contrib/ipfilter/tools/ipnat.c

   1 /*      $FreeBSD$       */
   2
   3 /*
   4  * Copyright (C) 2012 by Darren Reed.
   5  *
   6  * See the IPFILTER.LICENCE file for details on licencing.
   7  *
   8  * Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com)
   9  */
  10 #include <stdio.h>
  11 #include <string.h>
  12 #include <fcntl.h>
  13 #include <errno.h>
  14 #include <sys/types.h>
  15 #if !defined(__SVR4)
  16 #include <strings.h>
  17 #else
  18 #include <sys/byteorder.h>
  19 #endif
  20 #include <sys/time.h>
  21 #include <sys/param.h>
  22 #include <stdlib.h>
  23 #include <unistd.h>
  24 #include <stddef.h>
  25 #include <sys/file.h>
  26 #define _KERNEL
  27 #include <sys/uio.h>
  28 #undef _KERNEL
  29 #include <sys/socket.h>
  30 #include <sys/ioctl.h>
  31 #if defined(sun) && defined(__SVR4)
  32 # include <sys/ioccom.h>
  33 # include <sys/sysmacros.h>
  34 #endif
  35 #include <netinet/in.h>
  36 #include <netinet/in_systm.h>
  37 #include <netinet/ip.h>
  38 #include <netinet/tcp.h>
  39 #include <net/if.h>
  40 #include <netdb.h>
  41 #include <arpa/nameser.h>
  42 #include <arpa/inet.h>
  43 #include <resolv.h>
  44 #include <ctype.h>
  45 # include <nlist.h>
  46 #include "ipf.h"
  47 #include "netinet/ipl.h"
  48 #include "kmem.h"
  49
  50
  51 # define        STRERROR(x)     strerror(x)
  52
  53 #if !defined(lint)
  54 static const char sccsid[] ="@(#)ipnat.c        1.9 6/5/96 (C) 1993 Darren Reed";
  55 static const char rcsid[] = "@(#)$Id$";
  56 #endif
  57
  58
  59 #if     SOLARIS
  60 #define bzero(a,b)      memset(a,0,b)
  61 #endif
  62 int     use_inet6 = 0;
  63
  64 extern  char    *optarg;
  65
  66 void    dostats __P((int, natstat_t *, int, int, int *));
  67 void    dotable __P((natstat_t *, int, int, int, char *));
  68 void    flushtable __P((int, int, int *));
  69 void    usage __P((char *));
  70 int     main __P((int, char*[]));
  71 void    showhostmap __P((natstat_t *nsp));
  72 void    natstat_dead __P((natstat_t *, char *));
  73 void    dostats_live __P((int, natstat_t *, int, int *));
  74 void    showhostmap_dead __P((natstat_t *));
  75 void    showhostmap_live __P((int, natstat_t *));
  76 void    dostats_dead __P((natstat_t *, int, int *));
  77 int     nat_matcharray __P((nat_t *, int *));
  78
  79 int             opts;
  80 int             nohdrfields = 0;
  81 wordtab_t       *nat_fields = NULL;
  82
  83 void usage(name)
  84         char *name;
  85 {
  86         fprintf(stderr, "Usage: %s [-CFhlnrRsv] [-f filename]\n", name);
  87         exit(1);
  88 }
  89
  90
  91 int main(argc, argv)
  92         int argc;
  93         char *argv[];
  94 {
  95         int fd, c, mode, *natfilter;
  96         char *file, *core, *kernel;
  97         natstat_t ns, *nsp;
  98         ipfobj_t obj;
  99
 100         fd = -1;
 101         opts = 0;
 102         nsp = &ns;
 103         file = NULL;
 104         core = NULL;
 105         kernel = NULL;
 106         mode = O_RDWR;
 107         natfilter = NULL;
 108
 109         assigndefined(getenv("IPNAT_PREDEFINED"));
 110
 111         while ((c = getopt(argc, argv, "CdFf:hlm:M:N:nO:prRsv")) != -1)
 112                 switch (c)
 113                 {
 114                 case 'C' :
 115                         opts |= OPT_CLEAR;
 116                         break;
 117                 case 'd' :
 118                         opts |= OPT_DEBUG;
 119                         break;
 120                 case 'f' :
 121                         file = optarg;
 122                         break;
 123                 case 'F' :
 124                         opts |= OPT_FLUSH;
 125                         break;
 126                 case 'h' :
 127                         opts |=OPT_HITS;
 128                         break;
 129                 case 'l' :
 130                         opts |= OPT_LIST;
 131                         mode = O_RDONLY;
 132                         break;
 133                 case 'm' :
 134                         natfilter = parseipfexpr(optarg, NULL);
 135                         break;
 136                 case 'M' :
 137                         core = optarg;
 138                         break;
 139                 case 'N' :
 140                         kernel = optarg;
 141                         break;
 142                 case 'n' :
 143                         opts |= OPT_DONOTHING|OPT_DONTOPEN;
 144                         mode = O_RDONLY;
 145                         break;
 146                 case 'O' :
 147                         nat_fields = parsefields(natfields, optarg);
 148                         break;
 149                 case 'p' :
 150                         opts |= OPT_PURGE;
 151                         break;
 152                 case 'R' :
 153                         opts |= OPT_NORESOLVE;
 154                         break;
 155                 case 'r' :
 156                         opts |= OPT_REMOVE;
 157                         break;
 158                 case 's' :
 159                         opts |= OPT_STAT;
 160                         mode = O_RDONLY;
 161                         break;
 162                 case 'v' :
 163                         opts |= OPT_VERBOSE;
 164                         break;
 165                 default :
 166                         usage(argv[0]);
 167                 }
 168
 169         if (((opts & OPT_PURGE) != 0) && ((opts & OPT_REMOVE) == 0)) {
 170                 (void) fprintf(stderr, "%s: -p must be used with -r\n",
 171                                argv[0]);
 172                 exit(1);
 173         }
 174
 175         initparse();
 176
 177         if ((kernel != NULL) || (core != NULL)) {
 178                 (void) setgid(getgid());
 179                 (void) setuid(getuid());
 180         }
 181
 182         if (!(opts & OPT_DONOTHING)) {
 183                 if (((fd = open(IPNAT_NAME, mode)) == -1) &&
 184                     ((fd = open(IPNAT_NAME, O_RDONLY)) == -1)) {
 185                         (void) fprintf(stderr, "%s: open: %s\n", IPNAT_NAME,
 186                                 STRERROR(errno));
 187                         exit(1);
 188                 }
 189         }
 190
 191         bzero((char *)&ns, sizeof(ns));
 192
 193         if ((opts & OPT_DONOTHING) == 0) {
 194                 if (checkrev(IPL_NAME) == -1) {
 195                         fprintf(stderr, "User/kernel version check failed\n");
 196                         exit(1);
 197                 }
 198         }
 199
 200         if (!(opts & OPT_DONOTHING) && (kernel == NULL) && (core == NULL)) {
 201                 bzero((char *)&obj, sizeof(obj));
 202                 obj.ipfo_rev = IPFILTER_VERSION;
 203                 obj.ipfo_type = IPFOBJ_NATSTAT;
 204                 obj.ipfo_size = sizeof(*nsp);
 205                 obj.ipfo_ptr = (void *)nsp;
 206                 if (ioctl(fd, SIOCGNATS, &obj) == -1) {
 207                         ipferror(fd, "ioctl(SIOCGNATS)");
 208                         exit(1);
 209                 }
 210                 (void) setgid(getgid());
 211                 (void) setuid(getuid());
 212         } else if ((kernel != NULL) || (core != NULL)) {
 213                 if (openkmem(kernel, core) == -1)
 214                         exit(1);
 215
 216                 natstat_dead(nsp, kernel);
 217                 if (opts & (OPT_LIST|OPT_STAT))
 218                         dostats(fd, nsp, opts, 0, natfilter);
 219                 exit(0);
 220         }
 221
 222         if (opts & (OPT_FLUSH|OPT_CLEAR))
 223                 flushtable(fd, opts, natfilter);
 224         if (file) {
 225                 return ipnat_parsefile(fd, ipnat_addrule, ioctl, file);
 226         }
 227         if (opts & (OPT_LIST|OPT_STAT))
 228                 dostats(fd, nsp, opts, 1, natfilter);
 229         return 0;
 230 }
 231
 232
 233 /*
 234  * Read NAT statistic information in using a symbol table and memory file
 235  * rather than doing ioctl's.
 236  */
 237 void natstat_dead(nsp, kernel)
 238         natstat_t *nsp;
 239         char *kernel;
 240 {
 241         struct nlist nat_nlist[10] = {
 242                 { "nat_table" },                /* 0 */
 243                 { "nat_list" },
 244                 { "maptable" },
 245                 { "ipf_nattable_sz" },
 246                 { "ipf_natrules_sz" },
 247                 { "ipf_rdrrules_sz" },          /* 5 */
 248                 { "ipf_hostmap_sz" },
 249                 { "nat_instances" },
 250                 { NULL }
 251         };
 252         void *tables[2];
 253
 254         if (nlist(kernel, nat_nlist) == -1) {
 255                 fprintf(stderr, "nlist error\n");
 256                 return;
 257         }
 258
 259         /*
 260          * Normally the ioctl copies all of these values into the structure
 261          * for us, before returning it to userland, so here we must copy each
 262          * one in individually.
 263          */
 264         kmemcpy((char *)&tables, nat_nlist[0].n_value, sizeof(tables));
 265         nsp->ns_side[0].ns_table = tables[0];
 266         nsp->ns_side[1].ns_table = tables[1];
 267
 268         kmemcpy((char *)&nsp->ns_list, nat_nlist[1].n_value,
 269                 sizeof(nsp->ns_list));
 270         kmemcpy((char *)&nsp->ns_maptable, nat_nlist[2].n_value,
 271                 sizeof(nsp->ns_maptable));
 272         kmemcpy((char *)&nsp->ns_nattab_sz, nat_nlist[3].n_value,
 273                 sizeof(nsp->ns_nattab_sz));
 274         kmemcpy((char *)&nsp->ns_rultab_sz, nat_nlist[4].n_value,
 275                 sizeof(nsp->ns_rultab_sz));
 276         kmemcpy((char *)&nsp->ns_rdrtab_sz, nat_nlist[5].n_value,
 277                 sizeof(nsp->ns_rdrtab_sz));
 278         kmemcpy((char *)&nsp->ns_hostmap_sz, nat_nlist[6].n_value,
 279                 sizeof(nsp->ns_hostmap_sz));
 280         kmemcpy((char *)&nsp->ns_instances, nat_nlist[7].n_value,
 281                 sizeof(nsp->ns_instances));
 282 }
 283
 284
 285 /*
 286  * Issue an ioctl to flush either the NAT rules table or the active mapping
 287  * table or both.
 288  */
 289 void flushtable(fd, opts, match)
 290         int fd, opts, *match;
 291 {
 292         int n = 0;
 293
 294         if (opts & OPT_FLUSH) {
 295                 n = 0;
 296                 if (!(opts & OPT_DONOTHING)) {
 297                         if (match != NULL) {
 298                                 ipfobj_t obj;
 299
 300                                 obj.ipfo_rev = IPFILTER_VERSION;
 301                                 obj.ipfo_size = match[0] * sizeof(int);
 302                                 obj.ipfo_type = IPFOBJ_IPFEXPR;
 303                                 obj.ipfo_ptr = match;
 304                                 if (ioctl(fd, SIOCMATCHFLUSH, &obj) == -1) {
 305                                         ipferror(fd, "ioctl(SIOCMATCHFLUSH)");
 306                                         n = -1;
 307                                 } else {
 308                                         n = obj.ipfo_retval;
 309                                 }
 310                         } else if (ioctl(fd, SIOCIPFFL, &n) == -1) {
 311                                 ipferror(fd, "ioctl(SIOCIPFFL)");
 312                                 n = -1;
 313                         }
 314                 }
 315                 if (n >= 0)
 316                         printf("%d entries flushed from NAT table\n", n);
 317         }
 318
 319         if (opts & OPT_CLEAR) {
 320                 n = 1;
 321                 if (!(opts & OPT_DONOTHING) && ioctl(fd, SIOCIPFFL, &n) == -1)
 322                         ipferror(fd, "ioctl(SIOCCNATL)");
 323                 else
 324                         printf("%d entries flushed from NAT list\n", n);
 325         }
 326 }
 327
 328
 329 /*
 330  * Display NAT statistics.
 331  */
 332 void dostats_dead(nsp, opts, filter)
 333         natstat_t *nsp;
 334         int opts, *filter;
 335 {
 336         nat_t *np, nat;
 337         ipnat_t ipn;
 338         int i;
 339
 340         if (nat_fields == NULL) {
 341                 printf("List of active MAP/Redirect filters:\n");
 342                 while (nsp->ns_list) {
 343                         if (kmemcpy((char *)&ipn, (long)nsp->ns_list,
 344                                     sizeof(ipn))) {
 345                                 perror("kmemcpy");
 346                                 break;
 347                         }
 348                         if (opts & OPT_HITS)
 349                                 printf("%lu ", ipn.in_hits);
 350                         printnat(&ipn, opts & (OPT_DEBUG|OPT_VERBOSE));
 351                         nsp->ns_list = ipn.in_next;
 352                 }
 353         }
 354
 355         if (nat_fields == NULL) {
 356                 printf("\nList of active sessions:\n");
 357
 358         } else if (nohdrfields == 0) {
 359                 for (i = 0; nat_fields[i].w_value != 0; i++) {
 360                         printfieldhdr(natfields, nat_fields + i);
 361                         if (nat_fields[i + 1].w_value != 0)
 362                                 printf("\t");
 363                 }
 364                 printf("\n");
 365         }
 366
 367         for (np = nsp->ns_instances; np; np = nat.nat_next) {
 368                 if (kmemcpy((char *)&nat, (long)np, sizeof(nat)))
 369                         break;
 370                 if ((filter != NULL) && (nat_matcharray(&nat, filter) == 0))
 371                         continue;
 372                 if (nat_fields != NULL) {
 373                         for (i = 0; nat_fields[i].w_value != 0; i++) {
 374                                 printnatfield(&nat, nat_fields[i].w_value);
 375                                 if (nat_fields[i + 1].w_value != 0)
 376                                         printf("\t");
 377                         }
 378                         printf("\n");
 379                 } else {
 380                         printactivenat(&nat, opts, nsp->ns_ticks);
 381                         if (nat.nat_aps) {
 382                                 int proto;
 383
 384                                 if (nat.nat_dir & NAT_OUTBOUND)
 385                                         proto = nat.nat_pr[1];
 386                                 else
 387                                         proto = nat.nat_pr[0];
 388                                 printaps(nat.nat_aps, opts, proto);
 389                         }
 390                 }
 391         }
 392
 393         if (opts & OPT_VERBOSE)
 394                 showhostmap_dead(nsp);
 395 }
 396
 397
 398 void dotable(nsp, fd, alive, which, side)
 399         natstat_t *nsp;
 400         int fd, alive, which;
 401         char *side;
 402 {
 403         int sz, i, used, maxlen, minlen, totallen;
 404         ipftable_t table;
 405         u_int *buckets;
 406         ipfobj_t obj;
 407
 408         sz = sizeof(*buckets) * nsp->ns_nattab_sz;
 409         buckets = (u_int *)malloc(sz);
 410         if (buckets == NULL) {
 411                 fprintf(stderr,
 412                         "cannot allocate memory (%d) for buckets\n", sz);
 413                 return;
 414         }
 415
 416         obj.ipfo_rev = IPFILTER_VERSION;
 417         obj.ipfo_type = IPFOBJ_GTABLE;
 418         obj.ipfo_size = sizeof(table);
 419         obj.ipfo_ptr = &table;
 420
 421         if (which == 0) {
 422                 table.ita_type = IPFTABLE_BUCKETS_NATIN;
 423         } else if (which == 1) {
 424                 table.ita_type = IPFTABLE_BUCKETS_NATOUT;
 425         }
 426         table.ita_table = buckets;
 427
 428         if (alive) {
 429                 if (ioctl(fd, SIOCGTABL, &obj) != 0) {
 430                         ipferror(fd, "SIOCFTABL");
 431                         free(buckets);
 432                         return;
 433                 }
 434         } else {
 435                 if (kmemcpy((char *)buckets, (u_long)nsp->ns_nattab_sz, sz)) {
 436                         free(buckets);
 437                         return;
 438                 }
 439         }
 440
 441         minlen = nsp->ns_side[which].ns_inuse;
 442         totallen = 0;
 443         maxlen = 0;
 444         used = 0;
 445
 446         for (i = 0; i < nsp->ns_nattab_sz; i++) {
 447                 if (buckets[i] > maxlen)
 448                         maxlen = buckets[i];
 449                 if (buckets[i] < minlen)
 450                         minlen = buckets[i];
 451                 if (buckets[i] != 0)
 452                         used++;
 453                 totallen += buckets[i];
 454         }
 455
 456         printf("%d%%\thash efficiency %s\n",
 457                totallen ? used * 100 / totallen : 0, side);
 458         printf("%2.2f%%\tbucket usage %s\n",
 459                ((float)used / nsp->ns_nattab_sz) * 100.0, side);
 460         printf("%d\tminimal length %s\n", minlen, side);
 461         printf("%d\tmaximal length %s\n", maxlen, side);
 462         printf("%.3f\taverage length %s\n",
 463                used ? ((float)totallen / used) : 0.0, side);
 464
 465         free(buckets);
 466 }
 467
 468
 469 void dostats(fd, nsp, opts, alive, filter)
 470         natstat_t *nsp;
 471         int fd, opts, alive, *filter;
 472 {
 473         /*
 474          * Show statistics ?
 475          */
 476         if (opts & OPT_STAT) {
 477                 printnatside("in", &nsp->ns_side[0]);
 478                 dotable(nsp, fd, alive, 0, "in");
 479
 480                 printnatside("out", &nsp->ns_side[1]);
 481                 dotable(nsp, fd, alive, 1, "out");
 482
 483                 printf("%lu\tlog successes\n", nsp->ns_side[0].ns_log);
 484                 printf("%lu\tlog failures\n", nsp->ns_side[1].ns_log);
 485                 printf("%lu\tadded in\n%lu\tadded out\n",
 486                         nsp->ns_side[0].ns_added,
 487                         nsp->ns_side[1].ns_added);
 488                 printf("%u\tactive\n", nsp->ns_active);
 489                 printf("%lu\ttransparent adds\n", nsp->ns_addtrpnt);
 490                 printf("%lu\tdivert build\n", nsp->ns_divert_build);
 491                 printf("%lu\texpired\n", nsp->ns_expire);
 492                 printf("%lu\tflush all\n", nsp->ns_flush_all);
 493                 printf("%lu\tflush closing\n", nsp->ns_flush_closing);
 494                 printf("%lu\tflush queue\n", nsp->ns_flush_queue);
 495                 printf("%lu\tflush state\n", nsp->ns_flush_state);
 496                 printf("%lu\tflush timeout\n", nsp->ns_flush_timeout);
 497                 printf("%lu\thostmap new\n", nsp->ns_hm_new);
 498                 printf("%lu\thostmap fails\n", nsp->ns_hm_newfail);
 499                 printf("%lu\thostmap add\n", nsp->ns_hm_addref);
 500                 printf("%lu\thostmap NULL rule\n", nsp->ns_hm_nullnp);
 501                 printf("%lu\tlog ok\n", nsp->ns_log_ok);
 502                 printf("%lu\tlog fail\n", nsp->ns_log_fail);
 503                 printf("%u\torphan count\n", nsp->ns_orphans);
 504                 printf("%u\trule count\n", nsp->ns_rules);
 505                 printf("%u\tmap rules\n", nsp->ns_rules_map);
 506                 printf("%u\trdr rules\n", nsp->ns_rules_rdr);
 507                 printf("%u\twilds\n", nsp->ns_wilds);
 508                 if (opts & OPT_VERBOSE)
 509                         printf("list %p\n", nsp->ns_list);
 510         }
 511
 512         if (opts & OPT_LIST) {
 513                 if (alive)
 514                         dostats_live(fd, nsp, opts, filter);
 515                 else
 516                         dostats_dead(nsp, opts, filter);
 517         }
 518 }
 519
 520
 521 /*
 522  * Display NAT statistics.
 523  */
 524 void dostats_live(fd, nsp, opts, filter)
 525         natstat_t *nsp;
 526         int fd, opts, *filter;
 527 {
 528         ipfgeniter_t iter;
 529         char buffer[2000];
 530         ipfobj_t obj;
 531         ipnat_t *ipn;
 532         nat_t nat;
 533         int i;
 534
 535         bzero((char *)&obj, sizeof(obj));
 536         obj.ipfo_rev = IPFILTER_VERSION;
 537         obj.ipfo_type = IPFOBJ_GENITER;
 538         obj.ipfo_size = sizeof(iter);
 539         obj.ipfo_ptr = &iter;
 540
 541         iter.igi_type = IPFGENITER_IPNAT;
 542         iter.igi_nitems = 1;
 543         iter.igi_data = buffer;
 544         ipn = (ipnat_t *)buffer;
 545
 546         /*
 547          * Show list of NAT rules and NAT sessions ?
 548          */
 549         if (nat_fields == NULL) {
 550                 printf("List of active MAP/Redirect filters:\n");
 551                 while (nsp->ns_list) {
 552                         if (ioctl(fd, SIOCGENITER, &obj) == -1)
 553                                 break;
 554                         if (opts & OPT_HITS)
 555                                 printf("%lu ", ipn->in_hits);
 556                         printnat(ipn, opts & (OPT_DEBUG|OPT_VERBOSE));
 557                         nsp->ns_list = ipn->in_next;
 558                 }
 559         }
 560
 561         if (nat_fields == NULL) {
 562                 printf("\nList of active sessions:\n");
 563
 564         } else if (nohdrfields == 0) {
 565                 for (i = 0; nat_fields[i].w_value != 0; i++) {
 566                         printfieldhdr(natfields, nat_fields + i);
 567                         if (nat_fields[i + 1].w_value != 0)
 568                                 printf("\t");
 569                 }
 570                 printf("\n");
 571         }
 572
 573         i = IPFGENITER_IPNAT;
 574         (void) ioctl(fd,SIOCIPFDELTOK, &i);
 575
 576
 577         iter.igi_type = IPFGENITER_NAT;
 578         iter.igi_nitems = 1;
 579         iter.igi_data = &nat;
 580
 581         while (nsp->ns_instances != NULL) {
 582                 if (ioctl(fd, SIOCGENITER, &obj) == -1)
 583                         break;
 584                 if ((filter != NULL) && (nat_matcharray(&nat, filter) == 0))
 585                         continue;
 586                 if (nat_fields != NULL) {
 587                         for (i = 0; nat_fields[i].w_value != 0; i++) {
 588                                 printnatfield(&nat, nat_fields[i].w_value);
 589                                 if (nat_fields[i + 1].w_value != 0)
 590                                         printf("\t");
 591                         }
 592                         printf("\n");
 593                 } else {
 594                         printactivenat(&nat, opts, nsp->ns_ticks);
 595                         if (nat.nat_aps) {
 596                                 int proto;
 597
 598                                 if (nat.nat_dir & NAT_OUTBOUND)
 599                                         proto = nat.nat_pr[1];
 600                                 else
 601                                         proto = nat.nat_pr[0];
 602                                 printaps(nat.nat_aps, opts, proto);
 603                         }
 604                 }
 605                 nsp->ns_instances = nat.nat_next;
 606         }
 607
 608         if (opts & OPT_VERBOSE)
 609                 showhostmap_live(fd, nsp);
 610
 611         i = IPFGENITER_NAT;
 612         (void) ioctl(fd,SIOCIPFDELTOK, &i);
 613 }
 614
 615
 616 /*
 617  * Display the active host mapping table.
 618  */
 619 void showhostmap_dead(nsp)
 620         natstat_t *nsp;
 621 {
 622         hostmap_t hm, *hmp, **maptable;
 623         u_int hv;
 624
 625         printf("\nList of active host mappings:\n");
 626
 627         maptable = (hostmap_t **)malloc(sizeof(hostmap_t *) *
 628                                         nsp->ns_hostmap_sz);
 629         if (kmemcpy((char *)maptable, (u_long)nsp->ns_maptable,
 630                     sizeof(hostmap_t *) * nsp->ns_hostmap_sz)) {
 631                 perror("kmemcpy (maptable)");
 632                 return;
 633         }
 634
 635         for (hv = 0; hv < nsp->ns_hostmap_sz; hv++) {
 636                 hmp = maptable[hv];
 637
 638                 while (hmp) {
 639                         if (kmemcpy((char *)&hm, (u_long)hmp, sizeof(hm))) {
 640                                 perror("kmemcpy (hostmap)");
 641                                 return;
 642                         }
 643
 644                         printhostmap(&hm, hv);
 645                         hmp = hm.hm_next;
 646                 }
 647         }
 648         free(maptable);
 649 }
 650
 651
 652 /*
 653  * Display the active host mapping table.
 654  */
 655 void showhostmap_live(fd, nsp)
 656         int fd;
 657         natstat_t *nsp;
 658 {
 659         ipfgeniter_t iter;
 660         hostmap_t hm;
 661         ipfobj_t obj;
 662         int i;
 663
 664         bzero((char *)&obj, sizeof(obj));
 665         obj.ipfo_rev = IPFILTER_VERSION;
 666         obj.ipfo_type = IPFOBJ_GENITER;
 667         obj.ipfo_size = sizeof(iter);
 668         obj.ipfo_ptr = &iter;
 669
 670         iter.igi_type = IPFGENITER_HOSTMAP;
 671         iter.igi_nitems = 1;
 672         iter.igi_data = &hm;
 673
 674         printf("\nList of active host mappings:\n");
 675
 676         while (nsp->ns_maplist != NULL) {
 677                 if (ioctl(fd, SIOCGENITER, &obj) == -1)
 678                         break;
 679                 printhostmap(&hm, hm.hm_hv);
 680                 nsp->ns_maplist = hm.hm_next;
 681         }
 682
 683         i = IPFGENITER_HOSTMAP;
 684         (void) ioctl(fd,SIOCIPFDELTOK, &i);
 685 }
 686
 687
 688 int nat_matcharray(nat, array)
 689         nat_t *nat;
 690         int *array;
 691 {
 692         int i, n, *x, rv, p;
 693         ipfexp_t *e;
 694
 695         rv = 0;
 696         n = array[0];
 697         x = array + 1;
 698
 699         for (; n > 0; x += 3 + x[3], rv = 0) {
 700                 e = (ipfexp_t *)x;
 701                 if (e->ipfe_cmd == IPF_EXP_END)
 702                         break;
 703                 n -= e->ipfe_size;
 704
 705                 p = e->ipfe_cmd >> 16;
 706                 if ((p != 0) && (p != nat->nat_pr[1]))
 707                         break;
 708
 709                 switch (e->ipfe_cmd)
 710                 {
 711                 case IPF_EXP_IP_PR :
 712                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 713                                 rv |= (nat->nat_pr[1] == e->ipfe_arg0[i]);
 714                         }
 715                         break;
 716
 717                 case IPF_EXP_IP_SRCADDR :
 718                         if (nat->nat_v[0] != 4)
 719                                 break;
 720                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 721                                 rv |= ((nat->nat_osrcaddr &
 722                                         e->ipfe_arg0[i * 2 + 1]) ==
 723                                        e->ipfe_arg0[i * 2]) ||
 724                                       ((nat->nat_nsrcaddr &
 725                                         e->ipfe_arg0[i * 2 + 1]) ==
 726                                        e->ipfe_arg0[i * 2]);
 727                         }
 728                         break;
 729
 730                 case IPF_EXP_IP_DSTADDR :
 731                         if (nat->nat_v[0] != 4)
 732                                 break;
 733                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 734                                 rv |= ((nat->nat_odstaddr &
 735                                         e->ipfe_arg0[i * 2 + 1]) ==
 736                                        e->ipfe_arg0[i * 2]) ||
 737                                       ((nat->nat_ndstaddr &
 738                                         e->ipfe_arg0[i * 2 + 1]) ==
 739                                        e->ipfe_arg0[i * 2]);
 740                         }
 741                         break;
 742
 743                 case IPF_EXP_IP_ADDR :
 744                         if (nat->nat_v[0] != 4)
 745                                 break;
 746                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 747                                 rv |= ((nat->nat_osrcaddr &
 748                                         e->ipfe_arg0[i * 2 + 1]) ==
 749                                        e->ipfe_arg0[i * 2]) ||
 750                                       ((nat->nat_nsrcaddr &
 751                                         e->ipfe_arg0[i * 2 + 1]) ==
 752                                        e->ipfe_arg0[i * 2]) ||
 753                                      ((nat->nat_odstaddr &
 754                                         e->ipfe_arg0[i * 2 + 1]) ==
 755                                        e->ipfe_arg0[i * 2]) ||
 756                                      ((nat->nat_ndstaddr &
 757                                         e->ipfe_arg0[i * 2 + 1]) ==
 758                                        e->ipfe_arg0[i * 2]);
 759                         }
 760                         break;
 761
 762 #ifdef USE_INET6
 763                 case IPF_EXP_IP6_SRCADDR :
 764                         if (nat->nat_v[0] != 6)
 765                                 break;
 766                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 767                                 rv |= IP6_MASKEQ(&nat->nat_osrc6,
 768                                                  &e->ipfe_arg0[i * 8 + 4],
 769                                                  &e->ipfe_arg0[i * 8]) ||
 770                                       IP6_MASKEQ(&nat->nat_nsrc6,
 771                                                  &e->ipfe_arg0[i * 8 + 4],
 772                                                  &e->ipfe_arg0[i * 8]);
 773                         }
 774                         break;
 775
 776                 case IPF_EXP_IP6_DSTADDR :
 777                         if (nat->nat_v[0] != 6)
 778                                 break;
 779                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 780                                 rv |= IP6_MASKEQ(&nat->nat_odst6,
 781                                                  &e->ipfe_arg0[i * 8 + 4],
 782                                                  &e->ipfe_arg0[i * 8]) ||
 783                                       IP6_MASKEQ(&nat->nat_ndst6,
 784                                                  &e->ipfe_arg0[i * 8 + 4],
 785                                                  &e->ipfe_arg0[i * 8]);
 786                         }
 787                         break;
 788
 789                 case IPF_EXP_IP6_ADDR :
 790                         if (nat->nat_v[0] != 6)
 791                                 break;
 792                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 793                                 rv |= IP6_MASKEQ(&nat->nat_osrc6,
 794                                                  &e->ipfe_arg0[i * 8 + 4],
 795                                                  &e->ipfe_arg0[i * 8]) ||
 796                                       IP6_MASKEQ(&nat->nat_nsrc6,
 797                                                  &e->ipfe_arg0[i * 8 + 4],
 798                                                  &e->ipfe_arg0[i * 8]) ||
 799                                       IP6_MASKEQ(&nat->nat_odst6,
 800                                                  &e->ipfe_arg0[i * 8 + 4],
 801                                                  &e->ipfe_arg0[i * 8]) ||
 802                                       IP6_MASKEQ(&nat->nat_ndst6,
 803                                                  &e->ipfe_arg0[i * 8 + 4],
 804                                                  &e->ipfe_arg0[i * 8]);
 805                         }
 806                         break;
 807 #endif
 808
 809                 case IPF_EXP_UDP_PORT :
 810                 case IPF_EXP_TCP_PORT :
 811                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 812                                 rv |= (nat->nat_osport == e->ipfe_arg0[i]) ||
 813                                       (nat->nat_nsport == e->ipfe_arg0[i]) ||
 814                                       (nat->nat_odport == e->ipfe_arg0[i]) ||
 815                                       (nat->nat_ndport == e->ipfe_arg0[i]);
 816                         }
 817                         break;
 818
 819                 case IPF_EXP_UDP_SPORT :
 820                 case IPF_EXP_TCP_SPORT :
 821                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 822                                 rv |= (nat->nat_osport == e->ipfe_arg0[i]) ||
 823                                       (nat->nat_nsport == e->ipfe_arg0[i]);
 824                         }
 825                         break;
 826
 827                 case IPF_EXP_UDP_DPORT :
 828                 case IPF_EXP_TCP_DPORT :
 829                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 830                                 rv |= (nat->nat_odport == e->ipfe_arg0[i]) ||
 831                                       (nat->nat_ndport == e->ipfe_arg0[i]);
 832                         }
 833                         break;
 834                 }
 835                 rv ^= e->ipfe_not;
 836
 837                 if (rv == 0)
 838                         break;
 839         }
 840
 841         return rv;
 842 }