (qf->qf_ill->ill_ick.ick_magic == ICK_M_CTL_MAGIC)) { 1401 if (direction == NAT_OUTBOUND) 1402 sum1 = LONG_SUM(ntohl(in.s_addr)); 1403 else 1404 sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr)); 1405 sum1 += LONG_SUM(ntohl(ip->ip_dst.s_addr)); 1406 sum1 += 30; 1407 sum1 = (sum1 & 0xffff) + (sum1 >> 16); 1408 nat->nat_sumd[1] = NAT_HW_CKSUM|(sum1 & 0xffff); 1409 } else 1410#endif 1411 nat->nat_sumd[1] = nat->nat_sumd[0]; 1412 1413 if ((flags & IPN_TCPUDP) && ((sport != port) || (dport != nport))) { 1414 if (direction == NAT_OUTBOUND) 1415 sum1 = LONG_SUM(ntohl(ip->ip_src.s_addr)); 1416 else 1417 sum1 = LONG_SUM(ntohl(ip->ip_dst.s_addr)); 1418 1419 sum2 = LONG_SUM(in.s_addr); 1420 1421 CALC_SUMD(sum1, sum2, sumd); 1422 nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16); 1423 } else 1424 nat->nat_ipsumd = nat->nat_sumd[0]; 1425 1426 in.s_addr = htonl(in.s_addr); 1427 1428#ifdef _KERNEL 1429 strncpy(nat->nat_ifname, IFNAME(fin->fin_ifp), IFNAMSIZ); 1430#endif 1431 nat_insert(nat); 1432 1433 nat->nat_dir = direction; 1434 nat->nat_ifp = fin->fin_ifp; 1435 nat->nat_ptr = np; 1436 nat->nat_p = ip->ip_p; 1437 nat->nat_bytes = 0; 1438 nat->nat_pkts = 0; 1439 nat->nat_fr = fin->fin_fr; 1440 if (nat->nat_fr != NULL) { 1441 ATOMIC_INC32(nat->nat_fr->fr_ref); 1442 } 1443 if (direction == NAT_OUTBOUND) { 1444 if (flags & IPN_TCPUDP) 1445 tcp->th_sport = port; 1446 } else { 1447 if (flags & IPN_TCPUDP) 1448 tcp->th_dport = nport; 1449 } 1450 np->in_use++; 1451#ifdef IPFILTER_LOG 1452 nat_log(nat, (u_int)np->in_redir); 1453#endif 1454 return nat; 1455badnat: 1456 nat_stats.ns_badnat++; 1457 if ((hm = nat->nat_hm) != NULL) 1458 nat_hostmapdel(hm); 1459 KFREE(nat); 1460 return NULL; 1461} 1462 1463 1464void nat_insert(nat) 1465nat_t *nat; 1466{ 1467 nat_t **natp; 1468 u_int hv; 1469 1470 MUTEX_INIT(&nat->nat_lock, "nat entry lock", NULL); 1471 1472 nat->nat_age = fr_defnatage; 1473 nat->nat_ifname[sizeof(nat->nat_ifname) - 1] = '\0'; 1474 if (nat->nat_ifname[0] !='\0') { 1475 nat->nat_ifp = GETUNIT(nat->nat_ifname, 4); 1476 } 1477 1478 nat->nat_next = nat_instances; 1479 nat_instances = nat; 1480 1481 hv = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport, 1482 ipf_nattable_sz); 1483 natp = &nat_table[0][hv]; 1484 if (*natp) 1485 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 1486 nat->nat_phnext[0] = natp; 1487 nat->nat_hnext[0] = *natp; 1488 *natp = nat; 1489 1490 hv = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport, 1491 ipf_nattable_sz); 1492 natp = &nat_table[1][hv]; 1493 if (*natp) 1494 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 1495 nat->nat_phnext[1] = natp; 1496 nat->nat_hnext[1] = *natp; 1497 *natp = nat; 1498 1499 nat_stats.ns_added++; 1500 nat_stats.ns_inuse++; 1501} 1502 1503 1504nat_t *nat_icmplookup(ip, fin, dir) 1505ip_t *ip; 1506fr_info_t *fin; 1507int dir; 1508{ 1509 icmphdr_t *icmp; 1510 tcphdr_t *tcp = NULL; 1511 ip_t *oip; 1512 int flags = 0, type, minlen; 1513 1514 icmp = (icmphdr_t *)fin->fin_dp; 1515 /* 1516 * Does it at least have the return (basic) IP header ? 1517 * Only a basic IP header (no options) should be with an ICMP error 1518 * header. 1519 */ 1520 if ((ip->ip_hl != 5) || (ip->ip_len < ICMPERR_MINPKTLEN)) 1521 return NULL; 1522 type = icmp->icmp_type; 1523 /* 1524 * If it's not an error type, then return. 1525 */ 1526 if ((type != ICMP_UNREACH) && (type != ICMP_SOURCEQUENCH) && 1527 (type != ICMP_REDIRECT) && (type != ICMP_TIMXCEED) && 1528 (type != ICMP_PARAMPROB)) 1529 return NULL; 1530 1531 oip = (ip_t *)((char *)fin->fin_dp + 8); 1532 minlen = (oip->ip_hl << 2); 1533 if (minlen < sizeof(ip_t)) 1534 return NULL; 1535 if (ip->ip_len < ICMPERR_IPICMPHLEN + minlen) 1536 return NULL; 1537 /* 1538 * Is the buffer big enough for all of it ? It's the size of the IP 1539 * header claimed in the encapsulated part which is of concern. It 1540 * may be too big to be in this buffer but not so big that it's 1541 * outside the ICMP packet, leading to TCP deref's causing problems. 1542 * This is possible because we don't know how big oip_hl is when we 1543 * do the pullup early in fr_check() and thus can't gaurantee it is 1544 * all here now. 1545 */ 1546#ifdef _KERNEL 1547 { 1548 mb_t *m; 1549 1550# if SOLARIS 1551 m = fin->fin_qfm; 1552 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > (char *)m->b_wptr) 1553 return NULL; 1554# else 1555 m = *(mb_t **)fin->fin_mp; 1556 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > 1557 (char *)ip + m->m_len) 1558 return NULL; 1559# endif 1560 } 1561#endif 1562 1563 if (oip->ip_p == IPPROTO_TCP) 1564 flags = IPN_TCP; 1565 else if (oip->ip_p == IPPROTO_UDP) 1566 flags = IPN_UDP; 1567 if (flags & IPN_TCPUDP) { 1568 minlen += 8; /* + 64bits of data to get ports */ 1569 if (ip->ip_len < ICMPERR_IPICMPHLEN + minlen) 1570 return NULL; 1571 tcp = (tcphdr_t *)((char *)oip + (oip->ip_hl << 2)); 1572 if (dir == NAT_INBOUND) 1573 return nat_inlookup(fin->fin_ifp, flags, 1574 (u_int)oip->ip_p, oip->ip_dst, oip->ip_src, 1575 (tcp->th_sport << 16) | tcp->th_dport, 0); 1576 else 1577 return nat_outlookup(fin->fin_ifp, flags, 1578 (u_int)oip->ip_p, oip->ip_dst, oip->ip_src, 1579 (tcp->th_sport << 16) | tcp->th_dport, 0); 1580 } 1581 if (dir == NAT_INBOUND) 1582 return nat_inlookup(fin->fin_ifp, 0, (u_int)oip->ip_p, 1583 oip->ip_dst, oip->ip_src, 0, 0); 1584 else 1585 return nat_outlookup(fin->fin_ifp, 0, (u_int)oip->ip_p, 1586 oip->ip_dst, oip->ip_src, 0, 0); 1587} 1588 1589 1590/* 1591 * This should *ONLY* be used for incoming packets to make sure a NAT'd ICMP 1592 * packet gets correctly recognised. 1593 */ 1594nat_t *nat_icmp(ip, fin, nflags, dir) 1595ip_t *ip; 1596fr_info_t *fin; 1597u_int *nflags; 1598int dir; 1599{ 1600 u_32_t sum1, sum2, sumd, sumd2 = 0; 1601 struct in_addr in; 1602 icmphdr_t *icmp; 1603 udphdr_t *udp; 1604 nat_t *nat; 1605 ip_t *oip; 1606 int flags = 0; 1607 1608 if ((fin->fin_fi.fi_fl & FI_SHORT) || (ip->ip_off & IP_OFFMASK)) 1609 return NULL; 1610 /* 1611 * nat_icmplookup() will return NULL for `defective' packets. 1612 */ 1613 if ((ip->ip_v != 4) || !(nat = nat_icmplookup(ip, fin, dir))) 1614 return NULL; 1615 *nflags = IPN_ICMPERR; 1616 icmp = (icmphdr_t *)fin->fin_dp; 1617 oip = (ip_t *)&icmp->icmp_ip; 1618 if (oip->ip_p == IPPROTO_TCP) 1619 flags = IPN_TCP; 1620 else if (oip->ip_p == IPPROTO_UDP) 1621 flags = IPN_UDP; 1622 udp = (udphdr_t *)((((char *)oip) + (oip->ip_hl << 2))); 1623 /* 1624 * Need to adjust ICMP header to include the real IP#'s and 1625 * port #'s. Only apply a checksum change relative to the 1626 * IP address change as it will be modified again in ip_natout 1627 * for both address and port. Two checksum changes are 1628 * necessary for the two header address changes. Be careful 1629 * to only modify the checksum once for the port # and twice 1630 * for the IP#. 1631 */ 1632 1633 /* 1634 * Step 1 1635 * Fix the IP addresses in the offending IP packet. You also need 1636 * to adjust the IP header checksum of that offending IP packet 1637 * and the ICMP checksum of the ICMP error message itself. 1638 * 1639 * Unfortunately, for UDP and TCP, the IP addresses are also contained 1640 * in the pseudo header that is used to compute the UDP resp. TCP 1641 * checksum. So, we must compensate that as well. Even worse, the 1642 * change in the UDP and TCP checksums require yet another 1643 * adjustment of the ICMP checksum of the ICMP error message. 1644 * 1645 * For the moment we forget about TCP, because that checksum is not 1646 * in the first 8 bytes, so it will not be available in most cases. 1647 */ 1648 1649 if (oip->ip_dst.s_addr == nat->nat_oip.s_addr) { 1650 sum1 = LONG_SUM(ntohl(oip->ip_src.s_addr)); 1651 in = nat->nat_inip; 1652 oip->ip_src = in; 1653 } else { 1654 sum1 = LONG_SUM(ntohl(oip->ip_dst.s_addr)); 1655 in = nat->nat_outip; 1656 oip->ip_dst = in; 1657 } 1658 1659 sum2 = LONG_SUM(ntohl(in.s_addr)); 1660 1661 CALC_SUMD(sum1, sum2, sumd); 1662 1663 if (nat->nat_dir == NAT_OUTBOUND) { 1664 /* 1665 * Fix IP checksum of the offending IP packet to adjust for 1666 * the change in the IP address. 1667 * 1668 * Normally, you would expect that the ICMP checksum of the 1669 * ICMP error message needs to be adjusted as well for the 1670 * IP address change in oip. 1671 * However, this is a NOP, because the ICMP checksum is 1672 * calculated over the complete ICMP packet, which includes the 1673 * changed oip IP addresses and oip->ip_sum. However, these 1674 * two changes cancel each other out (if the delta for 1675 * the IP address is x, then the delta for ip_sum is minus x), 1676 * so no change in the icmp_cksum is necessary. 1677 * 1678 * Be careful that nat_dir refers to the direction of the 1679 * offending IP packet (oip), not to its ICMP response (icmp) 1680 */ 1681 fix_datacksum(&oip->ip_sum, sumd); 1682 1683 /* 1684 * Fix UDP pseudo header checksum to compensate for the 1685 * IP address change. 1686 */ 1687 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) { 1688 /* 1689 * The UDP checksum is optional, only adjust it 1690 * if it has been set. 1691 */ 1692 sum1 = ntohs(udp->uh_sum); 1693 fix_datacksum(&udp->uh_sum, sumd); 1694 sum2 = ntohs(udp->uh_sum); 1695 1696 /* 1697 * Fix ICMP checksum to compensate the UDP 1698 * checksum adjustment. 1699 */ 1700 CALC_SUMD(sum1, sum2, sumd); 1701 sumd2 = sumd; 1702 } 1703 1704#if 0 1705 /* 1706 * Fix TCP pseudo header checksum to compensate for the 1707 * IP address change. Before we can do the change, we 1708 * must make sure that oip is sufficient large to hold 1709 * the TCP checksum (normally it does not!). 1710 */ 1711 if (oip->ip_p == IPPROTO_TCP) { 1712 1713 } 1714#endif 1715 } else { 1716 1717 /* 1718 * Fix IP checksum of the offending IP packet to adjust for 1719 * the change in the IP address. 1720 * 1721 * Normally, you would expect that the ICMP checksum of the 1722 * ICMP error message needs to be adjusted as well for the 1723 * IP address change in oip. 1724 * However, this is a NOP, because the ICMP checksum is 1725 * calculated over the complete ICMP packet, which includes the 1726 * changed oip IP addresses and oip->ip_sum. However, these 1727 * two changes cancel each other out (if the delta for 1728 * the IP address is x, then the delta for ip_sum is minus x), 1729 * so no change in the icmp_cksum is necessary. 1730 * 1731 * Be careful that nat_dir refers to the direction of the 1732 * offending IP packet (oip), not to its ICMP response (icmp) 1733 */ 1734 fix_datacksum(&oip->ip_sum, sumd); 1735 1736/* XXX FV : without having looked at Solaris source code, it seems unlikely 1737 * that SOLARIS would compensate this in the kernel (a body of an IP packet 1738 * in the data section of an ICMP packet). I have the feeling that this should 1739 * be unconditional, but I'm not in a position to check. 1740 */ 1741#if !SOLARIS && !defined(__sgi) 1742 /* 1743 * Fix UDP pseudo header checksum to compensate for the 1744 * IP address change. 1745 */ 1746 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) { 1747 /* 1748 * The UDP checksum is optional, only adjust it 1749 * if it has been set 1750 */ 1751 sum1 = ntohs(udp->uh_sum); 1752 fix_datacksum(&udp->uh_sum, sumd); 1753 sum2 = ntohs(udp->uh_sum); 1754 1755 /* 1756 * Fix ICMP checksum to compensate the UDP 1757 * checksum adjustment. 1758 */ 1759 CALC_SUMD(sum1, sum2, sumd); 1760 sumd2 = sumd; 1761 } 1762 1763#if 0 1764 /* 1765 * Fix TCP pseudo header checksum to compensate for the 1766 * IP address change. Before we can do the change, we 1767 * must make sure that oip is sufficient large to hold 1768 * the TCP checksum (normally it does not!). 1769 */ 1770 if (oip->ip_p == IPPROTO_TCP) { 1771 1772 }; 1773#endif 1774 1775#endif 1776 } 1777 1778 if ((flags & IPN_TCPUDP) != 0) { 1779 tcphdr_t *tcp; 1780 1781 /* 1782 * XXX - what if this is bogus hl and we go off the end ? 1783 * In this case, nat_icmpinlookup() will have returned NULL. 1784 */ 1785 tcp = (tcphdr_t *)udp; 1786 1787 /* 1788 * Step 2 : 1789 * For offending TCP/UDP IP packets, translate the ports as 1790 * well, based on the NAT specification. Of course such 1791 * a change must be reflected in the ICMP checksum as well. 1792 * 1793 * Advance notice : Now it becomes complicated :-) 1794 * 1795 * Since the port fields are part of the TCP/UDP checksum 1796 * of the offending IP packet, you need to adjust that checksum 1797 * as well... but, if you change, you must change the icmp 1798 * checksum *again*, to reflect that change. 1799 * 1800 * To further complicate: the TCP checksum is not in the first 1801 * 8 bytes of the offending ip packet, so it most likely is not 1802 * available (we might have to fix that if the encounter a 1803 * device that returns more than 8 data bytes on icmp error) 1804 */ 1805 1806 if (nat->nat_oport == tcp->th_dport) { 1807 if (tcp->th_sport != nat->nat_inport) { 1808 /* 1809 * Fix ICMP checksum to compensate port 1810 * adjustment. 1811 */ 1812 sum1 = ntohs(tcp->th_sport); 1813 sum2 = ntohs(nat->nat_inport); 1814 CALC_SUMD(sum1, sum2, sumd); 1815 sumd2 += sumd; 1816 tcp->th_sport = nat->nat_inport; 1817 1818 /* 1819 * Fix udp checksum to compensate port 1820 * adjustment. NOTE : the offending IP packet 1821 * flows the other direction compared to the 1822 * ICMP message. 1823 * 1824 * The UDP checksum is optional, only adjust 1825 * it if it has been set. 1826 */ 1827 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) { 1828 1829 sum1 = ntohs(udp->uh_sum); 1830 fix_datacksum(&udp->uh_sum, sumd); 1831 sum2 = ntohs(udp->uh_sum); 1832 1833 /* 1834 * Fix ICMP checksum to 1835 * compensate UDP checksum 1836 * adjustment. 1837 */ 1838 CALC_SUMD(sum1, sum2, sumd); 1839 sumd2 += sumd; 1840 } 1841 } 1842 } else { 1843 if (tcp->th_dport != nat->nat_outport) { 1844 /* 1845 * Fix ICMP checksum to compensate port 1846 * adjustment. 1847 */ 1848 sum1 = ntohs(tcp->th_dport); 1849 sum2 = ntohs(nat->nat_outport); 1850 CALC_SUMD(sum1, sum2, sumd); 1851 sumd2 += sumd; 1852 tcp->th_dport = nat->nat_outport; 1853 1854 /* 1855 * Fix udp checksum to compensate port 1856 * adjustment. NOTE : the offending IP 1857 * packet flows the other direction compared 1858 * to the ICMP message. 1859 * 1860 * The UDP checksum is optional, only adjust 1861 * it if it has been set. 1862 */ 1863 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) { 1864 1865 sum1 = ntohs(udp->uh_sum); 1866 fix_datacksum(&udp->uh_sum, sumd); 1867 sum2 = ntohs(udp->uh_sum); 1868 1869 /* 1870 * Fix ICMP checksum to compensate 1871 * UDP checksum adjustment. 1872 */ 1873 CALC_SUMD(sum1, sum2, sumd); 1874 sumd2 += sumd; 1875 } 1876 } 1877 } 1878 if (sumd2) { 1879 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 1880 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16); 1881 if (nat->nat_dir == NAT_OUTBOUND) { 1882 fix_outcksum(&icmp->icmp_cksum, sumd2); 1883 } else { 1884 fix_incksum(&icmp->icmp_cksum, sumd2); 1885 } 1886 } 1887 } 1888 nat->nat_age = fr_defnaticmpage; 1889 return nat; 1890} 1891 1892 1893/* 1894 * NB: these lookups don't lock access to the list, it assume it has already 1895 * been done! 1896 */ 1897/* 1898 * Lookup a nat entry based on the mapped destination ip address/port and 1899 * real source address/port. We use this lookup when receiving a packet, 1900 * we're looking for a table entry, based on the destination address. 1901 * NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. 1902 */ 1903nat_t *nat_inlookup(ifp, flags, p, src, mapdst, ports, rw) 1904void *ifp; 1905register u_int flags, p; 1906struct in_addr src , mapdst; 1907u_32_t ports; 1908int rw; 1909{ 1910 register u_short sport, dport; 1911 register nat_t *nat; 1912 register int nflags; 1913 register u_32_t dst; 1914 u_int hv; 1915 1916 dst = mapdst.s_addr; 1917 dport = ports >> 16; 1918 sport = ports & 0xffff; 1919 flags &= IPN_TCPUDP; 1920 1921 hv = NAT_HASH_FN(dst, dport, ipf_nattable_sz); 1922 nat = nat_table[1][hv]; 1923 for (; nat; nat = nat->nat_hnext[1]) { 1924 nflags = nat->nat_flags; 1925 if ((!ifp || ifp == nat->nat_ifp) && 1926 nat->nat_oip.s_addr == src.s_addr && 1927 nat->nat_outip.s_addr == dst && 1928 (((p == 0) && (flags == (nat->nat_flags & IPN_TCPUDP))) 1929 || (p == nat->nat_p)) && (!flags || 1930 (((nat->nat_oport == sport) || (nflags & FI_W_DPORT)) && 1931 ((nat->nat_outport == dport) || (nflags & FI_W_SPORT))))) 1932 return nat; 1933 } 1934 if (!nat_stats.ns_wilds || !(flags & IPN_TCPUDP)) 1935 return NULL; 1936 if (!rw) { 1937 RWLOCK_EXIT(&ipf_nat); 1938 } 1939 hv = NAT_HASH_FN(dst, 0, ipf_nattable_sz); 1940 if (!rw) { 1941 WRITE_ENTER(&ipf_nat); 1942 } 1943 nat = nat_table[1][hv]; 1944 for (; nat; nat = nat->nat_hnext[1]) { 1945 nflags = nat->nat_flags; 1946 if (ifp && ifp != nat->nat_ifp) 1947 continue; 1948 if (!(nflags & IPN_TCPUDP)) 1949 continue; 1950 if (!(nflags & FI_WILDP)) 1951 continue; 1952 if (nat->nat_oip.s_addr != src.s_addr || 1953 nat->nat_outip.s_addr != dst) 1954 continue; 1955 if (((nat->nat_oport == sport) || (nflags & FI_W_DPORT)) && 1956 ((nat->nat_outport == dport) || (nflags & FI_W_SPORT))) { 1957 nat_tabmove(nat, ports); 1958 break; 1959 } 1960 } 1961 if (!rw) { 1962 MUTEX_DOWNGRADE(&ipf_nat); 1963 } 1964 return nat; 1965} 1966 1967 1968/* 1969 * This function is only called for TCP/UDP NAT table entries where the 1970 * original was placed in the table without hashing on the ports and we now 1971 * want to include hashing on port numbers. 1972 */ 1973static void nat_tabmove(nat, ports) 1974nat_t *nat; 1975u_32_t ports; 1976{ 1977 register u_short sport, dport; 1978 nat_t **natp; 1979 u_int hv; 1980 1981 dport = ports >> 16; 1982 sport = ports & 0xffff; 1983 1984 if (nat->nat_oport == dport) { 1985 nat->nat_inport = sport; 1986 nat->nat_outport = sport; 1987 } 1988 1989 /* 1990 * Remove the NAT entry from the old location 1991 */ 1992 if (nat->nat_hnext[0]) 1993 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; 1994 *nat->nat_phnext[0] = nat->nat_hnext[0]; 1995 1996 if (nat->nat_hnext[1]) 1997 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; 1998 *nat->nat_phnext[1] = nat->nat_hnext[1]; 1999 2000 /* 2001 * Add into the NAT table in the new position 2002 */ 2003 hv = NAT_HASH_FN(nat->nat_inip.s_addr, sport, ipf_nattable_sz); 2004 natp = &nat_table[0][hv]; 2005 if (*natp) 2006 (*natp)->nat_phnext[0] = &nat->nat_hnext[0]; 2007 nat->nat_phnext[0] = natp; 2008 nat->nat_hnext[0] = *natp; 2009 *natp = nat; 2010 2011 hv = NAT_HASH_FN(nat->nat_outip.s_addr, sport, ipf_nattable_sz); 2012 natp = &nat_table[1][hv]; 2013 if (*natp) 2014 (*natp)->nat_phnext[1] = &nat->nat_hnext[1]; 2015 nat->nat_phnext[1] = natp; 2016 nat->nat_hnext[1] = *natp; 2017 *natp = nat; 2018} 2019 2020 2021/* 2022 * Lookup a nat entry based on the source 'real' ip address/port and 2023 * destination address/port. We use this lookup when sending a packet out, 2024 * we're looking for a table entry, based on the source address. 2025 * NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. 2026 */ 2027nat_t *nat_outlookup(ifp, flags, p, src, dst, ports, rw) 2028void *ifp; 2029register u_int flags, p; 2030struct in_addr src , dst; 2031u_32_t ports; 2032int rw; 2033{ 2034 register u_short sport, dport; 2035 register nat_t *nat; 2036 register int nflags; 2037 u_32_t srcip; 2038 u_int hv; 2039 2040 sport = ports & 0xffff; 2041 dport = ports >> 16; 2042 flags &= IPN_TCPUDP; 2043 srcip = src.s_addr; 2044 2045 hv = NAT_HASH_FN(srcip, sport, ipf_nattable_sz); 2046 nat = nat_table[0][hv]; 2047 for (; nat; nat = nat->nat_hnext[0]) { 2048 nflags = nat->nat_flags; 2049 2050 if ((!ifp || ifp == nat->nat_ifp) && 2051 nat->nat_inip.s_addr == srcip && 2052 nat->nat_oip.s_addr == dst.s_addr && 2053 (((p == 0) && (flags == (nflags & IPN_TCPUDP))) 2054 || (p == nat->nat_p)) && (!flags || 2055 ((nat->nat_inport == sport || nflags & FI_W_SPORT) && 2056 (nat->nat_oport == dport || nflags & FI_W_DPORT)))) 2057 return nat; 2058 } 2059 if (!nat_stats.ns_wilds || !(flags & IPN_TCPUDP)) 2060 return NULL; 2061 if (!rw) { 2062 RWLOCK_EXIT(&ipf_nat); 2063 } 2064 hv = NAT_HASH_FN(srcip, 0, ipf_nattable_sz); 2065 if (!rw) { 2066 WRITE_ENTER(&ipf_nat); 2067 } 2068 nat = nat_table[0][hv]; 2069 for (; nat; nat = nat->nat_hnext[0]) { 2070 nflags = nat->nat_flags; 2071 if (ifp && ifp != nat->nat_ifp) 2072 continue; 2073 if (!(nflags & IPN_TCPUDP)) 2074 continue; 2075 if (!(nflags & FI_WILDP)) 2076 continue; 2077 if ((nat->nat_inip.s_addr != srcip) || 2078 (nat->nat_oip.s_addr != dst.s_addr)) 2079 continue; 2080 if (((nat->nat_inport == sport) || (nflags & FI_W_SPORT)) && 2081 ((nat->nat_oport == dport) || (nflags & FI_W_DPORT))) { 2082 nat_tabmove(nat, ports); 2083 break; 2084 } 2085 } 2086 if (!rw) { 2087 MUTEX_DOWNGRADE(&ipf_nat); 2088 } 2089 return nat; 2090} 2091 2092 2093/* 2094 * Lookup the NAT tables to search for a matching redirect 2095 */ 2096nat_t *nat_lookupredir(np) 2097register natlookup_t *np; 2098{ 2099 u_32_t ports; 2100 nat_t *nat; 2101 2102 ports = (np->nl_outport << 16) | np->nl_inport; 2103 /* 2104 * If nl_inip is non null, this is a lookup based on the real 2105 * ip address. Else, we use the fake. 2106 */ 2107 if ((nat = nat_outlookup(NULL, np->nl_flags, 0, np->nl_inip, 2108 np->nl_outip, ports, 0))) { 2109 np->nl_realip = nat->nat_outip; 2110 np->nl_realport = nat->nat_outport; 2111 } 2112 return nat; 2113} 2114 2115 2116static int nat_match(fin, np, ip) 2117fr_info_t *fin; 2118ipnat_t *np; 2119ip_t *ip; 2120{ 2121 frtuc_t *ft; 2122 2123 if (ip->ip_v != 4) 2124 return 0; 2125 2126 if (np->in_p && ip->ip_p != np->in_p) 2127 return 0; 2128 if (fin->fin_out) { 2129 if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK))) 2130 return 0; 2131 if (((fin->fin_fi.fi_saddr & np->in_inmsk) != np->in_inip) 2132 ^ ((np->in_flags & IPN_NOTSRC) != 0)) 2133 return 0; 2134 if (((fin->fin_fi.fi_daddr & np->in_srcmsk) != np->in_srcip) 2135 ^ ((np->in_flags & IPN_NOTDST) != 0)) 2136 return 0; 2137 } else { 2138 if (!(np->in_redir & NAT_REDIRECT)) 2139 return 0; 2140 if (((fin->fin_fi.fi_saddr & np->in_srcmsk) != np->in_srcip) 2141 ^ ((np->in_flags & IPN_NOTSRC) != 0)) 2142 return 0; 2143 if (((fin->fin_fi.fi_daddr & np->in_outmsk) != np->in_outip) 2144 ^ ((np->in_flags & IPN_NOTDST) != 0)) 2145 return 0; 2146 } 2147 2148 ft = &np->in_tuc; 2149 if (!(fin->fin_fi.fi_fl & FI_TCPUDP) || 2150 (fin->fin_fi.fi_fl & FI_SHORT) || (ip->ip_off & IP_OFFMASK)) { 2151 if (ft->ftu_scmp || ft->ftu_dcmp) 2152 return 0; 2153 return 1; 2154 } 2155 2156 return fr_tcpudpchk(ft, fin); 2157} 2158 2159 2160/* 2161 * Packets going out on the external interface go through this. 2162 * Here, the source address requires alteration, if anything. 2163 */ 2164int ip_natout(ip, fin) 2165ip_t *ip; 2166fr_info_t *fin; 2167{ 2168 register ipnat_t *np = NULL; 2169 register u_32_t ipa; 2170 tcphdr_t *tcp = NULL; 2171 u_short sport = 0, dport = 0, *csump = NULL; 2172 struct ifnet *ifp; 2173 int natadd = 1; 2174 frentry_t *fr; 2175 u_int nflags = 0, hv, msk; 2176 u_32_t iph; 2177 nat_t *nat; 2178 int i; 2179 2180 if (nat_list == NULL || (fr_nat_lock)) 2181 return 0; 2182 2183 if ((fr = fin->fin_fr) && !(fr->fr_flags & FR_DUP) && 2184 fr->fr_tif.fd_ifp && fr->fr_tif.fd_ifp != (void *)-1) 2185 ifp = fr->fr_tif.fd_ifp; 2186 else 2187 ifp = fin->fin_ifp; 2188 2189 if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) { 2190 if (ip->ip_p == IPPROTO_TCP) 2191 nflags = IPN_TCP; 2192 else if (ip->ip_p == IPPROTO_UDP) 2193 nflags = IPN_UDP; 2194 if ((nflags & IPN_TCPUDP)) { 2195 tcp = (tcphdr_t *)fin->fin_dp; 2196 sport = tcp->th_sport; 2197 dport = tcp->th_dport; 2198 } 2199 } 2200 2201 ipa = ip->ip_src.s_addr; 2202 2203 READ_ENTER(&ipf_nat); 2204 2205 if ((ip->ip_p == IPPROTO_ICMP) && 2206 (nat = nat_icmp(ip, fin, &nflags, NAT_OUTBOUND))) 2207 ; 2208 else if ((ip->ip_off & (IP_OFFMASK|IP_MF)) && 2209 (nat = ipfr_nat_knownfrag(ip, fin))) 2210 natadd = 0; 2211 else if ((nat = nat_outlookup(ifp, nflags, (u_int)ip->ip_p, 2212 ip->ip_src, ip->ip_dst, 2213 (dport << 16) | sport, 0))) { 2214 nflags = nat->nat_flags; 2215 if ((nflags & (FI_W_SPORT|FI_W_DPORT)) != 0) { 2216 if ((nflags & FI_W_SPORT) && 2217 (nat->nat_inport != sport)) 2218 nat->nat_inport = sport; 2219 else if ((nflags & FI_W_DPORT) && 2220 (nat->nat_oport != dport)) 2221 nat->nat_oport = dport; 2222 if (nat->nat_outport == 0) 2223 nat->nat_outport = sport; 2224 nat->nat_flags &= ~(FI_W_DPORT|FI_W_SPORT); 2225 nflags = nat->nat_flags; 2226 nat_stats.ns_wilds--; 2227 } 2228 } else { 2229 RWLOCK_EXIT(&ipf_nat); 2230 WRITE_ENTER(&ipf_nat); 2231 /* 2232 * If there is no current entry in the nat table for this IP#, 2233 * create one for it (if there is a matching rule). 2234 */ 2235 msk = 0xffffffff; 2236 i = 32; 2237maskloop: 2238 iph = ipa & htonl(msk); 2239 hv = NAT_HASH_FN(iph, 0, ipf_natrules_sz); 2240 for (np = nat_rules[hv]; np; np = np->in_mnext) 2241 { 2242 if ((np->in_ifp && (np->in_ifp != ifp)) || 2243 !np->in_space) 2244 continue; 2245 if ((np->in_flags & IPN_RF) && 2246 !(np->in_flags & nflags)) 2247 continue; 2248 if (np->in_flags & IPN_FILTER) { 2249 if (!nat_match(fin, np, ip)) 2250 continue; 2251 } else if ((ipa & np->in_inmsk) != np->in_inip) 2252 continue; 2253 if (np->in_redir & (NAT_MAP|NAT_MAPBLK)) { 2254 if (*np->in_plabel && !appr_ok(ip, tcp, np)) 2255 continue; 2256 /* 2257 * If it's a redirection, then we don't want to 2258 * create new outgoing port stuff. 2259 * Redirections are only for incoming 2260 * connections. 2261 */ 2262 if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK))) 2263 continue; 2264 if ((nat = nat_new(np, ip, fin, (u_int)nflags, 2265 NAT_OUTBOUND))) { 2266 np->in_hits++; 2267 break; 2268 } 2269 } 2270 } 2271 if ((np == NULL) && (i > 0)) { 2272 do { 2273 i--; 2274 msk <<= 1; 2275 } while ((i >= 0) && ((nat_masks & (1 << i)) == 0)); 2276 if (i >= 0) 2277 goto maskloop; 2278 } 2279 MUTEX_DOWNGRADE(&ipf_nat); 2280 } 2281 2282 /* 2283 * NOTE: ipf_nat must now only be held as a read lock 2284 */ 2285 if (nat) { 2286 np = nat->nat_ptr; 2287 if (natadd && fin->fin_fi.fi_fl & FI_FRAG) 2288 ipfr_nat_newfrag(ip, fin, 0, nat); 2289 MUTEX_ENTER(&nat->nat_lock); 2290 nat->nat_age = fr_defnatage; 2291 nat->nat_bytes += ip->ip_len; 2292 nat->nat_pkts++; 2293 MUTEX_EXIT(&nat->nat_lock); 2294 2295 /* 2296 * Fix up checksums, not by recalculating them, but 2297 * simply computing adjustments. 2298 */ 2299 if (nflags == IPN_ICMPERR) { 2300 u_32_t s1, s2, sumd; 2301 2302 s1 = LONG_SUM(ntohl(ip->ip_src.s_addr)); 2303 s2 = LONG_SUM(ntohl(nat->nat_outip.s_addr)); 2304 CALC_SUMD(s1, s2, sumd); 2305 2306 if (nat->nat_dir == NAT_OUTBOUND) 2307 fix_incksum(&ip->ip_sum, sumd); 2308 else 2309 fix_outcksum(&ip->ip_sum, sumd); 2310 } 2311#if SOLARIS || defined(__sgi) 2312 else { 2313 if (nat->nat_dir == NAT_OUTBOUND) 2314 fix_outcksum(&ip->ip_sum, nat->nat_ipsumd); 2315 else 2316 fix_incksum(&ip->ip_sum, nat->nat_ipsumd); 2317 } 2318#endif 2319 ip->ip_src = nat->nat_outip; 2320 2321 if (!(ip->ip_off & IP_OFFMASK) && 2322 !(fin->fin_fi.fi_fl & FI_SHORT)) { 2323 2324 if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) { 2325 tcp->th_sport = nat->nat_outport; 2326 fin->fin_data[0] = ntohs(tcp->th_sport); 2327 } 2328 2329 if (ip->ip_p == IPPROTO_TCP) { 2330 csump = &tcp->th_sum; 2331 MUTEX_ENTER(&nat->nat_lock); 2332 fr_tcp_age(&nat->nat_age, 2333 nat->nat_tcpstate, fin, 1); 2334 if (nat->nat_age < fr_defnaticmpage) 2335 nat->nat_age = fr_defnaticmpage; 2336#ifdef LARGE_NAT 2337 else if (nat->nat_age > fr_defnatage) 2338 nat->nat_age = fr_defnatage; 2339#endif 2340 /* 2341 * Increase this because we may have 2342 * "keep state" following this too and 2343 * packet storms can occur if this is 2344 * removed too quickly. 2345 */ 2346 if (nat->nat_age == fr_tcpclosed) 2347 nat->nat_age = fr_tcplastack; 2348 MUTEX_EXIT(&nat->nat_lock); 2349 } else if (ip->ip_p == IPPROTO_UDP) { 2350 udphdr_t *udp = (udphdr_t *)tcp; 2351 2352 if (udp->uh_sum) 2353 csump = &udp->uh_sum; 2354 } else if (ip->ip_p == IPPROTO_ICMP) { 2355 nat->nat_age = fr_defnaticmpage; 2356 } 2357 2358 if (csump) { 2359 if (nat->nat_dir == NAT_OUTBOUND) 2360 fix_outcksum(csump, nat->nat_sumd[1]); 2361 else 2362 fix_incksum(csump, nat->nat_sumd[1]); 2363 } 2364 } 2365 2366 if ((np->in_apr != NULL) && (np->in_dport == 0 || 2367 (tcp != NULL && dport == np->in_dport))) { 2368 i = appr_check(ip, fin, nat); 2369 if (i == 0) 2370 i = 1; 2371 } else 2372 i = 1; 2373 ATOMIC_INCL(nat_stats.ns_mapped[1]); 2374 RWLOCK_EXIT(&ipf_nat); /* READ */ 2375 return i; 2376 } 2377 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */ 2378 return 0; 2379} 2380 2381 2382/* 2383 * Packets coming in from the external interface go through this. 2384 * Here, the destination address requires alteration, if anything. 2385 */ 2386int ip_natin(ip, fin) 2387ip_t *ip; 2388fr_info_t *fin; 2389{ 2390 register struct in_addr src; 2391 register struct in_addr in; 2392 register ipnat_t *np; 2393 u_int nflags = 0, natadd = 1, hv, msk; 2394 struct ifnet *ifp = fin->fin_ifp; 2395 tcphdr_t *tcp = NULL; 2396 u_short sport = 0, dport = 0, *csump = NULL; 2397 nat_t *nat; 2398 u_32_t iph; 2399 int i; 2400 2401 if ((nat_list == NULL) || (ip->ip_v != 4) || (fr_nat_lock)) 2402 return 0; 2403 2404 if (!(ip->ip_off & IP_OFFMASK) && !(fin->fin_fi.fi_fl & FI_SHORT)) { 2405 if (ip->ip_p == IPPROTO_TCP) 2406 nflags = IPN_TCP; 2407 else if (ip->ip_p == IPPROTO_UDP) 2408 nflags = IPN_UDP; 2409 if ((nflags & IPN_TCPUDP)) { 2410 tcp = (tcphdr_t *)fin->fin_dp; 2411 dport = tcp->th_dport; 2412 sport = tcp->th_sport; 2413 } 2414 } 2415 2416 in = ip->ip_dst; 2417 /* make sure the source address is to be redirected */ 2418 src = ip->ip_src; 2419 2420 READ_ENTER(&ipf_nat); 2421 2422 if ((ip->ip_p == IPPROTO_ICMP) && 2423 (nat = nat_icmp(ip, fin, &nflags, NAT_INBOUND))) 2424 ; 2425 else if ((ip->ip_off & (IP_OFFMASK|IP_MF)) && 2426 (nat = ipfr_nat_knownfrag(ip, fin))) 2427 natadd = 0; 2428 else if ((nat = nat_inlookup(fin->fin_ifp, nflags, (u_int)ip->ip_p, 2429 ip->ip_src, in, (dport << 16) | sport, 2430 0))) { 2431 nflags = nat->nat_flags; 2432 if ((nflags & (FI_W_SPORT|FI_W_DPORT)) != 0) { 2433 if ((nat->nat_oport != sport) && (nflags & FI_W_DPORT)) 2434 nat->nat_oport = sport; 2435 else if ((nat->nat_outport != dport) && 2436 (nflags & FI_W_SPORT)) 2437 nat->nat_outport = dport; 2438 nat->nat_flags &= ~(FI_W_SPORT|FI_W_DPORT); 2439 nflags = nat->nat_flags; 2440 nat_stats.ns_wilds--; 2441 } 2442 } else { 2443 RWLOCK_EXIT(&ipf_nat); 2444 WRITE_ENTER(&ipf_nat); 2445 /* 2446 * If there is no current entry in the nat table for this IP#, 2447 * create one for it (if there is a matching rule). 2448 */ 2449 msk = 0xffffffff; 2450 i = 32; 2451maskloop: 2452 iph = in.s_addr & htonl(msk); 2453 hv = NAT_HASH_FN(iph, 0, ipf_rdrrules_sz); 2454 for (np = rdr_rules[hv]; np; np = np->in_rnext) { 2455 if ((np->in_ifp && (np->in_ifp != ifp)) || 2456 (np->in_p && (np->in_p != ip->ip_p)) || 2457 (np->in_flags && !(nflags & np->in_flags))) 2458 continue; 2459 if (np->in_flags & IPN_FILTER) { 2460 if (!nat_match(fin, np, ip)) 2461 continue; 2462 } else if ((in.s_addr & np->in_outmsk) != np->in_outip) 2463 continue; 2464 if ((np->in_redir & NAT_REDIRECT) && 2465 (!np->in_pmin || (np->in_flags & IPN_FILTER) || 2466 ((ntohs(np->in_pmax) >= ntohs(dport)) && 2467 (ntohs(dport) >= ntohs(np->in_pmin))))) 2468 if ((nat = nat_new(np, ip, fin, nflags, 2469 NAT_INBOUND))) { 2470 np->in_hits++; 2471 break; 2472 } 2473 } 2474 2475 if ((np == NULL) && (i > 0)) { 2476 do { 2477 i--; 2478 msk <<= 1; 2479 } while ((i >= 0) && ((rdr_masks & (1 << i)) == 0)); 2480 if (i >= 0) 2481 goto maskloop; 2482 } 2483 MUTEX_DOWNGRADE(&ipf_nat); 2484 } 2485 2486 /* 2487 * NOTE: ipf_nat must now only be held as a read lock 2488 */ 2489 if (nat) { 2490 np = nat->nat_ptr; 2491 fin->fin_fr = nat->nat_fr; 2492 if (natadd && fin->fin_fi.fi_fl & FI_FRAG) 2493 ipfr_nat_newfrag(ip, fin, 0, nat); 2494 if ((np->in_apr != NULL) && (np->in_dport == 0 || 2495 (tcp != NULL && sport == np->in_dport))) { 2496 i = appr_check(ip, fin, nat); 2497 if (i == -1) { 2498 RWLOCK_EXIT(&ipf_nat); 2499 return i; 2500 } 2501 } 2502 2503 MUTEX_ENTER(&nat->nat_lock); 2504 if (nflags != IPN_ICMPERR) 2505 nat->nat_age = fr_defnatage; 2506 2507 nat->nat_bytes += ip->ip_len; 2508 nat->nat_pkts++; 2509 MUTEX_EXIT(&nat->nat_lock); 2510 ip->ip_dst = nat->nat_inip; 2511 fin->fin_fi.fi_daddr = nat->nat_inip.s_addr; 2512 2513 /* 2514 * Fix up checksums, not by recalculating them, but 2515 * simply computing adjustments. 2516 */ 2517#if SOLARIS || defined(__sgi) 2518 if (nat->nat_dir == NAT_OUTBOUND) 2519 fix_incksum(&ip->ip_sum, nat->nat_ipsumd); 2520 else 2521 fix_outcksum(&ip->ip_sum, nat->nat_ipsumd); 2522#endif 2523 if (!(ip->ip_off & IP_OFFMASK) && 2524 !(fin->fin_fi.fi_fl & FI_SHORT)) { 2525 2526 if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) { 2527 tcp->th_dport = nat->nat_inport; 2528 fin->fin_data[1] = ntohs(tcp->th_dport); 2529 } 2530 2531 if (ip->ip_p == IPPROTO_TCP) { 2532 csump = &tcp->th_sum; 2533 MUTEX_ENTER(&nat->nat_lock); 2534 fr_tcp_age(&nat->nat_age, 2535 nat->nat_tcpstate, fin, 0); 2536 if (nat->nat_age < fr_defnaticmpage) 2537 nat->nat_age = fr_defnaticmpage; 2538#ifdef LARGE_NAT 2539 else if (nat->nat_age > fr_defnatage) 2540 nat->nat_age = fr_defnatage; 2541#endif 2542 /* 2543 * Increase this because we may have 2544 * "keep state" following this too and 2545 * packet storms can occur if this is 2546 * removed too quickly. 2547 */ 2548 if (nat->nat_age == fr_tcpclosed) 2549 nat->nat_age = fr_tcplastack; 2550 MUTEX_EXIT(&nat->nat_lock); 2551 } else if (ip->ip_p == IPPROTO_UDP) { 2552 udphdr_t *udp = (udphdr_t *)tcp; 2553 2554 if (udp->uh_sum) 2555 csump = &udp->uh_sum; 2556 } else if (ip->ip_p == IPPROTO_ICMP) { 2557 nat->nat_age = fr_defnaticmpage; 2558 } 2559 2560 if (csump) { 2561 if (nat->nat_dir == NAT_OUTBOUND) 2562 fix_incksum(csump, nat->nat_sumd[0]); 2563 else 2564 fix_outcksum(csump, nat->nat_sumd[0]); 2565 } 2566 } 2567 ATOMIC_INCL(nat_stats.ns_mapped[0]); 2568 RWLOCK_EXIT(&ipf_nat); /* READ */ 2569 return 1; 2570 } 2571 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */ 2572 return 0; 2573} 2574 2575 2576/* 2577 * Free all memory used by NAT structures allocated at runtime. 2578 */ 2579void ip_natunload() 2580{ 2581 WRITE_ENTER(&ipf_nat); 2582 (void) nat_clearlist(); 2583 (void) nat_flushtable(); 2584 RWLOCK_EXIT(&ipf_nat); 2585 2586 if (nat_table[0] != NULL) { 2587 KFREES(nat_table[0], sizeof(nat_t *) * ipf_nattable_sz); 2588 nat_table[0] = NULL; 2589 } 2590 if (nat_table[1] != NULL) { 2591 KFREES(nat_table[1], sizeof(nat_t *) * ipf_nattable_sz); 2592 nat_table[1] = NULL; 2593 } 2594 if (nat_rules != NULL) { 2595 KFREES(nat_rules, sizeof(ipnat_t *) * ipf_natrules_sz); 2596 nat_rules = NULL; 2597 } 2598 if (rdr_rules != NULL) { 2599 KFREES(rdr_rules, sizeof(ipnat_t *) * ipf_rdrrules_sz); 2600 rdr_rules = NULL; 2601 } 2602 if (maptable != NULL) { 2603 KFREES(maptable, sizeof(hostmap_t *) * ipf_hostmap_sz); 2604 maptable = NULL; 2605 } 2606} 2607 2608 2609/* 2610 * Slowly expire held state for NAT entries. Timeouts are set in 2611 * expectation of this being called twice per second. 2612 */ 2613void ip_natexpire() 2614{ 2615 register struct nat *nat, **natp; 2616#if defined(_KERNEL) && !SOLARIS 2617 int s; 2618#endif 2619 2620 SPL_NET(s); 2621 WRITE_ENTER(&ipf_nat); 2622 for (natp = &nat_instances; (nat = *natp); ) { 2623 nat->nat_age--; 2624 if (nat->nat_age) { 2625 natp = &nat->nat_next; 2626 continue; 2627 } 2628 *natp = nat->nat_next; 2629#ifdef IPFILTER_LOG 2630 nat_log(nat, NL_EXPIRE); 2631#endif 2632 nat_delete(nat); 2633 nat_stats.ns_expire++; 2634 } 2635 RWLOCK_EXIT(&ipf_nat); 2636 SPL_X(s); 2637} 2638 2639 2640/* 2641 */ 2642void ip_natsync(ifp) 2643void *ifp; 2644{ 2645 register ipnat_t *n; 2646 register nat_t *nat; 2647 register u_32_t sum1, sum2, sumd; 2648 struct in_addr in; 2649 ipnat_t *np; 2650 void *ifp2; 2651#if defined(_KERNEL) && !SOLARIS 2652 int s; 2653#endif 2654 2655 /* 2656 * Change IP addresses for NAT sessions for any protocol except TCP 2657 * since it will break the TCP connection anyway. 2658 */ 2659 SPL_NET(s); 2660 WRITE_ENTER(&ipf_nat); 2661 for (nat = nat_instances; nat; nat = nat->nat_next) 2662 if (((ifp == NULL) || (ifp == nat->nat_ifp)) && 2663 !(nat->nat_flags & IPN_TCP) && (np = nat->nat_ptr) && 2664 (np->in_outmsk == 0xffffffff) && !np->in_nip) { 2665 ifp2 = nat->nat_ifp; 2666 /* 2667 * Change the map-to address to be the same as the 2668 * new one. 2669 */ 2670 sum1 = nat->nat_outip.s_addr; 2671 if (fr_ifpaddr(4, ifp2, &in) != -1) 2672 nat->nat_outip = in; 2673 sum2 = nat->nat_outip.s_addr; 2674 2675 if (sum1 == sum2) 2676 continue; 2677 /* 2678 * Readjust the checksum adjustment to take into 2679 * account the new IP#. 2680 */ 2681 CALC_SUMD(sum1, sum2, sumd); 2682 /* XXX - dont change for TCP when solaris does 2683 * hardware checksumming. 2684 */ 2685 sumd += nat->nat_sumd[0]; 2686 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16); 2687 nat->nat_sumd[1] = nat->nat_sumd[0]; 2688 } 2689 2690 for (n = nat_list; (n != NULL); n = n->in_next) 2691 if (n->in_ifp == ifp) { 2692 n->in_ifp = (void *)GETUNIT(n->in_ifname, 4); 2693 if (!n->in_ifp) 2694 n->in_ifp = (void *)-1; 2695 } 2696 RWLOCK_EXIT(&ipf_nat); 2697 SPL_X(s); 2698} 2699 2700 2701#ifdef IPFILTER_LOG 2702void nat_log(nat, type) 2703struct nat *nat; 2704u_int type; 2705{ 2706 struct ipnat *np; 2707 struct natlog natl; 2708 void *items[1]; 2709 size_t sizes[1]; 2710 int rulen, types[1]; 2711 2712 natl.nl_inip = nat->nat_inip; 2713 natl.nl_outip = nat->nat_outip; 2714 natl.nl_origip = nat->nat_oip; 2715 natl.nl_bytes = nat->nat_bytes; 2716 natl.nl_pkts = nat->nat_pkts; 2717 natl.nl_origport = nat->nat_oport; 2718 natl.nl_inport = nat->nat_inport; 2719 natl.nl_outport = nat->nat_outport; 2720 natl.nl_p = nat->nat_p; 2721 natl.nl_type = type; 2722 natl.nl_rule = -1; 2723#ifndef LARGE_NAT 2724 if (nat->nat_ptr != NULL) { 2725 for (rulen = 0, np = nat_list; np; np = np->in_next, rulen++) 2726 if (np == nat->nat_ptr) { 2727 natl.nl_rule = rulen; 2728 break; 2729 } 2730 } 2731#endif 2732 items[0] = &natl; 2733 sizes[0] = sizeof(natl); 2734 types[0] = 0; 2735 2736 (void) ipllog(IPL_LOGNAT, NULL, items, sizes, types, 1); 2737} 2738#endif 2739