sys/contrib/ipfilter/netinet/ip_nat.c

   1 /*      $FreeBSD$       */
   2
   3 /*
   4  * Copyright (C) 2012 by Darren Reed.
   5  *
   6  * See the IPFILTER.LICENCE file for details on licencing.
   7  */
   8 #if defined(KERNEL) || defined(_KERNEL)
   9 # undef KERNEL
  10 # undef _KERNEL
  11 # define        KERNEL  1
  12 # define        _KERNEL 1
  13 #endif
  14 #include <sys/errno.h>
  15 #include <sys/types.h>
  16 #include <sys/param.h>
  17 #include <sys/time.h>
  18 #include <sys/file.h>
  19 #if defined(_KERNEL) && \
  20     (defined(__NetBSD_Version) && (__NetBSD_Version >= 399002000))
  21 # include <sys/kauth.h>
  22 #endif
  23 #if !defined(_KERNEL)
  24 # include <stdio.h>
  25 # include <string.h>
  26 # include <stdlib.h>
  27 # define KERNEL
  28 # ifdef _OpenBSD__
  29 struct file;
  30 # endif
  31 # include <sys/uio.h>
  32 # undef KERNEL
  33 #endif
  34 #if defined(_KERNEL) && defined(__FreeBSD_version)
  35 # include <sys/filio.h>
  36 # include <sys/fcntl.h>
  37 #else
  38 # include <sys/ioctl.h>
  39 #endif
  40 # include <sys/fcntl.h>
  41 # include <sys/protosw.h>
  42 #include <sys/socket.h>
  43 #if defined(_KERNEL)
  44 # include <sys/systm.h>
  45 # if !defined(__SVR4)
  46 #  include <sys/mbuf.h>
  47 # endif
  48 #endif
  49 #if defined(__SVR4)
  50 # include <sys/filio.h>
  51 # include <sys/byteorder.h>
  52 # ifdef KERNEL
  53 #  include <sys/dditypes.h>
  54 # endif
  55 # include <sys/stream.h>
  56 # include <sys/kmem.h>
  57 #endif
  58 #if defined(__FreeBSD_version)
  59 # include <sys/queue.h>
  60 #endif
  61 #include <net/if.h>
  62 #if defined(__FreeBSD_version)
  63 # include <net/if_var.h>
  64 #endif
  65 #ifdef sun
  66 # include <net/af.h>
  67 #endif
  68 #include <netinet/in.h>
  69 #include <netinet/in_systm.h>
  70 #include <netinet/ip.h>
  71
  72 #ifdef RFC1825
  73 # include <vpn/md5.h>
  74 # include <vpn/ipsec.h>
  75 extern struct ifnet vpnif;
  76 #endif
  77
  78 # include <netinet/ip_var.h>
  79 #include <netinet/tcp.h>
  80 #include <netinet/udp.h>
  81 #include <netinet/ip_icmp.h>
  82 #include "netinet/ip_compat.h"
  83 #include <netinet/tcpip.h>
  84 #include "netinet/ipl.h"
  85 #include "netinet/ip_fil.h"
  86 #include "netinet/ip_nat.h"
  87 #include "netinet/ip_frag.h"
  88 #include "netinet/ip_state.h"
  89 #include "netinet/ip_proxy.h"
  90 #include "netinet/ip_lookup.h"
  91 #include "netinet/ip_dstlist.h"
  92 #include "netinet/ip_sync.h"
  93 #if defined(__FreeBSD_version)
  94 # include <sys/malloc.h>
  95 #endif
  96 #ifdef HAS_SYS_MD5_H
  97 # include <sys/md5.h>
  98 #else
  99 # include "md5.h"
 100 #endif
 101 /* END OF INCLUDES */
 102
 103 #undef  SOCKADDR_IN
 104 #define SOCKADDR_IN     struct sockaddr_in
 105
 106 #if !defined(lint)
 107 static const char sccsid[] = "@(#)ip_nat.c      1.11 6/5/96 (C) 1995 Darren Reed";
 108 static const char rcsid[] = "@(#)$FreeBSD$";
 109 /* static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.195.2.102 2007/10/16 10:08:10 darrenr Exp $"; */
 110 #endif
 111
 112
 113 #define NATFSUM(n,v,f)  ((v) == 4 ? (n)->f.in4.s_addr : (n)->f.i6[0] + \
 114                          (n)->f.i6[1] + (n)->f.i6[2] + (n)->f.i6[3])
 115 #define NBUMP(x)        softn->(x)++
 116 #define NBUMPD(x, y)    do { \
 117                                 softn->x.y++; \
 118                                 DT(y); \
 119                         } while (0)
 120 #define NBUMPSIDE(y,x)  softn->ipf_nat_stats.ns_side[y].x++
 121 #define NBUMPSIDED(y,x) do { softn->ipf_nat_stats.ns_side[y].x++; \
 122                              DT(x); } while (0)
 123 #define NBUMPSIDEX(y,x,z) \
 124                         do { softn->ipf_nat_stats.ns_side[y].x++; \
 125                              DT(z); } while (0)
 126 #define NBUMPSIDEDF(y,x)do { softn->ipf_nat_stats.ns_side[y].x++; \
 127                              DT1(x, fr_info_t *, fin); } while (0)
 128
 129 static ipftuneable_t ipf_nat_tuneables[] = {
 130         /* nat */
 131         { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_lock) },
 132                 "nat_lock",     0,      1,
 133                 stsizeof(ipf_nat_softc_t, ipf_nat_lock),
 134                 IPFT_RDONLY,            NULL,   NULL },
 135         { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_sz) },
 136                 "nat_table_size", 1,    0x7fffffff,
 137                 stsizeof(ipf_nat_softc_t, ipf_nat_table_sz),
 138                 0,                      NULL,   ipf_nat_rehash },
 139         { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_max) },
 140                 "nat_table_max", 1,     0x7fffffff,
 141                 stsizeof(ipf_nat_softc_t, ipf_nat_table_max),
 142                 0,                      NULL,   NULL },
 143         { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_maprules_sz) },
 144                 "nat_rules_size", 1,    0x7fffffff,
 145                 stsizeof(ipf_nat_softc_t, ipf_nat_maprules_sz),
 146                 0,                      NULL,   ipf_nat_rehash_rules },
 147         { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_rdrrules_sz) },
 148                 "rdr_rules_size", 1,    0x7fffffff,
 149                 stsizeof(ipf_nat_softc_t, ipf_nat_rdrrules_sz),
 150                 0,                      NULL,   ipf_nat_rehash_rules },
 151         { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_hostmap_sz) },
 152                 "hostmap_size", 1,      0x7fffffff,
 153                 stsizeof(ipf_nat_softc_t, ipf_nat_hostmap_sz),
 154                 0,                      NULL,   ipf_nat_hostmap_rehash },
 155         { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_maxbucket) },
 156                 "nat_maxbucket",1,      0x7fffffff,
 157                 stsizeof(ipf_nat_softc_t, ipf_nat_maxbucket),
 158                 0,                      NULL,   NULL },
 159         { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_logging) },
 160                 "nat_logging",  0,      1,
 161                 stsizeof(ipf_nat_softc_t, ipf_nat_logging),
 162                 0,                      NULL,   NULL },
 163         { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_doflush) },
 164                 "nat_doflush",  0,      1,
 165                 stsizeof(ipf_nat_softc_t, ipf_nat_doflush),
 166                 0,                      NULL,   NULL },
 167         { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_wm_low) },
 168                 "nat_table_wm_low",     1,      99,
 169                 stsizeof(ipf_nat_softc_t, ipf_nat_table_wm_low),
 170                 0,                      NULL,   NULL },
 171         { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_wm_high) },
 172                 "nat_table_wm_high",    2,      100,
 173                 stsizeof(ipf_nat_softc_t, ipf_nat_table_wm_high),
 174                 0,                      NULL,   NULL },
 175         { { 0 },
 176                 NULL,                   0,      0,
 177                 0,
 178                 0,                      NULL,   NULL }
 179 };
 180
 181 /* ======================================================================== */
 182 /* How the NAT is organised and works.                                      */
 183 /*                                                                          */
 184 /* Inside (interface y) NAT       Outside (interface x)                     */
 185 /* -------------------- -+- -------------------------------------           */
 186 /* Packet going          |   out, processsed by ipf_nat_checkout() for x    */
 187 /* ------------>         |   ------------>                                  */
 188 /* src=10.1.1.1          |   src=192.1.1.1                                  */
 189 /*                       |                                                  */
 190 /*                       |   in, processed by ipf_nat_checkin() for x       */
 191 /* <------------         |   <------------                                  */
 192 /* dst=10.1.1.1          |   dst=192.1.1.1                                  */
 193 /* -------------------- -+- -------------------------------------           */
 194 /* ipf_nat_checkout() - changes ip_src and if required, sport               */
 195 /*             - creates a new mapping, if required.                        */
 196 /* ipf_nat_checkin()  - changes ip_dst and if required, dport               */
 197 /*                                                                          */
 198 /* In the NAT table, internal source is recorded as "in" and externally     */
 199 /* seen as "out".                                                           */
 200 /* ======================================================================== */
 201
 202
 203 #if SOLARIS && !defined(INSTANCES)
 204 extern  int             pfil_delayed_copy;
 205 #endif
 206
 207 static  int     ipf_nat_flush_entry __P((ipf_main_softc_t *, void *));
 208 static  int     ipf_nat_getent __P((ipf_main_softc_t *, caddr_t, int));
 209 static  int     ipf_nat_getsz __P((ipf_main_softc_t *, caddr_t, int));
 210 static  int     ipf_nat_putent __P((ipf_main_softc_t *, caddr_t, int));
 211 static  void    ipf_nat_addmap __P((ipf_nat_softc_t *, ipnat_t *));
 212 static  void    ipf_nat_addrdr __P((ipf_nat_softc_t *, ipnat_t *));
 213 static  int     ipf_nat_builddivertmp __P((ipf_nat_softc_t *, ipnat_t *));
 214 static  int     ipf_nat_clearlist __P((ipf_main_softc_t *, ipf_nat_softc_t *));
 215 static  int     ipf_nat_cmp_rules __P((ipnat_t *, ipnat_t *));
 216 static  int     ipf_nat_decap __P((fr_info_t *, nat_t *));
 217 static  void    ipf_nat_delrule __P((ipf_main_softc_t *, ipf_nat_softc_t *,
 218                                      ipnat_t *, int));
 219 static  int     ipf_nat_extraflush __P((ipf_main_softc_t *, ipf_nat_softc_t *, int));
 220 static  int     ipf_nat_finalise __P((fr_info_t *, nat_t *));
 221 static  int     ipf_nat_flushtable __P((ipf_main_softc_t *, ipf_nat_softc_t *));
 222 static  int     ipf_nat_getnext __P((ipf_main_softc_t *, ipftoken_t *,
 223                                      ipfgeniter_t *, ipfobj_t *));
 224 static  int     ipf_nat_gettable __P((ipf_main_softc_t *, ipf_nat_softc_t *,
 225                                       char *));
 226 static  hostmap_t *ipf_nat_hostmap __P((ipf_nat_softc_t *, ipnat_t *,
 227                                         struct in_addr, struct in_addr,
 228                                         struct in_addr, u_32_t));
 229 static  int     ipf_nat_icmpquerytype __P((int));
 230 static  int     ipf_nat_iterator __P((ipf_main_softc_t *, ipftoken_t *,
 231                                       ipfgeniter_t *, ipfobj_t *));
 232 static  int     ipf_nat_match __P((fr_info_t *, ipnat_t *));
 233 static  int     ipf_nat_matcharray __P((nat_t *, int *, u_long));
 234 static  int     ipf_nat_matchflush __P((ipf_main_softc_t *, ipf_nat_softc_t *,
 235                                         caddr_t));
 236 static  void    ipf_nat_mssclamp __P((tcphdr_t *, u_32_t, fr_info_t *,
 237                                       u_short *));
 238 static  int     ipf_nat_newmap __P((fr_info_t *, nat_t *, natinfo_t *));
 239 static  int     ipf_nat_newdivert __P((fr_info_t *, nat_t *, natinfo_t *));
 240 static  int     ipf_nat_newrdr __P((fr_info_t *, nat_t *, natinfo_t *));
 241 static  int     ipf_nat_newrewrite __P((fr_info_t *, nat_t *, natinfo_t *));
 242 static  int     ipf_nat_nextaddr __P((fr_info_t *, nat_addr_t *, u_32_t *,
 243                                       u_32_t *));
 244 static  int     ipf_nat_nextaddrinit __P((ipf_main_softc_t *, char *,
 245                                           nat_addr_t *, int, void *));
 246 static  int     ipf_nat_resolverule __P((ipf_main_softc_t *, ipnat_t *));
 247 static  int     ipf_nat_ruleaddrinit __P((ipf_main_softc_t *,
 248                                           ipf_nat_softc_t *, ipnat_t *));
 249 static  void    ipf_nat_rule_fini __P((ipf_main_softc_t *, ipnat_t *));
 250 static  int     ipf_nat_rule_init __P((ipf_main_softc_t *, ipf_nat_softc_t *,
 251                                        ipnat_t *));
 252 static  int     ipf_nat_siocaddnat __P((ipf_main_softc_t *, ipf_nat_softc_t *,
 253                                         ipnat_t *, int));
 254 static  void    ipf_nat_siocdelnat __P((ipf_main_softc_t *, ipf_nat_softc_t *,
 255                                         ipnat_t *, int));
 256 static  void    ipf_nat_tabmove __P((ipf_nat_softc_t *, nat_t *));
 257
 258 /* ------------------------------------------------------------------------ */
 259 /* Function:    ipf_nat_main_load                                           */
 260 /* Returns:     int - 0 == success, -1 == failure                           */
 261 /* Parameters:  Nil                                                         */
 262 /*                                                                          */
 263 /* The only global NAT structure that needs to be initialised is the filter */
 264 /* rule that is used with blocking packets.                                 */
 265 /* ------------------------------------------------------------------------ */
 266 int
 267 ipf_nat_main_load()
 268 {
 269
 270         return 0;
 271 }
 272
 273
 274 /* ------------------------------------------------------------------------ */
 275 /* Function:    ipf_nat_main_unload                                         */
 276 /* Returns:     int - 0 == success, -1 == failure                           */
 277 /* Parameters:  Nil                                                         */
 278 /*                                                                          */
 279 /* A null-op function that exists as a placeholder so that the flow in      */
 280 /* other functions is obvious.                                              */
 281 /* ------------------------------------------------------------------------ */
 282 int
 283 ipf_nat_main_unload()
 284 {
 285         return 0;
 286 }
 287
 288
 289 /* ------------------------------------------------------------------------ */
 290 /* Function:    ipf_nat_soft_create                                         */
 291 /* Returns:     void * - NULL = failure, else pointer to NAT context        */
 292 /* Parameters:  softc(I) - pointer to soft context main structure           */
 293 /*                                                                          */
 294 /* Allocate the initial soft context structure for NAT and populate it with */
 295 /* some default values. Creating the tables is left until we call _init so  */
 296 /* that sizes can be changed before we get under way.                       */
 297 /* ------------------------------------------------------------------------ */
 298 void *
 299 ipf_nat_soft_create(softc)
 300         ipf_main_softc_t *softc;
 301 {
 302         ipf_nat_softc_t *softn;
 303
 304         KMALLOC(softn, ipf_nat_softc_t *);
 305         if (softn == NULL)
 306                 return NULL;
 307
 308         bzero((char *)softn, sizeof(*softn));
 309
 310         softn->ipf_nat_tune = ipf_tune_array_copy(softn,
 311                                                   sizeof(ipf_nat_tuneables),
 312                                                   ipf_nat_tuneables);
 313         if (softn->ipf_nat_tune == NULL) {
 314                 ipf_nat_soft_destroy(softc, softn);
 315                 return NULL;
 316         }
 317         if (ipf_tune_array_link(softc, softn->ipf_nat_tune) == -1) {
 318                 ipf_nat_soft_destroy(softc, softn);
 319                 return NULL;
 320         }
 321
 322         softn->ipf_nat_list_tail = &softn->ipf_nat_list;
 323
 324         softn->ipf_nat_table_max = NAT_TABLE_MAX;
 325         softn->ipf_nat_table_sz = NAT_TABLE_SZ;
 326         softn->ipf_nat_maprules_sz = NAT_SIZE;
 327         softn->ipf_nat_rdrrules_sz = RDR_SIZE;
 328         softn->ipf_nat_hostmap_sz = HOSTMAP_SIZE;
 329         softn->ipf_nat_doflush = 0;
 330 #ifdef  IPFILTER_LOG
 331         softn->ipf_nat_logging = 1;
 332 #else
 333         softn->ipf_nat_logging = 0;
 334 #endif
 335
 336         softn->ipf_nat_defage = DEF_NAT_AGE;
 337         softn->ipf_nat_defipage = IPF_TTLVAL(60);
 338         softn->ipf_nat_deficmpage = IPF_TTLVAL(3);
 339         softn->ipf_nat_table_wm_high = 99;
 340         softn->ipf_nat_table_wm_low = 90;
 341
 342         return softn;
 343 }
 344
 345 /* ------------------------------------------------------------------------ */
 346 /* Function:    ipf_nat_soft_destroy                                        */
 347 /* Returns:     Nil                                                         */
 348 /* Parameters:  softc(I) - pointer to soft context main structure           */
 349 /*                                                                          */
 350 /* ------------------------------------------------------------------------ */
 351 void
 352 ipf_nat_soft_destroy(softc, arg)
 353         ipf_main_softc_t *softc;
 354         void *arg;
 355 {
 356         ipf_nat_softc_t *softn = arg;
 357
 358         if (softn->ipf_nat_tune != NULL) {
 359                 ipf_tune_array_unlink(softc, softn->ipf_nat_tune);
 360                 KFREES(softn->ipf_nat_tune, sizeof(ipf_nat_tuneables));
 361                 softn->ipf_nat_tune = NULL;
 362         }
 363
 364         KFREE(softn);
 365 }
 366
 367
 368 /* ------------------------------------------------------------------------ */
 369 /* Function:    ipf_nat_init                                                */
 370 /* Returns:     int - 0 == success, -1 == failure                           */
 371 /* Parameters:  softc(I) - pointer to soft context main structure           */
 372 /*                                                                          */
 373 /* Initialise all of the NAT locks, tables and other structures.            */
 374 /* ------------------------------------------------------------------------ */
 375 int
 376 ipf_nat_soft_init(softc, arg)
 377         ipf_main_softc_t *softc;
 378         void *arg;
 379 {
 380         ipf_nat_softc_t *softn = arg;
 381         ipftq_t *tq;
 382         int i;
 383
 384         KMALLOCS(softn->ipf_nat_table[0], nat_t **, \
 385                  sizeof(nat_t *) * softn->ipf_nat_table_sz);
 386
 387         if (softn->ipf_nat_table[0] != NULL) {
 388                 bzero((char *)softn->ipf_nat_table[0],
 389                       softn->ipf_nat_table_sz * sizeof(nat_t *));
 390         } else {
 391                 return -1;
 392         }
 393
 394         KMALLOCS(softn->ipf_nat_table[1], nat_t **, \
 395                  sizeof(nat_t *) * softn->ipf_nat_table_sz);
 396
 397         if (softn->ipf_nat_table[1] != NULL) {
 398                 bzero((char *)softn->ipf_nat_table[1],
 399                       softn->ipf_nat_table_sz * sizeof(nat_t *));
 400         } else {
 401                 return -2;
 402         }
 403
 404         KMALLOCS(softn->ipf_nat_map_rules, ipnat_t **, \
 405                  sizeof(ipnat_t *) * softn->ipf_nat_maprules_sz);
 406
 407         if (softn->ipf_nat_map_rules != NULL) {
 408                 bzero((char *)softn->ipf_nat_map_rules,
 409                       softn->ipf_nat_maprules_sz * sizeof(ipnat_t *));
 410         } else {
 411                 return -3;
 412         }
 413
 414         KMALLOCS(softn->ipf_nat_rdr_rules, ipnat_t **, \
 415                  sizeof(ipnat_t *) * softn->ipf_nat_rdrrules_sz);
 416
 417         if (softn->ipf_nat_rdr_rules != NULL) {
 418                 bzero((char *)softn->ipf_nat_rdr_rules,
 419                       softn->ipf_nat_rdrrules_sz * sizeof(ipnat_t *));
 420         } else {
 421                 return -4;
 422         }
 423
 424         KMALLOCS(softn->ipf_hm_maptable, hostmap_t **, \
 425                  sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
 426
 427         if (softn->ipf_hm_maptable != NULL) {
 428                 bzero((char *)softn->ipf_hm_maptable,
 429                       sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
 430         } else {
 431                 return -5;
 432         }
 433         softn->ipf_hm_maplist = NULL;
 434
 435         KMALLOCS(softn->ipf_nat_stats.ns_side[0].ns_bucketlen, u_int *,
 436                  softn->ipf_nat_table_sz * sizeof(u_int));
 437
 438         if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen == NULL) {
 439                 return -6;
 440         }
 441         bzero((char *)softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
 442               softn->ipf_nat_table_sz * sizeof(u_int));
 443
 444         KMALLOCS(softn->ipf_nat_stats.ns_side[1].ns_bucketlen, u_int *,
 445                  softn->ipf_nat_table_sz * sizeof(u_int));
 446
 447         if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen == NULL) {
 448                 return -7;
 449         }
 450
 451         bzero((char *)softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
 452               softn->ipf_nat_table_sz * sizeof(u_int));
 453
 454         if (softn->ipf_nat_maxbucket == 0) {
 455                 for (i = softn->ipf_nat_table_sz; i > 0; i >>= 1)
 456                         softn->ipf_nat_maxbucket++;
 457                 softn->ipf_nat_maxbucket *= 2;
 458         }
 459
 460         ipf_sttab_init(softc, softn->ipf_nat_tcptq);
 461         /*
 462          * Increase this because we may have "keep state" following this too
 463          * and packet storms can occur if this is removed too quickly.
 464          */
 465         softn->ipf_nat_tcptq[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcplastack;
 466         softn->ipf_nat_tcptq[IPF_TCP_NSTATES - 1].ifq_next =
 467                                                         &softn->ipf_nat_udptq;
 468
 469         IPFTQ_INIT(&softn->ipf_nat_udptq, softn->ipf_nat_defage,
 470                    "nat ipftq udp tab");
 471         softn->ipf_nat_udptq.ifq_next = &softn->ipf_nat_udpacktq;
 472
 473         IPFTQ_INIT(&softn->ipf_nat_udpacktq, softn->ipf_nat_defage,
 474                    "nat ipftq udpack tab");
 475         softn->ipf_nat_udpacktq.ifq_next = &softn->ipf_nat_icmptq;
 476
 477         IPFTQ_INIT(&softn->ipf_nat_icmptq, softn->ipf_nat_deficmpage,
 478                    "nat icmp ipftq tab");
 479         softn->ipf_nat_icmptq.ifq_next = &softn->ipf_nat_icmpacktq;
 480
 481         IPFTQ_INIT(&softn->ipf_nat_icmpacktq, softn->ipf_nat_defage,
 482                    "nat icmpack ipftq tab");
 483         softn->ipf_nat_icmpacktq.ifq_next = &softn->ipf_nat_iptq;
 484
 485         IPFTQ_INIT(&softn->ipf_nat_iptq, softn->ipf_nat_defipage,
 486                    "nat ip ipftq tab");
 487         softn->ipf_nat_iptq.ifq_next = &softn->ipf_nat_pending;
 488
 489         IPFTQ_INIT(&softn->ipf_nat_pending, 1, "nat pending ipftq tab");
 490         softn->ipf_nat_pending.ifq_next = NULL;
 491
 492         for (i = 0, tq = softn->ipf_nat_tcptq; i < IPF_TCP_NSTATES; i++, tq++) {
 493                 if (tq->ifq_ttl < softn->ipf_nat_deficmpage)
 494                         tq->ifq_ttl = softn->ipf_nat_deficmpage;
 495 #ifdef LARGE_NAT
 496                 else if (tq->ifq_ttl > softn->ipf_nat_defage)
 497                         tq->ifq_ttl = softn->ipf_nat_defage;
 498 #endif
 499         }
 500
 501         /*
 502          * Increase this because we may have "keep state" following
 503          * this too and packet storms can occur if this is removed
 504          * too quickly.
 505          */
 506         softn->ipf_nat_tcptq[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcplastack;
 507
 508         MUTEX_INIT(&softn->ipf_nat_new, "ipf nat new mutex");
 509         MUTEX_INIT(&softn->ipf_nat_io, "ipf nat io mutex");
 510
 511         softn->ipf_nat_inited = 1;
 512
 513         return 0;
 514 }
 515
 516
 517 /* ------------------------------------------------------------------------ */
 518 /* Function:    ipf_nat_soft_fini                                           */
 519 /* Returns:     Nil                                                         */
 520 /* Parameters:  softc(I) - pointer to soft context main structure           */
 521 /*                                                                          */
 522 /* Free all memory used by NAT structures allocated at runtime.             */
 523 /* ------------------------------------------------------------------------ */
 524 int
 525 ipf_nat_soft_fini(softc, arg)
 526         ipf_main_softc_t *softc;
 527         void *arg;
 528 {
 529         ipf_nat_softc_t *softn = arg;
 530         ipftq_t *ifq, *ifqnext;
 531
 532         (void) ipf_nat_clearlist(softc, softn);
 533         (void) ipf_nat_flushtable(softc, softn);
 534
 535         /*
 536          * Proxy timeout queues are not cleaned here because although they
 537          * exist on the NAT list, ipf_proxy_unload is called after unload
 538          * and the proxies actually are responsible for them being created.
 539          * Should the proxy timeouts have their own list?  There's no real
 540          * justification as this is the only complication.
 541          */
 542         for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifqnext) {
 543                 ifqnext = ifq->ifq_next;
 544                 if (ipf_deletetimeoutqueue(ifq) == 0)
 545                         ipf_freetimeoutqueue(softc, ifq);
 546         }
 547
 548         if (softn->ipf_nat_table[0] != NULL) {
 549                 KFREES(softn->ipf_nat_table[0],
 550                        sizeof(nat_t *) * softn->ipf_nat_table_sz);
 551                 softn->ipf_nat_table[0] = NULL;
 552         }
 553         if (softn->ipf_nat_table[1] != NULL) {
 554                 KFREES(softn->ipf_nat_table[1],
 555                        sizeof(nat_t *) * softn->ipf_nat_table_sz);
 556                 softn->ipf_nat_table[1] = NULL;
 557         }
 558         if (softn->ipf_nat_map_rules != NULL) {
 559                 KFREES(softn->ipf_nat_map_rules,
 560                        sizeof(ipnat_t *) * softn->ipf_nat_maprules_sz);
 561                 softn->ipf_nat_map_rules = NULL;
 562         }
 563         if (softn->ipf_nat_rdr_rules != NULL) {
 564                 KFREES(softn->ipf_nat_rdr_rules,
 565                        sizeof(ipnat_t *) * softn->ipf_nat_rdrrules_sz);
 566                 softn->ipf_nat_rdr_rules = NULL;
 567         }
 568         if (softn->ipf_hm_maptable != NULL) {
 569                 KFREES(softn->ipf_hm_maptable,
 570                        sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
 571                 softn->ipf_hm_maptable = NULL;
 572         }
 573         if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen != NULL) {
 574                 KFREES(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
 575                        sizeof(u_int) * softn->ipf_nat_table_sz);
 576                 softn->ipf_nat_stats.ns_side[0].ns_bucketlen = NULL;
 577         }
 578         if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen != NULL) {
 579                 KFREES(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
 580                        sizeof(u_int) * softn->ipf_nat_table_sz);
 581                 softn->ipf_nat_stats.ns_side[1].ns_bucketlen = NULL;
 582         }
 583
 584         if (softn->ipf_nat_inited == 1) {
 585                 softn->ipf_nat_inited = 0;
 586                 ipf_sttab_destroy(softn->ipf_nat_tcptq);
 587
 588                 MUTEX_DESTROY(&softn->ipf_nat_new);
 589                 MUTEX_DESTROY(&softn->ipf_nat_io);
 590
 591                 MUTEX_DESTROY(&softn->ipf_nat_udptq.ifq_lock);
 592                 MUTEX_DESTROY(&softn->ipf_nat_udpacktq.ifq_lock);
 593                 MUTEX_DESTROY(&softn->ipf_nat_icmptq.ifq_lock);
 594                 MUTEX_DESTROY(&softn->ipf_nat_icmpacktq.ifq_lock);
 595                 MUTEX_DESTROY(&softn->ipf_nat_iptq.ifq_lock);
 596                 MUTEX_DESTROY(&softn->ipf_nat_pending.ifq_lock);
 597         }
 598
 599         return 0;
 600 }
 601
 602
 603 /* ------------------------------------------------------------------------ */
 604 /* Function:    ipf_nat_setlock                                             */
 605 /* Returns:     Nil                                                         */
 606 /* Parameters:  arg(I) - pointer to soft state information                  */
 607 /*              tmp(I) - new lock value                                     */
 608 /*                                                                          */
 609 /* Set the "lock status" of NAT to the value in tmp.                        */
 610 /* ------------------------------------------------------------------------ */
 611 void
 612 ipf_nat_setlock(arg, tmp)
 613         void *arg;
 614         int tmp;
 615 {
 616         ipf_nat_softc_t *softn = arg;
 617
 618         softn->ipf_nat_lock = tmp;
 619 }
 620
 621
 622 /* ------------------------------------------------------------------------ */
 623 /* Function:    ipf_nat_addrdr                                              */
 624 /* Returns:     Nil                                                         */
 625 /* Parameters:  n(I) - pointer to NAT rule to add                           */
 626 /*                                                                          */
 627 /* Adds a redirect rule to the hash table of redirect rules and the list of */
 628 /* loaded NAT rules.  Updates the bitmask indicating which netmasks are in  */
 629 /* use by redirect rules.                                                   */
 630 /* ------------------------------------------------------------------------ */
 631 static void
 632 ipf_nat_addrdr(softn, n)
 633         ipf_nat_softc_t *softn;
 634         ipnat_t *n;
 635 {
 636         ipnat_t **np;
 637         u_32_t j;
 638         u_int hv;
 639         u_int rhv;
 640         int k;
 641
 642         if (n->in_odstatype == FRI_NORMAL) {
 643                 k = count4bits(n->in_odstmsk);
 644                 ipf_inet_mask_add(k, &softn->ipf_nat_rdr_mask);
 645                 j = (n->in_odstaddr & n->in_odstmsk);
 646                 rhv = NAT_HASH_FN(j, 0, 0xffffffff);
 647         } else {
 648                 ipf_inet_mask_add(0, &softn->ipf_nat_rdr_mask);
 649                 j = 0;
 650                 rhv = 0;
 651         }
 652         hv = rhv % softn->ipf_nat_rdrrules_sz;
 653         np = softn->ipf_nat_rdr_rules + hv;
 654         while (*np != NULL)
 655                 np = &(*np)->in_rnext;
 656         n->in_rnext = NULL;
 657         n->in_prnext = np;
 658         n->in_hv[0] = hv;
 659         n->in_use++;
 660         *np = n;
 661 }
 662
 663
 664 /* ------------------------------------------------------------------------ */
 665 /* Function:    ipf_nat_addmap                                              */
 666 /* Returns:     Nil                                                         */
 667 /* Parameters:  n(I) - pointer to NAT rule to add                           */
 668 /*                                                                          */
 669 /* Adds a NAT map rule to the hash table of rules and the list of  loaded   */
 670 /* NAT rules.  Updates the bitmask indicating which netmasks are in use by  */
 671 /* redirect rules.                                                          */
 672 /* ------------------------------------------------------------------------ */
 673 static void
 674 ipf_nat_addmap(softn, n)
 675         ipf_nat_softc_t *softn;
 676         ipnat_t *n;
 677 {
 678         ipnat_t **np;
 679         u_32_t j;
 680         u_int hv;
 681         u_int rhv;
 682         int k;
 683
 684         if (n->in_osrcatype == FRI_NORMAL) {
 685                 k = count4bits(n->in_osrcmsk);
 686                 ipf_inet_mask_add(k, &softn->ipf_nat_map_mask);
 687                 j = (n->in_osrcaddr & n->in_osrcmsk);
 688                 rhv = NAT_HASH_FN(j, 0, 0xffffffff);
 689         } else {
 690                 ipf_inet_mask_add(0, &softn->ipf_nat_map_mask);
 691                 j = 0;
 692                 rhv = 0;
 693         }
 694         hv = rhv % softn->ipf_nat_maprules_sz;
 695         np = softn->ipf_nat_map_rules + hv;
 696         while (*np != NULL)
 697                 np = &(*np)->in_mnext;
 698         n->in_mnext = NULL;
 699         n->in_pmnext = np;
 700         n->in_hv[1] = rhv;
 701         n->in_use++;
 702         *np = n;
 703 }
 704
 705
 706 /* ------------------------------------------------------------------------ */
 707 /* Function:    ipf_nat_delrdr                                              */
 708 /* Returns:     Nil                                                         */
 709 /* Parameters:  n(I) - pointer to NAT rule to delete                        */
 710 /*                                                                          */
 711 /* Removes a redirect rule from the hash table of redirect rules.           */
 712 /* ------------------------------------------------------------------------ */
 713 void
 714 ipf_nat_delrdr(softn, n)
 715         ipf_nat_softc_t *softn;
 716         ipnat_t *n;
 717 {
 718         if (n->in_odstatype == FRI_NORMAL) {
 719                 int k = count4bits(n->in_odstmsk);
 720                 ipf_inet_mask_del(k, &softn->ipf_nat_rdr_mask);
 721         } else {
 722                 ipf_inet_mask_del(0, &softn->ipf_nat_rdr_mask);
 723         }
 724         if (n->in_rnext)
 725                 n->in_rnext->in_prnext = n->in_prnext;
 726         *n->in_prnext = n->in_rnext;
 727         n->in_use--;
 728 }
 729
 730
 731 /* ------------------------------------------------------------------------ */
 732 /* Function:    ipf_nat_delmap                                              */
 733 /* Returns:     Nil                                                         */
 734 /* Parameters:  n(I) - pointer to NAT rule to delete                        */
 735 /*                                                                          */
 736 /* Removes a NAT map rule from the hash table of NAT map rules.             */
 737 /* ------------------------------------------------------------------------ */
 738 void
 739 ipf_nat_delmap(softn, n)
 740         ipf_nat_softc_t *softn;
 741         ipnat_t *n;
 742 {
 743         if (n->in_osrcatype == FRI_NORMAL) {
 744                 int k = count4bits(n->in_osrcmsk);
 745                 ipf_inet_mask_del(k, &softn->ipf_nat_map_mask);
 746         } else {
 747                 ipf_inet_mask_del(0, &softn->ipf_nat_map_mask);
 748         }
 749         if (n->in_mnext != NULL)
 750                 n->in_mnext->in_pmnext = n->in_pmnext;
 751         *n->in_pmnext = n->in_mnext;
 752         n->in_use--;
 753 }
 754
 755
 756 /* ------------------------------------------------------------------------ */
 757 /* Function:    ipf_nat_hostmap                                             */
 758 /* Returns:     struct hostmap* - NULL if no hostmap could be created,      */
 759 /*                                else a pointer to the hostmapping to use  */
 760 /* Parameters:  np(I)   - pointer to NAT rule                               */
 761 /*              real(I) - real IP address                                   */
 762 /*              map(I)  - mapped IP address                                 */
 763 /*              port(I) - destination port number                           */
 764 /* Write Locks: ipf_nat                                                     */
 765 /*                                                                          */
 766 /* Check if an ip address has already been allocated for a given mapping    */
 767 /* that is not doing port based translation.  If is not yet allocated, then */
 768 /* create a new entry if a non-NULL NAT rule pointer has been supplied.     */
 769 /* ------------------------------------------------------------------------ */
 770 static struct hostmap *
 771 ipf_nat_hostmap(softn, np, src, dst, map, port)
 772         ipf_nat_softc_t *softn;
 773         ipnat_t *np;
 774         struct in_addr src;
 775         struct in_addr dst;
 776         struct in_addr map;
 777         u_32_t port;
 778 {
 779         hostmap_t *hm;
 780         u_int hv, rhv;
 781
 782         hv = (src.s_addr ^ dst.s_addr);
 783         hv += src.s_addr;
 784         hv += dst.s_addr;
 785         rhv = hv;
 786         hv %= softn->ipf_nat_hostmap_sz;
 787         for (hm = softn->ipf_hm_maptable[hv]; hm; hm = hm->hm_hnext)
 788                 if ((hm->hm_osrcip.s_addr == src.s_addr) &&
 789                     (hm->hm_odstip.s_addr == dst.s_addr) &&
 790                     ((np == NULL) || (np == hm->hm_ipnat)) &&
 791                     ((port == 0) || (port == hm->hm_port))) {
 792                         softn->ipf_nat_stats.ns_hm_addref++;
 793                         hm->hm_ref++;
 794                         return hm;
 795                 }
 796
 797         if (np == NULL) {
 798                 softn->ipf_nat_stats.ns_hm_nullnp++;
 799                 return NULL;
 800         }
 801
 802         KMALLOC(hm, hostmap_t *);
 803         if (hm) {
 804                 hm->hm_next = softn->ipf_hm_maplist;
 805                 hm->hm_pnext = &softn->ipf_hm_maplist;
 806                 if (softn->ipf_hm_maplist != NULL)
 807                         softn->ipf_hm_maplist->hm_pnext = &hm->hm_next;
 808                 softn->ipf_hm_maplist = hm;
 809                 hm->hm_hnext = softn->ipf_hm_maptable[hv];
 810                 hm->hm_phnext = softn->ipf_hm_maptable + hv;
 811                 if (softn->ipf_hm_maptable[hv] != NULL)
 812                         softn->ipf_hm_maptable[hv]->hm_phnext = &hm->hm_hnext;
 813                 softn->ipf_hm_maptable[hv] = hm;
 814                 hm->hm_ipnat = np;
 815                 np->in_use++;
 816                 hm->hm_osrcip = src;
 817                 hm->hm_odstip = dst;
 818                 hm->hm_nsrcip = map;
 819                 hm->hm_ndstip.s_addr = 0;
 820                 hm->hm_ref = 1;
 821                 hm->hm_port = port;
 822                 hm->hm_hv = rhv;
 823                 hm->hm_v = 4;
 824                 softn->ipf_nat_stats.ns_hm_new++;
 825         } else {
 826                 softn->ipf_nat_stats.ns_hm_newfail++;
 827         }
 828         return hm;
 829 }
 830
 831
 832 /* ------------------------------------------------------------------------ */
 833 /* Function:    ipf_nat_hostmapdel                                          */
 834 /* Returns:     Nil                                                         */
 835 /* Parameters:  hmp(I) - pointer to hostmap structure pointer               */
 836 /* Write Locks: ipf_nat                                                     */
 837 /*                                                                          */
 838 /* Decrement the references to this hostmap structure by one.  If this      */
 839 /* reaches zero then remove it and free it.                                 */
 840 /* ------------------------------------------------------------------------ */
 841 void
 842 ipf_nat_hostmapdel(softc, hmp)
 843         ipf_main_softc_t *softc;
 844         struct hostmap **hmp;
 845 {
 846         struct hostmap *hm;
 847
 848         hm = *hmp;
 849         *hmp = NULL;
 850
 851         hm->hm_ref--;
 852         if (hm->hm_ref == 0) {
 853                 ipf_nat_rule_deref(softc, &hm->hm_ipnat);
 854                 if (hm->hm_hnext)
 855                         hm->hm_hnext->hm_phnext = hm->hm_phnext;
 856                 *hm->hm_phnext = hm->hm_hnext;
 857                 if (hm->hm_next)
 858                         hm->hm_next->hm_pnext = hm->hm_pnext;
 859                 *hm->hm_pnext = hm->hm_next;
 860                 KFREE(hm);
 861         }
 862 }
 863
 864
 865 /* ------------------------------------------------------------------------ */
 866 /* Function:    ipf_fix_outcksum                                            */
 867 /* Returns:     Nil                                                         */
 868 /* Parameters:  fin(I) - pointer to packet information                      */
 869 /*              sp(I)  - location of 16bit checksum to update               */
 870 /*              n((I)  - amount to adjust checksum by                       */
 871 /*                                                                          */
 872 /* Adjusts the 16bit checksum by "n" for packets going out.                 */
 873 /* ------------------------------------------------------------------------ */
 874 void
 875 ipf_fix_outcksum(cksum, sp, n, partial)
 876         int cksum;
 877         u_short *sp;
 878         u_32_t n, partial;
 879 {
 880         u_short sumshort;
 881         u_32_t sum1;
 882
 883         if (n == 0)
 884                 return;
 885
 886         if (cksum == 4) {
 887                 *sp = 0;
 888                 return;
 889         }
 890         if (cksum == 2) {
 891                 sum1 = partial;
 892                 sum1 = (sum1 & 0xffff) + (sum1 >> 16);
 893                 *sp = htons(sum1);
 894                 return;
 895         }
 896         sum1 = (~ntohs(*sp)) & 0xffff;
 897         sum1 += (n);
 898         sum1 = (sum1 >> 16) + (sum1 & 0xffff);
 899         /* Again */
 900         sum1 = (sum1 >> 16) + (sum1 & 0xffff);
 901         sumshort = ~(u_short)sum1;
 902         *(sp) = htons(sumshort);
 903 }
 904
 905
 906 /* ------------------------------------------------------------------------ */
 907 /* Function:    ipf_fix_incksum                                             */
 908 /* Returns:     Nil                                                         */
 909 /* Parameters:  fin(I) - pointer to packet information                      */
 910 /*              sp(I)  - location of 16bit checksum to update               */
 911 /*              n((I)  - amount to adjust checksum by                       */
 912 /*                                                                          */
 913 /* Adjusts the 16bit checksum by "n" for packets going in.                  */
 914 /* ------------------------------------------------------------------------ */
 915 void
 916 ipf_fix_incksum(cksum, sp, n, partial)
 917         int cksum;
 918         u_short *sp;
 919         u_32_t n, partial;
 920 {
 921         u_short sumshort;
 922         u_32_t sum1;
 923
 924         if (n == 0)
 925                 return;
 926
 927         if (cksum == 4) {
 928                 *sp = 0;
 929                 return;
 930         }
 931         if (cksum == 2) {
 932                 sum1 = partial;
 933                 sum1 = (sum1 & 0xffff) + (sum1 >> 16);
 934                 *sp = htons(sum1);
 935                 return;
 936         }
 937
 938         sum1 = (~ntohs(*sp)) & 0xffff;
 939         sum1 += ~(n) & 0xffff;
 940         sum1 = (sum1 >> 16) + (sum1 & 0xffff);
 941         /* Again */
 942         sum1 = (sum1 >> 16) + (sum1 & 0xffff);
 943         sumshort = ~(u_short)sum1;
 944         *(sp) = htons(sumshort);
 945 }
 946
 947
 948 /* ------------------------------------------------------------------------ */
 949 /* Function:    ipf_fix_datacksum                                           */
 950 /* Returns:     Nil                                                         */
 951 /* Parameters:  sp(I)  - location of 16bit checksum to update               */
 952 /*              n((I)  - amount to adjust checksum by                       */
 953 /*                                                                          */
 954 /* Fix_datacksum is used *only* for the adjustments of checksums in the     */
 955 /* data section of an IP packet.                                            */
 956 /*                                                                          */
 957 /* The only situation in which you need to do this is when NAT'ing an       */
 958 /* ICMP error message. Such a message, contains in its body the IP header   */
 959 /* of the original IP packet, that causes the error.                        */
 960 /*                                                                          */
 961 /* You can't use fix_incksum or fix_outcksum in that case, because for the  */
 962 /* kernel the data section of the ICMP error is just data, and no special   */
 963 /* processing like hardware cksum or ntohs processing have been done by the */
 964 /* kernel on the data section.                                              */
 965 /* ------------------------------------------------------------------------ */
 966 void
 967 ipf_fix_datacksum(sp, n)
 968         u_short *sp;
 969         u_32_t n;
 970 {
 971         u_short sumshort;
 972         u_32_t sum1;
 973
 974         if (n == 0)
 975                 return;
 976
 977         sum1 = (~ntohs(*sp)) & 0xffff;
 978         sum1 += (n);
 979         sum1 = (sum1 >> 16) + (sum1 & 0xffff);
 980         /* Again */
 981         sum1 = (sum1 >> 16) + (sum1 & 0xffff);
 982         sumshort = ~(u_short)sum1;
 983         *(sp) = htons(sumshort);
 984 }
 985
 986
 987 /* ------------------------------------------------------------------------ */
 988 /* Function:    ipf_nat_ioctl                                               */
 989 /* Returns:     int - 0 == success, != 0 == failure                         */
 990 /* Parameters:  softc(I) - pointer to soft context main structure           */
 991 /*              data(I)  - pointer to ioctl data                            */
 992 /*              cmd(I)   - ioctl command integer                            */
 993 /*              mode(I)  - file mode bits used with open                    */
 994 /*              uid(I)   - uid of calling process                           */
 995 /*              ctx(I)   - pointer used as key for finding context          */
 996 /*                                                                          */
 997 /* Processes an ioctl call made to operate on the IP Filter NAT device.     */
 998 /* ------------------------------------------------------------------------ */
 999 int
1000 ipf_nat_ioctl(softc, data, cmd, mode, uid, ctx)
1001         ipf_main_softc_t *softc;
1002         ioctlcmd_t cmd;
1003         caddr_t data;
1004         int mode, uid;
1005         void *ctx;
1006 {
1007         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1008         int error = 0, ret, arg, getlock;
1009         ipnat_t *nat, *nt, *n;
1010         ipnat_t natd;
1011         SPL_INT(s);
1012
1013 #if BSD_GE_YEAR(199306) && defined(_KERNEL)
1014 # if NETBSD_GE_REV(399002000)
1015         if ((mode & FWRITE) &&
1016              kauth_authorize_network(curlwp->l_cred, KAUTH_NETWORK_FIREWALL,
1017                                      KAUTH_REQ_NETWORK_FIREWALL_FW,
1018                                      NULL, NULL, NULL))
1019 # else
1020 #  if defined(__FreeBSD_version)
1021         if (securelevel_ge(curthread->td_ucred, 3) && (mode & FWRITE))
1022 #  else
1023         if ((securelevel >= 3) && (mode & FWRITE))
1024 #  endif
1025 # endif
1026         {
1027                 IPFERROR(60001);
1028                 return EPERM;
1029         }
1030 #endif
1031
1032         getlock = (mode & NAT_LOCKHELD) ? 0 : 1;
1033
1034         n = NULL;
1035         nt = NULL;
1036         nat = NULL;
1037
1038         if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT) ||
1039             (cmd == (ioctlcmd_t)SIOCPURGENAT)) {
1040                 if (mode & NAT_SYSSPACE) {
1041                         bcopy(data, (char *)&natd, sizeof(natd));
1042                         nat = &natd;
1043                         error = 0;
1044                 } else {
1045                         bzero(&natd, sizeof(natd));
1046                         error = ipf_inobj(softc, data, NULL, &natd,
1047                                           IPFOBJ_IPNAT);
1048                         if (error != 0)
1049                                 goto done;
1050
1051                         if (natd.in_size < sizeof(ipnat_t)) {
1052                                 error = EINVAL;
1053                                 goto done;
1054                         }
1055                         KMALLOCS(nt, ipnat_t *, natd.in_size);
1056                         if (nt == NULL) {
1057                                 IPFERROR(60070);
1058                                 error = ENOMEM;
1059                                 goto done;
1060                         }
1061                         bzero(nt, natd.in_size);
1062                         error = ipf_inobjsz(softc, data, nt, IPFOBJ_IPNAT,
1063                                             natd.in_size);
1064                         if (error)
1065                                 goto done;
1066                         nat = nt;
1067                 }
1068
1069                 /*
1070                  * For add/delete, look to see if the NAT entry is
1071                  * already present
1072                  */
1073                 nat->in_flags &= IPN_USERFLAGS;
1074                 if ((nat->in_redir & NAT_MAPBLK) == 0) {
1075                         if (nat->in_osrcatype == FRI_NORMAL ||
1076                             nat->in_osrcatype == FRI_NONE)
1077                                 nat->in_osrcaddr &= nat->in_osrcmsk;
1078                         if (nat->in_odstatype == FRI_NORMAL ||
1079                             nat->in_odstatype == FRI_NONE)
1080                                 nat->in_odstaddr &= nat->in_odstmsk;
1081                         if ((nat->in_flags & (IPN_SPLIT|IPN_SIPRANGE)) == 0) {
1082                                 if (nat->in_nsrcatype == FRI_NORMAL)
1083                                         nat->in_nsrcaddr &= nat->in_nsrcmsk;
1084                                 if (nat->in_ndstatype == FRI_NORMAL)
1085                                         nat->in_ndstaddr &= nat->in_ndstmsk;
1086                         }
1087                 }
1088
1089                 error = ipf_nat_rule_init(softc, softn, nat);
1090                 if (error != 0)
1091                         goto done;
1092
1093                 MUTEX_ENTER(&softn->ipf_nat_io);
1094                 for (n = softn->ipf_nat_list; n != NULL; n = n->in_next)
1095                         if (ipf_nat_cmp_rules(nat, n) == 0)
1096                                 break;
1097         }
1098
1099         switch (cmd)
1100         {
1101 #ifdef  IPFILTER_LOG
1102         case SIOCIPFFB :
1103         {
1104                 int tmp;
1105
1106                 if (!(mode & FWRITE)) {
1107                         IPFERROR(60002);
1108                         error = EPERM;
1109                 } else {
1110                         tmp = ipf_log_clear(softc, IPL_LOGNAT);
1111                         error = BCOPYOUT(&tmp, data, sizeof(tmp));
1112                         if (error != 0) {
1113                                 IPFERROR(60057);
1114                                 error = EFAULT;
1115                         }
1116                 }
1117                 break;
1118         }
1119
1120         case SIOCSETLG :
1121                 if (!(mode & FWRITE)) {
1122                         IPFERROR(60003);
1123                         error = EPERM;
1124                 } else {
1125                         error = BCOPYIN(data, &softn->ipf_nat_logging,
1126                                         sizeof(softn->ipf_nat_logging));
1127                         if (error != 0)
1128                                 error = EFAULT;
1129                 }
1130                 break;
1131
1132         case SIOCGETLG :
1133                 error = BCOPYOUT(&softn->ipf_nat_logging, data,
1134                                  sizeof(softn->ipf_nat_logging));
1135                 if (error != 0) {
1136                         IPFERROR(60004);
1137                         error = EFAULT;
1138                 }
1139                 break;
1140
1141         case FIONREAD :
1142                 arg = ipf_log_bytesused(softc, IPL_LOGNAT);
1143                 error = BCOPYOUT(&arg, data, sizeof(arg));
1144                 if (error != 0) {
1145                         IPFERROR(60005);
1146                         error = EFAULT;
1147                 }
1148                 break;
1149 #endif
1150         case SIOCADNAT :
1151                 if (!(mode & FWRITE)) {
1152                         IPFERROR(60006);
1153                         error = EPERM;
1154                 } else if (n != NULL) {
1155                         natd.in_flineno = n->in_flineno;
1156                         (void) ipf_outobj(softc, data, &natd, IPFOBJ_IPNAT);
1157                         IPFERROR(60007);
1158                         error = EEXIST;
1159                 } else if (nt == NULL) {
1160                         IPFERROR(60008);
1161                         error = ENOMEM;
1162                 }
1163                 if (error != 0) {
1164                         MUTEX_EXIT(&softn->ipf_nat_io);
1165                         break;
1166                 }
1167                 if (nat != nt)
1168                         bcopy((char *)nat, (char *)nt, sizeof(*n));
1169                 error = ipf_nat_siocaddnat(softc, softn, nt, getlock);
1170                 MUTEX_EXIT(&softn->ipf_nat_io);
1171                 if (error == 0) {
1172                         nat = NULL;
1173                         nt = NULL;
1174                 }
1175                 break;
1176
1177         case SIOCRMNAT :
1178         case SIOCPURGENAT :
1179                 if (!(mode & FWRITE)) {
1180                         IPFERROR(60009);
1181                         error = EPERM;
1182                         n = NULL;
1183                 } else if (n == NULL) {
1184                         IPFERROR(60010);
1185                         error = ESRCH;
1186                 }
1187
1188                 if (error != 0) {
1189                         MUTEX_EXIT(&softn->ipf_nat_io);
1190                         break;
1191                 }
1192                 if (cmd == (ioctlcmd_t)SIOCPURGENAT) {
1193                         error = ipf_outobjsz(softc, data, n, IPFOBJ_IPNAT,
1194                                              n->in_size);
1195                         if (error) {
1196                                 MUTEX_EXIT(&softn->ipf_nat_io);
1197                                 goto done;
1198                         }
1199                         n->in_flags |= IPN_PURGE;
1200                 }
1201                 ipf_nat_siocdelnat(softc, softn, n, getlock);
1202
1203                 MUTEX_EXIT(&softn->ipf_nat_io);
1204                 n = NULL;
1205                 break;
1206
1207         case SIOCGNATS :
1208             {
1209                 natstat_t *nsp = &softn->ipf_nat_stats;
1210
1211                 nsp->ns_side[0].ns_table = softn->ipf_nat_table[0];
1212                 nsp->ns_side[1].ns_table = softn->ipf_nat_table[1];
1213                 nsp->ns_list = softn->ipf_nat_list;
1214                 nsp->ns_maptable = softn->ipf_hm_maptable;
1215                 nsp->ns_maplist = softn->ipf_hm_maplist;
1216                 nsp->ns_nattab_sz = softn->ipf_nat_table_sz;
1217                 nsp->ns_nattab_max = softn->ipf_nat_table_max;
1218                 nsp->ns_rultab_sz = softn->ipf_nat_maprules_sz;
1219                 nsp->ns_rdrtab_sz = softn->ipf_nat_rdrrules_sz;
1220                 nsp->ns_hostmap_sz = softn->ipf_nat_hostmap_sz;
1221                 nsp->ns_instances = softn->ipf_nat_instances;
1222                 nsp->ns_ticks = softc->ipf_ticks;
1223 #ifdef IPFILTER_LOGGING
1224                 nsp->ns_log_ok = ipf_log_logok(softc, IPF_LOGNAT);
1225                 nsp->ns_log_fail = ipf_log_failures(softc, IPF_LOGNAT);
1226 #else
1227                 nsp->ns_log_ok = 0;
1228                 nsp->ns_log_fail = 0;
1229 #endif
1230                 error = ipf_outobj(softc, data, nsp, IPFOBJ_NATSTAT);
1231                 break;
1232             }
1233
1234         case SIOCGNATL :
1235             {
1236                 natlookup_t nl;
1237
1238                 error = ipf_inobj(softc, data, NULL, &nl, IPFOBJ_NATLOOKUP);
1239                 if (error == 0) {
1240                         void *ptr;
1241
1242                         if (getlock) {
1243                                 READ_ENTER(&softc->ipf_nat);
1244                         }
1245
1246                         switch (nl.nl_v)
1247                         {
1248                         case 4 :
1249                                 ptr = ipf_nat_lookupredir(&nl);
1250                                 break;
1251 #ifdef USE_INET6
1252                         case 6 :
1253                                 ptr = ipf_nat6_lookupredir(&nl);
1254                                 break;
1255 #endif
1256                         default:
1257                                 ptr = NULL;
1258                                 break;
1259                         }
1260
1261                         if (getlock) {
1262                                 RWLOCK_EXIT(&softc->ipf_nat);
1263                         }
1264                         if (ptr != NULL) {
1265                                 error = ipf_outobj(softc, data, &nl,
1266                                                    IPFOBJ_NATLOOKUP);
1267                         } else {
1268                                 IPFERROR(60011);
1269                                 error = ESRCH;
1270                         }
1271                 }
1272                 break;
1273             }
1274
1275         case SIOCIPFFL :        /* old SIOCFLNAT & SIOCCNATL */
1276                 if (!(mode & FWRITE)) {
1277                         IPFERROR(60012);
1278                         error = EPERM;
1279                         break;
1280                 }
1281                 if (getlock) {
1282                         WRITE_ENTER(&softc->ipf_nat);
1283                 }
1284
1285                 error = BCOPYIN(data, &arg, sizeof(arg));
1286                 if (error != 0) {
1287                         IPFERROR(60013);
1288                         error = EFAULT;
1289                 } else {
1290                         if (arg == 0)
1291                                 ret = ipf_nat_flushtable(softc, softn);
1292                         else if (arg == 1)
1293                                 ret = ipf_nat_clearlist(softc, softn);
1294                         else
1295                                 ret = ipf_nat_extraflush(softc, softn, arg);
1296                         ipf_proxy_flush(softc->ipf_proxy_soft, arg);
1297                 }
1298
1299                 if (getlock) {
1300                         RWLOCK_EXIT(&softc->ipf_nat);
1301                 }
1302                 if (error == 0) {
1303                         error = BCOPYOUT(&ret, data, sizeof(ret));
1304                 }
1305                 break;
1306
1307         case SIOCMATCHFLUSH :
1308                 if (!(mode & FWRITE)) {
1309                         IPFERROR(60014);
1310                         error = EPERM;
1311                         break;
1312                 }
1313                 if (getlock) {
1314                         WRITE_ENTER(&softc->ipf_nat);
1315                 }
1316
1317                 error = ipf_nat_matchflush(softc, softn, data);
1318
1319                 if (getlock) {
1320                         RWLOCK_EXIT(&softc->ipf_nat);
1321                 }
1322                 break;
1323
1324         case SIOCPROXY :
1325                 error = ipf_proxy_ioctl(softc, data, cmd, mode, ctx);
1326                 break;
1327
1328         case SIOCSTLCK :
1329                 if (!(mode & FWRITE)) {
1330                         IPFERROR(60015);
1331                         error = EPERM;
1332                 } else {
1333                         error = ipf_lock(data, &softn->ipf_nat_lock);
1334                 }
1335                 break;
1336
1337         case SIOCSTPUT :
1338                 if ((mode & FWRITE) != 0) {
1339                         error = ipf_nat_putent(softc, data, getlock);
1340                 } else {
1341                         IPFERROR(60016);
1342                         error = EACCES;
1343                 }
1344                 break;
1345
1346         case SIOCSTGSZ :
1347                 if (softn->ipf_nat_lock) {
1348                         error = ipf_nat_getsz(softc, data, getlock);
1349                 } else {
1350                         IPFERROR(60017);
1351                         error = EACCES;
1352                 }
1353                 break;
1354
1355         case SIOCSTGET :
1356                 if (softn->ipf_nat_lock) {
1357                         error = ipf_nat_getent(softc, data, getlock);
1358                 } else {
1359                         IPFERROR(60018);
1360                         error = EACCES;
1361                 }
1362                 break;
1363
1364         case SIOCGENITER :
1365             {
1366                 ipfgeniter_t iter;
1367                 ipftoken_t *token;
1368                 ipfobj_t obj;
1369
1370                 error = ipf_inobj(softc, data, &obj, &iter, IPFOBJ_GENITER);
1371                 if (error != 0)
1372                         break;
1373
1374                 SPL_SCHED(s);
1375                 token = ipf_token_find(softc, iter.igi_type, uid, ctx);
1376                 if (token != NULL) {
1377                         error  = ipf_nat_iterator(softc, token, &iter, &obj);
1378                         WRITE_ENTER(&softc->ipf_tokens);
1379                         ipf_token_deref(softc, token);
1380                         RWLOCK_EXIT(&softc->ipf_tokens);
1381                 }
1382                 SPL_X(s);
1383                 break;
1384             }
1385
1386         case SIOCIPFDELTOK :
1387                 error = BCOPYIN(data, &arg, sizeof(arg));
1388                 if (error == 0) {
1389                         SPL_SCHED(s);
1390                         error = ipf_token_del(softc, arg, uid, ctx);
1391                         SPL_X(s);
1392                 } else {
1393                         IPFERROR(60019);
1394                         error = EFAULT;
1395                 }
1396                 break;
1397
1398         case SIOCGTQTAB :
1399                 error = ipf_outobj(softc, data, softn->ipf_nat_tcptq,
1400                                    IPFOBJ_STATETQTAB);
1401                 break;
1402
1403         case SIOCGTABL :
1404                 error = ipf_nat_gettable(softc, softn, data);
1405                 break;
1406
1407         default :
1408                 IPFERROR(60020);
1409                 error = EINVAL;
1410                 break;
1411         }
1412 done:
1413         if (nat != NULL)
1414                 ipf_nat_rule_fini(softc, nat);
1415         if (nt != NULL)
1416                 KFREES(nt, nt->in_size);
1417         return error;
1418 }
1419
1420
1421 /* ------------------------------------------------------------------------ */
1422 /* Function:    ipf_nat_siocaddnat                                          */
1423 /* Returns:     int - 0 == success, != 0 == failure                         */
1424 /* Parameters:  softc(I) - pointer to soft context main structure           */
1425 /*              softn(I) - pointer to NAT context structure                 */
1426 /*              n(I)       - pointer to new NAT rule                        */
1427 /*              np(I)      - pointer to where to insert new NAT rule        */
1428 /*              getlock(I) - flag indicating if lock on  is held            */
1429 /* Mutex Locks: ipf_nat_io                                                   */
1430 /*                                                                          */
1431 /* Handle SIOCADNAT.  Resolve and calculate details inside the NAT rule     */
1432 /* from information passed to the kernel, then add it  to the appropriate   */
1433 /* NAT rule table(s).                                                       */
1434 /* ------------------------------------------------------------------------ */
1435 static int
1436 ipf_nat_siocaddnat(softc, softn, n, getlock)
1437         ipf_main_softc_t *softc;
1438         ipf_nat_softc_t *softn;
1439         ipnat_t *n;
1440         int getlock;
1441 {
1442         int error = 0;
1443
1444         if (ipf_nat_resolverule(softc, n) != 0) {
1445                 IPFERROR(60022);
1446                 return ENOENT;
1447         }
1448
1449         if ((n->in_age[0] == 0) && (n->in_age[1] != 0)) {
1450                 IPFERROR(60023);
1451                 return EINVAL;
1452         }
1453
1454         if (n->in_redir == (NAT_DIVERTUDP|NAT_MAP)) {
1455                 /*
1456                  * Prerecord whether or not the destination of the divert
1457                  * is local or not to the interface the packet is going
1458                  * to be sent out.
1459                  */
1460                 n->in_dlocal = ipf_deliverlocal(softc, n->in_v[1],
1461                                                 n->in_ifps[1], &n->in_ndstip6);
1462         }
1463
1464         if (getlock) {
1465                 WRITE_ENTER(&softc->ipf_nat);
1466         }
1467         n->in_next = NULL;
1468         n->in_pnext = softn->ipf_nat_list_tail;
1469         *n->in_pnext = n;
1470         softn->ipf_nat_list_tail = &n->in_next;
1471         n->in_use++;
1472
1473         if (n->in_redir & NAT_REDIRECT) {
1474                 n->in_flags &= ~IPN_NOTDST;
1475                 switch (n->in_v[0])
1476                 {
1477                 case 4 :
1478                         ipf_nat_addrdr(softn, n);
1479                         break;
1480 #ifdef USE_INET6
1481                 case 6 :
1482                         ipf_nat6_addrdr(softn, n);
1483                         break;
1484 #endif
1485                 default :
1486                         break;
1487                 }
1488                 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules_rdr);
1489         }
1490
1491         if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
1492                 n->in_flags &= ~IPN_NOTSRC;
1493                 switch (n->in_v[0])
1494                 {
1495                 case 4 :
1496                         ipf_nat_addmap(softn, n);
1497                         break;
1498 #ifdef USE_INET6
1499                 case 6 :
1500                         ipf_nat6_addmap(softn, n);
1501                         break;
1502 #endif
1503                 default :
1504                         break;
1505                 }
1506                 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules_map);
1507         }
1508
1509         if (n->in_age[0] != 0)
1510                 n->in_tqehead[0] = ipf_addtimeoutqueue(softc,
1511                                                        &softn->ipf_nat_utqe,
1512                                                        n->in_age[0]);
1513
1514         if (n->in_age[1] != 0)
1515                 n->in_tqehead[1] = ipf_addtimeoutqueue(softc,
1516                                                        &softn->ipf_nat_utqe,
1517                                                        n->in_age[1]);
1518
1519         MUTEX_INIT(&n->in_lock, "ipnat rule lock");
1520
1521         n = NULL;
1522         ATOMIC_INC32(softn->ipf_nat_stats.ns_rules);
1523 #if SOLARIS && !defined(INSTANCES)
1524         pfil_delayed_copy = 0;
1525 #endif
1526         if (getlock) {
1527                 RWLOCK_EXIT(&softc->ipf_nat);                   /* WRITE */
1528         }
1529
1530         return error;
1531 }
1532
1533
1534 /* ------------------------------------------------------------------------ */
1535 /* Function:    ipf_nat_ruleaddrinit                                        */
1536 /* Parameters:  softc(I) - pointer to soft context main structure           */
1537 /*              softn(I) - pointer to NAT context structure                 */
1538 /*              n(I)     - pointer to NAT rule                              */
1539 /*                                                                          */
1540 /* Initialise all of the NAT address structures in a NAT rule.              */
1541 /* ------------------------------------------------------------------------ */
1542 static int
1543 ipf_nat_ruleaddrinit(softc, softn, n)
1544         ipf_main_softc_t *softc;
1545         ipf_nat_softc_t *softn;
1546         ipnat_t *n;
1547 {
1548         int idx, error;
1549
1550         if ((n->in_ndst.na_atype == FRI_LOOKUP) &&
1551             (n->in_ndst.na_type != IPLT_DSTLIST)) {
1552                 IPFERROR(60071);
1553                 return EINVAL;
1554         }
1555         if ((n->in_nsrc.na_atype == FRI_LOOKUP) &&
1556             (n->in_nsrc.na_type != IPLT_DSTLIST)) {
1557                 IPFERROR(60069);
1558                 return EINVAL;
1559         }
1560
1561         if (n->in_redir == NAT_BIMAP) {
1562                 n->in_ndstaddr = n->in_osrcaddr;
1563                 n->in_ndstmsk = n->in_osrcmsk;
1564                 n->in_odstaddr = n->in_nsrcaddr;
1565                 n->in_odstmsk = n->in_nsrcmsk;
1566
1567         }
1568
1569         if (n->in_redir & NAT_REDIRECT)
1570                 idx = 1;
1571         else
1572                 idx = 0;
1573         /*
1574          * Initialise all of the address fields.
1575          */
1576         error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_osrc, 1,
1577                                      n->in_ifps[idx]);
1578         if (error != 0)
1579                 return error;
1580
1581         error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_odst, 1,
1582                                      n->in_ifps[idx]);
1583         if (error != 0)
1584                 return error;
1585
1586         error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_nsrc, 1,
1587                                      n->in_ifps[idx]);
1588         if (error != 0)
1589                 return error;
1590
1591         error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_ndst, 1,
1592                                      n->in_ifps[idx]);
1593         if (error != 0)
1594                 return error;
1595
1596         if (n->in_redir & NAT_DIVERTUDP)
1597                 ipf_nat_builddivertmp(softn, n);
1598
1599         return 0;
1600 }
1601
1602
1603 /* ------------------------------------------------------------------------ */
1604 /* Function:    ipf_nat_resolvrule                                          */
1605 /* Returns:     Nil                                                         */
1606 /* Parameters:  softc(I) - pointer to soft context main structure           */
1607 /*              n(I)     - pointer to NAT rule                              */
1608 /*                                                                          */
1609 /* Handle SIOCADNAT.  Resolve and calculate details inside the NAT rule     */
1610 /* from information passed to the kernel, then add it  to the appropriate   */
1611 /* NAT rule table(s).                                                       */
1612 /* ------------------------------------------------------------------------ */
1613 static int
1614 ipf_nat_resolverule(softc, n)
1615         ipf_main_softc_t *softc;
1616         ipnat_t *n;
1617 {
1618         char *base;
1619
1620         base = n->in_names;
1621
1622         n->in_ifps[0] = ipf_resolvenic(softc, base + n->in_ifnames[0],
1623                                        n->in_v[0]);
1624
1625         if (n->in_ifnames[1] == -1) {
1626                 n->in_ifnames[1] = n->in_ifnames[0];
1627                 n->in_ifps[1] = n->in_ifps[0];
1628         } else {
1629                 n->in_ifps[1] = ipf_resolvenic(softc, base + n->in_ifnames[1],
1630                                                n->in_v[1]);
1631         }
1632
1633         if (n->in_plabel != -1) {
1634                 if (n->in_redir & NAT_REDIRECT)
1635                         n->in_apr = ipf_proxy_lookup(softc->ipf_proxy_soft,
1636                                                      n->in_pr[0],
1637                                                      base + n->in_plabel);
1638                 else
1639                         n->in_apr = ipf_proxy_lookup(softc->ipf_proxy_soft,
1640                                                      n->in_pr[1],
1641                                                      base + n->in_plabel);
1642                 if (n->in_apr == NULL)
1643                         return -1;
1644         }
1645         return 0;
1646 }
1647
1648
1649 /* ------------------------------------------------------------------------ */
1650 /* Function:    ipf_nat_siocdelnat                                          */
1651 /* Returns:     int - 0 == success, != 0 == failure                         */
1652 /* Parameters:  softc(I)   - pointer to soft context main structure         */
1653 /*              softn(I)   - pointer to NAT context structure               */
1654 /*              n(I)       - pointer to new NAT rule                        */
1655 /*              getlock(I) - flag indicating if lock on  is held            */
1656 /* Mutex Locks: ipf_nat_io                                                  */
1657 /*                                                                          */
1658 /* Handle SIOCADNAT.  Resolve and calculate details inside the NAT rule     */
1659 /* from information passed to the kernel, then add it  to the appropriate   */
1660 /* NAT rule table(s).                                                       */
1661 /* ------------------------------------------------------------------------ */
1662 static void
1663 ipf_nat_siocdelnat(softc, softn, n, getlock)
1664         ipf_main_softc_t *softc;
1665         ipf_nat_softc_t *softn;
1666         ipnat_t *n;
1667         int getlock;
1668 {
1669         if (getlock) {
1670                 WRITE_ENTER(&softc->ipf_nat);
1671         }
1672
1673         ipf_nat_delrule(softc, softn, n, 1);
1674
1675         if (getlock) {
1676                 RWLOCK_EXIT(&softc->ipf_nat);                   /* READ/WRITE */
1677         }
1678 }
1679
1680
1681 /* ------------------------------------------------------------------------ */
1682 /* Function:    ipf_nat_getsz                                               */
1683 /* Returns:     int - 0 == success, != 0 is the error value.                */
1684 /* Parameters:  softc(I)   - pointer to soft context main structure         */
1685 /*              data(I)    - pointer to natget structure with kernel        */
1686 /*                           pointer get the size of.                       */
1687 /*              getlock(I) - flag indicating whether or not the caller      */
1688 /*                           holds a lock on ipf_nat                        */
1689 /*                                                                          */
1690 /* Handle SIOCSTGSZ.                                                        */
1691 /* Return the size of the nat list entry to be copied back to user space.   */
1692 /* The size of the entry is stored in the ng_sz field and the enture natget */
1693 /* structure is copied back to the user.                                    */
1694 /* ------------------------------------------------------------------------ */
1695 static int
1696 ipf_nat_getsz(softc, data, getlock)
1697         ipf_main_softc_t *softc;
1698         caddr_t data;
1699         int getlock;
1700 {
1701         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1702         ap_session_t *aps;
1703         nat_t *nat, *n;
1704         natget_t ng;
1705         int error;
1706
1707         error = BCOPYIN(data, &ng, sizeof(ng));
1708         if (error != 0) {
1709                 IPFERROR(60024);
1710                 return EFAULT;
1711         }
1712
1713         if (getlock) {
1714                 READ_ENTER(&softc->ipf_nat);
1715         }
1716
1717         nat = ng.ng_ptr;
1718         if (!nat) {
1719                 nat = softn->ipf_nat_instances;
1720                 ng.ng_sz = 0;
1721                 /*
1722                  * Empty list so the size returned is 0.  Simple.
1723                  */
1724                 if (nat == NULL) {
1725                         if (getlock) {
1726                                 RWLOCK_EXIT(&softc->ipf_nat);
1727                         }
1728                         error = BCOPYOUT(&ng, data, sizeof(ng));
1729                         if (error != 0) {
1730                                 IPFERROR(60025);
1731                                 return EFAULT;
1732                         }
1733                         return 0;
1734                 }
1735         } else {
1736                 /*
1737                  * Make sure the pointer we're copying from exists in the
1738                  * current list of entries.  Security precaution to prevent
1739                  * copying of random kernel data.
1740                  */
1741                 for (n = softn->ipf_nat_instances; n; n = n->nat_next)
1742                         if (n == nat)
1743                                 break;
1744                 if (n == NULL) {
1745                         if (getlock) {
1746                                 RWLOCK_EXIT(&softc->ipf_nat);
1747                         }
1748                         IPFERROR(60026);
1749                         return ESRCH;
1750                 }
1751         }
1752
1753         /*
1754          * Incluse any space required for proxy data structures.
1755          */
1756         ng.ng_sz = sizeof(nat_save_t);
1757         aps = nat->nat_aps;
1758         if (aps != NULL) {
1759                 ng.ng_sz += sizeof(ap_session_t) - 4;
1760                 if (aps->aps_data != 0)
1761                         ng.ng_sz += aps->aps_psiz;
1762         }
1763         if (getlock) {
1764                 RWLOCK_EXIT(&softc->ipf_nat);
1765         }
1766
1767         error = BCOPYOUT(&ng, data, sizeof(ng));
1768         if (error != 0) {
1769                 IPFERROR(60027);
1770                 return EFAULT;
1771         }
1772         return 0;
1773 }
1774
1775
1776 /* ------------------------------------------------------------------------ */
1777 /* Function:    ipf_nat_getent                                              */
1778 /* Returns:     int - 0 == success, != 0 is the error value.                */
1779 /* Parameters:  softc(I)   - pointer to soft context main structure         */
1780 /*              data(I)    - pointer to natget structure with kernel pointer*/
1781 /*                           to NAT structure to copy out.                  */
1782 /*              getlock(I) - flag indicating whether or not the caller      */
1783 /*                           holds a lock on ipf_nat                        */
1784 /*                                                                          */
1785 /* Handle SIOCSTGET.                                                        */
1786 /* Copies out NAT entry to user space.  Any additional data held for a      */
1787 /* proxy is also copied, as to is the NAT rule which was responsible for it */
1788 /* ------------------------------------------------------------------------ */
1789 static int
1790 ipf_nat_getent(softc, data, getlock)
1791         ipf_main_softc_t *softc;
1792         caddr_t data;
1793         int getlock;
1794 {
1795         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1796         int error, outsize;
1797         ap_session_t *aps;
1798         nat_save_t *ipn, ipns;
1799         nat_t *n, *nat;
1800
1801         error = ipf_inobj(softc, data, NULL, &ipns, IPFOBJ_NATSAVE);
1802         if (error != 0)
1803                 return error;
1804
1805         if ((ipns.ipn_dsize < sizeof(ipns)) || (ipns.ipn_dsize > 81920)) {
1806                 IPFERROR(60028);
1807                 return EINVAL;
1808         }
1809
1810         KMALLOCS(ipn, nat_save_t *, ipns.ipn_dsize);
1811         if (ipn == NULL) {
1812                 IPFERROR(60029);
1813                 return ENOMEM;
1814         }
1815
1816         if (getlock) {
1817                 READ_ENTER(&softc->ipf_nat);
1818         }
1819
1820         ipn->ipn_dsize = ipns.ipn_dsize;
1821         nat = ipns.ipn_next;
1822         if (nat == NULL) {
1823                 nat = softn->ipf_nat_instances;
1824                 if (nat == NULL) {
1825                         if (softn->ipf_nat_instances == NULL) {
1826                                 IPFERROR(60030);
1827                                 error = ENOENT;
1828                         }
1829                         goto finished;
1830                 }
1831         } else {
1832                 /*
1833                  * Make sure the pointer we're copying from exists in the
1834                  * current list of entries.  Security precaution to prevent
1835                  * copying of random kernel data.
1836                  */
1837                 for (n = softn->ipf_nat_instances; n; n = n->nat_next)
1838                         if (n == nat)
1839                                 break;
1840                 if (n == NULL) {
1841                         IPFERROR(60031);
1842                         error = ESRCH;
1843                         goto finished;
1844                 }
1845         }
1846         ipn->ipn_next = nat->nat_next;
1847
1848         /*
1849          * Copy the NAT structure.
1850          */
1851         bcopy((char *)nat, &ipn->ipn_nat, sizeof(*nat));
1852
1853         /*
1854          * If we have a pointer to the NAT rule it belongs to, save that too.
1855          */
1856         if (nat->nat_ptr != NULL)
1857                 bcopy((char *)nat->nat_ptr, (char *)&ipn->ipn_ipnat,
1858                       sizeof(nat->nat_ptr));
1859
1860         /*
1861          * If we also know the NAT entry has an associated filter rule,
1862          * save that too.
1863          */
1864         if (nat->nat_fr != NULL)
1865                 bcopy((char *)nat->nat_fr, (char *)&ipn->ipn_fr,
1866                       sizeof(ipn->ipn_fr));
1867
1868         /*
1869          * Last but not least, if there is an application proxy session set
1870          * up for this NAT entry, then copy that out too, including any
1871          * private data saved along side it by the proxy.
1872          */
1873         aps = nat->nat_aps;
1874         outsize = ipn->ipn_dsize - sizeof(*ipn) + sizeof(ipn->ipn_data);
1875         if (aps != NULL) {
1876                 char *s;
1877
1878                 if (outsize < sizeof(*aps)) {
1879                         IPFERROR(60032);
1880                         error = ENOBUFS;
1881                         goto finished;
1882                 }
1883
1884                 s = ipn->ipn_data;
1885                 bcopy((char *)aps, s, sizeof(*aps));
1886                 s += sizeof(*aps);
1887                 outsize -= sizeof(*aps);
1888                 if ((aps->aps_data != NULL) && (outsize >= aps->aps_psiz))
1889                         bcopy(aps->aps_data, s, aps->aps_psiz);
1890                 else {
1891                         IPFERROR(60033);
1892                         error = ENOBUFS;
1893                 }
1894         }
1895         if (error == 0) {
1896                 error = ipf_outobjsz(softc, data, ipn, IPFOBJ_NATSAVE,
1897                                      ipns.ipn_dsize);
1898         }
1899
1900 finished:
1901         if (ipn != NULL) {
1902                 KFREES(ipn, ipns.ipn_dsize);
1903         }
1904         if (getlock) {
1905                 RWLOCK_EXIT(&softc->ipf_nat);
1906         }
1907         return error;
1908 }
1909
1910
1911 /* ------------------------------------------------------------------------ */
1912 /* Function:    ipf_nat_putent                                              */
1913 /* Returns:     int - 0 == success, != 0 is the error value.                */
1914 /* Parameters:  softc(I)   - pointer to soft context main structure         */
1915 /*              data(I)    - pointer to natget structure with NAT           */
1916 /*                           structure information to load into the kernel  */
1917 /*              getlock(I) - flag indicating whether or not a write lock    */
1918 /*                           on is already held.                            */
1919 /*                                                                          */
1920 /* Handle SIOCSTPUT.                                                        */
1921 /* Loads a NAT table entry from user space, including a NAT rule, proxy and */
1922 /* firewall rule data structures, if pointers to them indicate so.          */
1923 /* ------------------------------------------------------------------------ */
1924 static int
1925 ipf_nat_putent(softc, data, getlock)
1926         ipf_main_softc_t *softc;
1927         caddr_t data;
1928         int getlock;
1929 {
1930         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1931         nat_save_t ipn, *ipnn;
1932         ap_session_t *aps;
1933         nat_t *n, *nat;
1934         frentry_t *fr;
1935         fr_info_t fin;
1936         ipnat_t *in;
1937         int error;
1938
1939         error = ipf_inobj(softc, data, NULL, &ipn, IPFOBJ_NATSAVE);
1940         if (error != 0)
1941                 return error;
1942
1943         /*
1944          * Initialise early because of code at junkput label.
1945          */
1946         n = NULL;
1947         in = NULL;
1948         aps = NULL;
1949         nat = NULL;
1950         ipnn = NULL;
1951         fr = NULL;
1952
1953         /*
1954          * New entry, copy in the rest of the NAT entry if it's size is more
1955          * than just the nat_t structure.
1956          */
1957         if (ipn.ipn_dsize > sizeof(ipn)) {
1958                 if (ipn.ipn_dsize > 81920) {
1959                         IPFERROR(60034);
1960                         error = ENOMEM;
1961                         goto junkput;
1962                 }
1963
1964                 KMALLOCS(ipnn, nat_save_t *, ipn.ipn_dsize);
1965                 if (ipnn == NULL) {
1966                         IPFERROR(60035);
1967                         return ENOMEM;
1968                 }
1969
1970                 bzero(ipnn, ipn.ipn_dsize);
1971                 error = ipf_inobjsz(softc, data, ipnn, IPFOBJ_NATSAVE,
1972                                     ipn.ipn_dsize);
1973                 if (error != 0) {
1974                         goto junkput;
1975                 }
1976         } else
1977                 ipnn = &ipn;
1978
1979         KMALLOC(nat, nat_t *);
1980         if (nat == NULL) {
1981                 IPFERROR(60037);
1982                 error = ENOMEM;
1983                 goto junkput;
1984         }
1985
1986         bcopy((char *)&ipnn->ipn_nat, (char *)nat, sizeof(*nat));
1987
1988         switch (nat->nat_v[0])
1989         {
1990         case 4:
1991 #ifdef USE_INET6
1992         case 6 :
1993 #endif
1994                 break;
1995         default :
1996                 IPFERROR(60061);
1997                 error = EPROTONOSUPPORT;
1998                 goto junkput;
1999                 /*NOTREACHED*/
2000         }
2001
2002         /*
2003          * Initialize all these so that ipf_nat_delete() doesn't cause a crash.
2004          */
2005         bzero((char *)nat, offsetof(struct nat, nat_tqe));
2006         nat->nat_tqe.tqe_pnext = NULL;
2007         nat->nat_tqe.tqe_next = NULL;
2008         nat->nat_tqe.tqe_ifq = NULL;
2009         nat->nat_tqe.tqe_parent = nat;
2010
2011         /*
2012          * Restore the rule associated with this nat session
2013          */
2014         in = ipnn->ipn_nat.nat_ptr;
2015         if (in != NULL) {
2016                 KMALLOCS(in, ipnat_t *, ipnn->ipn_ipnat.in_size);
2017                 nat->nat_ptr = in;
2018                 if (in == NULL) {
2019                         IPFERROR(60038);
2020                         error = ENOMEM;
2021                         goto junkput;
2022                 }
2023                 bcopy((char *)&ipnn->ipn_ipnat, (char *)in,
2024                       ipnn->ipn_ipnat.in_size);
2025                 in->in_use = 1;
2026                 in->in_flags |= IPN_DELETE;
2027
2028                 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules);
2029
2030                 if (ipf_nat_resolverule(softc, in) != 0) {
2031                         IPFERROR(60039);
2032                         error = ESRCH;
2033                         goto junkput;
2034                 }
2035         }
2036
2037         /*
2038          * Check that the NAT entry doesn't already exist in the kernel.
2039          *
2040          * For NAT_OUTBOUND, we're lookup for a duplicate MAP entry.  To do
2041          * this, we check to see if the inbound combination of addresses and
2042          * ports is already known.  Similar logic is applied for NAT_INBOUND.
2043          *
2044          */
2045         bzero((char *)&fin, sizeof(fin));
2046         fin.fin_v = nat->nat_v[0];
2047         fin.fin_p = nat->nat_pr[0];
2048         fin.fin_rev = nat->nat_rev;
2049         fin.fin_ifp = nat->nat_ifps[0];
2050         fin.fin_data[0] = ntohs(nat->nat_ndport);
2051         fin.fin_data[1] = ntohs(nat->nat_nsport);
2052
2053         switch (nat->nat_dir)
2054         {
2055         case NAT_OUTBOUND :
2056         case NAT_DIVERTOUT :
2057                 if (getlock) {
2058                         READ_ENTER(&softc->ipf_nat);
2059                 }
2060
2061                 fin.fin_v = nat->nat_v[1];
2062                 if (nat->nat_v[1] == 4) {
2063                         n = ipf_nat_inlookup(&fin, nat->nat_flags, fin.fin_p,
2064                                              nat->nat_ndstip, nat->nat_nsrcip);
2065 #ifdef USE_INET6
2066                 } else if (nat->nat_v[1] == 6) {
2067                         n = ipf_nat6_inlookup(&fin, nat->nat_flags, fin.fin_p,
2068                                               &nat->nat_ndst6.in6,
2069                                               &nat->nat_nsrc6.in6);
2070 #endif
2071                 }
2072
2073                 if (getlock) {
2074                         RWLOCK_EXIT(&softc->ipf_nat);
2075                 }
2076                 if (n != NULL) {
2077                         IPFERROR(60040);
2078                         error = EEXIST;
2079                         goto junkput;
2080                 }
2081                 break;
2082
2083         case NAT_INBOUND :
2084         case NAT_DIVERTIN :
2085                 if (getlock) {
2086                         READ_ENTER(&softc->ipf_nat);
2087                 }
2088
2089                 if (fin.fin_v == 4) {
2090                         n = ipf_nat_outlookup(&fin, nat->nat_flags, fin.fin_p,
2091                                               nat->nat_ndstip,
2092                                               nat->nat_nsrcip);
2093 #ifdef USE_INET6
2094                 } else if (fin.fin_v == 6) {
2095                         n = ipf_nat6_outlookup(&fin, nat->nat_flags, fin.fin_p,
2096                                                &nat->nat_ndst6.in6,
2097                                                &nat->nat_nsrc6.in6);
2098 #endif
2099                 }
2100
2101                 if (getlock) {
2102                         RWLOCK_EXIT(&softc->ipf_nat);
2103                 }
2104                 if (n != NULL) {
2105                         IPFERROR(60041);
2106                         error = EEXIST;
2107                         goto junkput;
2108                 }
2109                 break;
2110
2111         default :
2112                 IPFERROR(60042);
2113                 error = EINVAL;
2114                 goto junkput;
2115         }
2116
2117         /*
2118          * Restore ap_session_t structure.  Include the private data allocated
2119          * if it was there.
2120          */
2121         aps = nat->nat_aps;
2122         if (aps != NULL) {
2123                 KMALLOC(aps, ap_session_t *);
2124                 nat->nat_aps = aps;
2125                 if (aps == NULL) {
2126                         IPFERROR(60043);
2127                         error = ENOMEM;
2128                         goto junkput;
2129                 }
2130                 bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps));
2131                 if (in != NULL)
2132                         aps->aps_apr = in->in_apr;
2133                 else
2134                         aps->aps_apr = NULL;
2135                 if (aps->aps_psiz != 0) {
2136                         if (aps->aps_psiz > 81920) {
2137                                 IPFERROR(60044);
2138                                 error = ENOMEM;
2139                                 goto junkput;
2140                         }
2141                         KMALLOCS(aps->aps_data, void *, aps->aps_psiz);
2142                         if (aps->aps_data == NULL) {
2143                                 IPFERROR(60045);
2144                                 error = ENOMEM;
2145                                 goto junkput;
2146                         }
2147                         bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data,
2148                               aps->aps_psiz);
2149                 } else {
2150                         aps->aps_psiz = 0;
2151                         aps->aps_data = NULL;
2152                 }
2153         }
2154
2155         /*
2156          * If there was a filtering rule associated with this entry then
2157          * build up a new one.
2158          */
2159         fr = nat->nat_fr;
2160         if (fr != NULL) {
2161                 if ((nat->nat_flags & SI_NEWFR) != 0) {
2162                         KMALLOC(fr, frentry_t *);
2163                         nat->nat_fr = fr;
2164                         if (fr == NULL) {
2165                                 IPFERROR(60046);
2166                                 error = ENOMEM;
2167                                 goto junkput;
2168                         }
2169                         ipnn->ipn_nat.nat_fr = fr;
2170                         fr->fr_ref = 1;
2171                         (void) ipf_outobj(softc, data, ipnn, IPFOBJ_NATSAVE);
2172                         bcopy((char *)&ipnn->ipn_fr, (char *)fr, sizeof(*fr));
2173
2174                         fr->fr_ref = 1;
2175                         fr->fr_dsize = 0;
2176                         fr->fr_data = NULL;
2177                         fr->fr_type = FR_T_NONE;
2178
2179                         MUTEX_NUKE(&fr->fr_lock);
2180                         MUTEX_INIT(&fr->fr_lock, "nat-filter rule lock");
2181                 } else {
2182                         if (getlock) {
2183                                 READ_ENTER(&softc->ipf_nat);
2184                         }
2185                         for (n = softn->ipf_nat_instances; n; n = n->nat_next)
2186                                 if (n->nat_fr == fr)
2187                                         break;
2188
2189                         if (n != NULL) {
2190                                 MUTEX_ENTER(&fr->fr_lock);
2191                                 fr->fr_ref++;
2192                                 MUTEX_EXIT(&fr->fr_lock);
2193                         }
2194                         if (getlock) {
2195                                 RWLOCK_EXIT(&softc->ipf_nat);
2196                         }
2197
2198                         if (n == NULL) {
2199                                 IPFERROR(60047);
2200                                 error = ESRCH;
2201                                 goto junkput;
2202                         }
2203                 }
2204         }
2205
2206         if (ipnn != &ipn) {
2207                 KFREES(ipnn, ipn.ipn_dsize);
2208                 ipnn = NULL;
2209         }
2210
2211         if (getlock) {
2212                 WRITE_ENTER(&softc->ipf_nat);
2213         }
2214
2215         if (fin.fin_v == 4)
2216                 error = ipf_nat_finalise(&fin, nat);
2217 #ifdef USE_INET6
2218         else
2219                 error = ipf_nat6_finalise(&fin, nat);
2220 #endif
2221
2222         if (getlock) {
2223                 RWLOCK_EXIT(&softc->ipf_nat);
2224         }
2225
2226         if (error == 0)
2227                 return 0;
2228
2229         IPFERROR(60048);
2230         error = ENOMEM;
2231
2232 junkput:
2233         if (fr != NULL) {
2234                 (void) ipf_derefrule(softc, &fr);
2235         }
2236
2237         if ((ipnn != NULL) && (ipnn != &ipn)) {
2238                 KFREES(ipnn, ipn.ipn_dsize);
2239         }
2240         if (nat != NULL) {
2241                 if (aps != NULL) {
2242                         if (aps->aps_data != NULL) {
2243                                 KFREES(aps->aps_data, aps->aps_psiz);
2244                         }
2245                         KFREE(aps);
2246                 }
2247                 if (in != NULL) {
2248                         if (in->in_apr)
2249                                 ipf_proxy_deref(in->in_apr);
2250                         KFREES(in, in->in_size);
2251                 }
2252                 KFREE(nat);
2253         }
2254         return error;
2255 }
2256
2257
2258 /* ------------------------------------------------------------------------ */
2259 /* Function:    ipf_nat_delete                                              */
2260 /* Returns:     Nil                                                         */
2261 /* Parameters:  softc(I)   - pointer to soft context main structure         */
2262 /*              nat(I)     - pointer to NAT structure to delete             */
2263 /*              logtype(I) - type of LOG record to create before deleting   */
2264 /* Write Lock:  ipf_nat                                                     */
2265 /*                                                                          */
2266 /* Delete a nat entry from the various lists and table.  If NAT logging is  */
2267 /* enabled then generate a NAT log record for this event.                   */
2268 /* ------------------------------------------------------------------------ */
2269 void
2270 ipf_nat_delete(softc, nat, logtype)
2271         ipf_main_softc_t *softc;
2272         struct nat *nat;
2273         int logtype;
2274 {
2275         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2276         int madeorphan = 0, bkt, removed = 0;
2277         nat_stat_side_t *nss;
2278         struct ipnat *ipn;
2279
2280         if (logtype != 0 && softn->ipf_nat_logging != 0)
2281                 ipf_nat_log(softc, softn, nat, logtype);
2282
2283         /*
2284          * Take it as a general indication that all the pointers are set if
2285          * nat_pnext is set.
2286          */
2287         if (nat->nat_pnext != NULL) {
2288                 removed = 1;
2289
2290                 bkt = nat->nat_hv[0] % softn->ipf_nat_table_sz;
2291                 nss = &softn->ipf_nat_stats.ns_side[0];
2292                 if (nss->ns_bucketlen[bkt] > 0)
2293                         nss->ns_bucketlen[bkt]--;
2294                 if (nss->ns_bucketlen[bkt] == 0) {
2295                         nss->ns_inuse--;
2296                 }
2297
2298                 bkt = nat->nat_hv[1] % softn->ipf_nat_table_sz;
2299                 nss = &softn->ipf_nat_stats.ns_side[1];
2300                 if (nss->ns_bucketlen[bkt] > 0)
2301                         nss->ns_bucketlen[bkt]--;
2302                 if (nss->ns_bucketlen[bkt] == 0) {
2303                         nss->ns_inuse--;
2304                 }
2305
2306                 *nat->nat_pnext = nat->nat_next;
2307                 if (nat->nat_next != NULL) {
2308                         nat->nat_next->nat_pnext = nat->nat_pnext;
2309                         nat->nat_next = NULL;
2310                 }
2311                 nat->nat_pnext = NULL;
2312
2313                 *nat->nat_phnext[0] = nat->nat_hnext[0];
2314                 if (nat->nat_hnext[0] != NULL) {
2315                         nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
2316                         nat->nat_hnext[0] = NULL;
2317                 }
2318                 nat->nat_phnext[0] = NULL;
2319
2320                 *nat->nat_phnext[1] = nat->nat_hnext[1];
2321                 if (nat->nat_hnext[1] != NULL) {
2322                         nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
2323                         nat->nat_hnext[1] = NULL;
2324                 }
2325                 nat->nat_phnext[1] = NULL;
2326
2327                 if ((nat->nat_flags & SI_WILDP) != 0) {
2328                         ATOMIC_DEC32(softn->ipf_nat_stats.ns_wilds);
2329                 }
2330                 madeorphan = 1;
2331         }
2332
2333         if (nat->nat_me != NULL) {
2334                 *nat->nat_me = NULL;
2335                 nat->nat_me = NULL;
2336                 nat->nat_ref--;
2337                 ASSERT(nat->nat_ref >= 0);
2338         }
2339
2340         if (nat->nat_tqe.tqe_ifq != NULL) {
2341                 /*
2342                  * No call to ipf_freetimeoutqueue() is made here, they are
2343                  * garbage collected in ipf_nat_expire().
2344                  */
2345                 (void) ipf_deletequeueentry(&nat->nat_tqe);
2346         }
2347
2348         if (nat->nat_sync) {
2349                 ipf_sync_del_nat(softc->ipf_sync_soft, nat->nat_sync);
2350                 nat->nat_sync = NULL;
2351         }
2352
2353         if (logtype == NL_EXPIRE)
2354                 softn->ipf_nat_stats.ns_expire++;
2355
2356         MUTEX_ENTER(&nat->nat_lock);
2357         /*
2358          * NL_DESTROY should only be passed in when we've got nat_ref >= 2.
2359          * This happens when a nat'd packet is blocked and we want to throw
2360          * away the NAT session.
2361          */
2362         if (logtype == NL_DESTROY) {
2363                 if (nat->nat_ref > 2) {
2364                         nat->nat_ref -= 2;
2365                         MUTEX_EXIT(&nat->nat_lock);
2366                         if (removed)
2367                                 softn->ipf_nat_stats.ns_orphans++;
2368                         return;
2369                 }
2370         } else if (nat->nat_ref > 1) {
2371                 nat->nat_ref--;
2372                 MUTEX_EXIT(&nat->nat_lock);
2373                 if (madeorphan == 1)
2374                         softn->ipf_nat_stats.ns_orphans++;
2375                 return;
2376         }
2377         ASSERT(nat->nat_ref >= 0);
2378         MUTEX_EXIT(&nat->nat_lock);
2379
2380         nat->nat_ref = 0;
2381
2382         if (madeorphan == 0)
2383                 softn->ipf_nat_stats.ns_orphans--;
2384
2385         /*
2386          * At this point, nat_ref can be either 0 or -1
2387          */
2388         softn->ipf_nat_stats.ns_proto[nat->nat_pr[0]]--;
2389
2390         if (nat->nat_fr != NULL) {
2391                 (void) ipf_derefrule(softc, &nat->nat_fr);
2392         }
2393
2394         if (nat->nat_hm != NULL) {
2395                 ipf_nat_hostmapdel(softc, &nat->nat_hm);
2396         }
2397
2398         /*
2399          * If there is an active reference from the nat entry to its parent
2400          * rule, decrement the rule's reference count and free it too if no
2401          * longer being used.
2402          */
2403         ipn = nat->nat_ptr;
2404         nat->nat_ptr = NULL;
2405
2406         if (ipn != NULL) {
2407                 ipn->in_space++;
2408                 ipf_nat_rule_deref(softc, &ipn);
2409         }
2410
2411         if (nat->nat_aps != NULL) {
2412                 ipf_proxy_free(softc, nat->nat_aps);
2413                 nat->nat_aps = NULL;
2414         }
2415
2416         MUTEX_DESTROY(&nat->nat_lock);
2417
2418         softn->ipf_nat_stats.ns_active--;
2419
2420         /*
2421          * If there's a fragment table entry too for this nat entry, then
2422          * dereference that as well.  This is after nat_lock is released
2423          * because of Tru64.
2424          */
2425         ipf_frag_natforget(softc, (void *)nat);
2426
2427         KFREE(nat);
2428 }
2429
2430
2431 /* ------------------------------------------------------------------------ */
2432 /* Function:    ipf_nat_flushtable                                          */
2433 /* Returns:     int - number of NAT rules deleted                           */
2434 /* Parameters:  softc(I) - pointer to soft context main structure           */
2435 /*              softn(I) - pointer to NAT context structure                 */
2436 /* Write Lock:  ipf_nat                                                     */
2437 /*                                                                          */
2438 /* Deletes all currently active NAT sessions.  In deleting each NAT entry a */
2439 /* log record should be emitted in ipf_nat_delete() if NAT logging is       */
2440 /* enabled.                                                                 */
2441 /* ------------------------------------------------------------------------ */
2442 /*
2443  * nat_flushtable - clear the NAT table of all mapping entries.
2444  */
2445 static int
2446 ipf_nat_flushtable(softc, softn)
2447         ipf_main_softc_t *softc;
2448         ipf_nat_softc_t *softn;
2449 {
2450         nat_t *nat;
2451         int j = 0;
2452
2453         /*
2454          * ALL NAT mappings deleted, so lets just make the deletions
2455          * quicker.
2456          */
2457         if (softn->ipf_nat_table[0] != NULL)
2458                 bzero((char *)softn->ipf_nat_table[0],
2459                       sizeof(softn->ipf_nat_table[0]) *
2460                       softn->ipf_nat_table_sz);
2461         if (softn->ipf_nat_table[1] != NULL)
2462                 bzero((char *)softn->ipf_nat_table[1],
2463                       sizeof(softn->ipf_nat_table[1]) *
2464                       softn->ipf_nat_table_sz);
2465
2466         while ((nat = softn->ipf_nat_instances) != NULL) {
2467                 ipf_nat_delete(softc, nat, NL_FLUSH);
2468                 j++;
2469         }
2470
2471         return j;
2472 }
2473
2474
2475 /* ------------------------------------------------------------------------ */
2476 /* Function:    ipf_nat_clearlist                                           */
2477 /* Returns:     int - number of NAT/RDR rules deleted                       */
2478 /* Parameters:  softc(I) - pointer to soft context main structure           */
2479 /*              softn(I) - pointer to NAT context structure                 */
2480 /*                                                                          */
2481 /* Delete all rules in the current list of rules.  There is nothing elegant */
2482 /* about this cleanup: simply free all entries on the list of rules and     */
2483 /* clear out the tables used for hashed NAT rule lookups.                   */
2484 /* ------------------------------------------------------------------------ */
2485 static int
2486 ipf_nat_clearlist(softc, softn)
2487         ipf_main_softc_t *softc;
2488         ipf_nat_softc_t *softn;
2489 {
2490         ipnat_t *n;
2491         int i = 0;
2492
2493         if (softn->ipf_nat_map_rules != NULL) {
2494                 bzero((char *)softn->ipf_nat_map_rules,
2495                       sizeof(*softn->ipf_nat_map_rules) *
2496                       softn->ipf_nat_maprules_sz);
2497         }
2498         if (softn->ipf_nat_rdr_rules != NULL) {
2499                 bzero((char *)softn->ipf_nat_rdr_rules,
2500                       sizeof(*softn->ipf_nat_rdr_rules) *
2501                       softn->ipf_nat_rdrrules_sz);
2502         }
2503
2504         while ((n = softn->ipf_nat_list) != NULL) {
2505                 ipf_nat_delrule(softc, softn, n, 0);
2506                 i++;
2507         }
2508 #if SOLARIS && !defined(INSTANCES)
2509         pfil_delayed_copy = 1;
2510 #endif
2511         return i;
2512 }
2513
2514
2515 /* ------------------------------------------------------------------------ */
2516 /* Function:    ipf_nat_delrule                                             */
2517 /* Returns:     Nil                                                         */
2518 /* Parameters:  softc(I) - pointer to soft context main structure           */
2519 /*              softn(I) - pointer to NAT context structure                 */
2520 /*              np(I)    - pointer to NAT rule to delete                    */
2521 /*              purge(I) - 1 == allow purge, 0 == prevent purge             */
2522 /* Locks:       WRITE(ipf_nat)                                              */
2523 /*                                                                          */
2524 /* Preventing "purge" from occuring is allowed because when all of the NAT  */
2525 /* rules are being removed, allowing the "purge" to walk through the list   */
2526 /* of NAT sessions, possibly multiple times, would be a large performance   */
2527 /* hit, on the order of O(N^2).                                             */
2528 /* ------------------------------------------------------------------------ */
2529 static void
2530 ipf_nat_delrule(softc, softn, np, purge)
2531         ipf_main_softc_t *softc;
2532         ipf_nat_softc_t *softn;
2533         ipnat_t *np;
2534         int purge;
2535 {
2536
2537         if (np->in_pnext != NULL) {
2538                 *np->in_pnext = np->in_next;
2539                 if (np->in_next != NULL)
2540                         np->in_next->in_pnext = np->in_pnext;
2541                 if (softn->ipf_nat_list_tail == &np->in_next)
2542                         softn->ipf_nat_list_tail = np->in_pnext;
2543         }
2544
2545         if ((purge == 1) && ((np->in_flags & IPN_PURGE) != 0)) {
2546                 nat_t *next;
2547                 nat_t *nat;
2548
2549                 for (next = softn->ipf_nat_instances; (nat = next) != NULL;) {
2550                         next = nat->nat_next;
2551                         if (nat->nat_ptr == np)
2552                                 ipf_nat_delete(softc, nat, NL_PURGE);
2553                 }
2554         }
2555
2556         if ((np->in_flags & IPN_DELETE) == 0) {
2557                 if (np->in_redir & NAT_REDIRECT) {
2558                         switch (np->in_v[0])
2559                         {
2560                         case 4 :
2561                                 ipf_nat_delrdr(softn, np);
2562                                 break;
2563 #ifdef USE_INET6
2564                         case 6 :
2565                                 ipf_nat6_delrdr(softn, np);
2566                                 break;
2567 #endif
2568                         }
2569                 }
2570                 if (np->in_redir & (NAT_MAPBLK|NAT_MAP)) {
2571                         switch (np->in_v[0])
2572                         {
2573                         case 4 :
2574                                 ipf_nat_delmap(softn, np);
2575                                 break;
2576 #ifdef USE_INET6
2577                         case 6 :
2578                                 ipf_nat6_delmap(softn, np);
2579                                 break;
2580 #endif
2581                         }
2582                 }
2583         }
2584
2585         np->in_flags |= IPN_DELETE;
2586         ipf_nat_rule_deref(softc, &np);
2587 }
2588
2589
2590 /* ------------------------------------------------------------------------ */
2591 /* Function:    ipf_nat_newmap                                              */
2592 /* Returns:     int - -1 == error, 0 == success                             */
2593 /* Parameters:  fin(I) - pointer to packet information                      */
2594 /*              nat(I) - pointer to NAT entry                               */
2595 /*              ni(I)  - pointer to structure with misc. information needed */
2596 /*                       to create new NAT entry.                           */
2597 /*                                                                          */
2598 /* Given an empty NAT structure, populate it with new information about a   */
2599 /* new NAT session, as defined by the matching NAT rule.                    */
2600 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
2601 /* to the new IP address for the translation.                               */
2602 /* ------------------------------------------------------------------------ */
2603 static int
2604 ipf_nat_newmap(fin, nat, ni)
2605         fr_info_t *fin;
2606         nat_t *nat;
2607         natinfo_t *ni;
2608 {
2609         ipf_main_softc_t *softc = fin->fin_main_soft;
2610         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2611         u_short st_port, dport, sport, port, sp, dp;
2612         struct in_addr in, inb;
2613         hostmap_t *hm;
2614         u_32_t flags;
2615         u_32_t st_ip;
2616         ipnat_t *np;
2617         nat_t *natl;
2618         int l;
2619
2620         /*
2621          * If it's an outbound packet which doesn't match any existing
2622          * record, then create a new port
2623          */
2624         l = 0;
2625         hm = NULL;
2626         np = ni->nai_np;
2627         st_ip = np->in_snip;
2628         st_port = np->in_spnext;
2629         flags = nat->nat_flags;
2630
2631         if (flags & IPN_ICMPQUERY) {
2632                 sport = fin->fin_data[1];
2633                 dport = 0;
2634         } else {
2635                 sport = htons(fin->fin_data[0]);
2636                 dport = htons(fin->fin_data[1]);
2637         }
2638
2639         /*
2640          * Do a loop until we either run out of entries to try or we find
2641          * a NAT mapping that isn't currently being used.  This is done
2642          * because the change to the source is not (usually) being fixed.
2643          */
2644         do {
2645                 port = 0;
2646                 in.s_addr = htonl(np->in_snip);
2647                 if (l == 0) {
2648                         /*
2649                          * Check to see if there is an existing NAT
2650                          * setup for this IP address pair.
2651                          */
2652                         hm = ipf_nat_hostmap(softn, np, fin->fin_src,
2653                                              fin->fin_dst, in, 0);
2654                         if (hm != NULL)
2655                                 in.s_addr = hm->hm_nsrcip.s_addr;
2656                 } else if ((l == 1) && (hm != NULL)) {
2657                         ipf_nat_hostmapdel(softc, &hm);
2658                 }
2659                 in.s_addr = ntohl(in.s_addr);
2660
2661                 nat->nat_hm = hm;
2662
2663                 if ((np->in_nsrcmsk == 0xffffffff) && (np->in_spnext == 0)) {
2664                         if (l > 0) {
2665                                 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_1);
2666                                 DT4(ns_exhausted_1, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2667                                 return -1;
2668                         }
2669                 }
2670
2671                 if (np->in_redir == NAT_BIMAP &&
2672                     np->in_osrcmsk == np->in_nsrcmsk) {
2673                         /*
2674                          * map the address block in a 1:1 fashion
2675                          */
2676                         in.s_addr = np->in_nsrcaddr;
2677                         in.s_addr |= fin->fin_saddr & ~np->in_osrcmsk;
2678                         in.s_addr = ntohl(in.s_addr);
2679
2680                 } else if (np->in_redir & NAT_MAPBLK) {
2681                         if ((l >= np->in_ppip) || ((l > 0) &&
2682                              !(flags & IPN_TCPUDP))) {
2683                                 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_2);
2684                                 DT4(ns_exhausted_2, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2685                                 return -1;
2686                         }
2687                         /*
2688                          * map-block - Calculate destination address.
2689                          */
2690                         in.s_addr = ntohl(fin->fin_saddr);
2691                         in.s_addr &= ntohl(~np->in_osrcmsk);
2692                         inb.s_addr = in.s_addr;
2693                         in.s_addr /= np->in_ippip;
2694                         in.s_addr &= ntohl(~np->in_nsrcmsk);
2695                         in.s_addr += ntohl(np->in_nsrcaddr);
2696                         /*
2697                          * Calculate destination port.
2698                          */
2699                         if ((flags & IPN_TCPUDP) &&
2700                             (np->in_ppip != 0)) {
2701                                 port = ntohs(sport) + l;
2702                                 port %= np->in_ppip;
2703                                 port += np->in_ppip *
2704                                         (inb.s_addr % np->in_ippip);
2705                                 port += MAPBLK_MINPORT;
2706                                 port = htons(port);
2707                         }
2708
2709                 } else if ((np->in_nsrcaddr == 0) &&
2710                            (np->in_nsrcmsk == 0xffffffff)) {
2711                         i6addr_t in6;
2712
2713                         /*
2714                          * 0/32 - use the interface's IP address.
2715                          */
2716                         if ((l > 0) ||
2717                             ipf_ifpaddr(softc, 4, FRI_NORMAL, fin->fin_ifp,
2718                                        &in6, NULL) == -1) {
2719                                 NBUMPSIDEX(1, ns_new_ifpaddr, ns_new_ifpaddr_1);
2720                                 DT4(ns_new_ifpaddr_1, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2721                                 return -1;
2722                         }
2723                         in.s_addr = ntohl(in6.in4.s_addr);
2724
2725                 } else if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0)) {
2726                         /*
2727                          * 0/0 - use the original source address/port.
2728                          */
2729                         if (l > 0) {
2730                                 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_3);
2731                                 DT4(ns_exhausted_3, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2732                                 return -1;
2733                         }
2734                         in.s_addr = ntohl(fin->fin_saddr);
2735
2736                 } else if ((np->in_nsrcmsk != 0xffffffff) &&
2737                            (np->in_spnext == 0) && ((l > 0) || (hm == NULL)))
2738                         np->in_snip++;
2739
2740                 natl = NULL;
2741
2742                 if ((flags & IPN_TCPUDP) &&
2743                     ((np->in_redir & NAT_MAPBLK) == 0) &&
2744                     (np->in_flags & IPN_AUTOPORTMAP)) {
2745                         /*
2746                          * "ports auto" (without map-block)
2747                          */
2748                         if ((l > 0) && (l % np->in_ppip == 0)) {
2749                                 if ((l > np->in_ppip) &&
2750                                     np->in_nsrcmsk != 0xffffffff)
2751                                         np->in_snip++;
2752                         }
2753                         if (np->in_ppip != 0) {
2754                                 port = ntohs(sport);
2755                                 port += (l % np->in_ppip);
2756                                 port %= np->in_ppip;
2757                                 port += np->in_ppip *
2758                                         (ntohl(fin->fin_saddr) %
2759                                          np->in_ippip);
2760                                 port += MAPBLK_MINPORT;
2761                                 port = htons(port);
2762                         }
2763
2764                 } else if (((np->in_redir & NAT_MAPBLK) == 0) &&
2765                            (flags & IPN_TCPUDPICMP) && (np->in_spnext != 0)) {
2766                         /*
2767                          * Standard port translation.  Select next port.
2768                          */
2769                         if (np->in_flags & IPN_SEQUENTIAL) {
2770                                 port = np->in_spnext;
2771                         } else {
2772                                 port = ipf_random() % (np->in_spmax -
2773                                                        np->in_spmin + 1);
2774                                 port += np->in_spmin;
2775                         }
2776                         port = htons(port);
2777                         np->in_spnext++;
2778
2779                         if (np->in_spnext > np->in_spmax) {
2780                                 np->in_spnext = np->in_spmin;
2781                                 if (np->in_nsrcmsk != 0xffffffff)
2782                                         np->in_snip++;
2783                         }
2784                 }
2785
2786                 if (np->in_flags & IPN_SIPRANGE) {
2787                         if (np->in_snip > ntohl(np->in_nsrcmsk))
2788                                 np->in_snip = ntohl(np->in_nsrcaddr);
2789                 } else {
2790                         if ((np->in_nsrcmsk != 0xffffffff) &&
2791                             ((np->in_snip + 1) & ntohl(np->in_nsrcmsk)) >
2792                             ntohl(np->in_nsrcaddr))
2793                                 np->in_snip = ntohl(np->in_nsrcaddr) + 1;
2794                 }
2795
2796                 if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY)))
2797                         port = sport;
2798
2799                 /*
2800                  * Here we do a lookup of the connection as seen from
2801                  * the outside.  If an IP# pair already exists, try
2802                  * again.  So if you have A->B becomes C->B, you can
2803                  * also have D->E become C->E but not D->B causing
2804                  * another C->B.  Also take protocol and ports into
2805                  * account when determining whether a pre-existing
2806                  * NAT setup will cause an external conflict where
2807                  * this is appropriate.
2808                  */
2809                 inb.s_addr = htonl(in.s_addr);
2810                 sp = fin->fin_data[0];
2811                 dp = fin->fin_data[1];
2812                 fin->fin_data[0] = fin->fin_data[1];
2813                 fin->fin_data[1] = ntohs(port);
2814                 natl = ipf_nat_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
2815                                         (u_int)fin->fin_p, fin->fin_dst, inb);
2816                 fin->fin_data[0] = sp;
2817                 fin->fin_data[1] = dp;
2818
2819                 /*
2820                  * Has the search wrapped around and come back to the
2821                  * start ?
2822                  */
2823                 if ((natl != NULL) &&
2824                     (np->in_spnext != 0) && (st_port == np->in_spnext) &&
2825                     (np->in_snip != 0) && (st_ip == np->in_snip)) {
2826                         NBUMPSIDED(1, ns_wrap);
2827                         DT4(ns_wrap, fr_info_t *, fin, nat_t *, nat, natinfo_t *, ni, ipnat_t *, np);
2828                         return -1;
2829                 }
2830                 l++;
2831         } while (natl != NULL);
2832
2833         /* Setup the NAT table */
2834         nat->nat_osrcip = fin->fin_src;
2835         nat->nat_nsrcaddr = htonl(in.s_addr);
2836         nat->nat_odstip = fin->fin_dst;
2837         nat->nat_ndstip = fin->fin_dst;
2838         if (nat->nat_hm == NULL)
2839                 nat->nat_hm = ipf_nat_hostmap(softn, np, fin->fin_src,
2840                                               fin->fin_dst, nat->nat_nsrcip,
2841                                               0);
2842
2843         if (flags & IPN_TCPUDP) {
2844                 nat->nat_osport = sport;
2845                 nat->nat_nsport = port; /* sport */
2846                 nat->nat_odport = dport;
2847                 nat->nat_ndport = dport;
2848                 ((tcphdr_t *)fin->fin_dp)->th_sport = port;
2849         } else if (flags & IPN_ICMPQUERY) {
2850                 nat->nat_oicmpid = fin->fin_data[1];
2851                 ((icmphdr_t *)fin->fin_dp)->icmp_id = port;
2852                 nat->nat_nicmpid = port;
2853         }
2854         return 0;
2855 }
2856
2857
2858 /* ------------------------------------------------------------------------ */
2859 /* Function:    ipf_nat_newrdr                                              */
2860 /* Returns:     int - -1 == error, 0 == success (no move), 1 == success and */
2861 /*                    allow rule to be moved if IPN_ROUNDR is set.          */
2862 /* Parameters:  fin(I) - pointer to packet information                      */
2863 /*              nat(I) - pointer to NAT entry                               */
2864 /*              ni(I)  - pointer to structure with misc. information needed */
2865 /*                       to create new NAT entry.                           */
2866 /*                                                                          */
2867 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
2868 /* to the new IP address for the translation.                               */
2869 /* ------------------------------------------------------------------------ */
2870 static int
2871 ipf_nat_newrdr(fin, nat, ni)
2872         fr_info_t *fin;
2873         nat_t *nat;
2874         natinfo_t *ni;
2875 {
2876         ipf_main_softc_t *softc = fin->fin_main_soft;
2877         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2878         u_short nport, dport, sport;
2879         struct in_addr in, inb;
2880         u_short sp, dp;
2881         hostmap_t *hm;
2882         u_32_t flags;
2883         ipnat_t *np;
2884         nat_t *natl;
2885         int move;
2886
2887         move = 1;
2888         hm = NULL;
2889         in.s_addr = 0;
2890         np = ni->nai_np;
2891         flags = nat->nat_flags;
2892
2893         if (flags & IPN_ICMPQUERY) {
2894                 dport = fin->fin_data[1];
2895                 sport = 0;
2896         } else {
2897                 sport = htons(fin->fin_data[0]);
2898                 dport = htons(fin->fin_data[1]);
2899         }
2900
2901         /* TRACE sport, dport */
2902
2903
2904         /*
2905          * If the matching rule has IPN_STICKY set, then we want to have the
2906          * same rule kick in as before.  Why would this happen?  If you have
2907          * a collection of rdr rules with "round-robin sticky", the current
2908          * packet might match a different one to the previous connection but
2909          * we want the same destination to be used.
2910          */
2911         if (((np->in_flags & (IPN_ROUNDR|IPN_SPLIT)) != 0) &&
2912             ((np->in_flags & IPN_STICKY) != 0)) {
2913                 hm = ipf_nat_hostmap(softn, NULL, fin->fin_src, fin->fin_dst,
2914                                      in, (u_32_t)dport);
2915                 if (hm != NULL) {
2916                         in.s_addr = ntohl(hm->hm_ndstip.s_addr);
2917                         np = hm->hm_ipnat;
2918                         ni->nai_np = np;
2919                         move = 0;
2920                         ipf_nat_hostmapdel(softc, &hm);
2921                 }
2922         }
2923
2924         /*
2925          * Otherwise, it's an inbound packet. Most likely, we don't
2926          * want to rewrite source ports and source addresses. Instead,
2927          * we want to rewrite to a fixed internal address and fixed
2928          * internal port.
2929          */
2930         if (np->in_flags & IPN_SPLIT) {
2931                 in.s_addr = np->in_dnip;
2932                 inb.s_addr = htonl(in.s_addr);
2933
2934                 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) {
2935                         hm = ipf_nat_hostmap(softn, NULL, fin->fin_src,
2936                                              fin->fin_dst, inb, (u_32_t)dport);
2937                         if (hm != NULL) {
2938                                 in.s_addr = hm->hm_ndstip.s_addr;
2939                                 move = 0;
2940                         }
2941                 }
2942
2943                 if (hm == NULL || hm->hm_ref == 1) {
2944                         if (np->in_ndstaddr == htonl(in.s_addr)) {
2945                                 np->in_dnip = ntohl(np->in_ndstmsk);
2946                                 move = 0;
2947                         } else {
2948                                 np->in_dnip = ntohl(np->in_ndstaddr);
2949                         }
2950                 }
2951                 if (hm != NULL)
2952                         ipf_nat_hostmapdel(softc, &hm);
2953
2954         } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0xffffffff)) {
2955                 i6addr_t in6;
2956
2957                 /*
2958                  * 0/32 - use the interface's IP address.
2959                  */
2960                 if (ipf_ifpaddr(softc, 4, FRI_NORMAL, fin->fin_ifp,
2961                                &in6, NULL) == -1) {
2962                         NBUMPSIDEX(0, ns_new_ifpaddr, ns_new_ifpaddr_2);
2963                         DT3(ns_new_ifpaddr_2, fr_info_t *, fin, nat_t *, nat, natinfo_t, ni);
2964                         return -1;
2965                 }
2966                 in.s_addr = ntohl(in6.in4.s_addr);
2967
2968         } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk== 0)) {
2969                 /*
2970                  * 0/0 - use the original destination address/port.
2971                  */
2972                 in.s_addr = ntohl(fin->fin_daddr);
2973
2974         } else if (np->in_redir == NAT_BIMAP &&
2975                    np->in_ndstmsk == np->in_odstmsk) {
2976                 /*
2977                  * map the address block in a 1:1 fashion
2978                  */
2979                 in.s_addr = np->in_ndstaddr;
2980                 in.s_addr |= fin->fin_daddr & ~np->in_ndstmsk;
2981                 in.s_addr = ntohl(in.s_addr);
2982         } else {
2983                 in.s_addr = ntohl(np->in_ndstaddr);
2984         }
2985
2986         if ((np->in_dpnext == 0) || ((flags & NAT_NOTRULEPORT) != 0))
2987                 nport = dport;
2988         else {
2989                 /*
2990                  * Whilst not optimized for the case where
2991                  * pmin == pmax, the gain is not significant.
2992                  */
2993                 if (((np->in_flags & IPN_FIXEDDPORT) == 0) &&
2994                     (np->in_odport != np->in_dtop)) {
2995                         nport = ntohs(dport) - np->in_odport + np->in_dpmax;
2996                         nport = htons(nport);
2997                 } else {
2998                         nport = htons(np->in_dpnext);
2999                         np->in_dpnext++;
3000                         if (np->in_dpnext > np->in_dpmax)
3001                                 np->in_dpnext = np->in_dpmin;
3002                 }
3003         }
3004
3005         /*
3006          * When the redirect-to address is set to 0.0.0.0, just
3007          * assume a blank `forwarding' of the packet.  We don't
3008          * setup any translation for this either.
3009          */
3010         if (in.s_addr == 0) {
3011                 if (nport == dport) {
3012                         NBUMPSIDED(0, ns_xlate_null);
3013                         return -1;
3014                 }
3015                 in.s_addr = ntohl(fin->fin_daddr);
3016         }
3017
3018         /*
3019          * Check to see if this redirect mapping already exists and if
3020          * it does, return "failure" (allowing it to be created will just
3021          * cause one or both of these "connections" to stop working.)
3022          */
3023         inb.s_addr = htonl(in.s_addr);
3024         sp = fin->fin_data[0];
3025         dp = fin->fin_data[1];
3026         fin->fin_data[1] = fin->fin_data[0];
3027         fin->fin_data[0] = ntohs(nport);
3028         natl = ipf_nat_outlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
3029                              (u_int)fin->fin_p, inb, fin->fin_src);
3030         fin->fin_data[0] = sp;
3031         fin->fin_data[1] = dp;
3032         if (natl != NULL) {
3033                 DT2(ns_new_xlate_exists, fr_info_t *, fin, nat_t *, natl);
3034                 NBUMPSIDE(0, ns_xlate_exists);
3035                 return -1;
3036         }
3037
3038         inb.s_addr = htonl(in.s_addr);
3039         nat->nat_ndstaddr = htonl(in.s_addr);
3040         nat->nat_odstip = fin->fin_dst;
3041         nat->nat_nsrcip = fin->fin_src;
3042         nat->nat_osrcip = fin->fin_src;
3043         if ((nat->nat_hm == NULL) && ((np->in_flags & IPN_STICKY) != 0))
3044                 nat->nat_hm = ipf_nat_hostmap(softn, np, fin->fin_src,
3045                                               fin->fin_dst, inb, (u_32_t)dport);
3046
3047         if (flags & IPN_TCPUDP) {
3048                 nat->nat_odport = dport;
3049                 nat->nat_ndport = nport;
3050                 nat->nat_osport = sport;
3051                 nat->nat_nsport = sport;
3052                 ((tcphdr_t *)fin->fin_dp)->th_dport = nport;
3053         } else if (flags & IPN_ICMPQUERY) {
3054                 nat->nat_oicmpid = fin->fin_data[1];
3055                 ((icmphdr_t *)fin->fin_dp)->icmp_id = nport;
3056                 nat->nat_nicmpid = nport;
3057         }
3058
3059         return move;
3060 }
3061
3062 /* ------------------------------------------------------------------------ */
3063 /* Function:    ipf_nat_add                                                 */
3064 /* Returns:     nat_t* - NULL == failure to create new NAT structure,       */
3065 /*                       else pointer to new NAT structure                  */
3066 /* Parameters:  fin(I)       - pointer to packet information                */
3067 /*              np(I)        - pointer to NAT rule                          */
3068 /*              natsave(I)   - pointer to where to store NAT struct pointer */
3069 /*              flags(I)     - flags describing the current packet          */
3070 /*              direction(I) - direction of packet (in/out)                 */
3071 /* Write Lock:  ipf_nat                                                     */
3072 /*                                                                          */
3073 /* Attempts to create a new NAT entry.  Does not actually change the packet */
3074 /* in any way.                                                              */
3075 /*                                                                          */
3076 /* This fucntion is in three main parts: (1) deal with creating a new NAT   */
3077 /* structure for a "MAP" rule (outgoing NAT translation); (2) deal with     */
3078 /* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */
3079 /* and (3) building that structure and putting it into the NAT table(s).    */
3080 /*                                                                          */
3081 /* NOTE: natsave should NOT be used top point back to an ipstate_t struct   */
3082 /*       as it can result in memory being corrupted.                        */
3083 /* ------------------------------------------------------------------------ */
3084 nat_t *
3085 ipf_nat_add(fin, np, natsave, flags, direction)
3086         fr_info_t *fin;
3087         ipnat_t *np;
3088         nat_t **natsave;
3089         u_int flags;
3090         int direction;
3091 {
3092         ipf_main_softc_t *softc = fin->fin_main_soft;
3093         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3094         hostmap_t *hm = NULL;
3095         nat_t *nat, *natl;
3096         natstat_t *nsp;
3097         u_int nflags;
3098         natinfo_t ni;
3099         int move;
3100
3101         nsp = &softn->ipf_nat_stats;
3102
3103         if ((nsp->ns_active * 100 / softn->ipf_nat_table_max) >
3104             softn->ipf_nat_table_wm_high) {
3105                 softn->ipf_nat_doflush = 1;
3106         }
3107
3108         if (nsp->ns_active >= softn->ipf_nat_table_max) {
3109                 NBUMPSIDED(fin->fin_out, ns_table_max);
3110                 DT2(ns_table_max, nat_stat_t *, nsp, ipf_nat_softc_t *, softn);
3111                 return NULL;
3112         }
3113
3114         move = 1;
3115         nflags = np->in_flags & flags;
3116         nflags &= NAT_FROMRULE;
3117
3118         ni.nai_np = np;
3119         ni.nai_dport = 0;
3120         ni.nai_sport = 0;
3121
3122         /* Give me a new nat */
3123         KMALLOC(nat, nat_t *);
3124         if (nat == NULL) {
3125                 DT(ns_memfail);
3126                 NBUMPSIDED(fin->fin_out, ns_memfail);
3127                 /*
3128                  * Try to automatically tune the max # of entries in the
3129                  * table allowed to be less than what will cause kmem_alloc()
3130                  * to fail and try to eliminate panics due to out of memory
3131                  * conditions arising.
3132                  */
3133                 if ((softn->ipf_nat_table_max > softn->ipf_nat_table_sz) &&
3134                     (nsp->ns_active > 100)) {
3135                         softn->ipf_nat_table_max = nsp->ns_active - 100;
3136                         printf("table_max reduced to %d\n",
3137                                 softn->ipf_nat_table_max);
3138                 }
3139                 return NULL;
3140         }
3141
3142         if (flags & IPN_ICMPQUERY) {
3143                 /*
3144                  * In the ICMP query NAT code, we translate the ICMP id fields
3145                  * to make them unique. This is indepedent of the ICMP type
3146                  * (e.g. in the unlikely event that a host sends an echo and
3147                  * an tstamp request with the same id, both packets will have
3148                  * their ip address/id field changed in the same way).
3149                  */
3150                 /* The icmp_id field is used by the sender to identify the
3151                  * process making the icmp request. (the receiver justs
3152                  * copies it back in its response). So, it closely matches
3153                  * the concept of source port. We overlay sport, so we can
3154                  * maximally reuse the existing code.
3155                  */
3156                 ni.nai_sport = fin->fin_data[1];
3157                 ni.nai_dport = 0;
3158         }
3159
3160         bzero((char *)nat, sizeof(*nat));
3161         nat->nat_flags = flags;
3162         nat->nat_redir = np->in_redir;
3163         nat->nat_dir = direction;
3164         nat->nat_pr[0] = fin->fin_p;
3165         nat->nat_pr[1] = fin->fin_p;
3166
3167         /*
3168          * Search the current table for a match and create a new mapping
3169          * if there is none found.
3170          */
3171         if (np->in_redir & NAT_DIVERTUDP) {
3172                 move = ipf_nat_newdivert(fin, nat, &ni);
3173
3174         } else if (np->in_redir & NAT_REWRITE) {
3175                 move = ipf_nat_newrewrite(fin, nat, &ni);
3176
3177         } else if (direction == NAT_OUTBOUND) {
3178                 /*
3179                  * We can now arrange to call this for the same connection
3180                  * because ipf_nat_new doesn't protect the code path into
3181                  * this function.
3182                  */
3183                 natl = ipf_nat_outlookup(fin, nflags, (u_int)fin->fin_p,
3184                                      fin->fin_src, fin->fin_dst);
3185                 if (natl != NULL) {
3186                         KFREE(nat);
3187                         nat = natl;
3188                         goto done;
3189                 }
3190
3191                 move = ipf_nat_newmap(fin, nat, &ni);
3192         } else {
3193                 /*
3194                  * NAT_INBOUND is used for redirects rules
3195                  */
3196                 natl = ipf_nat_inlookup(fin, nflags, (u_int)fin->fin_p,
3197                                         fin->fin_src, fin->fin_dst);
3198                 if (natl != NULL) {
3199                         KFREE(nat);
3200                         nat = natl;
3201                         goto done;
3202                 }
3203
3204                 move = ipf_nat_newrdr(fin, nat, &ni);
3205         }
3206         if (move == -1)
3207                 goto badnat;
3208
3209         np = ni.nai_np;
3210
3211         nat->nat_mssclamp = np->in_mssclamp;
3212         nat->nat_me = natsave;
3213         nat->nat_fr = fin->fin_fr;
3214         nat->nat_rev = fin->fin_rev;
3215         nat->nat_ptr = np;
3216         nat->nat_dlocal = np->in_dlocal;
3217
3218         if ((np->in_apr != NULL) && ((nat->nat_flags & NAT_SLAVE) == 0)) {
3219                 if (ipf_proxy_new(fin, nat) == -1) {
3220                         NBUMPSIDED(fin->fin_out, ns_appr_fail);
3221                         DT3(ns_appr_fail, fr_info_t *, fin, nat_t *, nat, ipnat_t *, np);
3222                         goto badnat;
3223                 }
3224         }
3225
3226         nat->nat_ifps[0] = np->in_ifps[0];
3227         if (np->in_ifps[0] != NULL) {
3228                 COPYIFNAME(np->in_v[0], np->in_ifps[0], nat->nat_ifnames[0]);
3229         }
3230
3231         nat->nat_ifps[1] = np->in_ifps[1];
3232         if (np->in_ifps[1] != NULL) {
3233                 COPYIFNAME(np->in_v[1], np->in_ifps[1], nat->nat_ifnames[1]);
3234         }
3235
3236         if (ipf_nat_finalise(fin, nat) == -1) {
3237                 goto badnat;
3238         }
3239
3240         np->in_use++;
3241
3242         if ((move == 1) && (np->in_flags & IPN_ROUNDR)) {
3243                 if ((np->in_redir & (NAT_REDIRECT|NAT_MAP)) == NAT_REDIRECT) {
3244                         ipf_nat_delrdr(softn, np);
3245                         ipf_nat_addrdr(softn, np);
3246                 } else if ((np->in_redir & (NAT_REDIRECT|NAT_MAP)) == NAT_MAP) {
3247                         ipf_nat_delmap(softn, np);
3248                         ipf_nat_addmap(softn, np);
3249                 }
3250         }
3251
3252         if (flags & SI_WILDP)
3253                 nsp->ns_wilds++;
3254         nsp->ns_proto[nat->nat_pr[0]]++;
3255
3256         goto done;
3257 badnat:
3258         DT3(ns_badnatnew, fr_info_t *, fin, nat_t *, nat, ipnat_t *, np);
3259         NBUMPSIDE(fin->fin_out, ns_badnatnew);
3260         if ((hm = nat->nat_hm) != NULL)
3261                 ipf_nat_hostmapdel(softc, &hm);
3262         KFREE(nat);
3263         nat = NULL;
3264 done:
3265         if (nat != NULL && np != NULL)
3266                 np->in_hits++;
3267         if (natsave != NULL)
3268                 *natsave = nat;
3269         return nat;
3270 }
3271
3272
3273 /* ------------------------------------------------------------------------ */
3274 /* Function:    ipf_nat_finalise                                            */
3275 /* Returns:     int - 0 == sucess, -1 == failure                            */
3276 /* Parameters:  fin(I) - pointer to packet information                      */
3277 /*              nat(I) - pointer to NAT entry                               */
3278 /* Write Lock:  ipf_nat                                                     */
3279 /*                                                                          */
3280 /* This is the tail end of constructing a new NAT entry and is the same     */
3281 /* for both IPv4 and IPv6.                                                  */
3282 /* ------------------------------------------------------------------------ */
3283 /*ARGSUSED*/
3284 static int
3285 ipf_nat_finalise(fin, nat)
3286         fr_info_t *fin;
3287         nat_t *nat;
3288 {
3289         ipf_main_softc_t *softc = fin->fin_main_soft;
3290         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3291         u_32_t sum1, sum2, sumd;
3292         frentry_t *fr;
3293         u_32_t flags;
3294 #if SOLARIS && defined(_KERNEL) && defined(ICK_M_CTL_MAGIC)
3295         qpktinfo_t *qpi = fin->fin_qpi;
3296 #endif
3297
3298         flags = nat->nat_flags;
3299
3300         switch (nat->nat_pr[0])
3301         {
3302         case IPPROTO_ICMP :
3303                 sum1 = LONG_SUM(ntohs(nat->nat_oicmpid));
3304                 sum2 = LONG_SUM(ntohs(nat->nat_nicmpid));
3305                 CALC_SUMD(sum1, sum2, sumd);
3306                 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
3307
3308                 break;
3309
3310         default :
3311                 sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr) + \
3312                                 ntohs(nat->nat_osport));
3313                 sum2 = LONG_SUM(ntohl(nat->nat_nsrcaddr) + \
3314                                 ntohs(nat->nat_nsport));
3315                 CALC_SUMD(sum1, sum2, sumd);
3316                 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
3317
3318                 sum1 = LONG_SUM(ntohl(nat->nat_odstaddr) + \
3319                                 ntohs(nat->nat_odport));
3320                 sum2 = LONG_SUM(ntohl(nat->nat_ndstaddr) + \
3321                                 ntohs(nat->nat_ndport));
3322                 CALC_SUMD(sum1, sum2, sumd);
3323                 nat->nat_sumd[0] += (sumd & 0xffff) + (sumd >> 16);
3324                 break;
3325         }
3326
3327         /*
3328          * Compute the partial checksum, just in case.
3329          * This is only ever placed into outbound packets so care needs
3330          * to be taken over which pair of addresses are used.
3331          */
3332         if (nat->nat_dir == NAT_OUTBOUND) {
3333                 sum1 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
3334                 sum1 += LONG_SUM(ntohl(nat->nat_ndstaddr));
3335         } else {
3336                 sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr));
3337                 sum1 += LONG_SUM(ntohl(nat->nat_odstaddr));
3338         }
3339         sum1 += nat->nat_pr[1];
3340         nat->nat_sumd[1] = (sum1 & 0xffff) + (sum1 >> 16);
3341
3342         sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr));
3343         sum2 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
3344         CALC_SUMD(sum1, sum2, sumd);
3345         nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16);
3346
3347         sum1 = LONG_SUM(ntohl(nat->nat_odstaddr));
3348         sum2 = LONG_SUM(ntohl(nat->nat_ndstaddr));
3349         CALC_SUMD(sum1, sum2, sumd);
3350         nat->nat_ipsumd += (sumd & 0xffff) + (sumd >> 16);
3351
3352         nat->nat_v[0] = 4;
3353         nat->nat_v[1] = 4;
3354
3355         if ((nat->nat_ifps[0] != NULL) && (nat->nat_ifps[0] != (void *)-1)) {
3356                 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
3357         }
3358
3359         if ((nat->nat_ifps[1] != NULL) && (nat->nat_ifps[1] != (void *)-1)) {
3360                 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
3361         }
3362
3363         if ((nat->nat_flags & SI_CLONE) == 0)
3364                 nat->nat_sync = ipf_sync_new(softc, SMC_NAT, fin, nat);
3365
3366         if (ipf_nat_insert(softc, softn, nat) == 0) {
3367                 if (softn->ipf_nat_logging)
3368                         ipf_nat_log(softc, softn, nat, NL_NEW);
3369                 fr = nat->nat_fr;
3370                 if (fr != NULL) {
3371                         MUTEX_ENTER(&fr->fr_lock);
3372                         fr->fr_ref++;
3373                         MUTEX_EXIT(&fr->fr_lock);
3374                 }
3375                 return 0;
3376         }
3377
3378         NBUMPSIDED(fin->fin_out, ns_unfinalised);
3379         DT2(ns_unfinalised, fr_info_t *, fin, nat_t *, nat);
3380         /*
3381          * nat_insert failed, so cleanup time...
3382          */
3383         if (nat->nat_sync != NULL)
3384                 ipf_sync_del_nat(softc->ipf_sync_soft, nat->nat_sync);
3385         return -1;
3386 }
3387
3388
3389 /* ------------------------------------------------------------------------ */
3390 /* Function:    ipf_nat_insert                                              */
3391 /* Returns:     int - 0 == sucess, -1 == failure                            */
3392 /* Parameters:  softc(I) - pointer to soft context main structure           */
3393 /*              softn(I) - pointer to NAT context structure                 */
3394 /*              nat(I) - pointer to NAT structure                           */
3395 /* Write Lock:  ipf_nat                                                     */
3396 /*                                                                          */
3397 /* Insert a NAT entry into the hash tables for searching and add it to the  */
3398 /* list of active NAT entries.  Adjust global counters when complete.       */
3399 /* ------------------------------------------------------------------------ */
3400 int
3401 ipf_nat_insert(softc, softn, nat)
3402         ipf_main_softc_t *softc;
3403         ipf_nat_softc_t *softn;
3404         nat_t *nat;
3405 {
3406         u_int hv0, hv1;
3407         u_int sp, dp;
3408         ipnat_t *in;
3409
3410         /*
3411          * Try and return an error as early as possible, so calculate the hash
3412          * entry numbers first and then proceed.
3413          */
3414         if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) {
3415                 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
3416                         sp = nat->nat_osport;
3417                         dp = nat->nat_odport;
3418                 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
3419                         sp = 0;
3420                         dp = nat->nat_oicmpid;
3421                 } else {
3422                         sp = 0;
3423                         dp = 0;
3424                 }
3425                 hv0 = NAT_HASH_FN(nat->nat_osrcaddr, sp, 0xffffffff);
3426                 hv0 = NAT_HASH_FN(nat->nat_odstaddr, hv0 + dp, 0xffffffff);
3427                 /*
3428                  * TRACE nat_osrcaddr, nat_osport, nat_odstaddr,
3429                  * nat_odport, hv0
3430                  */
3431
3432                 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
3433                         sp = nat->nat_nsport;
3434                         dp = nat->nat_ndport;
3435                 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
3436                         sp = 0;
3437                         dp = nat->nat_nicmpid;
3438                 } else {
3439                         sp = 0;
3440                         dp = 0;
3441                 }
3442                 hv1 = NAT_HASH_FN(nat->nat_nsrcaddr, sp, 0xffffffff);
3443                 hv1 = NAT_HASH_FN(nat->nat_ndstaddr, hv1 + dp, 0xffffffff);
3444                 /*
3445                  * TRACE nat_nsrcaddr, nat_nsport, nat_ndstaddr,
3446                  * nat_ndport, hv1
3447                  */
3448         } else {
3449                 hv0 = NAT_HASH_FN(nat->nat_osrcaddr, 0, 0xffffffff);
3450                 hv0 = NAT_HASH_FN(nat->nat_odstaddr, hv0, 0xffffffff);
3451                 /* TRACE nat_osrcaddr, nat_odstaddr, hv0 */
3452
3453                 hv1 = NAT_HASH_FN(nat->nat_nsrcaddr, 0, 0xffffffff);
3454                 hv1 = NAT_HASH_FN(nat->nat_ndstaddr, hv1, 0xffffffff);
3455                 /* TRACE nat_nsrcaddr, nat_ndstaddr, hv1 */
3456         }
3457
3458         nat->nat_hv[0] = hv0;
3459         nat->nat_hv[1] = hv1;
3460
3461         MUTEX_INIT(&nat->nat_lock, "nat entry lock");
3462
3463         in = nat->nat_ptr;
3464         nat->nat_ref = nat->nat_me ? 2 : 1;
3465
3466         nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0';
3467         nat->nat_ifps[0] = ipf_resolvenic(softc, nat->nat_ifnames[0], 4);
3468
3469         if (nat->nat_ifnames[1][0] != '\0') {
3470                 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
3471                 nat->nat_ifps[1] = ipf_resolvenic(softc,
3472                                                   nat->nat_ifnames[1], 4);
3473         } else if (in->in_ifnames[1] != -1) {
3474                 char *name;
3475
3476                 name = in->in_names + in->in_ifnames[1];
3477                 if (name[1] != '\0' && name[0] != '-' && name[0] != '*') {
3478                         (void) strncpy(nat->nat_ifnames[1],
3479                                        nat->nat_ifnames[0], LIFNAMSIZ);
3480                         nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
3481                         nat->nat_ifps[1] = nat->nat_ifps[0];
3482                 }
3483         }
3484         if ((nat->nat_ifps[0] != NULL) && (nat->nat_ifps[0] != (void *)-1)) {
3485                 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
3486         }
3487         if ((nat->nat_ifps[1] != NULL) && (nat->nat_ifps[1] != (void *)-1)) {
3488                 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
3489         }
3490
3491         return ipf_nat_hashtab_add(softc, softn, nat);
3492 }
3493
3494
3495 /* ------------------------------------------------------------------------ */
3496 /* Function:    ipf_nat_hashtab_add                                         */
3497 /* Parameters:  softc(I) - pointer to soft context main structure           */
3498 /*              softn(I) - pointer to NAT context structure                 */
3499 /*              nat(I) - pointer to NAT structure                           */
3500 /*                                                                          */
3501 /* Handle the insertion of a NAT entry into the table/list.                 */
3502 /* ------------------------------------------------------------------------ */
3503 int
3504 ipf_nat_hashtab_add(softc, softn, nat)
3505         ipf_main_softc_t *softc;
3506         ipf_nat_softc_t *softn;
3507         nat_t *nat;
3508 {
3509         nat_t **natp;
3510         u_int hv0;
3511         u_int hv1;
3512
3513         hv0 = nat->nat_hv[0] % softn->ipf_nat_table_sz;
3514         hv1 = nat->nat_hv[1] % softn->ipf_nat_table_sz;
3515
3516         if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) {
3517                 u_int swap;
3518
3519                 swap = hv0;
3520                 hv0 = hv1;
3521                 hv1 = swap;
3522         }
3523
3524         if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0] >=
3525             softn->ipf_nat_maxbucket) {
3526                 DT1(ns_bucket_max_0, int,
3527                     softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0]);
3528                 NBUMPSIDE(0, ns_bucket_max);
3529                 return -1;
3530         }
3531
3532         if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen[hv1] >=
3533             softn->ipf_nat_maxbucket) {
3534                 DT1(ns_bucket_max_1, int,
3535                     softn->ipf_nat_stats.ns_side[1].ns_bucketlen[hv1]);
3536                 NBUMPSIDE(1, ns_bucket_max);
3537                 return -1;
3538         }
3539
3540         /*
3541          * The ordering of operations in the list and hash table insertion
3542          * is very important.  The last operation for each task should be
3543          * to update the top of the list, after all the "nexts" have been
3544          * done so that walking the list while it is being done does not
3545          * find strange pointers.
3546          *
3547          * Global list of NAT instances
3548          */
3549         nat->nat_next = softn->ipf_nat_instances;
3550         nat->nat_pnext = &softn->ipf_nat_instances;
3551         if (softn->ipf_nat_instances)
3552                 softn->ipf_nat_instances->nat_pnext = &nat->nat_next;
3553         softn->ipf_nat_instances = nat;
3554
3555         /*
3556          * Inbound hash table.
3557          */
3558         natp = &softn->ipf_nat_table[0][hv0];
3559         nat->nat_phnext[0] = natp;
3560         nat->nat_hnext[0] = *natp;
3561         if (*natp) {
3562                 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
3563         } else {
3564                 NBUMPSIDE(0, ns_inuse);
3565         }
3566         *natp = nat;
3567         NBUMPSIDE(0, ns_bucketlen[hv0]);
3568
3569         /*
3570          * Outbound hash table.
3571          */
3572         natp = &softn->ipf_nat_table[1][hv1];
3573         nat->nat_phnext[1] = natp;
3574         nat->nat_hnext[1] = *natp;
3575         if (*natp)
3576                 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
3577         else {
3578                 NBUMPSIDE(1, ns_inuse);
3579         }
3580         *natp = nat;
3581         NBUMPSIDE(1, ns_bucketlen[hv1]);
3582
3583         ipf_nat_setqueue(softc, softn, nat);
3584
3585         if (nat->nat_dir & NAT_OUTBOUND) {
3586                 NBUMPSIDE(1, ns_added);
3587         } else {
3588                 NBUMPSIDE(0, ns_added);
3589         }
3590         softn->ipf_nat_stats.ns_active++;
3591         return 0;
3592 }
3593
3594
3595 /* ------------------------------------------------------------------------ */
3596 /* Function:    ipf_nat_icmperrorlookup                                     */
3597 /* Returns:     nat_t* - point to matching NAT structure                    */
3598 /* Parameters:  fin(I) - pointer to packet information                      */
3599 /*              dir(I) - direction of packet (in/out)                       */
3600 /*                                                                          */
3601 /* Check if the ICMP error message is related to an existing TCP, UDP or    */
3602 /* ICMP query nat entry.  It is assumed that the packet is already of the   */
3603 /* the required length.                                                     */
3604 /* ------------------------------------------------------------------------ */
3605 nat_t *
3606 ipf_nat_icmperrorlookup(fin, dir)
3607         fr_info_t *fin;
3608         int dir;
3609 {
3610         ipf_main_softc_t *softc = fin->fin_main_soft;
3611         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3612         int flags = 0, type, minlen;
3613         icmphdr_t *icmp, *orgicmp;
3614         nat_stat_side_t *nside;
3615         tcphdr_t *tcp = NULL;
3616         u_short data[2];
3617         nat_t *nat;
3618         ip_t *oip;
3619         u_int p;
3620
3621         icmp = fin->fin_dp;
3622         type = icmp->icmp_type;
3623         nside = &softn->ipf_nat_stats.ns_side[fin->fin_out];
3624         /*
3625          * Does it at least have the return (basic) IP header ?
3626          * Only a basic IP header (no options) should be with an ICMP error
3627          * header.  Also, if it's not an error type, then return.
3628          */
3629         if ((fin->fin_hlen != sizeof(ip_t)) || !(fin->fin_flx & FI_ICMPERR)) {
3630                 ATOMIC_INCL(nside->ns_icmp_basic);
3631                 return NULL;
3632         }
3633
3634         /*
3635          * Check packet size
3636          */
3637         oip = (ip_t *)((char *)fin->fin_dp + 8);
3638         minlen = IP_HL(oip) << 2;
3639         if ((minlen < sizeof(ip_t)) ||
3640             (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen)) {
3641                 ATOMIC_INCL(nside->ns_icmp_size);
3642                 return NULL;
3643         }
3644
3645         /*
3646          * Is the buffer big enough for all of it ?  It's the size of the IP
3647          * header claimed in the encapsulated part which is of concern.  It
3648          * may be too big to be in this buffer but not so big that it's
3649          * outside the ICMP packet, leading to TCP deref's causing problems.
3650          * This is possible because we don't know how big oip_hl is when we
3651          * do the pullup early in ipf_check() and thus can't gaurantee it is
3652          * all here now.
3653          */
3654 #ifdef  ipf_nat_KERNEL
3655         {
3656         mb_t *m;
3657
3658         m = fin->fin_m;
3659 # if defined(MENTAT)
3660         if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
3661             (char *)m->b_wptr) {
3662                 ATOMIC_INCL(nside->ns_icmp_mbuf);
3663                 return NULL;
3664         }
3665 # else
3666         if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
3667             (char *)fin->fin_ip + M_LEN(m)) {
3668                 ATOMIC_INCL(nside->ns_icmp_mbuf);
3669                 return NULL;
3670         }
3671 # endif
3672         }
3673 #endif
3674
3675         if (fin->fin_daddr != oip->ip_src.s_addr) {
3676                 ATOMIC_INCL(nside->ns_icmp_address);
3677                 return NULL;
3678         }
3679
3680         p = oip->ip_p;
3681         if (p == IPPROTO_TCP)
3682                 flags = IPN_TCP;
3683         else if (p == IPPROTO_UDP)
3684                 flags = IPN_UDP;
3685         else if (p == IPPROTO_ICMP) {
3686                 orgicmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2));
3687
3688                 /* see if this is related to an ICMP query */
3689                 if (ipf_nat_icmpquerytype(orgicmp->icmp_type)) {
3690                         data[0] = fin->fin_data[0];
3691                         data[1] = fin->fin_data[1];
3692                         fin->fin_data[0] = 0;
3693                         fin->fin_data[1] = orgicmp->icmp_id;
3694
3695                         flags = IPN_ICMPERR|IPN_ICMPQUERY;
3696                         /*
3697                          * NOTE : dir refers to the direction of the original
3698                          *        ip packet. By definition the icmp error
3699                          *        message flows in the opposite direction.
3700                          */
3701                         if (dir == NAT_INBOUND)
3702                                 nat = ipf_nat_inlookup(fin, flags, p,
3703                                                        oip->ip_dst,
3704                                                        oip->ip_src);
3705                         else
3706                                 nat = ipf_nat_outlookup(fin, flags, p,
3707                                                         oip->ip_dst,
3708                                                         oip->ip_src);
3709                         fin->fin_data[0] = data[0];
3710                         fin->fin_data[1] = data[1];
3711                         return nat;
3712                 }
3713         }
3714
3715         if (flags & IPN_TCPUDP) {
3716                 minlen += 8;            /* + 64bits of data to get ports */
3717                 /* TRACE (fin,minlen) */
3718                 if (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen) {
3719                         ATOMIC_INCL(nside->ns_icmp_short);
3720                         return NULL;
3721                 }
3722
3723                 data[0] = fin->fin_data[0];
3724                 data[1] = fin->fin_data[1];
3725                 tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2));
3726                 fin->fin_data[0] = ntohs(tcp->th_dport);
3727                 fin->fin_data[1] = ntohs(tcp->th_sport);
3728
3729                 if (dir == NAT_INBOUND) {
3730                         nat = ipf_nat_inlookup(fin, flags, p, oip->ip_dst,
3731                                                oip->ip_src);
3732                 } else {
3733                         nat = ipf_nat_outlookup(fin, flags, p, oip->ip_dst,
3734                                             oip->ip_src);
3735                 }
3736                 fin->fin_data[0] = data[0];
3737                 fin->fin_data[1] = data[1];
3738                 return nat;
3739         }
3740         if (dir == NAT_INBOUND)
3741                 nat = ipf_nat_inlookup(fin, 0, p, oip->ip_dst, oip->ip_src);
3742         else
3743                 nat = ipf_nat_outlookup(fin, 0, p, oip->ip_dst, oip->ip_src);
3744
3745         return nat;
3746 }
3747
3748
3749 /* ------------------------------------------------------------------------ */
3750 /* Function:    ipf_nat_icmperror                                           */
3751 /* Returns:     nat_t* - point to matching NAT structure                    */
3752 /* Parameters:  fin(I)    - pointer to packet information                   */
3753 /*              nflags(I) - NAT flags for this packet                       */
3754 /*              dir(I)    - direction of packet (in/out)                    */
3755 /*                                                                          */
3756 /* Fix up an ICMP packet which is an error message for an existing NAT      */
3757 /* session.  This will correct both packet header data and checksums.       */
3758 /*                                                                          */
3759 /* This should *ONLY* be used for incoming ICMP error packets to make sure  */
3760 /* a NAT'd ICMP packet gets correctly recognised.                           */
3761 /* ------------------------------------------------------------------------ */
3762 nat_t *
3763 ipf_nat_icmperror(fin, nflags, dir)
3764         fr_info_t *fin;
3765         u_int *nflags;
3766         int dir;
3767 {
3768         ipf_main_softc_t *softc = fin->fin_main_soft;
3769         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3770         u_32_t sum1, sum2, sumd, sumd2;
3771         struct in_addr a1, a2, a3, a4;
3772         int flags, dlen, odst;
3773         icmphdr_t *icmp;
3774         u_short *csump;
3775         tcphdr_t *tcp;
3776         nat_t *nat;
3777         ip_t *oip;
3778         void *dp;
3779
3780         if ((fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) {
3781                 NBUMPSIDED(fin->fin_out, ns_icmp_short);
3782                 return NULL;
3783         }
3784
3785         /*
3786          * ipf_nat_icmperrorlookup() will return NULL for `defective' packets.
3787          */
3788         if ((fin->fin_v != 4) || !(nat = ipf_nat_icmperrorlookup(fin, dir))) {
3789                 NBUMPSIDED(fin->fin_out, ns_icmp_notfound);
3790                 return NULL;
3791         }
3792
3793         tcp = NULL;
3794         csump = NULL;
3795         flags = 0;
3796         sumd2 = 0;
3797         *nflags = IPN_ICMPERR;
3798         icmp = fin->fin_dp;
3799         oip = (ip_t *)&icmp->icmp_ip;
3800         dp = (((char *)oip) + (IP_HL(oip) << 2));
3801         if (oip->ip_p == IPPROTO_TCP) {
3802                 tcp = (tcphdr_t *)dp;
3803                 csump = (u_short *)&tcp->th_sum;
3804                 flags = IPN_TCP;
3805         } else if (oip->ip_p == IPPROTO_UDP) {
3806                 udphdr_t *udp;
3807
3808                 udp = (udphdr_t *)dp;
3809                 tcp = (tcphdr_t *)dp;
3810                 csump = (u_short *)&udp->uh_sum;
3811                 flags = IPN_UDP;
3812         } else if (oip->ip_p == IPPROTO_ICMP)
3813                 flags = IPN_ICMPQUERY;
3814         dlen = fin->fin_plen - ((char *)dp - (char *)fin->fin_ip);
3815
3816         /*
3817          * Need to adjust ICMP header to include the real IP#'s and
3818          * port #'s.  Only apply a checksum change relative to the
3819          * IP address change as it will be modified again in ipf_nat_checkout
3820          * for both address and port.  Two checksum changes are
3821          * necessary for the two header address changes.  Be careful
3822          * to only modify the checksum once for the port # and twice
3823          * for the IP#.
3824          */
3825
3826         /*
3827          * Step 1
3828          * Fix the IP addresses in the offending IP packet. You also need
3829          * to adjust the IP header checksum of that offending IP packet.
3830          *
3831          * Normally, you would expect that the ICMP checksum of the
3832          * ICMP error message needs to be adjusted as well for the
3833          * IP address change in oip.
3834          * However, this is a NOP, because the ICMP checksum is
3835          * calculated over the complete ICMP packet, which includes the
3836          * changed oip IP addresses and oip->ip_sum. However, these
3837          * two changes cancel each other out (if the delta for
3838          * the IP address is x, then the delta for ip_sum is minus x),
3839          * so no change in the icmp_cksum is necessary.
3840          *
3841          * Inbound ICMP
3842          * ------------
3843          * MAP rule, SRC=a,DST=b -> SRC=c,DST=b
3844          * - response to outgoing packet (a,b)=>(c,b) (OIP_SRC=c,OIP_DST=b)
3845          * - OIP_SRC(c)=nat_newsrcip,          OIP_DST(b)=nat_newdstip
3846          *=> OIP_SRC(c)=nat_oldsrcip,          OIP_DST(b)=nat_olddstip
3847          *
3848          * RDR rule, SRC=a,DST=b -> SRC=a,DST=c
3849          * - response to outgoing packet (c,a)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3850          * - OIP_SRC(b)=nat_olddstip,          OIP_DST(a)=nat_oldsrcip
3851          *=> OIP_SRC(b)=nat_newdstip,          OIP_DST(a)=nat_newsrcip
3852          *
3853          * REWRITE out rule, SRC=a,DST=b -> SRC=c,DST=d
3854          * - response to outgoing packet (a,b)=>(c,d) (OIP_SRC=c,OIP_DST=d)
3855          * - OIP_SRC(c)=nat_newsrcip,          OIP_DST(d)=nat_newdstip
3856          *=> OIP_SRC(c)=nat_oldsrcip,          OIP_DST(d)=nat_olddstip
3857          *
3858          * REWRITE in rule, SRC=a,DST=b -> SRC=c,DST=d
3859          * - response to outgoing packet (d,c)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3860          * - OIP_SRC(b)=nat_olddstip,          OIP_DST(a)=nat_oldsrcip
3861          *=> OIP_SRC(b)=nat_newdstip,          OIP_DST(a)=nat_newsrcip
3862          *
3863          * Outbound ICMP
3864          * -------------
3865          * MAP rule, SRC=a,DST=b -> SRC=c,DST=b
3866          * - response to incoming packet (b,c)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3867          * - OIP_SRC(b)=nat_olddstip,          OIP_DST(a)=nat_oldsrcip
3868          *=> OIP_SRC(b)=nat_newdstip,          OIP_DST(a)=nat_newsrcip
3869          *
3870          * RDR rule, SRC=a,DST=b -> SRC=a,DST=c
3871          * - response to incoming packet (a,b)=>(a,c) (OIP_SRC=a,OIP_DST=c)
3872          * - OIP_SRC(a)=nat_newsrcip,          OIP_DST(c)=nat_newdstip
3873          *=> OIP_SRC(a)=nat_oldsrcip,          OIP_DST(c)=nat_olddstip
3874          *
3875          * REWRITE out rule, SRC=a,DST=b -> SRC=c,DST=d
3876          * - response to incoming packet (d,c)=>(b,a) (OIP_SRC=c,OIP_DST=d)
3877          * - OIP_SRC(c)=nat_olddstip,          OIP_DST(d)=nat_oldsrcip
3878          *=> OIP_SRC(b)=nat_newdstip,          OIP_DST(a)=nat_newsrcip
3879          *
3880          * REWRITE in rule, SRC=a,DST=b -> SRC=c,DST=d
3881          * - response to incoming packet (a,b)=>(c,d) (OIP_SRC=b,OIP_DST=a)
3882          * - OIP_SRC(b)=nat_newsrcip,          OIP_DST(a)=nat_newdstip
3883          *=> OIP_SRC(a)=nat_oldsrcip,          OIP_DST(c)=nat_olddstip
3884          */
3885
3886         if (((fin->fin_out == 0) && ((nat->nat_redir & NAT_MAP) != 0)) ||
3887             ((fin->fin_out == 1) && ((nat->nat_redir & NAT_REDIRECT) != 0))) {
3888                 a1.s_addr = ntohl(nat->nat_osrcaddr);
3889                 a4.s_addr = ntohl(oip->ip_src.s_addr);
3890                 a3.s_addr = ntohl(nat->nat_odstaddr);
3891                 a2.s_addr = ntohl(oip->ip_dst.s_addr);
3892                 oip->ip_src.s_addr = htonl(a1.s_addr);
3893                 oip->ip_dst.s_addr = htonl(a3.s_addr);
3894                 odst = 1;
3895         } else {
3896                 a1.s_addr = ntohl(nat->nat_ndstaddr);
3897                 a2.s_addr = ntohl(oip->ip_dst.s_addr);
3898                 a3.s_addr = ntohl(nat->nat_nsrcaddr);
3899                 a4.s_addr = ntohl(oip->ip_src.s_addr);
3900                 oip->ip_dst.s_addr = htonl(a3.s_addr);
3901                 oip->ip_src.s_addr = htonl(a1.s_addr);
3902                 odst = 0;
3903         }
3904         sum1 = 0;
3905         sum2 = 0;
3906         sumd = 0;
3907         CALC_SUMD(a2.s_addr, a3.s_addr, sum1);
3908         CALC_SUMD(a4.s_addr, a1.s_addr, sum2);
3909         sumd = sum2 + sum1;
3910         if (sumd != 0)
3911                 ipf_fix_datacksum(&oip->ip_sum, sumd);
3912
3913         sumd2 = sumd;
3914         sum1 = 0;
3915         sum2 = 0;
3916
3917         /*
3918          * Fix UDP pseudo header checksum to compensate for the
3919          * IP address change.
3920          */
3921         if (((flags & IPN_TCPUDP) != 0) && (dlen >= 4)) {
3922                 u_32_t sum3, sum4, sumt;
3923
3924                 /*
3925                  * Step 2 :
3926                  * For offending TCP/UDP IP packets, translate the ports as
3927                  * well, based on the NAT specification. Of course such
3928                  * a change may be reflected in the ICMP checksum as well.
3929                  *
3930                  * Since the port fields are part of the TCP/UDP checksum
3931                  * of the offending IP packet, you need to adjust that checksum
3932                  * as well... except that the change in the port numbers should
3933                  * be offset by the checksum change.  However, the TCP/UDP
3934                  * checksum will also need to change if there has been an
3935                  * IP address change.
3936                  */
3937                 if (odst == 1) {
3938                         sum1 = ntohs(nat->nat_osport);
3939                         sum4 = ntohs(tcp->th_sport);
3940                         sum3 = ntohs(nat->nat_odport);
3941                         sum2 = ntohs(tcp->th_dport);
3942
3943                         tcp->th_sport = htons(sum1);
3944                         tcp->th_dport = htons(sum3);
3945                 } else {
3946                         sum1 = ntohs(nat->nat_ndport);
3947                         sum2 = ntohs(tcp->th_dport);
3948                         sum3 = ntohs(nat->nat_nsport);
3949                         sum4 = ntohs(tcp->th_sport);
3950
3951                         tcp->th_dport = htons(sum3);
3952                         tcp->th_sport = htons(sum1);
3953                 }
3954                 CALC_SUMD(sum4, sum1, sumt);
3955                 sumd += sumt;
3956                 CALC_SUMD(sum2, sum3, sumt);
3957                 sumd += sumt;
3958
3959                 if (sumd != 0 || sumd2 != 0) {
3960                         /*
3961                          * At this point, sumd is the delta to apply to the
3962                          * TCP/UDP header, given the changes in both the IP
3963                          * address and the ports and sumd2 is the delta to
3964                          * apply to the ICMP header, given the IP address
3965                          * change delta that may need to be applied to the
3966                          * TCP/UDP checksum instead.
3967                          *
3968                          * If we will both the IP and TCP/UDP checksums
3969                          * then the ICMP checksum changes by the address
3970                          * delta applied to the TCP/UDP checksum.  If we
3971                          * do not change the TCP/UDP checksum them we
3972                          * apply the delta in ports to the ICMP checksum.
3973                          */
3974                         if (oip->ip_p == IPPROTO_UDP) {
3975                                 if ((dlen >= 8) && (*csump != 0)) {
3976                                         ipf_fix_datacksum(csump, sumd);
3977                                 } else {
3978                                         CALC_SUMD(sum1, sum4, sumd2);
3979                                         CALC_SUMD(sum3, sum2, sumt);
3980                                         sumd2 += sumt;
3981                                 }
3982                         } else if (oip->ip_p == IPPROTO_TCP) {
3983                                 if (dlen >= 18) {
3984                                         ipf_fix_datacksum(csump, sumd);
3985                                 } else {
3986                                         CALC_SUMD(sum1, sum4, sumd2);
3987                                         CALC_SUMD(sum3, sum2, sumt);
3988                                         sumd2 += sumt;
3989                                 }
3990                         }
3991                         if (sumd2 != 0) {
3992                                 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3993                                 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3994                                 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3995                                 ipf_fix_incksum(0, &icmp->icmp_cksum, sumd2, 0);
3996                         }
3997                 }
3998         } else if (((flags & IPN_ICMPQUERY) != 0) && (dlen >= 8)) {
3999                 icmphdr_t *orgicmp;
4000
4001                 /*
4002                  * XXX - what if this is bogus hl and we go off the end ?
4003                  * In this case, ipf_nat_icmperrorlookup() will have
4004                  * returned NULL.
4005                  */
4006                 orgicmp = (icmphdr_t *)dp;
4007
4008                 if (odst == 1) {
4009                         if (orgicmp->icmp_id != nat->nat_osport) {
4010
4011                                 /*
4012                                  * Fix ICMP checksum (of the offening ICMP
4013                                  * query packet) to compensate the change
4014                                  * in the ICMP id of the offending ICMP
4015                                  * packet.
4016                                  *
4017                                  * Since you modify orgicmp->icmp_id with
4018                                  * a delta (say x) and you compensate that
4019                                  * in origicmp->icmp_cksum with a delta
4020                                  * minus x, you don't have to adjust the
4021                                  * overall icmp->icmp_cksum
4022                                  */
4023                                 sum1 = ntohs(orgicmp->icmp_id);
4024                                 sum2 = ntohs(nat->nat_oicmpid);
4025                                 CALC_SUMD(sum1, sum2, sumd);
4026                                 orgicmp->icmp_id = nat->nat_oicmpid;
4027                                 ipf_fix_datacksum(&orgicmp->icmp_cksum, sumd);
4028                         }
4029                 } /* nat_dir == NAT_INBOUND is impossible for icmp queries */
4030         }
4031         return nat;
4032 }
4033
4034
4035 /*
4036  *       MAP-IN    MAP-OUT   RDR-IN   RDR-OUT
4037  * osrc    X       == src    == src      X
4038  * odst    X       == dst    == dst      X
4039  * nsrc  == dst      X         X      == dst
4040  * ndst  == src      X         X      == src
4041  * MAP = NAT_OUTBOUND, RDR = NAT_INBOUND
4042  */
4043 /*
4044  * NB: these lookups don't lock access to the list, it assumed that it has
4045  * already been done!
4046  */
4047 /* ------------------------------------------------------------------------ */
4048 /* Function:    ipf_nat_inlookup                                            */
4049 /* Returns:     nat_t* - NULL == no match,                                  */
4050 /*                       else pointer to matching NAT entry                 */
4051 /* Parameters:  fin(I)    - pointer to packet information                   */
4052 /*              flags(I)  - NAT flags for this packet                       */
4053 /*              p(I)      - protocol for this packet                        */
4054 /*              src(I)    - source IP address                               */
4055 /*              mapdst(I) - destination IP address                          */
4056 /*                                                                          */
4057 /* Lookup a nat entry based on the mapped destination ip address/port and   */
4058 /* real source address/port.  We use this lookup when receiving a packet,   */
4059 /* we're looking for a table entry, based on the destination address.       */
4060 /*                                                                          */
4061 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY.         */
4062 /*                                                                          */
4063 /* NOTE: IT IS ASSUMED THAT  IS ONLY HELD WITH A READ LOCK WHEN             */
4064 /*       THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags.             */
4065 /*                                                                          */
4066 /* flags   -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if   */
4067 /*            the packet is of said protocol                                */
4068 /* ------------------------------------------------------------------------ */
4069 nat_t *
4070 ipf_nat_inlookup(fin, flags, p, src, mapdst)
4071         fr_info_t *fin;
4072         u_int flags, p;
4073         struct in_addr src , mapdst;
4074 {
4075         ipf_main_softc_t *softc = fin->fin_main_soft;
4076         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4077         u_short sport, dport;
4078         grehdr_t *gre;
4079         ipnat_t *ipn;
4080         u_int sflags;
4081         nat_t *nat;
4082         int nflags;
4083         u_32_t dst;
4084         void *ifp;
4085         u_int hv, rhv;
4086
4087         ifp = fin->fin_ifp;
4088         gre = NULL;
4089         dst = mapdst.s_addr;
4090         sflags = flags & NAT_TCPUDPICMP;
4091
4092         switch (p)
4093         {
4094         case IPPROTO_TCP :
4095         case IPPROTO_UDP :
4096                 sport = htons(fin->fin_data[0]);
4097                 dport = htons(fin->fin_data[1]);
4098                 break;
4099         case IPPROTO_ICMP :
4100                 sport = 0;
4101                 dport = fin->fin_data[1];
4102                 break;
4103         default :
4104                 sport = 0;
4105                 dport = 0;
4106                 break;
4107         }
4108
4109
4110         if ((flags & SI_WILDP) != 0)
4111                 goto find_in_wild_ports;
4112
4113         rhv = NAT_HASH_FN(dst, dport, 0xffffffff);
4114         rhv = NAT_HASH_FN(src.s_addr, rhv + sport, 0xffffffff);
4115         hv = rhv % softn->ipf_nat_table_sz;
4116         nat = softn->ipf_nat_table[1][hv];
4117         /* TRACE dst, dport, src, sport, hv, nat */
4118
4119         for (; nat; nat = nat->nat_hnext[1]) {
4120                 if (nat->nat_ifps[0] != NULL) {
4121                         if ((ifp != NULL) && (ifp != nat->nat_ifps[0]))
4122                                 continue;
4123                 }
4124
4125                 if (nat->nat_pr[0] != p)
4126                         continue;
4127
4128                 switch (nat->nat_dir)
4129                 {
4130                 case NAT_INBOUND :
4131                 case NAT_DIVERTIN :
4132                         if (nat->nat_v[0] != 4)
4133                                 continue;
4134                         if (nat->nat_osrcaddr != src.s_addr ||
4135                             nat->nat_odstaddr != dst)
4136                                 continue;
4137                         if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4138                                 if (nat->nat_osport != sport)
4139                                         continue;
4140                                 if (nat->nat_odport != dport)
4141                                         continue;
4142
4143                         } else if (p == IPPROTO_ICMP) {
4144                                 if (nat->nat_osport != dport) {
4145                                         continue;
4146                                 }
4147                         }
4148                         break;
4149                 case NAT_DIVERTOUT :
4150                         if (nat->nat_dlocal)
4151                                 continue;
4152                 case NAT_OUTBOUND :
4153                         if (nat->nat_v[1] != 4)
4154                                 continue;
4155                         if (nat->nat_dlocal)
4156                                 continue;
4157                         if (nat->nat_dlocal)
4158                                 continue;
4159                         if (nat->nat_ndstaddr != src.s_addr ||
4160                             nat->nat_nsrcaddr != dst)
4161                                 continue;
4162                         if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4163                                 if (nat->nat_ndport != sport)
4164                                         continue;
4165                                 if (nat->nat_nsport != dport)
4166                                         continue;
4167
4168                         } else if (p == IPPROTO_ICMP) {
4169                                 if (nat->nat_osport != dport) {
4170                                         continue;
4171                                 }
4172                         }
4173                         break;
4174                 }
4175
4176
4177                 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4178                         ipn = nat->nat_ptr;
4179                         if ((ipn != NULL) && (nat->nat_aps != NULL))
4180                                 if (ipf_proxy_match(fin, nat) != 0)
4181                                         continue;
4182                 }
4183                 if ((nat->nat_ifps[0] == NULL) && (ifp != NULL)) {
4184                         nat->nat_ifps[0] = ifp;
4185                         nat->nat_mtu[0] = GETIFMTU_4(ifp);
4186                 }
4187                 return nat;
4188         }
4189
4190         /*
4191          * So if we didn't find it but there are wildcard members in the hash
4192          * table, go back and look for them.  We do this search and update here
4193          * because it is modifying the NAT table and we want to do this only
4194          * for the first packet that matches.  The exception, of course, is
4195          * for "dummy" (FI_IGNORE) lookups.
4196          */
4197 find_in_wild_ports:
4198         if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) {
4199                 NBUMPSIDEX(0, ns_lookup_miss, ns_lookup_miss_0);
4200                 return NULL;
4201         }
4202         if (softn->ipf_nat_stats.ns_wilds == 0 || (fin->fin_flx & FI_NOWILD)) {
4203                 NBUMPSIDEX(0, ns_lookup_nowild, ns_lookup_nowild_0);
4204                 return NULL;
4205         }
4206
4207         RWLOCK_EXIT(&softc->ipf_nat);
4208
4209         hv = NAT_HASH_FN(dst, 0, 0xffffffff);
4210         hv = NAT_HASH_FN(src.s_addr, hv, softn->ipf_nat_table_sz);
4211         WRITE_ENTER(&softc->ipf_nat);
4212
4213         nat = softn->ipf_nat_table[1][hv];
4214         /* TRACE dst, src, hv, nat */
4215         for (; nat; nat = nat->nat_hnext[1]) {
4216                 if (nat->nat_ifps[0] != NULL) {
4217                         if ((ifp != NULL) && (ifp != nat->nat_ifps[0]))
4218                                 continue;
4219                 }
4220
4221                 if (nat->nat_pr[0] != fin->fin_p)
4222                         continue;
4223
4224                 switch (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND))
4225                 {
4226                 case NAT_INBOUND :
4227                         if (nat->nat_v[0] != 4)
4228                                 continue;
4229                         if (nat->nat_osrcaddr != src.s_addr ||
4230                             nat->nat_odstaddr != dst)
4231                                 continue;
4232                         break;
4233                 case NAT_OUTBOUND :
4234                         if (nat->nat_v[1] != 4)
4235                                 continue;
4236                         if (nat->nat_ndstaddr != src.s_addr ||
4237                             nat->nat_nsrcaddr != dst)
4238                                 continue;
4239                         break;
4240                 }
4241
4242                 nflags = nat->nat_flags;
4243                 if (!(nflags & (NAT_TCPUDP|SI_WILDP)))
4244                         continue;
4245
4246                 if (ipf_nat_wildok(nat, (int)sport, (int)dport, nflags,
4247                                    NAT_INBOUND) == 1) {
4248                         if ((fin->fin_flx & FI_IGNORE) != 0)
4249                                 break;
4250                         if ((nflags & SI_CLONE) != 0) {
4251                                 nat = ipf_nat_clone(fin, nat);
4252                                 if (nat == NULL)
4253                                         break;
4254                         } else {
4255                                 MUTEX_ENTER(&softn->ipf_nat_new);
4256                                 softn->ipf_nat_stats.ns_wilds--;
4257                                 MUTEX_EXIT(&softn->ipf_nat_new);
4258                         }
4259
4260                         if (nat->nat_dir == NAT_INBOUND) {
4261                                 if (nat->nat_osport == 0) {
4262                                         nat->nat_osport = sport;
4263                                         nat->nat_nsport = sport;
4264                                 }
4265                                 if (nat->nat_odport == 0) {
4266                                         nat->nat_odport = dport;
4267                                         nat->nat_ndport = dport;
4268                                 }
4269                         } else if (nat->nat_dir == NAT_OUTBOUND) {
4270                                 if (nat->nat_osport == 0) {
4271                                         nat->nat_osport = dport;
4272                                         nat->nat_nsport = dport;
4273                                 }
4274                                 if (nat->nat_odport == 0) {
4275                                         nat->nat_odport = sport;
4276                                         nat->nat_ndport = sport;
4277                                 }
4278                         }
4279                         if ((nat->nat_ifps[0] == NULL) && (ifp != NULL)) {
4280                                 nat->nat_ifps[0] = ifp;
4281                                 nat->nat_mtu[0] = GETIFMTU_4(ifp);
4282                         }
4283                         nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT);
4284                         ipf_nat_tabmove(softn, nat);
4285                         break;
4286                 }
4287         }
4288
4289         MUTEX_DOWNGRADE(&softc->ipf_nat);
4290
4291         if (nat == NULL) {
4292                 NBUMPSIDE(0, ns_lookup_miss);
4293         }
4294         return nat;
4295 }
4296
4297
4298 /* ------------------------------------------------------------------------ */
4299 /* Function:    ipf_nat_tabmove                                             */
4300 /* Returns:     Nil                                                         */
4301 /* Parameters:  softn(I) - pointer to NAT context structure                 */
4302 /*              nat(I)   - pointer to NAT structure                         */
4303 /* Write Lock:  ipf_nat                                                     */
4304 /*                                                                          */
4305 /* This function is only called for TCP/UDP NAT table entries where the     */
4306 /* original was placed in the table without hashing on the ports and we now */
4307 /* want to include hashing on port numbers.                                 */
4308 /* ------------------------------------------------------------------------ */
4309 static void
4310 ipf_nat_tabmove(softn, nat)
4311         ipf_nat_softc_t *softn;
4312         nat_t *nat;
4313 {
4314         u_int hv0, hv1, rhv0, rhv1;
4315         natstat_t *nsp;
4316         nat_t **natp;
4317
4318         if (nat->nat_flags & SI_CLONE)
4319                 return;
4320
4321         nsp = &softn->ipf_nat_stats;
4322         /*
4323          * Remove the NAT entry from the old location
4324          */
4325         if (nat->nat_hnext[0])
4326                 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
4327         *nat->nat_phnext[0] = nat->nat_hnext[0];
4328         nsp->ns_side[0].ns_bucketlen[nat->nat_hv[0] %
4329                                      softn->ipf_nat_table_sz]--;
4330
4331         if (nat->nat_hnext[1])
4332                 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
4333         *nat->nat_phnext[1] = nat->nat_hnext[1];
4334         nsp->ns_side[1].ns_bucketlen[nat->nat_hv[1] %
4335                                      softn->ipf_nat_table_sz]--;
4336
4337         /*
4338          * Add into the NAT table in the new position
4339          */
4340         rhv0 = NAT_HASH_FN(nat->nat_osrcaddr, nat->nat_osport, 0xffffffff);
4341         rhv0 = NAT_HASH_FN(nat->nat_odstaddr, rhv0 + nat->nat_odport,
4342                            0xffffffff);
4343         rhv1 = NAT_HASH_FN(nat->nat_nsrcaddr, nat->nat_nsport, 0xffffffff);
4344         rhv1 = NAT_HASH_FN(nat->nat_ndstaddr, rhv1 + nat->nat_ndport,
4345                            0xffffffff);
4346
4347         hv0 = rhv0 % softn->ipf_nat_table_sz;
4348         hv1 = rhv1 % softn->ipf_nat_table_sz;
4349
4350         if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) {
4351                 u_int swap;
4352
4353                 swap = hv0;
4354                 hv0 = hv1;
4355                 hv1 = swap;
4356         }
4357
4358         /* TRACE nat_osrcaddr, nat_osport, nat_odstaddr, nat_odport, hv0 */
4359         /* TRACE nat_nsrcaddr, nat_nsport, nat_ndstaddr, nat_ndport, hv1 */
4360
4361         nat->nat_hv[0] = rhv0;
4362         natp = &softn->ipf_nat_table[0][hv0];
4363         if (*natp)
4364                 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
4365         nat->nat_phnext[0] = natp;
4366         nat->nat_hnext[0] = *natp;
4367         *natp = nat;
4368         nsp->ns_side[0].ns_bucketlen[hv0]++;
4369
4370         nat->nat_hv[1] = rhv1;
4371         natp = &softn->ipf_nat_table[1][hv1];
4372         if (*natp)
4373                 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
4374         nat->nat_phnext[1] = natp;
4375         nat->nat_hnext[1] = *natp;
4376         *natp = nat;
4377         nsp->ns_side[1].ns_bucketlen[hv1]++;
4378 }
4379
4380
4381 /* ------------------------------------------------------------------------ */
4382 /* Function:    ipf_nat_outlookup                                           */
4383 /* Returns:     nat_t* - NULL == no match,                                  */
4384 /*                       else pointer to matching NAT entry                 */
4385 /* Parameters:  fin(I)   - pointer to packet information                    */
4386 /*              flags(I) - NAT flags for this packet                        */
4387 /*              p(I)     - protocol for this packet                         */
4388 /*              src(I)   - source IP address                                */
4389 /*              dst(I)   - destination IP address                           */
4390 /*              rw(I)    - 1 == write lock on  held, 0 == read lock.        */
4391 /*                                                                          */
4392 /* Lookup a nat entry based on the source 'real' ip address/port and        */
4393 /* destination address/port.  We use this lookup when sending a packet out, */
4394 /* we're looking for a table entry, based on the source address.            */
4395 /*                                                                          */
4396 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY.         */
4397 /*                                                                          */
4398 /* NOTE: IT IS ASSUMED THAT  IS ONLY HELD WITH A READ LOCK WHEN             */
4399 /*       THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags.             */
4400 /*                                                                          */
4401 /* flags   -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if   */
4402 /*            the packet is of said protocol                                */
4403 /* ------------------------------------------------------------------------ */
4404 nat_t *
4405 ipf_nat_outlookup(fin, flags, p, src, dst)
4406         fr_info_t *fin;
4407         u_int flags, p;
4408         struct in_addr src , dst;
4409 {
4410         ipf_main_softc_t *softc = fin->fin_main_soft;
4411         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4412         u_short sport, dport;
4413         u_int sflags;
4414         ipnat_t *ipn;
4415         nat_t *nat;
4416         void *ifp;
4417         u_int hv;
4418
4419         ifp = fin->fin_ifp;
4420         sflags = flags & IPN_TCPUDPICMP;
4421
4422         switch (p)
4423         {
4424         case IPPROTO_TCP :
4425         case IPPROTO_UDP :
4426                 sport = htons(fin->fin_data[0]);
4427                 dport = htons(fin->fin_data[1]);
4428                 break;
4429         case IPPROTO_ICMP :
4430                 sport = 0;
4431                 dport = fin->fin_data[1];
4432                 break;
4433         default :
4434                 sport = 0;
4435                 dport = 0;
4436                 break;
4437         }
4438
4439         if ((flags & SI_WILDP) != 0)
4440                 goto find_out_wild_ports;
4441
4442         hv = NAT_HASH_FN(src.s_addr, sport, 0xffffffff);
4443         hv = NAT_HASH_FN(dst.s_addr, hv + dport, softn->ipf_nat_table_sz);
4444         nat = softn->ipf_nat_table[0][hv];
4445
4446         /* TRACE src, sport, dst, dport, hv, nat */
4447
4448         for (; nat; nat = nat->nat_hnext[0]) {
4449                 if (nat->nat_ifps[1] != NULL) {
4450                         if ((ifp != NULL) && (ifp != nat->nat_ifps[1]))
4451                                 continue;
4452                 }
4453
4454                 if (nat->nat_pr[1] != p)
4455                         continue;
4456
4457                 switch (nat->nat_dir)
4458                 {
4459                 case NAT_INBOUND :
4460                 case NAT_DIVERTIN :
4461                         if (nat->nat_v[1] != 4)
4462                                 continue;
4463                         if (nat->nat_ndstaddr != src.s_addr ||
4464                             nat->nat_nsrcaddr != dst.s_addr)
4465                                 continue;
4466
4467                         if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4468                                 if (nat->nat_ndport != sport)
4469                                         continue;
4470                                 if (nat->nat_nsport != dport)
4471                                         continue;
4472
4473                         } else if (p == IPPROTO_ICMP) {
4474                                 if (nat->nat_osport != dport) {
4475                                         continue;
4476                                 }
4477                         }
4478                         break;
4479                 case NAT_OUTBOUND :
4480                 case NAT_DIVERTOUT :
4481                         if (nat->nat_v[0] != 4)
4482                                 continue;
4483                         if (nat->nat_osrcaddr != src.s_addr ||
4484                             nat->nat_odstaddr != dst.s_addr)
4485                                 continue;
4486
4487                         if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4488                                 if (nat->nat_odport != dport)
4489                                         continue;
4490                                 if (nat->nat_osport != sport)
4491                                         continue;
4492
4493                         } else if (p == IPPROTO_ICMP) {
4494                                 if (nat->nat_osport != dport) {
4495                                         continue;
4496                                 }
4497                         }
4498                         break;
4499                 }
4500
4501                 ipn = nat->nat_ptr;
4502                 if ((ipn != NULL) && (nat->nat_aps != NULL))
4503                         if (ipf_proxy_match(fin, nat) != 0)
4504                                 continue;
4505
4506                 if ((nat->nat_ifps[1] == NULL) && (ifp != NULL)) {
4507                         nat->nat_ifps[1] = ifp;
4508                         nat->nat_mtu[1] = GETIFMTU_4(ifp);
4509                 }
4510                 return nat;
4511         }
4512
4513         /*
4514          * So if we didn't find it but there are wildcard members in the hash
4515          * table, go back and look for them.  We do this search and update here
4516          * because it is modifying the NAT table and we want to do this only
4517          * for the first packet that matches.  The exception, of course, is
4518          * for "dummy" (FI_IGNORE) lookups.
4519          */
4520 find_out_wild_ports:
4521         if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) {
4522                 NBUMPSIDEX(1, ns_lookup_miss, ns_lookup_miss_1);
4523                 return NULL;
4524         }
4525         if (softn->ipf_nat_stats.ns_wilds == 0 || (fin->fin_flx & FI_NOWILD)) {
4526                 NBUMPSIDEX(1, ns_lookup_nowild, ns_lookup_nowild_1);
4527                 return NULL;
4528         }
4529
4530         RWLOCK_EXIT(&softc->ipf_nat);
4531
4532         hv = NAT_HASH_FN(src.s_addr, 0, 0xffffffff);
4533         hv = NAT_HASH_FN(dst.s_addr, hv, softn->ipf_nat_table_sz);
4534
4535         WRITE_ENTER(&softc->ipf_nat);
4536
4537         nat = softn->ipf_nat_table[0][hv];
4538         for (; nat; nat = nat->nat_hnext[0]) {
4539                 if (nat->nat_ifps[1] != NULL) {
4540                         if ((ifp != NULL) && (ifp != nat->nat_ifps[1]))
4541                                 continue;
4542                 }
4543
4544                 if (nat->nat_pr[1] != fin->fin_p)
4545                         continue;
4546
4547                 switch (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND))
4548                 {
4549                 case NAT_INBOUND :
4550                         if (nat->nat_v[1] != 4)
4551                                 continue;
4552                         if (nat->nat_ndstaddr != src.s_addr ||
4553                             nat->nat_nsrcaddr != dst.s_addr)
4554                                 continue;
4555                         break;
4556                 case NAT_OUTBOUND :
4557                         if (nat->nat_v[0] != 4)
4558                                 continue;
4559                         if (nat->nat_osrcaddr != src.s_addr ||
4560                             nat->nat_odstaddr != dst.s_addr)
4561                                 continue;
4562                         break;
4563                 }
4564
4565                 if (!(nat->nat_flags & (NAT_TCPUDP|SI_WILDP)))
4566                         continue;
4567
4568                 if (ipf_nat_wildok(nat, (int)sport, (int)dport, nat->nat_flags,
4569                                    NAT_OUTBOUND) == 1) {
4570                         if ((fin->fin_flx & FI_IGNORE) != 0)
4571                                 break;
4572                         if ((nat->nat_flags & SI_CLONE) != 0) {
4573                                 nat = ipf_nat_clone(fin, nat);
4574                                 if (nat == NULL)
4575                                         break;
4576                         } else {
4577                                 MUTEX_ENTER(&softn->ipf_nat_new);
4578                                 softn->ipf_nat_stats.ns_wilds--;
4579                                 MUTEX_EXIT(&softn->ipf_nat_new);
4580                         }
4581
4582                         if (nat->nat_dir == NAT_OUTBOUND) {
4583                                 if (nat->nat_osport == 0) {
4584                                         nat->nat_osport = sport;
4585                                         nat->nat_nsport = sport;
4586                                 }
4587                                 if (nat->nat_odport == 0) {
4588                                         nat->nat_odport = dport;
4589                                         nat->nat_ndport = dport;
4590                                 }
4591                         } else if (nat->nat_dir == NAT_INBOUND) {
4592                                 if (nat->nat_osport == 0) {
4593                                         nat->nat_osport = dport;
4594                                         nat->nat_nsport = dport;
4595                                 }
4596                                 if (nat->nat_odport == 0) {
4597                                         nat->nat_odport = sport;
4598                                         nat->nat_ndport = sport;
4599                                 }
4600                         }
4601                         if ((nat->nat_ifps[1] == NULL) && (ifp != NULL)) {
4602                                 nat->nat_ifps[1] = ifp;
4603                                 nat->nat_mtu[1] = GETIFMTU_4(ifp);
4604                         }
4605                         nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT);
4606                         ipf_nat_tabmove(softn, nat);
4607                         break;
4608                 }
4609         }
4610
4611         MUTEX_DOWNGRADE(&softc->ipf_nat);
4612
4613         if (nat == NULL) {
4614                 NBUMPSIDE(1, ns_lookup_miss);
4615         }
4616         return nat;
4617 }
4618
4619
4620 /* ------------------------------------------------------------------------ */
4621 /* Function:    ipf_nat_lookupredir                                         */
4622 /* Returns:     nat_t* - NULL == no match,                                  */
4623 /*                       else pointer to matching NAT entry                 */
4624 /* Parameters:  np(I) - pointer to description of packet to find NAT table  */
4625 /*                      entry for.                                          */
4626 /*                                                                          */
4627 /* Lookup the NAT tables to search for a matching redirect                  */
4628 /* The contents of natlookup_t should imitate those found in a packet that  */
4629 /* would be translated - ie a packet coming in for RDR or going out for MAP.*/
4630 /* We can do the lookup in one of two ways, imitating an inbound or         */
4631 /* outbound  packet.  By default we assume outbound, unless IPN_IN is set.  */
4632 /* For IN, the fields are set as follows:                                   */
4633 /*     nl_real* = source information                                        */
4634 /*     nl_out* = destination information (translated)                       */
4635 /* For an out packet, the fields are set like this:                         */
4636 /*     nl_in* = source information (untranslated)                           */
4637 /*     nl_out* = destination information (translated)                       */
4638 /* ------------------------------------------------------------------------ */
4639 nat_t *
4640 ipf_nat_lookupredir(np)
4641         natlookup_t *np;
4642 {
4643         fr_info_t fi;
4644         nat_t *nat;
4645
4646         bzero((char *)&fi, sizeof(fi));
4647         if (np->nl_flags & IPN_IN) {
4648                 fi.fin_data[0] = ntohs(np->nl_realport);
4649                 fi.fin_data[1] = ntohs(np->nl_outport);
4650         } else {
4651                 fi.fin_data[0] = ntohs(np->nl_inport);
4652                 fi.fin_data[1] = ntohs(np->nl_outport);
4653         }
4654         if (np->nl_flags & IPN_TCP)
4655                 fi.fin_p = IPPROTO_TCP;
4656         else if (np->nl_flags & IPN_UDP)
4657                 fi.fin_p = IPPROTO_UDP;
4658         else if (np->nl_flags & (IPN_ICMPERR|IPN_ICMPQUERY))
4659                 fi.fin_p = IPPROTO_ICMP;
4660
4661         /*
4662          * We can do two sorts of lookups:
4663          * - IPN_IN: we have the `real' and `out' address, look for `in'.
4664          * - default: we have the `in' and `out' address, look for `real'.
4665          */
4666         if (np->nl_flags & IPN_IN) {
4667                 if ((nat = ipf_nat_inlookup(&fi, np->nl_flags, fi.fin_p,
4668                                             np->nl_realip, np->nl_outip))) {
4669                         np->nl_inip = nat->nat_odstip;
4670                         np->nl_inport = nat->nat_odport;
4671                 }
4672         } else {
4673                 /*
4674                  * If nl_inip is non null, this is a lookup based on the real
4675                  * ip address. Else, we use the fake.
4676                  */
4677                 if ((nat = ipf_nat_outlookup(&fi, np->nl_flags, fi.fin_p,
4678                                          np->nl_inip, np->nl_outip))) {
4679
4680                         if ((np->nl_flags & IPN_FINDFORWARD) != 0) {
4681                                 fr_info_t fin;
4682                                 bzero((char *)&fin, sizeof(fin));
4683                                 fin.fin_p = nat->nat_pr[0];
4684                                 fin.fin_data[0] = ntohs(nat->nat_ndport);
4685                                 fin.fin_data[1] = ntohs(nat->nat_nsport);
4686                                 if (ipf_nat_inlookup(&fin, np->nl_flags,
4687                                                      fin.fin_p, nat->nat_ndstip,
4688                                                      nat->nat_nsrcip) != NULL) {
4689                                         np->nl_flags &= ~IPN_FINDFORWARD;
4690                                 }
4691                         }
4692
4693                         np->nl_realip = nat->nat_odstip;
4694                         np->nl_realport = nat->nat_odport;
4695                 }
4696         }
4697
4698         return nat;
4699 }
4700
4701
4702 /* ------------------------------------------------------------------------ */
4703 /* Function:    ipf_nat_match                                               */
4704 /* Returns:     int - 0 == no match, 1 == match                             */
4705 /* Parameters:  fin(I)   - pointer to packet information                    */
4706 /*              np(I)    - pointer to NAT rule                              */
4707 /*                                                                          */
4708 /* Pull the matching of a packet against a NAT rule out of that complex     */
4709 /* loop inside ipf_nat_checkin() and lay it out properly in its own function. */
4710 /* ------------------------------------------------------------------------ */
4711 static int
4712 ipf_nat_match(fin, np)
4713         fr_info_t *fin;
4714         ipnat_t *np;
4715 {
4716         ipf_main_softc_t *softc = fin->fin_main_soft;
4717         frtuc_t *ft;
4718         int match;
4719
4720         match = 0;
4721         switch (np->in_osrcatype)
4722         {
4723         case FRI_NORMAL :
4724                 match = ((fin->fin_saddr & np->in_osrcmsk) != np->in_osrcaddr);
4725                 break;
4726         case FRI_LOOKUP :
4727                 match = (*np->in_osrcfunc)(softc, np->in_osrcptr,
4728                                            4, &fin->fin_saddr, fin->fin_plen);
4729                 break;
4730         }
4731         match ^= ((np->in_flags & IPN_NOTSRC) != 0);
4732         if (match)
4733                 return 0;
4734
4735         match = 0;
4736         switch (np->in_odstatype)
4737         {
4738         case FRI_NORMAL :
4739                 match = ((fin->fin_daddr & np->in_odstmsk) != np->in_odstaddr);
4740                 break;
4741         case FRI_LOOKUP :
4742                 match = (*np->in_odstfunc)(softc, np->in_odstptr,
4743                                            4, &fin->fin_daddr, fin->fin_plen);
4744                 break;
4745         }
4746
4747         match ^= ((np->in_flags & IPN_NOTDST) != 0);
4748         if (match)
4749                 return 0;
4750
4751         ft = &np->in_tuc;
4752         if (!(fin->fin_flx & FI_TCPUDP) ||
4753             (fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) {
4754                 if (ft->ftu_scmp || ft->ftu_dcmp)
4755                         return 0;
4756                 return 1;
4757         }
4758
4759         return ipf_tcpudpchk(&fin->fin_fi, ft);
4760 }
4761
4762
4763 /* ------------------------------------------------------------------------ */
4764 /* Function:    ipf_nat_update                                              */
4765 /* Returns:     Nil                                                         */
4766 /* Parameters:  fin(I) - pointer to packet information                      */
4767 /*              nat(I) - pointer to NAT structure                           */
4768 /*                                                                          */
4769 /* Updates the lifetime of a NAT table entry for non-TCP packets.  Must be  */
4770 /* called with fin_rev updated - i.e. after calling ipf_nat_proto().        */
4771 /*                                                                          */
4772 /* This *MUST* be called after ipf_nat_proto() as it expects fin_rev to     */
4773 /* already be set.                                                          */
4774 /* ------------------------------------------------------------------------ */
4775 void
4776 ipf_nat_update(fin, nat)
4777         fr_info_t *fin;
4778         nat_t *nat;
4779 {
4780         ipf_main_softc_t *softc = fin->fin_main_soft;
4781         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4782         ipftq_t *ifq, *ifq2;
4783         ipftqent_t *tqe;
4784         ipnat_t *np = nat->nat_ptr;
4785
4786         tqe = &nat->nat_tqe;
4787         ifq = tqe->tqe_ifq;
4788
4789         /*
4790          * We allow over-riding of NAT timeouts from NAT rules, even for
4791          * TCP, however, if it is TCP and there is no rule timeout set,
4792          * then do not update the timeout here.
4793          */
4794         if (np != NULL) {
4795                 np->in_bytes[fin->fin_rev] += fin->fin_plen;
4796                 ifq2 = np->in_tqehead[fin->fin_rev];
4797         } else {
4798                 ifq2 = NULL;
4799         }
4800
4801         if (nat->nat_pr[0] == IPPROTO_TCP && ifq2 == NULL) {
4802                 (void) ipf_tcp_age(&nat->nat_tqe, fin, softn->ipf_nat_tcptq,
4803                                    0, 2);
4804         } else {
4805                 if (ifq2 == NULL) {
4806                         if (nat->nat_pr[0] == IPPROTO_UDP)
4807                                 ifq2 = fin->fin_rev ? &softn->ipf_nat_udpacktq :
4808                                                       &softn->ipf_nat_udptq;
4809                         else if (nat->nat_pr[0] == IPPROTO_ICMP ||
4810                                  nat->nat_pr[0] == IPPROTO_ICMPV6)
4811                                 ifq2 = fin->fin_rev ? &softn->ipf_nat_icmpacktq:
4812                                                       &softn->ipf_nat_icmptq;
4813                         else
4814                                 ifq2 = &softn->ipf_nat_iptq;
4815                 }
4816
4817                 ipf_movequeue(softc->ipf_ticks, tqe, ifq, ifq2);
4818         }
4819 }
4820
4821
4822 /* ------------------------------------------------------------------------ */
4823 /* Function:    ipf_nat_checkout                                            */
4824 /* Returns:     int - -1 == packet failed NAT checks so block it,           */
4825 /*                     0 == no packet translation occurred,                 */
4826 /*                     1 == packet was successfully translated.             */
4827 /* Parameters:  fin(I)   - pointer to packet information                    */
4828 /*              passp(I) - pointer to filtering result flags                */
4829 /*                                                                          */
4830 /* Check to see if an outcoming packet should be changed.  ICMP packets are */
4831 /* first checked to see if they match an existing entry (if an error),      */
4832 /* otherwise a search of the current NAT table is made.  If neither results */
4833 /* in a match then a search for a matching NAT rule is made.  Create a new  */
4834 /* NAT entry if a we matched a NAT rule.  Lastly, actually change the       */
4835 /* packet header(s) as required.                                            */
4836 /* ------------------------------------------------------------------------ */
4837 int
4838 ipf_nat_checkout(fin, passp)
4839         fr_info_t *fin;
4840         u_32_t *passp;
4841 {
4842         ipnat_t *np = NULL, *npnext;
4843         struct ifnet *ifp, *sifp;
4844         ipf_main_softc_t *softc;
4845         ipf_nat_softc_t *softn;
4846         icmphdr_t *icmp = NULL;
4847         tcphdr_t *tcp = NULL;
4848         int rval, natfailed;
4849         u_int nflags = 0;
4850         u_32_t ipa, iph;
4851         int natadd = 1;
4852         frentry_t *fr;
4853         nat_t *nat;
4854
4855         if (fin->fin_v == 6) {
4856 #ifdef USE_INET6
4857                 return ipf_nat6_checkout(fin, passp);
4858 #else
4859                 return 0;
4860 #endif
4861         }
4862
4863         softc = fin->fin_main_soft;
4864         softn = softc->ipf_nat_soft;
4865
4866         if (softn->ipf_nat_lock != 0)
4867                 return 0;
4868         if (softn->ipf_nat_stats.ns_rules == 0 &&
4869             softn->ipf_nat_instances == NULL)
4870                 return 0;
4871
4872         natfailed = 0;
4873         fr = fin->fin_fr;
4874         sifp = fin->fin_ifp;
4875         if (fr != NULL) {
4876                 ifp = fr->fr_tifs[fin->fin_rev].fd_ptr;
4877                 if ((ifp != NULL) && (ifp != (void *)-1))
4878                         fin->fin_ifp = ifp;
4879         }
4880         ifp = fin->fin_ifp;
4881
4882         if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
4883                 switch (fin->fin_p)
4884                 {
4885                 case IPPROTO_TCP :
4886                         nflags = IPN_TCP;
4887                         break;
4888                 case IPPROTO_UDP :
4889                         nflags = IPN_UDP;
4890                         break;
4891                 case IPPROTO_ICMP :
4892                         icmp = fin->fin_dp;
4893
4894                         /*
4895                          * This is an incoming packet, so the destination is
4896                          * the icmp_id and the source port equals 0
4897                          */
4898                         if ((fin->fin_flx & FI_ICMPQUERY) != 0)
4899                                 nflags = IPN_ICMPQUERY;
4900                         break;
4901                 default :
4902                         break;
4903                 }
4904
4905                 if ((nflags & IPN_TCPUDP))
4906                         tcp = fin->fin_dp;
4907         }
4908
4909         ipa = fin->fin_saddr;
4910
4911         READ_ENTER(&softc->ipf_nat);
4912
4913         if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
4914             (nat = ipf_nat_icmperror(fin, &nflags, NAT_OUTBOUND)))
4915                 /*EMPTY*/;
4916         else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin)))
4917                 natadd = 0;
4918         else if ((nat = ipf_nat_outlookup(fin, nflags|NAT_SEARCH,
4919                                       (u_int)fin->fin_p, fin->fin_src,
4920                                       fin->fin_dst))) {
4921                 nflags = nat->nat_flags;
4922         } else if (fin->fin_off == 0) {
4923                 u_32_t hv, msk, nmsk = 0;
4924
4925                 /*
4926                  * If there is no current entry in the nat table for this IP#,
4927                  * create one for it (if there is a matching rule).
4928                  */
4929 maskloop:
4930                 msk = softn->ipf_nat_map_active_masks[nmsk];
4931                 iph = ipa & msk;
4932                 hv = NAT_HASH_FN(iph, 0, softn->ipf_nat_maprules_sz);
4933 retry_roundrobin:
4934                 for (np = softn->ipf_nat_map_rules[hv]; np; np = npnext) {
4935                         npnext = np->in_mnext;
4936                         if ((np->in_ifps[1] && (np->in_ifps[1] != ifp)))
4937                                 continue;
4938                         if (np->in_v[0] != 4)
4939                                 continue;
4940                         if (np->in_pr[1] && (np->in_pr[1] != fin->fin_p))
4941                                 continue;
4942                         if ((np->in_flags & IPN_RF) &&
4943                             !(np->in_flags & nflags))
4944                                 continue;
4945                         if (np->in_flags & IPN_FILTER) {
4946                                 switch (ipf_nat_match(fin, np))
4947                                 {
4948                                 case 0 :
4949                                         continue;
4950                                 case -1 :
4951                                         rval = -3;
4952                                         goto outmatchfail;
4953                                 case 1 :
4954                                 default :
4955                                         break;
4956                                 }
4957                         } else if ((ipa & np->in_osrcmsk) != np->in_osrcaddr)
4958                                 continue;
4959
4960                         if ((fr != NULL) &&
4961                             !ipf_matchtag(&np->in_tag, &fr->fr_nattag))
4962                                 continue;
4963
4964                         if (np->in_plabel != -1) {
4965                                 if (((np->in_flags & IPN_FILTER) == 0) &&
4966                                     (np->in_odport != fin->fin_data[1]))
4967                                         continue;
4968                                 if (ipf_proxy_ok(fin, tcp, np) == 0)
4969                                         continue;
4970                         }
4971
4972                         if (np->in_flags & IPN_NO) {
4973                                 np->in_hits++;
4974                                 break;
4975                         }
4976                         MUTEX_ENTER(&softn->ipf_nat_new);
4977                         /*
4978                          * If we've matched a round-robin rule but it has
4979                          * moved in the list since we got it, start over as
4980                          * this is now no longer correct.
4981                          */
4982                         if (npnext != np->in_mnext) {
4983                                 if ((np->in_flags & IPN_ROUNDR) != 0) {
4984                                         MUTEX_EXIT(&softn->ipf_nat_new);
4985                                         goto retry_roundrobin;
4986                                 }
4987                                 npnext = np->in_mnext;
4988                         }
4989
4990                         nat = ipf_nat_add(fin, np, NULL, nflags, NAT_OUTBOUND);
4991                         MUTEX_EXIT(&softn->ipf_nat_new);
4992                         if (nat != NULL) {
4993                                 natfailed = 0;
4994                                 break;
4995                         }
4996                         natfailed = -2;
4997                 }
4998                 if ((np == NULL) && (nmsk < softn->ipf_nat_map_max)) {
4999                         nmsk++;
5000                         goto maskloop;
5001                 }
5002         }
5003
5004         if (nat != NULL) {
5005                 rval = ipf_nat_out(fin, nat, natadd, nflags);
5006                 if (rval == 1) {
5007                         MUTEX_ENTER(&nat->nat_lock);
5008                         ipf_nat_update(fin, nat);
5009                         nat->nat_bytes[1] += fin->fin_plen;
5010                         nat->nat_pkts[1]++;
5011                         fin->fin_pktnum = nat->nat_pkts[1];
5012                         MUTEX_EXIT(&nat->nat_lock);
5013                 }
5014         } else
5015                 rval = natfailed;
5016 outmatchfail:
5017         RWLOCK_EXIT(&softc->ipf_nat);
5018
5019         switch (rval)
5020         {
5021         case -3 :
5022                 /* ipf_nat_match() failure */
5023                 /* FALLTHROUGH */
5024         case -2 :
5025                 /* retry_roundrobin loop failure */
5026                 /* FALLTHROUGH */
5027         case -1 :
5028                 /* proxy failure detected by ipf_nat_out() */
5029                 if (passp != NULL) {
5030                         DT2(frb_natv4out, fr_info_t *, fin, int, rval);
5031                         NBUMPSIDED(1, ns_drop);
5032                         *passp = FR_BLOCK;
5033                         fin->fin_reason = FRB_NATV4;
5034                 }
5035                 fin->fin_flx |= FI_BADNAT;
5036                 NBUMPSIDED(1, ns_badnat);
5037                 rval = -1;      /* We only return -1 on error. */
5038                 break;
5039         case 0 :
5040                 NBUMPSIDE(1, ns_ignored);
5041                 break;
5042         case 1 :
5043                 NBUMPSIDE(1, ns_translated);
5044                 break;
5045         }
5046         fin->fin_ifp = sifp;
5047         return rval;
5048 }
5049
5050 /* ------------------------------------------------------------------------ */
5051 /* Function:    ipf_nat_out                                                 */
5052 /* Returns:     int - -1 == packet failed NAT checks so block it,           */
5053 /*                     1 == packet was successfully translated.             */
5054 /* Parameters:  fin(I)    - pointer to packet information                   */
5055 /*              nat(I)    - pointer to NAT structure                        */
5056 /*              natadd(I) - flag indicating if it is safe to add frag cache */
5057 /*              nflags(I) - NAT flags set for this packet                   */
5058 /*                                                                          */
5059 /* Translate a packet coming "out" on an interface.                         */
5060 /* ------------------------------------------------------------------------ */
5061 int
5062 ipf_nat_out(fin, nat, natadd, nflags)
5063         fr_info_t *fin;
5064         nat_t *nat;
5065         int natadd;
5066         u_32_t nflags;
5067 {
5068         ipf_main_softc_t *softc = fin->fin_main_soft;
5069         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5070         icmphdr_t *icmp;
5071         tcphdr_t *tcp;
5072         ipnat_t *np;
5073         int skip;
5074         int i;
5075
5076         tcp = NULL;
5077         icmp = NULL;
5078         np = nat->nat_ptr;
5079
5080         if ((natadd != 0) && (fin->fin_flx & FI_FRAG) && (np != NULL))
5081                 (void) ipf_frag_natnew(softc, fin, 0, nat);
5082
5083         /*
5084          * Fix up checksums, not by recalculating them, but
5085          * simply computing adjustments.
5086          * This is only done for STREAMS based IP implementations where the
5087          * checksum has already been calculated by IP.  In all other cases,
5088          * IPFilter is called before the checksum needs calculating so there
5089          * is no call to modify whatever is in the header now.
5090          */
5091         if (nflags == IPN_ICMPERR) {
5092                 u_32_t s1, s2, sumd, msumd;
5093
5094                 s1 = LONG_SUM(ntohl(fin->fin_saddr));
5095                 if (nat->nat_dir == NAT_OUTBOUND) {
5096                         s2 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
5097                 } else {
5098                         s2 = LONG_SUM(ntohl(nat->nat_odstaddr));
5099                 }
5100                 CALC_SUMD(s1, s2, sumd);
5101                 msumd = sumd;
5102
5103                 s1 = LONG_SUM(ntohl(fin->fin_daddr));
5104                 if (nat->nat_dir == NAT_OUTBOUND) {
5105                         s2 = LONG_SUM(ntohl(nat->nat_ndstaddr));
5106                 } else {
5107                         s2 = LONG_SUM(ntohl(nat->nat_osrcaddr));
5108                 }
5109                 CALC_SUMD(s1, s2, sumd);
5110                 msumd += sumd;
5111
5112                 ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, msumd, 0);
5113         }
5114 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
5115     defined(linux) || defined(BRIDGE_IPF) || defined(__FreeBSD__)
5116         else {
5117                 /*
5118                  * Strictly speaking, this isn't necessary on BSD
5119                  * kernels because they do checksum calculation after
5120                  * this code has run BUT if ipfilter is being used
5121                  * to do NAT as a bridge, that code doesn't exist.
5122                  */
5123                 switch (nat->nat_dir)
5124                 {
5125                 case NAT_OUTBOUND :
5126                         ipf_fix_outcksum(fin->fin_cksum & FI_CK_L4PART,
5127                                          &fin->fin_ip->ip_sum,
5128                                          nat->nat_ipsumd, 0);
5129                         break;
5130
5131                 case NAT_INBOUND :
5132                         ipf_fix_incksum(fin->fin_cksum & FI_CK_L4PART,
5133                                         &fin->fin_ip->ip_sum,
5134                                         nat->nat_ipsumd, 0);
5135                         break;
5136
5137                 default :
5138                         break;
5139                 }
5140         }
5141 #endif
5142
5143         /*
5144          * Address assignment is after the checksum modification because
5145          * we are using the address in the packet for determining the
5146          * correct checksum offset (the ICMP error could be coming from
5147          * anyone...)
5148          */
5149         switch (nat->nat_dir)
5150         {
5151         case NAT_OUTBOUND :
5152                 fin->fin_ip->ip_src = nat->nat_nsrcip;
5153                 fin->fin_saddr = nat->nat_nsrcaddr;
5154                 fin->fin_ip->ip_dst = nat->nat_ndstip;
5155                 fin->fin_daddr = nat->nat_ndstaddr;
5156                 break;
5157
5158         case NAT_INBOUND :
5159                 fin->fin_ip->ip_src = nat->nat_odstip;
5160                 fin->fin_saddr = nat->nat_ndstaddr;
5161                 fin->fin_ip->ip_dst = nat->nat_osrcip;
5162                 fin->fin_daddr = nat->nat_nsrcaddr;
5163                 break;
5164
5165         case NAT_DIVERTIN :
5166             {
5167                 mb_t *m;
5168
5169                 skip = ipf_nat_decap(fin, nat);
5170                 if (skip <= 0) {
5171                         NBUMPSIDED(1, ns_decap_fail);
5172                         return -1;
5173                 }
5174
5175                 m = fin->fin_m;
5176
5177 #if defined(MENTAT) && defined(_KERNEL)
5178                 m->b_rptr += skip;
5179 #else
5180                 m->m_data += skip;
5181                 m->m_len -= skip;
5182
5183 # ifdef M_PKTHDR
5184                 if (m->m_flags & M_PKTHDR)
5185                         m->m_pkthdr.len -= skip;
5186 # endif
5187 #endif
5188
5189                 MUTEX_ENTER(&nat->nat_lock);
5190                 ipf_nat_update(fin, nat);
5191                 MUTEX_EXIT(&nat->nat_lock);
5192                 fin->fin_flx |= FI_NATED;
5193                 if (np != NULL && np->in_tag.ipt_num[0] != 0)
5194                         fin->fin_nattag = &np->in_tag;
5195                 return 1;
5196                 /* NOTREACHED */
5197             }
5198
5199         case NAT_DIVERTOUT :
5200             {
5201                 u_32_t s1, s2, sumd;
5202                 udphdr_t *uh;
5203                 ip_t *ip;
5204                 mb_t *m;
5205
5206                 m = M_DUP(np->in_divmp);
5207                 if (m == NULL) {
5208                         NBUMPSIDED(1, ns_divert_dup);
5209                         return -1;
5210                 }
5211
5212                 ip = MTOD(m, ip_t *);
5213                 ip_fillid(ip);
5214                 s2 = ntohs(ip->ip_id);
5215
5216                 s1 = ip->ip_len;
5217                 ip->ip_len = ntohs(ip->ip_len);
5218                 ip->ip_len += fin->fin_plen;
5219                 ip->ip_len = htons(ip->ip_len);
5220                 s2 += ntohs(ip->ip_len);
5221                 CALC_SUMD(s1, s2, sumd);
5222
5223                 uh = (udphdr_t *)(ip + 1);
5224                 uh->uh_ulen += fin->fin_plen;
5225                 uh->uh_ulen = htons(uh->uh_ulen);
5226 #if !defined(_KERNEL) || defined(MENTAT) || \
5227     defined(BRIDGE_IPF) || defined(__FreeBSD__)
5228                 ipf_fix_outcksum(0, &ip->ip_sum, sumd, 0);
5229 #endif
5230
5231                 PREP_MB_T(fin, m);
5232
5233                 fin->fin_src = ip->ip_src;
5234                 fin->fin_dst = ip->ip_dst;
5235                 fin->fin_ip = ip;
5236                 fin->fin_plen += sizeof(ip_t) + 8;      /* UDP + IPv4 hdr */
5237                 fin->fin_dlen += sizeof(ip_t) + 8;      /* UDP + IPv4 hdr */
5238
5239                 nflags &= ~IPN_TCPUDPICMP;
5240
5241                 break;
5242             }
5243
5244         default :
5245                 break;
5246         }
5247
5248         if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5249                 u_short *csump;
5250
5251                 if ((nat->nat_nsport != 0) && (nflags & IPN_TCPUDP)) {
5252                         tcp = fin->fin_dp;
5253
5254                         switch (nat->nat_dir)
5255                         {
5256                         case NAT_OUTBOUND :
5257                                 tcp->th_sport = nat->nat_nsport;
5258                                 fin->fin_data[0] = ntohs(nat->nat_nsport);
5259                                 tcp->th_dport = nat->nat_ndport;
5260                                 fin->fin_data[1] = ntohs(nat->nat_ndport);
5261                                 break;
5262
5263                         case NAT_INBOUND :
5264                                 tcp->th_sport = nat->nat_odport;
5265                                 fin->fin_data[0] = ntohs(nat->nat_odport);
5266                                 tcp->th_dport = nat->nat_osport;
5267                                 fin->fin_data[1] = ntohs(nat->nat_osport);
5268                                 break;
5269                         }
5270                 }
5271
5272                 if ((nat->nat_nsport != 0) && (nflags & IPN_ICMPQUERY)) {
5273                         icmp = fin->fin_dp;
5274                         icmp->icmp_id = nat->nat_nicmpid;
5275                 }
5276
5277                 csump = ipf_nat_proto(fin, nat, nflags);
5278
5279                 /*
5280                  * The above comments do not hold for layer 4 (or higher)
5281                  * checksums...
5282                  */
5283                 if (csump != NULL) {
5284                         if (nat->nat_dir == NAT_OUTBOUND)
5285                                 ipf_fix_outcksum(fin->fin_cksum, csump,
5286                                                  nat->nat_sumd[0],
5287                                                  nat->nat_sumd[1] +
5288                                                  fin->fin_dlen);
5289                         else
5290                                 ipf_fix_incksum(fin->fin_cksum, csump,
5291                                                 nat->nat_sumd[0],
5292                                                 nat->nat_sumd[1] +
5293                                                 fin->fin_dlen);
5294                 }
5295         }
5296
5297         ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync);
5298         /* ------------------------------------------------------------- */
5299         /* A few quick notes:                                            */
5300         /*      Following are test conditions prior to calling the       */
5301         /*      ipf_proxy_check routine.                                 */
5302         /*                                                               */
5303         /*      A NULL tcp indicates a non TCP/UDP packet.  When dealing */
5304         /*      with a redirect rule, we attempt to match the packet's   */
5305         /*      source port against in_dport, otherwise we'd compare the */
5306         /*      packet's destination.                                    */
5307         /* ------------------------------------------------------------- */
5308         if ((np != NULL) && (np->in_apr != NULL)) {
5309                 i = ipf_proxy_check(fin, nat);
5310                 if (i == 0) {
5311                         i = 1;
5312                 } else if (i == -1) {
5313                         NBUMPSIDED(1, ns_ipf_proxy_fail);
5314                 }
5315         } else {
5316                 i = 1;
5317         }
5318         fin->fin_flx |= FI_NATED;
5319         return i;
5320 }
5321
5322
5323 /* ------------------------------------------------------------------------ */
5324 /* Function:    ipf_nat_checkin                                             */
5325 /* Returns:     int - -1 == packet failed NAT checks so block it,           */
5326 /*                     0 == no packet translation occurred,                 */
5327 /*                     1 == packet was successfully translated.             */
5328 /* Parameters:  fin(I)   - pointer to packet information                    */
5329 /*              passp(I) - pointer to filtering result flags                */
5330 /*                                                                          */
5331 /* Check to see if an incoming packet should be changed.  ICMP packets are  */
5332 /* first checked to see if they match an existing entry (if an error),      */
5333 /* otherwise a search of the current NAT table is made.  If neither results */
5334 /* in a match then a search for a matching NAT rule is made.  Create a new  */
5335 /* NAT entry if a we matched a NAT rule.  Lastly, actually change the       */
5336 /* packet header(s) as required.                                            */
5337 /* ------------------------------------------------------------------------ */
5338 int
5339 ipf_nat_checkin(fin, passp)
5340         fr_info_t *fin;
5341         u_32_t *passp;
5342 {
5343         ipf_main_softc_t *softc;
5344         ipf_nat_softc_t *softn;
5345         u_int nflags, natadd;
5346         ipnat_t *np, *npnext;
5347         int rval, natfailed;
5348         struct ifnet *ifp;
5349         struct in_addr in;
5350         icmphdr_t *icmp;
5351         tcphdr_t *tcp;
5352         u_short dport;
5353         nat_t *nat;
5354         u_32_t iph;
5355
5356         softc = fin->fin_main_soft;
5357         softn = softc->ipf_nat_soft;
5358
5359         if (softn->ipf_nat_lock != 0)
5360                 return 0;
5361         if (softn->ipf_nat_stats.ns_rules == 0 &&
5362             softn->ipf_nat_instances == NULL)
5363                 return 0;
5364
5365         tcp = NULL;
5366         icmp = NULL;
5367         dport = 0;
5368         natadd = 1;
5369         nflags = 0;
5370         natfailed = 0;
5371         ifp = fin->fin_ifp;
5372
5373         if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5374                 switch (fin->fin_p)
5375                 {
5376                 case IPPROTO_TCP :
5377                         nflags = IPN_TCP;
5378                         break;
5379                 case IPPROTO_UDP :
5380                         nflags = IPN_UDP;
5381                         break;
5382                 case IPPROTO_ICMP :
5383                         icmp = fin->fin_dp;
5384
5385                         /*
5386                          * This is an incoming packet, so the destination is
5387                          * the icmp_id and the source port equals 0
5388                          */
5389                         if ((fin->fin_flx & FI_ICMPQUERY) != 0) {
5390                                 nflags = IPN_ICMPQUERY;
5391                                 dport = icmp->icmp_id;
5392                         } break;
5393                 default :
5394                         break;
5395                 }
5396
5397                 if ((nflags & IPN_TCPUDP)) {
5398                         tcp = fin->fin_dp;
5399                         dport = fin->fin_data[1];
5400                 }
5401         }
5402
5403         in = fin->fin_dst;
5404
5405         READ_ENTER(&softc->ipf_nat);
5406
5407         if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
5408             (nat = ipf_nat_icmperror(fin, &nflags, NAT_INBOUND)))
5409                 /*EMPTY*/;
5410         else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin)))
5411                 natadd = 0;
5412         else if ((nat = ipf_nat_inlookup(fin, nflags|NAT_SEARCH,
5413                                          (u_int)fin->fin_p,
5414                                          fin->fin_src, in))) {
5415                 nflags = nat->nat_flags;
5416         } else if (fin->fin_off == 0) {
5417                 u_32_t hv, msk, rmsk = 0;
5418
5419                 /*
5420                  * If there is no current entry in the nat table for this IP#,
5421                  * create one for it (if there is a matching rule).
5422                  */
5423 maskloop:
5424                 msk = softn->ipf_nat_rdr_active_masks[rmsk];
5425                 iph = in.s_addr & msk;
5426                 hv = NAT_HASH_FN(iph, 0, softn->ipf_nat_rdrrules_sz);
5427 retry_roundrobin:
5428                 /* TRACE (iph,msk,rmsk,hv,softn->ipf_nat_rdrrules_sz) */
5429                 for (np = softn->ipf_nat_rdr_rules[hv]; np; np = npnext) {
5430                         npnext = np->in_rnext;
5431                         if (np->in_ifps[0] && (np->in_ifps[0] != ifp))
5432                                 continue;
5433                         if (np->in_v[0] != 4)
5434                                 continue;
5435                         if (np->in_pr[0] && (np->in_pr[0] != fin->fin_p))
5436                                 continue;
5437                         if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags))
5438                                 continue;
5439                         if (np->in_flags & IPN_FILTER) {
5440                                 switch (ipf_nat_match(fin, np))
5441                                 {
5442                                 case 0 :
5443                                         continue;
5444                                 case -1 :
5445                                         rval = -3;
5446                                         goto inmatchfail;
5447                                 case 1 :
5448                                 default :
5449                                         break;
5450                                 }
5451                         } else {
5452                                 if ((in.s_addr & np->in_odstmsk) !=
5453                                     np->in_odstaddr)
5454                                         continue;
5455                                 if (np->in_odport &&
5456                                     ((np->in_dtop < dport) ||
5457                                      (dport < np->in_odport)))
5458                                         continue;
5459                         }
5460
5461                         if (np->in_plabel != -1) {
5462                                 if (!ipf_proxy_ok(fin, tcp, np)) {
5463                                         continue;
5464                                 }
5465                         }
5466
5467                         if (np->in_flags & IPN_NO) {
5468                                 np->in_hits++;
5469                                 break;
5470                         }
5471
5472                         MUTEX_ENTER(&softn->ipf_nat_new);
5473                         /*
5474                          * If we've matched a round-robin rule but it has
5475                          * moved in the list since we got it, start over as
5476                          * this is now no longer correct.
5477                          */
5478                         if (npnext != np->in_rnext) {
5479                                 if ((np->in_flags & IPN_ROUNDR) != 0) {
5480                                         MUTEX_EXIT(&softn->ipf_nat_new);
5481                                         goto retry_roundrobin;
5482                                 }
5483                                 npnext = np->in_rnext;
5484                         }
5485
5486                         nat = ipf_nat_add(fin, np, NULL, nflags, NAT_INBOUND);
5487                         MUTEX_EXIT(&softn->ipf_nat_new);
5488                         if (nat != NULL) {
5489                                 natfailed = 0;
5490                                 break;
5491                         }
5492                         natfailed = -2;
5493                 }
5494                 if ((np == NULL) && (rmsk < softn->ipf_nat_rdr_max)) {
5495                         rmsk++;
5496                         goto maskloop;
5497                 }
5498         }
5499
5500         if (nat != NULL) {
5501                 rval = ipf_nat_in(fin, nat, natadd, nflags);
5502                 if (rval == 1) {
5503                         MUTEX_ENTER(&nat->nat_lock);
5504                         ipf_nat_update(fin, nat);
5505                         nat->nat_bytes[0] += fin->fin_plen;
5506                         nat->nat_pkts[0]++;
5507                         fin->fin_pktnum = nat->nat_pkts[0];
5508                         MUTEX_EXIT(&nat->nat_lock);
5509                 }
5510         } else
5511                 rval = natfailed;
5512 inmatchfail:
5513         RWLOCK_EXIT(&softc->ipf_nat);
5514
5515         switch (rval)
5516         {
5517         case -3 :
5518                 /* ipf_nat_match() failure */
5519                 /* FALLTHROUGH */
5520         case -2 :
5521                 /* retry_roundrobin loop failure */
5522                 /* FALLTHROUGH */
5523         case -1 :
5524                 /* proxy failure detected by ipf_nat_in() */
5525                 if (passp != NULL) {
5526                         DT2(frb_natv4in, fr_info_t *, fin, int, rval);
5527                         NBUMPSIDED(0, ns_drop);
5528                         *passp = FR_BLOCK;
5529                         fin->fin_reason = FRB_NATV4;
5530                 }
5531                 fin->fin_flx |= FI_BADNAT;
5532                 NBUMPSIDED(0, ns_badnat);
5533                 rval = -1;      /* We only return -1 on error. */
5534                 break;
5535         case 0 :
5536                 NBUMPSIDE(0, ns_ignored);
5537                 break;
5538         case 1 :
5539                 NBUMPSIDE(0, ns_translated);
5540                 break;
5541         }
5542         return rval;
5543 }
5544
5545
5546 /* ------------------------------------------------------------------------ */
5547 /* Function:    ipf_nat_in                                                  */
5548 /* Returns:     int - -1 == packet failed NAT checks so block it,           */
5549 /*                     1 == packet was successfully translated.             */
5550 /* Parameters:  fin(I)    - pointer to packet information                   */
5551 /*              nat(I)    - pointer to NAT structure                        */
5552 /*              natadd(I) - flag indicating if it is safe to add frag cache */
5553 /*              nflags(I) - NAT flags set for this packet                   */
5554 /* Locks Held:  ipf_nat(READ)                                               */
5555 /*                                                                          */
5556 /* Translate a packet coming "in" on an interface.                          */
5557 /* ------------------------------------------------------------------------ */
5558 int
5559 ipf_nat_in(fin, nat, natadd, nflags)
5560         fr_info_t *fin;
5561         nat_t *nat;
5562         int natadd;
5563         u_32_t nflags;
5564 {
5565         ipf_main_softc_t *softc = fin->fin_main_soft;
5566         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5567         u_32_t sumd, ipsumd, sum1, sum2;
5568         icmphdr_t *icmp;
5569         tcphdr_t *tcp;
5570         ipnat_t *np;
5571         int skip;
5572         int i;
5573
5574         tcp = NULL;
5575         np = nat->nat_ptr;
5576         fin->fin_fr = nat->nat_fr;
5577
5578         if (np != NULL) {
5579                 if ((natadd != 0) && (fin->fin_flx & FI_FRAG))
5580                         (void) ipf_frag_natnew(softc, fin, 0, nat);
5581
5582         /* ------------------------------------------------------------- */
5583         /* A few quick notes:                                            */
5584         /*      Following are test conditions prior to calling the       */
5585         /*      ipf_proxy_check routine.                                 */
5586         /*                                                               */
5587         /*      A NULL tcp indicates a non TCP/UDP packet.  When dealing */
5588         /*      with a map rule, we attempt to match the packet's        */
5589         /*      source port against in_dport, otherwise we'd compare the */
5590         /*      packet's destination.                                    */
5591         /* ------------------------------------------------------------- */
5592                 if (np->in_apr != NULL) {
5593                         i = ipf_proxy_check(fin, nat);
5594                         if (i == -1) {
5595                                 NBUMPSIDED(0, ns_ipf_proxy_fail);
5596                                 return -1;
5597                         }
5598                 }
5599         }
5600
5601         ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync);
5602
5603         ipsumd = nat->nat_ipsumd;
5604         /*
5605          * Fix up checksums, not by recalculating them, but
5606          * simply computing adjustments.
5607          * Why only do this for some platforms on inbound packets ?
5608          * Because for those that it is done, IP processing is yet to happen
5609          * and so the IPv4 header checksum has not yet been evaluated.
5610          * Perhaps it should always be done for the benefit of things like
5611          * fast forwarding (so that it doesn't need to be recomputed) but with
5612          * header checksum offloading, perhaps it is a moot point.
5613          */
5614
5615         switch (nat->nat_dir)
5616         {
5617         case NAT_INBOUND :
5618                 if ((fin->fin_flx & FI_ICMPERR) == 0) {
5619                         fin->fin_ip->ip_src = nat->nat_nsrcip;
5620                         fin->fin_saddr = nat->nat_nsrcaddr;
5621                 } else {
5622                         sum1 = nat->nat_osrcaddr;
5623                         sum2 = nat->nat_nsrcaddr;
5624                         CALC_SUMD(sum1, sum2, sumd);
5625                         ipsumd -= sumd;
5626                 }
5627                 fin->fin_ip->ip_dst = nat->nat_ndstip;
5628                 fin->fin_daddr = nat->nat_ndstaddr;
5629 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
5630      defined(__osf__) || defined(linux)
5631                 ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, ipsumd, 0);
5632 #endif
5633                 break;
5634
5635         case NAT_OUTBOUND :
5636                 if ((fin->fin_flx & FI_ICMPERR) == 0) {
5637                         fin->fin_ip->ip_src = nat->nat_odstip;
5638                         fin->fin_saddr = nat->nat_odstaddr;
5639                 } else {
5640                         sum1 = nat->nat_odstaddr;
5641                         sum2 = nat->nat_ndstaddr;
5642                         CALC_SUMD(sum1, sum2, sumd);
5643                         ipsumd -= sumd;
5644                 }
5645                 fin->fin_ip->ip_dst = nat->nat_osrcip;
5646                 fin->fin_daddr = nat->nat_osrcaddr;
5647 #if !defined(_KERNEL) || defined(MENTAT)
5648                 ipf_fix_incksum(0, &fin->fin_ip->ip_sum, ipsumd, 0);
5649 #endif
5650                 break;
5651
5652         case NAT_DIVERTIN :
5653             {
5654                 udphdr_t *uh;
5655                 ip_t *ip;
5656                 mb_t *m;
5657
5658                 m = M_DUP(np->in_divmp);
5659                 if (m == NULL) {
5660                         NBUMPSIDED(0, ns_divert_dup);
5661                         return -1;
5662                 }
5663
5664                 ip = MTOD(m, ip_t *);
5665                 ip_fillid(ip);
5666                 sum1 = ntohs(ip->ip_len);
5667                 ip->ip_len = ntohs(ip->ip_len);
5668                 ip->ip_len += fin->fin_plen;
5669                 ip->ip_len = htons(ip->ip_len);
5670
5671                 uh = (udphdr_t *)(ip + 1);
5672                 uh->uh_ulen += fin->fin_plen;
5673                 uh->uh_ulen = htons(uh->uh_ulen);
5674
5675                 sum2 = ntohs(ip->ip_id) + ntohs(ip->ip_len);
5676                 sum2 += ntohs(ip->ip_off) & IP_DF;
5677                 CALC_SUMD(sum1, sum2, sumd);
5678
5679 #if !defined(_KERNEL) || defined(MENTAT)
5680                 ipf_fix_outcksum(0, &ip->ip_sum, sumd, 0);
5681 #endif
5682                 PREP_MB_T(fin, m);
5683
5684                 fin->fin_ip = ip;
5685                 fin->fin_plen += sizeof(ip_t) + 8;      /* UDP + new IPv4 hdr */
5686                 fin->fin_dlen += sizeof(ip_t) + 8;      /* UDP + old IPv4 hdr */
5687
5688                 nflags &= ~IPN_TCPUDPICMP;
5689
5690                 break;
5691             }
5692
5693         case NAT_DIVERTOUT :
5694             {
5695                 mb_t *m;
5696
5697                 skip = ipf_nat_decap(fin, nat);
5698                 if (skip <= 0) {
5699                         NBUMPSIDED(0, ns_decap_fail);
5700                         return -1;
5701                 }
5702
5703                 m = fin->fin_m;
5704
5705 #if defined(MENTAT) && defined(_KERNEL)
5706                 m->b_rptr += skip;
5707 #else
5708                 m->m_data += skip;
5709                 m->m_len -= skip;
5710
5711 # ifdef M_PKTHDR
5712                 if (m->m_flags & M_PKTHDR)
5713                         m->m_pkthdr.len -= skip;
5714 # endif
5715 #endif
5716
5717                 ipf_nat_update(fin, nat);
5718                 nflags &= ~IPN_TCPUDPICMP;
5719                 fin->fin_flx |= FI_NATED;
5720                 if (np != NULL && np->in_tag.ipt_num[0] != 0)
5721                         fin->fin_nattag = &np->in_tag;
5722                 return 1;
5723                 /* NOTREACHED */
5724             }
5725         }
5726         if (nflags & IPN_TCPUDP)
5727                 tcp = fin->fin_dp;
5728
5729         if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5730                 u_short *csump;
5731
5732                 if ((nat->nat_odport != 0) && (nflags & IPN_TCPUDP)) {
5733                         switch (nat->nat_dir)
5734                         {
5735                         case NAT_INBOUND :
5736                                 tcp->th_sport = nat->nat_nsport;
5737                                 fin->fin_data[0] = ntohs(nat->nat_nsport);
5738                                 tcp->th_dport = nat->nat_ndport;
5739                                 fin->fin_data[1] = ntohs(nat->nat_ndport);
5740                                 break;
5741
5742                         case NAT_OUTBOUND :
5743                                 tcp->th_sport = nat->nat_odport;
5744                                 fin->fin_data[0] = ntohs(nat->nat_odport);
5745                                 tcp->th_dport = nat->nat_osport;
5746                                 fin->fin_data[1] = ntohs(nat->nat_osport);
5747                                 break;
5748                         }
5749                 }
5750
5751
5752                 if ((nat->nat_odport != 0) && (nflags & IPN_ICMPQUERY)) {
5753                         icmp = fin->fin_dp;
5754
5755                         icmp->icmp_id = nat->nat_nicmpid;
5756                 }
5757
5758                 csump = ipf_nat_proto(fin, nat, nflags);
5759
5760                 /*
5761                  * The above comments do not hold for layer 4 (or higher)
5762                  * checksums...
5763                  */
5764                 if (csump != NULL) {
5765                         if (nat->nat_dir == NAT_OUTBOUND)
5766                                 ipf_fix_incksum(0, csump, nat->nat_sumd[0], 0);
5767                         else
5768                                 ipf_fix_outcksum(0, csump, nat->nat_sumd[0], 0);
5769                 }
5770         }
5771
5772         fin->fin_flx |= FI_NATED;
5773         if (np != NULL && np->in_tag.ipt_num[0] != 0)
5774                 fin->fin_nattag = &np->in_tag;
5775         return 1;
5776 }
5777
5778
5779 /* ------------------------------------------------------------------------ */
5780 /* Function:    ipf_nat_proto                                               */
5781 /* Returns:     u_short* - pointer to transport header checksum to update,  */
5782 /*                         NULL if the transport protocol is not recognised */
5783 /*                         as needing a checksum update.                    */
5784 /* Parameters:  fin(I)    - pointer to packet information                   */
5785 /*              nat(I)    - pointer to NAT structure                        */
5786 /*              nflags(I) - NAT flags set for this packet                   */
5787 /*                                                                          */
5788 /* Return the pointer to the checksum field for each protocol so understood.*/
5789 /* If support for making other changes to a protocol header is required,    */
5790 /* that is not strictly 'address' translation, such as clamping the MSS in  */
5791 /* TCP down to a specific value, then do it from here.                      */
5792 /* ------------------------------------------------------------------------ */
5793 u_short *
5794 ipf_nat_proto(fin, nat, nflags)
5795         fr_info_t *fin;
5796         nat_t *nat;
5797         u_int nflags;
5798 {
5799         icmphdr_t *icmp;
5800         u_short *csump;
5801         tcphdr_t *tcp;
5802         udphdr_t *udp;
5803
5804         csump = NULL;
5805         if (fin->fin_out == 0) {
5806                 fin->fin_rev = (nat->nat_dir & NAT_OUTBOUND);
5807         } else {
5808                 fin->fin_rev = ((nat->nat_dir & NAT_OUTBOUND) == 0);
5809         }
5810
5811         switch (fin->fin_p)
5812         {
5813         case IPPROTO_TCP :
5814                 tcp = fin->fin_dp;
5815
5816                 if ((nflags & IPN_TCP) != 0)
5817                         csump = &tcp->th_sum;
5818
5819                 /*
5820                  * Do a MSS CLAMPING on a SYN packet,
5821                  * only deal IPv4 for now.
5822                  */
5823                 if ((nat->nat_mssclamp != 0) && (tcp->th_flags & TH_SYN) != 0)
5824                         ipf_nat_mssclamp(tcp, nat->nat_mssclamp, fin, csump);
5825
5826                 break;
5827
5828         case IPPROTO_UDP :
5829                 udp = fin->fin_dp;
5830
5831                 if ((nflags & IPN_UDP) != 0) {
5832                         if (udp->uh_sum != 0)
5833                                 csump = &udp->uh_sum;
5834                 }
5835                 break;
5836
5837         case IPPROTO_ICMP :
5838                 icmp = fin->fin_dp;
5839
5840                 if ((nflags & IPN_ICMPQUERY) != 0) {
5841                         if (icmp->icmp_cksum != 0)
5842                                 csump = &icmp->icmp_cksum;
5843                 }
5844                 break;
5845
5846 #ifdef USE_INET6
5847         case IPPROTO_ICMPV6 :
5848             {
5849                 struct icmp6_hdr *icmp6 = (struct icmp6_hdr *)fin->fin_dp;
5850
5851                 icmp6 = fin->fin_dp;
5852
5853                 if ((nflags & IPN_ICMPQUERY) != 0) {
5854                         if (icmp6->icmp6_cksum != 0)
5855                                 csump = &icmp6->icmp6_cksum;
5856                 }
5857                 break;
5858             }
5859 #endif
5860         }
5861         return csump;
5862 }
5863
5864
5865 /* ------------------------------------------------------------------------ */
5866 /* Function:    ipf_nat_expire                                              */
5867 /* Returns:     Nil                                                         */
5868 /* Parameters:  softc(I) - pointer to soft context main structure           */
5869 /*                                                                          */
5870 /* Check all of the timeout queues for entries at the top which need to be  */
5871 /* expired.                                                                 */
5872 /* ------------------------------------------------------------------------ */
5873 void
5874 ipf_nat_expire(softc)
5875         ipf_main_softc_t *softc;
5876 {
5877         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5878         ipftq_t *ifq, *ifqnext;
5879         ipftqent_t *tqe, *tqn;
5880         int i;
5881         SPL_INT(s);
5882
5883         SPL_NET(s);
5884         WRITE_ENTER(&softc->ipf_nat);
5885         for (ifq = softn->ipf_nat_tcptq, i = 0; ifq != NULL;
5886              ifq = ifq->ifq_next) {
5887                 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
5888                         if (tqe->tqe_die > softc->ipf_ticks)
5889                                 break;
5890                         tqn = tqe->tqe_next;
5891                         ipf_nat_delete(softc, tqe->tqe_parent, NL_EXPIRE);
5892                 }
5893         }
5894
5895         for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifq->ifq_next) {
5896                 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
5897                         if (tqe->tqe_die > softc->ipf_ticks)
5898                                 break;
5899                         tqn = tqe->tqe_next;
5900                         ipf_nat_delete(softc, tqe->tqe_parent, NL_EXPIRE);
5901                 }
5902         }
5903
5904         for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifqnext) {
5905                 ifqnext = ifq->ifq_next;
5906
5907                 if (((ifq->ifq_flags & IFQF_DELETE) != 0) &&
5908                     (ifq->ifq_ref == 0)) {
5909                         ipf_freetimeoutqueue(softc, ifq);
5910                 }
5911         }
5912
5913         if (softn->ipf_nat_doflush != 0) {
5914                 ipf_nat_extraflush(softc, softn, 2);
5915                 softn->ipf_nat_doflush = 0;
5916         }
5917
5918         RWLOCK_EXIT(&softc->ipf_nat);
5919         SPL_X(s);
5920 }
5921
5922
5923 /* ------------------------------------------------------------------------ */
5924 /* Function:    ipf_nat_sync                                                */
5925 /* Returns:     Nil                                                         */
5926 /* Parameters:  softc(I) - pointer to soft context main structure           */
5927 /*              ifp(I) - pointer to network interface                       */
5928 /*                                                                          */
5929 /* Walk through all of the currently active NAT sessions, looking for those */
5930 /* which need to have their translated address updated.                     */
5931 /* ------------------------------------------------------------------------ */
5932 void
5933 ipf_nat_sync(softc, ifp)
5934         ipf_main_softc_t *softc;
5935         void *ifp;
5936 {
5937         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5938         u_32_t sum1, sum2, sumd;
5939         i6addr_t in;
5940         ipnat_t *n;
5941         nat_t *nat;
5942         void *ifp2;
5943         int idx;
5944         SPL_INT(s);
5945
5946         if (softc->ipf_running <= 0)
5947                 return;
5948
5949         /*
5950          * Change IP addresses for NAT sessions for any protocol except TCP
5951          * since it will break the TCP connection anyway.  The only rules
5952          * which will get changed are those which are "map ... -> 0/32",
5953          * where the rule specifies the address is taken from the interface.
5954          */
5955         SPL_NET(s);
5956         WRITE_ENTER(&softc->ipf_nat);
5957
5958         if (softc->ipf_running <= 0) {
5959                 RWLOCK_EXIT(&softc->ipf_nat);
5960                 return;
5961         }
5962
5963         for (nat = softn->ipf_nat_instances; nat; nat = nat->nat_next) {
5964                 if ((nat->nat_flags & IPN_TCP) != 0)
5965                         continue;
5966
5967                 n = nat->nat_ptr;
5968                 if (n != NULL) {
5969                         if (n->in_v[1] == 4) {
5970                                 if (n->in_redir & NAT_MAP) {
5971                                         if ((n->in_nsrcaddr != 0) ||
5972                                             (n->in_nsrcmsk != 0xffffffff))
5973                                                 continue;
5974                                 } else if (n->in_redir & NAT_REDIRECT) {
5975                                         if ((n->in_ndstaddr != 0) ||
5976                                             (n->in_ndstmsk != 0xffffffff))
5977                                                 continue;
5978                                 }
5979                         }
5980 #ifdef USE_INET6
5981                         if (n->in_v[1] == 4) {
5982                                 if (n->in_redir & NAT_MAP) {
5983                                         if (!IP6_ISZERO(&n->in_nsrcaddr) ||
5984                                             !IP6_ISONES(&n->in_nsrcmsk))
5985                                                 continue;
5986                                 } else if (n->in_redir & NAT_REDIRECT) {
5987                                         if (!IP6_ISZERO(&n->in_ndstaddr) ||
5988                                             !IP6_ISONES(&n->in_ndstmsk))
5989                                                 continue;
5990                                 }
5991                         }
5992 #endif
5993                 }
5994
5995                 if (((ifp == NULL) || (ifp == nat->nat_ifps[0]) ||
5996                      (ifp == nat->nat_ifps[1]))) {
5997                         nat->nat_ifps[0] = GETIFP(nat->nat_ifnames[0],
5998                                                   nat->nat_v[0]);
5999                         if ((nat->nat_ifps[0] != NULL) &&
6000                             (nat->nat_ifps[0] != (void *)-1)) {
6001                                 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
6002                         }
6003                         if (nat->nat_ifnames[1][0] != '\0') {
6004                                 nat->nat_ifps[1] = GETIFP(nat->nat_ifnames[1],
6005                                                           nat->nat_v[1]);
6006                         } else {
6007                                 nat->nat_ifps[1] = nat->nat_ifps[0];
6008                         }
6009                         if ((nat->nat_ifps[1] != NULL) &&
6010                             (nat->nat_ifps[1] != (void *)-1)) {
6011                                 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
6012                         }
6013                         ifp2 = nat->nat_ifps[0];
6014                         if (ifp2 == NULL)
6015                                 continue;
6016
6017                         /*
6018                          * Change the map-to address to be the same as the
6019                          * new one.
6020                          */
6021                         sum1 = NATFSUM(nat, nat->nat_v[1], nat_nsrc6);
6022                         if (ipf_ifpaddr(softc, nat->nat_v[0], FRI_NORMAL, ifp2,
6023                                        &in, NULL) != -1) {
6024                                 if (nat->nat_v[0] == 4)
6025                                         nat->nat_nsrcip = in.in4;
6026                         }
6027                         sum2 = NATFSUM(nat, nat->nat_v[1], nat_nsrc6);
6028
6029                         if (sum1 == sum2)
6030                                 continue;
6031                         /*
6032                          * Readjust the checksum adjustment to take into
6033                          * account the new IP#.
6034                          */
6035                         CALC_SUMD(sum1, sum2, sumd);
6036                         /* XXX - dont change for TCP when solaris does
6037                          * hardware checksumming.
6038                          */
6039                         sumd += nat->nat_sumd[0];
6040                         nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
6041                         nat->nat_sumd[1] = nat->nat_sumd[0];
6042                 }
6043         }
6044
6045         for (n = softn->ipf_nat_list; (n != NULL); n = n->in_next) {
6046                 char *base = n->in_names;
6047
6048                 if ((ifp == NULL) || (n->in_ifps[0] == ifp))
6049                         n->in_ifps[0] = ipf_resolvenic(softc,
6050                                                        base + n->in_ifnames[0],
6051                                                        n->in_v[0]);
6052                 if ((ifp == NULL) || (n->in_ifps[1] == ifp))
6053                         n->in_ifps[1] = ipf_resolvenic(softc,
6054                                                        base + n->in_ifnames[1],
6055                                                        n->in_v[1]);
6056
6057                 if (n->in_redir & NAT_REDIRECT)
6058                         idx = 1;
6059                 else
6060                         idx = 0;
6061
6062                 if (((ifp == NULL) || (n->in_ifps[idx] == ifp)) &&
6063                     (n->in_ifps[idx] != NULL &&
6064                      n->in_ifps[idx] != (void *)-1)) {
6065
6066                         ipf_nat_nextaddrinit(softc, n->in_names, &n->in_osrc,
6067                                              0, n->in_ifps[idx]);
6068                         ipf_nat_nextaddrinit(softc, n->in_names, &n->in_odst,
6069                                              0, n->in_ifps[idx]);
6070                         ipf_nat_nextaddrinit(softc, n->in_names, &n->in_nsrc,
6071                                              0, n->in_ifps[idx]);
6072                         ipf_nat_nextaddrinit(softc, n->in_names, &n->in_ndst,
6073                                              0, n->in_ifps[idx]);
6074                 }
6075         }
6076         RWLOCK_EXIT(&softc->ipf_nat);
6077         SPL_X(s);
6078 }
6079
6080
6081 /* ------------------------------------------------------------------------ */
6082 /* Function:    ipf_nat_icmpquerytype                                       */
6083 /* Returns:     int - 1 == success, 0 == failure                            */
6084 /* Parameters:  icmptype(I) - ICMP type number                              */
6085 /*                                                                          */
6086 /* Tests to see if the ICMP type number passed is a query/response type or  */
6087 /* not.                                                                     */
6088 /* ------------------------------------------------------------------------ */
6089 static int
6090 ipf_nat_icmpquerytype(icmptype)
6091         int icmptype;
6092 {
6093
6094         /*
6095          * For the ICMP query NAT code, it is essential that both the query
6096          * and the reply match on the NAT rule. Because the NAT structure
6097          * does not keep track of the icmptype, and a single NAT structure
6098          * is used for all icmp types with the same src, dest and id, we
6099          * simply define the replies as queries as well. The funny thing is,
6100          * altough it seems silly to call a reply a query, this is exactly
6101          * as it is defined in the IPv4 specification
6102          */
6103         switch (icmptype)
6104         {
6105         case ICMP_ECHOREPLY:
6106         case ICMP_ECHO:
6107         /* route advertisement/solicitation is currently unsupported: */
6108         /* it would require rewriting the ICMP data section          */
6109         case ICMP_TSTAMP:
6110         case ICMP_TSTAMPREPLY:
6111         case ICMP_IREQ:
6112         case ICMP_IREQREPLY:
6113         case ICMP_MASKREQ:
6114         case ICMP_MASKREPLY:
6115                 return 1;
6116         default:
6117                 return 0;
6118         }
6119 }
6120
6121
6122 /* ------------------------------------------------------------------------ */
6123 /* Function:    nat_log                                                     */
6124 /* Returns:     Nil                                                         */
6125 /* Parameters:  softc(I) - pointer to soft context main structure           */
6126 /*              softn(I) - pointer to NAT context structure                 */
6127 /*              nat(I)    - pointer to NAT structure                        */
6128 /*              action(I) - action related to NAT structure being performed */
6129 /*                                                                          */
6130 /* Creates a NAT log entry.                                                 */
6131 /* ------------------------------------------------------------------------ */
6132 void
6133 ipf_nat_log(softc, softn, nat, action)
6134         ipf_main_softc_t *softc;
6135         ipf_nat_softc_t *softn;
6136         struct nat *nat;
6137         u_int action;
6138 {
6139 #ifdef  IPFILTER_LOG
6140 # ifndef LARGE_NAT
6141         struct ipnat *np;
6142         int rulen;
6143 # endif
6144         struct natlog natl;
6145         void *items[1];
6146         size_t sizes[1];
6147         int types[1];
6148
6149         bcopy((char *)&nat->nat_osrc6, (char *)&natl.nl_osrcip,
6150               sizeof(natl.nl_osrcip));
6151         bcopy((char *)&nat->nat_nsrc6, (char *)&natl.nl_nsrcip,
6152               sizeof(natl.nl_nsrcip));
6153         bcopy((char *)&nat->nat_odst6, (char *)&natl.nl_odstip,
6154               sizeof(natl.nl_odstip));
6155         bcopy((char *)&nat->nat_ndst6, (char *)&natl.nl_ndstip,
6156               sizeof(natl.nl_ndstip));
6157
6158         natl.nl_bytes[0] = nat->nat_bytes[0];
6159         natl.nl_bytes[1] = nat->nat_bytes[1];
6160         natl.nl_pkts[0] = nat->nat_pkts[0];
6161         natl.nl_pkts[1] = nat->nat_pkts[1];
6162         natl.nl_odstport = nat->nat_odport;
6163         natl.nl_osrcport = nat->nat_osport;
6164         natl.nl_nsrcport = nat->nat_nsport;
6165         natl.nl_ndstport = nat->nat_ndport;
6166         natl.nl_p[0] = nat->nat_pr[0];
6167         natl.nl_p[1] = nat->nat_pr[1];
6168         natl.nl_v[0] = nat->nat_v[0];
6169         natl.nl_v[1] = nat->nat_v[1];
6170         natl.nl_type = nat->nat_redir;
6171         natl.nl_action = action;
6172         natl.nl_rule = -1;
6173
6174         bcopy(nat->nat_ifnames[0], natl.nl_ifnames[0],
6175               sizeof(nat->nat_ifnames[0]));
6176         bcopy(nat->nat_ifnames[1], natl.nl_ifnames[1],
6177               sizeof(nat->nat_ifnames[1]));
6178
6179 # ifndef LARGE_NAT
6180         if (nat->nat_ptr != NULL) {
6181                 for (rulen = 0, np = softn->ipf_nat_list; np != NULL;
6182                      np = np->in_next, rulen++)
6183                         if (np == nat->nat_ptr) {
6184                                 natl.nl_rule = rulen;
6185                                 break;
6186                         }
6187         }
6188 # endif
6189         items[0] = &natl;
6190         sizes[0] = sizeof(natl);
6191         types[0] = 0;
6192
6193         (void) ipf_log_items(softc, IPL_LOGNAT, NULL, items, sizes, types, 1);
6194 #endif
6195 }
6196
6197
6198
6199
6200 /* ------------------------------------------------------------------------ */
6201 /* Function:    ipf_nat_rule_deref                                          */
6202 /* Returns:     Nil                                                         */
6203 /* Parameters:  softc(I) - pointer to soft context main structure           */
6204 /*              inp(I)   - pointer to pointer to NAT rule                   */
6205 /* Write Locks: ipf_nat                                                     */
6206 /*                                                                          */
6207 /* Dropping the refernce count for a rule means that whatever held the      */
6208 /* pointer to this rule (*inp) is no longer interested in it and when the   */
6209 /* reference count drops to zero, any resources allocated for the rule can  */
6210 /* be released and the rule itself free'd.                                  */
6211 /* ------------------------------------------------------------------------ */
6212 void
6213 ipf_nat_rule_deref(softc, inp)
6214         ipf_main_softc_t *softc;
6215         ipnat_t **inp;
6216 {
6217         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6218         ipnat_t *n;
6219
6220         n = *inp;
6221         *inp = NULL;
6222         n->in_use--;
6223         if (n->in_use > 0)
6224                 return;
6225
6226         if (n->in_apr != NULL)
6227                 ipf_proxy_deref(n->in_apr);
6228
6229         ipf_nat_rule_fini(softc, n);
6230
6231         if (n->in_redir & NAT_REDIRECT) {
6232                 if ((n->in_flags & IPN_PROXYRULE) == 0) {
6233                         ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules_rdr);
6234                 }
6235         }
6236         if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
6237                 if ((n->in_flags & IPN_PROXYRULE) == 0) {
6238                         ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules_map);
6239                 }
6240         }
6241
6242         if (n->in_tqehead[0] != NULL) {
6243                 if (ipf_deletetimeoutqueue(n->in_tqehead[0]) == 0) {
6244                         ipf_freetimeoutqueue(softc, n->in_tqehead[1]);
6245                 }
6246         }
6247
6248         if (n->in_tqehead[1] != NULL) {
6249                 if (ipf_deletetimeoutqueue(n->in_tqehead[1]) == 0) {
6250                         ipf_freetimeoutqueue(softc, n->in_tqehead[1]);
6251                 }
6252         }
6253
6254         if ((n->in_flags & IPN_PROXYRULE) == 0) {
6255                 ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules);
6256         }
6257
6258         MUTEX_DESTROY(&n->in_lock);
6259
6260         KFREES(n, n->in_size);
6261
6262 #if SOLARIS && !defined(INSTANCES)
6263         if (softn->ipf_nat_stats.ns_rules == 0)
6264                 pfil_delayed_copy = 1;
6265 #endif
6266 }
6267
6268
6269 /* ------------------------------------------------------------------------ */
6270 /* Function:    ipf_nat_deref                                               */
6271 /* Returns:     Nil                                                         */
6272 /* Parameters:  softc(I) - pointer to soft context main structure           */
6273 /*              natp(I)  - pointer to pointer to NAT table entry            */
6274 /*                                                                          */
6275 /* Decrement the reference counter for this NAT table entry and free it if  */
6276 /* there are no more things using it.                                       */
6277 /*                                                                          */
6278 /* IF nat_ref == 1 when this function is called, then we have an orphan nat */
6279 /* structure *because* it only gets called on paths _after_ nat_ref has been*/
6280 /* incremented.  If nat_ref == 1 then we shouldn't decrement it here        */
6281 /* because nat_delete() will do that and send nat_ref to -1.                */
6282 /*                                                                          */
6283 /* Holding the lock on nat_lock is required to serialise nat_delete() being */
6284 /* called from a NAT flush ioctl with a deref happening because of a packet.*/
6285 /* ------------------------------------------------------------------------ */
6286 void
6287 ipf_nat_deref(softc, natp)
6288         ipf_main_softc_t *softc;
6289         nat_t **natp;
6290 {
6291         nat_t *nat;
6292
6293         nat = *natp;
6294         *natp = NULL;
6295
6296         MUTEX_ENTER(&nat->nat_lock);
6297         if (nat->nat_ref > 1) {
6298                 nat->nat_ref--;
6299                 ASSERT(nat->nat_ref >= 0);
6300                 MUTEX_EXIT(&nat->nat_lock);
6301                 return;
6302         }
6303         MUTEX_EXIT(&nat->nat_lock);
6304
6305         WRITE_ENTER(&softc->ipf_nat);
6306         ipf_nat_delete(softc, nat, NL_EXPIRE);
6307         RWLOCK_EXIT(&softc->ipf_nat);
6308 }
6309
6310
6311 /* ------------------------------------------------------------------------ */
6312 /* Function:    ipf_nat_clone                                               */
6313 /* Returns:     ipstate_t* - NULL == cloning failed,                        */
6314 /*                           else pointer to new state structure            */
6315 /* Parameters:  fin(I) - pointer to packet information                      */
6316 /*              is(I)  - pointer to master state structure                  */
6317 /* Write Lock:  ipf_nat                                                     */
6318 /*                                                                          */
6319 /* Create a "duplcate" state table entry from the master.                   */
6320 /* ------------------------------------------------------------------------ */
6321 nat_t *
6322 ipf_nat_clone(fin, nat)
6323         fr_info_t *fin;
6324         nat_t *nat;
6325 {
6326         ipf_main_softc_t *softc = fin->fin_main_soft;
6327         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6328         frentry_t *fr;
6329         nat_t *clone;
6330         ipnat_t *np;
6331
6332         KMALLOC(clone, nat_t *);
6333         if (clone == NULL) {
6334                 NBUMPSIDED(fin->fin_out, ns_clone_nomem);
6335                 return NULL;
6336         }
6337         bcopy((char *)nat, (char *)clone, sizeof(*clone));
6338
6339         MUTEX_NUKE(&clone->nat_lock);
6340
6341         clone->nat_rev = fin->fin_rev;
6342         clone->nat_aps = NULL;
6343         /*
6344          * Initialize all these so that ipf_nat_delete() doesn't cause a crash.
6345          */
6346         clone->nat_tqe.tqe_pnext = NULL;
6347         clone->nat_tqe.tqe_next = NULL;
6348         clone->nat_tqe.tqe_ifq = NULL;
6349         clone->nat_tqe.tqe_parent = clone;
6350
6351         clone->nat_flags &= ~SI_CLONE;
6352         clone->nat_flags |= SI_CLONED;
6353
6354         if (clone->nat_hm)
6355                 clone->nat_hm->hm_ref++;
6356
6357         if (ipf_nat_insert(softc, softn, clone) == -1) {
6358                 KFREE(clone);
6359                 NBUMPSIDED(fin->fin_out, ns_insert_fail);
6360                 return NULL;
6361         }
6362
6363         np = clone->nat_ptr;
6364         if (np != NULL) {
6365                 if (softn->ipf_nat_logging)
6366                         ipf_nat_log(softc, softn, clone, NL_CLONE);
6367                 np->in_use++;
6368         }
6369         fr = clone->nat_fr;
6370         if (fr != NULL) {
6371                 MUTEX_ENTER(&fr->fr_lock);
6372                 fr->fr_ref++;
6373                 MUTEX_EXIT(&fr->fr_lock);
6374         }
6375
6376
6377         /*
6378          * Because the clone is created outside the normal loop of things and
6379          * TCP has special needs in terms of state, initialise the timeout
6380          * state of the new NAT from here.
6381          */
6382         if (clone->nat_pr[0] == IPPROTO_TCP) {
6383                 (void) ipf_tcp_age(&clone->nat_tqe, fin, softn->ipf_nat_tcptq,
6384                                    clone->nat_flags, 2);
6385         }
6386         clone->nat_sync = ipf_sync_new(softc, SMC_NAT, fin, clone);
6387         if (softn->ipf_nat_logging)
6388                 ipf_nat_log(softc, softn, clone, NL_CLONE);
6389         return clone;
6390 }
6391
6392
6393 /* ------------------------------------------------------------------------ */
6394 /* Function:   ipf_nat_wildok                                               */
6395 /* Returns:    int - 1 == packet's ports match wildcards                    */
6396 /*                   0 == packet's ports don't match wildcards              */
6397 /* Parameters: nat(I)   - NAT entry                                         */
6398 /*             sport(I) - source port                                       */
6399 /*             dport(I) - destination port                                  */
6400 /*             flags(I) - wildcard flags                                    */
6401 /*             dir(I)   - packet direction                                  */
6402 /*                                                                          */
6403 /* Use NAT entry and packet direction to determine which combination of     */
6404 /* wildcard flags should be used.                                           */
6405 /* ------------------------------------------------------------------------ */
6406 int
6407 ipf_nat_wildok(nat, sport, dport, flags, dir)
6408         nat_t *nat;
6409         int sport, dport, flags, dir;
6410 {
6411         /*
6412          * When called by       dir is set to
6413          * nat_inlookup         NAT_INBOUND (0)
6414          * nat_outlookup        NAT_OUTBOUND (1)
6415          *
6416          * We simply combine the packet's direction in dir with the original
6417          * "intended" direction of that NAT entry in nat->nat_dir to decide
6418          * which combination of wildcard flags to allow.
6419          */
6420         switch ((dir << 1) | (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND)))
6421         {
6422         case 3: /* outbound packet / outbound entry */
6423                 if (((nat->nat_osport == sport) ||
6424                     (flags & SI_W_SPORT)) &&
6425                     ((nat->nat_odport == dport) ||
6426                     (flags & SI_W_DPORT)))
6427                         return 1;
6428                 break;
6429         case 2: /* outbound packet / inbound entry */
6430                 if (((nat->nat_osport == dport) ||
6431                     (flags & SI_W_SPORT)) &&
6432                     ((nat->nat_odport == sport) ||
6433                     (flags & SI_W_DPORT)))
6434                         return 1;
6435                 break;
6436         case 1: /* inbound packet / outbound entry */
6437                 if (((nat->nat_osport == dport) ||
6438                     (flags & SI_W_SPORT)) &&
6439                     ((nat->nat_odport == sport) ||
6440                     (flags & SI_W_DPORT)))
6441                         return 1;
6442                 break;
6443         case 0: /* inbound packet / inbound entry */
6444                 if (((nat->nat_osport == sport) ||
6445                     (flags & SI_W_SPORT)) &&
6446                     ((nat->nat_odport == dport) ||
6447                     (flags & SI_W_DPORT)))
6448                         return 1;
6449                 break;
6450         default:
6451                 break;
6452         }
6453
6454         return(0);
6455 }
6456
6457
6458 /* ------------------------------------------------------------------------ */
6459 /* Function:    nat_mssclamp                                                */
6460 /* Returns:     Nil                                                         */
6461 /* Parameters:  tcp(I)    - pointer to TCP header                           */
6462 /*              maxmss(I) - value to clamp the TCP MSS to                   */
6463 /*              fin(I)    - pointer to packet information                   */
6464 /*              csump(I)  - pointer to TCP checksum                         */
6465 /*                                                                          */
6466 /* Check for MSS option and clamp it if necessary.  If found and changed,   */
6467 /* then the TCP header checksum will be updated to reflect the change in    */
6468 /* the MSS.                                                                 */
6469 /* ------------------------------------------------------------------------ */
6470 static void
6471 ipf_nat_mssclamp(tcp, maxmss, fin, csump)
6472         tcphdr_t *tcp;
6473         u_32_t maxmss;
6474         fr_info_t *fin;
6475         u_short *csump;
6476 {
6477         u_char *cp, *ep, opt;
6478         int hlen, advance;
6479         u_32_t mss, sumd;
6480
6481         hlen = TCP_OFF(tcp) << 2;
6482         if (hlen > sizeof(*tcp)) {
6483                 cp = (u_char *)tcp + sizeof(*tcp);
6484                 ep = (u_char *)tcp + hlen;
6485
6486                 while (cp < ep) {
6487                         opt = cp[0];
6488                         if (opt == TCPOPT_EOL)
6489                                 break;
6490                         else if (opt == TCPOPT_NOP) {
6491                                 cp++;
6492                                 continue;
6493                         }
6494
6495                         if (cp + 1 >= ep)
6496                                 break;
6497                         advance = cp[1];
6498                         if ((cp + advance > ep) || (advance <= 0))
6499                                 break;
6500                         switch (opt)
6501                         {
6502                         case TCPOPT_MAXSEG:
6503                                 if (advance != 4)
6504                                         break;
6505                                 mss = cp[2] * 256 + cp[3];
6506                                 if (mss > maxmss) {
6507                                         cp[2] = maxmss / 256;
6508                                         cp[3] = maxmss & 0xff;
6509                                         CALC_SUMD(mss, maxmss, sumd);
6510                                         ipf_fix_outcksum(0, csump, sumd, 0);
6511                                 }
6512                                 break;
6513                         default:
6514                                 /* ignore unknown options */
6515                                 break;
6516                         }
6517
6518                         cp += advance;
6519                 }
6520         }
6521 }
6522
6523
6524 /* ------------------------------------------------------------------------ */
6525 /* Function:    ipf_nat_setqueue                                            */
6526 /* Returns:     Nil                                                         */
6527 /* Parameters:  softc(I) - pointer to soft context main structure           */
6528 /*              softn(I) - pointer to NAT context structure                 */
6529 /*              nat(I)- pointer to NAT structure                            */
6530 /* Locks:       ipf_nat (read or write)                                     */
6531 /*                                                                          */
6532 /* Put the NAT entry on its default queue entry, using rev as a helped in   */
6533 /* determining which queue it should be placed on.                          */
6534 /* ------------------------------------------------------------------------ */
6535 void
6536 ipf_nat_setqueue(softc, softn, nat)
6537         ipf_main_softc_t *softc;
6538         ipf_nat_softc_t *softn;
6539         nat_t *nat;
6540 {
6541         ipftq_t *oifq, *nifq;
6542         int rev = nat->nat_rev;
6543
6544         if (nat->nat_ptr != NULL)
6545                 nifq = nat->nat_ptr->in_tqehead[rev];
6546         else
6547                 nifq = NULL;
6548
6549         if (nifq == NULL) {
6550                 switch (nat->nat_pr[0])
6551                 {
6552                 case IPPROTO_UDP :
6553                         nifq = &softn->ipf_nat_udptq;
6554                         break;
6555                 case IPPROTO_ICMP :
6556                         nifq = &softn->ipf_nat_icmptq;
6557                         break;
6558                 case IPPROTO_TCP :
6559                         nifq = softn->ipf_nat_tcptq +
6560                                nat->nat_tqe.tqe_state[rev];
6561                         break;
6562                 default :
6563                         nifq = &softn->ipf_nat_iptq;
6564                         break;
6565                 }
6566         }
6567
6568         oifq = nat->nat_tqe.tqe_ifq;
6569         /*
6570          * If it's currently on a timeout queue, move it from one queue to
6571          * another, else put it on the end of the newly determined queue.
6572          */
6573         if (oifq != NULL)
6574                 ipf_movequeue(softc->ipf_ticks, &nat->nat_tqe, oifq, nifq);
6575         else
6576                 ipf_queueappend(softc->ipf_ticks, &nat->nat_tqe, nifq, nat);
6577         return;
6578 }
6579
6580
6581 /* ------------------------------------------------------------------------ */
6582 /* Function:    nat_getnext                                                 */
6583 /* Returns:     int - 0 == ok, else error                                   */
6584 /* Parameters:  softc(I) - pointer to soft context main structure           */
6585 /*              t(I)   - pointer to ipftoken structure                      */
6586 /*              itp(I) - pointer to ipfgeniter_t structure                  */
6587 /*                                                                          */
6588 /* Fetch the next nat/ipnat structure pointer from the linked list and      */
6589 /* copy it out to the storage space pointed to by itp_data.  The next item  */
6590 /* in the list to look at is put back in the ipftoken struture.             */
6591 /* ------------------------------------------------------------------------ */
6592 static int
6593 ipf_nat_getnext(softc, t, itp, objp)
6594         ipf_main_softc_t *softc;
6595         ipftoken_t *t;
6596         ipfgeniter_t *itp;
6597         ipfobj_t *objp;
6598 {
6599         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6600         hostmap_t *hm, *nexthm = NULL, zerohm;
6601         ipnat_t *ipn, *nextipnat = NULL, zeroipn;
6602         nat_t *nat, *nextnat = NULL, zeronat;
6603         int error = 0;
6604         void *nnext;
6605
6606         if (itp->igi_nitems != 1) {
6607                 IPFERROR(60075);
6608                 return ENOSPC;
6609         }
6610
6611         READ_ENTER(&softc->ipf_nat);
6612
6613         switch (itp->igi_type)
6614         {
6615         case IPFGENITER_HOSTMAP :
6616                 hm = t->ipt_data;
6617                 if (hm == NULL) {
6618                         nexthm = softn->ipf_hm_maplist;
6619                 } else {
6620                         nexthm = hm->hm_next;
6621                 }
6622                 if (nexthm != NULL) {
6623                         ATOMIC_INC32(nexthm->hm_ref);
6624                         t->ipt_data = nexthm;
6625                 } else {
6626                         bzero(&zerohm, sizeof(zerohm));
6627                         nexthm = &zerohm;
6628                         t->ipt_data = NULL;
6629                 }
6630                 nnext = nexthm->hm_next;
6631                 break;
6632
6633         case IPFGENITER_IPNAT :
6634                 ipn = t->ipt_data;
6635                 if (ipn == NULL) {
6636                         nextipnat = softn->ipf_nat_list;
6637                 } else {
6638                         nextipnat = ipn->in_next;
6639                 }
6640                 if (nextipnat != NULL) {
6641                         ATOMIC_INC32(nextipnat->in_use);
6642                         t->ipt_data = nextipnat;
6643                 } else {
6644                         bzero(&zeroipn, sizeof(zeroipn));
6645                         nextipnat = &zeroipn;
6646                         t->ipt_data = NULL;
6647                 }
6648                 nnext = nextipnat->in_next;
6649                 break;
6650
6651         case IPFGENITER_NAT :
6652                 nat = t->ipt_data;
6653                 if (nat == NULL) {
6654                         nextnat = softn->ipf_nat_instances;
6655                 } else {
6656                         nextnat = nat->nat_next;
6657                 }
6658                 if (nextnat != NULL) {
6659                         MUTEX_ENTER(&nextnat->nat_lock);
6660                         nextnat->nat_ref++;
6661                         MUTEX_EXIT(&nextnat->nat_lock);
6662                         t->ipt_data = nextnat;
6663                 } else {
6664                         bzero(&zeronat, sizeof(zeronat));
6665                         nextnat = &zeronat;
6666                         t->ipt_data = NULL;
6667                 }
6668                 nnext = nextnat->nat_next;
6669                 break;
6670
6671         default :
6672                 RWLOCK_EXIT(&softc->ipf_nat);
6673                 IPFERROR(60055);
6674                 return EINVAL;
6675         }
6676
6677         RWLOCK_EXIT(&softc->ipf_nat);
6678
6679         objp->ipfo_ptr = itp->igi_data;
6680
6681         switch (itp->igi_type)
6682         {
6683         case IPFGENITER_HOSTMAP :
6684                 error = COPYOUT(nexthm, objp->ipfo_ptr, sizeof(*nexthm));
6685                 if (error != 0) {
6686                         IPFERROR(60049);
6687                         error = EFAULT;
6688                 }
6689                 if (hm != NULL) {
6690                         WRITE_ENTER(&softc->ipf_nat);
6691                         ipf_nat_hostmapdel(softc, &hm);
6692                         RWLOCK_EXIT(&softc->ipf_nat);
6693                 }
6694                 break;
6695
6696         case IPFGENITER_IPNAT :
6697                 objp->ipfo_size = nextipnat->in_size;
6698                 objp->ipfo_type = IPFOBJ_IPNAT;
6699                 error = ipf_outobjk(softc, objp, nextipnat);
6700                 if (ipn != NULL) {
6701                         WRITE_ENTER(&softc->ipf_nat);
6702                         ipf_nat_rule_deref(softc, &ipn);
6703                         RWLOCK_EXIT(&softc->ipf_nat);
6704                 }
6705                 break;
6706
6707         case IPFGENITER_NAT :
6708                 objp->ipfo_size = sizeof(nat_t);
6709                 objp->ipfo_type = IPFOBJ_NAT;
6710                 error = ipf_outobjk(softc, objp, nextnat);
6711                 if (nat != NULL)
6712                         ipf_nat_deref(softc, &nat);
6713
6714                 break;
6715         }
6716
6717         if (nnext == NULL)
6718                 ipf_token_mark_complete(t);
6719
6720         return error;
6721 }
6722
6723
6724 /* ------------------------------------------------------------------------ */
6725 /* Function:    nat_extraflush                                              */
6726 /* Returns:     int - 0 == success, -1 == failure                           */
6727 /* Parameters:  softc(I) - pointer to soft context main structure           */
6728 /*              softn(I) - pointer to NAT context structure                 */
6729 /*              which(I) - how to flush the active NAT table                */
6730 /* Write Locks: ipf_nat                                                     */
6731 /*                                                                          */
6732 /* Flush nat tables.  Three actions currently defined:                      */
6733 /* which == 0 : flush all nat table entries                                 */
6734 /* which == 1 : flush TCP connections which have started to close but are   */
6735 /*            stuck for some reason.                                        */
6736 /* which == 2 : flush TCP connections which have been idle for a long time, */
6737 /*            starting at > 4 days idle and working back in successive half-*/
6738 /*            days to at most 12 hours old.  If this fails to free enough   */
6739 /*            slots then work backwards in half hour slots to 30 minutes.   */
6740 /*            If that too fails, then work backwards in 30 second intervals */
6741 /*            for the last 30 minutes to at worst 30 seconds idle.          */
6742 /* ------------------------------------------------------------------------ */
6743 static int
6744 ipf_nat_extraflush(softc, softn, which)
6745         ipf_main_softc_t *softc;
6746         ipf_nat_softc_t *softn;
6747         int which;
6748 {
6749         nat_t *nat, **natp;
6750         ipftqent_t *tqn;
6751         ipftq_t *ifq;
6752         int removed;
6753         SPL_INT(s);
6754
6755         removed = 0;
6756
6757         SPL_NET(s);
6758         switch (which)
6759         {
6760         case 0 :
6761                 softn->ipf_nat_stats.ns_flush_all++;
6762                 /*
6763                  * Style 0 flush removes everything...
6764                  */
6765                 for (natp = &softn->ipf_nat_instances;
6766                      ((nat = *natp) != NULL); ) {
6767                         ipf_nat_delete(softc, nat, NL_FLUSH);
6768                         removed++;
6769                 }
6770                 break;
6771
6772         case 1 :
6773                 softn->ipf_nat_stats.ns_flush_closing++;
6774                 /*
6775                  * Since we're only interested in things that are closing,
6776                  * we can start with the appropriate timeout queue.
6777                  */
6778                 for (ifq = softn->ipf_nat_tcptq + IPF_TCPS_CLOSE_WAIT;
6779                      ifq != NULL; ifq = ifq->ifq_next) {
6780
6781                         for (tqn = ifq->ifq_head; tqn != NULL; ) {
6782                                 nat = tqn->tqe_parent;
6783                                 tqn = tqn->tqe_next;
6784                                 if (nat->nat_pr[0] != IPPROTO_TCP ||
6785                                     nat->nat_pr[1] != IPPROTO_TCP)
6786                                         break;
6787                                 ipf_nat_delete(softc, nat, NL_EXPIRE);
6788                                 removed++;
6789                         }
6790                 }
6791
6792                 /*
6793                  * Also need to look through the user defined queues.
6794                  */
6795                 for (ifq = softn->ipf_nat_utqe; ifq != NULL;
6796                      ifq = ifq->ifq_next) {
6797                         for (tqn = ifq->ifq_head; tqn != NULL; ) {
6798                                 nat = tqn->tqe_parent;
6799                                 tqn = tqn->tqe_next;
6800                                 if (nat->nat_pr[0] != IPPROTO_TCP ||
6801                                     nat->nat_pr[1] != IPPROTO_TCP)
6802                                         continue;
6803
6804                                 if ((nat->nat_tcpstate[0] >
6805                                      IPF_TCPS_ESTABLISHED) &&
6806                                     (nat->nat_tcpstate[1] >
6807                                      IPF_TCPS_ESTABLISHED)) {
6808                                         ipf_nat_delete(softc, nat, NL_EXPIRE);
6809                                         removed++;
6810                                 }
6811                         }
6812                 }
6813                 break;
6814
6815                 /*
6816                  * Args 5-11 correspond to flushing those particular states
6817                  * for TCP connections.
6818                  */
6819         case IPF_TCPS_CLOSE_WAIT :
6820         case IPF_TCPS_FIN_WAIT_1 :
6821         case IPF_TCPS_CLOSING :
6822         case IPF_TCPS_LAST_ACK :
6823         case IPF_TCPS_FIN_WAIT_2 :
6824         case IPF_TCPS_TIME_WAIT :
6825         case IPF_TCPS_CLOSED :
6826                 softn->ipf_nat_stats.ns_flush_state++;
6827                 tqn = softn->ipf_nat_tcptq[which].ifq_head;
6828                 while (tqn != NULL) {
6829                         nat = tqn->tqe_parent;
6830                         tqn = tqn->tqe_next;
6831                         ipf_nat_delete(softc, nat, NL_FLUSH);
6832                         removed++;
6833                 }
6834                 break;
6835
6836         default :
6837                 if (which < 30)
6838                         break;
6839
6840                 softn->ipf_nat_stats.ns_flush_timeout++;
6841                 /*
6842                  * Take a large arbitrary number to mean the number of seconds
6843                  * for which which consider to be the maximum value we'll allow
6844                  * the expiration to be.
6845                  */
6846                 which = IPF_TTLVAL(which);
6847                 for (natp = &softn->ipf_nat_instances;
6848                      ((nat = *natp) != NULL); ) {
6849                         if (softc->ipf_ticks - nat->nat_touched > which) {
6850                                 ipf_nat_delete(softc, nat, NL_FLUSH);
6851                                 removed++;
6852                         } else
6853                                 natp = &nat->nat_next;
6854                 }
6855                 break;
6856         }
6857
6858         if (which != 2) {
6859                 SPL_X(s);
6860                 return removed;
6861         }
6862
6863         softn->ipf_nat_stats.ns_flush_queue++;
6864
6865         /*
6866          * Asked to remove inactive entries because the table is full, try
6867          * again, 3 times, if first attempt failed with a different criteria
6868          * each time.  The order tried in must be in decreasing age.
6869          * Another alternative is to implement random drop and drop N entries
6870          * at random until N have been freed up.
6871          */
6872         if (softc->ipf_ticks - softn->ipf_nat_last_force_flush >
6873             IPF_TTLVAL(5)) {
6874                 softn->ipf_nat_last_force_flush = softc->ipf_ticks;
6875
6876                 removed = ipf_queueflush(softc, ipf_nat_flush_entry,
6877                                          softn->ipf_nat_tcptq,
6878                                          softn->ipf_nat_utqe,
6879                                          &softn->ipf_nat_stats.ns_active,
6880                                          softn->ipf_nat_table_sz,
6881                                          softn->ipf_nat_table_wm_low);
6882         }
6883
6884         SPL_X(s);
6885         return removed;
6886 }
6887
6888
6889 /* ------------------------------------------------------------------------ */
6890 /* Function:    ipf_nat_flush_entry                                         */
6891 /* Returns:     0 - always succeeds                                         */
6892 /* Parameters:  softc(I) - pointer to soft context main structure           */
6893 /*              entry(I) - pointer to NAT entry                             */
6894 /* Write Locks: ipf_nat                                                     */
6895 /*                                                                          */
6896 /* This function is a stepping stone between ipf_queueflush() and           */
6897 /* nat_dlete().  It is used so we can provide a uniform interface via the   */
6898 /* ipf_queueflush() function.  Since the nat_delete() function returns void */
6899 /* we translate that to mean it always succeeds in deleting something.      */
6900 /* ------------------------------------------------------------------------ */
6901 static int
6902 ipf_nat_flush_entry(softc, entry)
6903         ipf_main_softc_t *softc;
6904         void *entry;
6905 {
6906         ipf_nat_delete(softc, entry, NL_FLUSH);
6907         return 0;
6908 }
6909
6910
6911 /* ------------------------------------------------------------------------ */
6912 /* Function:    ipf_nat_iterator                                            */
6913 /* Returns:     int - 0 == ok, else error                                   */
6914 /* Parameters:  softc(I) - pointer to soft context main structure           */
6915 /*              token(I) - pointer to ipftoken structure                    */
6916 /*              itp(I)   - pointer to ipfgeniter_t structure                */
6917 /*              obj(I)   - pointer to data description structure            */
6918 /*                                                                          */
6919 /* This function acts as a handler for the SIOCGENITER ioctls that use a    */
6920 /* generic structure to iterate through a list.  There are three different  */
6921 /* linked lists of NAT related information to go through: NAT rules, active */
6922 /* NAT mappings and the NAT fragment cache.                                 */
6923 /* ------------------------------------------------------------------------ */
6924 static int
6925 ipf_nat_iterator(softc, token, itp, obj)
6926         ipf_main_softc_t *softc;
6927         ipftoken_t *token;
6928         ipfgeniter_t *itp;
6929         ipfobj_t *obj;
6930 {
6931         int error;
6932
6933         if (itp->igi_data == NULL) {
6934                 IPFERROR(60052);
6935                 return EFAULT;
6936         }
6937
6938         switch (itp->igi_type)
6939         {
6940         case IPFGENITER_HOSTMAP :
6941         case IPFGENITER_IPNAT :
6942         case IPFGENITER_NAT :
6943                 error = ipf_nat_getnext(softc, token, itp, obj);
6944                 break;
6945
6946         case IPFGENITER_NATFRAG :
6947                 error = ipf_frag_nat_next(softc, token, itp);
6948                 break;
6949         default :
6950                 IPFERROR(60053);
6951                 error = EINVAL;
6952                 break;
6953         }
6954
6955         return error;
6956 }
6957
6958
6959 /* ------------------------------------------------------------------------ */
6960 /* Function:    ipf_nat_setpending                                          */
6961 /* Returns:     Nil                                                         */
6962 /* Parameters:  softc(I) - pointer to soft context main structure           */
6963 /*              nat(I)   - pointer to NAT structure                         */
6964 /* Locks:       ipf_nat (read or write)                                     */
6965 /*                                                                          */
6966 /* Put the NAT entry on to the pending queue - this queue has a very short  */
6967 /* lifetime where items are put that can't be deleted straight away because */
6968 /* of locking issues but we want to delete them ASAP, anyway.  In calling   */
6969 /* this function, it is assumed that the owner (if there is one, as shown   */
6970 /* by nat_me) is no longer interested in it.                                */
6971 /* ------------------------------------------------------------------------ */
6972 void
6973 ipf_nat_setpending(softc, nat)
6974         ipf_main_softc_t *softc;
6975         nat_t *nat;
6976 {
6977         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6978         ipftq_t *oifq;
6979
6980         oifq = nat->nat_tqe.tqe_ifq;
6981         if (oifq != NULL)
6982                 ipf_movequeue(softc->ipf_ticks, &nat->nat_tqe, oifq,
6983                               &softn->ipf_nat_pending);
6984         else
6985                 ipf_queueappend(softc->ipf_ticks, &nat->nat_tqe,
6986                                 &softn->ipf_nat_pending, nat);
6987
6988         if (nat->nat_me != NULL) {
6989                 *nat->nat_me = NULL;
6990                 nat->nat_me = NULL;
6991                 nat->nat_ref--;
6992                 ASSERT(nat->nat_ref >= 0);
6993         }
6994 }
6995
6996
6997 /* ------------------------------------------------------------------------ */
6998 /* Function:    nat_newrewrite                                              */
6999 /* Returns:     int - -1 == error, 0 == success (no move), 1 == success and */
7000 /*                    allow rule to be moved if IPN_ROUNDR is set.          */
7001 /* Parameters:  fin(I) - pointer to packet information                      */
7002 /*              nat(I) - pointer to NAT entry                               */
7003 /*              ni(I)  - pointer to structure with misc. information needed */
7004 /*                       to create new NAT entry.                           */
7005 /* Write Lock:  ipf_nat                                                     */
7006 /*                                                                          */
7007 /* This function is responsible for setting up an active NAT session where  */
7008 /* we are changing both the source and destination parameters at the same   */
7009 /* time.  The loop in here works differently to elsewhere - each iteration  */
7010 /* is responsible for changing a single parameter that can be incremented.  */
7011 /* So one pass may increase the source IP#, next source port, next dest. IP#*/
7012 /* and the last destination port for a total of 4 iterations to try each.   */
7013 /* This is done to try and exhaustively use the translation space available.*/
7014 /* ------------------------------------------------------------------------ */
7015 static int
7016 ipf_nat_newrewrite(fin, nat, nai)
7017         fr_info_t *fin;
7018         nat_t *nat;
7019         natinfo_t *nai;
7020 {
7021         int src_search = 1;
7022         int dst_search = 1;
7023         fr_info_t frnat;
7024         u_32_t flags;
7025         u_short swap;
7026         ipnat_t *np;
7027         nat_t *natl;
7028         int l = 0;
7029         int changed;
7030
7031         natl = NULL;
7032         changed = -1;
7033         np = nai->nai_np;
7034         flags = nat->nat_flags;
7035         bcopy((char *)fin, (char *)&frnat, sizeof(*fin));
7036
7037         nat->nat_hm = NULL;
7038
7039         do {
7040                 changed = -1;
7041                 /* TRACE (l, src_search, dst_search, np) */
7042                 DT4(ipf_nat_rewrite_1, int, l, int, src_search, int, dst_search, ipnat_t *, np);
7043
7044                 if ((src_search == 0) && (np->in_spnext == 0) &&
7045                     (dst_search == 0) && (np->in_dpnext == 0)) {
7046                         if (l > 0)
7047                                 return -1;
7048                 }
7049
7050                 /*
7051                  * Find a new source address
7052                  */
7053                 if (ipf_nat_nextaddr(fin, &np->in_nsrc, &frnat.fin_saddr,
7054                                      &frnat.fin_saddr) == -1) {
7055                         return -1;
7056                 }
7057
7058                 if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0xffffffff)) {
7059                         src_search = 0;
7060                         if (np->in_stepnext == 0)
7061                                 np->in_stepnext = 1;
7062
7063                 } else if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0)) {
7064                         src_search = 0;
7065                         if (np->in_stepnext == 0)
7066                                 np->in_stepnext = 1;
7067
7068                 } else if (np->in_nsrcmsk == 0xffffffff) {
7069                         src_search = 0;
7070                         if (np->in_stepnext == 0)
7071                                 np->in_stepnext = 1;
7072
7073                 } else if (np->in_nsrcmsk != 0xffffffff) {
7074                         if (np->in_stepnext == 0 && changed == -1) {
7075                                 np->in_snip++;
7076                                 np->in_stepnext++;
7077                                 changed = 0;
7078                         }
7079                 }
7080
7081                 if ((flags & IPN_TCPUDPICMP) != 0) {
7082                         if (np->in_spnext != 0)
7083                                 frnat.fin_data[0] = np->in_spnext;
7084
7085                         /*
7086                          * Standard port translation.  Select next port.
7087                          */
7088                         if ((flags & IPN_FIXEDSPORT) != 0) {
7089                                 np->in_stepnext = 2;
7090                         } else if ((np->in_stepnext == 1) &&
7091                                    (changed == -1) && (natl != NULL)) {
7092                                 np->in_spnext++;
7093                                 np->in_stepnext++;
7094                                 changed = 1;
7095                                 if (np->in_spnext > np->in_spmax)
7096                                         np->in_spnext = np->in_spmin;
7097                         }
7098                 } else {
7099                         np->in_stepnext = 2;
7100                 }
7101                 np->in_stepnext &= 0x3;
7102
7103                 /*
7104                  * Find a new destination address
7105                  */
7106                 /* TRACE (fin, np, l, frnat) */
7107                 DT4(ipf_nat_rewrite_2, frinfo_t *, fin, ipnat_t *, np, int, l, frinfo_t *, &frnat);
7108
7109                 if (ipf_nat_nextaddr(fin, &np->in_ndst, &frnat.fin_daddr,
7110                                      &frnat.fin_daddr) == -1)
7111                         return -1;
7112                 if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0xffffffff)) {
7113                         dst_search = 0;
7114                         if (np->in_stepnext == 2)
7115                                 np->in_stepnext = 3;
7116
7117                 } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0)) {
7118                         dst_search = 0;
7119                         if (np->in_stepnext == 2)
7120                                 np->in_stepnext = 3;
7121
7122                 } else if (np->in_ndstmsk == 0xffffffff) {
7123                         dst_search = 0;
7124                         if (np->in_stepnext == 2)
7125                                 np->in_stepnext = 3;
7126
7127                 } else if (np->in_ndstmsk != 0xffffffff) {
7128                         if ((np->in_stepnext == 2) && (changed == -1) &&
7129                             (natl != NULL)) {
7130                                 changed = 2;
7131                                 np->in_stepnext++;
7132                                 np->in_dnip++;
7133                         }
7134                 }
7135
7136                 if ((flags & IPN_TCPUDPICMP) != 0) {
7137                         if (np->in_dpnext != 0)
7138                                 frnat.fin_data[1] = np->in_dpnext;
7139
7140                         /*
7141                          * Standard port translation.  Select next port.
7142                          */
7143                         if ((flags & IPN_FIXEDDPORT) != 0) {
7144                                 np->in_stepnext = 0;
7145                         } else if (np->in_stepnext == 3 && changed == -1) {
7146                                 np->in_dpnext++;
7147                                 np->in_stepnext++;
7148                                 changed = 3;
7149                                 if (np->in_dpnext > np->in_dpmax)
7150                                         np->in_dpnext = np->in_dpmin;
7151                         }
7152                 } else {
7153                         if (np->in_stepnext == 3)
7154                                 np->in_stepnext = 0;
7155                 }
7156
7157                 /* TRACE (frnat) */
7158                 DT1(ipf_nat_rewrite_3, frinfo_t *, &frnat);
7159
7160                 /*
7161                  * Here we do a lookup of the connection as seen from
7162                  * the outside.  If an IP# pair already exists, try
7163                  * again.  So if you have A->B becomes C->B, you can
7164                  * also have D->E become C->E but not D->B causing
7165                  * another C->B.  Also take protocol and ports into
7166                  * account when determining whether a pre-existing
7167                  * NAT setup will cause an external conflict where
7168                  * this is appropriate.
7169                  *
7170                  * fin_data[] is swapped around because we are doing a
7171                  * lookup of the packet is if it were moving in the opposite
7172                  * direction of the one we are working with now.
7173                  */
7174                 if (flags & IPN_TCPUDP) {
7175                         swap = frnat.fin_data[0];
7176                         frnat.fin_data[0] = frnat.fin_data[1];
7177                         frnat.fin_data[1] = swap;
7178                 }
7179                 if (fin->fin_out == 1) {
7180                         natl = ipf_nat_inlookup(&frnat,
7181                                                 flags & ~(SI_WILDP|NAT_SEARCH),
7182                                                 (u_int)frnat.fin_p,
7183                                                 frnat.fin_dst, frnat.fin_src);
7184
7185                 } else {
7186                         natl = ipf_nat_outlookup(&frnat,
7187                                                  flags & ~(SI_WILDP|NAT_SEARCH),
7188                                                  (u_int)frnat.fin_p,
7189                                                  frnat.fin_dst, frnat.fin_src);
7190                 }
7191                 if (flags & IPN_TCPUDP) {
7192                         swap = frnat.fin_data[0];
7193                         frnat.fin_data[0] = frnat.fin_data[1];
7194                         frnat.fin_data[1] = swap;
7195                 }
7196
7197                 /* TRACE natl, in_stepnext, l */
7198                 DT3(ipf_nat_rewrite_2, nat_t *, natl, ipnat_t *, np , int, l);
7199
7200                 if ((natl != NULL) && (l > 8))  /* XXX 8 is arbitrary */
7201                         return -1;
7202
7203                 np->in_stepnext &= 0x3;
7204
7205                 l++;
7206                 changed = -1;
7207         } while (natl != NULL);
7208
7209         nat->nat_osrcip = fin->fin_src;
7210         nat->nat_odstip = fin->fin_dst;
7211         nat->nat_nsrcip = frnat.fin_src;
7212         nat->nat_ndstip = frnat.fin_dst;
7213
7214         if ((flags & IPN_TCPUDP) != 0) {
7215                 nat->nat_osport = htons(fin->fin_data[0]);
7216                 nat->nat_odport = htons(fin->fin_data[1]);
7217                 nat->nat_nsport = htons(frnat.fin_data[0]);
7218                 nat->nat_ndport = htons(frnat.fin_data[1]);
7219         } else if ((flags & IPN_ICMPQUERY) != 0) {
7220                 nat->nat_oicmpid = fin->fin_data[1];
7221                 nat->nat_nicmpid = frnat.fin_data[1];
7222         }
7223
7224         return 0;
7225 }
7226
7227
7228 /* ------------------------------------------------------------------------ */
7229 /* Function:    nat_newdivert                                               */
7230 /* Returns:     int - -1 == error, 0 == success                             */
7231 /* Parameters:  fin(I) - pointer to packet information                      */
7232 /*              nat(I) - pointer to NAT entry                               */
7233 /*              ni(I)  - pointer to structure with misc. information needed */
7234 /*                       to create new NAT entry.                           */
7235 /* Write Lock:  ipf_nat                                                     */
7236 /*                                                                          */
7237 /* Create a new NAT  divert session as defined by the NAT rule.  This is    */
7238 /* somewhat different to other NAT session creation routines because we     */
7239 /* do not iterate through either port numbers or IP addresses, searching    */
7240 /* for a unique mapping, however, a complimentary duplicate check is made.  */
7241 /* ------------------------------------------------------------------------ */
7242 static int
7243 ipf_nat_newdivert(fin, nat, nai)
7244         fr_info_t *fin;
7245         nat_t *nat;
7246         natinfo_t *nai;
7247 {
7248         ipf_main_softc_t *softc = fin->fin_main_soft;
7249         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7250         fr_info_t frnat;
7251         ipnat_t *np;
7252         nat_t *natl;
7253         int p;
7254
7255         np = nai->nai_np;
7256         bcopy((char *)fin, (char *)&frnat, sizeof(*fin));
7257
7258         nat->nat_pr[0] = 0;
7259         nat->nat_osrcaddr = fin->fin_saddr;
7260         nat->nat_odstaddr = fin->fin_daddr;
7261         frnat.fin_saddr = htonl(np->in_snip);
7262         frnat.fin_daddr = htonl(np->in_dnip);
7263         if ((nat->nat_flags & IPN_TCPUDP) != 0) {
7264                 nat->nat_osport = htons(fin->fin_data[0]);
7265                 nat->nat_odport = htons(fin->fin_data[1]);
7266         } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
7267                 nat->nat_oicmpid = fin->fin_data[1];
7268         }
7269
7270         if (np->in_redir & NAT_DIVERTUDP) {
7271                 frnat.fin_data[0] = np->in_spnext;
7272                 frnat.fin_data[1] = np->in_dpnext;
7273                 frnat.fin_flx |= FI_TCPUDP;
7274                 p = IPPROTO_UDP;
7275         } else {
7276                 frnat.fin_flx &= ~FI_TCPUDP;
7277                 p = IPPROTO_IPIP;
7278         }
7279
7280         if (fin->fin_out == 1) {
7281                 natl = ipf_nat_inlookup(&frnat, 0, p,
7282                                         frnat.fin_dst, frnat.fin_src);
7283
7284         } else {
7285                 natl = ipf_nat_outlookup(&frnat, 0, p,
7286                                          frnat.fin_dst, frnat.fin_src);
7287         }
7288
7289         if (natl != NULL) {
7290                 NBUMPSIDED(fin->fin_out, ns_divert_exist);
7291                 DT3(ns_divert_exist, fr_info_t *, fin, nat_t *, nat, natinfo_t, nai);
7292                 return -1;
7293         }
7294
7295         nat->nat_nsrcaddr = frnat.fin_saddr;
7296         nat->nat_ndstaddr = frnat.fin_daddr;
7297         if ((nat->nat_flags & IPN_TCPUDP) != 0) {
7298                 nat->nat_nsport = htons(frnat.fin_data[0]);
7299                 nat->nat_ndport = htons(frnat.fin_data[1]);
7300         } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
7301                 nat->nat_nicmpid = frnat.fin_data[1];
7302         }
7303
7304         nat->nat_pr[fin->fin_out] = fin->fin_p;
7305         nat->nat_pr[1 - fin->fin_out] = p;
7306
7307         if (np->in_redir & NAT_REDIRECT)
7308                 nat->nat_dir = NAT_DIVERTIN;
7309         else
7310                 nat->nat_dir = NAT_DIVERTOUT;
7311
7312         return 0;
7313 }
7314
7315
7316 /* ------------------------------------------------------------------------ */
7317 /* Function:    nat_builddivertmp                                           */
7318 /* Returns:     int - -1 == error, 0 == success                             */
7319 /* Parameters:  softn(I) - pointer to NAT context structure                 */
7320 /*              np(I)    - pointer to a NAT rule                            */
7321 /*                                                                          */
7322 /* For divert rules, a skeleton packet representing what will be prepended  */
7323 /* to the real packet is created.  Even though we don't have the full       */
7324 /* packet here, a checksum is calculated that we update later when we       */
7325 /* fill in the final details.  At present a 0 checksum for UDP is being set */
7326 /* here because it is expected that divert will be used for localhost.      */
7327 /* ------------------------------------------------------------------------ */
7328 static int
7329 ipf_nat_builddivertmp(softn, np)
7330         ipf_nat_softc_t *softn;
7331         ipnat_t *np;
7332 {
7333         udphdr_t *uh;
7334         size_t len;
7335         ip_t *ip;
7336
7337         if ((np->in_redir & NAT_DIVERTUDP) != 0)
7338                 len = sizeof(ip_t) + sizeof(udphdr_t);
7339         else
7340                 len = sizeof(ip_t);
7341
7342         ALLOC_MB_T(np->in_divmp, len);
7343         if (np->in_divmp == NULL) {
7344                 NBUMPD(ipf_nat_stats, ns_divert_build);
7345                 return -1;
7346         }
7347
7348         /*
7349          * First, the header to get the packet diverted to the new destination
7350          */
7351         ip = MTOD(np->in_divmp, ip_t *);
7352         IP_V_A(ip, 4);
7353         IP_HL_A(ip, 5);
7354         ip->ip_tos = 0;
7355         if ((np->in_redir & NAT_DIVERTUDP) != 0)
7356                 ip->ip_p = IPPROTO_UDP;
7357         else
7358                 ip->ip_p = IPPROTO_IPIP;
7359         ip->ip_ttl = 255;
7360         ip->ip_off = 0;
7361         ip->ip_sum = 0;
7362         ip->ip_len = htons(len);
7363         ip->ip_id = 0;
7364         ip->ip_src.s_addr = htonl(np->in_snip);
7365         ip->ip_dst.s_addr = htonl(np->in_dnip);
7366         ip->ip_sum = ipf_cksum((u_short *)ip, sizeof(*ip));
7367
7368         if (np->in_redir & NAT_DIVERTUDP) {
7369                 uh = (udphdr_t *)(ip + 1);
7370                 uh->uh_sum = 0;
7371                 uh->uh_ulen = 8;
7372                 uh->uh_sport = htons(np->in_spnext);
7373                 uh->uh_dport = htons(np->in_dpnext);
7374         }
7375
7376         return 0;
7377 }
7378
7379
7380 #define MINDECAP        (sizeof(ip_t) + sizeof(udphdr_t) + sizeof(ip_t))
7381
7382 /* ------------------------------------------------------------------------ */
7383 /* Function:    nat_decap                                                   */
7384 /* Returns:     int - -1 == error, 0 == success                             */
7385 /* Parameters:  fin(I) - pointer to packet information                      */
7386 /*              nat(I) - pointer to current NAT session                     */
7387 /*                                                                          */
7388 /* This function is responsible for undoing a packet's encapsulation in the */
7389 /* reverse of an encap/divert rule.  After removing the outer encapsulation */
7390 /* it is necessary to call ipf_makefrip() again so that the contents of 'fin'*/
7391 /* match the "new" packet as it may still be used by IPFilter elsewhere.    */
7392 /* We use "dir" here as the basis for some of the expectations about the    */
7393 /* outer header.  If we return an error, the goal is to leave the original  */
7394 /* packet information undisturbed - this falls short at the end where we'd  */
7395 /* need to back a backup copy of "fin" - expensive.                         */
7396 /* ------------------------------------------------------------------------ */
7397 static int
7398 ipf_nat_decap(fin, nat)
7399         fr_info_t *fin;
7400         nat_t *nat;
7401 {
7402         ipf_main_softc_t *softc = fin->fin_main_soft;
7403         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7404         char *hdr;
7405         int hlen;
7406         int skip;
7407         mb_t *m;
7408
7409         if ((fin->fin_flx & FI_ICMPERR) != 0) {
7410                 /*
7411                  * ICMP packets don't get decapsulated, instead what we need
7412                  * to do is change the ICMP reply from including (in the data
7413                  * portion for errors) the encapsulated packet that we sent
7414                  * out to something that resembles the original packet prior
7415                  * to encapsulation.  This isn't done here - all we're doing
7416                  * here is changing the outer address to ensure that it gets
7417                  * targetted back to the correct system.
7418                  */
7419
7420                 if (nat->nat_dir & NAT_OUTBOUND) {
7421                         u_32_t sum1, sum2, sumd;
7422
7423                         sum1 = ntohl(fin->fin_daddr);
7424                         sum2 = ntohl(nat->nat_osrcaddr);
7425                         CALC_SUMD(sum1, sum2, sumd);
7426                         fin->fin_ip->ip_dst = nat->nat_osrcip;
7427                         fin->fin_daddr = nat->nat_osrcaddr;
7428 #if !defined(_KERNEL) || defined(MENTAT)
7429                         ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, sumd, 0);
7430 #endif
7431                 }
7432                 return 0;
7433         }
7434
7435         m = fin->fin_m;
7436         skip = fin->fin_hlen;
7437
7438         switch (nat->nat_dir)
7439         {
7440         case NAT_DIVERTIN :
7441         case NAT_DIVERTOUT :
7442                 if (fin->fin_plen < MINDECAP)
7443                         return -1;
7444                 skip += sizeof(udphdr_t);
7445                 break;
7446
7447         case NAT_ENCAPIN :
7448         case NAT_ENCAPOUT :
7449                 if (fin->fin_plen < (skip + sizeof(ip_t)))
7450                         return -1;
7451                 break;
7452         default :
7453                 return -1;
7454                 /* NOTREACHED */
7455         }
7456
7457         /*
7458          * The aim here is to keep the original packet details in "fin" for
7459          * as long as possible so that returning with an error is for the
7460          * original packet and there is little undoing work to do.
7461          */
7462         if (M_LEN(m) < skip + sizeof(ip_t)) {
7463                 if (ipf_pr_pullup(fin, skip + sizeof(ip_t)) == -1)
7464                         return -1;
7465         }
7466
7467         hdr = MTOD(fin->fin_m, char *);
7468         fin->fin_ip = (ip_t *)(hdr + skip);
7469         hlen = IP_HL(fin->fin_ip) << 2;
7470
7471         if (ipf_pr_pullup(fin, skip + hlen) == -1) {
7472                 NBUMPSIDED(fin->fin_out, ns_decap_pullup);
7473                 return -1;
7474         }
7475
7476         fin->fin_hlen = hlen;
7477         fin->fin_dlen -= skip;
7478         fin->fin_plen -= skip;
7479         fin->fin_ipoff += skip;
7480
7481         if (ipf_makefrip(hlen, (ip_t *)hdr, fin) == -1) {
7482                 NBUMPSIDED(fin->fin_out, ns_decap_bad);
7483                 return -1;
7484         }
7485
7486         return skip;
7487 }
7488
7489
7490 /* ------------------------------------------------------------------------ */
7491 /* Function:    nat_nextaddr                                                */
7492 /* Returns:     int - -1 == bad input (no new address),                     */
7493 /*                     0 == success and dst has new address                 */
7494 /* Parameters:  fin(I) - pointer to packet information                      */
7495 /*              na(I)  - how to generate new address                        */
7496 /*              old(I) - original address being replaced                    */
7497 /*              dst(O) - where to put the new address                       */
7498 /* Write Lock:  ipf_nat                                                     */
7499 /*                                                                          */
7500 /* This function uses the contents of the "na" structure, in combination    */
7501 /* with "old" to produce a new address to store in "dst".  Not all of the   */
7502 /* possible uses of "na" will result in a new address.                      */
7503 /* ------------------------------------------------------------------------ */
7504 static int
7505 ipf_nat_nextaddr(fin, na, old, dst)
7506         fr_info_t *fin;
7507         nat_addr_t *na;
7508         u_32_t *old, *dst;
7509 {
7510         ipf_main_softc_t *softc = fin->fin_main_soft;
7511         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7512         u_32_t amin, amax, new;
7513         i6addr_t newip;
7514         int error;
7515
7516         new = 0;
7517         amin = na->na_addr[0].in4.s_addr;
7518
7519         switch (na->na_atype)
7520         {
7521         case FRI_RANGE :
7522                 amax = na->na_addr[1].in4.s_addr;
7523                 break;
7524
7525         case FRI_NETMASKED :
7526         case FRI_DYNAMIC :
7527         case FRI_NORMAL :
7528                 /*
7529                  * Compute the maximum address by adding the inverse of the
7530                  * netmask to the minimum address.
7531                  */
7532                 amax = ~na->na_addr[1].in4.s_addr;
7533                 amax |= amin;
7534                 break;
7535
7536         case FRI_LOOKUP :
7537                 break;
7538
7539         case FRI_BROADCAST :
7540         case FRI_PEERADDR :
7541         case FRI_NETWORK :
7542         default :
7543                 DT4(ns_na_atype, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7544                 return -1;
7545         }
7546
7547         error = -1;
7548
7549         if (na->na_atype == FRI_LOOKUP) {
7550                 if (na->na_type == IPLT_DSTLIST) {
7551                         error = ipf_dstlist_select_node(fin, na->na_ptr, dst,
7552                                                         NULL);
7553                 } else {
7554                         NBUMPSIDE(fin->fin_out, ns_badnextaddr);
7555                         DT4(ns_badnextaddr_1, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7556                 }
7557
7558         } else if (na->na_atype == IPLT_NONE) {
7559                 /*
7560                  * 0/0 as the new address means leave it alone.
7561                  */
7562                 if (na->na_addr[0].in4.s_addr == 0 &&
7563                     na->na_addr[1].in4.s_addr == 0) {
7564                         new = *old;
7565
7566                 /*
7567                  * 0/32 means get the interface's address
7568                  */
7569                 } else if (na->na_addr[0].in4.s_addr == 0 &&
7570                            na->na_addr[1].in4.s_addr == 0xffffffff) {
7571                         if (ipf_ifpaddr(softc, 4, na->na_atype,
7572                                         fin->fin_ifp, &newip, NULL) == -1) {
7573                                 NBUMPSIDED(fin->fin_out, ns_ifpaddrfail);
7574                                 DT4(ns_ifpaddrfail, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7575                                 return -1;
7576                         }
7577                         new = newip.in4.s_addr;
7578                 } else {
7579                         new = htonl(na->na_nextip);
7580                 }
7581                 *dst = new;
7582                 error = 0;
7583
7584         } else {
7585                 NBUMPSIDE(fin->fin_out, ns_badnextaddr);
7586                 DT4(ns_badnextaddr_2, fr_info_t *, fin, nat_addr_t *, na, u_32_t *, old, u_32_t *, new);
7587         }
7588
7589         return error;
7590 }
7591
7592
7593 /* ------------------------------------------------------------------------ */
7594 /* Function:    nat_nextaddrinit                                            */
7595 /* Returns:     int - 0 == success, else error number                       */
7596 /* Parameters:  softc(I) - pointer to soft context main structure           */
7597 /*              na(I)      - NAT address information for generating new addr*/
7598 /*              initial(I) - flag indicating if it is the first call for    */
7599 /*                           this "na" structure.                           */
7600 /*              ifp(I)     - network interface to derive address            */
7601 /*                           information from.                              */
7602 /*                                                                          */
7603 /* This function is expected to be called in two scenarious: when a new NAT */
7604 /* rule is loaded into the kernel and when the list of NAT rules is sync'd  */
7605 /* up with the valid network interfaces (possibly due to them changing.)    */
7606 /* To distinguish between these, the "initial" parameter is used.  If it is */
7607 /* 1 then this indicates the rule has just been reloaded and 0 for when we  */
7608 /* are updating information.  This difference is important because in       */
7609 /* instances where we are not updating address information associated with  */
7610 /* a network interface, we don't want to disturb what the "next" address to */
7611 /* come out of ipf_nat_nextaddr() will be.                                  */
7612 /* ------------------------------------------------------------------------ */
7613 static int
7614 ipf_nat_nextaddrinit(softc, base, na, initial, ifp)
7615         ipf_main_softc_t *softc;
7616         char *base;
7617         nat_addr_t *na;
7618         int initial;
7619         void *ifp;
7620 {
7621
7622         switch (na->na_atype)
7623         {
7624         case FRI_LOOKUP :
7625                 if (na->na_subtype == 0) {
7626                         na->na_ptr = ipf_lookup_res_num(softc, IPL_LOGNAT,
7627                                                         na->na_type,
7628                                                         na->na_num,
7629                                                         &na->na_func);
7630                 } else if (na->na_subtype == 1) {
7631                         na->na_ptr = ipf_lookup_res_name(softc, IPL_LOGNAT,
7632                                                          na->na_type,
7633                                                          base + na->na_num,
7634                                                          &na->na_func);
7635                 }
7636                 if (na->na_func == NULL) {
7637                         IPFERROR(60060);
7638                         return ESRCH;
7639                 }
7640                 if (na->na_ptr == NULL) {
7641                         IPFERROR(60056);
7642                         return ESRCH;
7643                 }
7644                 break;
7645
7646         case FRI_DYNAMIC :
7647         case FRI_BROADCAST :
7648         case FRI_NETWORK :
7649         case FRI_NETMASKED :
7650         case FRI_PEERADDR :
7651                 if (ifp != NULL)
7652                         (void )ipf_ifpaddr(softc, 4, na->na_atype, ifp,
7653                                            &na->na_addr[0], &na->na_addr[1]);
7654                 break;
7655
7656         case FRI_SPLIT :
7657         case FRI_RANGE :
7658                 if (initial)
7659                         na->na_nextip = ntohl(na->na_addr[0].in4.s_addr);
7660                 break;
7661
7662         case FRI_NONE :
7663                 na->na_addr[0].in4.s_addr &= na->na_addr[1].in4.s_addr;
7664                 return 0;
7665
7666         case FRI_NORMAL :
7667                 na->na_addr[0].in4.s_addr &= na->na_addr[1].in4.s_addr;
7668                 break;
7669
7670         default :
7671                 IPFERROR(60054);
7672                 return EINVAL;
7673         }
7674
7675         if (initial && (na->na_atype == FRI_NORMAL)) {
7676                 if (na->na_addr[0].in4.s_addr == 0) {
7677                         if ((na->na_addr[1].in4.s_addr == 0xffffffff) ||
7678                             (na->na_addr[1].in4.s_addr == 0)) {
7679                                 return 0;
7680                         }
7681                 }
7682
7683                 if (na->na_addr[1].in4.s_addr == 0xffffffff) {
7684                         na->na_nextip = ntohl(na->na_addr[0].in4.s_addr);
7685                 } else {
7686                         na->na_nextip = ntohl(na->na_addr[0].in4.s_addr) + 1;
7687                 }
7688         }
7689
7690         return 0;
7691 }
7692
7693
7694 /* ------------------------------------------------------------------------ */
7695 /* Function:    ipf_nat_matchflush                                          */
7696 /* Returns:     int - -1 == error, 0 == success                             */
7697 /* Parameters:  softc(I) - pointer to soft context main structure           */
7698 /*              softn(I) - pointer to NAT context structure                 */
7699 /*              nat(I)   - pointer to current NAT session                   */
7700 /*                                                                          */
7701 /* ------------------------------------------------------------------------ */
7702 static int
7703 ipf_nat_matchflush(softc, softn, data)
7704         ipf_main_softc_t *softc;
7705         ipf_nat_softc_t *softn;
7706         caddr_t data;
7707 {
7708         int *array, flushed, error;
7709         nat_t *nat, *natnext;
7710         ipfobj_t obj;
7711
7712         error = ipf_matcharray_load(softc, data, &obj, &array);
7713         if (error != 0)
7714                 return error;
7715
7716         flushed = 0;
7717
7718         for (nat = softn->ipf_nat_instances; nat != NULL; nat = natnext) {
7719                 natnext = nat->nat_next;
7720                 if (ipf_nat_matcharray(nat, array, softc->ipf_ticks) == 0) {
7721                         ipf_nat_delete(softc, nat, NL_FLUSH);
7722                         flushed++;
7723                 }
7724         }
7725
7726         obj.ipfo_retval = flushed;
7727         error = BCOPYOUT(&obj, data, sizeof(obj));
7728
7729         KFREES(array, array[0] * sizeof(*array));
7730
7731         return error;
7732 }
7733
7734
7735 /* ------------------------------------------------------------------------ */
7736 /* Function:    ipf_nat_matcharray                                          */
7737 /* Returns:     int - -1 == error, 0 == success                             */
7738 /* Parameters:  fin(I) - pointer to packet information                      */
7739 /*              nat(I) - pointer to current NAT session                     */
7740 /*                                                                          */
7741 /* ------------------------------------------------------------------------ */
7742 static int
7743 ipf_nat_matcharray(nat, array, ticks)
7744         nat_t *nat;
7745         int *array;
7746         u_long ticks;
7747 {
7748         int i, n, *x, e, p;
7749
7750         e = 0;
7751         n = array[0];
7752         x = array + 1;
7753
7754         for (; n > 0; x += 3 + x[2]) {
7755                 if (x[0] == IPF_EXP_END)
7756                         break;
7757                 e = 0;
7758
7759                 n -= x[2] + 3;
7760                 if (n < 0)
7761                         break;
7762
7763                 p = x[0] >> 16;
7764                 if (p != 0 && p != nat->nat_pr[1])
7765                         break;
7766
7767                 switch (x[0])
7768                 {
7769                 case IPF_EXP_IP_PR :
7770                         for (i = 0; !e && i < x[2]; i++) {
7771                                 e |= (nat->nat_pr[1] == x[i + 3]);
7772                         }
7773                         break;
7774
7775                 case IPF_EXP_IP_SRCADDR :
7776                         if (nat->nat_v[0] == 4) {
7777                                 for (i = 0; !e && i < x[2]; i++) {
7778                                         e |= ((nat->nat_osrcaddr & x[i + 4]) ==
7779                                               x[i + 3]);
7780                                 }
7781                         }
7782                         if (nat->nat_v[1] == 4) {
7783                                 for (i = 0; !e && i < x[2]; i++) {
7784                                         e |= ((nat->nat_nsrcaddr & x[i + 4]) ==
7785                                               x[i + 3]);
7786                                 }
7787                         }
7788                         break;
7789
7790                 case IPF_EXP_IP_DSTADDR :
7791                         if (nat->nat_v[0] == 4) {
7792                                 for (i = 0; !e && i < x[2]; i++) {
7793                                         e |= ((nat->nat_odstaddr & x[i + 4]) ==
7794                                               x[i + 3]);
7795                                 }
7796                         }
7797                         if (nat->nat_v[1] == 4) {
7798                                 for (i = 0; !e && i < x[2]; i++) {
7799                                         e |= ((nat->nat_ndstaddr & x[i + 4]) ==
7800                                               x[i + 3]);
7801                                 }
7802                         }
7803                         break;
7804
7805                 case IPF_EXP_IP_ADDR :
7806                         for (i = 0; !e && i < x[2]; i++) {
7807                                 if (nat->nat_v[0] == 4) {
7808                                         e |= ((nat->nat_osrcaddr & x[i + 4]) ==
7809                                               x[i + 3]);
7810                                 }
7811                                 if (nat->nat_v[1] == 4) {
7812                                         e |= ((nat->nat_nsrcaddr & x[i + 4]) ==
7813                                               x[i + 3]);
7814                                 }
7815                                 if (nat->nat_v[0] == 4) {
7816                                         e |= ((nat->nat_odstaddr & x[i + 4]) ==
7817                                               x[i + 3]);
7818                                 }
7819                                 if (nat->nat_v[1] == 4) {
7820                                         e |= ((nat->nat_ndstaddr & x[i + 4]) ==
7821                                               x[i + 3]);
7822                                 }
7823                         }
7824                         break;
7825
7826 #ifdef USE_INET6
7827                 case IPF_EXP_IP6_SRCADDR :
7828                         if (nat->nat_v[0] == 6) {
7829                                 for (i = 0; !e && i < x[3]; i++) {
7830                                         e |= IP6_MASKEQ(&nat->nat_osrc6,
7831                                                         x + i + 7, x + i + 3);
7832                                 }
7833                         }
7834                         if (nat->nat_v[1] == 6) {
7835                                 for (i = 0; !e && i < x[3]; i++) {
7836                                         e |= IP6_MASKEQ(&nat->nat_nsrc6,
7837                                                         x + i + 7, x + i + 3);
7838                                 }
7839                         }
7840                         break;
7841
7842                 case IPF_EXP_IP6_DSTADDR :
7843                         if (nat->nat_v[0] == 6) {
7844                                 for (i = 0; !e && i < x[3]; i++) {
7845                                         e |= IP6_MASKEQ(&nat->nat_odst6,
7846                                                         x + i + 7,
7847                                                         x + i + 3);
7848                                 }
7849                         }
7850                         if (nat->nat_v[1] == 6) {
7851                                 for (i = 0; !e && i < x[3]; i++) {
7852                                         e |= IP6_MASKEQ(&nat->nat_ndst6,
7853                                                         x + i + 7,
7854                                                         x + i + 3);
7855                                 }
7856                         }
7857                         break;
7858
7859                 case IPF_EXP_IP6_ADDR :
7860                         for (i = 0; !e && i < x[3]; i++) {
7861                                 if (nat->nat_v[0] == 6) {
7862                                         e |= IP6_MASKEQ(&nat->nat_osrc6,
7863                                                         x + i + 7,
7864                                                         x + i + 3);
7865                                 }
7866                                 if (nat->nat_v[0] == 6) {
7867                                         e |= IP6_MASKEQ(&nat->nat_odst6,
7868                                                         x + i + 7,
7869                                                         x + i + 3);
7870                                 }
7871                                 if (nat->nat_v[1] == 6) {
7872                                         e |= IP6_MASKEQ(&nat->nat_nsrc6,
7873                                                         x + i + 7,
7874                                                         x + i + 3);
7875                                 }
7876                                 if (nat->nat_v[1] == 6) {
7877                                         e |= IP6_MASKEQ(&nat->nat_ndst6,
7878                                                         x + i + 7,
7879                                                         x + i + 3);
7880                                 }
7881                         }
7882                         break;
7883 #endif
7884
7885                 case IPF_EXP_UDP_PORT :
7886                 case IPF_EXP_TCP_PORT :
7887                         for (i = 0; !e && i < x[2]; i++) {
7888                                 e |= (nat->nat_nsport == x[i + 3]) ||
7889                                      (nat->nat_ndport == x[i + 3]);
7890                         }
7891                         break;
7892
7893                 case IPF_EXP_UDP_SPORT :
7894                 case IPF_EXP_TCP_SPORT :
7895                         for (i = 0; !e && i < x[2]; i++) {
7896                                 e |= (nat->nat_nsport == x[i + 3]);
7897                         }
7898                         break;
7899
7900                 case IPF_EXP_UDP_DPORT :
7901                 case IPF_EXP_TCP_DPORT :
7902                         for (i = 0; !e && i < x[2]; i++) {
7903                                 e |= (nat->nat_ndport == x[i + 3]);
7904                         }
7905                         break;
7906
7907                 case IPF_EXP_TCP_STATE :
7908                         for (i = 0; !e && i < x[2]; i++) {
7909                                 e |= (nat->nat_tcpstate[0] == x[i + 3]) ||
7910                                      (nat->nat_tcpstate[1] == x[i + 3]);
7911                         }
7912                         break;
7913
7914                 case IPF_EXP_IDLE_GT :
7915                         e |= (ticks - nat->nat_touched > x[3]);
7916                         break;
7917                 }
7918                 e ^= x[1];
7919
7920                 if (!e)
7921                         break;
7922         }
7923
7924         return e;
7925 }
7926
7927
7928 /* ------------------------------------------------------------------------ */
7929 /* Function:    ipf_nat_gettable                                            */
7930 /* Returns:     int     - 0 = success, else error                           */
7931 /* Parameters:  softc(I) - pointer to soft context main structure           */
7932 /*              softn(I) - pointer to NAT context structure                 */
7933 /*              data(I)  - pointer to ioctl data                            */
7934 /*                                                                          */
7935 /* This function handles ioctl requests for tables of nat information.      */
7936 /* At present the only table it deals with is the hash bucket statistics.   */
7937 /* ------------------------------------------------------------------------ */
7938 static int
7939 ipf_nat_gettable(softc, softn, data)
7940         ipf_main_softc_t *softc;
7941         ipf_nat_softc_t *softn;
7942         char *data;
7943 {
7944         ipftable_t table;
7945         int error;
7946
7947         error = ipf_inobj(softc, data, NULL, &table, IPFOBJ_GTABLE);
7948         if (error != 0)
7949                 return error;
7950
7951         switch (table.ita_type)
7952         {
7953         case IPFTABLE_BUCKETS_NATIN :
7954                 error = COPYOUT(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
7955                                 table.ita_table,
7956                                 softn->ipf_nat_table_sz * sizeof(u_int));
7957                 break;
7958
7959         case IPFTABLE_BUCKETS_NATOUT :
7960                 error = COPYOUT(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
7961                                 table.ita_table,
7962                                 softn->ipf_nat_table_sz * sizeof(u_int));
7963                 break;
7964
7965         default :
7966                 IPFERROR(60058);
7967                 return EINVAL;
7968         }
7969
7970         if (error != 0) {
7971                 IPFERROR(60059);
7972                 error = EFAULT;
7973         }
7974         return error;
7975 }
7976
7977
7978 /* ------------------------------------------------------------------------ */
7979 /* Function:    ipf_nat_settimeout                                          */
7980 /* Returns:     int  - 0 = success, else failure                            */
7981 /* Parameters:  softc(I) - pointer to soft context main structure           */
7982 /*              t(I) - pointer to tunable                                   */
7983 /*              p(I) - pointer to new tuning data                           */
7984 /*                                                                          */
7985 /* Apply the timeout change to the NAT timeout queues.                      */
7986 /* ------------------------------------------------------------------------ */
7987 int
7988 ipf_nat_settimeout(softc, t, p)
7989         struct ipf_main_softc_s *softc;
7990         ipftuneable_t *t;
7991         ipftuneval_t *p;
7992 {
7993         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7994
7995         if (!strncmp(t->ipft_name, "tcp_", 4))
7996                 return ipf_settimeout_tcp(t, p, softn->ipf_nat_tcptq);
7997
7998         if (!strcmp(t->ipft_name, "udp_timeout")) {
7999                 ipf_apply_timeout(&softn->ipf_nat_udptq, p->ipftu_int);
8000         } else if (!strcmp(t->ipft_name, "udp_ack_timeout")) {
8001                 ipf_apply_timeout(&softn->ipf_nat_udpacktq, p->ipftu_int);
8002         } else if (!strcmp(t->ipft_name, "icmp_timeout")) {
8003                 ipf_apply_timeout(&softn->ipf_nat_icmptq, p->ipftu_int);
8004         } else if (!strcmp(t->ipft_name, "icmp_ack_timeout")) {
8005                 ipf_apply_timeout(&softn->ipf_nat_icmpacktq, p->ipftu_int);
8006         } else if (!strcmp(t->ipft_name, "ip_timeout")) {
8007                 ipf_apply_timeout(&softn->ipf_nat_iptq, p->ipftu_int);
8008         } else {
8009                 IPFERROR(60062);
8010                 return ESRCH;
8011         }
8012         return 0;
8013 }
8014
8015
8016 /* ------------------------------------------------------------------------ */
8017 /* Function:    ipf_nat_rehash                                              */
8018 /* Returns:     int  - 0 = success, else failure                            */
8019 /* Parameters:  softc(I) - pointer to soft context main structure           */
8020 /*              t(I) - pointer to tunable                                   */
8021 /*              p(I) - pointer to new tuning data                           */
8022 /*                                                                          */
8023 /* To change the size of the basic NAT table, we need to first allocate the */
8024 /* new tables (lest it fails and we've got nowhere to store all of the NAT  */
8025 /* sessions currently active) and then walk through the entire list and     */
8026 /* insert them into the table.  There are two tables here: an inbound one   */
8027 /* and an outbound one.  Each NAT entry goes into each table once.          */
8028 /* ------------------------------------------------------------------------ */
8029 int
8030 ipf_nat_rehash(softc, t, p)
8031         ipf_main_softc_t *softc;
8032         ipftuneable_t *t;
8033         ipftuneval_t *p;
8034 {
8035         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8036         nat_t **newtab[2], *nat, **natp;
8037         u_int *bucketlens[2];
8038         u_int maxbucket;
8039         u_int newsize;
8040         int error;
8041         u_int hv;
8042         int i;
8043
8044         newsize = p->ipftu_int;
8045         /*
8046          * In case there is nothing to do...
8047          */
8048         if (newsize == softn->ipf_nat_table_sz)
8049                 return 0;
8050
8051         newtab[0] = NULL;
8052         newtab[1] = NULL;
8053         bucketlens[0] = NULL;
8054         bucketlens[1] = NULL;
8055         /*
8056          * 4 tables depend on the NAT table size: the inbound looking table,
8057          * the outbound lookup table and the hash chain length for each.
8058          */
8059         KMALLOCS(newtab[0], nat_t **, newsize * sizeof(nat_t *));
8060         if (newtab[0] == NULL) {
8061                 error = 60063;
8062                 goto badrehash;
8063         }
8064
8065         KMALLOCS(newtab[1], nat_t **, newsize * sizeof(nat_t *));
8066         if (newtab[1] == NULL) {
8067                 error = 60064;
8068                 goto badrehash;
8069         }
8070
8071         KMALLOCS(bucketlens[0], u_int *, newsize * sizeof(u_int));
8072         if (bucketlens[0] == NULL) {
8073                 error = 60065;
8074                 goto badrehash;
8075         }
8076
8077         KMALLOCS(bucketlens[1], u_int *, newsize * sizeof(u_int));
8078         if (bucketlens[1] == NULL) {
8079                 error = 60066;
8080                 goto badrehash;
8081         }
8082
8083         /*
8084          * Recalculate the maximum length based on the new size.
8085          */
8086         for (maxbucket = 0, i = newsize; i > 0; i >>= 1)
8087                 maxbucket++;
8088         maxbucket *= 2;
8089
8090         bzero((char *)newtab[0], newsize * sizeof(nat_t *));
8091         bzero((char *)newtab[1], newsize * sizeof(nat_t *));
8092         bzero((char *)bucketlens[0], newsize * sizeof(u_int));
8093         bzero((char *)bucketlens[1], newsize * sizeof(u_int));
8094
8095         WRITE_ENTER(&softc->ipf_nat);
8096
8097         if (softn->ipf_nat_table[0] != NULL) {
8098                 KFREES(softn->ipf_nat_table[0],
8099                        softn->ipf_nat_table_sz *
8100                        sizeof(*softn->ipf_nat_table[0]));
8101         }
8102         softn->ipf_nat_table[0] = newtab[0];
8103
8104         if (softn->ipf_nat_table[1] != NULL) {
8105                 KFREES(softn->ipf_nat_table[1],
8106                        softn->ipf_nat_table_sz *
8107                        sizeof(*softn->ipf_nat_table[1]));
8108         }
8109         softn->ipf_nat_table[1] = newtab[1];
8110
8111         if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen != NULL) {
8112                 KFREES(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
8113                        softn->ipf_nat_table_sz * sizeof(u_int));
8114         }
8115         softn->ipf_nat_stats.ns_side[0].ns_bucketlen = bucketlens[0];
8116
8117         if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen != NULL) {
8118                 KFREES(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
8119                        softn->ipf_nat_table_sz * sizeof(u_int));
8120         }
8121         softn->ipf_nat_stats.ns_side[1].ns_bucketlen = bucketlens[1];
8122
8123 #ifdef USE_INET6
8124         if (softn->ipf_nat_stats.ns_side6[0].ns_bucketlen != NULL) {
8125                 KFREES(softn->ipf_nat_stats.ns_side6[0].ns_bucketlen,
8126                        softn->ipf_nat_table_sz * sizeof(u_int));
8127         }
8128         softn->ipf_nat_stats.ns_side6[0].ns_bucketlen = bucketlens[0];
8129
8130         if (softn->ipf_nat_stats.ns_side6[1].ns_bucketlen != NULL) {
8131                 KFREES(softn->ipf_nat_stats.ns_side6[1].ns_bucketlen,
8132                        softn->ipf_nat_table_sz * sizeof(u_int));
8133         }
8134         softn->ipf_nat_stats.ns_side6[1].ns_bucketlen = bucketlens[1];
8135 #endif
8136
8137         softn->ipf_nat_maxbucket = maxbucket;
8138         softn->ipf_nat_table_sz = newsize;
8139         /*
8140          * Walk through the entire list of NAT table entries and put them
8141          * in the new NAT table, somewhere.  Because we have a new table,
8142          * we need to restart the counter of how many chains are in use.
8143          */
8144         softn->ipf_nat_stats.ns_side[0].ns_inuse = 0;
8145         softn->ipf_nat_stats.ns_side[1].ns_inuse = 0;
8146 #ifdef USE_INET6
8147         softn->ipf_nat_stats.ns_side6[0].ns_inuse = 0;
8148         softn->ipf_nat_stats.ns_side6[1].ns_inuse = 0;
8149 #endif
8150
8151         for (nat = softn->ipf_nat_instances; nat != NULL; nat = nat->nat_next) {
8152                 nat->nat_hnext[0] = NULL;
8153                 nat->nat_phnext[0] = NULL;
8154                 hv = nat->nat_hv[0] % softn->ipf_nat_table_sz;
8155
8156                 natp = &softn->ipf_nat_table[0][hv];
8157                 if (*natp) {
8158                         (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
8159                 } else {
8160                         NBUMPSIDE(0, ns_inuse);
8161                 }
8162                 nat->nat_phnext[0] = natp;
8163                 nat->nat_hnext[0] = *natp;
8164                 *natp = nat;
8165                 NBUMPSIDE(0, ns_bucketlen[hv]);
8166
8167                 nat->nat_hnext[1] = NULL;
8168                 nat->nat_phnext[1] = NULL;
8169                 hv = nat->nat_hv[1] % softn->ipf_nat_table_sz;
8170
8171                 natp = &softn->ipf_nat_table[1][hv];
8172                 if (*natp) {
8173                         (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
8174                 } else {
8175                         NBUMPSIDE(1, ns_inuse);
8176                 }
8177                 nat->nat_phnext[1] = natp;
8178                 nat->nat_hnext[1] = *natp;
8179                 *natp = nat;
8180                 NBUMPSIDE(1, ns_bucketlen[hv]);
8181         }
8182         RWLOCK_EXIT(&softc->ipf_nat);
8183
8184         return 0;
8185
8186 badrehash:
8187         if (bucketlens[1] != NULL) {
8188                 KFREES(bucketlens[0], newsize * sizeof(u_int));
8189         }
8190         if (bucketlens[0] != NULL) {
8191                 KFREES(bucketlens[0], newsize * sizeof(u_int));
8192         }
8193         if (newtab[0] != NULL) {
8194                 KFREES(newtab[0], newsize * sizeof(nat_t *));
8195         }
8196         if (newtab[1] != NULL) {
8197                 KFREES(newtab[1], newsize * sizeof(nat_t *));
8198         }
8199         IPFERROR(error);
8200         return ENOMEM;
8201 }
8202
8203
8204 /* ------------------------------------------------------------------------ */
8205 /* Function:    ipf_nat_rehash_rules                                        */
8206 /* Returns:     int  - 0 = success, else failure                            */
8207 /* Parameters:  softc(I) - pointer to soft context main structure           */
8208 /*              t(I) - pointer to tunable                                   */
8209 /*              p(I) - pointer to new tuning data                           */
8210 /*                                                                          */
8211 /* All of the NAT rules hang off of a hash table that is searched with a    */
8212 /* hash on address after the netmask is applied.  There is a different table*/
8213 /* for both inbound rules (rdr) and outbound (map.)  The resizing will only */
8214 /* affect one of these two tables.                                          */
8215 /* ------------------------------------------------------------------------ */
8216 int
8217 ipf_nat_rehash_rules(softc, t, p)
8218         ipf_main_softc_t *softc;
8219         ipftuneable_t *t;
8220         ipftuneval_t *p;
8221 {
8222         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8223         ipnat_t **newtab, *np, ***old, **npp;
8224         u_int newsize;
8225         u_int mask;
8226         u_int hv;
8227
8228         newsize = p->ipftu_int;
8229         /*
8230          * In case there is nothing to do...
8231          */
8232         if (newsize == *t->ipft_pint)
8233                 return 0;
8234
8235         /*
8236          * All inbound rules have the NAT_REDIRECT bit set in in_redir and
8237          * all outbound rules have either NAT_MAP or MAT_MAPBLK set.
8238          * This if statement allows for some more generic code to be below,
8239          * rather than two huge gobs of code that almost do the same thing.
8240          */
8241         if (t->ipft_pint == &softn->ipf_nat_rdrrules_sz) {
8242                 old = &softn->ipf_nat_rdr_rules;
8243                 mask = NAT_REDIRECT;
8244         } else {
8245                 old = &softn->ipf_nat_map_rules;
8246                 mask = NAT_MAP|NAT_MAPBLK;
8247         }
8248
8249         KMALLOCS(newtab, ipnat_t **, newsize * sizeof(ipnat_t *));
8250         if (newtab == NULL) {
8251                 IPFERROR(60067);
8252                 return ENOMEM;
8253         }
8254
8255         bzero((char *)newtab, newsize * sizeof(ipnat_t *));
8256
8257         WRITE_ENTER(&softc->ipf_nat);
8258
8259         if (*old != NULL) {
8260                 KFREES(*old, *t->ipft_pint * sizeof(ipnat_t **));
8261         }
8262         *old = newtab;
8263         *t->ipft_pint = newsize;
8264
8265         for (np = softn->ipf_nat_list; np != NULL; np = np->in_next) {
8266                 if ((np->in_redir & mask) == 0)
8267                         continue;
8268
8269                 if (np->in_redir & NAT_REDIRECT) {
8270                         np->in_rnext = NULL;
8271                         hv = np->in_hv[0] % newsize;
8272                         for (npp = newtab + hv; *npp != NULL; )
8273                                 npp = &(*npp)->in_rnext;
8274                         np->in_prnext = npp;
8275                         *npp = np;
8276                 }
8277                 if (np->in_redir & NAT_MAP) {
8278                         np->in_mnext = NULL;
8279                         hv = np->in_hv[1] % newsize;
8280                         for (npp = newtab + hv; *npp != NULL; )
8281                                 npp = &(*npp)->in_mnext;
8282                         np->in_pmnext = npp;
8283                         *npp = np;
8284                 }
8285
8286         }
8287         RWLOCK_EXIT(&softc->ipf_nat);
8288
8289         return 0;
8290 }
8291
8292
8293 /* ------------------------------------------------------------------------ */
8294 /* Function:    ipf_nat_hostmap_rehash                                      */
8295 /* Returns:     int  - 0 = success, else failure                            */
8296 /* Parameters:  softc(I) - pointer to soft context main structure           */
8297 /*              t(I) - pointer to tunable                                   */
8298 /*              p(I) - pointer to new tuning data                           */
8299 /*                                                                          */
8300 /* Allocate and populate a new hash table that will contain a reference to  */
8301 /* all of the active IP# translations currently in place.                   */
8302 /* ------------------------------------------------------------------------ */
8303 int
8304 ipf_nat_hostmap_rehash(softc, t, p)
8305         ipf_main_softc_t *softc;
8306         ipftuneable_t *t;
8307         ipftuneval_t *p;
8308 {
8309         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8310         hostmap_t *hm, **newtab;
8311         u_int newsize;
8312         u_int hv;
8313
8314         newsize = p->ipftu_int;
8315         /*
8316          * In case there is nothing to do...
8317          */
8318         if (newsize == *t->ipft_pint)
8319                 return 0;
8320
8321         KMALLOCS(newtab, hostmap_t **, newsize * sizeof(hostmap_t *));
8322         if (newtab == NULL) {
8323                 IPFERROR(60068);
8324                 return ENOMEM;
8325         }
8326
8327         bzero((char *)newtab, newsize * sizeof(hostmap_t *));
8328
8329         WRITE_ENTER(&softc->ipf_nat);
8330         if (softn->ipf_hm_maptable != NULL) {
8331                 KFREES(softn->ipf_hm_maptable,
8332                        softn->ipf_nat_hostmap_sz * sizeof(hostmap_t *));
8333         }
8334         softn->ipf_hm_maptable = newtab;
8335         softn->ipf_nat_hostmap_sz = newsize;
8336
8337         for (hm = softn->ipf_hm_maplist; hm != NULL; hm = hm->hm_next) {
8338                 hv = hm->hm_hv % softn->ipf_nat_hostmap_sz;
8339                 hm->hm_hnext = softn->ipf_hm_maptable[hv];
8340                 hm->hm_phnext = softn->ipf_hm_maptable + hv;
8341                 if (softn->ipf_hm_maptable[hv] != NULL)
8342                         softn->ipf_hm_maptable[hv]->hm_phnext = &hm->hm_hnext;
8343                 softn->ipf_hm_maptable[hv] = hm;
8344         }
8345         RWLOCK_EXIT(&softc->ipf_nat);
8346
8347         return 0;
8348 }
8349
8350
8351 /* ------------------------------------------------------------------------ */
8352 /* Function:    ipf_nat_add_tq                                              */
8353 /* Parameters:  softc(I) - pointer to soft context main structure           */
8354 /*                                                                          */
8355 /* ------------------------------------------------------------------------ */
8356 ipftq_t *
8357 ipf_nat_add_tq(softc, ttl)
8358         ipf_main_softc_t *softc;
8359         int ttl;
8360 {
8361         ipf_nat_softc_t *softs = softc->ipf_nat_soft;
8362
8363         return ipf_addtimeoutqueue(softc, &softs->ipf_nat_utqe, ttl);
8364 }
8365
8366 /* ------------------------------------------------------------------------ */
8367 /* Function:    ipf_nat_uncreate                                            */
8368 /* Returns:     Nil                                                         */
8369 /* Parameters:  fin(I) - pointer to packet information                      */
8370 /*                                                                          */
8371 /* This function is used to remove a NAT entry from the NAT table when we   */
8372 /* decide that the create was actually in error. It is thus assumed that    */
8373 /* fin_flx will have both FI_NATED and FI_NATNEW set. Because we're dealing */
8374 /* with the translated packet (not the original), we have to reverse the    */
8375 /* lookup. Although doing the lookup is expensive (relatively speaking), it */
8376 /* is not anticipated that this will be a frequent occurance for normal     */
8377 /* traffic patterns.                                                        */
8378 /* ------------------------------------------------------------------------ */
8379 void
8380 ipf_nat_uncreate(fin)
8381         fr_info_t *fin;
8382 {
8383         ipf_main_softc_t *softc = fin->fin_main_soft;
8384         ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8385         int nflags;
8386         nat_t *nat;
8387
8388         switch (fin->fin_p)
8389         {
8390         case IPPROTO_TCP :
8391                 nflags = IPN_TCP;
8392                 break;
8393         case IPPROTO_UDP :
8394                 nflags = IPN_UDP;
8395                 break;
8396         default :
8397                 nflags = 0;
8398                 break;
8399         }
8400
8401         WRITE_ENTER(&softc->ipf_nat);
8402
8403         if (fin->fin_out == 0) {
8404                 nat = ipf_nat_outlookup(fin, nflags, (u_int)fin->fin_p,
8405                                         fin->fin_dst, fin->fin_src);
8406         } else {
8407                 nat = ipf_nat_inlookup(fin, nflags, (u_int)fin->fin_p,
8408                                        fin->fin_src, fin->fin_dst);
8409         }
8410
8411         if (nat != NULL) {
8412                 NBUMPSIDE(fin->fin_out, ns_uncreate[0]);
8413                 ipf_nat_delete(softc, nat, NL_DESTROY);
8414         } else {
8415                 NBUMPSIDE(fin->fin_out, ns_uncreate[1]);
8416         }
8417
8418         RWLOCK_EXIT(&softc->ipf_nat);
8419 }
8420
8421
8422 /* ------------------------------------------------------------------------ */
8423 /* Function:    ipf_nat_cmp_rules                                           */
8424 /* Returns:     int   - 0 == success, else rules do not match.              */
8425 /* Parameters:  n1(I) - first rule to compare                               */
8426 /*              n2(I) - first rule to compare                               */
8427 /*                                                                          */
8428 /* Compare two rules using pointers to each rule. A straight bcmp will not  */
8429 /* work as some fields (such as in_dst, in_pkts) actually do change once    */
8430 /* the rule has been loaded into the kernel. Whilst this function returns   */
8431 /* various non-zero returns, they're strictly to aid in debugging. Use of   */
8432 /* this function should simply care if the result is zero or not.           */
8433 /* ------------------------------------------------------------------------ */
8434 static int
8435 ipf_nat_cmp_rules(n1, n2)
8436         ipnat_t *n1, *n2;
8437 {
8438         if (n1->in_size != n2->in_size)
8439                 return 1;
8440
8441         if (bcmp((char *)&n1->in_v, (char *)&n2->in_v,
8442                  offsetof(ipnat_t, in_ndst) - offsetof(ipnat_t, in_v)) != 0)
8443                 return 2;
8444
8445         if (bcmp((char *)&n1->in_tuc, (char *)&n2->in_tuc,
8446                  n1->in_size - offsetof(ipnat_t, in_tuc)) != 0)
8447                 return 3;
8448         if (n1->in_ndst.na_atype != n2->in_ndst.na_atype)
8449                 return 5;
8450         if (n1->in_ndst.na_function != n2->in_ndst.na_function)
8451                 return 6;
8452         if (bcmp((char *)&n1->in_ndst.na_addr, (char *)&n2->in_ndst.na_addr,
8453                  sizeof(n1->in_ndst.na_addr)))
8454                 return 7;
8455         if (n1->in_nsrc.na_atype != n2->in_nsrc.na_atype)
8456                 return 8;
8457         if (n1->in_nsrc.na_function != n2->in_nsrc.na_function)
8458                 return 9;
8459         if (bcmp((char *)&n1->in_nsrc.na_addr, (char *)&n2->in_nsrc.na_addr,
8460                  sizeof(n1->in_nsrc.na_addr)))
8461                 return 10;
8462         if (n1->in_odst.na_atype != n2->in_odst.na_atype)
8463                 return 11;
8464         if (n1->in_odst.na_function != n2->in_odst.na_function)
8465                 return 12;
8466         if (bcmp((char *)&n1->in_odst.na_addr, (char *)&n2->in_odst.na_addr,
8467                  sizeof(n1->in_odst.na_addr)))
8468                 return 13;
8469         if (n1->in_osrc.na_atype != n2->in_osrc.na_atype)
8470                 return 14;
8471         if (n1->in_osrc.na_function != n2->in_osrc.na_function)
8472                 return 15;
8473         if (bcmp((char *)&n1->in_osrc.na_addr, (char *)&n2->in_osrc.na_addr,
8474                  sizeof(n1->in_osrc.na_addr)))
8475                 return 16;
8476         return 0;
8477 }
8478
8479
8480 /* ------------------------------------------------------------------------ */
8481 /* Function:    ipf_nat_rule_init                                           */
8482 /* Returns:     int   - 0 == success, else rules do not match.              */
8483 /* Parameters:  softc(I) - pointer to soft context main structure           */
8484 /*              softn(I) - pointer to NAT context structure                 */
8485 /*              n(I)     - first rule to compare                            */
8486 /*                                                                          */
8487 /* ------------------------------------------------------------------------ */
8488 static int
8489 ipf_nat_rule_init(softc, softn, n)
8490         ipf_main_softc_t *softc;
8491         ipf_nat_softc_t *softn;
8492         ipnat_t *n;
8493 {
8494         int error = 0;
8495
8496         if ((n->in_flags & IPN_SIPRANGE) != 0)
8497                 n->in_nsrcatype = FRI_RANGE;
8498
8499         if ((n->in_flags & IPN_DIPRANGE) != 0)
8500                 n->in_ndstatype = FRI_RANGE;
8501
8502         if ((n->in_flags & IPN_SPLIT) != 0)
8503                 n->in_ndstatype = FRI_SPLIT;
8504
8505         if ((n->in_redir & (NAT_MAP|NAT_REWRITE|NAT_DIVERTUDP)) != 0)
8506                 n->in_spnext = n->in_spmin;
8507
8508         if ((n->in_redir & (NAT_REWRITE|NAT_DIVERTUDP)) != 0) {
8509                 n->in_dpnext = n->in_dpmin;
8510         } else if (n->in_redir == NAT_REDIRECT) {
8511                 n->in_dpnext = n->in_dpmin;
8512         }
8513
8514         n->in_stepnext = 0;
8515
8516         switch (n->in_v[0])
8517         {
8518         case 4 :
8519                 error = ipf_nat_ruleaddrinit(softc, softn, n);
8520                 if (error != 0)
8521                         return error;
8522                 break;
8523 #ifdef USE_INET6
8524         case 6 :
8525                 error = ipf_nat6_ruleaddrinit(softc, softn, n);
8526                 if (error != 0)
8527                         return error;
8528                 break;
8529 #endif
8530         default :
8531                 break;
8532         }
8533
8534         if (n->in_redir == (NAT_DIVERTUDP|NAT_MAP)) {
8535                 /*
8536                  * Prerecord whether or not the destination of the divert
8537                  * is local or not to the interface the packet is going
8538                  * to be sent out.
8539                  */
8540                 n->in_dlocal = ipf_deliverlocal(softc, n->in_v[1],
8541                                                 n->in_ifps[1], &n->in_ndstip6);
8542         }
8543
8544         return error;
8545 }
8546
8547
8548 /* ------------------------------------------------------------------------ */
8549 /* Function:    ipf_nat_rule_fini                                           */
8550 /* Returns:     int   - 0 == success, else rules do not match.              */
8551 /* Parameters:  softc(I) - pointer to soft context main structure           */
8552 /*              n(I)     - rule to work on                                  */
8553 /*                                                                          */
8554 /* This function is used to release any objects that were referenced during */
8555 /* the rule initialisation. This is useful both when free'ing the rule and  */
8556 /* when handling ioctls that need to initialise these fields but not        */
8557 /* actually use them after the ioctl processing has finished.               */
8558 /* ------------------------------------------------------------------------ */
8559 static void
8560 ipf_nat_rule_fini(softc, n)
8561         ipf_main_softc_t *softc;
8562         ipnat_t *n;
8563 {
8564         if (n->in_odst.na_atype == FRI_LOOKUP && n->in_odst.na_ptr != NULL)
8565                 ipf_lookup_deref(softc, n->in_odst.na_type, n->in_odst.na_ptr);
8566
8567         if (n->in_osrc.na_atype == FRI_LOOKUP && n->in_osrc.na_ptr != NULL)
8568                 ipf_lookup_deref(softc, n->in_osrc.na_type, n->in_osrc.na_ptr);
8569
8570         if (n->in_ndst.na_atype == FRI_LOOKUP && n->in_ndst.na_ptr != NULL)
8571                 ipf_lookup_deref(softc, n->in_ndst.na_type, n->in_ndst.na_ptr);
8572
8573         if (n->in_nsrc.na_atype == FRI_LOOKUP && n->in_nsrc.na_ptr != NULL)
8574                 ipf_lookup_deref(softc, n->in_nsrc.na_type, n->in_nsrc.na_ptr);
8575
8576         if (n->in_divmp != NULL)
8577                 FREE_MB_T(n->in_divmp);
8578 }