sbin/ipf/ipnat/ipnat.c

   1 /*      $FreeBSD$       */
   2
   3 /*
   4  * Copyright (C) 2012 by Darren Reed.
   5  *
   6  * See the IPFILTER.LICENCE file for details on licencing.
   7  *
   8  * Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com)
   9  */
  10 #include <stdio.h>
  11 #include <string.h>
  12 #include <fcntl.h>
  13 #include <errno.h>
  14 #include <sys/types.h>
  15 #if !defined(__SVR4)
  16 #include <strings.h>
  17 #else
  18 #include <sys/byteorder.h>
  19 #endif
  20 #include <sys/time.h>
  21 #include <sys/param.h>
  22 #include <stdlib.h>
  23 #include <unistd.h>
  24 #include <stddef.h>
  25 #include <sys/file.h>
  26 #define _KERNEL
  27 #include <sys/uio.h>
  28 #undef _KERNEL
  29 #include <sys/socket.h>
  30 #include <sys/ioctl.h>
  31 #if defined(sun) && defined(__SVR4)
  32 # include <sys/ioccom.h>
  33 # include <sys/sysmacros.h>
  34 #endif
  35 #include <netinet/in.h>
  36 #include <netinet/in_systm.h>
  37 #include <netinet/ip.h>
  38 #include <netinet/tcp.h>
  39 #include <net/if.h>
  40 #include <netdb.h>
  41 #include <arpa/nameser.h>
  42 #include <arpa/inet.h>
  43 #include <resolv.h>
  44 #include <ctype.h>
  45 # include <nlist.h>
  46 #include "ipf.h"
  47 #include "netinet/ipl.h"
  48 #include "kmem.h"
  49
  50
  51 # define        STRERROR(x)     strerror(x)
  52
  53 #if !defined(lint)
  54 static const char sccsid[] ="@(#)ipnat.c        1.9 6/5/96 (C) 1993 Darren Reed";
  55 static const char rcsid[] = "@(#)$Id$";
  56 #endif
  57
  58
  59 #if     SOLARIS
  60 #define bzero(a,b)      memset(a,0,b)
  61 #endif
  62 int     use_inet6 = 0;
  63
  64 extern  char    *optarg;
  65
  66 void    dostats(int, natstat_t *, int, int, int *);
  67 void    dotable(natstat_t *, int, int, int, char *);
  68 void    flushtable(int, int, int *);
  69 void    usage(char *);
  70 int     main(int, char*[]);
  71 void    showhostmap(natstat_t *nsp);
  72 void    natstat_dead(natstat_t *, char *);
  73 void    dostats_live(int, natstat_t *, int, int *);
  74 void    showhostmap_dead(natstat_t *);
  75 void    showhostmap_live(int, natstat_t *);
  76 void    dostats_dead(natstat_t *, int, int *);
  77 int     nat_matcharray(nat_t *, int *);
  78
  79 int             opts;
  80 int             nohdrfields = 0;
  81 wordtab_t       *nat_fields = NULL;
  82
  83 void
  84 usage(char *name)
  85 {
  86         fprintf(stderr, "Usage: %s [-CFhlnrRsv] [-f filename]\n", name);
  87         exit(1);
  88 }
  89
  90
  91 int
  92 main(int argc, char *argv[])
  93 {
  94         int fd, c, mode, *natfilter;
  95         char *file, *core, *kernel;
  96         natstat_t ns, *nsp;
  97         ipfobj_t obj;
  98
  99         fd = -1;
 100         opts = 0;
 101         nsp = &ns;
 102         file = NULL;
 103         core = NULL;
 104         kernel = NULL;
 105         mode = O_RDWR;
 106         natfilter = NULL;
 107
 108         assigndefined(getenv("IPNAT_PREDEFINED"));
 109
 110         while ((c = getopt(argc, argv, "CdFf:hlm:M:N:nO:prRsv")) != -1)
 111                 switch (c)
 112                 {
 113                 case 'C' :
 114                         opts |= OPT_CLEAR;
 115                         break;
 116                 case 'd' :
 117                         opts |= OPT_DEBUG;
 118                         break;
 119                 case 'f' :
 120                         file = optarg;
 121                         break;
 122                 case 'F' :
 123                         opts |= OPT_FLUSH;
 124                         break;
 125                 case 'h' :
 126                         opts |=OPT_HITS;
 127                         break;
 128                 case 'l' :
 129                         opts |= OPT_LIST;
 130                         mode = O_RDONLY;
 131                         break;
 132                 case 'm' :
 133                         natfilter = parseipfexpr(optarg, NULL);
 134                         break;
 135                 case 'M' :
 136                         core = optarg;
 137                         break;
 138                 case 'N' :
 139                         kernel = optarg;
 140                         break;
 141                 case 'n' :
 142                         opts |= OPT_DONOTHING|OPT_DONTOPEN;
 143                         mode = O_RDONLY;
 144                         break;
 145                 case 'O' :
 146                         nat_fields = parsefields(natfields, optarg);
 147                         break;
 148                 case 'p' :
 149                         opts |= OPT_PURGE;
 150                         break;
 151                 case 'R' :
 152                         opts |= OPT_NORESOLVE;
 153                         break;
 154                 case 'r' :
 155                         opts |= OPT_REMOVE;
 156                         break;
 157                 case 's' :
 158                         opts |= OPT_STAT;
 159                         mode = O_RDONLY;
 160                         break;
 161                 case 'v' :
 162                         opts |= OPT_VERBOSE;
 163                         break;
 164                 default :
 165                         usage(argv[0]);
 166                 }
 167
 168         if (((opts & OPT_PURGE) != 0) && ((opts & OPT_REMOVE) == 0)) {
 169                 (void) fprintf(stderr, "%s: -p must be used with -r\n",
 170                                argv[0]);
 171                 exit(1);
 172         }
 173
 174         initparse();
 175
 176         if ((kernel != NULL) || (core != NULL)) {
 177                 (void) setgid(getgid());
 178                 (void) setuid(getuid());
 179         }
 180
 181         if (!(opts & OPT_DONOTHING)) {
 182                 if (((fd = open(IPNAT_NAME, mode)) == -1) &&
 183                     ((fd = open(IPNAT_NAME, O_RDONLY)) == -1)) {
 184                         (void) fprintf(stderr, "%s: open: %s\n", IPNAT_NAME,
 185                                 STRERROR(errno));
 186                         exit(1);
 187                 }
 188         }
 189
 190         bzero((char *)&ns, sizeof(ns));
 191
 192         if ((opts & OPT_DONOTHING) == 0) {
 193                 if (checkrev(IPL_NAME) == -1) {
 194                         fprintf(stderr, "User/kernel version check failed\n");
 195                         exit(1);
 196                 }
 197         }
 198
 199         if (!(opts & OPT_DONOTHING) && (kernel == NULL) && (core == NULL)) {
 200                 bzero((char *)&obj, sizeof(obj));
 201                 obj.ipfo_rev = IPFILTER_VERSION;
 202                 obj.ipfo_type = IPFOBJ_NATSTAT;
 203                 obj.ipfo_size = sizeof(*nsp);
 204                 obj.ipfo_ptr = (void *)nsp;
 205                 if (ioctl(fd, SIOCGNATS, &obj) == -1) {
 206                         ipferror(fd, "ioctl(SIOCGNATS)");
 207                         exit(1);
 208                 }
 209                 (void) setgid(getgid());
 210                 (void) setuid(getuid());
 211         } else if ((kernel != NULL) || (core != NULL)) {
 212                 if (openkmem(kernel, core) == -1)
 213                         exit(1);
 214
 215                 natstat_dead(nsp, kernel);
 216                 if (opts & (OPT_LIST|OPT_STAT))
 217                         dostats(fd, nsp, opts, 0, natfilter);
 218                 exit(0);
 219         }
 220
 221         if (opts & (OPT_FLUSH|OPT_CLEAR))
 222                 flushtable(fd, opts, natfilter);
 223         if (file) {
 224                 return (ipnat_parsefile(fd, ipnat_addrule, ioctl, file));
 225         }
 226         if (opts & (OPT_LIST|OPT_STAT))
 227                 dostats(fd, nsp, opts, 1, natfilter);
 228         return (0);
 229 }
 230
 231
 232 /*
 233  * Read NAT statistic information in using a symbol table and memory file
 234  * rather than doing ioctl's.
 235  */
 236 void
 237 natstat_dead(natstat_t *nsp, char *kernel)
 238 {
 239         struct nlist nat_nlist[10] = {
 240                 { "nat_table" },                /* 0 */
 241                 { "nat_list" },
 242                 { "maptable" },
 243                 { "ipf_nattable_sz" },
 244                 { "ipf_natrules_sz" },
 245                 { "ipf_rdrrules_sz" },          /* 5 */
 246                 { "ipf_hostmap_sz" },
 247                 { "nat_instances" },
 248                 { NULL }
 249         };
 250         void *tables[2];
 251
 252         if (nlist(kernel, nat_nlist) == -1) {
 253                 fprintf(stderr, "nlist error\n");
 254                 return;
 255         }
 256
 257         /*
 258          * Normally the ioctl copies all of these values into the structure
 259          * for us, before returning it to userland, so here we must copy each
 260          * one in individually.
 261          */
 262         kmemcpy((char *)&tables, nat_nlist[0].n_value, sizeof(tables));
 263         nsp->ns_side[0].ns_table = tables[0];
 264         nsp->ns_side[1].ns_table = tables[1];
 265
 266         kmemcpy((char *)&nsp->ns_list, nat_nlist[1].n_value,
 267                 sizeof(nsp->ns_list));
 268         kmemcpy((char *)&nsp->ns_maptable, nat_nlist[2].n_value,
 269                 sizeof(nsp->ns_maptable));
 270         kmemcpy((char *)&nsp->ns_nattab_sz, nat_nlist[3].n_value,
 271                 sizeof(nsp->ns_nattab_sz));
 272         kmemcpy((char *)&nsp->ns_rultab_sz, nat_nlist[4].n_value,
 273                 sizeof(nsp->ns_rultab_sz));
 274         kmemcpy((char *)&nsp->ns_rdrtab_sz, nat_nlist[5].n_value,
 275                 sizeof(nsp->ns_rdrtab_sz));
 276         kmemcpy((char *)&nsp->ns_hostmap_sz, nat_nlist[6].n_value,
 277                 sizeof(nsp->ns_hostmap_sz));
 278         kmemcpy((char *)&nsp->ns_instances, nat_nlist[7].n_value,
 279                 sizeof(nsp->ns_instances));
 280 }
 281
 282
 283 /*
 284  * Issue an ioctl to flush either the NAT rules table or the active mapping
 285  * table or both.
 286  */
 287 void
 288 flushtable(int fd, int opts, int *match)
 289 {
 290         int n = 0;
 291
 292         if (opts & OPT_FLUSH) {
 293                 n = 0;
 294                 if (!(opts & OPT_DONOTHING)) {
 295                         if (match != NULL) {
 296                                 ipfobj_t obj;
 297
 298                                 obj.ipfo_rev = IPFILTER_VERSION;
 299                                 obj.ipfo_size = match[0] * sizeof(int);
 300                                 obj.ipfo_type = IPFOBJ_IPFEXPR;
 301                                 obj.ipfo_ptr = match;
 302                                 if (ioctl(fd, SIOCMATCHFLUSH, &obj) == -1) {
 303                                         ipferror(fd, "ioctl(SIOCMATCHFLUSH)");
 304                                         n = -1;
 305                                 } else {
 306                                         n = obj.ipfo_retval;
 307                                 }
 308                         } else if (ioctl(fd, SIOCIPFFL, &n) == -1) {
 309                                 ipferror(fd, "ioctl(SIOCIPFFL)");
 310                                 n = -1;
 311                         }
 312                 }
 313                 if (n >= 0)
 314                         printf("%d entries flushed from NAT table\n", n);
 315         }
 316
 317         if (opts & OPT_CLEAR) {
 318                 n = 1;
 319                 if (!(opts & OPT_DONOTHING) && ioctl(fd, SIOCIPFFL, &n) == -1)
 320                         ipferror(fd, "ioctl(SIOCCNATL)");
 321                 else
 322                         printf("%d entries flushed from NAT list\n", n);
 323         }
 324 }
 325
 326
 327 /*
 328  * Display NAT statistics.
 329  */
 330 void
 331 dostats_dead(natstat_t *nsp, int opts, int *filter)
 332 {
 333         nat_t *np, nat;
 334         ipnat_t ipn;
 335         int i;
 336
 337         if (nat_fields == NULL) {
 338                 printf("List of active MAP/Redirect filters:\n");
 339                 while (nsp->ns_list) {
 340                         if (kmemcpy((char *)&ipn, (long)nsp->ns_list,
 341                                     sizeof(ipn))) {
 342                                 perror("kmemcpy");
 343                                 break;
 344                         }
 345                         if (opts & OPT_HITS)
 346                                 printf("%lu ", ipn.in_hits);
 347                         printnat(&ipn, opts & (OPT_DEBUG|OPT_VERBOSE));
 348                         nsp->ns_list = ipn.in_next;
 349                 }
 350         }
 351
 352         if (nat_fields == NULL) {
 353                 printf("\nList of active sessions:\n");
 354
 355         } else if (nohdrfields == 0) {
 356                 for (i = 0; nat_fields[i].w_value != 0; i++) {
 357                         printfieldhdr(natfields, nat_fields + i);
 358                         if (nat_fields[i + 1].w_value != 0)
 359                                 printf("\t");
 360                 }
 361                 printf("\n");
 362         }
 363
 364         for (np = nsp->ns_instances; np; np = nat.nat_next) {
 365                 if (kmemcpy((char *)&nat, (long)np, sizeof(nat)))
 366                         break;
 367                 if ((filter != NULL) && (nat_matcharray(&nat, filter) == 0))
 368                         continue;
 369                 if (nat_fields != NULL) {
 370                         for (i = 0; nat_fields[i].w_value != 0; i++) {
 371                                 printnatfield(&nat, nat_fields[i].w_value);
 372                                 if (nat_fields[i + 1].w_value != 0)
 373                                         printf("\t");
 374                         }
 375                         printf("\n");
 376                 } else {
 377                         printactivenat(&nat, opts, nsp->ns_ticks);
 378                         if (nat.nat_aps) {
 379                                 int proto;
 380
 381                                 if (nat.nat_dir & NAT_OUTBOUND)
 382                                         proto = nat.nat_pr[1];
 383                                 else
 384                                         proto = nat.nat_pr[0];
 385                                 printaps(nat.nat_aps, opts, proto);
 386                         }
 387                 }
 388         }
 389
 390         if (opts & OPT_VERBOSE)
 391                 showhostmap_dead(nsp);
 392 }
 393
 394
 395 void
 396 dotable(natstat_t *nsp, int fd, int alive, int which, char *side)
 397 {
 398         int sz, i, used, maxlen, minlen, totallen;
 399         ipftable_t table;
 400         u_int *buckets;
 401         ipfobj_t obj;
 402
 403         sz = sizeof(*buckets) * nsp->ns_nattab_sz;
 404         buckets = (u_int *)malloc(sz);
 405         if (buckets == NULL) {
 406                 fprintf(stderr,
 407                         "cannot allocate memory (%d) for buckets\n", sz);
 408                 return;
 409         }
 410
 411         obj.ipfo_rev = IPFILTER_VERSION;
 412         obj.ipfo_type = IPFOBJ_GTABLE;
 413         obj.ipfo_size = sizeof(table);
 414         obj.ipfo_ptr = &table;
 415
 416         if (which == 0) {
 417                 table.ita_type = IPFTABLE_BUCKETS_NATIN;
 418         } else if (which == 1) {
 419                 table.ita_type = IPFTABLE_BUCKETS_NATOUT;
 420         }
 421         table.ita_table = buckets;
 422
 423         if (alive) {
 424                 if (ioctl(fd, SIOCGTABL, &obj) != 0) {
 425                         ipferror(fd, "SIOCFTABL");
 426                         free(buckets);
 427                         return;
 428                 }
 429         } else {
 430                 if (kmemcpy((char *)buckets, (u_long)nsp->ns_nattab_sz, sz)) {
 431                         free(buckets);
 432                         return;
 433                 }
 434         }
 435
 436         minlen = nsp->ns_side[which].ns_inuse;
 437         totallen = 0;
 438         maxlen = 0;
 439         used = 0;
 440
 441         for (i = 0; i < nsp->ns_nattab_sz; i++) {
 442                 if (buckets[i] > maxlen)
 443                         maxlen = buckets[i];
 444                 if (buckets[i] < minlen)
 445                         minlen = buckets[i];
 446                 if (buckets[i] != 0)
 447                         used++;
 448                 totallen += buckets[i];
 449         }
 450
 451         printf("%d%%\thash efficiency %s\n",
 452                totallen ? used * 100 / totallen : 0, side);
 453         printf("%2.2f%%\tbucket usage %s\n",
 454                ((float)used / nsp->ns_nattab_sz) * 100.0, side);
 455         printf("%d\tminimal length %s\n", minlen, side);
 456         printf("%d\tmaximal length %s\n", maxlen, side);
 457         printf("%.3f\taverage length %s\n",
 458                used ? ((float)totallen / used) : 0.0, side);
 459
 460         free(buckets);
 461 }
 462
 463
 464 void
 465 dostats(int fd, natstat_t *nsp, int opts, int alive, int *filter)
 466 {
 467         /*
 468          * Show statistics ?
 469          */
 470         if (opts & OPT_STAT) {
 471                 printnatside("in", &nsp->ns_side[0]);
 472                 dotable(nsp, fd, alive, 0, "in");
 473
 474                 printnatside("out", &nsp->ns_side[1]);
 475                 dotable(nsp, fd, alive, 1, "out");
 476
 477                 printf("%lu\tlog successes\n", nsp->ns_side[0].ns_log);
 478                 printf("%lu\tlog failures\n", nsp->ns_side[1].ns_log);
 479                 printf("%lu\tadded in\n%lu\tadded out\n",
 480                         nsp->ns_side[0].ns_added,
 481                         nsp->ns_side[1].ns_added);
 482                 printf("%u\tactive\n", nsp->ns_active);
 483                 printf("%lu\ttransparent adds\n", nsp->ns_addtrpnt);
 484                 printf("%lu\tdivert build\n", nsp->ns_divert_build);
 485                 printf("%lu\texpired\n", nsp->ns_expire);
 486                 printf("%lu\tflush all\n", nsp->ns_flush_all);
 487                 printf("%lu\tflush closing\n", nsp->ns_flush_closing);
 488                 printf("%lu\tflush queue\n", nsp->ns_flush_queue);
 489                 printf("%lu\tflush state\n", nsp->ns_flush_state);
 490                 printf("%lu\tflush timeout\n", nsp->ns_flush_timeout);
 491                 printf("%lu\thostmap new\n", nsp->ns_hm_new);
 492                 printf("%lu\thostmap fails\n", nsp->ns_hm_newfail);
 493                 printf("%lu\thostmap add\n", nsp->ns_hm_addref);
 494                 printf("%lu\thostmap NULL rule\n", nsp->ns_hm_nullnp);
 495                 printf("%lu\tlog ok\n", nsp->ns_log_ok);
 496                 printf("%lu\tlog fail\n", nsp->ns_log_fail);
 497                 printf("%u\torphan count\n", nsp->ns_orphans);
 498                 printf("%u\trule count\n", nsp->ns_rules);
 499                 printf("%u\tmap rules\n", nsp->ns_rules_map);
 500                 printf("%u\trdr rules\n", nsp->ns_rules_rdr);
 501                 printf("%u\twilds\n", nsp->ns_wilds);
 502                 if (opts & OPT_VERBOSE)
 503                         printf("list %p\n", nsp->ns_list);
 504         }
 505
 506         if (opts & OPT_LIST) {
 507                 if (alive)
 508                         dostats_live(fd, nsp, opts, filter);
 509                 else
 510                         dostats_dead(nsp, opts, filter);
 511         }
 512 }
 513
 514
 515 /*
 516  * Display NAT statistics.
 517  */
 518 void
 519 dostats_live(int fd, natstat_t *nsp, int opts, int *filter)
 520 {
 521         ipfgeniter_t iter;
 522         char buffer[2000];
 523         ipfobj_t obj;
 524         ipnat_t *ipn;
 525         nat_t nat;
 526         int i;
 527
 528         bzero((char *)&obj, sizeof(obj));
 529         obj.ipfo_rev = IPFILTER_VERSION;
 530         obj.ipfo_type = IPFOBJ_GENITER;
 531         obj.ipfo_size = sizeof(iter);
 532         obj.ipfo_ptr = &iter;
 533
 534         iter.igi_type = IPFGENITER_IPNAT;
 535         iter.igi_nitems = 1;
 536         iter.igi_data = buffer;
 537         ipn = (ipnat_t *)buffer;
 538
 539         /*
 540          * Show list of NAT rules and NAT sessions ?
 541          */
 542         if (nat_fields == NULL) {
 543                 printf("List of active MAP/Redirect filters:\n");
 544                 while (nsp->ns_list) {
 545                         if (ioctl(fd, SIOCGENITER, &obj) == -1)
 546                                 break;
 547                         if (opts & OPT_HITS)
 548                                 printf("%lu ", ipn->in_hits);
 549                         printnat(ipn, opts & (OPT_DEBUG|OPT_VERBOSE));
 550                         nsp->ns_list = ipn->in_next;
 551                 }
 552         }
 553
 554         if (nat_fields == NULL) {
 555                 printf("\nList of active sessions:\n");
 556
 557         } else if (nohdrfields == 0) {
 558                 for (i = 0; nat_fields[i].w_value != 0; i++) {
 559                         printfieldhdr(natfields, nat_fields + i);
 560                         if (nat_fields[i + 1].w_value != 0)
 561                                 printf("\t");
 562                 }
 563                 printf("\n");
 564         }
 565
 566         i = IPFGENITER_IPNAT;
 567         (void) ioctl(fd,SIOCIPFDELTOK, &i);
 568
 569
 570         iter.igi_type = IPFGENITER_NAT;
 571         iter.igi_nitems = 1;
 572         iter.igi_data = &nat;
 573
 574         while (nsp->ns_instances != NULL) {
 575                 if (ioctl(fd, SIOCGENITER, &obj) == -1)
 576                         break;
 577                 if ((filter != NULL) && (nat_matcharray(&nat, filter) == 0))
 578                         continue;
 579                 if (nat_fields != NULL) {
 580                         for (i = 0; nat_fields[i].w_value != 0; i++) {
 581                                 printnatfield(&nat, nat_fields[i].w_value);
 582                                 if (nat_fields[i + 1].w_value != 0)
 583                                         printf("\t");
 584                         }
 585                         printf("\n");
 586                 } else {
 587                         printactivenat(&nat, opts, nsp->ns_ticks);
 588                         if (nat.nat_aps) {
 589                                 int proto;
 590
 591                                 if (nat.nat_dir & NAT_OUTBOUND)
 592                                         proto = nat.nat_pr[1];
 593                                 else
 594                                         proto = nat.nat_pr[0];
 595                                 printaps(nat.nat_aps, opts, proto);
 596                         }
 597                 }
 598                 nsp->ns_instances = nat.nat_next;
 599         }
 600
 601         if (opts & OPT_VERBOSE)
 602                 showhostmap_live(fd, nsp);
 603
 604         i = IPFGENITER_NAT;
 605         (void) ioctl(fd,SIOCIPFDELTOK, &i);
 606 }
 607
 608
 609 /*
 610  * Display the active host mapping table.
 611  */
 612 void
 613 showhostmap_dead(natstat_t *nsp)
 614 {
 615         hostmap_t hm, *hmp, **maptable;
 616         u_int hv;
 617
 618         printf("\nList of active host mappings:\n");
 619
 620         maptable = (hostmap_t **)malloc(sizeof(hostmap_t *) *
 621                                         nsp->ns_hostmap_sz);
 622         if (kmemcpy((char *)maptable, (u_long)nsp->ns_maptable,
 623                     sizeof(hostmap_t *) * nsp->ns_hostmap_sz)) {
 624                 perror("kmemcpy (maptable)");
 625                 return;
 626         }
 627
 628         for (hv = 0; hv < nsp->ns_hostmap_sz; hv++) {
 629                 hmp = maptable[hv];
 630
 631                 while (hmp) {
 632                         if (kmemcpy((char *)&hm, (u_long)hmp, sizeof(hm))) {
 633                                 perror("kmemcpy (hostmap)");
 634                                 return;
 635                         }
 636
 637                         printhostmap(&hm, hv);
 638                         hmp = hm.hm_next;
 639                 }
 640         }
 641         free(maptable);
 642 }
 643
 644
 645 /*
 646  * Display the active host mapping table.
 647  */
 648 void
 649 showhostmap_live(int fd, natstat_t *nsp)
 650 {
 651         ipfgeniter_t iter;
 652         hostmap_t hm;
 653         ipfobj_t obj;
 654         int i;
 655
 656         bzero((char *)&obj, sizeof(obj));
 657         obj.ipfo_rev = IPFILTER_VERSION;
 658         obj.ipfo_type = IPFOBJ_GENITER;
 659         obj.ipfo_size = sizeof(iter);
 660         obj.ipfo_ptr = &iter;
 661
 662         iter.igi_type = IPFGENITER_HOSTMAP;
 663         iter.igi_nitems = 1;
 664         iter.igi_data = &hm;
 665
 666         printf("\nList of active host mappings:\n");
 667
 668         while (nsp->ns_maplist != NULL) {
 669                 if (ioctl(fd, SIOCGENITER, &obj) == -1)
 670                         break;
 671                 printhostmap(&hm, hm.hm_hv);
 672                 nsp->ns_maplist = hm.hm_next;
 673         }
 674
 675         i = IPFGENITER_HOSTMAP;
 676         (void) ioctl(fd,SIOCIPFDELTOK, &i);
 677 }
 678
 679
 680 int
 681 nat_matcharray(nat_t *nat, int *array)
 682 {
 683         int i, n, *x, rv, p;
 684         ipfexp_t *e;
 685
 686         rv = 0;
 687         n = array[0];
 688         x = array + 1;
 689
 690         for (; n > 0; x += 3 + x[3], rv = 0) {
 691                 e = (ipfexp_t *)x;
 692                 if (e->ipfe_cmd == IPF_EXP_END)
 693                         break;
 694                 n -= e->ipfe_size;
 695
 696                 p = e->ipfe_cmd >> 16;
 697                 if ((p != 0) && (p != nat->nat_pr[1]))
 698                         break;
 699
 700                 switch (e->ipfe_cmd)
 701                 {
 702                 case IPF_EXP_IP_PR :
 703                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 704                                 rv |= (nat->nat_pr[1] == e->ipfe_arg0[i]);
 705                         }
 706                         break;
 707
 708                 case IPF_EXP_IP_SRCADDR :
 709                         if (nat->nat_v[0] != 4)
 710                                 break;
 711                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 712                                 rv |= ((nat->nat_osrcaddr &
 713                                         e->ipfe_arg0[i * 2 + 1]) ==
 714                                        e->ipfe_arg0[i * 2]) ||
 715                                       ((nat->nat_nsrcaddr &
 716                                         e->ipfe_arg0[i * 2 + 1]) ==
 717                                        e->ipfe_arg0[i * 2]);
 718                         }
 719                         break;
 720
 721                 case IPF_EXP_IP_DSTADDR :
 722                         if (nat->nat_v[0] != 4)
 723                                 break;
 724                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 725                                 rv |= ((nat->nat_odstaddr &
 726                                         e->ipfe_arg0[i * 2 + 1]) ==
 727                                        e->ipfe_arg0[i * 2]) ||
 728                                       ((nat->nat_ndstaddr &
 729                                         e->ipfe_arg0[i * 2 + 1]) ==
 730                                        e->ipfe_arg0[i * 2]);
 731                         }
 732                         break;
 733
 734                 case IPF_EXP_IP_ADDR :
 735                         if (nat->nat_v[0] != 4)
 736                                 break;
 737                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 738                                 rv |= ((nat->nat_osrcaddr &
 739                                         e->ipfe_arg0[i * 2 + 1]) ==
 740                                        e->ipfe_arg0[i * 2]) ||
 741                                       ((nat->nat_nsrcaddr &
 742                                         e->ipfe_arg0[i * 2 + 1]) ==
 743                                        e->ipfe_arg0[i * 2]) ||
 744                                      ((nat->nat_odstaddr &
 745                                         e->ipfe_arg0[i * 2 + 1]) ==
 746                                        e->ipfe_arg0[i * 2]) ||
 747                                      ((nat->nat_ndstaddr &
 748                                         e->ipfe_arg0[i * 2 + 1]) ==
 749                                        e->ipfe_arg0[i * 2]);
 750                         }
 751                         break;
 752
 753 #ifdef USE_INET6
 754                 case IPF_EXP_IP6_SRCADDR :
 755                         if (nat->nat_v[0] != 6)
 756                                 break;
 757                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 758                                 rv |= IP6_MASKEQ(&nat->nat_osrc6,
 759                                                  &e->ipfe_arg0[i * 8 + 4],
 760                                                  &e->ipfe_arg0[i * 8]) ||
 761                                       IP6_MASKEQ(&nat->nat_nsrc6,
 762                                                  &e->ipfe_arg0[i * 8 + 4],
 763                                                  &e->ipfe_arg0[i * 8]);
 764                         }
 765                         break;
 766
 767                 case IPF_EXP_IP6_DSTADDR :
 768                         if (nat->nat_v[0] != 6)
 769                                 break;
 770                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 771                                 rv |= IP6_MASKEQ(&nat->nat_odst6,
 772                                                  &e->ipfe_arg0[i * 8 + 4],
 773                                                  &e->ipfe_arg0[i * 8]) ||
 774                                       IP6_MASKEQ(&nat->nat_ndst6,
 775                                                  &e->ipfe_arg0[i * 8 + 4],
 776                                                  &e->ipfe_arg0[i * 8]);
 777                         }
 778                         break;
 779
 780                 case IPF_EXP_IP6_ADDR :
 781                         if (nat->nat_v[0] != 6)
 782                                 break;
 783                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 784                                 rv |= IP6_MASKEQ(&nat->nat_osrc6,
 785                                                  &e->ipfe_arg0[i * 8 + 4],
 786                                                  &e->ipfe_arg0[i * 8]) ||
 787                                       IP6_MASKEQ(&nat->nat_nsrc6,
 788                                                  &e->ipfe_arg0[i * 8 + 4],
 789                                                  &e->ipfe_arg0[i * 8]) ||
 790                                       IP6_MASKEQ(&nat->nat_odst6,
 791                                                  &e->ipfe_arg0[i * 8 + 4],
 792                                                  &e->ipfe_arg0[i * 8]) ||
 793                                       IP6_MASKEQ(&nat->nat_ndst6,
 794                                                  &e->ipfe_arg0[i * 8 + 4],
 795                                                  &e->ipfe_arg0[i * 8]);
 796                         }
 797                         break;
 798 #endif
 799
 800                 case IPF_EXP_UDP_PORT :
 801                 case IPF_EXP_TCP_PORT :
 802                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 803                                 rv |= (nat->nat_osport == e->ipfe_arg0[i]) ||
 804                                       (nat->nat_nsport == e->ipfe_arg0[i]) ||
 805                                       (nat->nat_odport == e->ipfe_arg0[i]) ||
 806                                       (nat->nat_ndport == e->ipfe_arg0[i]);
 807                         }
 808                         break;
 809
 810                 case IPF_EXP_UDP_SPORT :
 811                 case IPF_EXP_TCP_SPORT :
 812                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 813                                 rv |= (nat->nat_osport == e->ipfe_arg0[i]) ||
 814                                       (nat->nat_nsport == e->ipfe_arg0[i]);
 815                         }
 816                         break;
 817
 818                 case IPF_EXP_UDP_DPORT :
 819                 case IPF_EXP_TCP_DPORT :
 820                         for (i = 0; !rv && i < e->ipfe_narg; i++) {
 821                                 rv |= (nat->nat_odport == e->ipfe_arg0[i]) ||
 822                                       (nat->nat_ndport == e->ipfe_arg0[i]);
 823                         }
 824                         break;
 825                 }
 826                 rv ^= e->ipfe_not;
 827
 828                 if (rv == 0)
 829                         break;
 830         }
 831
 832         return (rv);
 833 }