1/* $NetBSD: npf.c,v 1.2 2016/12/10 22:09:18 christos Exp $ */ 2 3/*- 4 * Copyright (c) 2016 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Christos Zoulas. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32#include <sys/cdefs.h> 33__RCSID("$NetBSD: npf.c,v 1.2 2016/12/10 22:09:18 christos Exp $"); 34 35#include <sys/types.h> 36#include <sys/socket.h> 37#include <sys/ioctl.h> 38#include <sys/fcntl.h> 39 40#include <net/if.h> 41#include <netinet/in.h> 42 43#include <npf.h> 44#include <stdlib.h> 45#include <string.h> 46#include <errno.h> 47#include <syslog.h> 48#include <unistd.h> 49 50#include "identd.h" 51 52int 53npf_natlookup(const struct sockaddr_storage *ss, 54 struct sockaddr_storage *nat_addr, in_port_t *nat_lport) 55{ 56 npf_addr_t *addr[2]; 57 in_port_t port[2]; 58 int dev, af; 59 60 /* copy the source into nat_addr so it is writable */ 61 memcpy(nat_addr, &ss[0], sizeof(ss[0])); 62 63 switch (af = ss[0].ss_family) { 64 case AF_INET: 65 addr[0] = (void *)&satosin(nat_addr)->sin_addr; 66 addr[1] = __UNCONST(&csatosin(&ss[1])->sin_addr); 67 port[0] = csatosin(&ss[0])->sin_port; 68 port[1] = csatosin(&ss[1])->sin_port; 69 break; 70 case AF_INET6: 71 addr[0] = (void *)&satosin6(&nat_addr)->sin6_addr; 72 addr[1] = __UNCONST(&csatosin6(&ss[0])->sin6_addr); 73 port[0] = csatosin6(&ss[0])->sin6_port; 74 port[1] = csatosin6(&ss[1])->sin6_port; 75 break; 76 default: 77 errno = EAFNOSUPPORT; 78 maybe_syslog(LOG_ERR, "NAT lookup for %d: %m" , af); 79 return 0; 80 } 81 82 /* Open the /dev/pf device and do the lookup. */ 83 if ((dev = open("/dev/npf", O_RDWR)) == -1) { 84 maybe_syslog(LOG_ERR, "Cannot open /dev/npf: %m"); 85 return 0; 86 } 87 if (npf_nat_lookup(dev, af, addr, port, IPPROTO_TCP, PFIL_OUT) == -1) { 88 maybe_syslog(LOG_ERR, "NAT lookup failure: %m"); 89 (void)close(dev); 90 return 0; 91 } 92 (void)close(dev); 93 94 /* 95 * The originating address is already set into nat_addr so fill 96 * in the rest, family, port (ident), len.... 97 */ 98 switch (af) { 99 case AF_INET: 100 satosin(nat_addr)->sin_port = htons(113); 101 satosin(nat_addr)->sin_len = sizeof(struct sockaddr_in); 102 satosin(nat_addr)->sin_family = AF_INET; 103 break; 104 case AF_INET6: 105 satosin6(nat_addr)->sin6_port = htons(113); 106 satosin6(nat_addr)->sin6_len = sizeof(struct sockaddr_in6); 107 satosin6(nat_addr)->sin6_family = AF_INET6; 108 break; 109 } 110 /* Put the originating port into nat_lport. */ 111 *nat_lport = ntohs(port[0]); 112 113 return 1; 114} 115