contrib/ipfilter/tools/ipnat.c

   1 /*      $FreeBSD$       */
   2
   3 /*
   4  * Copyright (C) 2012 by Darren Reed.
   5  *
   6  * See the IPFILTER.LICENCE file for details on licencing.
   7  *
   8  * Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com)
   9  */
  10 #include <stdio.h>
  11 #include <string.h>
  12 #include <fcntl.h>
  13 #include <errno.h>
  14 #include <sys/types.h>
  15 #if !defined(__SVR4)
  16 #include <strings.h>
  17 #else
  18 #include <sys/byteorder.h>
  19 #endif
  20 #include <sys/time.h>
  21 #include <sys/param.h>
  22 #include <stdlib.h>
  23 #include <unistd.h>
  24 #include <stddef.h>
  25 #include <sys/file.h>
  26 #define _KERNEL
  27 #include <sys/uio.h>
  28 #undef _KERNEL
  29 #include <sys/socket.h>
  30 #include <sys/ioctl.h>
  31 #if defined(sun) && defined(__SVR4)
  32 # include <sys/ioccom.h>
  33 # include <sys/sysmacros.h>
  34 #endif
  35 #include <netinet/in.h>
  36 #include <netinet/in_systm.h>
  37 #include <netinet/ip.h>
  38 #include <netinet/tcp.h>
  39 #include <net/if.h>
  40 #include <netdb.h>
  41 #include <arpa/nameser.h>
  42 #include <arpa/inet.h>
  43 #include <resolv.h>
  44 #include <ctype.h>
  45 # include <nlist.h>
  46 #include "ipf.h"
  47 #include "netinet/ipl.h"
  48 #include "kmem.h"
  49
  50
  51 # define        STRERROR(x)     strerror(x)
  52
  53 #if !defined(lint)
  54 static const char sccsid[] ="@(#)ipnat.c        1.9 6/5/96 (C) 1993 Darren Reed";
  55 static const char rcsid[] = "@(#)$Id$";
  56 #endif
  57
  58
  59 #if     SOLARIS
  60 #define bzero(a,b)      memset(a,0,b)
  61 #endif
  62 int     use_inet6 = 0;
  63 char    thishost[MAXHOSTNAMELEN];
  64
  65 extern  char    *optarg;
  66
  67 void    dostats __P((int, natstat_t *, int, int, int *));
  68 void    dotable __P((natstat_t *, int, int, int, char *));
  69 void    flushtable __P((int, int, int *));
  70 void    usage __P((char *));
  71 int     main __P((int, char*[]));
  72 void    showhostmap __P((natstat_t *nsp));
  73 void    natstat_dead __P((natstat_t *, char *));
  74 void    dostats_live __P((int, natstat_t *, int, int *));
  75 void    showhostmap_dead __P((natstat_t *));
  76 void    showhostmap_live __P((int, natstat_t *));
  77 void    dostats_dead __P((natstat_t *, int, int *));
  78 int     nat_matcharray __P((nat_t *, int *));
  79
  80 int             opts;
  81 int             nohdrfields = 0;
  82 wordtab_t       *nat_fields = NULL;
  83
  84 void usage(name)
  85         char *name;
  86 {
  87         fprintf(stderr, "Usage: %s [-CFhlnrRsv] [-f filename]\n", name);
  88         exit(1);
  89 }
  90
  91
  92 int main(argc, argv)
  93         int argc;
  94         char *argv[];
  95 {
  96         int fd, c, mode, *natfilter;
  97         char *file, *core, *kernel;
  98         natstat_t ns, *nsp;
  99         ipfobj_t obj;
 100
 101         fd = -1;
 102         opts = 0;
 103         nsp = &ns;
 104         file = NULL;
 105         core = NULL;
 106         kernel = NULL;
 107         mode = O_RDWR;
 108         natfilter = NULL;
 109
 110         assigndefined(getenv("IPNAT_PREDEFINED"));
 111
 112         while ((c = getopt(argc, argv, "CdFf:hlm:M:N:nO:prRsv")) != -1)
 113                 switch (c)
 114                 {
 115                 case 'C' :
 116                         opts |= OPT_CLEAR;
 117                         break;
 118                 case 'd' :
 119                         opts |= OPT_DEBUG;
 120                         break;
 121                 case 'f' :
 122                         file = optarg;
 123                         break;
 124                 case 'F' :
 125                         opts |= OPT_FLUSH;
 126                         break;
 127                 case 'h' :
 128                         opts |=OPT_HITS;
 129                         break;
 130                 case 'l' :
 131                         opts |= OPT_LIST;
 132                         mode = O_RDONLY;
 133                         break;
 134                 case 'm' :
 135                         natfilter = parseipfexpr(optarg, NULL);
 136                         break;
 137                 case 'M' :
 138                         core = optarg;
 139                         break;
 140                 case 'N' :
 141                         kernel = optarg;
 142                         break;
 143                 case 'n' :
 144                         opts |= OPT_DONOTHING|OPT_DONTOPEN;
 145                         mode = O_RDONLY;
 146                         break;
 147                 case 'O' :
 148                         nat_fields = parsefields(natfields, optarg);
 149                         break;
 150                 case 'p' :
 151                         opts |= OPT_PURGE;
 152                         break;
 153                 case 'R' :
 154                         opts |= OPT_NORESOLVE;
 155                         break;
 156                 case 'r' :
 157                         opts |= OPT_REMOVE;
 158                         break;
 159                 case 's' :
 160                         opts |= OPT_STAT;
 161                         mode = O_RDONLY;
 162                         break;
 163                 case 'v' :
 164                         opts |= OPT_VERBOSE;
 165                         break;
 166                 default :
 167                         usage(argv[0]);
 168                 }
 169
 170         if (((opts & OPT_PURGE) != 0) && ((opts & OPT_REMOVE) == 0)) {
 171                 (void) fprintf(stderr, "%s: -p must be used with -r\n",
 172                                argv[0]);
 173                 exit(1);
 174         }
 175
 176         initparse();
 177
 178         if ((kernel != NULL) || (core != NULL)) {
 179                 (void) setgid(getgid());
 180                 (void) setuid(getuid());
 181         }
 182
 183         if (!(opts & OPT_DONOTHING)) {
 184                 if (((fd = open(IPNAT_NAME, mode)) == -1) &&
 185                     ((fd = open(IPNAT_NAME, O_RDONLY)) == -1)) {
 186                         (void) fprintf(stderr, "%s: open: %s\n", IPNAT_NAME,
 187                                 STRERROR(errno));
 188                         exit(1);
 189                 }
 190         }
 191
 192         bzero((char *)&ns, sizeof(ns));
 193
 194         if ((opts & OPT_DONOTHING) == 0) {
 195                 if (checkrev(IPL_NAME) == -1) {
 196                         fprintf(stderr, "User/kernel version check failed\n");
 197                         exit(1);
 198                 }
 199         }
 200
 201         if (!(opts & OPT_DONOTHING) && (kernel == NULL) && (core == NULL)) {
 202                 bzero((char *)&obj, sizeof(obj));
 203                 obj.ipfo_rev = IPFILTER_VERSION;
 204                 obj.ipfo_type = IPFOBJ_NATSTAT;
 205                 obj.ipfo_size = sizeof(*nsp);
 206                 obj.ipfo_ptr = (void *)nsp;
 207                 if (ioctl(fd, SIOCGNATS, &obj) == -1) {
 208                         ipferror(fd, "ioctl(SIOCGNATS)");
 209                         exit(1);
 210                 }
 211                 (void) setgid(getgid());
 212                 (void) setuid(getuid());
 213         } else if ((kernel != NULL) || (core != NULL)) {
 214                 if (openkmem(kernel, core) == -1)
 215                         exit(1);
 216
 217                 natstat_dead(nsp, kernel);
 218                 if (opts & (OPT_LIST|OPT_STAT))
 219                         dostats(fd, nsp, opts, 0, natfilter);
 220                 exit(0);
 221         }
 222
 223         if (opts & (OPT_FLUSH|OPT_CLEAR))
 224                 flushtable(fd, opts, natfilter);
 225         if (file) {
 226                 return ipnat_parsefile(fd, ipnat_addrule, ioctl, file);
 227         }
 228         if (opts & (OPT_LIST|OPT_STAT))
 229                 dostats(fd, nsp, opts, 1, natfilter);
 230         return 0;
 231 }
 232
 233
 234 /*
 235  * Read NAT statistic information in using a symbol table and memory file
 236  * rather than doing ioctl's.
 237  */
 238 void natstat_dead(nsp, kernel)
 239         natstat_t *nsp;
 240         char *kernel;
 241 {
 242         struct nlist nat_nlist[10] = {
 243                 { "nat_table" },                /* 0 */
 244                 { "nat_list" },
 245                 { "maptable" },
 246                 { "ipf_nattable_sz" },
 247                 { "ipf_natrules_sz" },
 248                 { "ipf_rdrrules_sz" },          /* 5 */
 249                 { "ipf_hostmap_sz" },
 250                 { "nat_instances" },
 251                 { NULL }
 252         };
 253         void *tables[2];
 254
 255         if (nlist(kernel, nat_nlist) == -1) {
 256                 fprintf(stderr, "nlist error\n");
 257                 return;
 258         }
 259
 260         /*
 261          * Normally the ioctl copies all of these values into the structure
 262          * for us, before returning it to userland, so here we must copy each
 263          * one in individually.
 264          */
 265         kmemcpy((char *)&tables, nat_nlist[0].n_value, sizeof(tables));
 266         nsp->ns_side[0].ns_table = tables[0];
 267         nsp->ns_side[1].ns_table = tables[1];
 268
 269         kmemcpy((char *)&nsp->ns_list, nat_nlist[1].n_value,
 270                 sizeof(nsp->ns_list));
 271         kmemcpy((char *)&nsp->ns_maptable, nat_nlist[2].n_value,
 272                 sizeof(nsp->ns_maptable));
 273         kmemcpy((char *)&nsp->ns_nattab_sz, nat_nlist[3].n_value,
 274                 sizeof(nsp->ns_nattab_sz));
 275         kmemcpy((char *)&nsp->ns_rultab_sz, nat_nlist[4].n_value,
 276                 sizeof(nsp->ns_rultab_sz));
 277         kmemcpy((char *)&nsp->ns_rdrtab_sz, nat_nlist[5].n_value,
 278                 sizeof(nsp->ns_rdrtab_sz));
 279         kmemcpy((char *)&nsp->ns_hostmap_sz, nat_nlist[6].n_value,
 280                 sizeof(nsp->ns_hostmap_sz));
 281         kmemcpy((char *)&nsp->ns_instances, nat_nlist[7].n_value,
 282                 sizeof(nsp->ns_instances));
 283 }
 284
 285
 286 /*
 287  * Issue an ioctl to flush either the NAT rules table or the active mapping
 288  * table or both.
 289  */
 290 void flushtable(fd, opts, match)
 291         int fd, opts, *match;
 292 {
 293         int n = 0;
 294
 295         if (opts & OPT_FLUSH) {
 296                 n = 0;
 297                 if (!(opts & OPT_DONOTHING)) {
 298                         if (match != NULL) {
 299                                 ipfobj_t obj;
 300
 301                                 obj.ipfo_rev = IPFILTER_VERSION;
 302                                 obj.ipfo_size = match[0] * sizeof(int);
 303                                 obj.ipfo_type = IPFOBJ_IPFEXPR;
 304                                 obj.ipfo_ptr = match;
 305                                 if (ioctl(fd, SIOCMATCHFLUSH, &obj) == -1) {
 306                                         ipferror(fd, "ioctl(SIOCMATCHFLUSH)");
 307                                         n = -1;
 308                                 } else {
 309                                         n = obj.ipfo_retval;
 310                                 }
 311                         } else if (ioctl(fd, SIOCIPFFL, &n) == -1) {
 312                                 ipferror(fd, "ioctl(SIOCIPFFL)");
 313                                 n = -1;
 314                         }
 315                 }
 316                 if (n >= 0)
 317                         printf("%d entries flushed from NAT table\n", n);
 318         }
 319
 320         if (opts & OPT_CLEAR) {
 321                 n = 1;
 322                 if (!(opts & OPT_DONOTHING) && ioctl(fd, SIOCIPFFL, &n) == -1)
 323                         ipferror(fd, "ioctl(SIOCCNATL)");
 324                 else
 325                         printf("%d entries flushed from NAT list\n", n);
 326         }
 327 }
 328
 329
 330 /*
 331  * Display NAT statistics.
 332  */
 333 void dostats_dead(nsp, opts, filter)
 334         natstat_t *nsp;
 335         int opts, *filter;
 336 {
 337         nat_t *np, nat;
 338         ipnat_t ipn;
 339         int i;
 340
 341         if (nat_fields == NULL) {
 342                 printf("List of active MAP/Redirect filters:\n");
 343                 while (nsp->ns_list) {
 344                         if (kmemcpy((char *)&ipn, (long)nsp->ns_list,
 345                                     sizeof(ipn))) {
 346                                 perror("kmemcpy");
 347                                 break;
 348                         }
 349                         if (opts & OPT_HITS)
 350                                 printf("%lu ", ipn.in_hits);
 351                         printnat(&ipn, opts & (OPT_DEBUG|OPT_VERBOSE));
 352                         nsp->ns_list = ipn.in_next;
 353                 }
 354         }
 355
 356         if (nat_fields == NULL) {
 357                 printf("\nList of active sessions:\n");
 358
 359         } else if (nohdrfields == 0) {
 360                 for (i = 0; nat_fields[i].w_value != 0; i++) {
 361                         printfieldhdr(natfields, nat_fields + i);
 362                         if (nat_fields[i + 1].w_value != 0)
 363                                 printf("\t");
 364                 }
 365                 printf("\n");
 366         }
 367
 368         for (np = nsp->ns_instances; np; np = nat.nat_next) {
 369                 if (kmemcpy((char *)&nat, (long)np, sizeof(nat)))
 370                         break;
 371                 if ((filter != NULL) && (nat_matcharray(&nat, filter) == 0))
 372                         continue;
 373                 if (nat_fields != NULL) {
 374                         for (i = 0; nat_fields[i].w_value != 0; i++) {
 375                                 printnatfield(&nat, nat_fields[i].w_value);
 376                                 if (nat_fields[i + 1].w_value != 0)
 377                                         printf("\t");
 378                         }
 379                         printf("\n");
 380                 } else {
 381                         printactivenat(&nat, opts, nsp->ns_ticks);
 382                         if (nat.nat_aps) {
 383                                 int proto;
 384
 385                                 if (nat.nat_dir & NAT_OUTBOUND)
 386                                         proto = nat.nat_pr[1];
 387                                 else
 388                                         proto = nat.nat_pr[0];
 389                                 printaps(nat.nat_aps, opts, proto);
 390                         }
 391                 }
 392         }
 393
 394         if (opts & OPT_VERBOSE)
 395                 showhostmap_dead(nsp);
 396 }
 397
 398
 399 void dotable(nsp, fd, alive, which, side)
 400         natstat_t *nsp;
 401         int fd, alive, which;
 402         char *side;
 403 {
 404         int sz, i, used, maxlen, minlen, totallen;
 405         ipftable_t table;
 406         u_int *buckets;
 407         ipfobj_t obj;
 408
 409         sz = sizeof(*buckets) * nsp->ns_nattab_sz;
 410         buckets = (u_int *)malloc(sz);
 411         if (buckets == NULL) {
 412                 fprintf(stderr,
 413                         "cannot allocate memory (%d) for buckets\n", sz);
 414                 return;
 415         }
 416
 417         obj.ipfo_rev = IPFILTER_VERSION;
 418         obj.ipfo_type = IPFOBJ_GTABLE;
 419         obj.ipfo_size = sizeof(table);
 420         obj.ipfo_ptr = &table;
 421
 422         if (which == 0) {
 423                 table.ita_type = IPFTABLE_BUCKETS_NATIN;
 424         } else if (which == 1) {
 425                 table.ita_type = IPFTABLE_BUCKETS_NATOUT;
 426         }
 427         table.ita_table = buckets;
 428
 429         if (alive) {
 430                 if (ioctl(fd, SIOCGTABL, &obj) != 0) {
 431                         ipferror(fd, "SIOCFTABL");
 432                         free(buckets);
 433                         return;
 434                 }
 435         } else {
 436                 if (kmemcpy((char *)buckets, (u_long)nsp->ns_nattab_sz, sz)) {
 437                         free(buckets);
 438                         return;
 439                 }
 440         }
 441
 442         minlen = nsp->ns_side[which].ns_inuse;
 443         totallen = 0;
 444         maxlen = 0;
 445         used = 0;
 446
 447         for (i = 0; i < nsp->ns_nattab_sz; i++) {
 448                 if (buckets[i] > maxlen)
 449                         maxlen = buckets[i];
 450                 if (buckets[i] < minlen)
 451                         minlen = buckets[i];
 452                 if (buckets[i] != 0)
 453                         used++;
 454                 totallen += buckets[i];
 455         }
 456
 457         printf("%d%%\thash efficiency %s\n",
 458                totallen ? used * 100 / totallen : 0, side);
 459         printf("%2.2f%%\tbucket usage %s\n",
 460                ((float)used / nsp->ns_nattab_sz) * 100.0, side);
 461         printf("%d\tminimal length %s\n", minlen, side);
 462         printf("%d\tmaximal length %s\n", maxlen, side);
 463         printf("%.3f\taverage length %s\n",
 464                used ? ((float)totallen / used) : 0.0, side);
 465
 466         free(buckets);
 467 }
 468
 469
 470 void dostats(fd, nsp, opts, alive, filter)
 471         natstat_t *nsp;
 472         int fd, opts, alive, *filter;
 473 {
 474         /*
 475          * Show statistics ?
 476          */
 477         if (opts & OPT_STAT) {
 478                 printnatside("in", &nsp->ns_side[0]);
 479                 dotable(nsp, fd, alive, 0, "in");
 480
 481                 printnatside("out", &nsp->ns_side[1]);
 482                 dotable(nsp, fd, alive, 1, "out");
 483
 484                 printf("%lu\tlog successes\n", nsp->ns_side[0].ns_log);
 485                 printf("%lu\tlog failures\n", nsp->ns_side[1].ns_log);
 486                 printf("%lu\tadded in\n%lu\tadded out\n",
 487                         nsp->ns_side[0].ns_added,
 488                         nsp->ns_side[1].ns_added);
 489                 printf("%u\tactive\n", nsp->ns_active);
 490                 printf("%lu\ttransparent adds\n", nsp->ns_addtrpnt);
 491                 printf("%lu\tdivert build\n", nsp->ns_divert_build);
 492                 printf("%lu\texpired\n", nsp->ns_expire);
 493                 printf("%lu\tflush all\n", nsp->ns_flush_all);
 494                 printf("%lu\tflush closing\n", nsp->ns_flush_closing);
 495                 printf("%lu\tflush queue\n", nsp->ns_flush_queue);
 496                 printf("%lu\tflush state\n", nsp->ns_flush_state);
 497                 printf("%lu\tflush timeout\n", nsp->ns_flush_timeout);
 498                 printf("%lu\thostmap new\n", nsp->ns_hm_new);
 499                 printf("%lu\thostmap fails\n", nsp->ns_hm_newfail);
 500                 printf("%lu\thostmap add\n", nsp->ns_hm_addref);
 501                 printf("%lu\thostmap NULL rule\n", nsp->ns_hm_nullnp);
 502                 printf("%lu\tlog ok\n", nsp->ns_log_ok);
 503                 printf("%lu\tlog fail\n", nsp->ns_log_fail);
 504                 printf("%u\torphan count\n", nsp->ns_orphans);
 505                 printf("%u\trule count\n", nsp->ns_rules);
 506                 printf("%u\tmap rules\n", nsp->ns_rules_map);
 507                 printf("%u\trdr rules\n", nsp->ns_rules_rdr);
 508                 printf("%u\twilds\n", nsp->ns_wilds);
 509                 if (opts & OPT_VERBOSE)
 510                         printf("list %p\n", nsp->ns_list);
 511         }
 512
 513         if (opts & OPT_LIST) {
 514                 if (alive)
 515                         dostats_live(fd, nsp, opts, filter);
 516                 else
 517                         dostats_dead(nsp, opts, filter);
 518         }
 519 }
 520
 521
 522 /*
 523  * Display NAT statistics.
 524  */
 525 void dostats_live(fd, nsp, opts, filter)
 526         natstat_t *nsp;
 527         int fd, opts, *filter;
 528 {
 529         ipfgeniter_t iter;
 530         char buffer[2000];
 531         ipfobj_t obj;
 532         ipnat_t *ipn;
 533         nat_t nat;
 534         int i;
 535
 536         bzero((char *)&obj, sizeof(obj));
 537         obj.ipfo_rev = IPFILTER_VERSION;
 538         obj.ipfo_type = IPFOBJ_GENITER;
 539         obj.ipfo_size = sizeof(iter);
 540         obj.ipfo_ptr = &iter;
 541
 542         iter.igi_type = IPFGENITER_IPNAT;
 543         iter.igi_nitems = 1;
 544         iter.igi_data = buffer;
 545         ipn = (ipnat_t *)buffer;
 546
 547         /*
 548          * Show list of NAT rules and NAT sessions ?
 549          */
 550         if (nat_fields == NULL) {
 551                 printf("List of active MAP/Redirect filters:\n");
 552                 while (nsp->ns_list) {
 553                         if (ioctl(fd, SIOCGENITER, &obj) == -1)
 554                                 break;
 555                         if (opts & OPT_HITS)
 556                                 printf("%lu ", ipn->in_hits);
 557                         printnat(ipn, opts & (OPT_DEBUG|OPT_VERBOSE));
 558                         nsp->ns_list = ipn->in_next;
 559                 }
 560         }
 561
 562         if (nat_fields == NULL) {
 563                 printf("\nList of active sessions:\n");
 564
 565         } else if (nohdrfields == 0) {
 566                 for (i = 0; nat_fields[i].w_value != 0; i++) {
 567                         printfieldhdr(natfields, nat_fields + i);
 568                         if (nat_fields[i + 1].w_value != 0)
 569                                 printf("\t");
 570                 }
 571                 printf("\n");
 572         }
 573
 574         i = IPFGENITER_IPNAT;
 575         (void) ioctl(fd,SIOCIPFDELTOK, &i);
 576
 577
 578         iter.igi_type = IPFGENITER_NAT;
 579         iter.igi_nitems = 1;
 580         iter.igi_data = &nat;
 581
 582         while (nsp->ns_instances != NULL) {
 583                 if (ioctl(fd, SIOCGENITER, &obj) == -1)
 584                         break;
 585                 if ((filter != NULL) && (nat_matcharray(&nat, filter) == 0))
 586                         continue;
 587                 if (nat_fields != NULL) {
 588                         for (i = 0; nat_fields[i].w_value != 0; i++) {
 589                                 printnatfield(&nat, nat_fields[i].w_value);
 590                                 if (nat_fields[i + 1].w_value != 0)
 591                                         printf("\t");
 592                         }
 593                         printf("\n");
 594                 } else {
 595                         printactivenat(&nat, opts, nsp->ns_ticks);
 596                         if (nat.nat_aps) {
 597                                 int proto;
 598
 599                                 if (nat.nat_dir & NAT_OUTBOUND)
 600                                         proto = nat.nat_pr[1];
 601                                 else
 602                                         proto = nat.nat_pr[0];
 603                                 printaps(nat.nat_aps, opts, proto);
 604                         }
 605                 }
 606                 nsp->ns_instances = nat.nat_next;
 607         }
 608
 609         if (opts & OPT_VERBOSE)
 610                 showhostmap_live(fd, nsp);
 611
 612         i = IPFGENITER_NAT;
 613         (void) ioctl(fd,SIOCIPFDELTOK, &i);
 614 }
 615
 616
 617 /*
 618  * Display the active host mapping table.
 619  */
 620 void showhostmap_dead(nsp)
 621         natstat_t *nsp;
 622 {
 623         hostmap_t hm, *hmp, **maptable;
 624         u_int hv;
 625
 626         printf("\nList of active host mappings:\n");
 627
 628         maptable = (hostmap_t **)malloc(sizeof(hostmap_t *) *
 629                                         nsp->ns_hostmap_sz);
 630         if (kmemcpy((char *)maptable, (u_long)nsp->ns_maptable,
 631                     sizeof(hostmap_t *) * nsp->ns_hostmap_sz)) {
 632                 perror("kmemcpy (maptable)");
 633                 return;
 634         }
 635
 636         for (hv = 0; hv < nsp->ns_hostmap_sz; hv++) {
 637                 hmp = maptable[hv];
 638
 639                 while (hmp) {
 640                         if (kmemcpy((char *)&hm, (u_long)hmp, sizeof(hm))) {
 641                                 perror("kmemcpy (hostmap)");
 642                                 return;
 643                         }
 644
 645                         printhostmap(&hm, hv);
 646                         hmp = hm.hm_next;
 647                 }
 648         }
 649         free(maptable);
 650 }
 651
 652
 653 /*
 654  * Display the active host mapping table.
 655  */
 656 void showhostmap_live(fd, nsp)
 657         int fd;
 658         natstat_t *nsp;
 659 {
 660         ipfgeniter_t iter;
 661         hostmap_t hm;
 662         ipfobj_t obj;
 663         int i;
 664
 665         bzero((char *)&obj, sizeof(obj));
 666         obj.ipfo_rev = IPFILTER_VERSION;
 667         obj.ipfo_type = IPFOBJ_GENITER;
 668         obj.ipfo_size = sizeof(iter);
 669         obj.ipfo_ptr = &iter;
 670
 671         iter.igi_type = IPFGENITER_HOSTMAP;
 672         iter.igi_nitems = 1;
 673         iter.igi_data = &hm;
 674
 675         printf("\nList of active host mappings:\n");
 676
 677         while (nsp->ns_maplist != NULL) {
 678                 if (ioctl(fd, SIOCGENITER, &obj) == -1)
 679                         break;
 680                 printhostmap(&hm, hm.hm_hv);
 681                 nsp->ns_maplist = hm.hm_next;
 682         }
 683
 684         i = IPFGENITER_HOSTMAP;
 685         (void) ioctl(fd,SIOCIPFDELTOK, &i);
 686 }
 687
 688
 689 int nat_matcharray(nat, array)
 690         nat_t *nat;
 691         int *array;
 692 {
 693         int i, n, *x, rv, p;
 694         ipfexp_t *e;
 695
 696         rv = 0;
 697         n = array[0];
 698         x = array + 1;
 699
 700         for (; n > 0; x += 3 + x[3], rv = 0) {
 701                 e = (ipfexp_t *)x;
 702                 if (e->ipfe_cmd == IPF_EXP_END)
 703                         break;
 704                 n -= e->ipfe_size;
 705
 706                 p = e->ipfe_cmd >> 16;
 707                 if ((p != 0) && (p != nat->nat_pr[1]))
 708                         break;
 709
 710                 switch (e->ipfe_cmd)
 711                 {
 712                 case IPF_EXP_IP_PR :
 713                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 714                                 rv |= (nat->nat_pr[1] == e->ipfe_arg0[i]);
 715                         }
 716                         break;
 717
 718                 case IPF_EXP_IP_SRCADDR :
 719                         if (nat->nat_v[0] != 4)
 720                                 break;
 721                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 722                                 rv |= ((nat->nat_osrcaddr &
 723                                         e->ipfe_arg0[i * 2 + 1]) ==
 724                                        e->ipfe_arg0[i * 2]) ||
 725                                       ((nat->nat_nsrcaddr &
 726                                         e->ipfe_arg0[i * 2 + 1]) ==
 727                                        e->ipfe_arg0[i * 2]);
 728                         }
 729                         break;
 730
 731                 case IPF_EXP_IP_DSTADDR :
 732                         if (nat->nat_v[0] != 4)
 733                                 break;
 734                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 735                                 rv |= ((nat->nat_odstaddr &
 736                                         e->ipfe_arg0[i * 2 + 1]) ==
 737                                        e->ipfe_arg0[i * 2]) ||
 738                                       ((nat->nat_ndstaddr &
 739                                         e->ipfe_arg0[i * 2 + 1]) ==
 740                                        e->ipfe_arg0[i * 2]);
 741                         }
 742                         break;
 743
 744                 case IPF_EXP_IP_ADDR :
 745                         if (nat->nat_v[0] != 4)
 746                                 break;
 747                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 748                                 rv |= ((nat->nat_osrcaddr &
 749                                         e->ipfe_arg0[i * 2 + 1]) ==
 750                                        e->ipfe_arg0[i * 2]) ||
 751                                       ((nat->nat_nsrcaddr &
 752                                         e->ipfe_arg0[i * 2 + 1]) ==
 753                                        e->ipfe_arg0[i * 2]) ||
 754                                      ((nat->nat_odstaddr &
 755                                         e->ipfe_arg0[i * 2 + 1]) ==
 756                                        e->ipfe_arg0[i * 2]) ||
 757                                      ((nat->nat_ndstaddr &
 758                                         e->ipfe_arg0[i * 2 + 1]) ==
 759                                        e->ipfe_arg0[i * 2]);
 760                         }
 761                         break;
 762
 763 #ifdef USE_INET6
 764                 case IPF_EXP_IP6_SRCADDR :
 765                         if (nat->nat_v[0] != 6)
 766                                 break;
 767                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 768                                 rv |= IP6_MASKEQ(&nat->nat_osrc6,
 769                                                  &e->ipfe_arg0[i * 8 + 4],
 770                                                  &e->ipfe_arg0[i * 8]) ||
 771                                       IP6_MASKEQ(&nat->nat_nsrc6,
 772                                                  &e->ipfe_arg0[i * 8 + 4],
 773                                                  &e->ipfe_arg0[i * 8]);
 774                         }
 775                         break;
 776
 777                 case IPF_EXP_IP6_DSTADDR :
 778                         if (nat->nat_v[0] != 6)
 779                                 break;
 780                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 781                                 rv |= IP6_MASKEQ(&nat->nat_odst6,
 782                                                  &e->ipfe_arg0[i * 8 + 4],
 783                                                  &e->ipfe_arg0[i * 8]) ||
 784                                       IP6_MASKEQ(&nat->nat_ndst6,
 785                                                  &e->ipfe_arg0[i * 8 + 4],
 786                                                  &e->ipfe_arg0[i * 8]);
 787                         }
 788                         break;
 789
 790                 case IPF_EXP_IP6_ADDR :
 791                         if (nat->nat_v[0] != 6)
 792                                 break;
 793                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 794                                 rv |= IP6_MASKEQ(&nat->nat_osrc6,
 795                                                  &e->ipfe_arg0[i * 8 + 4],
 796                                                  &e->ipfe_arg0[i * 8]) ||
 797                                       IP6_MASKEQ(&nat->nat_nsrc6,
 798                                                  &e->ipfe_arg0[i * 8 + 4],
 799                                                  &e->ipfe_arg0[i * 8]) ||
 800                                       IP6_MASKEQ(&nat->nat_odst6,
 801                                                  &e->ipfe_arg0[i * 8 + 4],
 802                                                  &e->ipfe_arg0[i * 8]) ||
 803                                       IP6_MASKEQ(&nat->nat_ndst6,
 804                                                  &e->ipfe_arg0[i * 8 + 4],
 805                                                  &e->ipfe_arg0[i * 8]);
 806                         }
 807                         break;
 808 #endif
 809
 810                 case IPF_EXP_UDP_PORT :
 811                 case IPF_EXP_TCP_PORT :
 812                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 813                                 rv |= (nat->nat_osport == e->ipfe_arg0[i]) ||
 814                                       (nat->nat_nsport == e->ipfe_arg0[i]) ||
 815                                       (nat->nat_odport == e->ipfe_arg0[i]) ||
 816                                       (nat->nat_ndport == e->ipfe_arg0[i]);
 817                         }
 818                         break;
 819
 820                 case IPF_EXP_UDP_SPORT :
 821                 case IPF_EXP_TCP_SPORT :
 822                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 823                                 rv |= (nat->nat_osport == e->ipfe_arg0[i]) ||
 824                                       (nat->nat_nsport == e->ipfe_arg0[i]);
 825                         }
 826                         break;
 827
 828                 case IPF_EXP_UDP_DPORT :
 829                 case IPF_EXP_TCP_DPORT :
 830                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 831                                 rv |= (nat->nat_odport == e->ipfe_arg0[i]) ||
 832                                       (nat->nat_ndport == e->ipfe_arg0[i]);
 833                         }
 834                         break;
 835                 }
 836                 rv ^= e->ipfe_not;
 837
 838                 if (rv == 0)
 839                         break;
 840         }
 841
 842         return rv;
 843 }