Gitiles
Code Review Sign In
code.illumos.org / illumos-gate / f4b3ec61df05330d25f55a36b975b4d7519fdeb1 / . / usr / src / uts / common / inet / ipf / ip_nat.c
blob: 8eaa4fe89976a2fe047401c501f2c46e8fccebfb [file] [log] [blame]
/*
* Copyright (C) 1995-2003 by Darren Reed.
*
* See the IPFILTER.LICENCE file for details on licencing.
*
* Copyright 2007 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#pragma ident "%Z%%M% %I% %E% SMI"
#if defined(KERNEL) || defined(_KERNEL)
# undef KERNEL
# undef _KERNEL
# define KERNEL 1
# define _KERNEL 1
#endif
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/param.h>
#include <sys/time.h>
#include <sys/file.h>
#if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
defined(_KERNEL)
# include "opt_ipfilter_log.h"
#endif
#if !defined(_KERNEL)
# include <stdio.h>
# include <string.h>
# include <stdlib.h>
# define _KERNEL
# ifdef __OpenBSD__
struct file;
# endif
# include <sys/uio.h>
# undef _KERNEL
#endif
#if defined(_KERNEL) && (__FreeBSD_version >= 220000)
# include <sys/filio.h>
# include <sys/fcntl.h>
#else
# include <sys/ioctl.h>
#endif
#if !defined(AIX)
# include <sys/fcntl.h>
#endif
#if !defined(linux)
# include <sys/protosw.h>
#endif
#include <sys/socket.h>
#if defined(_KERNEL)
# include <sys/systm.h>
# if !defined(__SVR4) && !defined(__svr4__)
# include <sys/mbuf.h>
# endif
#endif
#if defined(__SVR4) || defined(__svr4__)
# include <sys/filio.h>
# include <sys/byteorder.h>
# ifdef _KERNEL
# include <sys/dditypes.h>
# endif
# include <sys/stream.h>
# include <sys/kmem.h>
#endif
#if __FreeBSD_version >= 300000
# include <sys/queue.h>
#endif
#include <net/if.h>
#if __FreeBSD_version >= 300000
# include <net/if_var.h>
# if defined(_KERNEL) && !defined(IPFILTER_LKM)
# include "opt_ipfilter.h"
# endif
#endif
#ifdef sun
# include <net/af.h>
#endif
#include <net/route.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#ifdef RFC1825
# include <vpn/md5.h>
# include <vpn/ipsec.h>
extern struct ifnet vpnif;
#endif
#if !defined(linux)
# include <netinet/ip_var.h>
#endif
#include <netinet/tcp.h>
#include <netinet/udp.h>
#include <netinet/ip_icmp.h>
#include "netinet/ip_compat.h"
#include <netinet/tcpip.h>
#include "netinet/ip_fil.h"
#include "netinet/ip_nat.h"
#include "netinet/ip_frag.h"
#include "netinet/ip_state.h"
#include "netinet/ip_proxy.h"
#include "netinet/ipf_stack.h"
#ifdef IPFILTER_SYNC
#include "netinet/ip_sync.h"
#endif
#if (__FreeBSD_version >= 300000)
# include <sys/malloc.h>
#endif
/* END OF INCLUDES */
#undef SOCKADDR_IN
#define SOCKADDR_IN struct sockaddr_in
#if !defined(lint)
static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.195.2.42 2005/08/11 19:51:36 darrenr Exp $";
#endif
/* ======================================================================== */
/* How the NAT is organised and works. */
/* */
/* Inside (interface y) NAT Outside (interface x) */
/* -------------------- -+- ------------------------------------- */
/* Packet going | out, processsed by fr_checknatout() for x */
/* ------------> | ------------> */
/* src=10.1.1.1 | src=192.1.1.1 */
/* | */
/* | in, processed by fr_checknatin() for x */
/* <------------ | <------------ */
/* dst=10.1.1.1 | dst=192.1.1.1 */
/* -------------------- -+- ------------------------------------- */
/* fr_checknatout() - changes ip_src and if required, sport */
/* - creates a new mapping, if required. */
/* fr_checknatin() - changes ip_dst and if required, dport */
/* */
/* In the NAT table, internal source is recorded as "in" and externally */
/* seen as "out". */
/* ======================================================================== */
static int nat_flushtable __P((ipf_stack_t *));
static int nat_clearlist __P((ipf_stack_t *));
static void nat_addnat __P((struct ipnat *, ipf_stack_t *));
static void nat_addrdr __P((struct ipnat *, ipf_stack_t *));
static void nat_delete __P((struct nat *, int, ipf_stack_t *));
static void nat_delrdr __P((struct ipnat *));
static void nat_delnat __P((struct ipnat *));
static int fr_natgetent __P((caddr_t, ipf_stack_t *));
static int fr_natgetsz __P((caddr_t, ipf_stack_t *));
static int fr_natputent __P((caddr_t, int, ipf_stack_t *));
static void nat_tabmove __P((nat_t *, ipf_stack_t *));
static int nat_match __P((fr_info_t *, ipnat_t *));
static INLINE int nat_newmap __P((fr_info_t *, nat_t *, natinfo_t *));
static INLINE int nat_newrdr __P((fr_info_t *, nat_t *, natinfo_t *));
static hostmap_t *nat_hostmap __P((ipnat_t *, struct in_addr,
struct in_addr, struct in_addr, u_32_t,
ipf_stack_t *));
static void nat_hostmapdel __P((struct hostmap *));
static INLINE int nat_icmpquerytype4 __P((int));
static int nat_siocaddnat __P((ipnat_t *, ipnat_t **, int,
ipf_stack_t *));
static void nat_siocdelnat __P((ipnat_t *, ipnat_t **, int,
ipf_stack_t *));
static INLINE int nat_icmperrortype4 __P((int));
static INLINE int nat_finalise __P((fr_info_t *, nat_t *, natinfo_t *,
tcphdr_t *, nat_t **, int));
static INLINE void nat_resolverule __P((ipnat_t *, ipf_stack_t *));
static nat_t *fr_natclone __P((fr_info_t *, nat_t *));
static void nat_mssclamp __P((tcphdr_t *, u_32_t, u_short *));
static INLINE int nat_wildok __P((nat_t *, int, int, int, int));
static int nat_getnext __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *));
static int nat_iterator __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *));
/* ------------------------------------------------------------------------ */
/* Function: fr_natinit */
/* Returns: int - 0 == success, -1 == failure */
/* Parameters: Nil */
/* */
/* Initialise all of the NAT locks, tables and other structures. */
/* ------------------------------------------------------------------------ */
int fr_natinit(ifs)
ipf_stack_t *ifs;
{
int i;
ifs->ifs_ipf_nattable_sz = NAT_TABLE_SZ;
ifs->ifs_ipf_nattable_max = NAT_TABLE_MAX;
ifs->ifs_ipf_natrules_sz = NAT_SIZE;
ifs->ifs_ipf_rdrrules_sz = RDR_SIZE;
ifs->ifs_ipf_hostmap_sz = HOSTMAP_SIZE;
ifs->ifs_fr_nat_maxbucket_reset = 1;
#ifdef IPFILTER_LOG
ifs->ifs_nat_logging = 1;
#else
ifs->ifs_nat_logging = 0;
#endif
ifs->ifs_fr_defnatage = DEF_NAT_AGE;
ifs->ifs_fr_defnatipage = 120; /* 60 seconds */
ifs->ifs_fr_defnaticmpage = 6; /* 3 seconds */
KMALLOCS(ifs->ifs_nat_table[0], nat_t **,
sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz);
if (ifs->ifs_nat_table[0] != NULL)
bzero((char *)ifs->ifs_nat_table[0],
ifs->ifs_ipf_nattable_sz * sizeof(nat_t *));
else
return -1;
KMALLOCS(ifs->ifs_nat_table[1], nat_t **,
sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz);
if (ifs->ifs_nat_table[1] != NULL)
bzero((char *)ifs->ifs_nat_table[1],
ifs->ifs_ipf_nattable_sz * sizeof(nat_t *));
else
return -2;
KMALLOCS(ifs->ifs_nat_rules, ipnat_t **,
sizeof(ipnat_t *) * ifs->ifs_ipf_natrules_sz);
if (ifs->ifs_nat_rules != NULL)
bzero((char *)ifs->ifs_nat_rules,
ifs->ifs_ipf_natrules_sz * sizeof(ipnat_t *));
else
return -3;
KMALLOCS(ifs->ifs_rdr_rules, ipnat_t **,
sizeof(ipnat_t *) * ifs->ifs_ipf_rdrrules_sz);
if (ifs->ifs_rdr_rules != NULL)
bzero((char *)ifs->ifs_rdr_rules,
ifs->ifs_ipf_rdrrules_sz * sizeof(ipnat_t *));
else
return -4;
KMALLOCS(ifs->ifs_maptable, hostmap_t **,
sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz);
if (ifs->ifs_maptable != NULL)
bzero((char *)ifs->ifs_maptable,
sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz);
else
return -5;
ifs->ifs_ipf_hm_maplist = NULL;
KMALLOCS(ifs->ifs_nat_stats.ns_bucketlen[0], u_long *,
ifs->ifs_ipf_nattable_sz * sizeof(u_long));
if (ifs->ifs_nat_stats.ns_bucketlen[0] == NULL)
return -1;
bzero((char *)ifs->ifs_nat_stats.ns_bucketlen[0],
ifs->ifs_ipf_nattable_sz * sizeof(u_long));
KMALLOCS(ifs->ifs_nat_stats.ns_bucketlen[1], u_long *,
ifs->ifs_ipf_nattable_sz * sizeof(u_long));
if (ifs->ifs_nat_stats.ns_bucketlen[1] == NULL)
return -1;
bzero((char *)ifs->ifs_nat_stats.ns_bucketlen[1],
ifs->ifs_ipf_nattable_sz * sizeof(u_long));
if (ifs->ifs_fr_nat_maxbucket == 0) {
for (i = ifs->ifs_ipf_nattable_sz; i > 0; i >>= 1)
ifs->ifs_fr_nat_maxbucket++;
ifs->ifs_fr_nat_maxbucket *= 2;
}
fr_sttab_init(ifs->ifs_nat_tqb, ifs);
/*
* Increase this because we may have "keep state" following this too
* and packet storms can occur if this is removed too quickly.
*/
ifs->ifs_nat_tqb[IPF_TCPS_CLOSED].ifq_ttl = ifs->ifs_fr_tcplastack;
ifs->ifs_nat_tqb[IPF_TCP_NSTATES - 1].ifq_next = &ifs->ifs_nat_udptq;
ifs->ifs_nat_udptq.ifq_ttl = ifs->ifs_fr_defnatage;
ifs->ifs_nat_udptq.ifq_ref = 1;
ifs->ifs_nat_udptq.ifq_head = NULL;
ifs->ifs_nat_udptq.ifq_tail = &ifs->ifs_nat_udptq.ifq_head;
MUTEX_INIT(&ifs->ifs_nat_udptq.ifq_lock, "nat ipftq udp tab");
ifs->ifs_nat_udptq.ifq_next = &ifs->ifs_nat_icmptq;
ifs->ifs_nat_icmptq.ifq_ttl = ifs->ifs_fr_defnaticmpage;
ifs->ifs_nat_icmptq.ifq_ref = 1;
ifs->ifs_nat_icmptq.ifq_head = NULL;
ifs->ifs_nat_icmptq.ifq_tail = &ifs->ifs_nat_icmptq.ifq_head;
MUTEX_INIT(&ifs->ifs_nat_icmptq.ifq_lock, "nat icmp ipftq tab");
ifs->ifs_nat_icmptq.ifq_next = &ifs->ifs_nat_iptq;
ifs->ifs_nat_iptq.ifq_ttl = ifs->ifs_fr_defnatipage;
ifs->ifs_nat_iptq.ifq_ref = 1;
ifs->ifs_nat_iptq.ifq_head = NULL;
ifs->ifs_nat_iptq.ifq_tail = &ifs->ifs_nat_iptq.ifq_head;
MUTEX_INIT(&ifs->ifs_nat_iptq.ifq_lock, "nat ip ipftq tab");
ifs->ifs_nat_iptq.ifq_next = NULL;
for (i = 0; i < IPF_TCP_NSTATES; i++) {
if (ifs->ifs_nat_tqb[i].ifq_ttl < ifs->ifs_fr_defnaticmpage)
ifs->ifs_nat_tqb[i].ifq_ttl = ifs->ifs_fr_defnaticmpage;
#ifdef LARGE_NAT
else if (ifs->ifs_nat_tqb[i].ifq_ttl > ifs->ifs_fr_defnatage)
ifs->ifs_nat_tqb[i].ifq_ttl = ifs->ifs_fr_defnatage;
#endif
}
/*
* Increase this because we may have "keep state" following
* this too and packet storms can occur if this is removed
* too quickly.
*/
ifs->ifs_nat_tqb[IPF_TCPS_CLOSED].ifq_ttl =
ifs->ifs_nat_tqb[IPF_TCPS_LAST_ACK].ifq_ttl;
RWLOCK_INIT(&ifs->ifs_ipf_nat, "ipf IP NAT rwlock");
RWLOCK_INIT(&ifs->ifs_ipf_natfrag, "ipf IP NAT-Frag rwlock");
MUTEX_INIT(&ifs->ifs_ipf_nat_new, "ipf nat new mutex");
MUTEX_INIT(&ifs->ifs_ipf_natio, "ipf nat io mutex");
ifs->ifs_fr_nat_init = 1;
return 0;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_addrdr */
/* Returns: Nil */
/* Parameters: n(I) - pointer to NAT rule to add */
/* */
/* Adds a redirect rule to the hash table of redirect rules and the list of */
/* loaded NAT rules. Updates the bitmask indicating which netmasks are in */
/* use by redirect rules. */
/* ------------------------------------------------------------------------ */
static void nat_addrdr(n, ifs)
ipnat_t *n;
ipf_stack_t *ifs;
{
ipnat_t **np;
u_32_t j;
u_int hv;
int k;
k = count4bits(n->in_outmsk);
if ((k >= 0) && (k != 32))
ifs->ifs_rdr_masks |= 1 << k;
j = (n->in_outip & n->in_outmsk);
hv = NAT_HASH_FN(j, 0, ifs->ifs_ipf_rdrrules_sz);
np = ifs->ifs_rdr_rules + hv;
while (*np != NULL)
np = &(*np)->in_rnext;
n->in_rnext = NULL;
n->in_prnext = np;
n->in_hv = hv;
*np = n;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_addnat */
/* Returns: Nil */
/* Parameters: n(I) - pointer to NAT rule to add */
/* */
/* Adds a NAT map rule to the hash table of rules and the list of loaded */
/* NAT rules. Updates the bitmask indicating which netmasks are in use by */
/* redirect rules. */
/* ------------------------------------------------------------------------ */
static void nat_addnat(n, ifs)
ipnat_t *n;
ipf_stack_t *ifs;
{
ipnat_t **np;
u_32_t j;
u_int hv;
int k;
k = count4bits(n->in_inmsk);
if ((k >= 0) && (k != 32))
ifs->ifs_nat_masks |= 1 << k;
j = (n->in_inip & n->in_inmsk);
hv = NAT_HASH_FN(j, 0, ifs->ifs_ipf_natrules_sz);
np = ifs->ifs_nat_rules + hv;
while (*np != NULL)
np = &(*np)->in_mnext;
n->in_mnext = NULL;
n->in_pmnext = np;
n->in_hv = hv;
*np = n;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_delrdr */
/* Returns: Nil */
/* Parameters: n(I) - pointer to NAT rule to delete */
/* */
/* Removes a redirect rule from the hash table of redirect rules. */
/* ------------------------------------------------------------------------ */
static void nat_delrdr(n)
ipnat_t *n;
{
if (n->in_rnext)
n->in_rnext->in_prnext = n->in_prnext;
*n->in_prnext = n->in_rnext;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_delnat */
/* Returns: Nil */
/* Parameters: n(I) - pointer to NAT rule to delete */
/* */
/* Removes a NAT map rule from the hash table of NAT map rules. */
/* ------------------------------------------------------------------------ */
static void nat_delnat(n)
ipnat_t *n;
{
if (n->in_mnext != NULL)
n->in_mnext->in_pmnext = n->in_pmnext;
*n->in_pmnext = n->in_mnext;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_hostmap */
/* Returns: struct hostmap* - NULL if no hostmap could be created, */
/* else a pointer to the hostmapping to use */
/* Parameters: np(I) - pointer to NAT rule */
/* real(I) - real IP address */
/* map(I) - mapped IP address */
/* port(I) - destination port number */
/* Write Locks: ipf_nat */
/* */
/* Check if an ip address has already been allocated for a given mapping */
/* that is not doing port based translation. If is not yet allocated, then */
/* create a new entry if a non-NULL NAT rule pointer has been supplied. */
/* ------------------------------------------------------------------------ */
static struct hostmap *nat_hostmap(np, src, dst, map, port, ifs)
ipnat_t *np;
struct in_addr src;
struct in_addr dst;
struct in_addr map;
u_32_t port;
ipf_stack_t *ifs;
{
hostmap_t *hm;
u_int hv;
hv = (src.s_addr ^ dst.s_addr);
hv += src.s_addr;
hv += dst.s_addr;
hv %= HOSTMAP_SIZE;
for (hm = ifs->ifs_maptable[hv]; hm; hm = hm->hm_next)
if ((hm->hm_srcip.s_addr == src.s_addr) &&
(hm->hm_dstip.s_addr == dst.s_addr) &&
((np == NULL) || (np == hm->hm_ipnat)) &&
((port == 0) || (port == hm->hm_port))) {
hm->hm_ref++;
return hm;
}
if (np == NULL)
return NULL;
KMALLOC(hm, hostmap_t *);
if (hm) {
hm->hm_hnext = ifs->ifs_ipf_hm_maplist;
hm->hm_phnext = &ifs->ifs_ipf_hm_maplist;
if (ifs->ifs_ipf_hm_maplist != NULL)
ifs->ifs_ipf_hm_maplist->hm_phnext = &hm->hm_hnext;
ifs->ifs_ipf_hm_maplist = hm;
hm->hm_next = ifs->ifs_maptable[hv];
hm->hm_pnext = ifs->ifs_maptable + hv;
if (ifs->ifs_maptable[hv] != NULL)
ifs->ifs_maptable[hv]->hm_pnext = &hm->hm_next;
ifs->ifs_maptable[hv] = hm;
hm->hm_ipnat = np;
hm->hm_srcip = src;
hm->hm_dstip = dst;
hm->hm_mapip = map;
hm->hm_ref = 1;
hm->hm_port = port;
}
return hm;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_hostmapdel */
/* Returns: Nil */
/* Parameters: hm(I) - pointer to hostmap structure */
/* Write Locks: ipf_nat */
/* */
/* Decrement the references to this hostmap structure by one. If this */
/* reaches zero then remove it and free it. */
/* ------------------------------------------------------------------------ */
static void nat_hostmapdel(hm)
struct hostmap *hm;
{
hm->hm_ref--;
if (hm->hm_ref == 0) {
if (hm->hm_next)
hm->hm_next->hm_pnext = hm->hm_pnext;
*hm->hm_pnext = hm->hm_next;
if (hm->hm_hnext)
hm->hm_hnext->hm_phnext = hm->hm_phnext;
*hm->hm_phnext = hm->hm_hnext;
KFREE(hm);
}
}
void fr_hostmapderef(hmp)
struct hostmap **hmp;
{
struct hostmap *hm;
hm = *hmp;
*hmp = NULL;
hm->hm_ref--;
if (hm->hm_ref == 0)
nat_hostmapdel(hm);
}
/* ------------------------------------------------------------------------ */
/* Function: fix_outcksum */
/* Returns: Nil */
/* Parameters: sp(I) - location of 16bit checksum to update */
/* n((I) - amount to adjust checksum by */
/* */
/* Adjusts the 16bit checksum by "n" for packets going out. */
/* ------------------------------------------------------------------------ */
void fix_outcksum(sp, n)
u_short *sp;
u_32_t n;
{
u_short sumshort;
u_32_t sum1;
if (n == 0)
return;
sum1 = (~ntohs(*sp)) & 0xffff;
sum1 += (n);
sum1 = (sum1 >> 16) + (sum1 & 0xffff);
/* Again */
sum1 = (sum1 >> 16) + (sum1 & 0xffff);
sumshort = ~(u_short)sum1;
*(sp) = htons(sumshort);
}
/* ------------------------------------------------------------------------ */
/* Function: fix_incksum */
/* Returns: Nil */
/* Parameters: sp(I) - location of 16bit checksum to update */
/* n((I) - amount to adjust checksum by */
/* */
/* Adjusts the 16bit checksum by "n" for packets going in. */
/* ------------------------------------------------------------------------ */
void fix_incksum(sp, n)
u_short *sp;
u_32_t n;
{
u_short sumshort;
u_32_t sum1;
if (n == 0)
return;
sum1 = (~ntohs(*sp)) & 0xffff;
sum1 += ~(n) & 0xffff;
sum1 = (sum1 >> 16) + (sum1 & 0xffff);
/* Again */
sum1 = (sum1 >> 16) + (sum1 & 0xffff);
sumshort = ~(u_short)sum1;
*(sp) = htons(sumshort);
}
/* ------------------------------------------------------------------------ */
/* Function: fix_datacksum */
/* Returns: Nil */
/* Parameters: sp(I) - location of 16bit checksum to update */
/* n((I) - amount to adjust checksum by */
/* */
/* Fix_datacksum is used *only* for the adjustments of checksums in the */
/* data section of an IP packet. */
/* */
/* The only situation in which you need to do this is when NAT'ing an */
/* ICMP error message. Such a message, contains in its body the IP header */
/* of the original IP packet, that causes the error. */
/* */
/* You can't use fix_incksum or fix_outcksum in that case, because for the */
/* kernel the data section of the ICMP error is just data, and no special */
/* processing like hardware cksum or ntohs processing have been done by the */
/* kernel on the data section. */
/* ------------------------------------------------------------------------ */
void fix_datacksum(sp, n)
u_short *sp;
u_32_t n;
{
u_short sumshort;
u_32_t sum1;
if (n == 0)
return;
sum1 = (~ntohs(*sp)) & 0xffff;
sum1 += (n);
sum1 = (sum1 >> 16) + (sum1 & 0xffff);
/* Again */
sum1 = (sum1 >> 16) + (sum1 & 0xffff);
sumshort = ~(u_short)sum1;
*(sp) = htons(sumshort);
}
/* ------------------------------------------------------------------------ */
/* Function: fr_nat_ioctl */
/* Returns: int - 0 == success, != 0 == failure */
/* Parameters: data(I) - pointer to ioctl data */
/* cmd(I) - ioctl command integer */
/* mode(I) - file mode bits used with open */
/* */
/* Processes an ioctl call made to operate on the IP Filter NAT device. */
/* ------------------------------------------------------------------------ */
int fr_nat_ioctl(data, cmd, mode, uid, ctx, ifs)
ioctlcmd_t cmd;
caddr_t data;
int mode, uid;
void *ctx;
ipf_stack_t *ifs;
{
ipnat_t *nat, *nt, *n = NULL, **np = NULL;
int error = 0, ret, arg, getlock;
ipnat_t natd;
#if (BSD >= 199306) && defined(_KERNEL)
if ((securelevel >= 2) && (mode & FWRITE))
return EPERM;
#endif
#if defined(__osf__) && defined(_KERNEL)
getlock = 0;
#else
getlock = (mode & NAT_LOCKHELD) ? 0 : 1;
#endif
nat = NULL; /* XXX gcc -Wuninitialized */
if (cmd == (ioctlcmd_t)SIOCADNAT) {
KMALLOC(nt, ipnat_t *);
} else {
nt = NULL;
}
if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) {
if (mode & NAT_SYSSPACE) {
bcopy(data, (char *)&natd, sizeof(natd));
error = 0;
} else {
error = fr_inobj(data, &natd, IPFOBJ_IPNAT);
}
} else if (cmd == (ioctlcmd_t)SIOCIPFFL) { /* SIOCFLNAT & SIOCCNATL */
BCOPYIN(data, &arg, sizeof(arg));
}
if (error != 0)
goto done;
/*
* For add/delete, look to see if the NAT entry is already present
*/
if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) {
nat = &natd;
if (nat->in_v == 0) /* For backward compat. */
nat->in_v = 4;
nat->in_flags &= IPN_USERFLAGS;
if ((nat->in_redir & NAT_MAPBLK) == 0) {
if ((nat->in_flags & IPN_SPLIT) == 0)
nat->in_inip &= nat->in_inmsk;
if ((nat->in_flags & IPN_IPRANGE) == 0)
nat->in_outip &= nat->in_outmsk;
}
MUTEX_ENTER(&ifs->ifs_ipf_natio);
for (np = &ifs->ifs_nat_list; ((n = *np) != NULL);
np = &n->in_next)
if (!bcmp((char *)&nat->in_flags, (char *)&n->in_flags,
IPN_CMPSIZ))
break;
}
switch (cmd)
{
case SIOCGENITER :
{
ipfgeniter_t iter;
ipftoken_t *token;
error = fr_inobj(data, &iter, IPFOBJ_GENITER);
if (error != 0)
break;
token = ipf_findtoken(iter.igi_type, uid, ctx, ifs);
if (token != NULL)
error = nat_iterator(token, &iter, ifs);
else
error = ESRCH;
RWLOCK_EXIT(&ifs->ifs_ipf_tokens);
break;
}
#ifdef IPFILTER_LOG
case SIOCIPFFB :
{
int tmp;
if (!(mode & FWRITE))
error = EPERM;
else {
tmp = ipflog_clear(IPL_LOGNAT, ifs);
BCOPYOUT((char *)&tmp, (char *)data, sizeof(tmp));
}
break;
}
case SIOCSETLG :
if (!(mode & FWRITE))
error = EPERM;
else {
BCOPYIN((char *)data,
(char *)&ifs->ifs_nat_logging,
sizeof(ifs->ifs_nat_logging));
}
break;
case SIOCGETLG :
BCOPYOUT((char *)&ifs->ifs_nat_logging, (char *)data,
sizeof(ifs->ifs_nat_logging));
break;
case FIONREAD :
arg = ifs->ifs_iplused[IPL_LOGNAT];
BCOPYOUT(&arg, data, sizeof(arg));
break;
#endif
case SIOCADNAT :
if (!(mode & FWRITE)) {
error = EPERM;
} else if (n != NULL) {
error = EEXIST;
} else if (nt == NULL) {
error = ENOMEM;
}
if (error != 0) {
MUTEX_EXIT(&ifs->ifs_ipf_natio);
break;
}
bcopy((char *)nat, (char *)nt, sizeof(*n));
error = nat_siocaddnat(nt, np, getlock, ifs);
MUTEX_EXIT(&ifs->ifs_ipf_natio);
if (error == 0)
nt = NULL;
break;
case SIOCRMNAT :
if (!(mode & FWRITE)) {
error = EPERM;
n = NULL;
} else if (n == NULL) {
error = ESRCH;
}
if (error != 0) {
MUTEX_EXIT(&ifs->ifs_ipf_natio);
break;
}
nat_siocdelnat(n, np, getlock, ifs);
MUTEX_EXIT(&ifs->ifs_ipf_natio);
n = NULL;
break;
case SIOCGNATS :
ifs->ifs_nat_stats.ns_table[0] = ifs->ifs_nat_table[0];
ifs->ifs_nat_stats.ns_table[1] = ifs->ifs_nat_table[1];
ifs->ifs_nat_stats.ns_list = ifs->ifs_nat_list;
ifs->ifs_nat_stats.ns_maptable = ifs->ifs_maptable;
ifs->ifs_nat_stats.ns_maplist = ifs->ifs_ipf_hm_maplist;
ifs->ifs_nat_stats.ns_nattab_max = ifs->ifs_ipf_nattable_max;
ifs->ifs_nat_stats.ns_nattab_sz = ifs->ifs_ipf_nattable_sz;
ifs->ifs_nat_stats.ns_rultab_sz = ifs->ifs_ipf_natrules_sz;
ifs->ifs_nat_stats.ns_rdrtab_sz = ifs->ifs_ipf_rdrrules_sz;
ifs->ifs_nat_stats.ns_hostmap_sz = ifs->ifs_ipf_hostmap_sz;
ifs->ifs_nat_stats.ns_instances = ifs->ifs_nat_instances;
ifs->ifs_nat_stats.ns_apslist = ifs->ifs_ap_sess_list;
error = fr_outobj(data, &ifs->ifs_nat_stats, IPFOBJ_NATSTAT);
break;
case SIOCGNATL :
{
natlookup_t nl;
if (getlock) {
READ_ENTER(&ifs->ifs_ipf_nat);
}
error = fr_inobj(data, &nl, IPFOBJ_NATLOOKUP);
if (error == 0) {
if (nat_lookupredir(&nl, ifs) != NULL) {
error = fr_outobj(data, &nl, IPFOBJ_NATLOOKUP);
} else {
error = ESRCH;
}
}
if (getlock) {
RWLOCK_EXIT(&ifs->ifs_ipf_nat);
}
break;
}
case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */
if (!(mode & FWRITE)) {
error = EPERM;
break;
}
if (getlock) {
WRITE_ENTER(&ifs->ifs_ipf_nat);
}
error = 0;
if (arg == 0)
ret = nat_flushtable(ifs);
else if (arg == 1)
ret = nat_clearlist(ifs);
else
error = EINVAL;
if (getlock) {
RWLOCK_EXIT(&ifs->ifs_ipf_nat);
}
if (error == 0) {
BCOPYOUT(&ret, data, sizeof(ret));
}
break;
case SIOCPROXY :
error = appr_ioctl(data, cmd, mode, ifs);
break;
case SIOCSTLCK :
if (!(mode & FWRITE)) {
error = EPERM;
} else {
fr_lock(data, &ifs->ifs_fr_nat_lock);
}
break;
case SIOCSTPUT :
if ((mode & FWRITE) != 0) {
error = fr_natputent(data, getlock, ifs);
} else {
error = EACCES;
}
break;
case SIOCSTGSZ :
if (ifs->ifs_fr_nat_lock) {
if (getlock) {
READ_ENTER(&ifs->ifs_ipf_nat);
}
error = fr_natgetsz(data, ifs);
if (getlock) {
RWLOCK_EXIT(&ifs->ifs_ipf_nat);
}
} else
error = EACCES;
break;
case SIOCSTGET :
if (ifs->ifs_fr_nat_lock) {
if (getlock) {
READ_ENTER(&ifs->ifs_ipf_nat);
}
error = fr_natgetent(data, ifs);
if (getlock) {
RWLOCK_EXIT(&ifs->ifs_ipf_nat);
}
} else
error = EACCES;
break;
case SIOCIPFDELTOK :
(void) BCOPYIN((caddr_t)data, (caddr_t)&arg, sizeof(arg));
error = ipf_deltoken(arg, uid, ctx, ifs);
break;
default :
error = EINVAL;
break;
}
done:
if (nt)
KFREE(nt);
return error;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_siocaddnat */
/* Returns: int - 0 == success, != 0 == failure */
/* Parameters: n(I) - pointer to new NAT rule */
/* np(I) - pointer to where to insert new NAT rule */
/* getlock(I) - flag indicating if lock on ipf_nat is held */
/* Mutex Locks: ipf_natio */
/* */
/* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
/* from information passed to the kernel, then add it to the appropriate */
/* NAT rule table(s). */
/* ------------------------------------------------------------------------ */
static int nat_siocaddnat(n, np, getlock, ifs)
ipnat_t *n, **np;
int getlock;
ipf_stack_t *ifs;
{
int error = 0, i, j;
nat_resolverule(n, ifs);
if (n->in_plabel[0] != '\0') {
if (n->in_apr == NULL)
return ENOENT;
}
if ((n->in_age[0] == 0) && (n->in_age[1] != 0))
return EINVAL;
n->in_use = 0;
if (n->in_redir & NAT_MAPBLK)
n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk);
else if (n->in_flags & IPN_AUTOPORTMAP)
n->in_space = USABLE_PORTS * ~ntohl(n->in_inmsk);
else if (n->in_flags & IPN_IPRANGE)
n->in_space = ntohl(n->in_outmsk) - ntohl(n->in_outip);
else if (n->in_flags & IPN_SPLIT)
n->in_space = 2;
else if (n->in_outmsk != 0)
n->in_space = ~ntohl(n->in_outmsk);
else
n->in_space = 1;
/*
* Calculate the number of valid IP addresses in the output
* mapping range. In all cases, the range is inclusive of
* the start and ending IP addresses.
* If to a CIDR address, lose 2: broadcast + network address
* (so subtract 1)
* If to a range, add one.
* If to a single IP address, set to 1.
*/
if (n->in_space) {
if ((n->in_flags & IPN_IPRANGE) != 0)
n->in_space += 1;
else
n->in_space -= 1;
} else
n->in_space = 1;
if ((n->in_outmsk != 0xffffffff) && (n->in_outmsk != 0) &&
((n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0))
n->in_nip = ntohl(n->in_outip) + 1;
else if ((n->in_flags & IPN_SPLIT) &&
(n->in_redir & NAT_REDIRECT))
n->in_nip = ntohl(n->in_inip);
else
n->in_nip = ntohl(n->in_outip);
if (n->in_redir & NAT_MAP) {
n->in_pnext = ntohs(n->in_pmin);
/*
* Multiply by the number of ports made available.
*/
if (ntohs(n->in_pmax) >= ntohs(n->in_pmin)) {
n->in_space *= (ntohs(n->in_pmax) -
ntohs(n->in_pmin) + 1);
/*
* Because two different sources can map to
* different destinations but use the same
* local IP#/port #.
* If the result is smaller than in_space, then
* we may have wrapped around 32bits.
*/
i = n->in_inmsk;
if ((i != 0) && (i != 0xffffffff)) {
j = n->in_space * (~ntohl(i) + 1);
if (j >= n->in_space)
n->in_space = j;
else
n->in_space = 0xffffffff;
}
}
/*
* If no protocol is specified, multiple by 256 to allow for
* at least one IP:IP mapping per protocol.
*/
if ((n->in_flags & IPN_TCPUDPICMP) == 0) {
j = n->in_space * 256;
if (j >= n->in_space)
n->in_space = j;
else
n->in_space = 0xffffffff;
}
}
/* Otherwise, these fields are preset */
if (getlock) {
WRITE_ENTER(&ifs->ifs_ipf_nat);
}
n->in_next = NULL;
*np = n;
if (n->in_age[0] != 0)
n->in_tqehead[0] = fr_addtimeoutqueue(&ifs->ifs_nat_utqe,
n->in_age[0], ifs);
if (n->in_age[1] != 0)
n->in_tqehead[1] = fr_addtimeoutqueue(&ifs->ifs_nat_utqe,
n->in_age[1], ifs);
if (n->in_redir & NAT_REDIRECT) {
n->in_flags &= ~IPN_NOTDST;
nat_addrdr(n, ifs);
}
if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
n->in_flags &= ~IPN_NOTSRC;
nat_addnat(n, ifs);
}
n = NULL;
ifs->ifs_nat_stats.ns_rules++;
if (getlock) {
RWLOCK_EXIT(&ifs->ifs_ipf_nat); /* WRITE */
}
return error;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_resolvrule */
/* Returns: Nil */
/* Parameters: n(I) - pointer to NAT rule */
/* */
/* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
/* from information passed to the kernel, then add it to the appropriate */
/* NAT rule table(s). */
/* ------------------------------------------------------------------------ */
static void nat_resolverule(n, ifs)
ipnat_t *n;
ipf_stack_t *ifs;
{
n->in_ifnames[0][LIFNAMSIZ - 1] = '\0';
n->in_ifps[0] = fr_resolvenic(n->in_ifnames[0], 4, ifs);
n->in_ifnames[1][LIFNAMSIZ - 1] = '\0';
if (n->in_ifnames[1][0] == '\0') {
(void) strncpy(n->in_ifnames[1], n->in_ifnames[0], LIFNAMSIZ);
n->in_ifps[1] = n->in_ifps[0];
} else {
n->in_ifps[1] = fr_resolvenic(n->in_ifnames[0], 4, ifs);
}
if (n->in_plabel[0] != '\0') {
n->in_apr = appr_lookup(n->in_p, n->in_plabel, ifs);
}
}
/* ------------------------------------------------------------------------ */
/* Function: nat_siocdelnat */
/* Returns: int - 0 == success, != 0 == failure */
/* Parameters: n(I) - pointer to new NAT rule */
/* np(I) - pointer to where to insert new NAT rule */
/* getlock(I) - flag indicating if lock on ipf_nat is held */
/* Mutex Locks: ipf_natio */
/* */
/* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
/* from information passed to the kernel, then add it to the appropriate */
/* NAT rule table(s). */
/* ------------------------------------------------------------------------ */
static void nat_siocdelnat(n, np, getlock, ifs)
ipnat_t *n, **np;
int getlock;
ipf_stack_t *ifs;
{
if (getlock) {
WRITE_ENTER(&ifs->ifs_ipf_nat);
}
if (n->in_redir & NAT_REDIRECT)
nat_delrdr(n);
if (n->in_redir & (NAT_MAPBLK|NAT_MAP))
nat_delnat(n);
if (ifs->ifs_nat_list == NULL) {
ifs->ifs_nat_masks = 0;
ifs->ifs_rdr_masks = 0;
}
if (n->in_tqehead[0] != NULL) {
if (fr_deletetimeoutqueue(n->in_tqehead[0]) == 0) {
fr_freetimeoutqueue(n->in_tqehead[1], ifs);
}
}
if (n->in_tqehead[1] != NULL) {
if (fr_deletetimeoutqueue(n->in_tqehead[1]) == 0) {
fr_freetimeoutqueue(n->in_tqehead[1], ifs);
}
}
*np = n->in_next;
if (n->in_use == 0) {
if (n->in_apr)
appr_free(n->in_apr);
KFREE(n);
ifs->ifs_nat_stats.ns_rules--;
} else {
n->in_flags |= IPN_DELETE;
n->in_next = NULL;
}
if (getlock) {
RWLOCK_EXIT(&ifs->ifs_ipf_nat); /* READ/WRITE */
}
}
/* ------------------------------------------------------------------------ */
/* Function: fr_natgetsz */
/* Returns: int - 0 == success, != 0 is the error value. */
/* Parameters: data(I) - pointer to natget structure with kernel pointer */
/* get the size of. */
/* */
/* Handle SIOCSTGSZ. */
/* Return the size of the nat list entry to be copied back to user space. */
/* The size of the entry is stored in the ng_sz field and the enture natget */
/* structure is copied back to the user. */
/* ------------------------------------------------------------------------ */
static int fr_natgetsz(data, ifs)
caddr_t data;
ipf_stack_t *ifs;
{
ap_session_t *aps;
nat_t *nat, *n;
natget_t ng;
BCOPYIN(data, &ng, sizeof(ng));
nat = ng.ng_ptr;
if (!nat) {
nat = ifs->ifs_nat_instances;
ng.ng_sz = 0;
/*
* Empty list so the size returned is 0. Simple.
*/
if (nat == NULL) {
BCOPYOUT(&ng, data, sizeof(ng));
return 0;
}
} else {
/*
* Make sure the pointer we're copying from exists in the
* current list of entries. Security precaution to prevent
* copying of random kernel data.
*/
for (n = ifs->ifs_nat_instances; n; n = n->nat_next)
if (n == nat)
break;
if (!n)
return ESRCH;
}
/*
* Incluse any space required for proxy data structures.
*/
ng.ng_sz = sizeof(nat_save_t);
aps = nat->nat_aps;
if (aps != NULL) {
ng.ng_sz += sizeof(ap_session_t) - 4;
if (aps->aps_data != 0)
ng.ng_sz += aps->aps_psiz;
}
BCOPYOUT(&ng, data, sizeof(ng));
return 0;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_natgetent */
/* Returns: int - 0 == success, != 0 is the error value. */
/* Parameters: data(I) - pointer to natget structure with kernel pointer */
/* to NAT structure to copy out. */
/* */
/* Handle SIOCSTGET. */
/* Copies out NAT entry to user space. Any additional data held for a */
/* proxy is also copied, as to is the NAT rule which was responsible for it */
/* ------------------------------------------------------------------------ */
static int fr_natgetent(data, ifs)
caddr_t data;
ipf_stack_t *ifs;
{
int error, outsize;
ap_session_t *aps;
nat_save_t *ipn, ipns;
nat_t *n, *nat;
error = fr_inobj(data, &ipns, IPFOBJ_NATSAVE);
if (error != 0)
return error;
if ((ipns.ipn_dsize < sizeof(ipns)) || (ipns.ipn_dsize > 81920))
return EINVAL;
KMALLOCS(ipn, nat_save_t *, ipns.ipn_dsize);
if (ipn == NULL)
return ENOMEM;
ipn->ipn_dsize = ipns.ipn_dsize;
nat = ipns.ipn_next;
if (nat == NULL) {
nat = ifs->ifs_nat_instances;
if (nat == NULL) {
if (ifs->ifs_nat_instances == NULL)
error = ENOENT;
goto finished;
}
} else {
/*
* Make sure the pointer we're copying from exists in the
* current list of entries. Security precaution to prevent
* copying of random kernel data.
*/
for (n = ifs->ifs_nat_instances; n; n = n->nat_next)
if (n == nat)
break;
if (n == NULL) {
error = ESRCH;
goto finished;
}
}
ipn->ipn_next = nat->nat_next;
/*
* Copy the NAT structure.
*/
bcopy((char *)nat, &ipn->ipn_nat, sizeof(*nat));
/*
* If we have a pointer to the NAT rule it belongs to, save that too.
*/
if (nat->nat_ptr != NULL)
bcopy((char *)nat->nat_ptr, (char *)&ipn->ipn_ipnat,
sizeof(ipn->ipn_ipnat));
/*
* If we also know the NAT entry has an associated filter rule,
* save that too.
*/
if (nat->nat_fr != NULL)
bcopy((char *)nat->nat_fr, (char *)&ipn->ipn_fr,
sizeof(ipn->ipn_fr));
/*
* Last but not least, if there is an application proxy session set
* up for this NAT entry, then copy that out too, including any
* private data saved along side it by the proxy.
*/
aps = nat->nat_aps;
outsize = ipn->ipn_dsize - sizeof(*ipn) + sizeof(ipn->ipn_data);
if (aps != NULL) {
char *s;
if (outsize < sizeof(*aps)) {
error = ENOBUFS;
goto finished;
}
s = ipn->ipn_data;
bcopy((char *)aps, s, sizeof(*aps));
s += sizeof(*aps);
outsize -= sizeof(*aps);
if ((aps->aps_data != NULL) && (outsize >= aps->aps_psiz))
bcopy(aps->aps_data, s, aps->aps_psiz);
else
error = ENOBUFS;
}
if (error == 0) {
error = fr_outobjsz(data, ipn, IPFOBJ_NATSAVE, ipns.ipn_dsize);
}
finished:
if (ipn != NULL) {
KFREES(ipn, ipns.ipn_dsize);
}
return error;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_natputent */
/* Returns: int - 0 == success, != 0 is the error value. */
/* Parameters: data(I) - pointer to natget structure with NAT */
/* structure information to load into the kernel */
/* getlock(I) - flag indicating whether or not a write lock */
/* on ipf_nat is already held. */
/* */
/* Handle SIOCSTPUT. */
/* Loads a NAT table entry from user space, including a NAT rule, proxy and */
/* firewall rule data structures, if pointers to them indicate so. */
/* ------------------------------------------------------------------------ */
static int fr_natputent(data, getlock, ifs)
caddr_t data;
int getlock;
ipf_stack_t *ifs;
{
nat_save_t ipn, *ipnn;
ap_session_t *aps;
nat_t *n, *nat;
frentry_t *fr;
fr_info_t fin;
ipnat_t *in;
int error;
error = fr_inobj(data, &ipn, IPFOBJ_NATSAVE);
if (error != 0)
return error;
/*
* Initialise early because of code at junkput label.
*/
in = NULL;
aps = NULL;
nat = NULL;
ipnn = NULL;
/*
* New entry, copy in the rest of the NAT entry if it's size is more
* than just the nat_t structure.
*/
fr = NULL;
if (ipn.ipn_dsize > sizeof(ipn)) {
if (ipn.ipn_dsize > 81920) {
error = ENOMEM;
goto junkput;
}
KMALLOCS(ipnn, nat_save_t *, ipn.ipn_dsize);
if (ipnn == NULL)
return ENOMEM;
error = fr_inobjsz(data, ipnn, IPFOBJ_NATSAVE, ipn.ipn_dsize);
if (error != 0) {
error = EFAULT;
goto junkput;
}
} else
ipnn = &ipn;
KMALLOC(nat, nat_t *);
if (nat == NULL) {
error = ENOMEM;
goto junkput;
}
bcopy((char *)&ipnn->ipn_nat, (char *)nat, sizeof(*nat));
/*
* Initialize all these so that nat_delete() doesn't cause a crash.
*/
bzero((char *)nat, offsetof(struct nat, nat_tqe));
nat->nat_tqe.tqe_pnext = NULL;
nat->nat_tqe.tqe_next = NULL;
nat->nat_tqe.tqe_ifq = NULL;
nat->nat_tqe.tqe_parent = nat;
/*
* Restore the rule associated with this nat session
*/
in = ipnn->ipn_nat.nat_ptr;
if (in != NULL) {
KMALLOC(in, ipnat_t *);
nat->nat_ptr = in;
if (in == NULL) {
error = ENOMEM;
goto junkput;
}
bzero((char *)in, offsetof(struct ipnat, in_next6));
bcopy((char *)&ipnn->ipn_ipnat, (char *)in, sizeof(*in));
in->in_use = 1;
in->in_flags |= IPN_DELETE;
ATOMIC_INC(ifs->ifs_nat_stats.ns_rules);
nat_resolverule(in, ifs);
}
/*
* Check that the NAT entry doesn't already exist in the kernel.
*/
bzero((char *)&fin, sizeof(fin));
fin.fin_p = nat->nat_p;
if (nat->nat_dir == NAT_OUTBOUND) {
fin.fin_data[0] = ntohs(nat->nat_oport);
fin.fin_data[1] = ntohs(nat->nat_outport);
fin.fin_ifp = nat->nat_ifps[0];
if (getlock) {
READ_ENTER(&ifs->ifs_ipf_nat);
}
n = nat_inlookup(&fin, nat->nat_flags, fin.fin_p,
nat->nat_oip, nat->nat_outip);
if (getlock) {
RWLOCK_EXIT(&ifs->ifs_ipf_nat);
}
if (n != NULL) {
error = EEXIST;
goto junkput;
}
} else if (nat->nat_dir == NAT_INBOUND) {
fin.fin_data[0] = ntohs(nat->nat_inport);
fin.fin_data[1] = ntohs(nat->nat_oport);
fin.fin_ifp = nat->nat_ifps[1];
if (getlock) {
READ_ENTER(&ifs->ifs_ipf_nat);
}
n = nat_outlookup(&fin, nat->nat_flags, fin.fin_p,
nat->nat_inip, nat->nat_oip);
if (getlock) {
RWLOCK_EXIT(&ifs->ifs_ipf_nat);
}
if (n != NULL) {
error = EEXIST;
goto junkput;
}
} else {
error = EINVAL;
goto junkput;
}
/*
* Restore ap_session_t structure. Include the private data allocated
* if it was there.
*/
aps = nat->nat_aps;
if (aps != NULL) {
KMALLOC(aps, ap_session_t *);
nat->nat_aps = aps;
if (aps == NULL) {
error = ENOMEM;
goto junkput;
}
bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps));
if (in != NULL)
aps->aps_apr = in->in_apr;
else
aps->aps_apr = NULL;
if (aps->aps_psiz != 0) {
if (aps->aps_psiz > 81920) {
error = ENOMEM;
goto junkput;
}
KMALLOCS(aps->aps_data, void *, aps->aps_psiz);
if (aps->aps_data == NULL) {
error = ENOMEM;
goto junkput;
}
bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data,
aps->aps_psiz);
} else {
aps->aps_psiz = 0;
aps->aps_data = NULL;
}
}
/*
* If there was a filtering rule associated with this entry then
* build up a new one.
*/
fr = nat->nat_fr;
if (fr != NULL) {
if ((nat->nat_flags & SI_NEWFR) != 0) {
KMALLOC(fr, frentry_t *);
nat->nat_fr = fr;
if (fr == NULL) {
error = ENOMEM;
goto junkput;
}
ipnn->ipn_nat.nat_fr = fr;
fr->fr_ref = 1;
(void) fr_outobj(data, ipnn, IPFOBJ_NATSAVE);
bcopy((char *)&ipnn->ipn_fr, (char *)fr, sizeof(*fr));
MUTEX_NUKE(&fr->fr_lock);
MUTEX_INIT(&fr->fr_lock, "nat-filter rule lock");
} else {
READ_ENTER(&ifs->ifs_ipf_nat);
for (n = ifs->ifs_nat_instances; n; n = n->nat_next)
if (n->nat_fr == fr)
break;
if (n != NULL) {
MUTEX_ENTER(&fr->fr_lock);
fr->fr_ref++;
MUTEX_EXIT(&fr->fr_lock);
}
RWLOCK_EXIT(&ifs->ifs_ipf_nat);
if (!n) {
error = ESRCH;
goto junkput;
}
}
}
if (ipnn != &ipn) {
KFREES(ipnn, ipn.ipn_dsize);
ipnn = NULL;
}
if (getlock) {
WRITE_ENTER(&ifs->ifs_ipf_nat);
}
error = nat_insert(nat, nat->nat_rev, ifs);
if ((error == 0) && (aps != NULL)) {
aps->aps_next = ifs->ifs_ap_sess_list;
ifs->ifs_ap_sess_list = aps;
}
if (getlock) {
RWLOCK_EXIT(&ifs->ifs_ipf_nat);
}
if (error == 0)
return 0;
error = ENOMEM;
junkput:
if (fr != NULL)
(void) fr_derefrule(&fr, ifs);
if ((ipnn != NULL) && (ipnn != &ipn)) {
KFREES(ipnn, ipn.ipn_dsize);
}
if (nat != NULL) {
if (aps != NULL) {
if (aps->aps_data != NULL) {
KFREES(aps->aps_data, aps->aps_psiz);
}
KFREE(aps);
}
if (in != NULL) {
if (in->in_apr)
appr_free(in->in_apr);
KFREE(in);
}
KFREE(nat);
}
return error;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_delete */
/* Returns: Nil */
/* Parameters: natd(I) - pointer to NAT structure to delete */
/* logtype(I) - type of LOG record to create before deleting */
/* Write Lock: ipf_nat */
/* */
/* Delete a nat entry from the various lists and table. If NAT logging is */
/* enabled then generate a NAT log record for this event. */
/* ------------------------------------------------------------------------ */
static void nat_delete(nat, logtype, ifs)
struct nat *nat;
int logtype;
ipf_stack_t *ifs;
{
struct ipnat *ipn;
if (logtype != 0 && ifs->ifs_nat_logging != 0)
nat_log(nat, logtype, ifs);
MUTEX_ENTER(&ifs->ifs_ipf_nat_new);
/*
* Take it as a general indication that all the pointers are set if
* nat_pnext is set.
*/
if (nat->nat_pnext != NULL) {
ifs->ifs_nat_stats.ns_bucketlen[0][nat->nat_hv[0]]--;
ifs->ifs_nat_stats.ns_bucketlen[1][nat->nat_hv[1]]--;
*nat->nat_pnext = nat->nat_next;
if (nat->nat_next != NULL) {
nat->nat_next->nat_pnext = nat->nat_pnext;
nat->nat_next = NULL;
}
nat->nat_pnext = NULL;
*nat->nat_phnext[0] = nat->nat_hnext[0];
if (nat->nat_hnext[0] != NULL) {
nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
nat->nat_hnext[0] = NULL;
}
nat->nat_phnext[0] = NULL;
*nat->nat_phnext[1] = nat->nat_hnext[1];
if (nat->nat_hnext[1] != NULL) {
nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
nat->nat_hnext[1] = NULL;
}
nat->nat_phnext[1] = NULL;
if ((nat->nat_flags & SI_WILDP) != 0)
ifs->ifs_nat_stats.ns_wilds--;
}
if (nat->nat_me != NULL) {
*nat->nat_me = NULL;
nat->nat_me = NULL;
}
fr_deletequeueentry(&nat->nat_tqe);
nat->nat_ref--;
if (nat->nat_ref > 0) {
MUTEX_EXIT(&ifs->ifs_ipf_nat_new);
return;
}
#ifdef IPFILTER_SYNC
if (nat->nat_sync)
ipfsync_del(nat->nat_sync);
#endif
if (nat->nat_fr != NULL)
(void)fr_derefrule(&nat->nat_fr, ifs);
if (nat->nat_hm != NULL)
nat_hostmapdel(nat->nat_hm);
/*
* If there is an active reference from the nat entry to its parent
* rule, decrement the rule's reference count and free it too if no
* longer being used.
*/
ipn = nat->nat_ptr;
if (ipn != NULL) {
ipn->in_space++;
ipn->in_use--;
if (ipn->in_use == 0 && (ipn->in_flags & IPN_DELETE)) {
if (ipn->in_apr)
appr_free(ipn->in_apr);
KFREE(ipn);
ifs->ifs_nat_stats.ns_rules--;
}
}
MUTEX_DESTROY(&nat->nat_lock);
aps_free(nat->nat_aps, ifs);
ifs->ifs_nat_stats.ns_inuse--;
MUTEX_EXIT(&ifs->ifs_ipf_nat_new);
/*
* If there's a fragment table entry too for this nat entry, then
* dereference that as well. This is after nat_lock is released
* because of Tru64.
*/
fr_forgetnat((void *)nat, ifs);
KFREE(nat);
}
/* ------------------------------------------------------------------------ */
/* Function: nat_flushtable */
/* Returns: int - number of NAT rules deleted */
/* Parameters: Nil */
/* */
/* Deletes all currently active NAT sessions. In deleting each NAT entry a */
/* log record should be emitted in nat_delete() if NAT logging is enabled. */
/* ------------------------------------------------------------------------ */
/*
* nat_flushtable - clear the NAT table of all mapping entries.
*/
static int nat_flushtable(ifs)
ipf_stack_t *ifs;
{
nat_t *nat;
int j = 0;
/*
* ALL NAT mappings deleted, so lets just make the deletions
* quicker.
*/
if (ifs->ifs_nat_table[0] != NULL)
bzero((char *)ifs->ifs_nat_table[0],
sizeof(ifs->ifs_nat_table[0]) * ifs->ifs_ipf_nattable_sz);
if (ifs->ifs_nat_table[1] != NULL)
bzero((char *)ifs->ifs_nat_table[1],
sizeof(ifs->ifs_nat_table[1]) * ifs->ifs_ipf_nattable_sz);
while ((nat = ifs->ifs_nat_instances) != NULL) {
nat_delete(nat, NL_FLUSH, ifs);
j++;
}
ifs->ifs_nat_stats.ns_inuse = 0;
return j;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_clearlist */
/* Returns: int - number of NAT/RDR rules deleted */
/* Parameters: Nil */
/* */
/* Delete all rules in the current list of rules. There is nothing elegant */
/* about this cleanup: simply free all entries on the list of rules and */
/* clear out the tables used for hashed NAT rule lookups. */
/* ------------------------------------------------------------------------ */
static int nat_clearlist(ifs)
ipf_stack_t *ifs;
{
ipnat_t *n, **np = &ifs->ifs_nat_list;
int i = 0;
if (ifs->ifs_nat_rules != NULL)
bzero((char *)ifs->ifs_nat_rules,
sizeof(*ifs->ifs_nat_rules) * ifs->ifs_ipf_natrules_sz);
if (ifs->ifs_rdr_rules != NULL)
bzero((char *)ifs->ifs_rdr_rules,
sizeof(*ifs->ifs_rdr_rules) * ifs->ifs_ipf_rdrrules_sz);
while ((n = *np) != NULL) {
*np = n->in_next;
if (n->in_use == 0) {
if (n->in_apr != NULL)
appr_free(n->in_apr);
KFREE(n);
ifs->ifs_nat_stats.ns_rules--;
} else {
n->in_flags |= IPN_DELETE;
n->in_next = NULL;
}
i++;
}
ifs->ifs_nat_masks = 0;
ifs->ifs_rdr_masks = 0;
return i;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_newmap */
/* Returns: int - -1 == error, 0 == success */
/* Parameters: fin(I) - pointer to packet information */
/* nat(I) - pointer to NAT entry */
/* ni(I) - pointer to structure with misc. information needed */
/* to create new NAT entry. */
/* */
/* Given an empty NAT structure, populate it with new information about a */
/* new NAT session, as defined by the matching NAT rule. */
/* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
/* to the new IP address for the translation. */
/* ------------------------------------------------------------------------ */
static INLINE int nat_newmap(fin, nat, ni)
fr_info_t *fin;
nat_t *nat;
natinfo_t *ni;
{
u_short st_port, dport, sport, port, sp, dp;
struct in_addr in, inb;
hostmap_t *hm;
u_32_t flags;
u_32_t st_ip;
ipnat_t *np;
nat_t *natl;
int l;
ipf_stack_t *ifs = fin->fin_ifs;
/*
* If it's an outbound packet which doesn't match any existing
* record, then create a new port
*/
l = 0;
hm = NULL;
np = ni->nai_np;
st_ip = np->in_nip;
st_port = np->in_pnext;
flags = ni->nai_flags;
sport = ni->nai_sport;
dport = ni->nai_dport;
/*
* Do a loop until we either run out of entries to try or we find
* a NAT mapping that isn't currently being used. This is done
* because the change to the source is not (usually) being fixed.
*/
do {
port = 0;
in.s_addr = htonl(np->in_nip);
if (l == 0) {
/*
* Check to see if there is an existing NAT
* setup for this IP address pair.
*/
hm = nat_hostmap(np, fin->fin_src, fin->fin_dst,
in, 0, ifs);
if (hm != NULL)
in.s_addr = hm->hm_mapip.s_addr;
} else if ((l == 1) && (hm != NULL)) {
nat_hostmapdel(hm);
hm = NULL;
}
in.s_addr = ntohl(in.s_addr);
nat->nat_hm = hm;
if ((np->in_outmsk == 0xffffffff) && (np->in_pnext == 0)) {
if (l > 0)
return -1;
}
if (np->in_redir == NAT_BIMAP &&
np->in_inmsk == np->in_outmsk) {
/*
* map the address block in a 1:1 fashion
*/
in.s_addr = np->in_outip;
in.s_addr |= fin->fin_saddr & ~np->in_inmsk;
in.s_addr = ntohl(in.s_addr);
} else if (np->in_redir & NAT_MAPBLK) {
if ((l >= np->in_ppip) || ((l > 0) &&
!(flags & IPN_TCPUDP)))
return -1;
/*
* map-block - Calculate destination address.
*/
in.s_addr = ntohl(fin->fin_saddr);
in.s_addr &= ntohl(~np->in_inmsk);
inb.s_addr = in.s_addr;
in.s_addr /= np->in_ippip;
in.s_addr &= ntohl(~np->in_outmsk);
in.s_addr += ntohl(np->in_outip);
/*
* Calculate destination port.
*/
if ((flags & IPN_TCPUDP) &&
(np->in_ppip != 0)) {
port = ntohs(sport) + l;
port %= np->in_ppip;
port += np->in_ppip *
(inb.s_addr % np->in_ippip);
port += MAPBLK_MINPORT;
port = htons(port);
}
} else if ((np->in_outip == 0) &&
(np->in_outmsk == 0xffffffff)) {
/*
* 0/32 - use the interface's IP address.
*/
if ((l > 0) ||
fr_ifpaddr(4, FRI_NORMAL, fin->fin_ifp,
&in, NULL, fin->fin_ifs) == -1)
return -1;
in.s_addr = ntohl(in.s_addr);
} else if ((np->in_outip == 0) && (np->in_outmsk == 0)) {
/*
* 0/0 - use the original source address/port.
*/
if (l > 0)
return -1;
in.s_addr = ntohl(fin->fin_saddr);
} else if ((np->in_outmsk != 0xffffffff) &&
(np->in_pnext == 0) && ((l > 0) || (hm == NULL)))
np->in_nip++;
natl = NULL;
if ((flags & IPN_TCPUDP) &&
((np->in_redir & NAT_MAPBLK) == 0) &&
(np->in_flags & IPN_AUTOPORTMAP)) {
/*
* "ports auto" (without map-block)
*/
if ((l > 0) && (l % np->in_ppip == 0)) {
if (l > np->in_space) {
return -1;
} else if ((l > np->in_ppip) &&
np->in_outmsk != 0xffffffff)
np->in_nip++;
}
if (np->in_ppip != 0) {
port = ntohs(sport);
port += (l % np->in_ppip);
port %= np->in_ppip;
port += np->in_ppip *
(ntohl(fin->fin_saddr) %
np->in_ippip);
port += MAPBLK_MINPORT;
port = htons(port);
}
} else if (((np->in_redir & NAT_MAPBLK) == 0) &&
(flags & IPN_TCPUDPICMP) && (np->in_pnext != 0)) {
/*
* Standard port translation. Select next port.
*/
port = htons(np->in_pnext++);
if (np->in_pnext > ntohs(np->in_pmax)) {
np->in_pnext = ntohs(np->in_pmin);
if (np->in_outmsk != 0xffffffff)
np->in_nip++;
}
}
if (np->in_flags & IPN_IPRANGE) {
if (np->in_nip > ntohl(np->in_outmsk))
np->in_nip = ntohl(np->in_outip);
} else {
if ((np->in_outmsk != 0xffffffff) &&
((np->in_nip + 1) & ntohl(np->in_outmsk)) >
ntohl(np->in_outip))
np->in_nip = ntohl(np->in_outip) + 1;
}
if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY)))
port = sport;
/*
* Here we do a lookup of the connection as seen from
* the outside. If an IP# pair already exists, try
* again. So if you have A->B becomes C->B, you can
* also have D->E become C->E but not D->B causing
* another C->B. Also take protocol and ports into
* account when determining whether a pre-existing
* NAT setup will cause an external conflict where
* this is appropriate.
*/
inb.s_addr = htonl(in.s_addr);
sp = fin->fin_data[0];
dp = fin->fin_data[1];
fin->fin_data[0] = fin->fin_data[1];
fin->fin_data[1] = htons(port);
natl = nat_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
(u_int)fin->fin_p, fin->fin_dst, inb);
fin->fin_data[0] = sp;
fin->fin_data[1] = dp;
/*
* Has the search wrapped around and come back to the
* start ?
*/
if ((natl != NULL) &&
(np->in_pnext != 0) && (st_port == np->in_pnext) &&
(np->in_nip != 0) && (st_ip == np->in_nip))
return -1;
l++;
} while (natl != NULL);
if (np->in_space > 0)
np->in_space--;
/* Setup the NAT table */
nat->nat_inip = fin->fin_src;
nat->nat_outip.s_addr = htonl(in.s_addr);
nat->nat_oip = fin->fin_dst;
if (nat->nat_hm == NULL)
nat->nat_hm = nat_hostmap(np, fin->fin_src, fin->fin_dst,
nat->nat_outip, 0, ifs);
/*
* The ICMP checksum does not have a pseudo header containing
* the IP addresses
*/
ni->nai_sum1 = LONG_SUM(ntohl(fin->fin_saddr));
ni->nai_sum2 = LONG_SUM(in.s_addr);
if ((flags & IPN_TCPUDP)) {
ni->nai_sum1 += ntohs(sport);
ni->nai_sum2 += ntohs(port);
}
if (flags & IPN_TCPUDP) {
nat->nat_inport = sport;
nat->nat_outport = port; /* sport */
nat->nat_oport = dport;
((tcphdr_t *)fin->fin_dp)->th_sport = port;
} else if (flags & IPN_ICMPQUERY) {
((icmphdr_t *)fin->fin_dp)->icmp_id = port;
nat->nat_inport = port;
nat->nat_outport = port;
}
ni->nai_ip.s_addr = in.s_addr;
ni->nai_port = port;
ni->nai_nport = dport;
return 0;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_newrdr */
/* Returns: int - -1 == error, 0 == success (no move), 1 == success and */
/* allow rule to be moved if IPN_ROUNDR is set. */
/* Parameters: fin(I) - pointer to packet information */
/* nat(I) - pointer to NAT entry */
/* ni(I) - pointer to structure with misc. information needed */
/* to create new NAT entry. */
/* */
/* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
/* to the new IP address for the translation. */
/* ------------------------------------------------------------------------ */
static INLINE int nat_newrdr(fin, nat, ni)
fr_info_t *fin;
nat_t *nat;
natinfo_t *ni;
{
u_short nport, dport, sport;
struct in_addr in;
hostmap_t *hm;
u_32_t flags;
ipnat_t *np;
int move;
ipf_stack_t *ifs = fin->fin_ifs;
move = 1;
hm = NULL;
in.s_addr = 0;
np = ni->nai_np;
flags = ni->nai_flags;
sport = ni->nai_sport;
dport = ni->nai_dport;
/*
* If the matching rule has IPN_STICKY set, then we want to have the
* same rule kick in as before. Why would this happen? If you have
* a collection of rdr rules with "round-robin sticky", the current
* packet might match a different one to the previous connection but
* we want the same destination to be used.
*/
if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) ==
(IPN_ROUNDR|IPN_STICKY)) {
hm = nat_hostmap(NULL, fin->fin_src, fin->fin_dst, in,
(u_32_t)dport, ifs);
if (hm != NULL) {
in.s_addr = ntohl(hm->hm_mapip.s_addr);
np = hm->hm_ipnat;
ni->nai_np = np;
move = 0;
}
}
/*
* Otherwise, it's an inbound packet. Most likely, we don't
* want to rewrite source ports and source addresses. Instead,
* we want to rewrite to a fixed internal address and fixed
* internal port.
*/
if (np->in_flags & IPN_SPLIT) {
in.s_addr = np->in_nip;
if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) {
hm = nat_hostmap(np, fin->fin_src, fin->fin_dst,
in, (u_32_t)dport, ifs);
if (hm != NULL) {
in.s_addr = hm->hm_mapip.s_addr;
move = 0;
}
}
if (hm == NULL || hm->hm_ref == 1) {
if (np->in_inip == htonl(in.s_addr)) {
np->in_nip = ntohl(np->in_inmsk);
move = 0;
} else {
np->in_nip = ntohl(np->in_inip);
}
}
} else if ((np->in_inip == 0) && (np->in_inmsk == 0xffffffff)) {
/*
* 0/32 - use the interface's IP address.
*/
if (fr_ifpaddr(4, FRI_NORMAL, fin->fin_ifp, &in, NULL,
fin->fin_ifs) == -1)
return -1;
in.s_addr = ntohl(in.s_addr);
} else if ((np->in_inip == 0) && (np->in_inmsk== 0)) {
/*
* 0/0 - use the original destination address/port.
*/
in.s_addr = ntohl(fin->fin_daddr);
} else if (np->in_redir == NAT_BIMAP &&
np->in_inmsk == np->in_outmsk) {
/*
* map the address block in a 1:1 fashion
*/
in.s_addr = np->in_inip;
in.s_addr |= fin->fin_daddr & ~np->in_inmsk;
in.s_addr = ntohl(in.s_addr);
} else {
in.s_addr = ntohl(np->in_inip);
}
if ((np->in_pnext == 0) || ((flags & NAT_NOTRULEPORT) != 0))
nport = dport;
else {
/*
* Whilst not optimized for the case where
* pmin == pmax, the gain is not significant.
*/
if (((np->in_flags & IPN_FIXEDDPORT) == 0) &&
(np->in_pmin != np->in_pmax)) {
nport = ntohs(dport) - ntohs(np->in_pmin) +
ntohs(np->in_pnext);
nport = htons(nport);
} else
nport = np->in_pnext;
}
/*
* When the redirect-to address is set to 0.0.0.0, just
* assume a blank `forwarding' of the packet. We don't
* setup any translation for this either.
*/
if (in.s_addr == 0) {
if (nport == dport)
return -1;
in.s_addr = ntohl(fin->fin_daddr);
}
nat->nat_inip.s_addr = htonl(in.s_addr);
nat->nat_outip = fin->fin_dst;
nat->nat_oip = fin->fin_src;
ni->nai_sum1 = LONG_SUM(ntohl(fin->fin_daddr)) + ntohs(dport);
ni->nai_sum2 = LONG_SUM(in.s_addr) + ntohs(nport);
ni->nai_ip.s_addr = in.s_addr;
ni->nai_nport = nport;
ni->nai_port = sport;
if (flags & IPN_TCPUDP) {
nat->nat_inport = nport;
nat->nat_outport = dport;
nat->nat_oport = sport;
((tcphdr_t *)fin->fin_dp)->th_dport = nport;
} else if (flags & IPN_ICMPQUERY) {
((icmphdr_t *)fin->fin_dp)->icmp_id = nport;
nat->nat_inport = nport;
nat->nat_outport = nport;
}
return move;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_new */
/* Returns: nat_t* - NULL == failure to create new NAT structure, */
/* else pointer to new NAT structure */
/* Parameters: fin(I) - pointer to packet information */
/* np(I) - pointer to NAT rule */
/* natsave(I) - pointer to where to store NAT struct pointer */
/* flags(I) - flags describing the current packet */
/* direction(I) - direction of packet (in/out) */
/* Write Lock: ipf_nat */
/* */
/* Attempts to create a new NAT entry. Does not actually change the packet */
/* in any way. */
/* */
/* This fucntion is in three main parts: (1) deal with creating a new NAT */
/* structure for a "MAP" rule (outgoing NAT translation); (2) deal with */
/* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */
/* and (3) building that structure and putting it into the NAT table(s). */
/* ------------------------------------------------------------------------ */
nat_t *nat_new(fin, np, natsave, flags, direction)
fr_info_t *fin;
ipnat_t *np;
nat_t **natsave;
u_int flags;
int direction;
{
u_short port = 0, sport = 0, dport = 0, nport = 0;
tcphdr_t *tcp = NULL;
hostmap_t *hm = NULL;
struct in_addr in;
nat_t *nat, *natl;
u_int nflags;
natinfo_t ni;
u_32_t sumd;
int move;
ipf_stack_t *ifs = fin->fin_ifs;
if (ifs->ifs_nat_stats.ns_inuse >= ifs->ifs_ipf_nattable_max) {
ifs->ifs_nat_stats.ns_memfail++;
return NULL;
}
move = 1;
nflags = np->in_flags & flags;
nflags &= NAT_FROMRULE;
ni.nai_np = np;
ni.nai_nflags = nflags;
ni.nai_flags = flags;
/* Give me a new nat */
KMALLOC(nat, nat_t *);
if (nat == NULL) {
ifs->ifs_nat_stats.ns_memfail++;
/*
* Try to automatically tune the max # of entries in the
* table allowed to be less than what will cause kmem_alloc()
* to fail and try to eliminate panics due to out of memory
* conditions arising.
*/
if (ifs->ifs_ipf_nattable_max > ifs->ifs_ipf_nattable_sz) {
ifs->ifs_ipf_nattable_max = ifs->ifs_nat_stats.ns_inuse - 100;
printf("ipf_nattable_max reduced to %d\n",
ifs->ifs_ipf_nattable_max);
}
return NULL;
}
if (flags & IPN_TCPUDP) {
tcp = fin->fin_dp;
ni.nai_sport = htons(fin->fin_sport);
ni.nai_dport = htons(fin->fin_dport);
} else if (flags & IPN_ICMPQUERY) {
/*
* In the ICMP query NAT code, we translate the ICMP id fields
* to make them unique. This is indepedent of the ICMP type
* (e.g. in the unlikely event that a host sends an echo and
* an tstamp request with the same id, both packets will have
* their ip address/id field changed in the same way).
*/
/* The icmp_id field is used by the sender to identify the
* process making the icmp request. (the receiver justs
* copies it back in its response). So, it closely matches
* the concept of source port. We overlay sport, so we can
* maximally reuse the existing code.
*/
ni.nai_sport = ((icmphdr_t *)fin->fin_dp)->icmp_id;
ni.nai_dport = ni.nai_sport;
}
bzero((char *)nat, sizeof(*nat));
nat->nat_flags = flags;
nat->nat_redir = np->in_redir;
if ((flags & NAT_SLAVE) == 0) {
MUTEX_ENTER(&ifs->ifs_ipf_nat_new);
}
/*
* Search the current table for a match.
*/
if (direction == NAT_OUTBOUND) {
/*
* We can now arrange to call this for the same connection
* because ipf_nat_new doesn't protect the code path into
* this function.
*/
natl = nat_outlookup(fin, nflags, (u_int)fin->fin_p,
fin->fin_src, fin->fin_dst);
if (natl != NULL) {
nat = natl;
goto done;
}
move = nat_newmap(fin, nat, &ni);
if (move == -1)
goto badnat;
np = ni.nai_np;
in = ni.nai_ip;
} else {
/*
* NAT_INBOUND is used only for redirects rules
*/
natl = nat_inlookup(fin, nflags, (u_int)fin->fin_p,
fin->fin_src, fin->fin_dst);
if (natl != NULL) {
nat = natl;
goto done;
}
move = nat_newrdr(fin, nat, &ni);
if (move == -1)
goto badnat;
np = ni.nai_np;
in = ni.nai_ip;
}
port = ni.nai_port;
nport = ni.nai_nport;
if ((move == 1) && (np->in_flags & IPN_ROUNDR)) {
if (np->in_redir == NAT_REDIRECT) {
nat_delrdr(np);
nat_addrdr(np, ifs);
} else if (np->in_redir == NAT_MAP) {
nat_delnat(np);
nat_addnat(np, ifs);
}
}
if (flags & IPN_TCPUDP) {
sport = ni.nai_sport;
dport = ni.nai_dport;
} else if (flags & IPN_ICMPQUERY) {
sport = ni.nai_sport;
dport = 0;
}
/*
* nat_sumd[0] stores adjustment value including both IP address and
* port number changes. nat_sumd[1] stores adjustment value only for
* IP address changes, to be used for pseudo header adjustment, in
* case hardware partial checksum offload is offered.
*/
CALC_SUMD(ni.nai_sum1, ni.nai_sum2, sumd);
nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
#if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
if (flags & IPN_TCPUDP) {
ni.nai_sum1 = LONG_SUM(in.s_addr);
if (direction == NAT_OUTBOUND)
ni.nai_sum2 = LONG_SUM(ntohl(fin->fin_saddr));
else
ni.nai_sum2 = LONG_SUM(ntohl(fin->fin_daddr));
CALC_SUMD(ni.nai_sum1, ni.nai_sum2, sumd);
nat->nat_sumd[1] = (sumd & 0xffff) + (sumd >> 16);
} else
#endif
nat->nat_sumd[1] = nat->nat_sumd[0];
if ((flags & IPN_TCPUDPICMP) && ((sport != port) || (dport != nport))) {
if (direction == NAT_OUTBOUND)
ni.nai_sum1 = LONG_SUM(ntohl(fin->fin_saddr));
else
ni.nai_sum1 = LONG_SUM(ntohl(fin->fin_daddr));
ni.nai_sum2 = LONG_SUM(in.s_addr);
CALC_SUMD(ni.nai_sum1, ni.nai_sum2, sumd);
nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16);
} else {
nat->nat_ipsumd = nat->nat_sumd[0];
if (!(flags & IPN_TCPUDPICMP)) {
nat->nat_sumd[0] = 0;
nat->nat_sumd[1] = 0;
}
}
if (nat_finalise(fin, nat, &ni, tcp, natsave, direction) == -1) {
goto badnat;
}
if (flags & SI_WILDP)
ifs->ifs_nat_stats.ns_wilds++;
goto done;
badnat:
ifs->ifs_nat_stats.ns_badnat++;
if ((hm = nat->nat_hm) != NULL)
nat_hostmapdel(hm);
KFREE(nat);
nat = NULL;
done:
if ((flags & NAT_SLAVE) == 0) {
MUTEX_EXIT(&ifs->ifs_ipf_nat_new);
}
return nat;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_finalise */
/* Returns: int - 0 == sucess, -1 == failure */
/* Parameters: fin(I) - pointer to packet information */
/* nat(I) - pointer to NAT entry */
/* ni(I) - pointer to structure with misc. information needed */
/* to create new NAT entry. */
/* Write Lock: ipf_nat */
/* */
/* This is the tail end of constructing a new NAT entry and is the same */
/* for both IPv4 and IPv6. */
/* ------------------------------------------------------------------------ */
/*ARGSUSED*/
static INLINE int nat_finalise(fin, nat, ni, tcp, natsave, direction)
fr_info_t *fin;
nat_t *nat;
natinfo_t *ni;
tcphdr_t *tcp;
nat_t **natsave;
int direction;
{
frentry_t *fr;
ipnat_t *np;
ipf_stack_t *ifs = fin->fin_ifs;
np = ni->nai_np;
COPYIFNAME(fin->fin_ifp, nat->nat_ifnames[0], fin->fin_v);
#ifdef IPFILTER_SYNC
if ((nat->nat_flags & SI_CLONE) == 0)
nat->nat_sync = ipfsync_new(SMC_NAT, fin, nat);
#endif
nat->nat_me = natsave;
nat->nat_dir = direction;
nat->nat_ifps[0] = np->in_ifps[0];
nat->nat_ifps[1] = np->in_ifps[1];
nat->nat_ptr = np;
nat->nat_p = fin->fin_p;
nat->nat_mssclamp = np->in_mssclamp;
fr = fin->fin_fr;
nat->nat_fr = fr;
if ((np->in_apr != NULL) && ((ni->nai_flags & NAT_SLAVE) == 0))
if (appr_new(fin, nat) == -1)
return -1;
if (nat_insert(nat, fin->fin_rev, ifs) == 0) {
if (ifs->ifs_nat_logging)
nat_log(nat, (u_int)np->in_redir, ifs);
np->in_use++;
if (fr != NULL) {
MUTEX_ENTER(&fr->fr_lock);
fr->fr_ref++;
MUTEX_EXIT(&fr->fr_lock);
}
return 0;
}
/*
* nat_insert failed, so cleanup time...
*/
return -1;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_insert */
/* Returns: int - 0 == sucess, -1 == failure */
/* Parameters: nat(I) - pointer to NAT structure */
/* rev(I) - flag indicating forward/reverse direction of packet */
/* Write Lock: ipf_nat */
/* */
/* Insert a NAT entry into the hash tables for searching and add it to the */
/* list of active NAT entries. Adjust global counters when complete. */
/* ------------------------------------------------------------------------ */
int nat_insert(nat, rev, ifs)
nat_t *nat;
int rev;
ipf_stack_t *ifs;
{
u_int hv1, hv2;
nat_t **natp;
/*
* Try and return an error as early as possible, so calculate the hash
* entry numbers first and then proceed.
*/
if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) {
hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport,
0xffffffff);
hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1 + nat->nat_oport,
ifs->ifs_ipf_nattable_sz);
hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport,
0xffffffff);
hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2 + nat->nat_oport,
ifs->ifs_ipf_nattable_sz);
} else {
hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, 0, 0xffffffff);
hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1,
ifs->ifs_ipf_nattable_sz);
hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, 0, 0xffffffff);
hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2,
ifs->ifs_ipf_nattable_sz);
}
if (ifs->ifs_nat_stats.ns_bucketlen[0][hv1] >= ifs->ifs_fr_nat_maxbucket ||
ifs->ifs_nat_stats.ns_bucketlen[1][hv2] >= ifs->ifs_fr_nat_maxbucket) {
return -1;
}
nat->nat_hv[0] = hv1;
nat->nat_hv[1] = hv2;
MUTEX_INIT(&nat->nat_lock, "nat entry lock");
nat->nat_rev = rev;
nat->nat_ref = 1;
nat->nat_bytes[0] = 0;
nat->nat_pkts[0] = 0;
nat->nat_bytes[1] = 0;
nat->nat_pkts[1] = 0;
nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0';
nat->nat_ifps[0] = fr_resolvenic(nat->nat_ifnames[0], 4, ifs);
if (nat->nat_ifnames[1][0] !='\0') {
nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
nat->nat_ifps[1] = fr_resolvenic(nat->nat_ifnames[1], 4, ifs);
} else {
(void) strncpy(nat->nat_ifnames[1], nat->nat_ifnames[0],
LIFNAMSIZ);
nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
nat->nat_ifps[1] = nat->nat_ifps[0];
}
nat->nat_next = ifs->ifs_nat_instances;
nat->nat_pnext = &ifs->ifs_nat_instances;
if (ifs->ifs_nat_instances)
ifs->ifs_nat_instances->nat_pnext = &nat->nat_next;
ifs->ifs_nat_instances = nat;
natp = &ifs->ifs_nat_table[0][hv1];
if (*natp)
(*natp)->nat_phnext[0] = &nat->nat_hnext[0];
nat->nat_phnext[0] = natp;
nat->nat_hnext[0] = *natp;
*natp = nat;
ifs->ifs_nat_stats.ns_bucketlen[0][hv1]++;
natp = &ifs->ifs_nat_table[1][hv2];
if (*natp)
(*natp)->nat_phnext[1] = &nat->nat_hnext[1];
nat->nat_phnext[1] = natp;
nat->nat_hnext[1] = *natp;
*natp = nat;
ifs->ifs_nat_stats.ns_bucketlen[1][hv2]++;
fr_setnatqueue(nat, rev, ifs);
ifs->ifs_nat_stats.ns_added++;
ifs->ifs_nat_stats.ns_inuse++;
return 0;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_icmperrorlookup */
/* Returns: nat_t* - point to matching NAT structure */
/* Parameters: fin(I) - pointer to packet information */
/* dir(I) - direction of packet (in/out) */
/* */
/* Check if the ICMP error message is related to an existing TCP, UDP or */
/* ICMP query nat entry. It is assumed that the packet is already of the */
/* the required length. */
/* ------------------------------------------------------------------------ */
nat_t *nat_icmperrorlookup(fin, dir)
fr_info_t *fin;
int dir;
{
int flags = 0, minlen;
icmphdr_t *orgicmp;
tcphdr_t *tcp = NULL;
u_short data[2];
nat_t *nat;
ip_t *oip;
u_int p;
/*
* Does it at least have the return (basic) IP header ?
* Only a basic IP header (no options) should be with an ICMP error
* header. Also, if it's not an error type, then return.
*/
if ((fin->fin_hlen != sizeof(ip_t)) || !(fin->fin_flx & FI_ICMPERR))
return NULL;
/*
* Check packet size
*/
oip = (ip_t *)((char *)fin->fin_dp + 8);
minlen = IP_HL(oip) << 2;
if ((minlen < sizeof(ip_t)) ||
(fin->fin_plen < ICMPERR_IPICMPHLEN + minlen))
return NULL;
/*
* Is the buffer big enough for all of it ? It's the size of the IP
* header claimed in the encapsulated part which is of concern. It
* may be too big to be in this buffer but not so big that it's
* outside the ICMP packet, leading to TCP deref's causing problems.
* This is possible because we don't know how big oip_hl is when we
* do the pullup early in fr_check() and thus can't gaurantee it is
* all here now.
*/
#ifdef _KERNEL
{
mb_t *m;
m = fin->fin_m;
# if defined(MENTAT)
if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > (char *)m->b_wptr)
return NULL;
# else
if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
(char *)fin->fin_ip + M_LEN(m))
return NULL;
# endif
}
#endif
if (fin->fin_daddr != oip->ip_src.s_addr)
return NULL;
p = oip->ip_p;
if (p == IPPROTO_TCP)
flags = IPN_TCP;
else if (p == IPPROTO_UDP)
flags = IPN_UDP;
else if (p == IPPROTO_ICMP) {
orgicmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2));
/* see if this is related to an ICMP query */
if (nat_icmpquerytype4(orgicmp->icmp_type)) {
data[0] = fin->fin_data[0];
data[1] = fin->fin_data[1];
fin->fin_data[0] = 0;
fin->fin_data[1] = orgicmp->icmp_id;
flags = IPN_ICMPERR|IPN_ICMPQUERY;
/*
* NOTE : dir refers to the direction of the original
* ip packet. By definition the icmp error
* message flows in the opposite direction.
*/
if (dir == NAT_INBOUND)
nat = nat_inlookup(fin, flags, p, oip->ip_dst,
oip->ip_src);
else
nat = nat_outlookup(fin, flags, p, oip->ip_dst,
oip->ip_src);
fin->fin_data[0] = data[0];
fin->fin_data[1] = data[1];
return nat;
}
}
if (flags & IPN_TCPUDP) {
minlen += 8; /* + 64bits of data to get ports */
if (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen)
return NULL;
data[0] = fin->fin_data[0];
data[1] = fin->fin_data[1];
tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2));
fin->fin_data[0] = ntohs(tcp->th_dport);
fin->fin_data[1] = ntohs(tcp->th_sport);
if (dir == NAT_INBOUND) {
nat = nat_inlookup(fin, flags, p, oip->ip_dst,
oip->ip_src);
} else {
nat = nat_outlookup(fin, flags, p, oip->ip_dst,
oip->ip_src);
}
fin->fin_data[0] = data[0];
fin->fin_data[1] = data[1];