sbin/natd/natd.c

   1 /*
   2  * natd - Network Address Translation Daemon for FreeBSD.
   3  *
   4  * This software is provided free of charge, with no
   5  * warranty of any kind, either expressed or implied.
   6  * Use at your own risk.
   7  *
   8  * You may copy, modify and distribute this software (natd.c) freely.
   9  *
  10  * Ari Suutari <suutari@iki.fi>
  11  */
  12
  13 #include <sys/cdefs.h>
  14 __FBSDID("$FreeBSD$");
  15
  16 #define SYSLOG_NAMES
  17
  18 #include <sys/types.h>
  19 #include <sys/socket.h>
  20 #include <sys/sysctl.h>
  21 #include <sys/time.h>
  22 #include <sys/queue.h>
  23
  24 #include <netinet/in.h>
  25 #include <netinet/in_systm.h>
  26 #include <netinet/ip.h>
  27 #include <netinet/tcp.h>
  28 #include <netinet/udp.h>
  29 #include <netinet/ip_icmp.h>
  30 #include <net/if.h>
  31 #include <net/if_dl.h>
  32 #include <net/route.h>
  33 #include <arpa/inet.h>
  34
  35 #include <alias.h>
  36 #include <ctype.h>
  37 #include <err.h>
  38 #include <errno.h>
  39 #include <netdb.h>
  40 #include <signal.h>
  41 #include <stdio.h>
  42 #include <stdlib.h>
  43 #include <string.h>
  44 #include <syslog.h>
  45 #include <unistd.h>
  46
  47 #include "natd.h"
  48
  49 struct instance {
  50         const char              *name;
  51         struct libalias         *la;
  52         LIST_ENTRY(instance)    list;
  53
  54         int                     ifIndex;
  55         int                     assignAliasAddr;
  56         char*                   ifName;
  57         int                     logDropped;
  58         u_short                 inPort;
  59         u_short                 outPort;
  60         u_short                 inOutPort;
  61         struct in_addr          aliasAddr;
  62         int                     ifMTU;
  63         int                     aliasOverhead;
  64         int                     dropIgnoredIncoming;
  65         int                     divertIn;
  66         int                     divertOut;
  67         int                     divertInOut;
  68 };
  69
  70 static LIST_HEAD(, instance) root = LIST_HEAD_INITIALIZER(root);
  71
  72 struct libalias *mla;
  73 static struct instance *mip;
  74 static int ninstance = 1;
  75
  76 /*
  77  * Default values for input and output
  78  * divert socket ports.
  79  */
  80
  81 #define DEFAULT_SERVICE "natd"
  82
  83 /*
  84  * Definition of a port range, and macros to deal with values.
  85  * FORMAT:  HI 16-bits == first port in range, 0 == all ports.
  86  *          LO 16-bits == number of ports in range
  87  * NOTES:   - Port values are not stored in network byte order.
  88  */
  89
  90 typedef u_long port_range;
  91
  92 #define GETLOPORT(x)     ((x) >> 0x10)
  93 #define GETNUMPORTS(x)   ((x) & 0x0000ffff)
  94 #define GETHIPORT(x)     (GETLOPORT((x)) + GETNUMPORTS((x)))
  95
  96 /* Set y to be the low-port value in port_range variable x. */
  97 #define SETLOPORT(x,y)   ((x) = ((x) & 0x0000ffff) | ((y) << 0x10))
  98
  99 /* Set y to be the number of ports in port_range variable x. */
 100 #define SETNUMPORTS(x,y) ((x) = ((x) & 0xffff0000) | (y))
 101
 102 /*
 103  * Function prototypes.
 104  */
 105
 106 static void     DoAliasing (int fd, int direction);
 107 static void     DaemonMode (void);
 108 static void     HandleRoutingInfo (int fd);
 109 static void     Usage (void);
 110 static char*    FormatPacket (struct ip*);
 111 static void     PrintPacket (struct ip*);
 112 static void     SyslogPacket (struct ip*, int priority, const char *label);
 113 static int      SetAliasAddressFromIfName (const char *ifName);
 114 static void     InitiateShutdown (int);
 115 static void     Shutdown (int);
 116 static void     RefreshAddr (int);
 117 static void     ParseOption (const char* option, const char* parms);
 118 static void     ReadConfigFile (const char* fileName);
 119 static void     SetupPortRedirect (const char* parms);
 120 static void     SetupProtoRedirect(const char* parms);
 121 static void     SetupAddressRedirect (const char* parms);
 122 static void     StrToAddr (const char* str, struct in_addr* addr);
 123 static u_short  StrToPort (const char* str, const char* proto);
 124 static int      StrToPortRange (const char* str, const char* proto, port_range *portRange);
 125 static int      StrToProto (const char* str);
 126 static int      StrToAddrAndPortRange (char* str, struct in_addr* addr, char* proto, port_range *portRange);
 127 static void     ParseArgs (int argc, char** argv);
 128 static void     SetupPunchFW(const char *strValue);
 129 static void     SetupSkinnyPort(const char *strValue);
 130 static void     NewInstance(const char *name);
 131 static void     DoGlobal (int fd);
 132 static int      CheckIpfwRulenum(unsigned int rnum);
 133
 134 /*
 135  * Globals.
 136  */
 137
 138 static  int                     verbose;
 139 static  int                     background;
 140 static  int                     running;
 141 static  int                     logFacility;
 142
 143 static  int                     dynamicMode;
 144 static  int                     icmpSock;
 145 static  int                     logIpfwDenied;
 146 static  const char*             pidName;
 147 static  int                     routeSock;
 148 static  int                     globalPort;
 149 static  int                     divertGlobal;
 150 static  int                     exitDelay;
 151
 152
 153 int main (int argc, char** argv)
 154 {
 155         struct sockaddr_in      addr;
 156         fd_set                  readMask;
 157         int                     fdMax;
 158         int                     rval;
 159 /*
 160  * Initialize packet aliasing software.
 161  * Done already here to be able to alter option bits
 162  * during command line and configuration file processing.
 163  */
 164         NewInstance("default");
 165
 166 /*
 167  * Parse options.
 168  */
 169         verbose                 = 0;
 170         background              = 0;
 171         running                 = 1;
 172         dynamicMode             = 0;
 173         logFacility             = LOG_DAEMON;
 174         logIpfwDenied           = -1;
 175         pidName                 = PIDFILE;
 176         routeSock               = -1;
 177         icmpSock                = -1;
 178         fdMax                   = -1;
 179         divertGlobal            = -1;
 180         exitDelay               = EXIT_DELAY;
 181
 182         ParseArgs (argc, argv);
 183 /*
 184  * Log ipfw(8) denied packets by default in verbose mode.
 185  */
 186         if (logIpfwDenied == -1)
 187                 logIpfwDenied = verbose;
 188 /*
 189  * Open syslog channel.
 190  */
 191         openlog ("natd", LOG_CONS | LOG_PID | (verbose ? LOG_PERROR : 0),
 192                  logFacility);
 193
 194         LIST_FOREACH(mip, &root, list) {
 195                 mla = mip->la;
 196 /*
 197  * If not doing the transparent proxying only,
 198  * check that valid aliasing address has been given.
 199  */
 200                 if (mip->aliasAddr.s_addr == INADDR_NONE && mip->ifName == NULL &&
 201                     !(LibAliasSetMode(mla, 0,0) & PKT_ALIAS_PROXY_ONLY))
 202                         errx (1, "instance %s: aliasing address not given", mip->name);
 203
 204                 if (mip->aliasAddr.s_addr != INADDR_NONE && mip->ifName != NULL)
 205                         errx (1, "both alias address and interface "
 206                                  "name are not allowed");
 207 /*
 208  * Check that valid port number is known.
 209  */
 210                 if (mip->inPort != 0 || mip->outPort != 0)
 211                         if (mip->inPort == 0 || mip->outPort == 0)
 212                                 errx (1, "both input and output ports are required");
 213
 214                 if (mip->inPort == 0 && mip->outPort == 0 && mip->inOutPort == 0)
 215                         ParseOption ("port", DEFAULT_SERVICE);
 216
 217 /*
 218  * Check if ignored packets should be dropped.
 219  */
 220                 mip->dropIgnoredIncoming = LibAliasSetMode (mla, 0, 0);
 221                 mip->dropIgnoredIncoming &= PKT_ALIAS_DENY_INCOMING;
 222 /*
 223  * Create divert sockets. Use only one socket if -p was specified
 224  * on command line. Otherwise, create separate sockets for
 225  * outgoing and incoming connections.
 226  */
 227                 if (mip->inOutPort) {
 228
 229                         mip->divertInOut = socket(PF_DIVERT, SOCK_RAW, 0);
 230                         if (mip->divertInOut == -1)
 231                                 Quit ("Unable to create divert socket.");
 232                         if (mip->divertInOut > fdMax)
 233                                 fdMax = mip->divertInOut;
 234
 235                         mip->divertIn  = -1;
 236                         mip->divertOut = -1;
 237 /*
 238  * Bind socket.
 239  */
 240
 241                         addr.sin_family         = AF_INET;
 242                         addr.sin_addr.s_addr    = INADDR_ANY;
 243                         addr.sin_port           = mip->inOutPort;
 244
 245                         if (bind (mip->divertInOut,
 246                                   (struct sockaddr*) &addr,
 247                                   sizeof addr) == -1)
 248                                 Quit ("Unable to bind divert socket.");
 249                 }
 250                 else {
 251
 252                         mip->divertIn = socket(PF_DIVERT, SOCK_RAW, 0);
 253                         if (mip->divertIn == -1)
 254                                 Quit ("Unable to create incoming divert socket.");
 255                         if (mip->divertIn > fdMax)
 256                                 fdMax = mip->divertIn;
 257
 258
 259                         mip->divertOut = socket(PF_DIVERT, SOCK_RAW, 0);
 260                         if (mip->divertOut == -1)
 261                                 Quit ("Unable to create outgoing divert socket.");
 262                         if (mip->divertOut > fdMax)
 263                                 fdMax = mip->divertOut;
 264
 265                         mip->divertInOut = -1;
 266
 267 /*
 268  * Bind divert sockets.
 269  */
 270
 271                         addr.sin_family         = AF_INET;
 272                         addr.sin_addr.s_addr    = INADDR_ANY;
 273                         addr.sin_port           = mip->inPort;
 274
 275                         if (bind (mip->divertIn,
 276                                   (struct sockaddr*) &addr,
 277                                   sizeof addr) == -1)
 278                                 Quit ("Unable to bind incoming divert socket.");
 279
 280                         addr.sin_family         = AF_INET;
 281                         addr.sin_addr.s_addr    = INADDR_ANY;
 282                         addr.sin_port           = mip->outPort;
 283
 284                         if (bind (mip->divertOut,
 285                                   (struct sockaddr*) &addr,
 286                                   sizeof addr) == -1)
 287                                 Quit ("Unable to bind outgoing divert socket.");
 288                 }
 289 /*
 290  * Create routing socket if interface name specified and in dynamic mode.
 291  */
 292                 if (mip->ifName) {
 293                         if (dynamicMode) {
 294
 295                                 if (routeSock == -1)
 296                                         routeSock = socket (PF_ROUTE, SOCK_RAW, 0);
 297                                 if (routeSock == -1)
 298                                         Quit ("Unable to create routing info socket.");
 299                                 if (routeSock > fdMax)
 300                                         fdMax = routeSock;
 301
 302                                 mip->assignAliasAddr = 1;
 303                         }
 304                         else {
 305                                 do {
 306                                         rval = SetAliasAddressFromIfName (mip->ifName);
 307                                         if (background == 0 || dynamicMode == 0)
 308                                                 break;
 309                                         if (rval == EAGAIN)
 310                                                 sleep(1);
 311                                 } while (rval == EAGAIN);
 312                                 if (rval != 0)
 313                                         exit(1);
 314                         }
 315                 }
 316
 317         }
 318         if (globalPort) {
 319
 320                 divertGlobal = socket(PF_DIVERT, SOCK_RAW, 0);
 321                 if (divertGlobal == -1)
 322                         Quit ("Unable to create divert socket.");
 323                 if (divertGlobal > fdMax)
 324                         fdMax = divertGlobal;
 325
 326 /*
 327 * Bind socket.
 328 */
 329
 330                 addr.sin_family         = AF_INET;
 331                 addr.sin_addr.s_addr    = INADDR_ANY;
 332                 addr.sin_port           = globalPort;
 333
 334                 if (bind (divertGlobal,
 335                           (struct sockaddr*) &addr,
 336                           sizeof addr) == -1)
 337                         Quit ("Unable to bind global divert socket.");
 338         }
 339 /*
 340  * Create socket for sending ICMP messages.
 341  */
 342         icmpSock = socket (AF_INET, SOCK_RAW, IPPROTO_ICMP);
 343         if (icmpSock == -1)
 344                 Quit ("Unable to create ICMP socket.");
 345
 346 /*
 347  * And disable reads for the socket, otherwise it slowly fills
 348  * up with received icmps which we do not use.
 349  */
 350         shutdown(icmpSock, SHUT_RD);
 351
 352 /*
 353  * Become a daemon unless verbose mode was requested.
 354  */
 355         if (!verbose)
 356                 DaemonMode ();
 357 /*
 358  * Catch signals to manage shutdown and
 359  * refresh of interface address.
 360  */
 361         siginterrupt(SIGTERM, 1);
 362         siginterrupt(SIGHUP, 1);
 363         if (exitDelay)
 364                 signal(SIGTERM, InitiateShutdown);
 365         else
 366                 signal(SIGTERM, Shutdown);
 367         signal (SIGHUP, RefreshAddr);
 368 /*
 369  * Set alias address if it has been given.
 370  */
 371         mip = LIST_FIRST(&root);        /* XXX: simon */
 372         LIST_FOREACH(mip, &root, list) {
 373                 mla = mip->la;
 374                 if (mip->aliasAddr.s_addr != INADDR_NONE)
 375                         LibAliasSetAddress (mla, mip->aliasAddr);
 376         }
 377
 378         while (running) {
 379                 mip = LIST_FIRST(&root);        /* XXX: simon */
 380
 381                 if (mip->divertInOut != -1 && !mip->ifName && ninstance == 1) {
 382 /*
 383  * When using only one socket, just call
 384  * DoAliasing repeatedly to process packets.
 385  */
 386                         DoAliasing (mip->divertInOut, DONT_KNOW);
 387                         continue;
 388                 }
 389 /*
 390  * Build read mask from socket descriptors to select.
 391  */
 392                 FD_ZERO (&readMask);
 393 /*
 394  * Check if new packets are available.
 395  */
 396                 LIST_FOREACH(mip, &root, list) {
 397                         if (mip->divertIn != -1)
 398                                 FD_SET (mip->divertIn, &readMask);
 399
 400                         if (mip->divertOut != -1)
 401                                 FD_SET (mip->divertOut, &readMask);
 402
 403                         if (mip->divertInOut != -1)
 404                                 FD_SET (mip->divertInOut, &readMask);
 405                 }
 406 /*
 407  * Routing info is processed always.
 408  */
 409                 if (routeSock != -1)
 410                         FD_SET (routeSock, &readMask);
 411
 412                 if (divertGlobal != -1)
 413                         FD_SET (divertGlobal, &readMask);
 414
 415                 if (select (fdMax + 1,
 416                             &readMask,
 417                             NULL,
 418                             NULL,
 419                             NULL) == -1) {
 420
 421                         if (errno == EINTR)
 422                                 continue;
 423
 424                         Quit ("Select failed.");
 425                 }
 426
 427                 if (divertGlobal != -1)
 428                         if (FD_ISSET (divertGlobal, &readMask))
 429                                 DoGlobal (divertGlobal);
 430                 LIST_FOREACH(mip, &root, list) {
 431                         mla = mip->la;
 432                         if (mip->divertIn != -1)
 433                                 if (FD_ISSET (mip->divertIn, &readMask))
 434                                         DoAliasing (mip->divertIn, INPUT);
 435
 436                         if (mip->divertOut != -1)
 437                                 if (FD_ISSET (mip->divertOut, &readMask))
 438                                         DoAliasing (mip->divertOut, OUTPUT);
 439
 440                         if (mip->divertInOut != -1)
 441                                 if (FD_ISSET (mip->divertInOut, &readMask))
 442                                         DoAliasing (mip->divertInOut, DONT_KNOW);
 443
 444                 }
 445                 if (routeSock != -1)
 446                         if (FD_ISSET (routeSock, &readMask))
 447                                 HandleRoutingInfo (routeSock);
 448         }
 449
 450         if (background)
 451                 unlink (pidName);
 452
 453         return 0;
 454 }
 455
 456 static void DaemonMode(void)
 457 {
 458         FILE*   pidFile;
 459
 460         daemon (0, 0);
 461         background = 1;
 462
 463         pidFile = fopen (pidName, "w");
 464         if (pidFile) {
 465
 466                 fprintf (pidFile, "%d\n", getpid ());
 467                 fclose (pidFile);
 468         }
 469 }
 470
 471 static void ParseArgs (int argc, char** argv)
 472 {
 473         int             arg;
 474         char*           opt;
 475         char            parmBuf[256];
 476         int             len; /* bounds checking */
 477
 478         for (arg = 1; arg < argc; arg++) {
 479
 480                 opt  = argv[arg];
 481                 if (*opt != '-') {
 482
 483                         warnx ("invalid option %s", opt);
 484                         Usage ();
 485                 }
 486
 487                 parmBuf[0] = '\0';
 488                 len = 0;
 489
 490                 while (arg < argc - 1) {
 491
 492                         if (argv[arg + 1][0] == '-')
 493                                 break;
 494
 495                         if (len) {
 496                                 strncat (parmBuf, " ", sizeof(parmBuf) - (len + 1));
 497                                 len += strlen(parmBuf + len);
 498                         }
 499
 500                         ++arg;
 501                         strncat (parmBuf, argv[arg], sizeof(parmBuf) - (len + 1));
 502                         len += strlen(parmBuf + len);
 503
 504                 }
 505
 506                 ParseOption (opt + 1, (len ? parmBuf : NULL));
 507
 508         }
 509 }
 510
 511 static void DoGlobal (int fd)
 512 {
 513         int                     bytes;
 514         int                     origBytes;
 515         char                    buf[IP_MAXPACKET];
 516         struct sockaddr_in      addr;
 517         int                     wrote;
 518         socklen_t               addrSize;
 519         struct ip*              ip;
 520         char                    msgBuf[80];
 521
 522 /*
 523  * Get packet from socket.
 524  */
 525         addrSize  = sizeof addr;
 526         origBytes = recvfrom (fd,
 527                               buf,
 528                               sizeof buf,
 529                               0,
 530                               (struct sockaddr*) &addr,
 531                               &addrSize);
 532
 533         if (origBytes == -1) {
 534
 535                 if (errno != EINTR)
 536                         Warn ("read from divert socket failed");
 537
 538                 return;
 539         }
 540
 541 #if 0
 542         if (mip->assignAliasAddr) {
 543                 if (SetAliasAddressFromIfName (mip->ifName) != 0)
 544                         exit(1);
 545                 mip->assignAliasAddr = 0;
 546         }
 547 #endif
 548 /*
 549  * This is an IP packet.
 550  */
 551         ip = (struct ip*) buf;
 552
 553         if (verbose) {
 554 /*
 555  * Print packet direction and protocol type.
 556  */
 557                 printf ("Glb ");
 558
 559                 switch (ip->ip_p) {
 560                 case IPPROTO_TCP:
 561                         printf ("[TCP]  ");
 562                         break;
 563
 564                 case IPPROTO_UDP:
 565                         printf ("[UDP]  ");
 566                         break;
 567
 568                 case IPPROTO_ICMP:
 569                         printf ("[ICMP] ");
 570                         break;
 571
 572                 default:
 573                         printf ("[%d]    ", ip->ip_p);
 574                         break;
 575                 }
 576 /*
 577  * Print addresses.
 578  */
 579                 PrintPacket (ip);
 580         }
 581
 582         LIST_FOREACH(mip, &root, list) {
 583                 mla = mip->la;
 584                 if (LibAliasOutTry (mla, buf, IP_MAXPACKET, 0) != PKT_ALIAS_IGNORED)
 585                         break;
 586         }
 587 /*
 588  * Length might have changed during aliasing.
 589  */
 590         bytes = ntohs (ip->ip_len);
 591 /*
 592  * Update alias overhead size for outgoing packets.
 593  */
 594         if (mip != NULL && bytes - origBytes > mip->aliasOverhead)
 595                 mip->aliasOverhead = bytes - origBytes;
 596
 597         if (verbose) {
 598
 599 /*
 600  * Print addresses after aliasing.
 601  */
 602                 printf (" aliased to\n");
 603                 printf ("           ");
 604                 PrintPacket (ip);
 605                 printf ("\n");
 606         }
 607
 608 /*
 609  * Put packet back for processing.
 610  */
 611         wrote = sendto (fd,
 612                         buf,
 613                         bytes,
 614                         0,
 615                         (struct sockaddr*) &addr,
 616                         sizeof addr);
 617
 618         if (wrote != bytes) {
 619
 620                 if (errno == EMSGSIZE && mip != NULL) {
 621
 622                         if (mip->ifMTU != -1)
 623                                 SendNeedFragIcmp (icmpSock,
 624                                                   (struct ip*) buf,
 625                                                   mip->ifMTU - mip->aliasOverhead);
 626                 }
 627                 else if (errno == EACCES && logIpfwDenied) {
 628
 629                         sprintf (msgBuf, "failed to write packet back");
 630                         Warn (msgBuf);
 631                 }
 632         }
 633 }
 634
 635
 636 static void DoAliasing (int fd, int direction)
 637 {
 638         int                     bytes;
 639         int                     origBytes;
 640         char                    buf[IP_MAXPACKET];
 641         struct sockaddr_in      addr;
 642         int                     wrote;
 643         int                     status;
 644         socklen_t               addrSize;
 645         struct ip*              ip;
 646         char                    msgBuf[80];
 647         int                     rval;
 648
 649         if (mip->assignAliasAddr) {
 650                 do {
 651                         rval = SetAliasAddressFromIfName (mip->ifName);
 652                         if (background == 0 || dynamicMode == 0)
 653                                 break;
 654                         if (rval == EAGAIN)
 655                                 sleep(1);
 656                 } while (rval == EAGAIN);
 657                 if (rval != 0)
 658                         exit(1);
 659                 mip->assignAliasAddr = 0;
 660         }
 661 /*
 662  * Get packet from socket.
 663  */
 664         addrSize  = sizeof addr;
 665         origBytes = recvfrom (fd,
 666                               buf,
 667                               sizeof buf,
 668                               0,
 669                               (struct sockaddr*) &addr,
 670                               &addrSize);
 671
 672         if (origBytes == -1) {
 673
 674                 if (errno != EINTR)
 675                         Warn ("read from divert socket failed");
 676
 677                 return;
 678         }
 679 /*
 680  * This is an IP packet.
 681  */
 682         ip = (struct ip*) buf;
 683         if (direction == DONT_KNOW) {
 684                 if (addr.sin_addr.s_addr == INADDR_ANY)
 685                         direction = OUTPUT;
 686                 else
 687                         direction = INPUT;
 688         }
 689
 690         if (verbose) {
 691 /*
 692  * Print packet direction and protocol type.
 693  */
 694                 printf (direction == OUTPUT ? "Out " : "In  ");
 695                 if (ninstance > 1)
 696                         printf ("{%s}", mip->name);
 697
 698                 switch (ip->ip_p) {
 699                 case IPPROTO_TCP:
 700                         printf ("[TCP]  ");
 701                         break;
 702
 703                 case IPPROTO_UDP:
 704                         printf ("[UDP]  ");
 705                         break;
 706
 707                 case IPPROTO_ICMP:
 708                         printf ("[ICMP] ");
 709                         break;
 710
 711                 default:
 712                         printf ("[%d]    ", ip->ip_p);
 713                         break;
 714                 }
 715 /*
 716  * Print addresses.
 717  */
 718                 PrintPacket (ip);
 719         }
 720
 721         if (direction == OUTPUT) {
 722 /*
 723  * Outgoing packets. Do aliasing.
 724  */
 725                 LibAliasOut (mla, buf, IP_MAXPACKET);
 726         }
 727         else {
 728
 729 /*
 730  * Do aliasing.
 731  */
 732                 status = LibAliasIn (mla, buf, IP_MAXPACKET);
 733                 if (status == PKT_ALIAS_IGNORED &&
 734                     mip->dropIgnoredIncoming) {
 735
 736                         if (verbose)
 737                                 printf (" dropped.\n");
 738
 739                         if (mip->logDropped)
 740                                 SyslogPacket (ip, LOG_WARNING, "denied");
 741
 742                         return;
 743                 }
 744         }
 745 /*
 746  * Length might have changed during aliasing.
 747  */
 748         bytes = ntohs (ip->ip_len);
 749 /*
 750  * Update alias overhead size for outgoing packets.
 751  */
 752         if (direction == OUTPUT &&
 753             bytes - origBytes > mip->aliasOverhead)
 754                 mip->aliasOverhead = bytes - origBytes;
 755
 756         if (verbose) {
 757
 758 /*
 759  * Print addresses after aliasing.
 760  */
 761                 printf (" aliased to\n");
 762                 printf ("           ");
 763                 PrintPacket (ip);
 764                 printf ("\n");
 765         }
 766
 767 /*
 768  * Put packet back for processing.
 769  */
 770         wrote = sendto (fd,
 771                         buf,
 772                         bytes,
 773                         0,
 774                         (struct sockaddr*) &addr,
 775                         sizeof addr);
 776
 777         if (wrote != bytes) {
 778
 779                 if (errno == EMSGSIZE) {
 780
 781                         if (direction == OUTPUT &&
 782                             mip->ifMTU != -1)
 783                                 SendNeedFragIcmp (icmpSock,
 784                                                   (struct ip*) buf,
 785                                                   mip->ifMTU - mip->aliasOverhead);
 786                 }
 787                 else if (errno == EACCES && logIpfwDenied) {
 788
 789                         sprintf (msgBuf, "failed to write packet back");
 790                         Warn (msgBuf);
 791                 }
 792         }
 793 }
 794
 795 static void HandleRoutingInfo (int fd)
 796 {
 797         int                     bytes;
 798         struct if_msghdr        ifMsg;
 799 /*
 800  * Get packet from socket.
 801  */
 802         bytes = read (fd, &ifMsg, sizeof ifMsg);
 803         if (bytes == -1) {
 804
 805                 Warn ("read from routing socket failed");
 806                 return;
 807         }
 808
 809         if (ifMsg.ifm_version != RTM_VERSION) {
 810
 811                 Warn ("unexpected packet read from routing socket");
 812                 return;
 813         }
 814
 815         if (verbose)
 816                 printf ("Routing message %#x received.\n", ifMsg.ifm_type);
 817
 818         if ((ifMsg.ifm_type == RTM_NEWADDR || ifMsg.ifm_type == RTM_IFINFO)) {
 819                 LIST_FOREACH(mip, &root, list) {
 820                         mla = mip->la;
 821                         if (ifMsg.ifm_index == mip->ifIndex) {
 822                                 if (verbose)
 823                                         printf("Interface address/MTU has probably changed.\n");
 824                                 mip->assignAliasAddr = 1;
 825                         }
 826                 }
 827         }
 828 }
 829
 830 static void PrintPacket (struct ip* ip)
 831 {
 832         printf ("%s", FormatPacket (ip));
 833 }
 834
 835 static void SyslogPacket (struct ip* ip, int priority, const char *label)
 836 {
 837         syslog (priority, "%s %s", label, FormatPacket (ip));
 838 }
 839
 840 static char* FormatPacket (struct ip* ip)
 841 {
 842         static char     buf[256];
 843         struct tcphdr*  tcphdr;
 844         struct udphdr*  udphdr;
 845         struct icmp*    icmphdr;
 846         char            src[20];
 847         char            dst[20];
 848
 849         strcpy (src, inet_ntoa (ip->ip_src));
 850         strcpy (dst, inet_ntoa (ip->ip_dst));
 851
 852         switch (ip->ip_p) {
 853         case IPPROTO_TCP:
 854                 tcphdr = (struct tcphdr*) ((char*) ip + (ip->ip_hl << 2));
 855                 sprintf (buf, "[TCP] %s:%d -> %s:%d",
 856                               src,
 857                               ntohs (tcphdr->th_sport),
 858                               dst,
 859                               ntohs (tcphdr->th_dport));
 860                 break;
 861
 862         case IPPROTO_UDP:
 863                 udphdr = (struct udphdr*) ((char*) ip + (ip->ip_hl << 2));
 864                 sprintf (buf, "[UDP] %s:%d -> %s:%d",
 865                               src,
 866                               ntohs (udphdr->uh_sport),
 867                               dst,
 868                               ntohs (udphdr->uh_dport));
 869                 break;
 870
 871         case IPPROTO_ICMP:
 872                 icmphdr = (struct icmp*) ((char*) ip + (ip->ip_hl << 2));
 873                 sprintf (buf, "[ICMP] %s -> %s %u(%u)",
 874                               src,
 875                               dst,
 876                               icmphdr->icmp_type,
 877                               icmphdr->icmp_code);
 878                 break;
 879
 880         default:
 881                 sprintf (buf, "[%d] %s -> %s ", ip->ip_p, src, dst);
 882                 break;
 883         }
 884
 885         return buf;
 886 }
 887
 888 static int
 889 SetAliasAddressFromIfName(const char *ifn)
 890 {
 891         size_t needed;
 892         int mib[6];
 893         char *buf, *lim, *next;
 894         struct if_msghdr *ifm;
 895         struct ifa_msghdr *ifam;
 896         struct sockaddr_dl *sdl;
 897         struct sockaddr_in *sin;
 898
 899         mib[0] = CTL_NET;
 900         mib[1] = PF_ROUTE;
 901         mib[2] = 0;
 902         mib[3] = AF_INET;       /* Only IP addresses please */
 903         mib[4] = NET_RT_IFLIST;
 904         mib[5] = 0;             /* ifIndex??? */
 905 /*
 906  * Get interface data.
 907  */
 908         if (sysctl(mib, 6, NULL, &needed, NULL, 0) == -1)
 909                 err(1, "iflist-sysctl-estimate");
 910         if ((buf = malloc(needed)) == NULL)
 911                 errx(1, "malloc failed");
 912         if (sysctl(mib, 6, buf, &needed, NULL, 0) == -1 && errno != ENOMEM)
 913                 err(1, "iflist-sysctl-get");
 914         lim = buf + needed;
 915 /*
 916  * Loop through interfaces until one with
 917  * given name is found. This is done to
 918  * find correct interface index for routing
 919  * message processing.
 920  */
 921         mip->ifIndex    = 0;
 922         next = buf;
 923         while (next < lim) {
 924                 ifm = (struct if_msghdr *)next;
 925                 next += ifm->ifm_msglen;
 926                 if (ifm->ifm_version != RTM_VERSION) {
 927                         if (verbose)
 928                                 warnx("routing message version %d "
 929                                       "not understood", ifm->ifm_version);
 930                         continue;
 931                 }
 932                 if (ifm->ifm_type == RTM_IFINFO) {
 933                         sdl = (struct sockaddr_dl *)(ifm + 1);
 934                         if (strlen(ifn) == sdl->sdl_nlen &&
 935                             strncmp(ifn, sdl->sdl_data, sdl->sdl_nlen) == 0) {
 936                                 mip->ifIndex = ifm->ifm_index;
 937                                 mip->ifMTU = ifm->ifm_data.ifi_mtu;
 938                                 break;
 939                         }
 940                 }
 941         }
 942         if (!mip->ifIndex)
 943                 errx(1, "unknown interface name %s", ifn);
 944 /*
 945  * Get interface address.
 946  */
 947         sin = NULL;
 948         while (next < lim) {
 949                 ifam = (struct ifa_msghdr *)next;
 950                 next += ifam->ifam_msglen;
 951                 if (ifam->ifam_version != RTM_VERSION) {
 952                         if (verbose)
 953                                 warnx("routing message version %d "
 954                                       "not understood", ifam->ifam_version);
 955                         continue;
 956                 }
 957                 if (ifam->ifam_type != RTM_NEWADDR)
 958                         break;
 959                 if (ifam->ifam_addrs & RTA_IFA) {
 960                         int i;
 961                         char *cp = (char *)(ifam + 1);
 962
 963                         for (i = 1; i < RTA_IFA; i <<= 1)
 964                                 if (ifam->ifam_addrs & i)
 965                                         cp += SA_SIZE((struct sockaddr *)cp);
 966                         if (((struct sockaddr *)cp)->sa_family == AF_INET) {
 967                                 sin = (struct sockaddr_in *)cp;
 968                                 break;
 969                         }
 970                 }
 971         }
 972         if (sin == NULL) {
 973                 warnx("%s: cannot get interface address", ifn);
 974                 free(buf);
 975                 return EAGAIN;
 976         }
 977
 978         LibAliasSetAddress(mla, sin->sin_addr);
 979         syslog(LOG_INFO, "Aliasing to %s, mtu %d bytes",
 980                inet_ntoa(sin->sin_addr), mip->ifMTU);
 981
 982         free(buf);
 983
 984         return 0;
 985 }
 986
 987 void Quit (const char* msg)
 988 {
 989         Warn (msg);
 990         exit (1);
 991 }
 992
 993 void Warn (const char* msg)
 994 {
 995         if (background)
 996                 syslog (LOG_ALERT, "%s (%m)", msg);
 997         else
 998                 warn ("%s", msg);
 999 }
1000
1001 static void RefreshAddr (int sig __unused)
1002 {
1003         LibAliasRefreshModules();
1004         if (mip != NULL && mip->ifName != NULL)
1005                 mip->assignAliasAddr = 1;
1006 }
1007
1008 static void InitiateShutdown (int sig __unused)
1009 {
1010 /*
1011  * Start timer to allow kernel gracefully
1012  * shutdown existing connections when system
1013  * is shut down.
1014  */
1015         siginterrupt(SIGALRM, 1);
1016         signal (SIGALRM, Shutdown);
1017         ualarm(exitDelay*1000, 1000);
1018 }
1019
1020 static void Shutdown (int sig __unused)
1021 {
1022         running = 0;
1023 }
1024
1025 /*
1026  * Different options recognized by this program.
1027  */
1028
1029 enum Option {
1030
1031         LibAliasOption,
1032         Instance,
1033         Verbose,
1034         InPort,
1035         OutPort,
1036         Port,
1037         GlobalPort,
1038         AliasAddress,
1039         TargetAddress,
1040         InterfaceName,
1041         RedirectPort,
1042         RedirectProto,
1043         RedirectAddress,
1044         ConfigFile,
1045         DynamicMode,
1046         ProxyRule,
1047         LogDenied,
1048         LogFacility,
1049         PunchFW,
1050         SkinnyPort,
1051         LogIpfwDenied,
1052         PidFile,
1053         ExitDelay
1054 };
1055
1056 enum Param {
1057
1058         YesNo,
1059         Numeric,
1060         String,
1061         None,
1062         Address,
1063         Service
1064 };
1065
1066 /*
1067  * Option information structure (used by ParseOption).
1068  */
1069
1070 struct OptionInfo {
1071
1072         enum Option             type;
1073         int                     packetAliasOpt;
1074         enum Param              parm;
1075         const char*             parmDescription;
1076         const char*             description;
1077         const char*             name;
1078         const char*             shortName;
1079 };
1080
1081 /*
1082  * Table of known options.
1083  */
1084
1085 static struct OptionInfo optionTable[] = {
1086
1087         { LibAliasOption,
1088                 PKT_ALIAS_UNREGISTERED_ONLY,
1089                 YesNo,
1090                 "[yes|no]",
1091                 "alias only unregistered addresses",
1092                 "unregistered_only",
1093                 "u" },
1094
1095         { LibAliasOption,
1096                 PKT_ALIAS_LOG,
1097                 YesNo,
1098                 "[yes|no]",
1099                 "enable logging",
1100                 "log",
1101                 "l" },
1102
1103         { LibAliasOption,
1104                 PKT_ALIAS_PROXY_ONLY,
1105                 YesNo,
1106                 "[yes|no]",
1107                 "proxy only",
1108                 "proxy_only",
1109                 NULL },
1110
1111         { LibAliasOption,
1112                 PKT_ALIAS_REVERSE,
1113                 YesNo,
1114                 "[yes|no]",
1115                 "operate in reverse mode",
1116                 "reverse",
1117                 NULL },
1118
1119         { LibAliasOption,
1120                 PKT_ALIAS_DENY_INCOMING,
1121                 YesNo,
1122                 "[yes|no]",
1123                 "allow incoming connections",
1124                 "deny_incoming",
1125                 "d" },
1126
1127         { LibAliasOption,
1128                 PKT_ALIAS_USE_SOCKETS,
1129                 YesNo,
1130                 "[yes|no]",
1131                 "use sockets to inhibit port conflict",
1132                 "use_sockets",
1133                 "s" },
1134
1135         { LibAliasOption,
1136                 PKT_ALIAS_SAME_PORTS,
1137                 YesNo,
1138                 "[yes|no]",
1139                 "try to keep original port numbers for connections",
1140                 "same_ports",
1141                 "m" },
1142
1143         { Verbose,
1144                 0,
1145                 YesNo,
1146                 "[yes|no]",
1147                 "verbose mode, dump packet information",
1148                 "verbose",
1149                 "v" },
1150
1151         { DynamicMode,
1152                 0,
1153                 YesNo,
1154                 "[yes|no]",
1155                 "dynamic mode, automatically detect interface address changes",
1156                 "dynamic",
1157                 NULL },
1158
1159         { InPort,
1160                 0,
1161                 Service,
1162                 "number|service_name",
1163                 "set port for incoming packets",
1164                 "in_port",
1165                 "i" },
1166
1167         { OutPort,
1168                 0,
1169                 Service,
1170                 "number|service_name",
1171                 "set port for outgoing packets",
1172                 "out_port",
1173                 "o" },
1174
1175         { Port,
1176                 0,
1177                 Service,
1178                 "number|service_name",
1179                 "set port (defaults to natd/divert)",
1180                 "port",
1181                 "p" },
1182
1183         { GlobalPort,
1184                 0,
1185                 Service,
1186                 "number|service_name",
1187                 "set globalport",
1188                 "globalport",
1189                 NULL },
1190
1191         { AliasAddress,
1192                 0,
1193                 Address,
1194                 "x.x.x.x",
1195                 "address to use for aliasing",
1196                 "alias_address",
1197                 "a" },
1198
1199         { TargetAddress,
1200                 0,
1201                 Address,
1202                 "x.x.x.x",
1203                 "address to use for incoming sessions",
1204                 "target_address",
1205                 "t" },
1206
1207         { InterfaceName,
1208                 0,
1209                 String,
1210                 "network_if_name",
1211                 "take aliasing address from interface",
1212                 "interface",
1213                 "n" },
1214
1215         { ProxyRule,
1216                 0,
1217                 String,
1218                 "[type encode_ip_hdr|encode_tcp_stream] port xxxx server "
1219                 "a.b.c.d:yyyy",
1220                 "add transparent proxying / destination NAT",
1221                 "proxy_rule",
1222                 NULL },
1223
1224         { RedirectPort,
1225                 0,
1226                 String,
1227                 "tcp|udp local_addr:local_port_range[,...] [public_addr:]public_port_range"
1228                 " [remote_addr[:remote_port_range]]",
1229                 "redirect a port (or ports) for incoming traffic",
1230                 "redirect_port",
1231                 NULL },
1232
1233         { RedirectProto,
1234                 0,
1235                 String,
1236                 "proto local_addr [public_addr] [remote_addr]",
1237                 "redirect packets of a given proto",
1238                 "redirect_proto",
1239                 NULL },
1240
1241         { RedirectAddress,
1242                 0,
1243                 String,
1244                 "local_addr[,...] public_addr",
1245                 "define mapping between local and public addresses",
1246                 "redirect_address",
1247                 NULL },
1248
1249         { ConfigFile,
1250                 0,
1251                 String,
1252                 "file_name",
1253                 "read options from configuration file",
1254                 "config",
1255                 "f" },
1256
1257         { LogDenied,
1258                 0,
1259                 YesNo,
1260                 "[yes|no]",
1261                 "enable logging of denied incoming packets",
1262                 "log_denied",
1263                 NULL },
1264
1265         { LogFacility,
1266                 0,
1267                 String,
1268                 "facility",
1269                 "name of syslog facility to use for logging",
1270                 "log_facility",
1271                 NULL },
1272
1273         { PunchFW,
1274                 0,
1275                 String,
1276                 "basenumber:count",
1277                 "punch holes in the firewall for incoming FTP/IRC DCC connections",
1278                 "punch_fw",
1279                 NULL },
1280
1281         { SkinnyPort,
1282                 0,
1283                 String,
1284                 "port",
1285                 "set the TCP port for use with the Skinny Station protocol",
1286                 "skinny_port",
1287                 NULL },
1288
1289         { LogIpfwDenied,
1290                 0,
1291                 YesNo,
1292                 "[yes|no]",
1293                 "log packets converted by natd, but denied by ipfw",
1294                 "log_ipfw_denied",
1295                 NULL },
1296
1297         { PidFile,
1298                 0,
1299                 String,
1300                 "file_name",
1301                 "store PID in an alternate file",
1302                 "pid_file",
1303                 "P" },
1304         { Instance,
1305                 0,
1306                 String,
1307                 "instance name",
1308                 "name of aliasing engine instance",
1309                 "instance",
1310                 NULL },
1311         { ExitDelay,
1312                 0,
1313                 Numeric,
1314                 "ms",
1315                 "delay in ms before daemon exit after signal",
1316                 "exit_delay",
1317                 NULL },
1318 };
1319
1320 static void ParseOption (const char* option, const char* parms)
1321 {
1322         int                     i;
1323         struct OptionInfo*      info;
1324         int                     yesNoValue;
1325         int                     aliasValue;
1326         int                     numValue;
1327         u_short                 uNumValue;
1328         const char*             strValue;
1329         struct in_addr          addrValue;
1330         int                     max;
1331         char*                   end;
1332         const CODE*             fac_record = NULL;
1333 /*
1334  * Find option from table.
1335  */
1336         max = sizeof (optionTable) / sizeof (struct OptionInfo);
1337         for (i = 0, info = optionTable; i < max; i++, info++) {
1338
1339                 if (!strcmp (info->name, option))
1340                         break;
1341
1342                 if (info->shortName)
1343                         if (!strcmp (info->shortName, option))
1344                                 break;
1345         }
1346
1347         if (i >= max) {
1348
1349                 warnx ("unknown option %s", option);
1350                 Usage ();
1351         }
1352
1353         uNumValue       = 0;
1354         yesNoValue      = 0;
1355         numValue        = 0;
1356         strValue        = NULL;
1357 /*
1358  * Check parameters.
1359  */
1360         switch (info->parm) {
1361         case YesNo:
1362                 if (!parms)
1363                         parms = "yes";
1364
1365                 if (!strcmp (parms, "yes"))
1366                         yesNoValue = 1;
1367                 else
1368                         if (!strcmp (parms, "no"))
1369                                 yesNoValue = 0;
1370                         else
1371                                 errx (1, "%s needs yes/no parameter", option);
1372                 break;
1373
1374         case Service:
1375                 if (!parms)
1376                         errx (1, "%s needs service name or "
1377                                  "port number parameter",
1378                                  option);
1379
1380                 uNumValue = StrToPort (parms, "divert");
1381                 break;
1382
1383         case Numeric:
1384                 if (parms)
1385                         numValue = strtol (parms, &end, 10);
1386                 else
1387                         end = NULL;
1388
1389                 if (end == parms)
1390                         errx (1, "%s needs numeric parameter", option);
1391                 break;
1392
1393         case String:
1394                 strValue = parms;
1395                 if (!strValue)
1396                         errx (1, "%s needs parameter", option);
1397                 break;
1398
1399         case None:
1400                 if (parms)
1401                         errx (1, "%s does not take parameters", option);
1402                 break;
1403
1404         case Address:
1405                 if (!parms)
1406                         errx (1, "%s needs address/host parameter", option);
1407
1408                 StrToAddr (parms, &addrValue);
1409                 break;
1410         }
1411
1412         switch (info->type) {
1413         case LibAliasOption:
1414
1415                 aliasValue = yesNoValue ? info->packetAliasOpt : 0;
1416                 LibAliasSetMode (mla, aliasValue, info->packetAliasOpt);
1417                 break;
1418
1419         case Verbose:
1420                 verbose = yesNoValue;
1421                 break;
1422
1423         case DynamicMode:
1424                 dynamicMode = yesNoValue;
1425                 break;
1426
1427         case InPort:
1428                 mip->inPort = uNumValue;
1429                 break;
1430
1431         case OutPort:
1432                 mip->outPort = uNumValue;
1433                 break;
1434
1435         case Port:
1436                 mip->inOutPort = uNumValue;
1437                 break;
1438
1439         case GlobalPort:
1440                 globalPort = uNumValue;
1441                 break;
1442
1443         case AliasAddress:
1444                 memcpy (&mip->aliasAddr, &addrValue, sizeof (struct in_addr));
1445                 break;
1446
1447         case TargetAddress:
1448                 LibAliasSetTarget(mla, addrValue);
1449                 break;
1450
1451         case RedirectPort:
1452                 SetupPortRedirect (strValue);
1453                 break;
1454
1455         case RedirectProto:
1456                 SetupProtoRedirect(strValue);
1457                 break;
1458
1459         case RedirectAddress:
1460                 SetupAddressRedirect (strValue);
1461                 break;
1462
1463         case ProxyRule:
1464                 LibAliasProxyRule (mla, strValue);
1465                 break;
1466
1467         case InterfaceName:
1468                 if (mip->ifName)
1469                         free (mip->ifName);
1470
1471                 mip->ifName = strdup (strValue);
1472                 break;
1473
1474         case ConfigFile:
1475                 ReadConfigFile (strValue);
1476                 break;
1477
1478         case LogDenied:
1479                 mip->logDropped = yesNoValue;
1480                 break;
1481
1482         case LogFacility:
1483
1484                 fac_record = facilitynames;
1485                 while (fac_record->c_name != NULL) {
1486
1487                         if (!strcmp (fac_record->c_name, strValue)) {
1488
1489                                 logFacility = fac_record->c_val;
1490                                 break;
1491
1492                         }
1493                         else
1494                                 fac_record++;
1495                 }
1496
1497                 if(fac_record->c_name == NULL)
1498                         errx(1, "Unknown log facility name: %s", strValue);
1499
1500                 break;
1501
1502         case PunchFW:
1503                 SetupPunchFW(strValue);
1504                 break;
1505
1506         case SkinnyPort:
1507                 SetupSkinnyPort(strValue);
1508                 break;
1509
1510         case LogIpfwDenied:
1511                 logIpfwDenied = yesNoValue;
1512                 break;
1513
1514         case PidFile:
1515                 pidName = strdup (strValue);
1516                 break;
1517         case Instance:
1518                 NewInstance(strValue);
1519                 break;
1520         case ExitDelay:
1521                 if (numValue < 0 || numValue > MAX_EXIT_DELAY)
1522                         errx(1, "Incorrect exit delay: %d", numValue);
1523                 exitDelay = numValue;
1524                 break;
1525         }
1526 }
1527
1528 void ReadConfigFile (const char* fileName)
1529 {
1530         FILE*   file;
1531         char    *buf;
1532         size_t  len;
1533         char    *ptr, *p;
1534         char*   option;
1535
1536         file = fopen (fileName, "r");
1537         if (!file)
1538                 err(1, "cannot open config file %s", fileName);
1539
1540         while ((buf = fgetln(file, &len)) != NULL) {
1541                 if (buf[len - 1] == '\n')
1542                         buf[len - 1] = '\0';
1543                 else
1544                         errx(1, "config file format error: "
1545                                 "last line should end with newline");
1546
1547 /*
1548  * Check for comments, strip off trailing spaces.
1549  */
1550                 if ((ptr = strchr(buf, '#')))
1551                         *ptr = '\0';
1552                 for (ptr = buf; isspace(*ptr); ++ptr)
1553                         continue;
1554                 if (*ptr == '\0')
1555                         continue;
1556                 for (p = strchr(buf, '\0'); isspace(*--p);)
1557                         continue;
1558                 *++p = '\0';
1559
1560 /*
1561  * Extract option name.
1562  */
1563                 option = ptr;
1564                 while (*ptr && !isspace (*ptr))
1565                         ++ptr;
1566
1567                 if (*ptr != '\0') {
1568
1569                         *ptr = '\0';
1570                         ++ptr;
1571                 }
1572 /*
1573  * Skip white space between name and parms.
1574  */
1575                 while (*ptr && isspace (*ptr))
1576                         ++ptr;
1577
1578                 ParseOption (option, *ptr ? ptr : NULL);
1579         }
1580
1581         fclose (file);
1582 }
1583
1584 static void Usage(void)
1585 {
1586         int                     i;
1587         int                     max;
1588         struct OptionInfo*      info;
1589
1590         fprintf (stderr, "Recognized options:\n\n");
1591
1592         max = sizeof (optionTable) / sizeof (struct OptionInfo);
1593         for (i = 0, info = optionTable; i < max; i++, info++) {
1594
1595                 fprintf (stderr, "-%-20s %s\n", info->name,
1596                                                 info->parmDescription);
1597
1598                 if (info->shortName)
1599                         fprintf (stderr, "-%-20s %s\n", info->shortName,
1600                                                         info->parmDescription);
1601
1602                 fprintf (stderr, "      %s\n\n", info->description);
1603         }
1604
1605         exit (1);
1606 }
1607
1608 void SetupPortRedirect (const char* parms)
1609 {
1610         char            *buf;
1611         char*           ptr;
1612         char*           serverPool;
1613         struct in_addr  localAddr;
1614         struct in_addr  publicAddr;
1615         struct in_addr  remoteAddr;
1616         port_range      portRange;
1617         u_short         localPort      = 0;
1618         u_short         publicPort     = 0;
1619         u_short         remotePort     = 0;
1620         u_short         numLocalPorts  = 0;
1621         u_short         numPublicPorts = 0;
1622         u_short         numRemotePorts = 0;
1623         int             proto;
1624         char*           protoName;
1625         char*           separator;
1626         int             i;
1627         struct alias_link *aliaslink = NULL;
1628
1629         buf = strdup (parms);
1630         if (!buf)
1631                 errx (1, "redirect_port: strdup() failed");
1632 /*
1633  * Extract protocol.
1634  */
1635         protoName = strtok (buf, " \t");
1636         if (!protoName)
1637                 errx (1, "redirect_port: missing protocol");
1638
1639         proto = StrToProto (protoName);
1640 /*
1641  * Extract local address.
1642  */
1643         ptr = strtok (NULL, " \t");
1644         if (!ptr)
1645                 errx (1, "redirect_port: missing local address");
1646
1647         separator = strchr(ptr, ',');
1648         if (separator) {                /* LSNAT redirection syntax. */
1649                 localAddr.s_addr = INADDR_NONE;
1650                 localPort = ~0;
1651                 numLocalPorts = 1;
1652                 serverPool = ptr;
1653         } else {
1654                 if ( StrToAddrAndPortRange (ptr, &localAddr, protoName, &portRange) != 0 )
1655                         errx (1, "redirect_port: invalid local port range");
1656
1657                 localPort     = GETLOPORT(portRange);
1658                 numLocalPorts = GETNUMPORTS(portRange);
1659                 serverPool = NULL;
1660         }
1661
1662 /*
1663  * Extract public port and optionally address.
1664  */
1665         ptr = strtok (NULL, " \t");
1666         if (!ptr)
1667                 errx (1, "redirect_port: missing public port");
1668
1669         separator = strchr (ptr, ':');
1670         if (separator) {
1671                 if (StrToAddrAndPortRange (ptr, &publicAddr, protoName, &portRange) != 0 )
1672                         errx (1, "redirect_port: invalid public port range");
1673         }
1674         else {
1675                 publicAddr.s_addr = INADDR_ANY;
1676                 if (StrToPortRange (ptr, protoName, &portRange) != 0)
1677                         errx (1, "redirect_port: invalid public port range");
1678         }
1679
1680         publicPort     = GETLOPORT(portRange);
1681         numPublicPorts = GETNUMPORTS(portRange);
1682
1683 /*
1684  * Extract remote address and optionally port.
1685  */
1686         ptr = strtok (NULL, " \t");
1687         if (ptr) {
1688                 separator = strchr (ptr, ':');
1689                 if (separator) {
1690                         if (StrToAddrAndPortRange (ptr, &remoteAddr, protoName, &portRange) != 0)
1691                                 errx (1, "redirect_port: invalid remote port range");
1692                 } else {
1693                         SETLOPORT(portRange, 0);
1694                         SETNUMPORTS(portRange, 1);
1695                         StrToAddr (ptr, &remoteAddr);
1696                 }
1697         }
1698         else {
1699                 SETLOPORT(portRange, 0);
1700                 SETNUMPORTS(portRange, 1);
1701                 remoteAddr.s_addr = INADDR_ANY;
1702         }
1703
1704         remotePort     = GETLOPORT(portRange);
1705         numRemotePorts = GETNUMPORTS(portRange);
1706
1707 /*
1708  * Make sure port ranges match up, then add the redirect ports.
1709  */
1710         if (numLocalPorts != numPublicPorts)
1711                 errx (1, "redirect_port: port ranges must be equal in size");
1712
1713         /* Remote port range is allowed to be '0' which means all ports. */
1714         if (numRemotePorts != numLocalPorts && (numRemotePorts != 1 || remotePort != 0))
1715                 errx (1, "redirect_port: remote port must be 0 or equal to local port range in size");
1716
1717         for (i = 0 ; i < numPublicPorts ; ++i) {
1718                 /* If remotePort is all ports, set it to 0. */
1719                 u_short remotePortCopy = remotePort + i;
1720                 if (numRemotePorts == 1 && remotePort == 0)
1721                         remotePortCopy = 0;
1722
1723                 aliaslink = LibAliasRedirectPort (mla, localAddr,
1724                                                 htons(localPort + i),
1725                                                 remoteAddr,
1726                                                 htons(remotePortCopy),
1727                                                 publicAddr,
1728                                                 htons(publicPort + i),
1729                                                 proto);
1730         }
1731
1732 /*
1733  * Setup LSNAT server pool.
1734  */
1735         if (serverPool != NULL && aliaslink != NULL) {
1736                 ptr = strtok(serverPool, ",");
1737                 while (ptr != NULL) {
1738                         if (StrToAddrAndPortRange(ptr, &localAddr, protoName, &portRange) != 0)
1739                                 errx(1, "redirect_port: invalid local port range");
1740
1741                         localPort = GETLOPORT(portRange);
1742                         if (GETNUMPORTS(portRange) != 1)
1743                                 errx(1, "redirect_port: local port must be single in this context");
1744                         LibAliasAddServer(mla, aliaslink, localAddr, htons(localPort));
1745                         ptr = strtok(NULL, ",");
1746                 }
1747         }
1748
1749         free (buf);
1750 }
1751
1752 void
1753 SetupProtoRedirect(const char* parms)
1754 {
1755         char            *buf;
1756         char*           ptr;
1757         struct in_addr  localAddr;
1758         struct in_addr  publicAddr;
1759         struct in_addr  remoteAddr;
1760         int             proto;
1761         char*           protoName;
1762         struct protoent *protoent;
1763
1764         buf = strdup (parms);
1765         if (!buf)
1766                 errx (1, "redirect_port: strdup() failed");
1767 /*
1768  * Extract protocol.
1769  */
1770         protoName = strtok(buf, " \t");
1771         if (!protoName)
1772                 errx(1, "redirect_proto: missing protocol");
1773
1774         protoent = getprotobyname(protoName);
1775         if (protoent == NULL)
1776                 errx(1, "redirect_proto: unknown protocol %s", protoName);
1777         else
1778                 proto = protoent->p_proto;
1779 /*
1780  * Extract local address.
1781  */
1782         ptr = strtok(NULL, " \t");
1783         if (!ptr)
1784                 errx(1, "redirect_proto: missing local address");
1785         else
1786                 StrToAddr(ptr, &localAddr);
1787 /*
1788  * Extract optional public address.
1789  */
1790         ptr = strtok(NULL, " \t");
1791         if (ptr)
1792                 StrToAddr(ptr, &publicAddr);
1793         else
1794                 publicAddr.s_addr = INADDR_ANY;
1795 /*
1796  * Extract optional remote address.
1797  */
1798         ptr = strtok(NULL, " \t");
1799         if (ptr)
1800                 StrToAddr(ptr, &remoteAddr);
1801         else
1802                 remoteAddr.s_addr = INADDR_ANY;
1803 /*
1804  * Create aliasing link.
1805  */
1806         (void)LibAliasRedirectProto(mla, localAddr, remoteAddr, publicAddr,
1807                                        proto);
1808
1809         free (buf);
1810 }
1811
1812 void SetupAddressRedirect (const char* parms)
1813 {
1814         char            *buf;
1815         char*           ptr;
1816         char*           separator;
1817         struct in_addr  localAddr;
1818         struct in_addr  publicAddr;
1819         char*           serverPool;
1820         struct alias_link *aliaslink;
1821
1822         buf = strdup (parms);
1823         if (!buf)
1824                 errx (1, "redirect_port: strdup() failed");
1825 /*
1826  * Extract local address.
1827  */
1828         ptr = strtok (buf, " \t");
1829         if (!ptr)
1830                 errx (1, "redirect_address: missing local address");
1831
1832         separator = strchr(ptr, ',');
1833         if (separator) {                /* LSNAT redirection syntax. */
1834                 localAddr.s_addr = INADDR_NONE;
1835                 serverPool = ptr;
1836         } else {
1837                 StrToAddr (ptr, &localAddr);
1838                 serverPool = NULL;
1839         }
1840 /*
1841  * Extract public address.
1842  */
1843         ptr = strtok (NULL, " \t");
1844         if (!ptr)
1845                 errx (1, "redirect_address: missing public address");
1846
1847         StrToAddr (ptr, &publicAddr);
1848         aliaslink = LibAliasRedirectAddr(mla, localAddr, publicAddr);
1849
1850 /*
1851  * Setup LSNAT server pool.
1852  */
1853         if (serverPool != NULL && aliaslink != NULL) {
1854                 ptr = strtok(serverPool, ",");
1855                 while (ptr != NULL) {
1856                         StrToAddr(ptr, &localAddr);
1857                         LibAliasAddServer(mla, aliaslink, localAddr, htons(~0));
1858                         ptr = strtok(NULL, ",");
1859                 }
1860         }
1861
1862         free (buf);
1863 }
1864
1865 void StrToAddr (const char* str, struct in_addr* addr)
1866 {
1867         struct hostent* hp;
1868
1869         if (inet_aton (str, addr))
1870                 return;
1871
1872         hp = gethostbyname (str);
1873         if (!hp)
1874                 errx (1, "unknown host %s", str);
1875
1876         memcpy (addr, hp->h_addr, sizeof (struct in_addr));
1877 }
1878
1879 u_short StrToPort (const char* str, const char* proto)
1880 {
1881         u_short         port;
1882         struct servent* sp;
1883         char*           end;
1884
1885         port = strtol (str, &end, 10);
1886         if (end != str)
1887                 return htons (port);
1888
1889         sp = getservbyname (str, proto);
1890         if (!sp)
1891                 errx (1, "%s/%s: unknown service", str, proto);
1892
1893         return sp->s_port;
1894 }
1895
1896 int StrToPortRange (const char* str, const char* proto, port_range *portRange)
1897 {
1898         const char*     sep;
1899         struct servent* sp;
1900         char*           end;
1901         u_short         loPort;
1902         u_short         hiPort;
1903
1904         /* First see if this is a service, return corresponding port if so. */
1905         sp = getservbyname (str,proto);
1906         if (sp) {
1907                 SETLOPORT(*portRange, ntohs(sp->s_port));
1908                 SETNUMPORTS(*portRange, 1);
1909                 return 0;
1910         }
1911
1912         /* Not a service, see if it's a single port or port range. */
1913         sep = strchr (str, '-');
1914         if (sep == NULL) {
1915                 SETLOPORT(*portRange, strtol(str, &end, 10));
1916                 if (end != str) {
1917                         /* Single port. */
1918                         SETNUMPORTS(*portRange, 1);
1919                         return 0;
1920                 }
1921
1922                 /* Error in port range field. */
1923                 errx (1, "%s/%s: unknown service", str, proto);
1924         }
1925
1926         /* Port range, get the values and sanity check. */
1927         sscanf (str, "%hu-%hu", &loPort, &hiPort);
1928         SETLOPORT(*portRange, loPort);
1929         SETNUMPORTS(*portRange, 0);     /* Error by default */
1930         if (loPort <= hiPort)
1931                 SETNUMPORTS(*portRange, hiPort - loPort + 1);
1932
1933         if (GETNUMPORTS(*portRange) == 0)
1934                 errx (1, "invalid port range %s", str);
1935
1936         return 0;
1937 }
1938
1939
1940 static int
1941 StrToProto (const char* str)
1942 {
1943         if (!strcmp (str, "tcp"))
1944                 return IPPROTO_TCP;
1945
1946         if (!strcmp (str, "udp"))
1947                 return IPPROTO_UDP;
1948
1949         errx (1, "unknown protocol %s. Expected tcp or udp", str);
1950 }
1951
1952 static int
1953 StrToAddrAndPortRange (char* str, struct in_addr* addr, char* proto, port_range *portRange)
1954 {
1955         char*   ptr;
1956
1957         ptr = strchr (str, ':');
1958         if (!ptr)
1959                 errx (1, "%s is missing port number", str);
1960
1961         *ptr = '\0';
1962         ++ptr;
1963
1964         StrToAddr (str, addr);
1965         return StrToPortRange (ptr, proto, portRange);
1966 }
1967
1968 static void
1969 SetupPunchFW(const char *strValue)
1970 {
1971         unsigned int base, num;
1972
1973         if (sscanf(strValue, "%u:%u", &base, &num) != 2)
1974                 errx(1, "punch_fw: basenumber:count parameter required");
1975
1976         if (CheckIpfwRulenum(base + num - 1) == -1)
1977                 errx(1, "punch_fw: basenumber:count parameter should fit "
1978                         "the maximum allowed rule numbers");
1979
1980         LibAliasSetFWBase(mla, base, num);
1981         (void)LibAliasSetMode(mla, PKT_ALIAS_PUNCH_FW, PKT_ALIAS_PUNCH_FW);
1982 }
1983
1984 static void
1985 SetupSkinnyPort(const char *strValue)
1986 {
1987         unsigned int port;
1988
1989         if (sscanf(strValue, "%u", &port) != 1)
1990                 errx(1, "skinny_port: port parameter required");
1991
1992         LibAliasSetSkinnyPort(mla, port);
1993 }
1994
1995 static void
1996 NewInstance(const char *name)
1997 {
1998         struct instance *ip;
1999
2000         LIST_FOREACH(ip, &root, list) {
2001                 if (!strcmp(ip->name, name)) {
2002                         mla = ip->la;
2003                         mip = ip;
2004                         return;
2005                 }
2006         }
2007         ninstance++;
2008         ip = calloc(1, sizeof(*ip));
2009         ip->name = strdup(name);
2010         ip->la = LibAliasInit (ip->la);
2011         ip->assignAliasAddr     = 0;
2012         ip->ifName              = NULL;
2013         ip->logDropped          = 0;
2014         ip->inPort              = 0;
2015         ip->outPort             = 0;
2016         ip->inOutPort           = 0;
2017         ip->aliasAddr.s_addr    = INADDR_NONE;
2018         ip->ifMTU               = -1;
2019         ip->aliasOverhead       = 12;
2020         LIST_INSERT_HEAD(&root, ip, list);
2021         mla = ip->la;
2022         mip = ip;
2023 }
2024
2025 static int
2026 CheckIpfwRulenum(unsigned int rnum)
2027 {
2028         unsigned int default_rule;
2029         size_t len = sizeof(default_rule);
2030
2031         if (sysctlbyname("net.inet.ip.fw.default_rule", &default_rule, &len,
2032                 NULL, 0) == -1) {
2033                 warn("Failed to get the default ipfw rule number, using "
2034                      "default historical value 65535.  The reason was");
2035                 default_rule = 65535;
2036         }
2037         if (rnum >= default_rule) {
2038                 return -1;
2039         }
2040
2041         return 0;
2042 }