4 * Copyright (C) 2012 by Darren Reed.
6 * See the IPFILTER.LICENCE file for details on licencing.
8 #if defined(KERNEL) || defined(_KERNEL)
14 #include <sys/errno.h>
15 #include <sys/types.h>
16 #include <sys/param.h>
19 #if defined(_KERNEL) && \
20 (defined(__NetBSD_Version) && (__NetBSD_Version >= 399002000))
21 # include <sys/kauth.h>
34 #if defined(_KERNEL) && \
35 defined(__FreeBSD_version) && (__FreeBSD_version >= 220000)
36 # include <sys/filio.h>
37 # include <sys/fcntl.h>
39 # include <sys/ioctl.h>
42 # include <sys/fcntl.h>
45 # include <sys/protosw.h>
47 #include <sys/socket.h>
49 # include <sys/systm.h>
50 # if !defined(__SVR4) && !defined(__svr4__)
51 # include <sys/mbuf.h>
54 #if defined(__SVR4) || defined(__svr4__)
55 # include <sys/filio.h>
56 # include <sys/byteorder.h>
58 # include <sys/dditypes.h>
60 # include <sys/stream.h>
61 # include <sys/kmem.h>
63 #if __FreeBSD_version >= 300000
64 # include <sys/queue.h>
67 #if __FreeBSD_version >= 300000
68 # include <net/if_var.h>
73 #include <netinet/in.h>
74 #include <netinet/in_systm.h>
75 #include <netinet/ip.h>
79 # include <vpn/ipsec.h>
80 extern struct ifnet vpnif;
84 # include <netinet/ip_var.h>
86 #include <netinet/tcp.h>
87 #include <netinet/udp.h>
88 #include <netinet/ip_icmp.h>
89 #include "netinet/ip_compat.h"
90 #include <netinet/tcpip.h>
91 #include "netinet/ipl.h"
92 #include "netinet/ip_fil.h"
93 #include "netinet/ip_nat.h"
94 #include "netinet/ip_frag.h"
95 #include "netinet/ip_state.h"
96 #include "netinet/ip_proxy.h"
97 #include "netinet/ip_lookup.h"
98 #include "netinet/ip_dstlist.h"
99 #include "netinet/ip_sync.h"
100 #if FREEBSD_GE_REV(300000)
101 # include <sys/malloc.h>
104 # include <sys/md5.h>
108 /* END OF INCLUDES */
111 #define SOCKADDR_IN struct sockaddr_in
114 static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
115 static const char rcsid[] = "@(#)$FreeBSD$";
116 /* static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.195.2.102 2007/10/16 10:08:10 darrenr Exp $"; */
120 #define NATFSUM(n,v,f) ((v) == 4 ? (n)->f.in4.s_addr : (n)->f.i6[0] + \
121 (n)->f.i6[1] + (n)->f.i6[2] + (n)->f.i6[3])
122 #define NBUMP(x) softn->(x)++
123 #define NBUMPD(x, y) do { \
127 #define NBUMPSIDE(y,x) softn->ipf_nat_stats.ns_side[y].x++
128 #define NBUMPSIDED(y,x) do { softn->ipf_nat_stats.ns_side[y].x++; \
130 #define NBUMPSIDEX(y,x,z) \
131 do { softn->ipf_nat_stats.ns_side[y].x++; \
133 #define NBUMPSIDEDF(y,x)do { softn->ipf_nat_stats.ns_side[y].x++; \
134 DT1(x, fr_info_t *, fin); } while (0)
136 frentry_t ipfnatblock;
138 static ipftuneable_t ipf_nat_tuneables[] = {
140 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_lock) },
142 stsizeof(ipf_nat_softc_t, ipf_nat_lock),
143 IPFT_RDONLY, NULL, NULL },
144 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_sz) },
145 "nat_table_size", 1, 0x7fffffff,
146 stsizeof(ipf_nat_softc_t, ipf_nat_table_sz),
147 0, NULL, ipf_nat_rehash },
148 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_max) },
149 "nat_table_max", 1, 0x7fffffff,
150 stsizeof(ipf_nat_softc_t, ipf_nat_table_max),
152 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_maprules_sz) },
153 "nat_rules_size", 1, 0x7fffffff,
154 stsizeof(ipf_nat_softc_t, ipf_nat_maprules_sz),
155 0, NULL, ipf_nat_rehash_rules },
156 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_rdrrules_sz) },
157 "rdr_rules_size", 1, 0x7fffffff,
158 stsizeof(ipf_nat_softc_t, ipf_nat_rdrrules_sz),
159 0, NULL, ipf_nat_rehash_rules },
160 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_hostmap_sz) },
161 "hostmap_size", 1, 0x7fffffff,
162 stsizeof(ipf_nat_softc_t, ipf_nat_hostmap_sz),
163 0, NULL, ipf_nat_hostmap_rehash },
164 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_maxbucket) },
165 "nat_maxbucket",1, 0x7fffffff,
166 stsizeof(ipf_nat_softc_t, ipf_nat_maxbucket),
168 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_logging) },
170 stsizeof(ipf_nat_softc_t, ipf_nat_logging),
172 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_doflush) },
174 stsizeof(ipf_nat_softc_t, ipf_nat_doflush),
176 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_wm_low) },
177 "nat_table_wm_low", 1, 99,
178 stsizeof(ipf_nat_softc_t, ipf_nat_table_wm_low),
180 { { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_wm_high) },
181 "nat_table_wm_high", 2, 100,
182 stsizeof(ipf_nat_softc_t, ipf_nat_table_wm_high),
190 /* ======================================================================== */
191 /* How the NAT is organised and works. */
193 /* Inside (interface y) NAT Outside (interface x) */
194 /* -------------------- -+- ------------------------------------- */
195 /* Packet going | out, processsed by ipf_nat_checkout() for x */
196 /* ------------> | ------------> */
197 /* src=10.1.1.1 | src=192.1.1.1 */
199 /* | in, processed by ipf_nat_checkin() for x */
200 /* <------------ | <------------ */
201 /* dst=10.1.1.1 | dst=192.1.1.1 */
202 /* -------------------- -+- ------------------------------------- */
203 /* ipf_nat_checkout() - changes ip_src and if required, sport */
204 /* - creates a new mapping, if required. */
205 /* ipf_nat_checkin() - changes ip_dst and if required, dport */
207 /* In the NAT table, internal source is recorded as "in" and externally */
209 /* ======================================================================== */
212 #if SOLARIS && !defined(INSTANCES)
213 extern int pfil_delayed_copy;
216 static int ipf_nat_flush_entry __P((ipf_main_softc_t *, void *));
217 static int ipf_nat_getent __P((ipf_main_softc_t *, caddr_t, int));
218 static int ipf_nat_getsz __P((ipf_main_softc_t *, caddr_t, int));
219 static int ipf_nat_putent __P((ipf_main_softc_t *, caddr_t, int));
220 static void ipf_nat_addmap __P((ipf_nat_softc_t *, ipnat_t *));
221 static void ipf_nat_addrdr __P((ipf_nat_softc_t *, ipnat_t *));
222 static int ipf_nat_builddivertmp __P((ipf_nat_softc_t *, ipnat_t *));
223 static int ipf_nat_clearlist __P((ipf_main_softc_t *, ipf_nat_softc_t *));
224 static int ipf_nat_cmp_rules __P((ipnat_t *, ipnat_t *));
225 static int ipf_nat_decap __P((fr_info_t *, nat_t *));
226 static void ipf_nat_delrule __P((ipf_main_softc_t *, ipf_nat_softc_t *,
228 static int ipf_nat_extraflush __P((ipf_main_softc_t *, ipf_nat_softc_t *, int));
229 static int ipf_nat_finalise __P((fr_info_t *, nat_t *));
230 static int ipf_nat_flushtable __P((ipf_main_softc_t *, ipf_nat_softc_t *));
231 static int ipf_nat_getnext __P((ipf_main_softc_t *, ipftoken_t *,
232 ipfgeniter_t *, ipfobj_t *));
233 static int ipf_nat_gettable __P((ipf_main_softc_t *, ipf_nat_softc_t *,
235 static hostmap_t *ipf_nat_hostmap __P((ipf_nat_softc_t *, ipnat_t *,
236 struct in_addr, struct in_addr,
237 struct in_addr, u_32_t));
238 static int ipf_nat_icmpquerytype __P((int));
239 static int ipf_nat_iterator __P((ipf_main_softc_t *, ipftoken_t *,
240 ipfgeniter_t *, ipfobj_t *));
241 static int ipf_nat_match __P((fr_info_t *, ipnat_t *));
242 static int ipf_nat_matcharray __P((nat_t *, int *, u_long));
243 static int ipf_nat_matchflush __P((ipf_main_softc_t *, ipf_nat_softc_t *,
245 static void ipf_nat_mssclamp __P((tcphdr_t *, u_32_t, fr_info_t *,
247 static int ipf_nat_newmap __P((fr_info_t *, nat_t *, natinfo_t *));
248 static int ipf_nat_newdivert __P((fr_info_t *, nat_t *, natinfo_t *));
249 static int ipf_nat_newrdr __P((fr_info_t *, nat_t *, natinfo_t *));
250 static int ipf_nat_newrewrite __P((fr_info_t *, nat_t *, natinfo_t *));
251 static int ipf_nat_nextaddr __P((fr_info_t *, nat_addr_t *, u_32_t *,
253 static int ipf_nat_nextaddrinit __P((ipf_main_softc_t *, char *,
254 nat_addr_t *, int, void *));
255 static int ipf_nat_resolverule __P((ipf_main_softc_t *, ipnat_t *));
256 static int ipf_nat_ruleaddrinit __P((ipf_main_softc_t *,
257 ipf_nat_softc_t *, ipnat_t *));
258 static void ipf_nat_rule_fini __P((ipf_main_softc_t *, ipnat_t *));
259 static int ipf_nat_rule_init __P((ipf_main_softc_t *, ipf_nat_softc_t *,
261 static int ipf_nat_siocaddnat __P((ipf_main_softc_t *, ipf_nat_softc_t *,
263 static void ipf_nat_siocdelnat __P((ipf_main_softc_t *, ipf_nat_softc_t *,
265 static void ipf_nat_tabmove __P((ipf_nat_softc_t *, nat_t *));
267 /* ------------------------------------------------------------------------ */
268 /* Function: ipf_nat_main_load */
269 /* Returns: int - 0 == success, -1 == failure */
270 /* Parameters: Nil */
272 /* The only global NAT structure that needs to be initialised is the filter */
273 /* rule that is used with blocking packets. */
274 /* ------------------------------------------------------------------------ */
278 bzero((char *)&ipfnatblock, sizeof(ipfnatblock));
279 ipfnatblock.fr_flags = FR_BLOCK|FR_QUICK;
280 ipfnatblock.fr_ref = 1;
286 /* ------------------------------------------------------------------------ */
287 /* Function: ipf_nat_main_unload */
288 /* Returns: int - 0 == success, -1 == failure */
289 /* Parameters: Nil */
291 /* A null-op function that exists as a placeholder so that the flow in */
292 /* other functions is obvious. */
293 /* ------------------------------------------------------------------------ */
295 ipf_nat_main_unload()
301 /* ------------------------------------------------------------------------ */
302 /* Function: ipf_nat_soft_create */
303 /* Returns: void * - NULL = failure, else pointer to NAT context */
304 /* Parameters: softc(I) - pointer to soft context main structure */
306 /* Allocate the initial soft context structure for NAT and populate it with */
307 /* some default values. Creating the tables is left until we call _init so */
308 /* that sizes can be changed before we get under way. */
309 /* ------------------------------------------------------------------------ */
311 ipf_nat_soft_create(softc)
312 ipf_main_softc_t *softc;
314 ipf_nat_softc_t *softn;
316 KMALLOC(softn, ipf_nat_softc_t *);
320 bzero((char *)softn, sizeof(*softn));
322 softn->ipf_nat_tune = ipf_tune_array_copy(softn,
323 sizeof(ipf_nat_tuneables),
325 if (softn->ipf_nat_tune == NULL) {
326 ipf_nat_soft_destroy(softc, softn);
329 if (ipf_tune_array_link(softc, softn->ipf_nat_tune) == -1) {
330 ipf_nat_soft_destroy(softc, softn);
334 softn->ipf_nat_list_tail = &softn->ipf_nat_list;
336 softn->ipf_nat_table_max = NAT_TABLE_MAX;
337 softn->ipf_nat_table_sz = NAT_TABLE_SZ;
338 softn->ipf_nat_maprules_sz = NAT_SIZE;
339 softn->ipf_nat_rdrrules_sz = RDR_SIZE;
340 softn->ipf_nat_hostmap_sz = HOSTMAP_SIZE;
341 softn->ipf_nat_doflush = 0;
343 softn->ipf_nat_logging = 1;
345 softn->ipf_nat_logging = 0;
348 softn->ipf_nat_defage = DEF_NAT_AGE;
349 softn->ipf_nat_defipage = IPF_TTLVAL(60);
350 softn->ipf_nat_deficmpage = IPF_TTLVAL(3);
351 softn->ipf_nat_table_wm_high = 99;
352 softn->ipf_nat_table_wm_low = 90;
357 /* ------------------------------------------------------------------------ */
358 /* Function: ipf_nat_soft_destroy */
360 /* Parameters: softc(I) - pointer to soft context main structure */
362 /* ------------------------------------------------------------------------ */
364 ipf_nat_soft_destroy(softc, arg)
365 ipf_main_softc_t *softc;
368 ipf_nat_softc_t *softn = arg;
370 if (softn->ipf_nat_tune != NULL) {
371 ipf_tune_array_unlink(softc, softn->ipf_nat_tune);
372 KFREES(softn->ipf_nat_tune, sizeof(ipf_nat_tuneables));
373 softn->ipf_nat_tune = NULL;
380 /* ------------------------------------------------------------------------ */
381 /* Function: ipf_nat_init */
382 /* Returns: int - 0 == success, -1 == failure */
383 /* Parameters: softc(I) - pointer to soft context main structure */
385 /* Initialise all of the NAT locks, tables and other structures. */
386 /* ------------------------------------------------------------------------ */
388 ipf_nat_soft_init(softc, arg)
389 ipf_main_softc_t *softc;
392 ipf_nat_softc_t *softn = arg;
396 KMALLOCS(softn->ipf_nat_table[0], nat_t **, \
397 sizeof(nat_t *) * softn->ipf_nat_table_sz);
399 if (softn->ipf_nat_table[0] != NULL) {
400 bzero((char *)softn->ipf_nat_table[0],
401 softn->ipf_nat_table_sz * sizeof(nat_t *));
406 KMALLOCS(softn->ipf_nat_table[1], nat_t **, \
407 sizeof(nat_t *) * softn->ipf_nat_table_sz);
409 if (softn->ipf_nat_table[1] != NULL) {
410 bzero((char *)softn->ipf_nat_table[1],
411 softn->ipf_nat_table_sz * sizeof(nat_t *));
416 KMALLOCS(softn->ipf_nat_map_rules, ipnat_t **, \
417 sizeof(ipnat_t *) * softn->ipf_nat_maprules_sz);
419 if (softn->ipf_nat_map_rules != NULL) {
420 bzero((char *)softn->ipf_nat_map_rules,
421 softn->ipf_nat_maprules_sz * sizeof(ipnat_t *));
426 KMALLOCS(softn->ipf_nat_rdr_rules, ipnat_t **, \
427 sizeof(ipnat_t *) * softn->ipf_nat_rdrrules_sz);
429 if (softn->ipf_nat_rdr_rules != NULL) {
430 bzero((char *)softn->ipf_nat_rdr_rules,
431 softn->ipf_nat_rdrrules_sz * sizeof(ipnat_t *));
436 KMALLOCS(softn->ipf_hm_maptable, hostmap_t **, \
437 sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
439 if (softn->ipf_hm_maptable != NULL) {
440 bzero((char *)softn->ipf_hm_maptable,
441 sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
445 softn->ipf_hm_maplist = NULL;
447 KMALLOCS(softn->ipf_nat_stats.ns_side[0].ns_bucketlen, u_int *,
448 softn->ipf_nat_table_sz * sizeof(u_int));
450 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen == NULL) {
453 bzero((char *)softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
454 softn->ipf_nat_table_sz * sizeof(u_int));
456 KMALLOCS(softn->ipf_nat_stats.ns_side[1].ns_bucketlen, u_int *,
457 softn->ipf_nat_table_sz * sizeof(u_int));
459 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen == NULL) {
463 bzero((char *)softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
464 softn->ipf_nat_table_sz * sizeof(u_int));
466 if (softn->ipf_nat_maxbucket == 0) {
467 for (i = softn->ipf_nat_table_sz; i > 0; i >>= 1)
468 softn->ipf_nat_maxbucket++;
469 softn->ipf_nat_maxbucket *= 2;
472 ipf_sttab_init(softc, softn->ipf_nat_tcptq);
474 * Increase this because we may have "keep state" following this too
475 * and packet storms can occur if this is removed too quickly.
477 softn->ipf_nat_tcptq[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcplastack;
478 softn->ipf_nat_tcptq[IPF_TCP_NSTATES - 1].ifq_next =
479 &softn->ipf_nat_udptq;
481 IPFTQ_INIT(&softn->ipf_nat_udptq, softn->ipf_nat_defage,
482 "nat ipftq udp tab");
483 softn->ipf_nat_udptq.ifq_next = &softn->ipf_nat_udpacktq;
485 IPFTQ_INIT(&softn->ipf_nat_udpacktq, softn->ipf_nat_defage,
486 "nat ipftq udpack tab");
487 softn->ipf_nat_udpacktq.ifq_next = &softn->ipf_nat_icmptq;
489 IPFTQ_INIT(&softn->ipf_nat_icmptq, softn->ipf_nat_deficmpage,
490 "nat icmp ipftq tab");
491 softn->ipf_nat_icmptq.ifq_next = &softn->ipf_nat_icmpacktq;
493 IPFTQ_INIT(&softn->ipf_nat_icmpacktq, softn->ipf_nat_defage,
494 "nat icmpack ipftq tab");
495 softn->ipf_nat_icmpacktq.ifq_next = &softn->ipf_nat_iptq;
497 IPFTQ_INIT(&softn->ipf_nat_iptq, softn->ipf_nat_defipage,
499 softn->ipf_nat_iptq.ifq_next = &softn->ipf_nat_pending;
501 IPFTQ_INIT(&softn->ipf_nat_pending, 1, "nat pending ipftq tab");
502 softn->ipf_nat_pending.ifq_next = NULL;
504 for (i = 0, tq = softn->ipf_nat_tcptq; i < IPF_TCP_NSTATES; i++, tq++) {
505 if (tq->ifq_ttl < softn->ipf_nat_deficmpage)
506 tq->ifq_ttl = softn->ipf_nat_deficmpage;
508 else if (tq->ifq_ttl > softn->ipf_nat_defage)
509 tq->ifq_ttl = softn->ipf_nat_defage;
514 * Increase this because we may have "keep state" following
515 * this too and packet storms can occur if this is removed
518 softn->ipf_nat_tcptq[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcplastack;
520 MUTEX_INIT(&softn->ipf_nat_new, "ipf nat new mutex");
521 MUTEX_INIT(&softn->ipf_nat_io, "ipf nat io mutex");
523 softn->ipf_nat_inited = 1;
529 /* ------------------------------------------------------------------------ */
530 /* Function: ipf_nat_soft_fini */
532 /* Parameters: softc(I) - pointer to soft context main structure */
534 /* Free all memory used by NAT structures allocated at runtime. */
535 /* ------------------------------------------------------------------------ */
537 ipf_nat_soft_fini(softc, arg)
538 ipf_main_softc_t *softc;
541 ipf_nat_softc_t *softn = arg;
542 ipftq_t *ifq, *ifqnext;
544 (void) ipf_nat_clearlist(softc, softn);
545 (void) ipf_nat_flushtable(softc, softn);
548 * Proxy timeout queues are not cleaned here because although they
549 * exist on the NAT list, ipf_proxy_unload is called after unload
550 * and the proxies actually are responsible for them being created.
551 * Should the proxy timeouts have their own list? There's no real
552 * justification as this is the only complication.
554 for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifqnext) {
555 ifqnext = ifq->ifq_next;
556 if (ipf_deletetimeoutqueue(ifq) == 0)
557 ipf_freetimeoutqueue(softc, ifq);
560 if (softn->ipf_nat_table[0] != NULL) {
561 KFREES(softn->ipf_nat_table[0],
562 sizeof(nat_t *) * softn->ipf_nat_table_sz);
563 softn->ipf_nat_table[0] = NULL;
565 if (softn->ipf_nat_table[1] != NULL) {
566 KFREES(softn->ipf_nat_table[1],
567 sizeof(nat_t *) * softn->ipf_nat_table_sz);
568 softn->ipf_nat_table[1] = NULL;
570 if (softn->ipf_nat_map_rules != NULL) {
571 KFREES(softn->ipf_nat_map_rules,
572 sizeof(ipnat_t *) * softn->ipf_nat_maprules_sz);
573 softn->ipf_nat_map_rules = NULL;
575 if (softn->ipf_nat_rdr_rules != NULL) {
576 KFREES(softn->ipf_nat_rdr_rules,
577 sizeof(ipnat_t *) * softn->ipf_nat_rdrrules_sz);
578 softn->ipf_nat_rdr_rules = NULL;
580 if (softn->ipf_hm_maptable != NULL) {
581 KFREES(softn->ipf_hm_maptable,
582 sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
583 softn->ipf_hm_maptable = NULL;
585 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen != NULL) {
586 KFREES(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
587 sizeof(u_int) * softn->ipf_nat_table_sz);
588 softn->ipf_nat_stats.ns_side[0].ns_bucketlen = NULL;
590 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen != NULL) {
591 KFREES(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
592 sizeof(u_int) * softn->ipf_nat_table_sz);
593 softn->ipf_nat_stats.ns_side[1].ns_bucketlen = NULL;
596 if (softn->ipf_nat_inited == 1) {
597 softn->ipf_nat_inited = 0;
598 ipf_sttab_destroy(softn->ipf_nat_tcptq);
600 MUTEX_DESTROY(&softn->ipf_nat_new);
601 MUTEX_DESTROY(&softn->ipf_nat_io);
603 MUTEX_DESTROY(&softn->ipf_nat_udptq.ifq_lock);
604 MUTEX_DESTROY(&softn->ipf_nat_udpacktq.ifq_lock);
605 MUTEX_DESTROY(&softn->ipf_nat_icmptq.ifq_lock);
606 MUTEX_DESTROY(&softn->ipf_nat_icmpacktq.ifq_lock);
607 MUTEX_DESTROY(&softn->ipf_nat_iptq.ifq_lock);
608 MUTEX_DESTROY(&softn->ipf_nat_pending.ifq_lock);
615 /* ------------------------------------------------------------------------ */
616 /* Function: ipf_nat_setlock */
618 /* Parameters: arg(I) - pointer to soft state information */
619 /* tmp(I) - new lock value */
621 /* Set the "lock status" of NAT to the value in tmp. */
622 /* ------------------------------------------------------------------------ */
624 ipf_nat_setlock(arg, tmp)
628 ipf_nat_softc_t *softn = arg;
630 softn->ipf_nat_lock = tmp;
634 /* ------------------------------------------------------------------------ */
635 /* Function: ipf_nat_addrdr */
637 /* Parameters: n(I) - pointer to NAT rule to add */
639 /* Adds a redirect rule to the hash table of redirect rules and the list of */
640 /* loaded NAT rules. Updates the bitmask indicating which netmasks are in */
641 /* use by redirect rules. */
642 /* ------------------------------------------------------------------------ */
644 ipf_nat_addrdr(softn, n)
645 ipf_nat_softc_t *softn;
654 if (n->in_odstatype == FRI_NORMAL) {
655 k = count4bits(n->in_odstmsk);
656 ipf_inet_mask_add(k, &softn->ipf_nat_rdr_mask);
657 j = (n->in_odstaddr & n->in_odstmsk);
658 rhv = NAT_HASH_FN(j, 0, 0xffffffff);
660 ipf_inet_mask_add(0, &softn->ipf_nat_rdr_mask);
664 hv = rhv % softn->ipf_nat_rdrrules_sz;
665 np = softn->ipf_nat_rdr_rules + hv;
667 np = &(*np)->in_rnext;
676 /* ------------------------------------------------------------------------ */
677 /* Function: ipf_nat_addmap */
679 /* Parameters: n(I) - pointer to NAT rule to add */
681 /* Adds a NAT map rule to the hash table of rules and the list of loaded */
682 /* NAT rules. Updates the bitmask indicating which netmasks are in use by */
683 /* redirect rules. */
684 /* ------------------------------------------------------------------------ */
686 ipf_nat_addmap(softn, n)
687 ipf_nat_softc_t *softn;
696 if (n->in_osrcatype == FRI_NORMAL) {
697 k = count4bits(n->in_osrcmsk);
698 ipf_inet_mask_add(k, &softn->ipf_nat_map_mask);
699 j = (n->in_osrcaddr & n->in_osrcmsk);
700 rhv = NAT_HASH_FN(j, 0, 0xffffffff);
702 ipf_inet_mask_add(0, &softn->ipf_nat_map_mask);
706 hv = rhv % softn->ipf_nat_maprules_sz;
707 np = softn->ipf_nat_map_rules + hv;
709 np = &(*np)->in_mnext;
718 /* ------------------------------------------------------------------------ */
719 /* Function: ipf_nat_delrdr */
721 /* Parameters: n(I) - pointer to NAT rule to delete */
723 /* Removes a redirect rule from the hash table of redirect rules. */
724 /* ------------------------------------------------------------------------ */
726 ipf_nat_delrdr(softn, n)
727 ipf_nat_softc_t *softn;
730 if (n->in_odstatype == FRI_NORMAL) {
731 int k = count4bits(n->in_odstmsk);
732 ipf_inet_mask_del(k, &softn->ipf_nat_rdr_mask);
734 ipf_inet_mask_del(0, &softn->ipf_nat_rdr_mask);
737 n->in_rnext->in_prnext = n->in_prnext;
738 *n->in_prnext = n->in_rnext;
743 /* ------------------------------------------------------------------------ */
744 /* Function: ipf_nat_delmap */
746 /* Parameters: n(I) - pointer to NAT rule to delete */
748 /* Removes a NAT map rule from the hash table of NAT map rules. */
749 /* ------------------------------------------------------------------------ */
751 ipf_nat_delmap(softn, n)
752 ipf_nat_softc_t *softn;
755 if (n->in_osrcatype == FRI_NORMAL) {
756 int k = count4bits(n->in_osrcmsk);
757 ipf_inet_mask_del(k, &softn->ipf_nat_map_mask);
759 ipf_inet_mask_del(0, &softn->ipf_nat_map_mask);
761 if (n->in_mnext != NULL)
762 n->in_mnext->in_pmnext = n->in_pmnext;
763 *n->in_pmnext = n->in_mnext;
768 /* ------------------------------------------------------------------------ */
769 /* Function: ipf_nat_hostmap */
770 /* Returns: struct hostmap* - NULL if no hostmap could be created, */
771 /* else a pointer to the hostmapping to use */
772 /* Parameters: np(I) - pointer to NAT rule */
773 /* real(I) - real IP address */
774 /* map(I) - mapped IP address */
775 /* port(I) - destination port number */
776 /* Write Locks: ipf_nat */
778 /* Check if an ip address has already been allocated for a given mapping */
779 /* that is not doing port based translation. If is not yet allocated, then */
780 /* create a new entry if a non-NULL NAT rule pointer has been supplied. */
781 /* ------------------------------------------------------------------------ */
782 static struct hostmap *
783 ipf_nat_hostmap(softn, np, src, dst, map, port)
784 ipf_nat_softc_t *softn;
794 hv = (src.s_addr ^ dst.s_addr);
798 hv %= softn->ipf_nat_hostmap_sz;
799 for (hm = softn->ipf_hm_maptable[hv]; hm; hm = hm->hm_hnext)
800 if ((hm->hm_osrcip.s_addr == src.s_addr) &&
801 (hm->hm_odstip.s_addr == dst.s_addr) &&
802 ((np == NULL) || (np == hm->hm_ipnat)) &&
803 ((port == 0) || (port == hm->hm_port))) {
804 softn->ipf_nat_stats.ns_hm_addref++;
810 softn->ipf_nat_stats.ns_hm_nullnp++;
814 KMALLOC(hm, hostmap_t *);
816 hm->hm_next = softn->ipf_hm_maplist;
817 hm->hm_pnext = &softn->ipf_hm_maplist;
818 if (softn->ipf_hm_maplist != NULL)
819 softn->ipf_hm_maplist->hm_pnext = &hm->hm_next;
820 softn->ipf_hm_maplist = hm;
821 hm->hm_hnext = softn->ipf_hm_maptable[hv];
822 hm->hm_phnext = softn->ipf_hm_maptable + hv;
823 if (softn->ipf_hm_maptable[hv] != NULL)
824 softn->ipf_hm_maptable[hv]->hm_phnext = &hm->hm_hnext;
825 softn->ipf_hm_maptable[hv] = hm;
831 hm->hm_ndstip.s_addr = 0;
836 softn->ipf_nat_stats.ns_hm_new++;
838 softn->ipf_nat_stats.ns_hm_newfail++;
844 /* ------------------------------------------------------------------------ */
845 /* Function: ipf_nat_hostmapdel */
847 /* Parameters: hmp(I) - pointer to hostmap structure pointer */
848 /* Write Locks: ipf_nat */
850 /* Decrement the references to this hostmap structure by one. If this */
851 /* reaches zero then remove it and free it. */
852 /* ------------------------------------------------------------------------ */
854 ipf_nat_hostmapdel(softc, hmp)
855 ipf_main_softc_t *softc;
856 struct hostmap **hmp;
864 if (hm->hm_ref == 0) {
865 ipf_nat_rule_deref(softc, &hm->hm_ipnat);
867 hm->hm_hnext->hm_phnext = hm->hm_phnext;
868 *hm->hm_phnext = hm->hm_hnext;
870 hm->hm_next->hm_pnext = hm->hm_pnext;
871 *hm->hm_pnext = hm->hm_next;
877 /* ------------------------------------------------------------------------ */
878 /* Function: ipf_fix_outcksum */
880 /* Parameters: fin(I) - pointer to packet information */
881 /* sp(I) - location of 16bit checksum to update */
882 /* n((I) - amount to adjust checksum by */
884 /* Adjusts the 16bit checksum by "n" for packets going out. */
885 /* ------------------------------------------------------------------------ */
887 ipf_fix_outcksum(cksum, sp, n, partial)
904 sum1 = (sum1 & 0xffff) + (sum1 >> 16);
908 sum1 = (~ntohs(*sp)) & 0xffff;
910 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
912 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
913 sumshort = ~(u_short)sum1;
914 *(sp) = htons(sumshort);
918 /* ------------------------------------------------------------------------ */
919 /* Function: ipf_fix_incksum */
921 /* Parameters: fin(I) - pointer to packet information */
922 /* sp(I) - location of 16bit checksum to update */
923 /* n((I) - amount to adjust checksum by */
925 /* Adjusts the 16bit checksum by "n" for packets going in. */
926 /* ------------------------------------------------------------------------ */
928 ipf_fix_incksum(cksum, sp, n, partial)
945 sum1 = (sum1 & 0xffff) + (sum1 >> 16);
950 sum1 = (~ntohs(*sp)) & 0xffff;
951 sum1 += ~(n) & 0xffff;
952 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
954 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
955 sumshort = ~(u_short)sum1;
956 *(sp) = htons(sumshort);
960 /* ------------------------------------------------------------------------ */
961 /* Function: ipf_fix_datacksum */
963 /* Parameters: sp(I) - location of 16bit checksum to update */
964 /* n((I) - amount to adjust checksum by */
966 /* Fix_datacksum is used *only* for the adjustments of checksums in the */
967 /* data section of an IP packet. */
969 /* The only situation in which you need to do this is when NAT'ing an */
970 /* ICMP error message. Such a message, contains in its body the IP header */
971 /* of the original IP packet, that causes the error. */
973 /* You can't use fix_incksum or fix_outcksum in that case, because for the */
974 /* kernel the data section of the ICMP error is just data, and no special */
975 /* processing like hardware cksum or ntohs processing have been done by the */
976 /* kernel on the data section. */
977 /* ------------------------------------------------------------------------ */
979 ipf_fix_datacksum(sp, n)
989 sum1 = (~ntohs(*sp)) & 0xffff;
991 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
993 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
994 sumshort = ~(u_short)sum1;
995 *(sp) = htons(sumshort);
999 /* ------------------------------------------------------------------------ */
1000 /* Function: ipf_nat_ioctl */
1001 /* Returns: int - 0 == success, != 0 == failure */
1002 /* Parameters: softc(I) - pointer to soft context main structure */
1003 /* data(I) - pointer to ioctl data */
1004 /* cmd(I) - ioctl command integer */
1005 /* mode(I) - file mode bits used with open */
1006 /* uid(I) - uid of calling process */
1007 /* ctx(I) - pointer used as key for finding context */
1009 /* Processes an ioctl call made to operate on the IP Filter NAT device. */
1010 /* ------------------------------------------------------------------------ */
1012 ipf_nat_ioctl(softc, data, cmd, mode, uid, ctx)
1013 ipf_main_softc_t *softc;
1019 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1020 int error = 0, ret, arg, getlock;
1021 ipnat_t *nat, *nt, *n;
1025 #if BSD_GE_YEAR(199306) && defined(_KERNEL)
1026 # if NETBSD_GE_REV(399002000)
1027 if ((mode & FWRITE) &&
1028 kauth_authorize_network(curlwp->l_cred, KAUTH_NETWORK_FIREWALL,
1029 KAUTH_REQ_NETWORK_FIREWALL_FW,
1032 # if defined(__FreeBSD_version) && (__FreeBSD_version >= 500034)
1033 if (securelevel_ge(curthread->td_ucred, 3) && (mode & FWRITE))
1035 if ((securelevel >= 3) && (mode & FWRITE))
1044 #if defined(__osf__) && defined(_KERNEL)
1047 getlock = (mode & NAT_LOCKHELD) ? 0 : 1;
1054 if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT) ||
1055 (cmd == (ioctlcmd_t)SIOCPURGENAT)) {
1056 if (mode & NAT_SYSSPACE) {
1057 bcopy(data, (char *)&natd, sizeof(natd));
1061 bzero(&natd, sizeof(natd));
1062 error = ipf_inobj(softc, data, NULL, &natd,
1067 if (natd.in_size < sizeof(ipnat_t)) {
1071 KMALLOCS(nt, ipnat_t *, natd.in_size);
1077 bzero(nt, natd.in_size);
1078 error = ipf_inobjsz(softc, data, nt, IPFOBJ_IPNAT,
1086 * For add/delete, look to see if the NAT entry is
1089 nat->in_flags &= IPN_USERFLAGS;
1090 if ((nat->in_redir & NAT_MAPBLK) == 0) {
1091 if (nat->in_osrcatype == FRI_NORMAL ||
1092 nat->in_osrcatype == FRI_NONE)
1093 nat->in_osrcaddr &= nat->in_osrcmsk;
1094 if (nat->in_odstatype == FRI_NORMAL ||
1095 nat->in_odstatype == FRI_NONE)
1096 nat->in_odstaddr &= nat->in_odstmsk;
1097 if ((nat->in_flags & (IPN_SPLIT|IPN_SIPRANGE)) == 0) {
1098 if (nat->in_nsrcatype == FRI_NORMAL)
1099 nat->in_nsrcaddr &= nat->in_nsrcmsk;
1100 if (nat->in_ndstatype == FRI_NORMAL)
1101 nat->in_ndstaddr &= nat->in_ndstmsk;
1105 error = ipf_nat_rule_init(softc, softn, nat);
1109 MUTEX_ENTER(&softn->ipf_nat_io);
1110 for (n = softn->ipf_nat_list; n != NULL; n = n->in_next)
1111 if (ipf_nat_cmp_rules(nat, n) == 0)
1122 if (!(mode & FWRITE)) {
1126 tmp = ipf_log_clear(softc, IPL_LOGNAT);
1127 error = BCOPYOUT(&tmp, data, sizeof(tmp));
1137 if (!(mode & FWRITE)) {
1141 error = BCOPYIN(data, &softn->ipf_nat_logging,
1142 sizeof(softn->ipf_nat_logging));
1149 error = BCOPYOUT(&softn->ipf_nat_logging, data,
1150 sizeof(softn->ipf_nat_logging));
1158 arg = ipf_log_bytesused(softc, IPL_LOGNAT);
1159 error = BCOPYOUT(&arg, data, sizeof(arg));
1167 if (!(mode & FWRITE)) {
1170 } else if (n != NULL) {
1171 natd.in_flineno = n->in_flineno;
1172 (void) ipf_outobj(softc, data, &natd, IPFOBJ_IPNAT);
1175 } else if (nt == NULL) {
1180 MUTEX_EXIT(&softn->ipf_nat_io);
1184 bcopy((char *)nat, (char *)nt, sizeof(*n));
1185 error = ipf_nat_siocaddnat(softc, softn, nt, getlock);
1186 MUTEX_EXIT(&softn->ipf_nat_io);
1195 if (!(mode & FWRITE)) {
1199 } else if (n == NULL) {
1205 MUTEX_EXIT(&softn->ipf_nat_io);
1208 if (cmd == (ioctlcmd_t)SIOCPURGENAT) {
1209 error = ipf_outobjsz(softc, data, n, IPFOBJ_IPNAT,
1212 MUTEX_EXIT(&softn->ipf_nat_io);
1215 n->in_flags |= IPN_PURGE;
1217 ipf_nat_siocdelnat(softc, softn, n, getlock);
1219 MUTEX_EXIT(&softn->ipf_nat_io);
1225 natstat_t *nsp = &softn->ipf_nat_stats;
1227 nsp->ns_side[0].ns_table = softn->ipf_nat_table[0];
1228 nsp->ns_side[1].ns_table = softn->ipf_nat_table[1];
1229 nsp->ns_list = softn->ipf_nat_list;
1230 nsp->ns_maptable = softn->ipf_hm_maptable;
1231 nsp->ns_maplist = softn->ipf_hm_maplist;
1232 nsp->ns_nattab_sz = softn->ipf_nat_table_sz;
1233 nsp->ns_nattab_max = softn->ipf_nat_table_max;
1234 nsp->ns_rultab_sz = softn->ipf_nat_maprules_sz;
1235 nsp->ns_rdrtab_sz = softn->ipf_nat_rdrrules_sz;
1236 nsp->ns_hostmap_sz = softn->ipf_nat_hostmap_sz;
1237 nsp->ns_instances = softn->ipf_nat_instances;
1238 nsp->ns_ticks = softc->ipf_ticks;
1239 #ifdef IPFILTER_LOGGING
1240 nsp->ns_log_ok = ipf_log_logok(softc, IPF_LOGNAT);
1241 nsp->ns_log_fail = ipf_log_failures(softc, IPF_LOGNAT);
1244 nsp->ns_log_fail = 0;
1246 error = ipf_outobj(softc, data, nsp, IPFOBJ_NATSTAT);
1254 error = ipf_inobj(softc, data, NULL, &nl, IPFOBJ_NATLOOKUP);
1259 READ_ENTER(&softc->ipf_nat);
1265 ptr = ipf_nat_lookupredir(&nl);
1269 ptr = ipf_nat6_lookupredir(&nl);
1278 RWLOCK_EXIT(&softc->ipf_nat);
1281 error = ipf_outobj(softc, data, &nl,
1291 case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */
1292 if (!(mode & FWRITE)) {
1298 WRITE_ENTER(&softc->ipf_nat);
1301 error = BCOPYIN(data, &arg, sizeof(arg));
1307 ret = ipf_nat_flushtable(softc, softn);
1309 ret = ipf_nat_clearlist(softc, softn);
1311 ret = ipf_nat_extraflush(softc, softn, arg);
1312 ipf_proxy_flush(softc->ipf_proxy_soft, arg);
1316 RWLOCK_EXIT(&softc->ipf_nat);
1319 error = BCOPYOUT(&ret, data, sizeof(ret));
1323 case SIOCMATCHFLUSH :
1324 if (!(mode & FWRITE)) {
1330 WRITE_ENTER(&softc->ipf_nat);
1333 error = ipf_nat_matchflush(softc, softn, data);
1336 RWLOCK_EXIT(&softc->ipf_nat);
1341 error = ipf_proxy_ioctl(softc, data, cmd, mode, ctx);
1345 if (!(mode & FWRITE)) {
1349 error = ipf_lock(data, &softn->ipf_nat_lock);
1354 if ((mode & FWRITE) != 0) {
1355 error = ipf_nat_putent(softc, data, getlock);
1363 if (softn->ipf_nat_lock) {
1364 error = ipf_nat_getsz(softc, data, getlock);
1372 if (softn->ipf_nat_lock) {
1373 error = ipf_nat_getent(softc, data, getlock);
1386 error = ipf_inobj(softc, data, &obj, &iter, IPFOBJ_GENITER);
1391 token = ipf_token_find(softc, iter.igi_type, uid, ctx);
1392 if (token != NULL) {
1393 error = ipf_nat_iterator(softc, token, &iter, &obj);
1394 WRITE_ENTER(&softc->ipf_tokens);
1395 ipf_token_deref(softc, token);
1396 RWLOCK_EXIT(&softc->ipf_tokens);
1402 case SIOCIPFDELTOK :
1403 error = BCOPYIN(data, &arg, sizeof(arg));
1406 error = ipf_token_del(softc, arg, uid, ctx);
1415 error = ipf_outobj(softc, data, softn->ipf_nat_tcptq,
1420 error = ipf_nat_gettable(softc, softn, data);
1430 ipf_nat_rule_fini(softc, nat);
1432 KFREES(nt, nt->in_size);
1437 /* ------------------------------------------------------------------------ */
1438 /* Function: ipf_nat_siocaddnat */
1439 /* Returns: int - 0 == success, != 0 == failure */
1440 /* Parameters: softc(I) - pointer to soft context main structure */
1441 /* softn(I) - pointer to NAT context structure */
1442 /* n(I) - pointer to new NAT rule */
1443 /* np(I) - pointer to where to insert new NAT rule */
1444 /* getlock(I) - flag indicating if lock on is held */
1445 /* Mutex Locks: ipf_nat_io */
1447 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
1448 /* from information passed to the kernel, then add it to the appropriate */
1449 /* NAT rule table(s). */
1450 /* ------------------------------------------------------------------------ */
1452 ipf_nat_siocaddnat(softc, softn, n, getlock)
1453 ipf_main_softc_t *softc;
1454 ipf_nat_softc_t *softn;
1460 if (ipf_nat_resolverule(softc, n) != 0) {
1465 if ((n->in_age[0] == 0) && (n->in_age[1] != 0)) {
1470 if (n->in_redir == (NAT_DIVERTUDP|NAT_MAP)) {
1472 * Prerecord whether or not the destination of the divert
1473 * is local or not to the interface the packet is going
1476 n->in_dlocal = ipf_deliverlocal(softc, n->in_v[1],
1477 n->in_ifps[1], &n->in_ndstip6);
1481 WRITE_ENTER(&softc->ipf_nat);
1484 n->in_pnext = softn->ipf_nat_list_tail;
1486 softn->ipf_nat_list_tail = &n->in_next;
1489 if (n->in_redir & NAT_REDIRECT) {
1490 n->in_flags &= ~IPN_NOTDST;
1494 ipf_nat_addrdr(softn, n);
1498 ipf_nat6_addrdr(softn, n);
1504 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules_rdr);
1507 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
1508 n->in_flags &= ~IPN_NOTSRC;
1512 ipf_nat_addmap(softn, n);
1516 ipf_nat6_addmap(softn, n);
1522 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules_map);
1525 if (n->in_age[0] != 0)
1526 n->in_tqehead[0] = ipf_addtimeoutqueue(softc,
1527 &softn->ipf_nat_utqe,
1530 if (n->in_age[1] != 0)
1531 n->in_tqehead[1] = ipf_addtimeoutqueue(softc,
1532 &softn->ipf_nat_utqe,
1535 MUTEX_INIT(&n->in_lock, "ipnat rule lock");
1538 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules);
1539 #if SOLARIS && !defined(INSTANCES)
1540 pfil_delayed_copy = 0;
1543 RWLOCK_EXIT(&softc->ipf_nat); /* WRITE */
1550 /* ------------------------------------------------------------------------ */
1551 /* Function: ipf_nat_ruleaddrinit */
1552 /* Parameters: softc(I) - pointer to soft context main structure */
1553 /* softn(I) - pointer to NAT context structure */
1554 /* n(I) - pointer to NAT rule */
1556 /* Initialise all of the NAT address structures in a NAT rule. */
1557 /* ------------------------------------------------------------------------ */
1559 ipf_nat_ruleaddrinit(softc, softn, n)
1560 ipf_main_softc_t *softc;
1561 ipf_nat_softc_t *softn;
1566 if ((n->in_ndst.na_atype == FRI_LOOKUP) &&
1567 (n->in_ndst.na_type != IPLT_DSTLIST)) {
1571 if ((n->in_nsrc.na_atype == FRI_LOOKUP) &&
1572 (n->in_nsrc.na_type != IPLT_DSTLIST)) {
1577 if (n->in_redir == NAT_BIMAP) {
1578 n->in_ndstaddr = n->in_osrcaddr;
1579 n->in_ndstmsk = n->in_osrcmsk;
1580 n->in_odstaddr = n->in_nsrcaddr;
1581 n->in_odstmsk = n->in_nsrcmsk;
1585 if (n->in_redir & NAT_REDIRECT)
1590 * Initialise all of the address fields.
1592 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_osrc, 1,
1597 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_odst, 1,
1602 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_nsrc, 1,
1607 error = ipf_nat_nextaddrinit(softc, n->in_names, &n->in_ndst, 1,
1612 if (n->in_redir & NAT_DIVERTUDP)
1613 ipf_nat_builddivertmp(softn, n);
1619 /* ------------------------------------------------------------------------ */
1620 /* Function: ipf_nat_resolvrule */
1622 /* Parameters: softc(I) - pointer to soft context main structure */
1623 /* n(I) - pointer to NAT rule */
1625 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
1626 /* from information passed to the kernel, then add it to the appropriate */
1627 /* NAT rule table(s). */
1628 /* ------------------------------------------------------------------------ */
1630 ipf_nat_resolverule(softc, n)
1631 ipf_main_softc_t *softc;
1638 n->in_ifps[0] = ipf_resolvenic(softc, base + n->in_ifnames[0],
1641 if (n->in_ifnames[1] == -1) {
1642 n->in_ifnames[1] = n->in_ifnames[0];
1643 n->in_ifps[1] = n->in_ifps[0];
1645 n->in_ifps[1] = ipf_resolvenic(softc, base + n->in_ifnames[1],
1649 if (n->in_plabel != -1) {
1650 if (n->in_redir & NAT_REDIRECT)
1651 n->in_apr = ipf_proxy_lookup(softc->ipf_proxy_soft,
1653 base + n->in_plabel);
1655 n->in_apr = ipf_proxy_lookup(softc->ipf_proxy_soft,
1657 base + n->in_plabel);
1658 if (n->in_apr == NULL)
1665 /* ------------------------------------------------------------------------ */
1666 /* Function: ipf_nat_siocdelnat */
1667 /* Returns: int - 0 == success, != 0 == failure */
1668 /* Parameters: softc(I) - pointer to soft context main structure */
1669 /* softn(I) - pointer to NAT context structure */
1670 /* n(I) - pointer to new NAT rule */
1671 /* getlock(I) - flag indicating if lock on is held */
1672 /* Mutex Locks: ipf_nat_io */
1674 /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
1675 /* from information passed to the kernel, then add it to the appropriate */
1676 /* NAT rule table(s). */
1677 /* ------------------------------------------------------------------------ */
1679 ipf_nat_siocdelnat(softc, softn, n, getlock)
1680 ipf_main_softc_t *softc;
1681 ipf_nat_softc_t *softn;
1690 WRITE_ENTER(&softc->ipf_nat);
1693 ipf_nat_delrule(softc, softn, n, 1);
1696 RWLOCK_EXIT(&softc->ipf_nat); /* READ/WRITE */
1701 /* ------------------------------------------------------------------------ */
1702 /* Function: ipf_nat_getsz */
1703 /* Returns: int - 0 == success, != 0 is the error value. */
1704 /* Parameters: softc(I) - pointer to soft context main structure */
1705 /* data(I) - pointer to natget structure with kernel */
1706 /* pointer get the size of. */
1707 /* getlock(I) - flag indicating whether or not the caller */
1708 /* holds a lock on ipf_nat */
1710 /* Handle SIOCSTGSZ. */
1711 /* Return the size of the nat list entry to be copied back to user space. */
1712 /* The size of the entry is stored in the ng_sz field and the enture natget */
1713 /* structure is copied back to the user. */
1714 /* ------------------------------------------------------------------------ */
1716 ipf_nat_getsz(softc, data, getlock)
1717 ipf_main_softc_t *softc;
1721 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1727 error = BCOPYIN(data, &ng, sizeof(ng));
1734 READ_ENTER(&softc->ipf_nat);
1739 nat = softn->ipf_nat_instances;
1742 * Empty list so the size returned is 0. Simple.
1746 RWLOCK_EXIT(&softc->ipf_nat);
1748 error = BCOPYOUT(&ng, data, sizeof(ng));
1757 * Make sure the pointer we're copying from exists in the
1758 * current list of entries. Security precaution to prevent
1759 * copying of random kernel data.
1761 for (n = softn->ipf_nat_instances; n; n = n->nat_next)
1766 RWLOCK_EXIT(&softc->ipf_nat);
1774 * Incluse any space required for proxy data structures.
1776 ng.ng_sz = sizeof(nat_save_t);
1779 ng.ng_sz += sizeof(ap_session_t) - 4;
1780 if (aps->aps_data != 0)
1781 ng.ng_sz += aps->aps_psiz;
1784 RWLOCK_EXIT(&softc->ipf_nat);
1787 error = BCOPYOUT(&ng, data, sizeof(ng));
1796 /* ------------------------------------------------------------------------ */
1797 /* Function: ipf_nat_getent */
1798 /* Returns: int - 0 == success, != 0 is the error value. */
1799 /* Parameters: softc(I) - pointer to soft context main structure */
1800 /* data(I) - pointer to natget structure with kernel pointer*/
1801 /* to NAT structure to copy out. */
1802 /* getlock(I) - flag indicating whether or not the caller */
1803 /* holds a lock on ipf_nat */
1805 /* Handle SIOCSTGET. */
1806 /* Copies out NAT entry to user space. Any additional data held for a */
1807 /* proxy is also copied, as to is the NAT rule which was responsible for it */
1808 /* ------------------------------------------------------------------------ */
1810 ipf_nat_getent(softc, data, getlock)
1811 ipf_main_softc_t *softc;
1815 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1818 nat_save_t *ipn, ipns;
1821 error = ipf_inobj(softc, data, NULL, &ipns, IPFOBJ_NATSAVE);
1825 if ((ipns.ipn_dsize < sizeof(ipns)) || (ipns.ipn_dsize > 81920)) {
1830 KMALLOCS(ipn, nat_save_t *, ipns.ipn_dsize);
1837 READ_ENTER(&softc->ipf_nat);
1840 ipn->ipn_dsize = ipns.ipn_dsize;
1841 nat = ipns.ipn_next;
1843 nat = softn->ipf_nat_instances;
1845 if (softn->ipf_nat_instances == NULL) {
1853 * Make sure the pointer we're copying from exists in the
1854 * current list of entries. Security precaution to prevent
1855 * copying of random kernel data.
1857 for (n = softn->ipf_nat_instances; n; n = n->nat_next)
1866 ipn->ipn_next = nat->nat_next;
1869 * Copy the NAT structure.
1871 bcopy((char *)nat, &ipn->ipn_nat, sizeof(*nat));
1874 * If we have a pointer to the NAT rule it belongs to, save that too.
1876 if (nat->nat_ptr != NULL)
1877 bcopy((char *)nat->nat_ptr, (char *)&ipn->ipn_ipnat,
1878 ipn->ipn_ipnat.in_size);
1881 * If we also know the NAT entry has an associated filter rule,
1884 if (nat->nat_fr != NULL)
1885 bcopy((char *)nat->nat_fr, (char *)&ipn->ipn_fr,
1886 sizeof(ipn->ipn_fr));
1889 * Last but not least, if there is an application proxy session set
1890 * up for this NAT entry, then copy that out too, including any
1891 * private data saved along side it by the proxy.
1894 outsize = ipn->ipn_dsize - sizeof(*ipn) + sizeof(ipn->ipn_data);
1898 if (outsize < sizeof(*aps)) {
1905 bcopy((char *)aps, s, sizeof(*aps));
1907 outsize -= sizeof(*aps);
1908 if ((aps->aps_data != NULL) && (outsize >= aps->aps_psiz))
1909 bcopy(aps->aps_data, s, aps->aps_psiz);
1917 READ_ENTER(&softc->ipf_nat);
1920 error = ipf_outobjsz(softc, data, ipn, IPFOBJ_NATSAVE,
1926 READ_ENTER(&softc->ipf_nat);
1929 KFREES(ipn, ipns.ipn_dsize);
1935 /* ------------------------------------------------------------------------ */
1936 /* Function: ipf_nat_putent */
1937 /* Returns: int - 0 == success, != 0 is the error value. */
1938 /* Parameters: softc(I) - pointer to soft context main structure */
1939 /* data(I) - pointer to natget structure with NAT */
1940 /* structure information to load into the kernel */
1941 /* getlock(I) - flag indicating whether or not a write lock */
1942 /* on is already held. */
1944 /* Handle SIOCSTPUT. */
1945 /* Loads a NAT table entry from user space, including a NAT rule, proxy and */
1946 /* firewall rule data structures, if pointers to them indicate so. */
1947 /* ------------------------------------------------------------------------ */
1949 ipf_nat_putent(softc, data, getlock)
1950 ipf_main_softc_t *softc;
1954 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1955 nat_save_t ipn, *ipnn;
1963 error = ipf_inobj(softc, data, NULL, &ipn, IPFOBJ_NATSAVE);
1968 * Initialise early because of code at junkput label.
1978 * New entry, copy in the rest of the NAT entry if it's size is more
1979 * than just the nat_t structure.
1981 if (ipn.ipn_dsize > sizeof(ipn)) {
1982 if (ipn.ipn_dsize > 81920) {
1988 KMALLOCS(ipnn, nat_save_t *, ipn.ipn_dsize);
1994 bzero(ipnn, ipn.ipn_dsize);
1995 error = ipf_inobjsz(softc, data, ipnn, IPFOBJ_NATSAVE,
2003 KMALLOC(nat, nat_t *);
2010 bcopy((char *)&ipnn->ipn_nat, (char *)nat, sizeof(*nat));
2012 switch (nat->nat_v[0])
2021 error = EPROTONOSUPPORT;
2027 * Initialize all these so that ipf_nat_delete() doesn't cause a crash.
2029 bzero((char *)nat, offsetof(struct nat, nat_tqe));
2030 nat->nat_tqe.tqe_pnext = NULL;
2031 nat->nat_tqe.tqe_next = NULL;
2032 nat->nat_tqe.tqe_ifq = NULL;
2033 nat->nat_tqe.tqe_parent = nat;
2036 * Restore the rule associated with this nat session
2038 in = ipnn->ipn_nat.nat_ptr;
2040 KMALLOCS(in, ipnat_t *, ipnn->ipn_ipnat.in_size);
2047 bcopy((char *)&ipnn->ipn_ipnat, (char *)in,
2048 ipnn->ipn_ipnat.in_size);
2050 in->in_flags |= IPN_DELETE;
2052 ATOMIC_INC32(softn->ipf_nat_stats.ns_rules);
2054 if (ipf_nat_resolverule(softc, in) != 0) {
2062 * Check that the NAT entry doesn't already exist in the kernel.
2064 * For NAT_OUTBOUND, we're lookup for a duplicate MAP entry. To do
2065 * this, we check to see if the inbound combination of addresses and
2066 * ports is already known. Similar logic is applied for NAT_INBOUND.
2069 bzero((char *)&fin, sizeof(fin));
2070 fin.fin_v = nat->nat_v[0];
2071 fin.fin_p = nat->nat_pr[0];
2072 fin.fin_rev = nat->nat_rev;
2073 fin.fin_ifp = nat->nat_ifps[0];
2074 fin.fin_data[0] = ntohs(nat->nat_ndport);
2075 fin.fin_data[1] = ntohs(nat->nat_nsport);
2077 switch (nat->nat_dir)
2080 case NAT_DIVERTOUT :
2082 READ_ENTER(&softc->ipf_nat);
2085 fin.fin_v = nat->nat_v[1];
2086 if (nat->nat_v[1] == 4) {
2087 n = ipf_nat_inlookup(&fin, nat->nat_flags, fin.fin_p,
2088 nat->nat_ndstip, nat->nat_nsrcip);
2090 } else if (nat->nat_v[1] == 6) {
2091 n = ipf_nat6_inlookup(&fin, nat->nat_flags, fin.fin_p,
2092 &nat->nat_ndst6.in6,
2093 &nat->nat_nsrc6.in6);
2098 RWLOCK_EXIT(&softc->ipf_nat);
2110 READ_ENTER(&softc->ipf_nat);
2113 if (fin.fin_v == 4) {
2114 n = ipf_nat_outlookup(&fin, nat->nat_flags, fin.fin_p,
2118 } else if (fin.fin_v == 6) {
2119 n = ipf_nat6_outlookup(&fin, nat->nat_flags, fin.fin_p,
2120 &nat->nat_ndst6.in6,
2121 &nat->nat_nsrc6.in6);
2126 RWLOCK_EXIT(&softc->ipf_nat);
2142 * Restore ap_session_t structure. Include the private data allocated
2147 KMALLOC(aps, ap_session_t *);
2154 bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps));
2156 aps->aps_apr = in->in_apr;
2158 aps->aps_apr = NULL;
2159 if (aps->aps_psiz != 0) {
2160 if (aps->aps_psiz > 81920) {
2165 KMALLOCS(aps->aps_data, void *, aps->aps_psiz);
2166 if (aps->aps_data == NULL) {
2171 bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data,
2175 aps->aps_data = NULL;
2180 * If there was a filtering rule associated with this entry then
2181 * build up a new one.
2185 if ((nat->nat_flags & SI_NEWFR) != 0) {
2186 KMALLOC(fr, frentry_t *);
2193 ipnn->ipn_nat.nat_fr = fr;
2195 (void) ipf_outobj(softc, data, ipnn, IPFOBJ_NATSAVE);
2196 bcopy((char *)&ipnn->ipn_fr, (char *)fr, sizeof(*fr));
2201 fr->fr_type = FR_T_NONE;
2203 MUTEX_NUKE(&fr->fr_lock);
2204 MUTEX_INIT(&fr->fr_lock, "nat-filter rule lock");
2207 READ_ENTER(&softc->ipf_nat);
2209 for (n = softn->ipf_nat_instances; n; n = n->nat_next)
2210 if (n->nat_fr == fr)
2214 MUTEX_ENTER(&fr->fr_lock);
2216 MUTEX_EXIT(&fr->fr_lock);
2219 RWLOCK_EXIT(&softc->ipf_nat);
2231 KFREES(ipnn, ipn.ipn_dsize);
2236 WRITE_ENTER(&softc->ipf_nat);
2240 error = ipf_nat_finalise(&fin, nat);
2243 error = ipf_nat6_finalise(&fin, nat);
2247 RWLOCK_EXIT(&softc->ipf_nat);
2258 (void) ipf_derefrule(softc, &fr);
2261 if ((ipnn != NULL) && (ipnn != &ipn)) {
2262 KFREES(ipnn, ipn.ipn_dsize);
2266 if (aps->aps_data != NULL) {
2267 KFREES(aps->aps_data, aps->aps_psiz);
2273 ipf_proxy_deref(in->in_apr);
2274 KFREES(in, in->in_size);
2282 /* ------------------------------------------------------------------------ */
2283 /* Function: ipf_nat_delete */
2285 /* Parameters: softc(I) - pointer to soft context main structure */
2286 /* nat(I) - pointer to NAT structure to delete */
2287 /* logtype(I) - type of LOG record to create before deleting */
2288 /* Write Lock: ipf_nat */
2290 /* Delete a nat entry from the various lists and table. If NAT logging is */
2291 /* enabled then generate a NAT log record for this event. */
2292 /* ------------------------------------------------------------------------ */
2294 ipf_nat_delete(softc, nat, logtype)
2295 ipf_main_softc_t *softc;
2299 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2300 int madeorphan = 0, bkt, removed = 0;
2301 nat_stat_side_t *nss;
2304 if (logtype != 0 && softn->ipf_nat_logging != 0)
2305 ipf_nat_log(softc, softn, nat, logtype);
2308 * Take it as a general indication that all the pointers are set if
2311 if (nat->nat_pnext != NULL) {
2314 bkt = nat->nat_hv[0] % softn->ipf_nat_table_sz;
2315 nss = &softn->ipf_nat_stats.ns_side[0];
2316 nss->ns_bucketlen[bkt]--;
2317 if (nss->ns_bucketlen[bkt] == 0) {
2321 bkt = nat->nat_hv[1] % softn->ipf_nat_table_sz;
2322 nss = &softn->ipf_nat_stats.ns_side[1];
2323 nss->ns_bucketlen[bkt]--;
2324 if (nss->ns_bucketlen[bkt] == 0) {
2328 *nat->nat_pnext = nat->nat_next;
2329 if (nat->nat_next != NULL) {
2330 nat->nat_next->nat_pnext = nat->nat_pnext;
2331 nat->nat_next = NULL;
2333 nat->nat_pnext = NULL;
2335 *nat->nat_phnext[0] = nat->nat_hnext[0];
2336 if (nat->nat_hnext[0] != NULL) {
2337 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
2338 nat->nat_hnext[0] = NULL;
2340 nat->nat_phnext[0] = NULL;
2342 *nat->nat_phnext[1] = nat->nat_hnext[1];
2343 if (nat->nat_hnext[1] != NULL) {
2344 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
2345 nat->nat_hnext[1] = NULL;
2347 nat->nat_phnext[1] = NULL;
2349 if ((nat->nat_flags & SI_WILDP) != 0) {
2350 ATOMIC_DEC32(softn->ipf_nat_stats.ns_wilds);
2355 if (nat->nat_me != NULL) {
2356 *nat->nat_me = NULL;
2359 ASSERT(nat->nat_ref >= 0);
2362 if (nat->nat_tqe.tqe_ifq != NULL) {
2364 * No call to ipf_freetimeoutqueue() is made here, they are
2365 * garbage collected in ipf_nat_expire().
2367 (void) ipf_deletequeueentry(&nat->nat_tqe);
2370 if (nat->nat_sync) {
2371 ipf_sync_del_nat(softc->ipf_sync_soft, nat->nat_sync);
2372 nat->nat_sync = NULL;
2375 if (logtype == NL_EXPIRE)
2376 softn->ipf_nat_stats.ns_expire++;
2378 MUTEX_ENTER(&nat->nat_lock);
2380 * NL_DESTROY should only be passed in when we've got nat_ref >= 2.
2381 * This happens when a nat'd packet is blocked and we want to throw
2382 * away the NAT session.
2384 if (logtype == NL_DESTROY) {
2385 if (nat->nat_ref > 2) {
2387 MUTEX_EXIT(&nat->nat_lock);
2389 softn->ipf_nat_stats.ns_orphans++;
2392 } else if (nat->nat_ref > 1) {
2394 MUTEX_EXIT(&nat->nat_lock);
2395 if (madeorphan == 1)
2396 softn->ipf_nat_stats.ns_orphans++;
2399 ASSERT(nat->nat_ref >= 0);
2400 MUTEX_EXIT(&nat->nat_lock);
2404 if (madeorphan == 0)
2405 softn->ipf_nat_stats.ns_orphans--;
2408 * At this point, nat_ref can be either 0 or -1
2410 softn->ipf_nat_stats.ns_proto[nat->nat_pr[0]]--;
2412 if (nat->nat_fr != NULL) {
2413 (void) ipf_derefrule(softc, &nat->nat_fr);
2416 if (nat->nat_hm != NULL) {
2417 ipf_nat_hostmapdel(softc, &nat->nat_hm);
2421 * If there is an active reference from the nat entry to its parent
2422 * rule, decrement the rule's reference count and free it too if no
2423 * longer being used.
2426 nat->nat_ptr = NULL;
2430 ipf_nat_rule_deref(softc, &ipn);
2433 if (nat->nat_aps != NULL) {
2434 ipf_proxy_free(softc, nat->nat_aps);
2435 nat->nat_aps = NULL;
2438 MUTEX_DESTROY(&nat->nat_lock);
2440 softn->ipf_nat_stats.ns_active--;
2443 * If there's a fragment table entry too for this nat entry, then
2444 * dereference that as well. This is after nat_lock is released
2447 ipf_frag_natforget(softc, (void *)nat);
2453 /* ------------------------------------------------------------------------ */
2454 /* Function: ipf_nat_flushtable */
2455 /* Returns: int - number of NAT rules deleted */
2456 /* Parameters: softc(I) - pointer to soft context main structure */
2457 /* softn(I) - pointer to NAT context structure */
2458 /* Write Lock: ipf_nat */
2460 /* Deletes all currently active NAT sessions. In deleting each NAT entry a */
2461 /* log record should be emitted in ipf_nat_delete() if NAT logging is */
2463 /* ------------------------------------------------------------------------ */
2465 * nat_flushtable - clear the NAT table of all mapping entries.
2468 ipf_nat_flushtable(softc, softn)
2469 ipf_main_softc_t *softc;
2470 ipf_nat_softc_t *softn;
2476 * ALL NAT mappings deleted, so lets just make the deletions
2479 if (softn->ipf_nat_table[0] != NULL)
2480 bzero((char *)softn->ipf_nat_table[0],
2481 sizeof(softn->ipf_nat_table[0]) *
2482 softn->ipf_nat_table_sz);
2483 if (softn->ipf_nat_table[1] != NULL)
2484 bzero((char *)softn->ipf_nat_table[1],
2485 sizeof(softn->ipf_nat_table[1]) *
2486 softn->ipf_nat_table_sz);
2488 while ((nat = softn->ipf_nat_instances) != NULL) {
2489 ipf_nat_delete(softc, nat, NL_FLUSH);
2497 /* ------------------------------------------------------------------------ */
2498 /* Function: ipf_nat_clearlist */
2499 /* Returns: int - number of NAT/RDR rules deleted */
2500 /* Parameters: softc(I) - pointer to soft context main structure */
2501 /* softn(I) - pointer to NAT context structure */
2503 /* Delete all rules in the current list of rules. There is nothing elegant */
2504 /* about this cleanup: simply free all entries on the list of rules and */
2505 /* clear out the tables used for hashed NAT rule lookups. */
2506 /* ------------------------------------------------------------------------ */
2508 ipf_nat_clearlist(softc, softn)
2509 ipf_main_softc_t *softc;
2510 ipf_nat_softc_t *softn;
2515 if (softn->ipf_nat_map_rules != NULL) {
2516 bzero((char *)softn->ipf_nat_map_rules,
2517 sizeof(*softn->ipf_nat_map_rules) *
2518 softn->ipf_nat_maprules_sz);
2520 if (softn->ipf_nat_rdr_rules != NULL) {
2521 bzero((char *)softn->ipf_nat_rdr_rules,
2522 sizeof(*softn->ipf_nat_rdr_rules) *
2523 softn->ipf_nat_rdrrules_sz);
2526 while ((n = softn->ipf_nat_list) != NULL) {
2527 ipf_nat_delrule(softc, softn, n, 0);
2530 #if SOLARIS && !defined(INSTANCES)
2531 pfil_delayed_copy = 1;
2537 /* ------------------------------------------------------------------------ */
2538 /* Function: ipf_nat_delrule */
2540 /* Parameters: softc(I) - pointer to soft context main structure */
2541 /* softn(I) - pointer to NAT context structure */
2542 /* np(I) - pointer to NAT rule to delete */
2543 /* purge(I) - 1 == allow purge, 0 == prevent purge */
2544 /* Locks: WRITE(ipf_nat) */
2546 /* Preventing "purge" from occuring is allowed because when all of the NAT */
2547 /* rules are being removed, allowing the "purge" to walk through the list */
2548 /* of NAT sessions, possibly multiple times, would be a large performance */
2549 /* hit, on the order of O(N^2). */
2550 /* ------------------------------------------------------------------------ */
2552 ipf_nat_delrule(softc, softn, np, purge)
2553 ipf_main_softc_t *softc;
2554 ipf_nat_softc_t *softn;
2559 if (np->in_pnext != NULL) {
2560 *np->in_pnext = np->in_next;
2561 if (np->in_next != NULL)
2562 np->in_next->in_pnext = np->in_pnext;
2563 if (softn->ipf_nat_list_tail == &np->in_next)
2564 softn->ipf_nat_list_tail = np->in_pnext;
2567 if ((purge == 1) && ((np->in_flags & IPN_PURGE) != 0)) {
2571 for (next = softn->ipf_nat_instances; (nat = next) != NULL;) {
2572 next = nat->nat_next;
2573 if (nat->nat_ptr == np)
2574 ipf_nat_delete(softc, nat, NL_PURGE);
2578 if ((np->in_flags & IPN_DELETE) == 0) {
2579 if (np->in_redir & NAT_REDIRECT) {
2580 switch (np->in_v[0])
2583 ipf_nat_delrdr(softn, np);
2587 ipf_nat6_delrdr(softn, np);
2592 if (np->in_redir & (NAT_MAPBLK|NAT_MAP)) {
2593 switch (np->in_v[0])
2596 ipf_nat_delmap(softn, np);
2600 ipf_nat6_delmap(softn, np);
2607 np->in_flags |= IPN_DELETE;
2608 ipf_nat_rule_deref(softc, &np);
2612 /* ------------------------------------------------------------------------ */
2613 /* Function: ipf_nat_newmap */
2614 /* Returns: int - -1 == error, 0 == success */
2615 /* Parameters: fin(I) - pointer to packet information */
2616 /* nat(I) - pointer to NAT entry */
2617 /* ni(I) - pointer to structure with misc. information needed */
2618 /* to create new NAT entry. */
2620 /* Given an empty NAT structure, populate it with new information about a */
2621 /* new NAT session, as defined by the matching NAT rule. */
2622 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
2623 /* to the new IP address for the translation. */
2624 /* ------------------------------------------------------------------------ */
2626 ipf_nat_newmap(fin, nat, ni)
2631 ipf_main_softc_t *softc = fin->fin_main_soft;
2632 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2633 u_short st_port, dport, sport, port, sp, dp;
2634 struct in_addr in, inb;
2643 * If it's an outbound packet which doesn't match any existing
2644 * record, then create a new port
2649 st_ip = np->in_snip;
2650 st_port = np->in_spnext;
2651 flags = nat->nat_flags;
2653 if (flags & IPN_ICMPQUERY) {
2654 sport = fin->fin_data[1];
2657 sport = htons(fin->fin_data[0]);
2658 dport = htons(fin->fin_data[1]);
2662 * Do a loop until we either run out of entries to try or we find
2663 * a NAT mapping that isn't currently being used. This is done
2664 * because the change to the source is not (usually) being fixed.
2668 in.s_addr = htonl(np->in_snip);
2671 * Check to see if there is an existing NAT
2672 * setup for this IP address pair.
2674 hm = ipf_nat_hostmap(softn, np, fin->fin_src,
2675 fin->fin_dst, in, 0);
2677 in.s_addr = hm->hm_nsrcip.s_addr;
2678 } else if ((l == 1) && (hm != NULL)) {
2679 ipf_nat_hostmapdel(softc, &hm);
2681 in.s_addr = ntohl(in.s_addr);
2685 if ((np->in_nsrcmsk == 0xffffffff) && (np->in_spnext == 0)) {
2687 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_1);
2692 if (np->in_redir == NAT_BIMAP &&
2693 np->in_osrcmsk == np->in_nsrcmsk) {
2695 * map the address block in a 1:1 fashion
2697 in.s_addr = np->in_nsrcaddr;
2698 in.s_addr |= fin->fin_saddr & ~np->in_osrcmsk;
2699 in.s_addr = ntohl(in.s_addr);
2701 } else if (np->in_redir & NAT_MAPBLK) {
2702 if ((l >= np->in_ppip) || ((l > 0) &&
2703 !(flags & IPN_TCPUDP))) {
2704 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_2);
2708 * map-block - Calculate destination address.
2710 in.s_addr = ntohl(fin->fin_saddr);
2711 in.s_addr &= ntohl(~np->in_osrcmsk);
2712 inb.s_addr = in.s_addr;
2713 in.s_addr /= np->in_ippip;
2714 in.s_addr &= ntohl(~np->in_nsrcmsk);
2715 in.s_addr += ntohl(np->in_nsrcaddr);
2717 * Calculate destination port.
2719 if ((flags & IPN_TCPUDP) &&
2720 (np->in_ppip != 0)) {
2721 port = ntohs(sport) + l;
2722 port %= np->in_ppip;
2723 port += np->in_ppip *
2724 (inb.s_addr % np->in_ippip);
2725 port += MAPBLK_MINPORT;
2729 } else if ((np->in_nsrcaddr == 0) &&
2730 (np->in_nsrcmsk == 0xffffffff)) {
2734 * 0/32 - use the interface's IP address.
2737 ipf_ifpaddr(softc, 4, FRI_NORMAL, fin->fin_ifp,
2738 &in6, NULL) == -1) {
2739 NBUMPSIDEX(1, ns_new_ifpaddr, ns_new_ifpaddr_1);
2742 in.s_addr = ntohl(in6.in4.s_addr);
2744 } else if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0)) {
2746 * 0/0 - use the original source address/port.
2749 NBUMPSIDEX(1, ns_exhausted, ns_exhausted_3);
2752 in.s_addr = ntohl(fin->fin_saddr);
2754 } else if ((np->in_nsrcmsk != 0xffffffff) &&
2755 (np->in_spnext == 0) && ((l > 0) || (hm == NULL)))
2760 if ((flags & IPN_TCPUDP) &&
2761 ((np->in_redir & NAT_MAPBLK) == 0) &&
2762 (np->in_flags & IPN_AUTOPORTMAP)) {
2764 * "ports auto" (without map-block)
2766 if ((l > 0) && (l % np->in_ppip == 0)) {
2767 if ((l > np->in_ppip) &&
2768 np->in_nsrcmsk != 0xffffffff)
2771 if (np->in_ppip != 0) {
2772 port = ntohs(sport);
2773 port += (l % np->in_ppip);
2774 port %= np->in_ppip;
2775 port += np->in_ppip *
2776 (ntohl(fin->fin_saddr) %
2778 port += MAPBLK_MINPORT;
2782 } else if (((np->in_redir & NAT_MAPBLK) == 0) &&
2783 (flags & IPN_TCPUDPICMP) && (np->in_spnext != 0)) {
2785 * Standard port translation. Select next port.
2787 if (np->in_flags & IPN_SEQUENTIAL) {
2788 port = np->in_spnext;
2790 port = ipf_random() % (np->in_spmax -
2792 port += np->in_spmin;
2797 if (np->in_spnext > np->in_spmax) {
2798 np->in_spnext = np->in_spmin;
2799 if (np->in_nsrcmsk != 0xffffffff)
2804 if (np->in_flags & IPN_SIPRANGE) {
2805 if (np->in_snip > ntohl(np->in_nsrcmsk))
2806 np->in_snip = ntohl(np->in_nsrcaddr);
2808 if ((np->in_nsrcmsk != 0xffffffff) &&
2809 ((np->in_snip + 1) & ntohl(np->in_nsrcmsk)) >
2810 ntohl(np->in_nsrcaddr))
2811 np->in_snip = ntohl(np->in_nsrcaddr) + 1;
2814 if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY)))
2818 * Here we do a lookup of the connection as seen from
2819 * the outside. If an IP# pair already exists, try
2820 * again. So if you have A->B becomes C->B, you can
2821 * also have D->E become C->E but not D->B causing
2822 * another C->B. Also take protocol and ports into
2823 * account when determining whether a pre-existing
2824 * NAT setup will cause an external conflict where
2825 * this is appropriate.
2827 inb.s_addr = htonl(in.s_addr);
2828 sp = fin->fin_data[0];
2829 dp = fin->fin_data[1];
2830 fin->fin_data[0] = fin->fin_data[1];
2831 fin->fin_data[1] = ntohs(port);
2832 natl = ipf_nat_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
2833 (u_int)fin->fin_p, fin->fin_dst, inb);
2834 fin->fin_data[0] = sp;
2835 fin->fin_data[1] = dp;
2838 * Has the search wrapped around and come back to the
2841 if ((natl != NULL) &&
2842 (np->in_spnext != 0) && (st_port == np->in_spnext) &&
2843 (np->in_snip != 0) && (st_ip == np->in_snip)) {
2844 NBUMPSIDED(1, ns_wrap);
2848 } while (natl != NULL);
2850 /* Setup the NAT table */
2851 nat->nat_osrcip = fin->fin_src;
2852 nat->nat_nsrcaddr = htonl(in.s_addr);
2853 nat->nat_odstip = fin->fin_dst;
2854 nat->nat_ndstip = fin->fin_dst;
2855 if (nat->nat_hm == NULL)
2856 nat->nat_hm = ipf_nat_hostmap(softn, np, fin->fin_src,
2857 fin->fin_dst, nat->nat_nsrcip,
2860 if (flags & IPN_TCPUDP) {
2861 nat->nat_osport = sport;
2862 nat->nat_nsport = port; /* sport */
2863 nat->nat_odport = dport;
2864 nat->nat_ndport = dport;
2865 ((tcphdr_t *)fin->fin_dp)->th_sport = port;
2866 } else if (flags & IPN_ICMPQUERY) {
2867 nat->nat_oicmpid = fin->fin_data[1];
2868 ((icmphdr_t *)fin->fin_dp)->icmp_id = port;
2869 nat->nat_nicmpid = port;
2875 /* ------------------------------------------------------------------------ */
2876 /* Function: ipf_nat_newrdr */
2877 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */
2878 /* allow rule to be moved if IPN_ROUNDR is set. */
2879 /* Parameters: fin(I) - pointer to packet information */
2880 /* nat(I) - pointer to NAT entry */
2881 /* ni(I) - pointer to structure with misc. information needed */
2882 /* to create new NAT entry. */
2884 /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
2885 /* to the new IP address for the translation. */
2886 /* ------------------------------------------------------------------------ */
2888 ipf_nat_newrdr(fin, nat, ni)
2893 ipf_main_softc_t *softc = fin->fin_main_soft;
2894 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
2895 u_short nport, dport, sport;
2896 struct in_addr in, inb;
2908 flags = nat->nat_flags;
2910 if (flags & IPN_ICMPQUERY) {
2911 dport = fin->fin_data[1];
2914 sport = htons(fin->fin_data[0]);
2915 dport = htons(fin->fin_data[1]);
2918 /* TRACE sport, dport */
2922 * If the matching rule has IPN_STICKY set, then we want to have the
2923 * same rule kick in as before. Why would this happen? If you have
2924 * a collection of rdr rules with "round-robin sticky", the current
2925 * packet might match a different one to the previous connection but
2926 * we want the same destination to be used.
2928 if (((np->in_flags & (IPN_ROUNDR|IPN_SPLIT)) != 0) &&
2929 ((np->in_flags & IPN_STICKY) != 0)) {
2930 hm = ipf_nat_hostmap(softn, NULL, fin->fin_src, fin->fin_dst,
2933 in.s_addr = ntohl(hm->hm_ndstip.s_addr);
2937 ipf_nat_hostmapdel(softc, &hm);
2942 * Otherwise, it's an inbound packet. Most likely, we don't
2943 * want to rewrite source ports and source addresses. Instead,
2944 * we want to rewrite to a fixed internal address and fixed
2947 if (np->in_flags & IPN_SPLIT) {
2948 in.s_addr = np->in_dnip;
2950 if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) {
2951 hm = ipf_nat_hostmap(softn, NULL, fin->fin_src,
2952 fin->fin_dst, in, (u_32_t)dport);
2954 in.s_addr = hm->hm_ndstip.s_addr;
2959 if (hm == NULL || hm->hm_ref == 1) {
2960 if (np->in_ndstaddr == htonl(in.s_addr)) {
2961 np->in_dnip = ntohl(np->in_ndstmsk);
2964 np->in_dnip = ntohl(np->in_ndstaddr);
2968 ipf_nat_hostmapdel(softc, &hm);
2970 } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0xffffffff)) {
2974 * 0/32 - use the interface's IP address.
2976 if (ipf_ifpaddr(softc, 4, FRI_NORMAL, fin->fin_ifp,
2977 &in6, NULL) == -1) {
2978 NBUMPSIDEX(0, ns_new_ifpaddr, ns_new_ifpaddr_2);
2981 in.s_addr = ntohl(in6.in4.s_addr);
2983 } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk== 0)) {
2985 * 0/0 - use the original destination address/port.
2987 in.s_addr = ntohl(fin->fin_daddr);
2989 } else if (np->in_redir == NAT_BIMAP &&
2990 np->in_ndstmsk == np->in_odstmsk) {
2992 * map the address block in a 1:1 fashion
2994 in.s_addr = np->in_ndstaddr;
2995 in.s_addr |= fin->fin_daddr & ~np->in_ndstmsk;
2996 in.s_addr = ntohl(in.s_addr);
2998 in.s_addr = ntohl(np->in_ndstaddr);
3001 if ((np->in_dpnext == 0) || ((flags & NAT_NOTRULEPORT) != 0))
3005 * Whilst not optimized for the case where
3006 * pmin == pmax, the gain is not significant.
3008 if (((np->in_flags & IPN_FIXEDDPORT) == 0) &&
3009 (np->in_odport != np->in_dtop)) {
3010 nport = ntohs(dport) - np->in_odport + np->in_dpmax;
3011 nport = htons(nport);
3013 nport = htons(np->in_dpnext);
3015 if (np->in_dpnext > np->in_dpmax)
3016 np->in_dpnext = np->in_dpmin;
3021 * When the redirect-to address is set to 0.0.0.0, just
3022 * assume a blank `forwarding' of the packet. We don't
3023 * setup any translation for this either.
3025 if (in.s_addr == 0) {
3026 if (nport == dport) {
3027 NBUMPSIDED(0, ns_xlate_null);
3030 in.s_addr = ntohl(fin->fin_daddr);
3034 * Check to see if this redirect mapping already exists and if
3035 * it does, return "failure" (allowing it to be created will just
3036 * cause one or both of these "connections" to stop working.)
3038 inb.s_addr = htonl(in.s_addr);
3039 sp = fin->fin_data[0];
3040 dp = fin->fin_data[1];
3041 fin->fin_data[1] = fin->fin_data[0];
3042 fin->fin_data[0] = ntohs(nport);
3043 natl = ipf_nat_outlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
3044 (u_int)fin->fin_p, inb, fin->fin_src);
3045 fin->fin_data[0] = sp;
3046 fin->fin_data[1] = dp;
3048 DT2(ns_new_xlate_exists, fr_info_t *, fin, nat_t *, natl);
3049 NBUMPSIDE(0, ns_xlate_exists);
3053 nat->nat_ndstaddr = htonl(in.s_addr);
3054 nat->nat_odstip = fin->fin_dst;
3055 nat->nat_nsrcip = fin->fin_src;
3056 nat->nat_osrcip = fin->fin_src;
3057 if ((nat->nat_hm == NULL) && ((np->in_flags & IPN_STICKY) != 0))
3058 nat->nat_hm = ipf_nat_hostmap(softn, np, fin->fin_src,
3059 fin->fin_dst, in, (u_32_t)dport);
3061 if (flags & IPN_TCPUDP) {
3062 nat->nat_odport = dport;
3063 nat->nat_ndport = nport;
3064 nat->nat_osport = sport;
3065 nat->nat_nsport = sport;
3066 ((tcphdr_t *)fin->fin_dp)->th_dport = nport;
3067 } else if (flags & IPN_ICMPQUERY) {
3068 nat->nat_oicmpid = fin->fin_data[1];
3069 ((icmphdr_t *)fin->fin_dp)->icmp_id = nport;
3070 nat->nat_nicmpid = nport;
3076 /* ------------------------------------------------------------------------ */
3077 /* Function: ipf_nat_add */
3078 /* Returns: nat_t* - NULL == failure to create new NAT structure, */
3079 /* else pointer to new NAT structure */
3080 /* Parameters: fin(I) - pointer to packet information */
3081 /* np(I) - pointer to NAT rule */
3082 /* natsave(I) - pointer to where to store NAT struct pointer */
3083 /* flags(I) - flags describing the current packet */
3084 /* direction(I) - direction of packet (in/out) */
3085 /* Write Lock: ipf_nat */
3087 /* Attempts to create a new NAT entry. Does not actually change the packet */
3090 /* This fucntion is in three main parts: (1) deal with creating a new NAT */
3091 /* structure for a "MAP" rule (outgoing NAT translation); (2) deal with */
3092 /* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */
3093 /* and (3) building that structure and putting it into the NAT table(s). */
3095 /* NOTE: natsave should NOT be used top point back to an ipstate_t struct */
3096 /* as it can result in memory being corrupted. */
3097 /* ------------------------------------------------------------------------ */
3099 ipf_nat_add(fin, np, natsave, flags, direction)
3106 ipf_main_softc_t *softc = fin->fin_main_soft;
3107 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3108 hostmap_t *hm = NULL;
3115 nsp = &softn->ipf_nat_stats;
3117 if ((nsp->ns_active * 100 / softn->ipf_nat_table_max) >
3118 softn->ipf_nat_table_wm_high) {
3119 softn->ipf_nat_doflush = 1;
3122 if (nsp->ns_active >= softn->ipf_nat_table_max) {
3123 NBUMPSIDED(fin->fin_out, ns_table_max);
3128 nflags = np->in_flags & flags;
3129 nflags &= NAT_FROMRULE;
3135 /* Give me a new nat */
3136 KMALLOC(nat, nat_t *);
3138 NBUMPSIDED(fin->fin_out, ns_memfail);
3140 * Try to automatically tune the max # of entries in the
3141 * table allowed to be less than what will cause kmem_alloc()
3142 * to fail and try to eliminate panics due to out of memory
3143 * conditions arising.
3145 if ((softn->ipf_nat_table_max > softn->ipf_nat_table_sz) &&
3146 (nsp->ns_active > 100)) {
3147 softn->ipf_nat_table_max = nsp->ns_active - 100;
3148 printf("table_max reduced to %d\n",
3149 softn->ipf_nat_table_max);
3154 if (flags & IPN_ICMPQUERY) {
3156 * In the ICMP query NAT code, we translate the ICMP id fields
3157 * to make them unique. This is indepedent of the ICMP type
3158 * (e.g. in the unlikely event that a host sends an echo and
3159 * an tstamp request with the same id, both packets will have
3160 * their ip address/id field changed in the same way).
3162 /* The icmp_id field is used by the sender to identify the
3163 * process making the icmp request. (the receiver justs
3164 * copies it back in its response). So, it closely matches
3165 * the concept of source port. We overlay sport, so we can
3166 * maximally reuse the existing code.
3168 ni.nai_sport = fin->fin_data[1];
3172 bzero((char *)nat, sizeof(*nat));
3173 nat->nat_flags = flags;
3174 nat->nat_redir = np->in_redir;
3175 nat->nat_dir = direction;
3176 nat->nat_pr[0] = fin->fin_p;
3177 nat->nat_pr[1] = fin->fin_p;
3180 * Search the current table for a match and create a new mapping
3181 * if there is none found.
3183 if (np->in_redir & NAT_DIVERTUDP) {
3184 move = ipf_nat_newdivert(fin, nat, &ni);
3186 } else if (np->in_redir & NAT_REWRITE) {
3187 move = ipf_nat_newrewrite(fin, nat, &ni);
3189 } else if (direction == NAT_OUTBOUND) {
3191 * We can now arrange to call this for the same connection
3192 * because ipf_nat_new doesn't protect the code path into
3195 natl = ipf_nat_outlookup(fin, nflags, (u_int)fin->fin_p,
3196 fin->fin_src, fin->fin_dst);
3203 move = ipf_nat_newmap(fin, nat, &ni);
3206 * NAT_INBOUND is used for redirects rules
3208 natl = ipf_nat_inlookup(fin, nflags, (u_int)fin->fin_p,
3209 fin->fin_src, fin->fin_dst);
3216 move = ipf_nat_newrdr(fin, nat, &ni);
3223 nat->nat_mssclamp = np->in_mssclamp;
3224 nat->nat_me = natsave;
3225 nat->nat_fr = fin->fin_fr;
3226 nat->nat_rev = fin->fin_rev;
3228 nat->nat_dlocal = np->in_dlocal;
3230 if ((np->in_apr != NULL) && ((nat->nat_flags & NAT_SLAVE) == 0)) {
3231 if (ipf_proxy_new(fin, nat) == -1) {
3232 NBUMPSIDED(fin->fin_out, ns_appr_fail);
3237 nat->nat_ifps[0] = np->in_ifps[0];
3238 if (np->in_ifps[0] != NULL) {
3239 COPYIFNAME(np->in_v[0], np->in_ifps[0], nat->nat_ifnames[0]);
3242 nat->nat_ifps[1] = np->in_ifps[1];
3243 if (np->in_ifps[1] != NULL) {
3244 COPYIFNAME(np->in_v[1], np->in_ifps[1], nat->nat_ifnames[1]);
3247 if (ipf_nat_finalise(fin, nat) == -1) {
3253 if ((move == 1) && (np->in_flags & IPN_ROUNDR)) {
3254 if ((np->in_redir & (NAT_REDIRECT|NAT_MAP)) == NAT_REDIRECT) {
3255 ipf_nat_delrdr(softn, np);
3256 ipf_nat_addrdr(softn, np);
3257 } else if ((np->in_redir & (NAT_REDIRECT|NAT_MAP)) == NAT_MAP) {
3258 ipf_nat_delmap(softn, np);
3259 ipf_nat_addmap(softn, np);
3263 if (flags & SI_WILDP)
3265 nsp->ns_proto[nat->nat_pr[0]]++;
3269 DT2(ns_badnatnew, fr_info_t *, fin, nat_t *, nat);
3270 NBUMPSIDE(fin->fin_out, ns_badnatnew);
3271 if ((hm = nat->nat_hm) != NULL)
3272 ipf_nat_hostmapdel(softc, &hm);
3276 if (nat != NULL && np != NULL)
3278 if (natsave != NULL)
3284 /* ------------------------------------------------------------------------ */
3285 /* Function: ipf_nat_finalise */
3286 /* Returns: int - 0 == sucess, -1 == failure */
3287 /* Parameters: fin(I) - pointer to packet information */
3288 /* nat(I) - pointer to NAT entry */
3289 /* Write Lock: ipf_nat */
3291 /* This is the tail end of constructing a new NAT entry and is the same */
3292 /* for both IPv4 and IPv6. */
3293 /* ------------------------------------------------------------------------ */
3296 ipf_nat_finalise(fin, nat)
3300 ipf_main_softc_t *softc = fin->fin_main_soft;
3301 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3302 u_32_t sum1, sum2, sumd;
3305 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6) && defined(ICK_M_CTL_MAGIC)
3306 qpktinfo_t *qpi = fin->fin_qpi;
3309 flags = nat->nat_flags;
3311 switch (nat->nat_pr[0])
3314 sum1 = LONG_SUM(ntohs(nat->nat_oicmpid));
3315 sum2 = LONG_SUM(ntohs(nat->nat_nicmpid));
3316 CALC_SUMD(sum1, sum2, sumd);
3317 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
3322 sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr) + \
3323 ntohs(nat->nat_osport));
3324 sum2 = LONG_SUM(ntohl(nat->nat_nsrcaddr) + \
3325 ntohs(nat->nat_nsport));
3326 CALC_SUMD(sum1, sum2, sumd);
3327 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
3329 sum1 = LONG_SUM(ntohl(nat->nat_odstaddr) + \
3330 ntohs(nat->nat_odport));
3331 sum2 = LONG_SUM(ntohl(nat->nat_ndstaddr) + \
3332 ntohs(nat->nat_ndport));
3333 CALC_SUMD(sum1, sum2, sumd);
3334 nat->nat_sumd[0] += (sumd & 0xffff) + (sumd >> 16);
3339 * Compute the partial checksum, just in case.
3340 * This is only ever placed into outbound packets so care needs
3341 * to be taken over which pair of addresses are used.
3343 if (nat->nat_dir == NAT_OUTBOUND) {
3344 sum1 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
3345 sum1 += LONG_SUM(ntohl(nat->nat_ndstaddr));
3347 sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr));
3348 sum1 += LONG_SUM(ntohl(nat->nat_odstaddr));
3350 sum1 += nat->nat_pr[1];
3351 nat->nat_sumd[1] = (sum1 & 0xffff) + (sum1 >> 16);
3353 sum1 = LONG_SUM(ntohl(nat->nat_osrcaddr));
3354 sum2 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
3355 CALC_SUMD(sum1, sum2, sumd);
3356 nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16);
3358 sum1 = LONG_SUM(ntohl(nat->nat_odstaddr));
3359 sum2 = LONG_SUM(ntohl(nat->nat_ndstaddr));
3360 CALC_SUMD(sum1, sum2, sumd);
3361 nat->nat_ipsumd += (sumd & 0xffff) + (sumd >> 16);
3366 if ((nat->nat_ifps[0] != NULL) && (nat->nat_ifps[0] != (void *)-1)) {
3367 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
3370 if ((nat->nat_ifps[1] != NULL) && (nat->nat_ifps[1] != (void *)-1)) {
3371 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
3374 if ((nat->nat_flags & SI_CLONE) == 0)
3375 nat->nat_sync = ipf_sync_new(softc, SMC_NAT, fin, nat);
3377 if (ipf_nat_insert(softc, softn, nat) == 0) {
3378 if (softn->ipf_nat_logging)
3379 ipf_nat_log(softc, softn, nat, NL_NEW);
3382 MUTEX_ENTER(&fr->fr_lock);
3384 MUTEX_EXIT(&fr->fr_lock);
3389 NBUMPSIDED(fin->fin_out, ns_unfinalised);
3391 * nat_insert failed, so cleanup time...
3393 if (nat->nat_sync != NULL)
3394 ipf_sync_del_nat(softc->ipf_sync_soft, nat->nat_sync);
3399 /* ------------------------------------------------------------------------ */
3400 /* Function: ipf_nat_insert */
3401 /* Returns: int - 0 == sucess, -1 == failure */
3402 /* Parameters: softc(I) - pointer to soft context main structure */
3403 /* softn(I) - pointer to NAT context structure */
3404 /* nat(I) - pointer to NAT structure */
3405 /* Write Lock: ipf_nat */
3407 /* Insert a NAT entry into the hash tables for searching and add it to the */
3408 /* list of active NAT entries. Adjust global counters when complete. */
3409 /* ------------------------------------------------------------------------ */
3411 ipf_nat_insert(softc, softn, nat)
3412 ipf_main_softc_t *softc;
3413 ipf_nat_softc_t *softn;
3421 * Try and return an error as early as possible, so calculate the hash
3422 * entry numbers first and then proceed.
3424 if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) {
3425 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
3426 sp = nat->nat_osport;
3427 dp = nat->nat_odport;
3428 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
3430 dp = nat->nat_oicmpid;
3435 hv0 = NAT_HASH_FN(nat->nat_osrcaddr, sp, 0xffffffff);
3436 hv0 = NAT_HASH_FN(nat->nat_odstaddr, hv0 + dp, 0xffffffff);
3438 * TRACE nat_osrcaddr, nat_osport, nat_odstaddr,
3442 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
3443 sp = nat->nat_nsport;
3444 dp = nat->nat_ndport;
3445 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
3447 dp = nat->nat_nicmpid;
3452 hv1 = NAT_HASH_FN(nat->nat_nsrcaddr, sp, 0xffffffff);
3453 hv1 = NAT_HASH_FN(nat->nat_ndstaddr, hv1 + dp, 0xffffffff);
3455 * TRACE nat_nsrcaddr, nat_nsport, nat_ndstaddr,
3459 hv0 = NAT_HASH_FN(nat->nat_osrcaddr, 0, 0xffffffff);
3460 hv0 = NAT_HASH_FN(nat->nat_odstaddr, hv0, 0xffffffff);
3461 /* TRACE nat_osrcaddr, nat_odstaddr, hv0 */
3463 hv1 = NAT_HASH_FN(nat->nat_nsrcaddr, 0, 0xffffffff);
3464 hv1 = NAT_HASH_FN(nat->nat_ndstaddr, hv1, 0xffffffff);
3465 /* TRACE nat_nsrcaddr, nat_ndstaddr, hv1 */
3468 nat->nat_hv[0] = hv0;
3469 nat->nat_hv[1] = hv1;
3471 MUTEX_INIT(&nat->nat_lock, "nat entry lock");
3474 nat->nat_ref = nat->nat_me ? 2 : 1;
3476 nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0';
3477 nat->nat_ifps[0] = ipf_resolvenic(softc, nat->nat_ifnames[0], 4);
3479 if (nat->nat_ifnames[1][0] != '\0') {
3480 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
3481 nat->nat_ifps[1] = ipf_resolvenic(softc,
3482 nat->nat_ifnames[1], 4);
3483 } else if (in->in_ifnames[1] != -1) {
3486 name = in->in_names + in->in_ifnames[1];
3487 if (name[1] != '\0' && name[0] != '-' && name[0] != '*') {
3488 (void) strncpy(nat->nat_ifnames[1],
3489 nat->nat_ifnames[0], LIFNAMSIZ);
3490 nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
3491 nat->nat_ifps[1] = nat->nat_ifps[0];
3494 if ((nat->nat_ifps[0] != NULL) && (nat->nat_ifps[0] != (void *)-1)) {
3495 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
3497 if ((nat->nat_ifps[1] != NULL) && (nat->nat_ifps[1] != (void *)-1)) {
3498 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
3501 return ipf_nat_hashtab_add(softc, softn, nat);
3505 /* ------------------------------------------------------------------------ */
3506 /* Function: ipf_nat_hashtab_add */
3507 /* Parameters: softc(I) - pointer to soft context main structure */
3508 /* softn(I) - pointer to NAT context structure */
3509 /* nat(I) - pointer to NAT structure */
3511 /* Handle the insertion of a NAT entry into the table/list. */
3512 /* ------------------------------------------------------------------------ */
3514 ipf_nat_hashtab_add(softc, softn, nat)
3515 ipf_main_softc_t *softc;
3516 ipf_nat_softc_t *softn;
3523 hv0 = nat->nat_hv[0] % softn->ipf_nat_table_sz;
3524 hv1 = nat->nat_hv[1] % softn->ipf_nat_table_sz;
3526 if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) {
3534 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0] >=
3535 softn->ipf_nat_maxbucket) {
3536 DT1(ns_bucket_max_0, int,
3537 softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0]);
3538 NBUMPSIDE(0, ns_bucket_max);
3542 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen[hv1] >=
3543 softn->ipf_nat_maxbucket) {
3544 DT1(ns_bucket_max_1, int,
3545 softn->ipf_nat_stats.ns_side[1].ns_bucketlen[hv1]);
3546 NBUMPSIDE(1, ns_bucket_max);
3551 * The ordering of operations in the list and hash table insertion
3552 * is very important. The last operation for each task should be
3553 * to update the top of the list, after all the "nexts" have been
3554 * done so that walking the list while it is being done does not
3555 * find strange pointers.
3557 * Global list of NAT instances
3559 nat->nat_next = softn->ipf_nat_instances;
3560 nat->nat_pnext = &softn->ipf_nat_instances;
3561 if (softn->ipf_nat_instances)
3562 softn->ipf_nat_instances->nat_pnext = &nat->nat_next;
3563 softn->ipf_nat_instances = nat;
3566 * Inbound hash table.
3568 natp = &softn->ipf_nat_table[0][hv0];
3569 nat->nat_phnext[0] = natp;
3570 nat->nat_hnext[0] = *natp;
3572 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
3574 NBUMPSIDE(0, ns_inuse);
3577 NBUMPSIDE(0, ns_bucketlen[hv0]);
3580 * Outbound hash table.
3582 natp = &softn->ipf_nat_table[1][hv1];
3583 nat->nat_phnext[1] = natp;
3584 nat->nat_hnext[1] = *natp;
3586 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
3588 NBUMPSIDE(1, ns_inuse);
3591 NBUMPSIDE(1, ns_bucketlen[hv1]);
3593 ipf_nat_setqueue(softc, softn, nat);
3595 if (nat->nat_dir & NAT_OUTBOUND) {
3596 NBUMPSIDE(1, ns_added);
3598 NBUMPSIDE(0, ns_added);
3600 softn->ipf_nat_stats.ns_active++;
3605 /* ------------------------------------------------------------------------ */
3606 /* Function: ipf_nat_icmperrorlookup */
3607 /* Returns: nat_t* - point to matching NAT structure */
3608 /* Parameters: fin(I) - pointer to packet information */
3609 /* dir(I) - direction of packet (in/out) */
3611 /* Check if the ICMP error message is related to an existing TCP, UDP or */
3612 /* ICMP query nat entry. It is assumed that the packet is already of the */
3613 /* the required length. */
3614 /* ------------------------------------------------------------------------ */
3616 ipf_nat_icmperrorlookup(fin, dir)
3620 ipf_main_softc_t *softc = fin->fin_main_soft;
3621 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3622 int flags = 0, type, minlen;
3623 icmphdr_t *icmp, *orgicmp;
3624 nat_stat_side_t *nside;
3625 tcphdr_t *tcp = NULL;
3632 type = icmp->icmp_type;
3633 nside = &softn->ipf_nat_stats.ns_side[fin->fin_out];
3635 * Does it at least have the return (basic) IP header ?
3636 * Only a basic IP header (no options) should be with an ICMP error
3637 * header. Also, if it's not an error type, then return.
3639 if ((fin->fin_hlen != sizeof(ip_t)) || !(fin->fin_flx & FI_ICMPERR)) {
3640 ATOMIC_INCL(nside->ns_icmp_basic);
3647 oip = (ip_t *)((char *)fin->fin_dp + 8);
3648 minlen = IP_HL(oip) << 2;
3649 if ((minlen < sizeof(ip_t)) ||
3650 (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen)) {
3651 ATOMIC_INCL(nside->ns_icmp_size);
3656 * Is the buffer big enough for all of it ? It's the size of the IP
3657 * header claimed in the encapsulated part which is of concern. It
3658 * may be too big to be in this buffer but not so big that it's
3659 * outside the ICMP packet, leading to TCP deref's causing problems.
3660 * This is possible because we don't know how big oip_hl is when we
3661 * do the pullup early in ipf_check() and thus can't gaurantee it is
3664 #ifdef ipf_nat_KERNEL
3669 # if defined(MENTAT)
3670 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
3671 (char *)m->b_wptr) {
3672 ATOMIC_INCL(nside->ns_icmp_mbuf);
3676 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
3677 (char *)fin->fin_ip + M_LEN(m)) {
3678 ATOMIC_INCL(nside->ns_icmp_mbuf);
3685 if (fin->fin_daddr != oip->ip_src.s_addr) {
3686 ATOMIC_INCL(nside->ns_icmp_address);
3691 if (p == IPPROTO_TCP)
3693 else if (p == IPPROTO_UDP)
3695 else if (p == IPPROTO_ICMP) {
3696 orgicmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2));
3698 /* see if this is related to an ICMP query */
3699 if (ipf_nat_icmpquerytype(orgicmp->icmp_type)) {
3700 data[0] = fin->fin_data[0];
3701 data[1] = fin->fin_data[1];
3702 fin->fin_data[0] = 0;
3703 fin->fin_data[1] = orgicmp->icmp_id;
3705 flags = IPN_ICMPERR|IPN_ICMPQUERY;
3707 * NOTE : dir refers to the direction of the original
3708 * ip packet. By definition the icmp error
3709 * message flows in the opposite direction.
3711 if (dir == NAT_INBOUND)
3712 nat = ipf_nat_inlookup(fin, flags, p,
3716 nat = ipf_nat_outlookup(fin, flags, p,
3719 fin->fin_data[0] = data[0];
3720 fin->fin_data[1] = data[1];
3725 if (flags & IPN_TCPUDP) {
3726 minlen += 8; /* + 64bits of data to get ports */
3727 /* TRACE (fin,minlen) */
3728 if (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen) {
3729 ATOMIC_INCL(nside->ns_icmp_short);
3733 data[0] = fin->fin_data[0];
3734 data[1] = fin->fin_data[1];
3735 tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2));
3736 fin->fin_data[0] = ntohs(tcp->th_dport);
3737 fin->fin_data[1] = ntohs(tcp->th_sport);
3739 if (dir == NAT_INBOUND) {
3740 nat = ipf_nat_inlookup(fin, flags, p, oip->ip_dst,
3743 nat = ipf_nat_outlookup(fin, flags, p, oip->ip_dst,
3746 fin->fin_data[0] = data[0];
3747 fin->fin_data[1] = data[1];
3750 if (dir == NAT_INBOUND)
3751 nat = ipf_nat_inlookup(fin, 0, p, oip->ip_dst, oip->ip_src);
3753 nat = ipf_nat_outlookup(fin, 0, p, oip->ip_dst, oip->ip_src);
3759 /* ------------------------------------------------------------------------ */
3760 /* Function: ipf_nat_icmperror */
3761 /* Returns: nat_t* - point to matching NAT structure */
3762 /* Parameters: fin(I) - pointer to packet information */
3763 /* nflags(I) - NAT flags for this packet */
3764 /* dir(I) - direction of packet (in/out) */
3766 /* Fix up an ICMP packet which is an error message for an existing NAT */
3767 /* session. This will correct both packet header data and checksums. */
3769 /* This should *ONLY* be used for incoming ICMP error packets to make sure */
3770 /* a NAT'd ICMP packet gets correctly recognised. */
3771 /* ------------------------------------------------------------------------ */
3773 ipf_nat_icmperror(fin, nflags, dir)
3778 ipf_main_softc_t *softc = fin->fin_main_soft;
3779 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
3780 u_32_t sum1, sum2, sumd, sumd2;
3781 struct in_addr a1, a2, a3, a4;
3782 int flags, dlen, odst;
3790 if ((fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) {
3791 NBUMPSIDED(fin->fin_out, ns_icmp_short);
3796 * ipf_nat_icmperrorlookup() will return NULL for `defective' packets.
3798 if ((fin->fin_v != 4) || !(nat = ipf_nat_icmperrorlookup(fin, dir))) {
3799 NBUMPSIDED(fin->fin_out, ns_icmp_notfound);
3807 *nflags = IPN_ICMPERR;
3809 oip = (ip_t *)&icmp->icmp_ip;
3810 dp = (((char *)oip) + (IP_HL(oip) << 2));
3811 if (oip->ip_p == IPPROTO_TCP) {
3812 tcp = (tcphdr_t *)dp;
3813 csump = (u_short *)&tcp->th_sum;
3815 } else if (oip->ip_p == IPPROTO_UDP) {
3818 udp = (udphdr_t *)dp;
3819 tcp = (tcphdr_t *)dp;
3820 csump = (u_short *)&udp->uh_sum;
3822 } else if (oip->ip_p == IPPROTO_ICMP)
3823 flags = IPN_ICMPQUERY;
3824 dlen = fin->fin_plen - ((char *)dp - (char *)fin->fin_ip);
3827 * Need to adjust ICMP header to include the real IP#'s and
3828 * port #'s. Only apply a checksum change relative to the
3829 * IP address change as it will be modified again in ipf_nat_checkout
3830 * for both address and port. Two checksum changes are
3831 * necessary for the two header address changes. Be careful
3832 * to only modify the checksum once for the port # and twice
3838 * Fix the IP addresses in the offending IP packet. You also need
3839 * to adjust the IP header checksum of that offending IP packet.
3841 * Normally, you would expect that the ICMP checksum of the
3842 * ICMP error message needs to be adjusted as well for the
3843 * IP address change in oip.
3844 * However, this is a NOP, because the ICMP checksum is
3845 * calculated over the complete ICMP packet, which includes the
3846 * changed oip IP addresses and oip->ip_sum. However, these
3847 * two changes cancel each other out (if the delta for
3848 * the IP address is x, then the delta for ip_sum is minus x),
3849 * so no change in the icmp_cksum is necessary.
3853 * MAP rule, SRC=a,DST=b -> SRC=c,DST=b
3854 * - response to outgoing packet (a,b)=>(c,b) (OIP_SRC=c,OIP_DST=b)
3855 * - OIP_SRC(c)=nat_newsrcip, OIP_DST(b)=nat_newdstip
3856 *=> OIP_SRC(c)=nat_oldsrcip, OIP_DST(b)=nat_olddstip
3858 * RDR rule, SRC=a,DST=b -> SRC=a,DST=c
3859 * - response to outgoing packet (c,a)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3860 * - OIP_SRC(b)=nat_olddstip, OIP_DST(a)=nat_oldsrcip
3861 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip
3863 * REWRITE out rule, SRC=a,DST=b -> SRC=c,DST=d
3864 * - response to outgoing packet (a,b)=>(c,d) (OIP_SRC=c,OIP_DST=d)
3865 * - OIP_SRC(c)=nat_newsrcip, OIP_DST(d)=nat_newdstip
3866 *=> OIP_SRC(c)=nat_oldsrcip, OIP_DST(d)=nat_olddstip
3868 * REWRITE in rule, SRC=a,DST=b -> SRC=c,DST=d
3869 * - response to outgoing packet (d,c)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3870 * - OIP_SRC(b)=nat_olddstip, OIP_DST(a)=nat_oldsrcip
3871 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip
3875 * MAP rule, SRC=a,DST=b -> SRC=c,DST=b
3876 * - response to incoming packet (b,c)=>(b,a) (OIP_SRC=b,OIP_DST=a)
3877 * - OIP_SRC(b)=nat_olddstip, OIP_DST(a)=nat_oldsrcip
3878 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip
3880 * RDR rule, SRC=a,DST=b -> SRC=a,DST=c
3881 * - response to incoming packet (a,b)=>(a,c) (OIP_SRC=a,OIP_DST=c)
3882 * - OIP_SRC(a)=nat_newsrcip, OIP_DST(c)=nat_newdstip
3883 *=> OIP_SRC(a)=nat_oldsrcip, OIP_DST(c)=nat_olddstip
3885 * REWRITE out rule, SRC=a,DST=b -> SRC=c,DST=d
3886 * - response to incoming packet (d,c)=>(b,a) (OIP_SRC=c,OIP_DST=d)
3887 * - OIP_SRC(c)=nat_olddstip, OIP_DST(d)=nat_oldsrcip
3888 *=> OIP_SRC(b)=nat_newdstip, OIP_DST(a)=nat_newsrcip
3890 * REWRITE in rule, SRC=a,DST=b -> SRC=c,DST=d
3891 * - response to incoming packet (a,b)=>(c,d) (OIP_SRC=b,OIP_DST=a)
3892 * - OIP_SRC(b)=nat_newsrcip, OIP_DST(a)=nat_newdstip
3893 *=> OIP_SRC(a)=nat_oldsrcip, OIP_DST(c)=nat_olddstip
3896 if (((fin->fin_out == 0) && ((nat->nat_redir & NAT_MAP) != 0)) ||
3897 ((fin->fin_out == 1) && ((nat->nat_redir & NAT_REDIRECT) != 0))) {
3898 a1.s_addr = ntohl(nat->nat_osrcaddr);
3899 a4.s_addr = ntohl(oip->ip_src.s_addr);
3900 a3.s_addr = ntohl(nat->nat_odstaddr);
3901 a2.s_addr = ntohl(oip->ip_dst.s_addr);
3902 oip->ip_src.s_addr = htonl(a1.s_addr);
3903 oip->ip_dst.s_addr = htonl(a3.s_addr);
3906 a1.s_addr = ntohl(nat->nat_ndstaddr);
3907 a2.s_addr = ntohl(oip->ip_dst.s_addr);
3908 a3.s_addr = ntohl(nat->nat_nsrcaddr);
3909 a4.s_addr = ntohl(oip->ip_src.s_addr);
3910 oip->ip_dst.s_addr = htonl(a3.s_addr);
3911 oip->ip_src.s_addr = htonl(a1.s_addr);
3917 CALC_SUMD(a2.s_addr, a3.s_addr, sum1);
3918 CALC_SUMD(a4.s_addr, a1.s_addr, sum2);
3921 ipf_fix_datacksum(&oip->ip_sum, sumd);
3928 * Fix UDP pseudo header checksum to compensate for the
3929 * IP address change.
3931 if (((flags & IPN_TCPUDP) != 0) && (dlen >= 4)) {
3932 u_32_t sum3, sum4, sumt;
3936 * For offending TCP/UDP IP packets, translate the ports as
3937 * well, based on the NAT specification. Of course such
3938 * a change may be reflected in the ICMP checksum as well.
3940 * Since the port fields are part of the TCP/UDP checksum
3941 * of the offending IP packet, you need to adjust that checksum
3942 * as well... except that the change in the port numbers should
3943 * be offset by the checksum change. However, the TCP/UDP
3944 * checksum will also need to change if there has been an
3945 * IP address change.
3948 sum1 = ntohs(nat->nat_osport);
3949 sum4 = ntohs(tcp->th_sport);
3950 sum3 = ntohs(nat->nat_odport);
3951 sum2 = ntohs(tcp->th_dport);
3953 tcp->th_sport = htons(sum1);
3954 tcp->th_dport = htons(sum3);
3956 sum1 = ntohs(nat->nat_ndport);
3957 sum2 = ntohs(tcp->th_dport);
3958 sum3 = ntohs(nat->nat_nsport);
3959 sum4 = ntohs(tcp->th_sport);
3961 tcp->th_dport = htons(sum3);
3962 tcp->th_sport = htons(sum1);
3964 CALC_SUMD(sum4, sum1, sumt);
3966 CALC_SUMD(sum2, sum3, sumt);
3969 if (sumd != 0 || sumd2 != 0) {
3971 * At this point, sumd is the delta to apply to the
3972 * TCP/UDP header, given the changes in both the IP
3973 * address and the ports and sumd2 is the delta to
3974 * apply to the ICMP header, given the IP address
3975 * change delta that may need to be applied to the
3976 * TCP/UDP checksum instead.
3978 * If we will both the IP and TCP/UDP checksums
3979 * then the ICMP checksum changes by the address
3980 * delta applied to the TCP/UDP checksum. If we
3981 * do not change the TCP/UDP checksum them we
3982 * apply the delta in ports to the ICMP checksum.
3984 if (oip->ip_p == IPPROTO_UDP) {
3985 if ((dlen >= 8) && (*csump != 0)) {
3986 ipf_fix_datacksum(csump, sumd);
3988 CALC_SUMD(sum1, sum4, sumd2);
3989 CALC_SUMD(sum3, sum2, sumt);
3992 } else if (oip->ip_p == IPPROTO_TCP) {
3994 ipf_fix_datacksum(csump, sumd);
3996 CALC_SUMD(sum1, sum4, sumd2);
3997 CALC_SUMD(sum3, sum2, sumt);
4002 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
4003 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
4004 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
4005 ipf_fix_incksum(0, &icmp->icmp_cksum, sumd2, 0);
4008 } else if (((flags & IPN_ICMPQUERY) != 0) && (dlen >= 8)) {
4012 * XXX - what if this is bogus hl and we go off the end ?
4013 * In this case, ipf_nat_icmperrorlookup() will have
4016 orgicmp = (icmphdr_t *)dp;
4019 if (orgicmp->icmp_id != nat->nat_osport) {
4022 * Fix ICMP checksum (of the offening ICMP
4023 * query packet) to compensate the change
4024 * in the ICMP id of the offending ICMP
4027 * Since you modify orgicmp->icmp_id with
4028 * a delta (say x) and you compensate that
4029 * in origicmp->icmp_cksum with a delta
4030 * minus x, you don't have to adjust the
4031 * overall icmp->icmp_cksum
4033 sum1 = ntohs(orgicmp->icmp_id);
4034 sum2 = ntohs(nat->nat_oicmpid);
4035 CALC_SUMD(sum1, sum2, sumd);
4036 orgicmp->icmp_id = nat->nat_oicmpid;
4037 ipf_fix_datacksum(&orgicmp->icmp_cksum, sumd);
4039 } /* nat_dir == NAT_INBOUND is impossible for icmp queries */
4046 * MAP-IN MAP-OUT RDR-IN RDR-OUT
4047 * osrc X == src == src X
4048 * odst X == dst == dst X
4049 * nsrc == dst X X == dst
4050 * ndst == src X X == src
4051 * MAP = NAT_OUTBOUND, RDR = NAT_INBOUND
4054 * NB: these lookups don't lock access to the list, it assumed that it has
4055 * already been done!
4057 /* ------------------------------------------------------------------------ */
4058 /* Function: ipf_nat_inlookup */
4059 /* Returns: nat_t* - NULL == no match, */
4060 /* else pointer to matching NAT entry */
4061 /* Parameters: fin(I) - pointer to packet information */
4062 /* flags(I) - NAT flags for this packet */
4063 /* p(I) - protocol for this packet */
4064 /* src(I) - source IP address */
4065 /* mapdst(I) - destination IP address */
4067 /* Lookup a nat entry based on the mapped destination ip address/port and */
4068 /* real source address/port. We use this lookup when receiving a packet, */
4069 /* we're looking for a table entry, based on the destination address. */
4071 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */
4073 /* NOTE: IT IS ASSUMED THAT IS ONLY HELD WITH A READ LOCK WHEN */
4074 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */
4076 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */
4077 /* the packet is of said protocol */
4078 /* ------------------------------------------------------------------------ */
4080 ipf_nat_inlookup(fin, flags, p, src, mapdst)
4083 struct in_addr src , mapdst;
4085 ipf_main_softc_t *softc = fin->fin_main_soft;
4086 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4087 u_short sport, dport;
4099 dst = mapdst.s_addr;
4100 sflags = flags & NAT_TCPUDPICMP;
4106 sport = htons(fin->fin_data[0]);
4107 dport = htons(fin->fin_data[1]);
4110 if (flags & IPN_ICMPERR) {
4111 sport = fin->fin_data[1];
4114 dport = fin->fin_data[1];
4125 if ((flags & SI_WILDP) != 0)
4126 goto find_in_wild_ports;
4128 rhv = NAT_HASH_FN(dst, dport, 0xffffffff);
4129 rhv = NAT_HASH_FN(src.s_addr, rhv + sport, 0xffffffff);
4130 hv = rhv % softn->ipf_nat_table_sz;
4131 nat = softn->ipf_nat_table[1][hv];
4132 /* TRACE dst, dport, src, sport, hv, nat */
4134 for (; nat; nat = nat->nat_hnext[1]) {
4135 if (nat->nat_ifps[0] != NULL) {
4136 if ((ifp != NULL) && (ifp != nat->nat_ifps[0]))
4140 if (nat->nat_pr[0] != p)
4143 switch (nat->nat_dir)
4147 if (nat->nat_v[0] != 4)
4149 if (nat->nat_osrcaddr != src.s_addr ||
4150 nat->nat_odstaddr != dst)
4152 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4153 if (nat->nat_osport != sport)
4155 if (nat->nat_odport != dport)
4158 } else if (p == IPPROTO_ICMP) {
4159 if (nat->nat_osport != dport) {
4164 case NAT_DIVERTOUT :
4165 if (nat->nat_dlocal)
4168 if (nat->nat_v[1] != 4)
4170 if (nat->nat_dlocal)
4172 if (nat->nat_dlocal)
4174 if (nat->nat_ndstaddr != src.s_addr ||
4175 nat->nat_nsrcaddr != dst)
4177 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4178 if (nat->nat_ndport != sport)
4180 if (nat->nat_nsport != dport)
4183 } else if (p == IPPROTO_ICMP) {
4184 if (nat->nat_osport != dport) {
4192 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4194 if ((ipn != NULL) && (nat->nat_aps != NULL))
4195 if (ipf_proxy_match(fin, nat) != 0)
4198 if ((nat->nat_ifps[0] == NULL) && (ifp != NULL)) {
4199 nat->nat_ifps[0] = ifp;
4200 nat->nat_mtu[0] = GETIFMTU_4(ifp);
4206 * So if we didn't find it but there are wildcard members in the hash
4207 * table, go back and look for them. We do this search and update here
4208 * because it is modifying the NAT table and we want to do this only
4209 * for the first packet that matches. The exception, of course, is
4210 * for "dummy" (FI_IGNORE) lookups.
4213 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) {
4214 NBUMPSIDEX(0, ns_lookup_miss, ns_lookup_miss_0);
4217 if (softn->ipf_nat_stats.ns_wilds == 0 || (fin->fin_flx & FI_NOWILD)) {
4218 NBUMPSIDEX(0, ns_lookup_nowild, ns_lookup_nowild_0);
4222 RWLOCK_EXIT(&softc->ipf_nat);
4224 hv = NAT_HASH_FN(dst, 0, 0xffffffff);
4225 hv = NAT_HASH_FN(src.s_addr, hv, softn->ipf_nat_table_sz);
4226 WRITE_ENTER(&softc->ipf_nat);
4228 nat = softn->ipf_nat_table[1][hv];
4229 /* TRACE dst, src, hv, nat */
4230 for (; nat; nat = nat->nat_hnext[1]) {
4231 if (nat->nat_ifps[0] != NULL) {
4232 if ((ifp != NULL) && (ifp != nat->nat_ifps[0]))
4236 if (nat->nat_pr[0] != fin->fin_p)
4239 switch (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND))
4242 if (nat->nat_v[0] != 4)
4244 if (nat->nat_osrcaddr != src.s_addr ||
4245 nat->nat_odstaddr != dst)
4249 if (nat->nat_v[1] != 4)
4251 if (nat->nat_ndstaddr != src.s_addr ||
4252 nat->nat_nsrcaddr != dst)
4257 nflags = nat->nat_flags;
4258 if (!(nflags & (NAT_TCPUDP|SI_WILDP)))
4261 if (ipf_nat_wildok(nat, (int)sport, (int)dport, nflags,
4262 NAT_INBOUND) == 1) {
4263 if ((fin->fin_flx & FI_IGNORE) != 0)
4265 if ((nflags & SI_CLONE) != 0) {
4266 nat = ipf_nat_clone(fin, nat);
4270 MUTEX_ENTER(&softn->ipf_nat_new);
4271 softn->ipf_nat_stats.ns_wilds--;
4272 MUTEX_EXIT(&softn->ipf_nat_new);
4275 if (nat->nat_dir == NAT_INBOUND) {
4276 if (nat->nat_osport == 0) {
4277 nat->nat_osport = sport;
4278 nat->nat_nsport = sport;
4280 if (nat->nat_odport == 0) {
4281 nat->nat_odport = dport;
4282 nat->nat_ndport = dport;
4284 } else if (nat->nat_dir == NAT_OUTBOUND) {
4285 if (nat->nat_osport == 0) {
4286 nat->nat_osport = dport;
4287 nat->nat_nsport = dport;
4289 if (nat->nat_odport == 0) {
4290 nat->nat_odport = sport;
4291 nat->nat_ndport = sport;
4294 if ((nat->nat_ifps[0] == NULL) && (ifp != NULL)) {
4295 nat->nat_ifps[0] = ifp;
4296 nat->nat_mtu[0] = GETIFMTU_4(ifp);
4298 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT);
4299 ipf_nat_tabmove(softn, nat);
4304 MUTEX_DOWNGRADE(&softc->ipf_nat);
4307 NBUMPSIDE(0, ns_lookup_miss);
4313 /* ------------------------------------------------------------------------ */
4314 /* Function: ipf_nat_tabmove */
4316 /* Parameters: softn(I) - pointer to NAT context structure */
4317 /* nat(I) - pointer to NAT structure */
4318 /* Write Lock: ipf_nat */
4320 /* This function is only called for TCP/UDP NAT table entries where the */
4321 /* original was placed in the table without hashing on the ports and we now */
4322 /* want to include hashing on port numbers. */
4323 /* ------------------------------------------------------------------------ */
4325 ipf_nat_tabmove(softn, nat)
4326 ipf_nat_softc_t *softn;
4329 u_int hv0, hv1, rhv0, rhv1;
4333 if (nat->nat_flags & SI_CLONE)
4336 nsp = &softn->ipf_nat_stats;
4338 * Remove the NAT entry from the old location
4340 if (nat->nat_hnext[0])
4341 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
4342 *nat->nat_phnext[0] = nat->nat_hnext[0];
4343 nsp->ns_side[0].ns_bucketlen[nat->nat_hv[0] %
4344 softn->ipf_nat_table_sz]--;
4346 if (nat->nat_hnext[1])
4347 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
4348 *nat->nat_phnext[1] = nat->nat_hnext[1];
4349 nsp->ns_side[1].ns_bucketlen[nat->nat_hv[1] %
4350 softn->ipf_nat_table_sz]--;
4353 * Add into the NAT table in the new position
4355 rhv0 = NAT_HASH_FN(nat->nat_osrcaddr, nat->nat_osport, 0xffffffff);
4356 rhv0 = NAT_HASH_FN(nat->nat_odstaddr, rhv0 + nat->nat_odport,
4358 rhv1 = NAT_HASH_FN(nat->nat_nsrcaddr, nat->nat_nsport, 0xffffffff);
4359 rhv1 = NAT_HASH_FN(nat->nat_ndstaddr, rhv1 + nat->nat_ndport,
4362 hv0 = rhv0 % softn->ipf_nat_table_sz;
4363 hv1 = rhv1 % softn->ipf_nat_table_sz;
4365 if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) {
4373 /* TRACE nat_osrcaddr, nat_osport, nat_odstaddr, nat_odport, hv0 */
4374 /* TRACE nat_nsrcaddr, nat_nsport, nat_ndstaddr, nat_ndport, hv1 */
4376 nat->nat_hv[0] = rhv0;
4377 natp = &softn->ipf_nat_table[0][hv0];
4379 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
4380 nat->nat_phnext[0] = natp;
4381 nat->nat_hnext[0] = *natp;
4383 nsp->ns_side[0].ns_bucketlen[hv0]++;
4385 nat->nat_hv[1] = rhv1;
4386 natp = &softn->ipf_nat_table[1][hv1];
4388 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
4389 nat->nat_phnext[1] = natp;
4390 nat->nat_hnext[1] = *natp;
4392 nsp->ns_side[1].ns_bucketlen[hv1]++;
4396 /* ------------------------------------------------------------------------ */
4397 /* Function: ipf_nat_outlookup */
4398 /* Returns: nat_t* - NULL == no match, */
4399 /* else pointer to matching NAT entry */
4400 /* Parameters: fin(I) - pointer to packet information */
4401 /* flags(I) - NAT flags for this packet */
4402 /* p(I) - protocol for this packet */
4403 /* src(I) - source IP address */
4404 /* dst(I) - destination IP address */
4405 /* rw(I) - 1 == write lock on held, 0 == read lock. */
4407 /* Lookup a nat entry based on the source 'real' ip address/port and */
4408 /* destination address/port. We use this lookup when sending a packet out, */
4409 /* we're looking for a table entry, based on the source address. */
4411 /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */
4413 /* NOTE: IT IS ASSUMED THAT IS ONLY HELD WITH A READ LOCK WHEN */
4414 /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */
4416 /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */
4417 /* the packet is of said protocol */
4418 /* ------------------------------------------------------------------------ */
4420 ipf_nat_outlookup(fin, flags, p, src, dst)
4423 struct in_addr src , dst;
4425 ipf_main_softc_t *softc = fin->fin_main_soft;
4426 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4427 u_short sport, dport;
4435 sflags = flags & IPN_TCPUDPICMP;
4443 sport = htons(fin->fin_data[0]);
4444 dport = htons(fin->fin_data[1]);
4447 if (flags & IPN_ICMPERR)
4448 sport = fin->fin_data[1];
4450 dport = fin->fin_data[1];
4456 if ((flags & SI_WILDP) != 0)
4457 goto find_out_wild_ports;
4459 hv = NAT_HASH_FN(src.s_addr, sport, 0xffffffff);
4460 hv = NAT_HASH_FN(dst.s_addr, hv + dport, softn->ipf_nat_table_sz);
4461 nat = softn->ipf_nat_table[0][hv];
4463 /* TRACE src, sport, dst, dport, hv, nat */
4465 for (; nat; nat = nat->nat_hnext[0]) {
4466 if (nat->nat_ifps[1] != NULL) {
4467 if ((ifp != NULL) && (ifp != nat->nat_ifps[1]))
4471 if (nat->nat_pr[1] != p)
4474 switch (nat->nat_dir)
4478 if (nat->nat_v[1] != 4)
4480 if (nat->nat_ndstaddr != src.s_addr ||
4481 nat->nat_nsrcaddr != dst.s_addr)
4484 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4485 if (nat->nat_ndport != sport)
4487 if (nat->nat_nsport != dport)
4490 } else if (p == IPPROTO_ICMP) {
4491 if (nat->nat_osport != dport) {
4497 case NAT_DIVERTOUT :
4498 if (nat->nat_v[0] != 4)
4500 if (nat->nat_osrcaddr != src.s_addr ||
4501 nat->nat_odstaddr != dst.s_addr)
4504 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
4505 if (nat->nat_odport != dport)
4507 if (nat->nat_osport != sport)
4510 } else if (p == IPPROTO_ICMP) {
4511 if (nat->nat_osport != dport) {
4519 if ((ipn != NULL) && (nat->nat_aps != NULL))
4520 if (ipf_proxy_match(fin, nat) != 0)
4523 if ((nat->nat_ifps[1] == NULL) && (ifp != NULL)) {
4524 nat->nat_ifps[1] = ifp;
4525 nat->nat_mtu[1] = GETIFMTU_4(ifp);
4531 * So if we didn't find it but there are wildcard members in the hash
4532 * table, go back and look for them. We do this search and update here
4533 * because it is modifying the NAT table and we want to do this only
4534 * for the first packet that matches. The exception, of course, is
4535 * for "dummy" (FI_IGNORE) lookups.
4537 find_out_wild_ports:
4538 if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH)) {
4539 NBUMPSIDEX(1, ns_lookup_miss, ns_lookup_miss_1);
4542 if (softn->ipf_nat_stats.ns_wilds == 0 || (fin->fin_flx & FI_NOWILD)) {
4543 NBUMPSIDEX(1, ns_lookup_nowild, ns_lookup_nowild_1);
4547 RWLOCK_EXIT(&softc->ipf_nat);
4549 hv = NAT_HASH_FN(src.s_addr, 0, 0xffffffff);
4550 hv = NAT_HASH_FN(dst.s_addr, hv, softn->ipf_nat_table_sz);
4552 WRITE_ENTER(&softc->ipf_nat);
4554 nat = softn->ipf_nat_table[0][hv];
4555 for (; nat; nat = nat->nat_hnext[0]) {
4556 if (nat->nat_ifps[1] != NULL) {
4557 if ((ifp != NULL) && (ifp != nat->nat_ifps[1]))
4561 if (nat->nat_pr[1] != fin->fin_p)
4564 switch (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND))
4567 if (nat->nat_v[1] != 4)
4569 if (nat->nat_ndstaddr != src.s_addr ||
4570 nat->nat_nsrcaddr != dst.s_addr)
4574 if (nat->nat_v[0] != 4)
4576 if (nat->nat_osrcaddr != src.s_addr ||
4577 nat->nat_odstaddr != dst.s_addr)
4582 if (!(nat->nat_flags & (NAT_TCPUDP|SI_WILDP)))
4585 if (ipf_nat_wildok(nat, (int)sport, (int)dport, nat->nat_flags,
4586 NAT_OUTBOUND) == 1) {
4587 if ((fin->fin_flx & FI_IGNORE) != 0)
4589 if ((nat->nat_flags & SI_CLONE) != 0) {
4590 nat = ipf_nat_clone(fin, nat);
4594 MUTEX_ENTER(&softn->ipf_nat_new);
4595 softn->ipf_nat_stats.ns_wilds--;
4596 MUTEX_EXIT(&softn->ipf_nat_new);
4599 if (nat->nat_dir == NAT_OUTBOUND) {
4600 if (nat->nat_osport == 0) {
4601 nat->nat_osport = sport;
4602 nat->nat_nsport = sport;
4604 if (nat->nat_odport == 0) {
4605 nat->nat_odport = dport;
4606 nat->nat_ndport = dport;
4608 } else if (nat->nat_dir == NAT_INBOUND) {
4609 if (nat->nat_osport == 0) {
4610 nat->nat_osport = dport;
4611 nat->nat_nsport = dport;
4613 if (nat->nat_odport == 0) {
4614 nat->nat_odport = sport;
4615 nat->nat_ndport = sport;
4618 if ((nat->nat_ifps[1] == NULL) && (ifp != NULL)) {
4619 nat->nat_ifps[1] = ifp;
4620 nat->nat_mtu[1] = GETIFMTU_4(ifp);
4622 nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT);
4623 ipf_nat_tabmove(softn, nat);
4628 MUTEX_DOWNGRADE(&softc->ipf_nat);
4631 NBUMPSIDE(1, ns_lookup_miss);
4637 /* ------------------------------------------------------------------------ */
4638 /* Function: ipf_nat_lookupredir */
4639 /* Returns: nat_t* - NULL == no match, */
4640 /* else pointer to matching NAT entry */
4641 /* Parameters: np(I) - pointer to description of packet to find NAT table */
4644 /* Lookup the NAT tables to search for a matching redirect */
4645 /* The contents of natlookup_t should imitate those found in a packet that */
4646 /* would be translated - ie a packet coming in for RDR or going out for MAP.*/
4647 /* We can do the lookup in one of two ways, imitating an inbound or */
4648 /* outbound packet. By default we assume outbound, unless IPN_IN is set. */
4649 /* For IN, the fields are set as follows: */
4650 /* nl_real* = source information */
4651 /* nl_out* = destination information (translated) */
4652 /* For an out packet, the fields are set like this: */
4653 /* nl_in* = source information (untranslated) */
4654 /* nl_out* = destination information (translated) */
4655 /* ------------------------------------------------------------------------ */
4657 ipf_nat_lookupredir(np)
4663 bzero((char *)&fi, sizeof(fi));
4664 if (np->nl_flags & IPN_IN) {
4665 fi.fin_data[0] = ntohs(np->nl_realport);
4666 fi.fin_data[1] = ntohs(np->nl_outport);
4668 fi.fin_data[0] = ntohs(np->nl_inport);
4669 fi.fin_data[1] = ntohs(np->nl_outport);
4671 if (np->nl_flags & IPN_TCP)
4672 fi.fin_p = IPPROTO_TCP;
4673 else if (np->nl_flags & IPN_UDP)
4674 fi.fin_p = IPPROTO_UDP;
4675 else if (np->nl_flags & (IPN_ICMPERR|IPN_ICMPQUERY))
4676 fi.fin_p = IPPROTO_ICMP;
4679 * We can do two sorts of lookups:
4680 * - IPN_IN: we have the `real' and `out' address, look for `in'.
4681 * - default: we have the `in' and `out' address, look for `real'.
4683 if (np->nl_flags & IPN_IN) {
4684 if ((nat = ipf_nat_inlookup(&fi, np->nl_flags, fi.fin_p,
4685 np->nl_realip, np->nl_outip))) {
4686 np->nl_inip = nat->nat_odstip;
4687 np->nl_inport = nat->nat_odport;
4691 * If nl_inip is non null, this is a lookup based on the real
4692 * ip address. Else, we use the fake.
4694 if ((nat = ipf_nat_outlookup(&fi, np->nl_flags, fi.fin_p,
4695 np->nl_inip, np->nl_outip))) {
4697 if ((np->nl_flags & IPN_FINDFORWARD) != 0) {
4699 bzero((char *)&fin, sizeof(fin));
4700 fin.fin_p = nat->nat_pr[0];
4701 fin.fin_data[0] = ntohs(nat->nat_ndport);
4702 fin.fin_data[1] = ntohs(nat->nat_nsport);
4703 if (ipf_nat_inlookup(&fin, np->nl_flags,
4704 fin.fin_p, nat->nat_ndstip,
4705 nat->nat_nsrcip) != NULL) {
4706 np->nl_flags &= ~IPN_FINDFORWARD;
4710 np->nl_realip = nat->nat_ndstip;
4711 np->nl_realport = nat->nat_ndport;
4719 /* ------------------------------------------------------------------------ */
4720 /* Function: ipf_nat_match */
4721 /* Returns: int - 0 == no match, 1 == match */
4722 /* Parameters: fin(I) - pointer to packet information */
4723 /* np(I) - pointer to NAT rule */
4725 /* Pull the matching of a packet against a NAT rule out of that complex */
4726 /* loop inside ipf_nat_checkin() and lay it out properly in its own function. */
4727 /* ------------------------------------------------------------------------ */
4729 ipf_nat_match(fin, np)
4733 ipf_main_softc_t *softc = fin->fin_main_soft;
4738 switch (np->in_osrcatype)
4741 match = ((fin->fin_saddr & np->in_osrcmsk) != np->in_osrcaddr);
4744 match = (*np->in_osrcfunc)(softc, np->in_osrcptr,
4745 4, &fin->fin_saddr, fin->fin_plen);
4748 match ^= ((np->in_flags & IPN_NOTSRC) != 0);
4753 switch (np->in_odstatype)
4756 match = ((fin->fin_daddr & np->in_odstmsk) != np->in_odstaddr);
4759 match = (*np->in_odstfunc)(softc, np->in_odstptr,
4760 4, &fin->fin_daddr, fin->fin_plen);
4764 match ^= ((np->in_flags & IPN_NOTDST) != 0);
4769 if (!(fin->fin_flx & FI_TCPUDP) ||
4770 (fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) {
4771 if (ft->ftu_scmp || ft->ftu_dcmp)
4776 return ipf_tcpudpchk(&fin->fin_fi, ft);
4780 /* ------------------------------------------------------------------------ */
4781 /* Function: ipf_nat_update */
4783 /* Parameters: fin(I) - pointer to packet information */
4784 /* nat(I) - pointer to NAT structure */
4786 /* Updates the lifetime of a NAT table entry for non-TCP packets. Must be */
4787 /* called with fin_rev updated - i.e. after calling ipf_nat_proto(). */
4789 /* This *MUST* be called after ipf_nat_proto() as it expects fin_rev to */
4790 /* already be set. */
4791 /* ------------------------------------------------------------------------ */
4793 ipf_nat_update(fin, nat)
4797 ipf_main_softc_t *softc = fin->fin_main_soft;
4798 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
4799 ipftq_t *ifq, *ifq2;
4801 ipnat_t *np = nat->nat_ptr;
4803 tqe = &nat->nat_tqe;
4807 * We allow over-riding of NAT timeouts from NAT rules, even for
4808 * TCP, however, if it is TCP and there is no rule timeout set,
4809 * then do not update the timeout here.
4812 np->in_bytes[fin->fin_rev] += fin->fin_plen;
4813 ifq2 = np->in_tqehead[fin->fin_rev];
4818 if (nat->nat_pr[0] == IPPROTO_TCP && ifq2 == NULL) {
4819 (void) ipf_tcp_age(&nat->nat_tqe, fin, softn->ipf_nat_tcptq,
4823 if (nat->nat_pr[0] == IPPROTO_UDP)
4824 ifq2 = fin->fin_rev ? &softn->ipf_nat_udpacktq :
4825 &softn->ipf_nat_udptq;
4826 else if (nat->nat_pr[0] == IPPROTO_ICMP ||
4827 nat->nat_pr[0] == IPPROTO_ICMPV6)
4828 ifq2 = fin->fin_rev ? &softn->ipf_nat_icmpacktq:
4829 &softn->ipf_nat_icmptq;
4831 ifq2 = &softn->ipf_nat_iptq;
4834 ipf_movequeue(softc->ipf_ticks, tqe, ifq, ifq2);
4839 /* ------------------------------------------------------------------------ */
4840 /* Function: ipf_nat_checkout */
4841 /* Returns: int - -1 == packet failed NAT checks so block it, */
4842 /* 0 == no packet translation occurred, */
4843 /* 1 == packet was successfully translated. */
4844 /* Parameters: fin(I) - pointer to packet information */
4845 /* passp(I) - pointer to filtering result flags */
4847 /* Check to see if an outcoming packet should be changed. ICMP packets are */
4848 /* first checked to see if they match an existing entry (if an error), */
4849 /* otherwise a search of the current NAT table is made. If neither results */
4850 /* in a match then a search for a matching NAT rule is made. Create a new */
4851 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */
4852 /* packet header(s) as required. */
4853 /* ------------------------------------------------------------------------ */
4855 ipf_nat_checkout(fin, passp)
4859 ipnat_t *np = NULL, *npnext;
4860 struct ifnet *ifp, *sifp;
4861 ipf_main_softc_t *softc;
4862 ipf_nat_softc_t *softn;
4863 icmphdr_t *icmp = NULL;
4864 tcphdr_t *tcp = NULL;
4865 int rval, natfailed;
4872 if (fin->fin_v == 6) {
4874 return ipf_nat6_checkout(fin, passp);
4880 softc = fin->fin_main_soft;
4881 softn = softc->ipf_nat_soft;
4883 if (softn->ipf_nat_lock != 0)
4885 if (softn->ipf_nat_stats.ns_rules == 0 &&
4886 softn->ipf_nat_instances == NULL)
4891 sifp = fin->fin_ifp;
4893 ifp = fr->fr_tifs[fin->fin_rev].fd_ptr;
4894 if ((ifp != NULL) && (ifp != (void *)-1))
4899 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
4912 * This is an incoming packet, so the destination is
4913 * the icmp_id and the source port equals 0
4915 if ((fin->fin_flx & FI_ICMPQUERY) != 0)
4916 nflags = IPN_ICMPQUERY;
4922 if ((nflags & IPN_TCPUDP))
4926 ipa = fin->fin_saddr;
4928 READ_ENTER(&softc->ipf_nat);
4930 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
4931 (nat = ipf_nat_icmperror(fin, &nflags, NAT_OUTBOUND)))
4933 else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin)))
4935 else if ((nat = ipf_nat_outlookup(fin, nflags|NAT_SEARCH,
4936 (u_int)fin->fin_p, fin->fin_src,
4938 nflags = nat->nat_flags;
4939 } else if (fin->fin_off == 0) {
4940 u_32_t hv, msk, nmsk = 0;
4943 * If there is no current entry in the nat table for this IP#,
4944 * create one for it (if there is a matching rule).
4947 msk = softn->ipf_nat_map_active_masks[nmsk];
4949 hv = NAT_HASH_FN(iph, 0, softn->ipf_nat_maprules_sz);
4951 for (np = softn->ipf_nat_map_rules[hv]; np; np = npnext) {
4952 npnext = np->in_mnext;
4953 if ((np->in_ifps[1] && (np->in_ifps[1] != ifp)))
4955 if (np->in_v[0] != 4)
4957 if (np->in_pr[1] && (np->in_pr[1] != fin->fin_p))
4959 if ((np->in_flags & IPN_RF) &&
4960 !(np->in_flags & nflags))
4962 if (np->in_flags & IPN_FILTER) {
4963 switch (ipf_nat_match(fin, np))
4974 } else if ((ipa & np->in_osrcmsk) != np->in_osrcaddr)
4978 !ipf_matchtag(&np->in_tag, &fr->fr_nattag))
4981 if (np->in_plabel != -1) {
4982 if (((np->in_flags & IPN_FILTER) == 0) &&
4983 (np->in_odport != fin->fin_data[1]))
4985 if (ipf_proxy_ok(fin, tcp, np) == 0)
4989 if (np->in_flags & IPN_NO) {
4993 MUTEX_ENTER(&softn->ipf_nat_new);
4995 * If we've matched a round-robin rule but it has
4996 * moved in the list since we got it, start over as
4997 * this is now no longer correct.
4999 if (npnext != np->in_mnext) {
5000 if ((np->in_flags & IPN_ROUNDR) != 0) {
5001 MUTEX_EXIT(&softn->ipf_nat_new);
5002 goto retry_roundrobin;
5004 npnext = np->in_mnext;
5007 nat = ipf_nat_add(fin, np, NULL, nflags, NAT_OUTBOUND);
5008 MUTEX_EXIT(&softn->ipf_nat_new);
5015 if ((np == NULL) && (nmsk < softn->ipf_nat_map_max)) {
5022 rval = ipf_nat_out(fin, nat, natadd, nflags);
5024 MUTEX_ENTER(&nat->nat_lock);
5025 ipf_nat_update(fin, nat);
5026 nat->nat_bytes[1] += fin->fin_plen;
5028 fin->fin_pktnum = nat->nat_pkts[1];
5029 MUTEX_EXIT(&nat->nat_lock);
5034 RWLOCK_EXIT(&softc->ipf_nat);
5039 if (passp != NULL) {
5040 DT1(frb_natv4out, fr_info_t *, fin);
5041 NBUMPSIDED(1, ns_drop);
5043 fin->fin_reason = FRB_NATV4;
5045 fin->fin_flx |= FI_BADNAT;
5046 NBUMPSIDED(1, ns_badnat);
5049 NBUMPSIDE(1, ns_ignored);
5052 NBUMPSIDE(1, ns_translated);
5055 fin->fin_ifp = sifp;
5059 /* ------------------------------------------------------------------------ */
5060 /* Function: ipf_nat_out */
5061 /* Returns: int - -1 == packet failed NAT checks so block it, */
5062 /* 1 == packet was successfully translated. */
5063 /* Parameters: fin(I) - pointer to packet information */
5064 /* nat(I) - pointer to NAT structure */
5065 /* natadd(I) - flag indicating if it is safe to add frag cache */
5066 /* nflags(I) - NAT flags set for this packet */
5068 /* Translate a packet coming "out" on an interface. */
5069 /* ------------------------------------------------------------------------ */
5071 ipf_nat_out(fin, nat, natadd, nflags)
5077 ipf_main_softc_t *softc = fin->fin_main_soft;
5078 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5089 if ((natadd != 0) && (fin->fin_flx & FI_FRAG) && (np != NULL))
5090 (void) ipf_frag_natnew(softc, fin, 0, nat);
5093 * Fix up checksums, not by recalculating them, but
5094 * simply computing adjustments.
5095 * This is only done for STREAMS based IP implementations where the
5096 * checksum has already been calculated by IP. In all other cases,
5097 * IPFilter is called before the checksum needs calculating so there
5098 * is no call to modify whatever is in the header now.
5100 if (nflags == IPN_ICMPERR) {
5101 u_32_t s1, s2, sumd, msumd;
5103 s1 = LONG_SUM(ntohl(fin->fin_saddr));
5104 if (nat->nat_dir == NAT_OUTBOUND) {
5105 s2 = LONG_SUM(ntohl(nat->nat_nsrcaddr));
5107 s2 = LONG_SUM(ntohl(nat->nat_odstaddr));
5109 CALC_SUMD(s1, s2, sumd);
5112 s1 = LONG_SUM(ntohl(fin->fin_daddr));
5113 if (nat->nat_dir == NAT_OUTBOUND) {
5114 s2 = LONG_SUM(ntohl(nat->nat_ndstaddr));
5116 s2 = LONG_SUM(ntohl(nat->nat_osrcaddr));
5118 CALC_SUMD(s1, s2, sumd);
5121 ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, msumd, 0);
5123 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
5124 defined(linux) || defined(BRIDGE_IPF)
5127 * Strictly speaking, this isn't necessary on BSD
5128 * kernels because they do checksum calculation after
5129 * this code has run BUT if ipfilter is being used
5130 * to do NAT as a bridge, that code doesn't exist.
5132 switch (nat->nat_dir)
5135 ipf_fix_outcksum(fin->fin_cksum & FI_CK_L4PART,
5136 &fin->fin_ip->ip_sum,
5137 nat->nat_ipsumd, 0);
5141 ipf_fix_incksum(fin->fin_cksum & FI_CK_L4PART,
5142 &fin->fin_ip->ip_sum,
5143 nat->nat_ipsumd, 0);
5153 * Address assignment is after the checksum modification because
5154 * we are using the address in the packet for determining the
5155 * correct checksum offset (the ICMP error could be coming from
5158 switch (nat->nat_dir)
5161 fin->fin_ip->ip_src = nat->nat_nsrcip;
5162 fin->fin_saddr = nat->nat_nsrcaddr;
5163 fin->fin_ip->ip_dst = nat->nat_ndstip;
5164 fin->fin_daddr = nat->nat_ndstaddr;
5168 fin->fin_ip->ip_src = nat->nat_odstip;
5169 fin->fin_saddr = nat->nat_ndstaddr;
5170 fin->fin_ip->ip_dst = nat->nat_osrcip;
5171 fin->fin_daddr = nat->nat_nsrcaddr;
5178 skip = ipf_nat_decap(fin, nat);
5180 NBUMPSIDED(1, ns_decap_fail);
5186 #if defined(MENTAT) && defined(_KERNEL)
5193 if (m->m_flags & M_PKTHDR)
5194 m->m_pkthdr.len -= skip;
5198 MUTEX_ENTER(&nat->nat_lock);
5199 ipf_nat_update(fin, nat);
5200 MUTEX_EXIT(&nat->nat_lock);
5201 fin->fin_flx |= FI_NATED;
5202 if (np != NULL && np->in_tag.ipt_num[0] != 0)
5203 fin->fin_nattag = &np->in_tag;
5208 case NAT_DIVERTOUT :
5210 u_32_t s1, s2, sumd;
5215 m = M_DUP(np->in_divmp);
5217 NBUMPSIDED(1, ns_divert_dup);
5221 ip = MTOD(m, ip_t *);
5222 ip->ip_id = htons(ipf_nextipid(fin));
5223 s2 = ntohs(ip->ip_id);
5226 ip->ip_len = ntohs(ip->ip_len);
5227 ip->ip_len += fin->fin_plen;
5228 ip->ip_len = htons(ip->ip_len);
5229 s2 += ntohs(ip->ip_len);
5230 CALC_SUMD(s1, s2, sumd);
5232 uh = (udphdr_t *)(ip + 1);
5233 uh->uh_ulen += fin->fin_plen;
5234 uh->uh_ulen = htons(uh->uh_ulen);
5235 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
5236 defined(linux) || defined(BRIDGE_IPF)
5237 ipf_fix_outcksum(0, &ip->ip_sum, sumd, 0);
5242 fin->fin_src = ip->ip_src;
5243 fin->fin_dst = ip->ip_dst;
5245 fin->fin_plen += sizeof(ip_t) + 8; /* UDP + IPv4 hdr */
5246 fin->fin_dlen += sizeof(ip_t) + 8; /* UDP + IPv4 hdr */
5248 nflags &= ~IPN_TCPUDPICMP;
5257 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5260 if ((nat->nat_nsport != 0) && (nflags & IPN_TCPUDP)) {
5263 switch (nat->nat_dir)
5266 tcp->th_sport = nat->nat_nsport;
5267 fin->fin_data[0] = ntohs(nat->nat_nsport);
5268 tcp->th_dport = nat->nat_ndport;
5269 fin->fin_data[1] = ntohs(nat->nat_ndport);
5273 tcp->th_sport = nat->nat_odport;
5274 fin->fin_data[0] = ntohs(nat->nat_odport);
5275 tcp->th_dport = nat->nat_osport;
5276 fin->fin_data[1] = ntohs(nat->nat_osport);
5281 if ((nat->nat_nsport != 0) && (nflags & IPN_ICMPQUERY)) {
5283 icmp->icmp_id = nat->nat_nicmpid;
5286 csump = ipf_nat_proto(fin, nat, nflags);
5289 * The above comments do not hold for layer 4 (or higher)
5292 if (csump != NULL) {
5293 if (nat->nat_dir == NAT_OUTBOUND)
5294 ipf_fix_outcksum(fin->fin_cksum, csump,
5299 ipf_fix_incksum(fin->fin_cksum, csump,
5306 ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync);
5307 /* ------------------------------------------------------------- */
5308 /* A few quick notes: */
5309 /* Following are test conditions prior to calling the */
5310 /* ipf_proxy_check routine. */
5312 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */
5313 /* with a redirect rule, we attempt to match the packet's */
5314 /* source port against in_dport, otherwise we'd compare the */
5315 /* packet's destination. */
5316 /* ------------------------------------------------------------- */
5317 if ((np != NULL) && (np->in_apr != NULL)) {
5318 i = ipf_proxy_check(fin, nat);
5321 } else if (i == -1) {
5322 NBUMPSIDED(1, ns_ipf_proxy_fail);
5327 fin->fin_flx |= FI_NATED;
5332 /* ------------------------------------------------------------------------ */
5333 /* Function: ipf_nat_checkin */
5334 /* Returns: int - -1 == packet failed NAT checks so block it, */
5335 /* 0 == no packet translation occurred, */
5336 /* 1 == packet was successfully translated. */
5337 /* Parameters: fin(I) - pointer to packet information */
5338 /* passp(I) - pointer to filtering result flags */
5340 /* Check to see if an incoming packet should be changed. ICMP packets are */
5341 /* first checked to see if they match an existing entry (if an error), */
5342 /* otherwise a search of the current NAT table is made. If neither results */
5343 /* in a match then a search for a matching NAT rule is made. Create a new */
5344 /* NAT entry if a we matched a NAT rule. Lastly, actually change the */
5345 /* packet header(s) as required. */
5346 /* ------------------------------------------------------------------------ */
5348 ipf_nat_checkin(fin, passp)
5352 ipf_main_softc_t *softc;
5353 ipf_nat_softc_t *softn;
5354 u_int nflags, natadd;
5355 ipnat_t *np, *npnext;
5356 int rval, natfailed;
5365 softc = fin->fin_main_soft;
5366 softn = softc->ipf_nat_soft;
5368 if (softn->ipf_nat_lock != 0)
5370 if (softn->ipf_nat_stats.ns_rules == 0 &&
5371 softn->ipf_nat_instances == NULL)
5382 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5395 * This is an incoming packet, so the destination is
5396 * the icmp_id and the source port equals 0
5398 if ((fin->fin_flx & FI_ICMPQUERY) != 0) {
5399 nflags = IPN_ICMPQUERY;
5400 dport = icmp->icmp_id;
5406 if ((nflags & IPN_TCPUDP)) {
5408 dport = fin->fin_data[1];
5414 READ_ENTER(&softc->ipf_nat);
5416 if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
5417 (nat = ipf_nat_icmperror(fin, &nflags, NAT_INBOUND)))
5419 else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin)))
5421 else if ((nat = ipf_nat_inlookup(fin, nflags|NAT_SEARCH,
5423 fin->fin_src, in))) {
5424 nflags = nat->nat_flags;
5425 } else if (fin->fin_off == 0) {
5426 u_32_t hv, msk, rmsk = 0;
5429 * If there is no current entry in the nat table for this IP#,
5430 * create one for it (if there is a matching rule).
5433 msk = softn->ipf_nat_rdr_active_masks[rmsk];
5434 iph = in.s_addr & msk;
5435 hv = NAT_HASH_FN(iph, 0, softn->ipf_nat_rdrrules_sz);
5437 /* TRACE (iph,msk,rmsk,hv,softn->ipf_nat_rdrrules_sz) */
5438 for (np = softn->ipf_nat_rdr_rules[hv]; np; np = npnext) {
5439 npnext = np->in_rnext;
5440 if (np->in_ifps[0] && (np->in_ifps[0] != ifp))
5442 if (np->in_v[0] != 4)
5444 if (np->in_pr[0] && (np->in_pr[0] != fin->fin_p))
5446 if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags))
5448 if (np->in_flags & IPN_FILTER) {
5449 switch (ipf_nat_match(fin, np))
5461 if ((in.s_addr & np->in_odstmsk) !=
5464 if (np->in_odport &&
5465 ((np->in_dtop < dport) ||
5466 (dport < np->in_odport)))
5470 if (np->in_plabel != -1) {
5471 if (!ipf_proxy_ok(fin, tcp, np)) {
5476 if (np->in_flags & IPN_NO) {
5481 MUTEX_ENTER(&softn->ipf_nat_new);
5483 * If we've matched a round-robin rule but it has
5484 * moved in the list since we got it, start over as
5485 * this is now no longer correct.
5487 if (npnext != np->in_rnext) {
5488 if ((np->in_flags & IPN_ROUNDR) != 0) {
5489 MUTEX_EXIT(&softn->ipf_nat_new);
5490 goto retry_roundrobin;
5492 npnext = np->in_rnext;
5495 nat = ipf_nat_add(fin, np, NULL, nflags, NAT_INBOUND);
5496 MUTEX_EXIT(&softn->ipf_nat_new);
5503 if ((np == NULL) && (rmsk < softn->ipf_nat_rdr_max)) {
5510 rval = ipf_nat_in(fin, nat, natadd, nflags);
5512 MUTEX_ENTER(&nat->nat_lock);
5513 ipf_nat_update(fin, nat);
5514 nat->nat_bytes[0] += fin->fin_plen;
5516 fin->fin_pktnum = nat->nat_pkts[0];
5517 MUTEX_EXIT(&nat->nat_lock);
5522 RWLOCK_EXIT(&softc->ipf_nat);
5527 if (passp != NULL) {
5528 DT1(frb_natv4in, fr_info_t *, fin);
5529 NBUMPSIDED(0, ns_drop);
5531 fin->fin_reason = FRB_NATV4;
5533 fin->fin_flx |= FI_BADNAT;
5534 NBUMPSIDED(0, ns_badnat);
5537 NBUMPSIDE(0, ns_ignored);
5540 NBUMPSIDE(0, ns_translated);
5547 /* ------------------------------------------------------------------------ */
5548 /* Function: ipf_nat_in */
5549 /* Returns: int - -1 == packet failed NAT checks so block it, */
5550 /* 1 == packet was successfully translated. */
5551 /* Parameters: fin(I) - pointer to packet information */
5552 /* nat(I) - pointer to NAT structure */
5553 /* natadd(I) - flag indicating if it is safe to add frag cache */
5554 /* nflags(I) - NAT flags set for this packet */
5555 /* Locks Held: ipf_nat(READ) */
5557 /* Translate a packet coming "in" on an interface. */
5558 /* ------------------------------------------------------------------------ */
5560 ipf_nat_in(fin, nat, natadd, nflags)
5566 ipf_main_softc_t *softc = fin->fin_main_soft;
5567 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5568 u_32_t sumd, ipsumd, sum1, sum2;
5577 fin->fin_fr = nat->nat_fr;
5580 if ((natadd != 0) && (fin->fin_flx & FI_FRAG))
5581 (void) ipf_frag_natnew(softc, fin, 0, nat);
5583 /* ------------------------------------------------------------- */
5584 /* A few quick notes: */
5585 /* Following are test conditions prior to calling the */
5586 /* ipf_proxy_check routine. */
5588 /* A NULL tcp indicates a non TCP/UDP packet. When dealing */
5589 /* with a map rule, we attempt to match the packet's */
5590 /* source port against in_dport, otherwise we'd compare the */
5591 /* packet's destination. */
5592 /* ------------------------------------------------------------- */
5593 if (np->in_apr != NULL) {
5594 i = ipf_proxy_check(fin, nat);
5596 NBUMPSIDED(0, ns_ipf_proxy_fail);
5602 ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync);
5604 ipsumd = nat->nat_ipsumd;
5606 * Fix up checksums, not by recalculating them, but
5607 * simply computing adjustments.
5608 * Why only do this for some platforms on inbound packets ?
5609 * Because for those that it is done, IP processing is yet to happen
5610 * and so the IPv4 header checksum has not yet been evaluated.
5611 * Perhaps it should always be done for the benefit of things like
5612 * fast forwarding (so that it doesn't need to be recomputed) but with
5613 * header checksum offloading, perhaps it is a moot point.
5616 switch (nat->nat_dir)
5619 if ((fin->fin_flx & FI_ICMPERR) == 0) {
5620 fin->fin_ip->ip_src = nat->nat_nsrcip;
5621 fin->fin_saddr = nat->nat_nsrcaddr;
5623 sum1 = nat->nat_osrcaddr;
5624 sum2 = nat->nat_nsrcaddr;
5625 CALC_SUMD(sum1, sum2, sumd);
5628 fin->fin_ip->ip_dst = nat->nat_ndstip;
5629 fin->fin_daddr = nat->nat_ndstaddr;
5630 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
5631 defined(__osf__) || defined(linux)
5632 ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, ipsumd, 0);
5637 if ((fin->fin_flx & FI_ICMPERR) == 0) {
5638 fin->fin_ip->ip_src = nat->nat_odstip;
5639 fin->fin_saddr = nat->nat_odstaddr;
5641 sum1 = nat->nat_odstaddr;
5642 sum2 = nat->nat_ndstaddr;
5643 CALC_SUMD(sum1, sum2, sumd);
5646 fin->fin_ip->ip_dst = nat->nat_osrcip;
5647 fin->fin_daddr = nat->nat_osrcaddr;
5648 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
5649 defined(__osf__) || defined(linux)
5650 ipf_fix_incksum(0, &fin->fin_ip->ip_sum, ipsumd, 0);
5660 m = M_DUP(np->in_divmp);
5662 NBUMPSIDED(0, ns_divert_dup);
5666 ip = MTOD(m, ip_t *);
5667 ip->ip_id = htons(ipf_nextipid(fin));
5668 sum1 = ntohs(ip->ip_len);
5669 ip->ip_len = ntohs(ip->ip_len);
5670 ip->ip_len += fin->fin_plen;
5671 ip->ip_len = htons(ip->ip_len);
5673 uh = (udphdr_t *)(ip + 1);
5674 uh->uh_ulen += fin->fin_plen;
5675 uh->uh_ulen = htons(uh->uh_ulen);
5677 sum2 = ntohs(ip->ip_id) + ntohs(ip->ip_len);
5678 sum2 += ntohs(ip->ip_off) & IP_DF;
5679 CALC_SUMD(sum1, sum2, sumd);
5681 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
5682 defined(__osf__) || defined(linux)
5683 ipf_fix_outcksum(0, &ip->ip_sum, sumd, 0);
5688 fin->fin_plen += sizeof(ip_t) + 8; /* UDP + new IPv4 hdr */
5689 fin->fin_dlen += sizeof(ip_t) + 8; /* UDP + old IPv4 hdr */
5691 nflags &= ~IPN_TCPUDPICMP;
5696 case NAT_DIVERTOUT :
5700 skip = ipf_nat_decap(fin, nat);
5702 NBUMPSIDED(0, ns_decap_fail);
5708 #if defined(MENTAT) && defined(_KERNEL)
5715 if (m->m_flags & M_PKTHDR)
5716 m->m_pkthdr.len -= skip;
5720 ipf_nat_update(fin, nat);
5721 nflags &= ~IPN_TCPUDPICMP;
5722 fin->fin_flx |= FI_NATED;
5723 if (np != NULL && np->in_tag.ipt_num[0] != 0)
5724 fin->fin_nattag = &np->in_tag;
5729 if (nflags & IPN_TCPUDP)
5732 if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
5735 if ((nat->nat_odport != 0) && (nflags & IPN_TCPUDP)) {
5736 switch (nat->nat_dir)
5739 tcp->th_sport = nat->nat_nsport;
5740 fin->fin_data[0] = ntohs(nat->nat_nsport);
5741 tcp->th_dport = nat->nat_ndport;
5742 fin->fin_data[1] = ntohs(nat->nat_ndport);
5746 tcp->th_sport = nat->nat_odport;
5747 fin->fin_data[0] = ntohs(nat->nat_odport);
5748 tcp->th_dport = nat->nat_osport;
5749 fin->fin_data[1] = ntohs(nat->nat_osport);
5755 if ((nat->nat_odport != 0) && (nflags & IPN_ICMPQUERY)) {
5758 icmp->icmp_id = nat->nat_nicmpid;
5761 csump = ipf_nat_proto(fin, nat, nflags);
5764 * The above comments do not hold for layer 4 (or higher)
5767 if (csump != NULL) {
5768 if (nat->nat_dir == NAT_OUTBOUND)
5769 ipf_fix_incksum(0, csump, nat->nat_sumd[0], 0);
5771 ipf_fix_outcksum(0, csump, nat->nat_sumd[0], 0);
5775 fin->fin_flx |= FI_NATED;
5776 if (np != NULL && np->in_tag.ipt_num[0] != 0)
5777 fin->fin_nattag = &np->in_tag;
5782 /* ------------------------------------------------------------------------ */
5783 /* Function: ipf_nat_proto */
5784 /* Returns: u_short* - pointer to transport header checksum to update, */
5785 /* NULL if the transport protocol is not recognised */
5786 /* as needing a checksum update. */
5787 /* Parameters: fin(I) - pointer to packet information */
5788 /* nat(I) - pointer to NAT structure */
5789 /* nflags(I) - NAT flags set for this packet */
5791 /* Return the pointer to the checksum field for each protocol so understood.*/
5792 /* If support for making other changes to a protocol header is required, */
5793 /* that is not strictly 'address' translation, such as clamping the MSS in */
5794 /* TCP down to a specific value, then do it from here. */
5795 /* ------------------------------------------------------------------------ */
5797 ipf_nat_proto(fin, nat, nflags)
5808 if (fin->fin_out == 0) {
5809 fin->fin_rev = (nat->nat_dir & NAT_OUTBOUND);
5811 fin->fin_rev = ((nat->nat_dir & NAT_OUTBOUND) == 0);
5819 if ((nflags & IPN_TCP) != 0)
5820 csump = &tcp->th_sum;
5823 * Do a MSS CLAMPING on a SYN packet,
5824 * only deal IPv4 for now.
5826 if ((nat->nat_mssclamp != 0) && (tcp->th_flags & TH_SYN) != 0)
5827 ipf_nat_mssclamp(tcp, nat->nat_mssclamp, fin, csump);
5834 if ((nflags & IPN_UDP) != 0) {
5835 if (udp->uh_sum != 0)
5836 csump = &udp->uh_sum;
5843 if ((nflags & IPN_ICMPQUERY) != 0) {
5844 if (icmp->icmp_cksum != 0)
5845 csump = &icmp->icmp_cksum;
5850 case IPPROTO_ICMPV6 :
5852 struct icmp6_hdr *icmp6 = (struct icmp6_hdr *)fin->fin_dp;
5854 icmp6 = fin->fin_dp;
5856 if ((nflags & IPN_ICMPQUERY) != 0) {
5857 if (icmp6->icmp6_cksum != 0)
5858 csump = &icmp6->icmp6_cksum;
5868 /* ------------------------------------------------------------------------ */
5869 /* Function: ipf_nat_expire */
5871 /* Parameters: softc(I) - pointer to soft context main structure */
5873 /* Check all of the timeout queues for entries at the top which need to be */
5875 /* ------------------------------------------------------------------------ */
5877 ipf_nat_expire(softc)
5878 ipf_main_softc_t *softc;
5880 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5881 ipftq_t *ifq, *ifqnext;
5882 ipftqent_t *tqe, *tqn;
5887 WRITE_ENTER(&softc->ipf_nat);
5888 for (ifq = softn->ipf_nat_tcptq, i = 0; ifq != NULL;
5889 ifq = ifq->ifq_next) {
5890 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
5891 if (tqe->tqe_die > softc->ipf_ticks)
5893 tqn = tqe->tqe_next;
5894 ipf_nat_delete(softc, tqe->tqe_parent, NL_EXPIRE);
5898 for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifq->ifq_next) {
5899 for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
5900 if (tqe->tqe_die > softc->ipf_ticks)
5902 tqn = tqe->tqe_next;
5903 ipf_nat_delete(softc, tqe->tqe_parent, NL_EXPIRE);
5907 for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifqnext) {
5908 ifqnext = ifq->ifq_next;
5910 if (((ifq->ifq_flags & IFQF_DELETE) != 0) &&
5911 (ifq->ifq_ref == 0)) {
5912 ipf_freetimeoutqueue(softc, ifq);
5916 if (softn->ipf_nat_doflush != 0) {
5917 ipf_nat_extraflush(softc, softn, 2);
5918 softn->ipf_nat_doflush = 0;
5921 RWLOCK_EXIT(&softc->ipf_nat);
5926 /* ------------------------------------------------------------------------ */
5927 /* Function: ipf_nat_sync */
5929 /* Parameters: softc(I) - pointer to soft context main structure */
5930 /* ifp(I) - pointer to network interface */
5932 /* Walk through all of the currently active NAT sessions, looking for those */
5933 /* which need to have their translated address updated. */
5934 /* ------------------------------------------------------------------------ */
5936 ipf_nat_sync(softc, ifp)
5937 ipf_main_softc_t *softc;
5940 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
5941 u_32_t sum1, sum2, sumd;
5949 if (softc->ipf_running <= 0)
5953 * Change IP addresses for NAT sessions for any protocol except TCP
5954 * since it will break the TCP connection anyway. The only rules
5955 * which will get changed are those which are "map ... -> 0/32",
5956 * where the rule specifies the address is taken from the interface.
5959 WRITE_ENTER(&softc->ipf_nat);
5961 if (softc->ipf_running <= 0) {
5962 RWLOCK_EXIT(&softc->ipf_nat);
5966 for (nat = softn->ipf_nat_instances; nat; nat = nat->nat_next) {
5967 if ((nat->nat_flags & IPN_TCP) != 0)
5972 if (n->in_v[1] == 4) {
5973 if (n->in_redir & NAT_MAP) {
5974 if ((n->in_nsrcaddr != 0) ||
5975 (n->in_nsrcmsk != 0xffffffff))
5977 } else if (n->in_redir & NAT_REDIRECT) {
5978 if ((n->in_ndstaddr != 0) ||
5979 (n->in_ndstmsk != 0xffffffff))
5984 if (n->in_v[1] == 4) {
5985 if (n->in_redir & NAT_MAP) {
5986 if (!IP6_ISZERO(&n->in_nsrcaddr) ||
5987 !IP6_ISONES(&n->in_nsrcmsk))
5989 } else if (n->in_redir & NAT_REDIRECT) {
5990 if (!IP6_ISZERO(&n->in_ndstaddr) ||
5991 !IP6_ISONES(&n->in_ndstmsk))
5998 if (((ifp == NULL) || (ifp == nat->nat_ifps[0]) ||
5999 (ifp == nat->nat_ifps[1]))) {
6000 nat->nat_ifps[0] = GETIFP(nat->nat_ifnames[0],
6002 if ((nat->nat_ifps[0] != NULL) &&
6003 (nat->nat_ifps[0] != (void *)-1)) {
6004 nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
6006 if (nat->nat_ifnames[1][0] != '\0') {
6007 nat->nat_ifps[1] = GETIFP(nat->nat_ifnames[1],
6010 nat->nat_ifps[1] = nat->nat_ifps[0];
6012 if ((nat->nat_ifps[1] != NULL) &&
6013 (nat->nat_ifps[1] != (void *)-1)) {
6014 nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
6016 ifp2 = nat->nat_ifps[0];
6021 * Change the map-to address to be the same as the
6024 sum1 = NATFSUM(nat, nat->nat_v[1], nat_nsrc6);
6025 if (ipf_ifpaddr(softc, nat->nat_v[0], FRI_NORMAL, ifp2,
6027 if (nat->nat_v[0] == 4)
6028 nat->nat_nsrcip = in.in4;
6030 sum2 = NATFSUM(nat, nat->nat_v[1], nat_nsrc6);
6035 * Readjust the checksum adjustment to take into
6036 * account the new IP#.
6038 CALC_SUMD(sum1, sum2, sumd);
6039 /* XXX - dont change for TCP when solaris does
6040 * hardware checksumming.
6042 sumd += nat->nat_sumd[0];
6043 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
6044 nat->nat_sumd[1] = nat->nat_sumd[0];
6048 for (n = softn->ipf_nat_list; (n != NULL); n = n->in_next) {
6049 char *base = n->in_names;
6051 if ((ifp == NULL) || (n->in_ifps[0] == ifp))
6052 n->in_ifps[0] = ipf_resolvenic(softc,
6053 base + n->in_ifnames[0],
6055 if ((ifp == NULL) || (n->in_ifps[1] == ifp))
6056 n->in_ifps[1] = ipf_resolvenic(softc,
6057 base + n->in_ifnames[1],
6060 if (n->in_redir & NAT_REDIRECT)
6065 if (((ifp == NULL) || (n->in_ifps[idx] == ifp)) &&
6066 (n->in_ifps[idx] != NULL &&
6067 n->in_ifps[idx] != (void *)-1)) {
6069 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_osrc,
6070 0, n->in_ifps[idx]);
6071 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_odst,
6072 0, n->in_ifps[idx]);
6073 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_nsrc,
6074 0, n->in_ifps[idx]);
6075 ipf_nat_nextaddrinit(softc, n->in_names, &n->in_ndst,
6076 0, n->in_ifps[idx]);
6079 RWLOCK_EXIT(&softc->ipf_nat);
6084 /* ------------------------------------------------------------------------ */
6085 /* Function: ipf_nat_icmpquerytype */
6086 /* Returns: int - 1 == success, 0 == failure */
6087 /* Parameters: icmptype(I) - ICMP type number */
6089 /* Tests to see if the ICMP type number passed is a query/response type or */
6091 /* ------------------------------------------------------------------------ */
6093 ipf_nat_icmpquerytype(icmptype)
6098 * For the ICMP query NAT code, it is essential that both the query
6099 * and the reply match on the NAT rule. Because the NAT structure
6100 * does not keep track of the icmptype, and a single NAT structure
6101 * is used for all icmp types with the same src, dest and id, we
6102 * simply define the replies as queries as well. The funny thing is,
6103 * altough it seems silly to call a reply a query, this is exactly
6104 * as it is defined in the IPv4 specification
6108 case ICMP_ECHOREPLY:
6110 /* route aedvertisement/solliciation is currently unsupported: */
6111 /* it would require rewriting the ICMP data section */
6113 case ICMP_TSTAMPREPLY:
6115 case ICMP_IREQREPLY:
6117 case ICMP_MASKREPLY:
6125 /* ------------------------------------------------------------------------ */
6126 /* Function: nat_log */
6128 /* Parameters: softc(I) - pointer to soft context main structure */
6129 /* softn(I) - pointer to NAT context structure */
6130 /* nat(I) - pointer to NAT structure */
6131 /* action(I) - action related to NAT structure being performed */
6133 /* Creates a NAT log entry. */
6134 /* ------------------------------------------------------------------------ */
6136 ipf_nat_log(softc, softn, nat, action)
6137 ipf_main_softc_t *softc;
6138 ipf_nat_softc_t *softn;
6152 bcopy((char *)&nat->nat_osrc6, (char *)&natl.nl_osrcip,
6153 sizeof(natl.nl_osrcip));
6154 bcopy((char *)&nat->nat_nsrc6, (char *)&natl.nl_nsrcip,
6155 sizeof(natl.nl_nsrcip));
6156 bcopy((char *)&nat->nat_odst6, (char *)&natl.nl_odstip,
6157 sizeof(natl.nl_odstip));
6158 bcopy((char *)&nat->nat_ndst6, (char *)&natl.nl_ndstip,
6159 sizeof(natl.nl_ndstip));
6161 natl.nl_bytes[0] = nat->nat_bytes[0];
6162 natl.nl_bytes[1] = nat->nat_bytes[1];
6163 natl.nl_pkts[0] = nat->nat_pkts[0];
6164 natl.nl_pkts[1] = nat->nat_pkts[1];
6165 natl.nl_odstport = nat->nat_odport;
6166 natl.nl_osrcport = nat->nat_osport;
6167 natl.nl_nsrcport = nat->nat_nsport;
6168 natl.nl_ndstport = nat->nat_ndport;
6169 natl.nl_p[0] = nat->nat_pr[0];
6170 natl.nl_p[1] = nat->nat_pr[1];
6171 natl.nl_v[0] = nat->nat_v[0];
6172 natl.nl_v[1] = nat->nat_v[1];
6173 natl.nl_type = nat->nat_redir;
6174 natl.nl_action = action;
6177 bcopy(nat->nat_ifnames[0], natl.nl_ifnames[0],
6178 sizeof(nat->nat_ifnames[0]));
6179 bcopy(nat->nat_ifnames[1], natl.nl_ifnames[1],
6180 sizeof(nat->nat_ifnames[1]));
6183 if (nat->nat_ptr != NULL) {
6184 for (rulen = 0, np = softn->ipf_nat_list; np != NULL;
6185 np = np->in_next, rulen++)
6186 if (np == nat->nat_ptr) {
6187 natl.nl_rule = rulen;
6193 sizes[0] = sizeof(natl);
6196 (void) ipf_log_items(softc, IPL_LOGNAT, NULL, items, sizes, types, 1);
6201 #if defined(__OpenBSD__)
6202 /* ------------------------------------------------------------------------ */
6203 /* Function: ipf_nat_ifdetach */
6205 /* Parameters: ifp(I) - pointer to network interface */
6207 /* Compatibility interface for OpenBSD to trigger the correct updating of */
6208 /* interface references within IPFilter. */
6209 /* ------------------------------------------------------------------------ */
6211 ipf_nat_ifdetach(ifp)
6214 ipf_main_softc_t *softc;
6216 softc = ipf_get_softc(0);
6224 /* ------------------------------------------------------------------------ */
6225 /* Function: ipf_nat_rule_deref */
6227 /* Parameters: softc(I) - pointer to soft context main structure */
6228 /* inp(I) - pointer to pointer to NAT rule */
6229 /* Write Locks: ipf_nat */
6231 /* Dropping the refernce count for a rule means that whatever held the */
6232 /* pointer to this rule (*inp) is no longer interested in it and when the */
6233 /* reference count drops to zero, any resources allocated for the rule can */
6234 /* be released and the rule itself free'd. */
6235 /* ------------------------------------------------------------------------ */
6237 ipf_nat_rule_deref(softc, inp)
6238 ipf_main_softc_t *softc;
6241 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6250 if (n->in_apr != NULL)
6251 ipf_proxy_deref(n->in_apr);
6253 ipf_nat_rule_fini(softc, n);
6255 if (n->in_redir & NAT_REDIRECT) {
6256 if ((n->in_flags & IPN_PROXYRULE) == 0) {
6257 ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules_rdr);
6260 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
6261 if ((n->in_flags & IPN_PROXYRULE) == 0) {
6262 ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules_map);
6266 if (n->in_tqehead[0] != NULL) {
6267 if (ipf_deletetimeoutqueue(n->in_tqehead[0]) == 0) {
6268 ipf_freetimeoutqueue(softc, n->in_tqehead[1]);
6272 if (n->in_tqehead[1] != NULL) {
6273 if (ipf_deletetimeoutqueue(n->in_tqehead[1]) == 0) {
6274 ipf_freetimeoutqueue(softc, n->in_tqehead[1]);
6278 if ((n->in_flags & IPN_PROXYRULE) == 0) {
6279 ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules);
6282 MUTEX_DESTROY(&n->in_lock);
6284 KFREES(n, n->in_size);
6286 #if SOLARIS && !defined(INSTANCES)
6287 if (softn->ipf_nat_stats.ns_rules == 0)
6288 pfil_delayed_copy = 1;
6293 /* ------------------------------------------------------------------------ */
6294 /* Function: ipf_nat_deref */
6296 /* Parameters: softc(I) - pointer to soft context main structure */
6297 /* natp(I) - pointer to pointer to NAT table entry */
6299 /* Decrement the reference counter for this NAT table entry and free it if */
6300 /* there are no more things using it. */
6302 /* IF nat_ref == 1 when this function is called, then we have an orphan nat */
6303 /* structure *because* it only gets called on paths _after_ nat_ref has been*/
6304 /* incremented. If nat_ref == 1 then we shouldn't decrement it here */
6305 /* because nat_delete() will do that and send nat_ref to -1. */
6307 /* Holding the lock on nat_lock is required to serialise nat_delete() being */
6308 /* called from a NAT flush ioctl with a deref happening because of a packet.*/
6309 /* ------------------------------------------------------------------------ */
6311 ipf_nat_deref(softc, natp)
6312 ipf_main_softc_t *softc;
6320 MUTEX_ENTER(&nat->nat_lock);
6321 if (nat->nat_ref > 1) {
6323 ASSERT(nat->nat_ref >= 0);
6324 MUTEX_EXIT(&nat->nat_lock);
6327 MUTEX_EXIT(&nat->nat_lock);
6329 WRITE_ENTER(&softc->ipf_nat);
6330 ipf_nat_delete(softc, nat, NL_EXPIRE);
6331 RWLOCK_EXIT(&softc->ipf_nat);
6335 /* ------------------------------------------------------------------------ */
6336 /* Function: ipf_nat_clone */
6337 /* Returns: ipstate_t* - NULL == cloning failed, */
6338 /* else pointer to new state structure */
6339 /* Parameters: fin(I) - pointer to packet information */
6340 /* is(I) - pointer to master state structure */
6341 /* Write Lock: ipf_nat */
6343 /* Create a "duplcate" state table entry from the master. */
6344 /* ------------------------------------------------------------------------ */
6346 ipf_nat_clone(fin, nat)
6350 ipf_main_softc_t *softc = fin->fin_main_soft;
6351 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6356 KMALLOC(clone, nat_t *);
6357 if (clone == NULL) {
6358 NBUMPSIDED(fin->fin_out, ns_clone_nomem);
6361 bcopy((char *)nat, (char *)clone, sizeof(*clone));
6363 MUTEX_NUKE(&clone->nat_lock);
6365 clone->nat_rev = fin->fin_rev;
6366 clone->nat_aps = NULL;
6368 * Initialize all these so that ipf_nat_delete() doesn't cause a crash.
6370 clone->nat_tqe.tqe_pnext = NULL;
6371 clone->nat_tqe.tqe_next = NULL;
6372 clone->nat_tqe.tqe_ifq = NULL;
6373 clone->nat_tqe.tqe_parent = clone;
6375 clone->nat_flags &= ~SI_CLONE;
6376 clone->nat_flags |= SI_CLONED;
6379 clone->nat_hm->hm_ref++;
6381 if (ipf_nat_insert(softc, softn, clone) == -1) {
6383 NBUMPSIDED(fin->fin_out, ns_insert_fail);
6387 np = clone->nat_ptr;
6389 if (softn->ipf_nat_logging)
6390 ipf_nat_log(softc, softn, clone, NL_CLONE);
6395 MUTEX_ENTER(&fr->fr_lock);
6397 MUTEX_EXIT(&fr->fr_lock);
6402 * Because the clone is created outside the normal loop of things and
6403 * TCP has special needs in terms of state, initialise the timeout
6404 * state of the new NAT from here.
6406 if (clone->nat_pr[0] == IPPROTO_TCP) {
6407 (void) ipf_tcp_age(&clone->nat_tqe, fin, softn->ipf_nat_tcptq,
6408 clone->nat_flags, 2);
6410 clone->nat_sync = ipf_sync_new(softc, SMC_NAT, fin, clone);
6411 if (softn->ipf_nat_logging)
6412 ipf_nat_log(softc, softn, clone, NL_CLONE);
6417 /* ------------------------------------------------------------------------ */
6418 /* Function: ipf_nat_wildok */
6419 /* Returns: int - 1 == packet's ports match wildcards */
6420 /* 0 == packet's ports don't match wildcards */
6421 /* Parameters: nat(I) - NAT entry */
6422 /* sport(I) - source port */
6423 /* dport(I) - destination port */
6424 /* flags(I) - wildcard flags */
6425 /* dir(I) - packet direction */
6427 /* Use NAT entry and packet direction to determine which combination of */
6428 /* wildcard flags should be used. */
6429 /* ------------------------------------------------------------------------ */
6431 ipf_nat_wildok(nat, sport, dport, flags, dir)
6433 int sport, dport, flags, dir;
6436 * When called by dir is set to
6437 * nat_inlookup NAT_INBOUND (0)
6438 * nat_outlookup NAT_OUTBOUND (1)
6440 * We simply combine the packet's direction in dir with the original
6441 * "intended" direction of that NAT entry in nat->nat_dir to decide
6442 * which combination of wildcard flags to allow.
6444 switch ((dir << 1) | (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND)))
6446 case 3: /* outbound packet / outbound entry */
6447 if (((nat->nat_osport == sport) ||
6448 (flags & SI_W_SPORT)) &&
6449 ((nat->nat_odport == dport) ||
6450 (flags & SI_W_DPORT)))
6453 case 2: /* outbound packet / inbound entry */
6454 if (((nat->nat_osport == dport) ||
6455 (flags & SI_W_SPORT)) &&
6456 ((nat->nat_odport == sport) ||
6457 (flags & SI_W_DPORT)))
6460 case 1: /* inbound packet / outbound entry */
6461 if (((nat->nat_osport == dport) ||
6462 (flags & SI_W_SPORT)) &&
6463 ((nat->nat_odport == sport) ||
6464 (flags & SI_W_DPORT)))
6467 case 0: /* inbound packet / inbound entry */
6468 if (((nat->nat_osport == sport) ||
6469 (flags & SI_W_SPORT)) &&
6470 ((nat->nat_odport == dport) ||
6471 (flags & SI_W_DPORT)))
6482 /* ------------------------------------------------------------------------ */
6483 /* Function: nat_mssclamp */
6485 /* Parameters: tcp(I) - pointer to TCP header */
6486 /* maxmss(I) - value to clamp the TCP MSS to */
6487 /* fin(I) - pointer to packet information */
6488 /* csump(I) - pointer to TCP checksum */
6490 /* Check for MSS option and clamp it if necessary. If found and changed, */
6491 /* then the TCP header checksum will be updated to reflect the change in */
6493 /* ------------------------------------------------------------------------ */
6495 ipf_nat_mssclamp(tcp, maxmss, fin, csump)
6501 u_char *cp, *ep, opt;
6505 hlen = TCP_OFF(tcp) << 2;
6506 if (hlen > sizeof(*tcp)) {
6507 cp = (u_char *)tcp + sizeof(*tcp);
6508 ep = (u_char *)tcp + hlen;
6512 if (opt == TCPOPT_EOL)
6514 else if (opt == TCPOPT_NOP) {
6522 if ((cp + advance > ep) || (advance <= 0))
6529 mss = cp[2] * 256 + cp[3];
6531 cp[2] = maxmss / 256;
6532 cp[3] = maxmss & 0xff;
6533 CALC_SUMD(mss, maxmss, sumd);
6534 ipf_fix_outcksum(0, csump, sumd, 0);
6538 /* ignore unknown options */
6548 /* ------------------------------------------------------------------------ */
6549 /* Function: ipf_nat_setqueue */
6551 /* Parameters: softc(I) - pointer to soft context main structure */
6552 /* softn(I) - pointer to NAT context structure */
6553 /* nat(I)- pointer to NAT structure */
6554 /* Locks: ipf_nat (read or write) */
6556 /* Put the NAT entry on its default queue entry, using rev as a helped in */
6557 /* determining which queue it should be placed on. */
6558 /* ------------------------------------------------------------------------ */
6560 ipf_nat_setqueue(softc, softn, nat)
6561 ipf_main_softc_t *softc;
6562 ipf_nat_softc_t *softn;
6565 ipftq_t *oifq, *nifq;
6566 int rev = nat->nat_rev;
6568 if (nat->nat_ptr != NULL)
6569 nifq = nat->nat_ptr->in_tqehead[rev];
6574 switch (nat->nat_pr[0])
6577 nifq = &softn->ipf_nat_udptq;
6580 nifq = &softn->ipf_nat_icmptq;
6583 nifq = softn->ipf_nat_tcptq +
6584 nat->nat_tqe.tqe_state[rev];
6587 nifq = &softn->ipf_nat_iptq;
6592 oifq = nat->nat_tqe.tqe_ifq;
6594 * If it's currently on a timeout queue, move it from one queue to
6595 * another, else put it on the end of the newly determined queue.
6598 ipf_movequeue(softc->ipf_ticks, &nat->nat_tqe, oifq, nifq);
6600 ipf_queueappend(softc->ipf_ticks, &nat->nat_tqe, nifq, nat);
6605 /* ------------------------------------------------------------------------ */
6606 /* Function: nat_getnext */
6607 /* Returns: int - 0 == ok, else error */
6608 /* Parameters: softc(I) - pointer to soft context main structure */
6609 /* t(I) - pointer to ipftoken structure */
6610 /* itp(I) - pointer to ipfgeniter_t structure */
6612 /* Fetch the next nat/ipnat structure pointer from the linked list and */
6613 /* copy it out to the storage space pointed to by itp_data. The next item */
6614 /* in the list to look at is put back in the ipftoken struture. */
6615 /* ------------------------------------------------------------------------ */
6617 ipf_nat_getnext(softc, t, itp, objp)
6618 ipf_main_softc_t *softc;
6623 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
6624 hostmap_t *hm, *nexthm = NULL, zerohm;
6625 ipnat_t *ipn, *nextipnat = NULL, zeroipn;
6626 nat_t *nat, *nextnat = NULL, zeronat;
6630 if (itp->igi_nitems != 1) {
6635 READ_ENTER(&softc->ipf_nat);
6637 switch (itp->igi_type)
6639 case IPFGENITER_HOSTMAP :
6642 nexthm = softn->ipf_hm_maplist;
6644 nexthm = hm->hm_next;
6646 if (nexthm != NULL) {
6647 ATOMIC_INC32(nexthm->hm_ref);
6648 t->ipt_data = nexthm;
6650 bzero(&zerohm, sizeof(zerohm));
6654 nnext = nexthm->hm_next;
6657 case IPFGENITER_IPNAT :
6660 nextipnat = softn->ipf_nat_list;
6662 nextipnat = ipn->in_next;
6664 if (nextipnat != NULL) {
6665 ATOMIC_INC32(nextipnat->in_use);
6666 t->ipt_data = nextipnat;
6668 bzero(&zeroipn, sizeof(zeroipn));
6669 nextipnat = &zeroipn;
6672 nnext = nextipnat->in_next;
6675 case IPFGENITER_NAT :
6678 nextnat = softn->ipf_nat_instances;
6680 nextnat = nat->nat_next;
6682 if (nextnat != NULL) {
6683 MUTEX_ENTER(&nextnat->nat_lock);
6685 MUTEX_EXIT(&nextnat->nat_lock);
6686 t->ipt_data = nextnat;
6688 bzero(&zeronat, sizeof(zeronat));
6692 nnext = nextnat->nat_next;
6696 RWLOCK_EXIT(&softc->ipf_nat);
6701 RWLOCK_EXIT(&softc->ipf_nat);
6703 objp->ipfo_ptr = itp->igi_data;
6705 switch (itp->igi_type)
6707 case IPFGENITER_HOSTMAP :
6708 error = COPYOUT(nexthm, objp->ipfo_ptr, sizeof(*nexthm));
6714 WRITE_ENTER(&softc->ipf_nat);
6715 ipf_nat_hostmapdel(softc, &hm);
6716 RWLOCK_EXIT(&softc->ipf_nat);
6720 case IPFGENITER_IPNAT :
6721 objp->ipfo_size = nextipnat->in_size;
6722 objp->ipfo_type = IPFOBJ_IPNAT;
6723 error = ipf_outobjk(softc, objp, nextipnat);
6725 WRITE_ENTER(&softc->ipf_nat);
6726 ipf_nat_rule_deref(softc, &ipn);
6727 RWLOCK_EXIT(&softc->ipf_nat);
6731 case IPFGENITER_NAT :
6732 objp->ipfo_size = sizeof(nat_t);
6733 objp->ipfo_type = IPFOBJ_NAT;
6734 error = ipf_outobjk(softc, objp, nextnat);
6736 ipf_nat_deref(softc, &nat);
6742 ipf_token_mark_complete(t);
6748 /* ------------------------------------------------------------------------ */
6749 /* Function: nat_extraflush */
6750 /* Returns: int - 0 == success, -1 == failure */
6751 /* Parameters: softc(I) - pointer to soft context main structure */
6752 /* softn(I) - pointer to NAT context structure */
6753 /* which(I) - how to flush the active NAT table */
6754 /* Write Locks: ipf_nat */
6756 /* Flush nat tables. Three actions currently defined: */
6757 /* which == 0 : flush all nat table entries */
6758 /* which == 1 : flush TCP connections which have started to close but are */
6759 /* stuck for some reason. */
6760 /* which == 2 : flush TCP connections which have been idle for a long time, */
6761 /* starting at > 4 days idle and working back in successive half-*/
6762 /* days to at most 12 hours old. If this fails to free enough */
6763 /* slots then work backwards in half hour slots to 30 minutes. */
6764 /* If that too fails, then work backwards in 30 second intervals */
6765 /* for the last 30 minutes to at worst 30 seconds idle. */
6766 /* ------------------------------------------------------------------------ */
6768 ipf_nat_extraflush(softc, softn, which)
6769 ipf_main_softc_t *softc;
6770 ipf_nat_softc_t *softn;
6785 softn->ipf_nat_stats.ns_flush_all++;
6787 * Style 0 flush removes everything...
6789 for (natp = &softn->ipf_nat_instances;
6790 ((nat = *natp) != NULL); ) {
6791 ipf_nat_delete(softc, nat, NL_FLUSH);
6797 softn->ipf_nat_stats.ns_flush_closing++;
6799 * Since we're only interested in things that are closing,
6800 * we can start with the appropriate timeout queue.
6802 for (ifq = softn->ipf_nat_tcptq + IPF_TCPS_CLOSE_WAIT;
6803 ifq != NULL; ifq = ifq->ifq_next) {
6805 for (tqn = ifq->ifq_head; tqn != NULL; ) {
6806 nat = tqn->tqe_parent;
6807 tqn = tqn->tqe_next;
6808 if (nat->nat_pr[0] != IPPROTO_TCP ||
6809 nat->nat_pr[1] != IPPROTO_TCP)
6811 ipf_nat_delete(softc, nat, NL_EXPIRE);
6817 * Also need to look through the user defined queues.
6819 for (ifq = softn->ipf_nat_utqe; ifq != NULL;
6820 ifq = ifq->ifq_next) {
6821 for (tqn = ifq->ifq_head; tqn != NULL; ) {
6822 nat = tqn->tqe_parent;
6823 tqn = tqn->tqe_next;
6824 if (nat->nat_pr[0] != IPPROTO_TCP ||
6825 nat->nat_pr[1] != IPPROTO_TCP)
6828 if ((nat->nat_tcpstate[0] >
6829 IPF_TCPS_ESTABLISHED) &&
6830 (nat->nat_tcpstate[1] >
6831 IPF_TCPS_ESTABLISHED)) {
6832 ipf_nat_delete(softc, nat, NL_EXPIRE);
6840 * Args 5-11 correspond to flushing those particular states
6841 * for TCP connections.
6843 case IPF_TCPS_CLOSE_WAIT :
6844 case IPF_TCPS_FIN_WAIT_1 :
6845 case IPF_TCPS_CLOSING :
6846 case IPF_TCPS_LAST_ACK :
6847 case IPF_TCPS_FIN_WAIT_2 :
6848 case IPF_TCPS_TIME_WAIT :
6849 case IPF_TCPS_CLOSED :
6850 softn->ipf_nat_stats.ns_flush_state++;
6851 tqn = softn->ipf_nat_tcptq[which].ifq_head;
6852 while (tqn != NULL) {
6853 nat = tqn->tqe_parent;
6854 tqn = tqn->tqe_next;
6855 ipf_nat_delete(softc, nat, NL_FLUSH);
6864 softn->ipf_nat_stats.ns_flush_timeout++;
6866 * Take a large arbitrary number to mean the number of seconds
6867 * for which which consider to be the maximum value we'll allow
6868 * the expiration to be.
6870 which = IPF_TTLVAL(which);
6871 for (natp = &softn->ipf_nat_instances;
6872 ((nat = *natp) != NULL); ) {
6873 if (softc->ipf_ticks - nat->nat_touched > which) {
6874 ipf_nat_delete(softc, nat, NL_FLUSH);
6877 natp = &nat->nat_next;
6887 softn->ipf_nat_stats.ns_flush_queue++;
6890 * Asked to remove inactive entries because the table is full, try
6891 * again, 3 times, if first attempt failed with a different criteria
6892 * each time. The order tried in must be in decreasing age.
6893 * Another alternative is to implement random drop and drop N entries
6894 * at random until N have been freed up.
6896 if (softc->ipf_ticks - softn->ipf_nat_last_force_flush >
6898 softn->ipf_nat_last_force_flush = softc->ipf_ticks;
6900 removed = ipf_queueflush(softc, ipf_nat_flush_entry,
6901 softn->ipf_nat_tcptq,
6902 softn->ipf_nat_utqe,
6903 &softn->ipf_nat_stats.ns_active,
6904 softn->ipf_nat_table_sz,
6905 softn->ipf_nat_table_wm_low);
6913 /* ------------------------------------------------------------------------ */
6914 /* Function: ipf_nat_flush_entry */
6915 /* Returns: 0 - always succeeds */
6916 /* Parameters: softc(I) - pointer to soft context main structure */
6917 /* entry(I) - pointer to NAT entry */
6918 /* Write Locks: ipf_nat */
6920 /* This function is a stepping stone between ipf_queueflush() and */
6921 /* nat_dlete(). It is used so we can provide a uniform interface via the */
6922 /* ipf_queueflush() function. Since the nat_delete() function returns void */
6923 /* we translate that to mean it always succeeds in deleting something. */
6924 /* ------------------------------------------------------------------------ */
6926 ipf_nat_flush_entry(softc, entry)
6927 ipf_main_softc_t *softc;
6930 ipf_nat_delete(softc, entry, NL_FLUSH);
6935 /* ------------------------------------------------------------------------ */
6936 /* Function: ipf_nat_iterator */
6937 /* Returns: int - 0 == ok, else error */
6938 /* Parameters: softc(I) - pointer to soft context main structure */
6939 /* token(I) - pointer to ipftoken structure */
6940 /* itp(I) - pointer to ipfgeniter_t structure */
6941 /* obj(I) - pointer to data description structure */
6943 /* This function acts as a handler for the SIOCGENITER ioctls that use a */
6944 /* generic structure to iterate through a list. There are three different */
6945 /* linked lists of NAT related information to go through: NAT rules, active */
6946 /* NAT mappings and the NAT fragment cache. */
6947 /* ------------------------------------------------------------------------ */
6949 ipf_nat_iterator(softc, token, itp, obj)
6950 ipf_main_softc_t *softc;
6957 if (itp->igi_data == NULL) {
6962 switch (itp->igi_type)
6964 case IPFGENITER_HOSTMAP :
6965 case IPFGENITER_IPNAT :
6966 case IPFGENITER_NAT :
6967 error = ipf_nat_getnext(softc, token, itp, obj);
6970 case IPFGENITER_NATFRAG :
6971 error = ipf_frag_nat_next(softc, token, itp);
6983 /* ------------------------------------------------------------------------ */
6984 /* Function: ipf_nat_setpending */
6986 /* Parameters: softc(I) - pointer to soft context main structure */
6987 /* nat(I) - pointer to NAT structure */
6988 /* Locks: ipf_nat (read or write) */
6990 /* Put the NAT entry on to the pending queue - this queue has a very short */
6991 /* lifetime where items are put that can't be deleted straight away because */
6992 /* of locking issues but we want to delete them ASAP, anyway. In calling */
6993 /* this function, it is assumed that the owner (if there is one, as shown */
6994 /* by nat_me) is no longer interested in it. */
6995 /* ------------------------------------------------------------------------ */
6997 ipf_nat_setpending(softc, nat)
6998 ipf_main_softc_t *softc;
7001 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7004 oifq = nat->nat_tqe.tqe_ifq;
7006 ipf_movequeue(softc->ipf_ticks, &nat->nat_tqe, oifq,
7007 &softn->ipf_nat_pending);
7009 ipf_queueappend(softc->ipf_ticks, &nat->nat_tqe,
7010 &softn->ipf_nat_pending, nat);
7012 if (nat->nat_me != NULL) {
7013 *nat->nat_me = NULL;
7016 ASSERT(nat->nat_ref >= 0);
7021 /* ------------------------------------------------------------------------ */
7022 /* Function: nat_newrewrite */
7023 /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */
7024 /* allow rule to be moved if IPN_ROUNDR is set. */
7025 /* Parameters: fin(I) - pointer to packet information */
7026 /* nat(I) - pointer to NAT entry */
7027 /* ni(I) - pointer to structure with misc. information needed */
7028 /* to create new NAT entry. */
7029 /* Write Lock: ipf_nat */
7031 /* This function is responsible for setting up an active NAT session where */
7032 /* we are changing both the source and destination parameters at the same */
7033 /* time. The loop in here works differently to elsewhere - each iteration */
7034 /* is responsible for changing a single parameter that can be incremented. */
7035 /* So one pass may increase the source IP#, next source port, next dest. IP#*/
7036 /* and the last destination port for a total of 4 iterations to try each. */
7037 /* This is done to try and exhaustively use the translation space available.*/
7038 /* ------------------------------------------------------------------------ */
7040 ipf_nat_newrewrite(fin, nat, nai)
7058 flags = nat->nat_flags;
7059 bcopy((char *)fin, (char *)&frnat, sizeof(*fin));
7065 /* TRACE (l, src_search, dst_search, np) */
7067 if ((src_search == 0) && (np->in_spnext == 0) &&
7068 (dst_search == 0) && (np->in_dpnext == 0)) {
7074 * Find a new source address
7076 if (ipf_nat_nextaddr(fin, &np->in_nsrc, &frnat.fin_saddr,
7077 &frnat.fin_saddr) == -1) {
7081 if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0xffffffff)) {
7083 if (np->in_stepnext == 0)
7084 np->in_stepnext = 1;
7086 } else if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0)) {
7088 if (np->in_stepnext == 0)
7089 np->in_stepnext = 1;
7091 } else if (np->in_nsrcmsk == 0xffffffff) {
7093 if (np->in_stepnext == 0)
7094 np->in_stepnext = 1;
7096 } else if (np->in_nsrcmsk != 0xffffffff) {
7097 if (np->in_stepnext == 0 && changed == -1) {
7104 if ((flags & IPN_TCPUDPICMP) != 0) {
7105 if (np->in_spnext != 0)
7106 frnat.fin_data[0] = np->in_spnext;
7109 * Standard port translation. Select next port.
7111 if ((flags & IPN_FIXEDSPORT) != 0) {
7112 np->in_stepnext = 2;
7113 } else if ((np->in_stepnext == 1) &&
7114 (changed == -1) && (natl != NULL)) {
7118 if (np->in_spnext > np->in_spmax)
7119 np->in_spnext = np->in_spmin;
7122 np->in_stepnext = 2;
7124 np->in_stepnext &= 0x3;
7127 * Find a new destination address
7129 /* TRACE (fin, np, l, frnat) */
7131 if (ipf_nat_nextaddr(fin, &np->in_ndst, &frnat.fin_daddr,
7132 &frnat.fin_daddr) == -1)
7134 if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0xffffffff)) {
7136 if (np->in_stepnext == 2)
7137 np->in_stepnext = 3;
7139 } else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0)) {
7141 if (np->in_stepnext == 2)
7142 np->in_stepnext = 3;
7144 } else if (np->in_ndstmsk == 0xffffffff) {
7146 if (np->in_stepnext == 2)
7147 np->in_stepnext = 3;
7149 } else if (np->in_ndstmsk != 0xffffffff) {
7150 if ((np->in_stepnext == 2) && (changed == -1) &&
7158 if ((flags & IPN_TCPUDPICMP) != 0) {
7159 if (np->in_dpnext != 0)
7160 frnat.fin_data[1] = np->in_dpnext;
7163 * Standard port translation. Select next port.
7165 if ((flags & IPN_FIXEDDPORT) != 0) {
7166 np->in_stepnext = 0;
7167 } else if (np->in_stepnext == 3 && changed == -1) {
7171 if (np->in_dpnext > np->in_dpmax)
7172 np->in_dpnext = np->in_dpmin;
7175 if (np->in_stepnext == 3)
7176 np->in_stepnext = 0;
7182 * Here we do a lookup of the connection as seen from
7183 * the outside. If an IP# pair already exists, try
7184 * again. So if you have A->B becomes C->B, you can
7185 * also have D->E become C->E but not D->B causing
7186 * another C->B. Also take protocol and ports into
7187 * account when determining whether a pre-existing
7188 * NAT setup will cause an external conflict where
7189 * this is appropriate.
7191 * fin_data[] is swapped around because we are doing a
7192 * lookup of the packet is if it were moving in the opposite
7193 * direction of the one we are working with now.
7195 if (flags & IPN_TCPUDP) {
7196 swap = frnat.fin_data[0];
7197 frnat.fin_data[0] = frnat.fin_data[1];
7198 frnat.fin_data[1] = swap;
7200 if (fin->fin_out == 1) {
7201 natl = ipf_nat_inlookup(&frnat,
7202 flags & ~(SI_WILDP|NAT_SEARCH),
7204 frnat.fin_dst, frnat.fin_src);
7207 natl = ipf_nat_outlookup(&frnat,
7208 flags & ~(SI_WILDP|NAT_SEARCH),
7210 frnat.fin_dst, frnat.fin_src);
7212 if (flags & IPN_TCPUDP) {
7213 swap = frnat.fin_data[0];
7214 frnat.fin_data[0] = frnat.fin_data[1];
7215 frnat.fin_data[1] = swap;
7218 /* TRACE natl, in_stepnext, l */
7220 if ((natl != NULL) && (l > 8)) /* XXX 8 is arbitrary */
7223 np->in_stepnext &= 0x3;
7227 } while (natl != NULL);
7229 nat->nat_osrcip = fin->fin_src;
7230 nat->nat_odstip = fin->fin_dst;
7231 nat->nat_nsrcip = frnat.fin_src;
7232 nat->nat_ndstip = frnat.fin_dst;
7234 if ((flags & IPN_TCPUDP) != 0) {
7235 nat->nat_osport = htons(fin->fin_data[0]);
7236 nat->nat_odport = htons(fin->fin_data[1]);
7237 nat->nat_nsport = htons(frnat.fin_data[0]);
7238 nat->nat_ndport = htons(frnat.fin_data[1]);
7239 } else if ((flags & IPN_ICMPQUERY) != 0) {
7240 nat->nat_oicmpid = fin->fin_data[1];
7241 nat->nat_nicmpid = frnat.fin_data[1];
7248 /* ------------------------------------------------------------------------ */
7249 /* Function: nat_newdivert */
7250 /* Returns: int - -1 == error, 0 == success */
7251 /* Parameters: fin(I) - pointer to packet information */
7252 /* nat(I) - pointer to NAT entry */
7253 /* ni(I) - pointer to structure with misc. information needed */
7254 /* to create new NAT entry. */
7255 /* Write Lock: ipf_nat */
7257 /* Create a new NAT divert session as defined by the NAT rule. This is */
7258 /* somewhat different to other NAT session creation routines because we */
7259 /* do not iterate through either port numbers or IP addresses, searching */
7260 /* for a unique mapping, however, a complimentary duplicate check is made. */
7261 /* ------------------------------------------------------------------------ */
7263 ipf_nat_newdivert(fin, nat, nai)
7268 ipf_main_softc_t *softc = fin->fin_main_soft;
7269 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7276 bcopy((char *)fin, (char *)&frnat, sizeof(*fin));
7279 nat->nat_osrcaddr = fin->fin_saddr;
7280 nat->nat_odstaddr = fin->fin_daddr;
7281 frnat.fin_saddr = htonl(np->in_snip);
7282 frnat.fin_daddr = htonl(np->in_dnip);
7283 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
7284 nat->nat_osport = htons(fin->fin_data[0]);
7285 nat->nat_odport = htons(fin->fin_data[1]);
7286 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
7287 nat->nat_oicmpid = fin->fin_data[1];
7290 if (np->in_redir & NAT_DIVERTUDP) {
7291 frnat.fin_data[0] = np->in_spnext;
7292 frnat.fin_data[1] = np->in_dpnext;
7293 frnat.fin_flx |= FI_TCPUDP;
7296 frnat.fin_flx &= ~FI_TCPUDP;
7300 if (fin->fin_out == 1) {
7301 natl = ipf_nat_inlookup(&frnat, 0, p,
7302 frnat.fin_dst, frnat.fin_src);
7305 natl = ipf_nat_outlookup(&frnat, 0, p,
7306 frnat.fin_dst, frnat.fin_src);
7310 NBUMPSIDED(fin->fin_out, ns_divert_exist);
7314 nat->nat_nsrcaddr = frnat.fin_saddr;
7315 nat->nat_ndstaddr = frnat.fin_daddr;
7316 if ((nat->nat_flags & IPN_TCPUDP) != 0) {
7317 nat->nat_nsport = htons(frnat.fin_data[0]);
7318 nat->nat_ndport = htons(frnat.fin_data[1]);
7319 } else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
7320 nat->nat_nicmpid = frnat.fin_data[1];
7323 nat->nat_pr[fin->fin_out] = fin->fin_p;
7324 nat->nat_pr[1 - fin->fin_out] = p;
7326 if (np->in_redir & NAT_REDIRECT)
7327 nat->nat_dir = NAT_DIVERTIN;
7329 nat->nat_dir = NAT_DIVERTOUT;
7335 /* ------------------------------------------------------------------------ */
7336 /* Function: nat_builddivertmp */
7337 /* Returns: int - -1 == error, 0 == success */
7338 /* Parameters: softn(I) - pointer to NAT context structure */
7339 /* np(I) - pointer to a NAT rule */
7341 /* For divert rules, a skeleton packet representing what will be prepended */
7342 /* to the real packet is created. Even though we don't have the full */
7343 /* packet here, a checksum is calculated that we update later when we */
7344 /* fill in the final details. At present a 0 checksum for UDP is being set */
7345 /* here because it is expected that divert will be used for localhost. */
7346 /* ------------------------------------------------------------------------ */
7348 ipf_nat_builddivertmp(softn, np)
7349 ipf_nat_softc_t *softn;
7356 if ((np->in_redir & NAT_DIVERTUDP) != 0)
7357 len = sizeof(ip_t) + sizeof(udphdr_t);
7361 ALLOC_MB_T(np->in_divmp, len);
7362 if (np->in_divmp == NULL) {
7363 NBUMPD(ipf_nat_stats, ns_divert_build);
7368 * First, the header to get the packet diverted to the new destination
7370 ip = MTOD(np->in_divmp, ip_t *);
7374 if ((np->in_redir & NAT_DIVERTUDP) != 0)
7375 ip->ip_p = IPPROTO_UDP;
7377 ip->ip_p = IPPROTO_IPIP;
7381 ip->ip_len = htons(len);
7383 ip->ip_src.s_addr = htonl(np->in_snip);
7384 ip->ip_dst.s_addr = htonl(np->in_dnip);
7385 ip->ip_sum = ipf_cksum((u_short *)ip, sizeof(*ip));
7387 if (np->in_redir & NAT_DIVERTUDP) {
7388 uh = (udphdr_t *)(ip + 1);
7391 uh->uh_sport = htons(np->in_spnext);
7392 uh->uh_dport = htons(np->in_dpnext);
7399 #define MINDECAP (sizeof(ip_t) + sizeof(udphdr_t) + sizeof(ip_t))
7401 /* ------------------------------------------------------------------------ */
7402 /* Function: nat_decap */
7403 /* Returns: int - -1 == error, 0 == success */
7404 /* Parameters: fin(I) - pointer to packet information */
7405 /* nat(I) - pointer to current NAT session */
7407 /* This function is responsible for undoing a packet's encapsulation in the */
7408 /* reverse of an encap/divert rule. After removing the outer encapsulation */
7409 /* it is necessary to call ipf_makefrip() again so that the contents of 'fin'*/
7410 /* match the "new" packet as it may still be used by IPFilter elsewhere. */
7411 /* We use "dir" here as the basis for some of the expectations about the */
7412 /* outer header. If we return an error, the goal is to leave the original */
7413 /* packet information undisturbed - this falls short at the end where we'd */
7414 /* need to back a backup copy of "fin" - expensive. */
7415 /* ------------------------------------------------------------------------ */
7417 ipf_nat_decap(fin, nat)
7421 ipf_main_softc_t *softc = fin->fin_main_soft;
7422 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7428 if ((fin->fin_flx & FI_ICMPERR) != 0) {
7430 * ICMP packets don't get decapsulated, instead what we need
7431 * to do is change the ICMP reply from including (in the data
7432 * portion for errors) the encapsulated packet that we sent
7433 * out to something that resembles the original packet prior
7434 * to encapsulation. This isn't done here - all we're doing
7435 * here is changing the outer address to ensure that it gets
7436 * targetted back to the correct system.
7439 if (nat->nat_dir & NAT_OUTBOUND) {
7440 u_32_t sum1, sum2, sumd;
7442 sum1 = ntohl(fin->fin_daddr);
7443 sum2 = ntohl(nat->nat_osrcaddr);
7444 CALC_SUMD(sum1, sum2, sumd);
7445 fin->fin_ip->ip_dst = nat->nat_osrcip;
7446 fin->fin_daddr = nat->nat_osrcaddr;
7447 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
7448 defined(__osf__) || defined(linux)
7449 ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, sumd, 0);
7456 skip = fin->fin_hlen;
7458 switch (nat->nat_dir)
7461 case NAT_DIVERTOUT :
7462 if (fin->fin_plen < MINDECAP)
7464 skip += sizeof(udphdr_t);
7469 if (fin->fin_plen < (skip + sizeof(ip_t)))
7478 * The aim here is to keep the original packet details in "fin" for
7479 * as long as possible so that returning with an error is for the
7480 * original packet and there is little undoing work to do.
7482 if (M_LEN(m) < skip + sizeof(ip_t)) {
7483 if (ipf_pr_pullup(fin, skip + sizeof(ip_t)) == -1)
7487 hdr = MTOD(fin->fin_m, char *);
7488 fin->fin_ip = (ip_t *)(hdr + skip);
7489 hlen = IP_HL(fin->fin_ip) << 2;
7491 if (ipf_pr_pullup(fin, skip + hlen) == -1) {
7492 NBUMPSIDED(fin->fin_out, ns_decap_pullup);
7496 fin->fin_hlen = hlen;
7497 fin->fin_dlen -= skip;
7498 fin->fin_plen -= skip;
7499 fin->fin_ipoff += skip;
7501 if (ipf_makefrip(hlen, (ip_t *)hdr, fin) == -1) {
7502 NBUMPSIDED(fin->fin_out, ns_decap_bad);
7510 /* ------------------------------------------------------------------------ */
7511 /* Function: nat_nextaddr */
7512 /* Returns: int - -1 == bad input (no new address), */
7513 /* 0 == success and dst has new address */
7514 /* Parameters: fin(I) - pointer to packet information */
7515 /* na(I) - how to generate new address */
7516 /* old(I) - original address being replaced */
7517 /* dst(O) - where to put the new address */
7518 /* Write Lock: ipf_nat */
7520 /* This function uses the contents of the "na" structure, in combination */
7521 /* with "old" to produce a new address to store in "dst". Not all of the */
7522 /* possible uses of "na" will result in a new address. */
7523 /* ------------------------------------------------------------------------ */
7525 ipf_nat_nextaddr(fin, na, old, dst)
7530 ipf_main_softc_t *softc = fin->fin_main_soft;
7531 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
7532 u_32_t amin, amax, new;
7537 amin = na->na_addr[0].in4.s_addr;
7539 switch (na->na_atype)
7542 amax = na->na_addr[1].in4.s_addr;
7545 case FRI_NETMASKED :
7549 * Compute the maximum address by adding the inverse of the
7550 * netmask to the minimum address.
7552 amax = ~na->na_addr[1].in4.s_addr;
7559 case FRI_BROADCAST :
7568 if (na->na_atype == FRI_LOOKUP) {
7569 if (na->na_type == IPLT_DSTLIST) {
7570 error = ipf_dstlist_select_node(fin, na->na_ptr, dst,
7573 NBUMPSIDE(fin->fin_out, ns_badnextaddr);
7576 } else if (na->na_atype == IPLT_NONE) {
7578 * 0/0 as the new address means leave it alone.
7580 if (na->na_addr[0].in4.s_addr == 0 &&
7581 na->na_addr[1].in4.s_addr == 0) {
7585 * 0/32 means get the interface's address
7587 } else if (na->na_addr[0].in4.s_addr == 0 &&
7588 na->na_addr[1].in4.s_addr == 0xffffffff) {
7589 if (ipf_ifpaddr(softc, 4, na->na_atype,
7590 fin->fin_ifp, &newip, NULL) == -1) {
7591 NBUMPSIDED(fin->fin_out, ns_ifpaddrfail);
7594 new = newip.in4.s_addr;
7596 new = htonl(na->na_nextip);
7602 NBUMPSIDE(fin->fin_out, ns_badnextaddr);
7609 /* ------------------------------------------------------------------------ */
7610 /* Function: nat_nextaddrinit */
7611 /* Returns: int - 0 == success, else error number */
7612 /* Parameters: softc(I) - pointer to soft context main structure */
7613 /* na(I) - NAT address information for generating new addr*/
7614 /* initial(I) - flag indicating if it is the first call for */
7615 /* this "na" structure. */
7616 /* ifp(I) - network interface to derive address */
7617 /* information from. */
7619 /* This function is expected to be called in two scenarious: when a new NAT */
7620 /* rule is loaded into the kernel and when the list of NAT rules is sync'd */
7621 /* up with the valid network interfaces (possibly due to them changing.) */
7622 /* To distinguish between these, the "initial" parameter is used. If it is */
7623 /* 1 then this indicates the rule has just been reloaded and 0 for when we */
7624 /* are updating information. This difference is important because in */
7625 /* instances where we are not updating address information associated with */
7626 /* a network interface, we don't want to disturb what the "next" address to */
7627 /* come out of ipf_nat_nextaddr() will be. */
7628 /* ------------------------------------------------------------------------ */
7630 ipf_nat_nextaddrinit(softc, base, na, initial, ifp)
7631 ipf_main_softc_t *softc;
7638 switch (na->na_atype)
7641 if (na->na_subtype == 0) {
7642 na->na_ptr = ipf_lookup_res_num(softc, IPL_LOGNAT,
7646 } else if (na->na_subtype == 1) {
7647 na->na_ptr = ipf_lookup_res_name(softc, IPL_LOGNAT,
7652 if (na->na_func == NULL) {
7656 if (na->na_ptr == NULL) {
7663 case FRI_BROADCAST :
7665 case FRI_NETMASKED :
7668 (void )ipf_ifpaddr(softc, 4, na->na_atype, ifp,
7669 &na->na_addr[0], &na->na_addr[1]);
7675 na->na_nextip = ntohl(na->na_addr[0].in4.s_addr);
7679 na->na_addr[0].in4.s_addr &= na->na_addr[1].in4.s_addr;
7683 na->na_addr[0].in4.s_addr &= na->na_addr[1].in4.s_addr;
7691 if (initial && (na->na_atype == FRI_NORMAL)) {
7692 if (na->na_addr[0].in4.s_addr == 0) {
7693 if ((na->na_addr[1].in4.s_addr == 0xffffffff) ||
7694 (na->na_addr[1].in4.s_addr == 0)) {
7699 if (na->na_addr[1].in4.s_addr == 0xffffffff) {
7700 na->na_nextip = ntohl(na->na_addr[0].in4.s_addr);
7702 na->na_nextip = ntohl(na->na_addr[0].in4.s_addr) + 1;
7710 /* ------------------------------------------------------------------------ */
7711 /* Function: ipf_nat_matchflush */
7712 /* Returns: int - -1 == error, 0 == success */
7713 /* Parameters: softc(I) - pointer to soft context main structure */
7714 /* softn(I) - pointer to NAT context structure */
7715 /* nat(I) - pointer to current NAT session */
7717 /* ------------------------------------------------------------------------ */
7719 ipf_nat_matchflush(softc, softn, data)
7720 ipf_main_softc_t *softc;
7721 ipf_nat_softc_t *softn;
7724 int *array, flushed, error;
7725 nat_t *nat, *natnext;
7728 error = ipf_matcharray_load(softc, data, &obj, &array);
7734 for (nat = softn->ipf_nat_instances; nat != NULL; nat = natnext) {
7735 natnext = nat->nat_next;
7736 if (ipf_nat_matcharray(nat, array, softc->ipf_ticks) == 0) {
7737 ipf_nat_delete(softc, nat, NL_FLUSH);
7742 obj.ipfo_retval = flushed;
7743 error = BCOPYOUT(&obj, data, sizeof(obj));
7745 KFREES(array, array[0] * sizeof(*array));
7751 /* ------------------------------------------------------------------------ */
7752 /* Function: ipf_nat_matcharray */
7753 /* Returns: int - -1 == error, 0 == success */
7754 /* Parameters: fin(I) - pointer to packet information */
7755 /* nat(I) - pointer to current NAT session */
7757 /* ------------------------------------------------------------------------ */
7759 ipf_nat_matcharray(nat, array, ticks)
7770 for (; n > 0; x += 3 + x[2]) {
7771 if (x[0] == IPF_EXP_END)
7780 if (p != 0 && p != nat->nat_pr[1])
7785 case IPF_EXP_IP_PR :
7786 for (i = 0; !e && i < x[2]; i++) {
7787 e |= (nat->nat_pr[1] == x[i + 3]);
7791 case IPF_EXP_IP_SRCADDR :
7792 if (nat->nat_v[0] == 4) {
7793 for (i = 0; !e && i < x[2]; i++) {
7794 e |= ((nat->nat_osrcaddr & x[i + 4]) ==
7798 if (nat->nat_v[1] == 4) {
7799 for (i = 0; !e && i < x[2]; i++) {
7800 e |= ((nat->nat_nsrcaddr & x[i + 4]) ==
7806 case IPF_EXP_IP_DSTADDR :
7807 if (nat->nat_v[0] == 4) {
7808 for (i = 0; !e && i < x[2]; i++) {
7809 e |= ((nat->nat_odstaddr & x[i + 4]) ==
7813 if (nat->nat_v[1] == 4) {
7814 for (i = 0; !e && i < x[2]; i++) {
7815 e |= ((nat->nat_ndstaddr & x[i + 4]) ==
7821 case IPF_EXP_IP_ADDR :
7822 for (i = 0; !e && i < x[2]; i++) {
7823 if (nat->nat_v[0] == 4) {
7824 e |= ((nat->nat_osrcaddr & x[i + 4]) ==
7827 if (nat->nat_v[1] == 4) {
7828 e |= ((nat->nat_nsrcaddr & x[i + 4]) ==
7831 if (nat->nat_v[0] == 4) {
7832 e |= ((nat->nat_odstaddr & x[i + 4]) ==
7835 if (nat->nat_v[1] == 4) {
7836 e |= ((nat->nat_ndstaddr & x[i + 4]) ==
7843 case IPF_EXP_IP6_SRCADDR :
7844 if (nat->nat_v[0] == 6) {
7845 for (i = 0; !e && i < x[3]; i++) {
7846 e |= IP6_MASKEQ(&nat->nat_osrc6,
7847 x + i + 7, x + i + 3);
7850 if (nat->nat_v[1] == 6) {
7851 for (i = 0; !e && i < x[3]; i++) {
7852 e |= IP6_MASKEQ(&nat->nat_nsrc6,
7853 x + i + 7, x + i + 3);
7858 case IPF_EXP_IP6_DSTADDR :
7859 if (nat->nat_v[0] == 6) {
7860 for (i = 0; !e && i < x[3]; i++) {
7861 e |= IP6_MASKEQ(&nat->nat_odst6,
7866 if (nat->nat_v[1] == 6) {
7867 for (i = 0; !e && i < x[3]; i++) {
7868 e |= IP6_MASKEQ(&nat->nat_ndst6,
7875 case IPF_EXP_IP6_ADDR :
7876 for (i = 0; !e && i < x[3]; i++) {
7877 if (nat->nat_v[0] == 6) {
7878 e |= IP6_MASKEQ(&nat->nat_osrc6,
7882 if (nat->nat_v[0] == 6) {
7883 e |= IP6_MASKEQ(&nat->nat_odst6,
7887 if (nat->nat_v[1] == 6) {
7888 e |= IP6_MASKEQ(&nat->nat_nsrc6,
7892 if (nat->nat_v[1] == 6) {
7893 e |= IP6_MASKEQ(&nat->nat_ndst6,
7901 case IPF_EXP_UDP_PORT :
7902 case IPF_EXP_TCP_PORT :
7903 for (i = 0; !e && i < x[2]; i++) {
7904 e |= (nat->nat_nsport == x[i + 3]) ||
7905 (nat->nat_ndport == x[i + 3]);
7909 case IPF_EXP_UDP_SPORT :
7910 case IPF_EXP_TCP_SPORT :
7911 for (i = 0; !e && i < x[2]; i++) {
7912 e |= (nat->nat_nsport == x[i + 3]);
7916 case IPF_EXP_UDP_DPORT :
7917 case IPF_EXP_TCP_DPORT :
7918 for (i = 0; !e && i < x[2]; i++) {
7919 e |= (nat->nat_ndport == x[i + 3]);
7923 case IPF_EXP_TCP_STATE :
7924 for (i = 0; !e && i < x[2]; i++) {
7925 e |= (nat->nat_tcpstate[0] == x[i + 3]) ||
7926 (nat->nat_tcpstate[1] == x[i + 3]);
7930 case IPF_EXP_IDLE_GT :
7931 e |= (ticks - nat->nat_touched > x[3]);
7944 /* ------------------------------------------------------------------------ */
7945 /* Function: ipf_nat_gettable */
7946 /* Returns: int - 0 = success, else error */
7947 /* Parameters: softc(I) - pointer to soft context main structure */
7948 /* softn(I) - pointer to NAT context structure */
7949 /* data(I) - pointer to ioctl data */
7951 /* This function handles ioctl requests for tables of nat information. */
7952 /* At present the only table it deals with is the hash bucket statistics. */
7953 /* ------------------------------------------------------------------------ */
7955 ipf_nat_gettable(softc, softn, data)
7956 ipf_main_softc_t *softc;
7957 ipf_nat_softc_t *softn;
7963 error = ipf_inobj(softc, data, NULL, &table, IPFOBJ_GTABLE);
7967 switch (table.ita_type)
7969 case IPFTABLE_BUCKETS_NATIN :
7970 error = COPYOUT(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
7972 softn->ipf_nat_table_sz * sizeof(u_int));
7975 case IPFTABLE_BUCKETS_NATOUT :
7976 error = COPYOUT(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
7978 softn->ipf_nat_table_sz * sizeof(u_int));
7994 /* ------------------------------------------------------------------------ */
7995 /* Function: ipf_nat_settimeout */
7996 /* Returns: int - 0 = success, else failure */
7997 /* Parameters: softc(I) - pointer to soft context main structure */
7998 /* t(I) - pointer to tunable */
7999 /* p(I) - pointer to new tuning data */
8001 /* Apply the timeout change to the NAT timeout queues. */
8002 /* ------------------------------------------------------------------------ */
8004 ipf_nat_settimeout(softc, t, p)
8005 struct ipf_main_softc_s *softc;
8009 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8011 if (!strncmp(t->ipft_name, "tcp_", 4))
8012 return ipf_settimeout_tcp(t, p, softn->ipf_nat_tcptq);
8014 if (!strcmp(t->ipft_name, "udp_timeout")) {
8015 ipf_apply_timeout(&softn->ipf_nat_udptq, p->ipftu_int);
8016 } else if (!strcmp(t->ipft_name, "udp_ack_timeout")) {
8017 ipf_apply_timeout(&softn->ipf_nat_udpacktq, p->ipftu_int);
8018 } else if (!strcmp(t->ipft_name, "icmp_timeout")) {
8019 ipf_apply_timeout(&softn->ipf_nat_icmptq, p->ipftu_int);
8020 } else if (!strcmp(t->ipft_name, "icmp_ack_timeout")) {
8021 ipf_apply_timeout(&softn->ipf_nat_icmpacktq, p->ipftu_int);
8022 } else if (!strcmp(t->ipft_name, "ip_timeout")) {
8023 ipf_apply_timeout(&softn->ipf_nat_iptq, p->ipftu_int);
8032 /* ------------------------------------------------------------------------ */
8033 /* Function: ipf_nat_rehash */
8034 /* Returns: int - 0 = success, else failure */
8035 /* Parameters: softc(I) - pointer to soft context main structure */
8036 /* t(I) - pointer to tunable */
8037 /* p(I) - pointer to new tuning data */
8039 /* To change the size of the basic NAT table, we need to first allocate the */
8040 /* new tables (lest it fails and we've got nowhere to store all of the NAT */
8041 /* sessions currently active) and then walk through the entire list and */
8042 /* insert them into the table. There are two tables here: an inbound one */
8043 /* and an outbound one. Each NAT entry goes into each table once. */
8044 /* ------------------------------------------------------------------------ */
8046 ipf_nat_rehash(softc, t, p)
8047 ipf_main_softc_t *softc;
8051 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8052 nat_t **newtab[2], *nat, **natp;
8053 u_int *bucketlens[2];
8060 newsize = p->ipftu_int;
8062 * In case there is nothing to do...
8064 if (newsize == softn->ipf_nat_table_sz)
8069 bucketlens[0] = NULL;
8070 bucketlens[1] = NULL;
8072 * 4 tables depend on the NAT table size: the inbound looking table,
8073 * the outbound lookup table and the hash chain length for each.
8075 KMALLOCS(newtab[0], nat_t **, newsize * sizeof(nat_t *));
8076 if (newtab == NULL) {
8081 KMALLOCS(newtab[1], nat_t **, newsize * sizeof(nat_t *));
8082 if (newtab == NULL) {
8087 KMALLOCS(bucketlens[0], u_int *, newsize * sizeof(u_int));
8088 if (bucketlens[0] == NULL) {
8093 KMALLOCS(bucketlens[1], u_int *, newsize * sizeof(u_int));
8094 if (bucketlens[1] == NULL) {
8100 * Recalculate the maximum length based on the new size.
8102 for (maxbucket = 0, i = newsize; i > 0; i >>= 1)
8106 bzero((char *)newtab[0], newsize * sizeof(nat_t *));
8107 bzero((char *)newtab[1], newsize * sizeof(nat_t *));
8108 bzero((char *)bucketlens[0], newsize * sizeof(u_int));
8109 bzero((char *)bucketlens[1], newsize * sizeof(u_int));
8111 WRITE_ENTER(&softc->ipf_nat);
8113 if (softn->ipf_nat_table[0] != NULL) {
8114 KFREES(softn->ipf_nat_table[0],
8115 softn->ipf_nat_table_sz *
8116 sizeof(*softn->ipf_nat_table[0]));
8118 softn->ipf_nat_table[0] = newtab[0];
8120 if (softn->ipf_nat_table[1] != NULL) {
8121 KFREES(softn->ipf_nat_table[1],
8122 softn->ipf_nat_table_sz *
8123 sizeof(*softn->ipf_nat_table[1]));
8125 softn->ipf_nat_table[1] = newtab[1];
8127 if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen != NULL) {
8128 KFREES(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
8129 softn->ipf_nat_table_sz * sizeof(u_int));
8131 softn->ipf_nat_stats.ns_side[0].ns_bucketlen = bucketlens[0];
8133 if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen != NULL) {
8134 KFREES(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
8135 softn->ipf_nat_table_sz * sizeof(u_int));
8137 softn->ipf_nat_stats.ns_side[1].ns_bucketlen = bucketlens[1];
8140 if (softn->ipf_nat_stats.ns_side6[0].ns_bucketlen != NULL) {
8141 KFREES(softn->ipf_nat_stats.ns_side6[0].ns_bucketlen,
8142 softn->ipf_nat_table_sz * sizeof(u_int));
8144 softn->ipf_nat_stats.ns_side6[0].ns_bucketlen = bucketlens[0];
8146 if (softn->ipf_nat_stats.ns_side6[1].ns_bucketlen != NULL) {
8147 KFREES(softn->ipf_nat_stats.ns_side6[1].ns_bucketlen,
8148 softn->ipf_nat_table_sz * sizeof(u_int));
8150 softn->ipf_nat_stats.ns_side6[1].ns_bucketlen = bucketlens[1];
8153 softn->ipf_nat_maxbucket = maxbucket;
8154 softn->ipf_nat_table_sz = newsize;
8156 * Walk through the entire list of NAT table entries and put them
8157 * in the new NAT table, somewhere. Because we have a new table,
8158 * we need to restart the counter of how many chains are in use.
8160 softn->ipf_nat_stats.ns_side[0].ns_inuse = 0;
8161 softn->ipf_nat_stats.ns_side[1].ns_inuse = 0;
8163 softn->ipf_nat_stats.ns_side6[0].ns_inuse = 0;
8164 softn->ipf_nat_stats.ns_side6[1].ns_inuse = 0;
8167 for (nat = softn->ipf_nat_instances; nat != NULL; nat = nat->nat_next) {
8168 nat->nat_hnext[0] = NULL;
8169 nat->nat_phnext[0] = NULL;
8170 hv = nat->nat_hv[0] % softn->ipf_nat_table_sz;
8172 natp = &softn->ipf_nat_table[0][hv];
8174 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
8176 NBUMPSIDE(0, ns_inuse);
8178 nat->nat_phnext[0] = natp;
8179 nat->nat_hnext[0] = *natp;
8181 NBUMPSIDE(0, ns_bucketlen[hv]);
8183 nat->nat_hnext[1] = NULL;
8184 nat->nat_phnext[1] = NULL;
8185 hv = nat->nat_hv[1] % softn->ipf_nat_table_sz;
8187 natp = &softn->ipf_nat_table[1][hv];
8189 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
8191 NBUMPSIDE(1, ns_inuse);
8193 nat->nat_phnext[1] = natp;
8194 nat->nat_hnext[1] = *natp;
8196 NBUMPSIDE(1, ns_bucketlen[hv]);
8198 RWLOCK_EXIT(&softc->ipf_nat);
8203 if (bucketlens[1] != NULL) {
8204 KFREES(bucketlens[0], newsize * sizeof(u_int));
8206 if (bucketlens[0] != NULL) {
8207 KFREES(bucketlens[0], newsize * sizeof(u_int));
8209 if (newtab[0] != NULL) {
8210 KFREES(newtab[0], newsize * sizeof(nat_t *));
8212 if (newtab[1] != NULL) {
8213 KFREES(newtab[1], newsize * sizeof(nat_t *));
8220 /* ------------------------------------------------------------------------ */
8221 /* Function: ipf_nat_rehash_rules */
8222 /* Returns: int - 0 = success, else failure */
8223 /* Parameters: softc(I) - pointer to soft context main structure */
8224 /* t(I) - pointer to tunable */
8225 /* p(I) - pointer to new tuning data */
8227 /* All of the NAT rules hang off of a hash table that is searched with a */
8228 /* hash on address after the netmask is applied. There is a different table*/
8229 /* for both inbound rules (rdr) and outbound (map.) The resizing will only */
8230 /* affect one of these two tables. */
8231 /* ------------------------------------------------------------------------ */
8233 ipf_nat_rehash_rules(softc, t, p)
8234 ipf_main_softc_t *softc;
8238 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8239 ipnat_t **newtab, *np, ***old, **npp;
8244 newsize = p->ipftu_int;
8246 * In case there is nothing to do...
8248 if (newsize == *t->ipft_pint)
8252 * All inbound rules have the NAT_REDIRECT bit set in in_redir and
8253 * all outbound rules have either NAT_MAP or MAT_MAPBLK set.
8254 * This if statement allows for some more generic code to be below,
8255 * rather than two huge gobs of code that almost do the same thing.
8257 if (t->ipft_pint == &softn->ipf_nat_rdrrules_sz) {
8258 old = &softn->ipf_nat_rdr_rules;
8259 mask = NAT_REDIRECT;
8261 old = &softn->ipf_nat_map_rules;
8262 mask = NAT_MAP|NAT_MAPBLK;
8265 KMALLOCS(newtab, ipnat_t **, newsize * sizeof(ipnat_t *));
8266 if (newtab == NULL) {
8271 bzero((char *)newtab, newsize * sizeof(ipnat_t *));
8273 WRITE_ENTER(&softc->ipf_nat);
8276 KFREES(*old, *t->ipft_pint * sizeof(ipnat_t **));
8279 *t->ipft_pint = newsize;
8281 for (np = softn->ipf_nat_list; np != NULL; np = np->in_next) {
8282 if ((np->in_redir & mask) == 0)
8285 if (np->in_redir & NAT_REDIRECT) {
8286 np->in_rnext = NULL;
8287 hv = np->in_hv[0] % newsize;
8288 for (npp = newtab + hv; *npp != NULL; )
8289 npp = &(*npp)->in_rnext;
8290 np->in_prnext = npp;
8293 if (np->in_redir & NAT_MAP) {
8294 np->in_mnext = NULL;
8295 hv = np->in_hv[1] % newsize;
8296 for (npp = newtab + hv; *npp != NULL; )
8297 npp = &(*npp)->in_mnext;
8298 np->in_pmnext = npp;
8303 RWLOCK_EXIT(&softc->ipf_nat);
8309 /* ------------------------------------------------------------------------ */
8310 /* Function: ipf_nat_hostmap_rehash */
8311 /* Returns: int - 0 = success, else failure */
8312 /* Parameters: softc(I) - pointer to soft context main structure */
8313 /* t(I) - pointer to tunable */
8314 /* p(I) - pointer to new tuning data */
8316 /* Allocate and populate a new hash table that will contain a reference to */
8317 /* all of the active IP# translations currently in place. */
8318 /* ------------------------------------------------------------------------ */
8320 ipf_nat_hostmap_rehash(softc, t, p)
8321 ipf_main_softc_t *softc;
8325 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8326 hostmap_t *hm, **newtab;
8330 newsize = p->ipftu_int;
8332 * In case there is nothing to do...
8334 if (newsize == *t->ipft_pint)
8337 KMALLOCS(newtab, hostmap_t **, newsize * sizeof(hostmap_t *));
8338 if (newtab == NULL) {
8343 bzero((char *)newtab, newsize * sizeof(hostmap_t *));
8345 WRITE_ENTER(&softc->ipf_nat);
8346 if (softn->ipf_hm_maptable != NULL) {
8347 KFREES(softn->ipf_hm_maptable,
8348 softn->ipf_nat_hostmap_sz * sizeof(hostmap_t *));
8350 softn->ipf_hm_maptable = newtab;
8351 softn->ipf_nat_hostmap_sz = newsize;
8353 for (hm = softn->ipf_hm_maplist; hm != NULL; hm = hm->hm_next) {
8354 hv = hm->hm_hv % softn->ipf_nat_hostmap_sz;
8355 hm->hm_hnext = softn->ipf_hm_maptable[hv];
8356 hm->hm_phnext = softn->ipf_hm_maptable + hv;
8357 if (softn->ipf_hm_maptable[hv] != NULL)
8358 softn->ipf_hm_maptable[hv]->hm_phnext = &hm->hm_hnext;
8359 softn->ipf_hm_maptable[hv] = hm;
8361 RWLOCK_EXIT(&softc->ipf_nat);
8367 /* ------------------------------------------------------------------------ */
8368 /* Function: ipf_nat_add_tq */
8369 /* Parameters: softc(I) - pointer to soft context main structure */
8371 /* ------------------------------------------------------------------------ */
8373 ipf_nat_add_tq(softc, ttl)
8374 ipf_main_softc_t *softc;
8377 ipf_nat_softc_t *softs = softc->ipf_nat_soft;
8379 return ipf_addtimeoutqueue(softc, &softs->ipf_nat_utqe, ttl);
8382 /* ------------------------------------------------------------------------ */
8383 /* Function: ipf_nat_uncreate */
8385 /* Parameters: fin(I) - pointer to packet information */
8387 /* This function is used to remove a NAT entry from the NAT table when we */
8388 /* decide that the create was actually in error. It is thus assumed that */
8389 /* fin_flx will have both FI_NATED and FI_NATNEW set. Because we're dealing */
8390 /* with the translated packet (not the original), we have to reverse the */
8391 /* lookup. Although doing the lookup is expensive (relatively speaking), it */
8392 /* is not anticipated that this will be a frequent occurance for normal */
8393 /* traffic patterns. */
8394 /* ------------------------------------------------------------------------ */
8396 ipf_nat_uncreate(fin)
8399 ipf_main_softc_t *softc = fin->fin_main_soft;
8400 ipf_nat_softc_t *softn = softc->ipf_nat_soft;
8417 WRITE_ENTER(&softc->ipf_nat);
8419 if (fin->fin_out == 0) {
8420 nat = ipf_nat_outlookup(fin, nflags, (u_int)fin->fin_p,
8421 fin->fin_dst, fin->fin_src);
8423 nat = ipf_nat_inlookup(fin, nflags, (u_int)fin->fin_p,
8424 fin->fin_src, fin->fin_dst);
8428 NBUMPSIDE(fin->fin_out, ns_uncreate[0]);
8429 ipf_nat_delete(softc, nat, NL_DESTROY);
8431 NBUMPSIDE(fin->fin_out, ns_uncreate[1]);
8434 RWLOCK_EXIT(&softc->ipf_nat);
8438 /* ------------------------------------------------------------------------ */
8439 /* Function: ipf_nat_cmp_rules */
8440 /* Returns: int - 0 == success, else rules do not match. */
8441 /* Parameters: n1(I) - first rule to compare */
8442 /* n2(I) - first rule to compare */
8444 /* Compare two rules using pointers to each rule. A straight bcmp will not */
8445 /* work as some fields (such as in_dst, in_pkts) actually do change once */
8446 /* the rule has been loaded into the kernel. Whilst this function returns */
8447 /* various non-zero returns, they're strictly to aid in debugging. Use of */
8448 /* this function should simply care if the result is zero or not. */
8449 /* ------------------------------------------------------------------------ */
8451 ipf_nat_cmp_rules(n1, n2)
8454 if (n1->in_size != n2->in_size)
8457 if (bcmp((char *)&n1->in_v, (char *)&n2->in_v,
8458 offsetof(ipnat_t, in_ndst) - offsetof(ipnat_t, in_v)) != 0)
8461 if (bcmp((char *)&n1->in_tuc, (char *)&n2->in_tuc,
8462 n1->in_size - offsetof(ipnat_t, in_tuc)) != 0)
8464 if (n1->in_ndst.na_atype != n2->in_ndst.na_atype)
8466 if (n1->in_ndst.na_function != n2->in_ndst.na_function)
8468 if (bcmp((char *)&n1->in_ndst.na_addr, (char *)&n2->in_ndst.na_addr,
8469 sizeof(n1->in_ndst.na_addr)))
8471 if (n1->in_nsrc.na_atype != n2->in_nsrc.na_atype)
8473 if (n1->in_nsrc.na_function != n2->in_nsrc.na_function)
8475 if (bcmp((char *)&n1->in_nsrc.na_addr, (char *)&n2->in_nsrc.na_addr,
8476 sizeof(n1->in_nsrc.na_addr)))
8478 if (n1->in_odst.na_atype != n2->in_odst.na_atype)
8480 if (n1->in_odst.na_function != n2->in_odst.na_function)
8482 if (bcmp((char *)&n1->in_odst.na_addr, (char *)&n2->in_odst.na_addr,
8483 sizeof(n1->in_odst.na_addr)))
8485 if (n1->in_osrc.na_atype != n2->in_osrc.na_atype)
8487 if (n1->in_osrc.na_function != n2->in_osrc.na_function)
8489 if (bcmp((char *)&n1->in_osrc.na_addr, (char *)&n2->in_osrc.na_addr,
8490 sizeof(n1->in_osrc.na_addr)))
8496 /* ------------------------------------------------------------------------ */
8497 /* Function: ipf_nat_rule_init */
8498 /* Returns: int - 0 == success, else rules do not match. */
8499 /* Parameters: softc(I) - pointer to soft context main structure */
8500 /* softn(I) - pointer to NAT context structure */
8501 /* n(I) - first rule to compare */
8503 /* ------------------------------------------------------------------------ */
8505 ipf_nat_rule_init(softc, softn, n)
8506 ipf_main_softc_t *softc;
8507 ipf_nat_softc_t *softn;
8512 if ((n->in_flags & IPN_SIPRANGE) != 0)
8513 n->in_nsrcatype = FRI_RANGE;
8515 if ((n->in_flags & IPN_DIPRANGE) != 0)
8516 n->in_ndstatype = FRI_RANGE;
8518 if ((n->in_flags & IPN_SPLIT) != 0)
8519 n->in_ndstatype = FRI_SPLIT;
8521 if ((n->in_redir & (NAT_MAP|NAT_REWRITE|NAT_DIVERTUDP)) != 0)
8522 n->in_spnext = n->in_spmin;
8524 if ((n->in_redir & (NAT_REWRITE|NAT_DIVERTUDP)) != 0) {
8525 n->in_dpnext = n->in_dpmin;
8526 } else if (n->in_redir == NAT_REDIRECT) {
8527 n->in_dpnext = n->in_dpmin;
8535 error = ipf_nat_ruleaddrinit(softc, softn, n);
8541 error = ipf_nat6_ruleaddrinit(softc, softn, n);
8550 if (n->in_redir == (NAT_DIVERTUDP|NAT_MAP)) {
8552 * Prerecord whether or not the destination of the divert
8553 * is local or not to the interface the packet is going
8556 n->in_dlocal = ipf_deliverlocal(softc, n->in_v[1],
8557 n->in_ifps[1], &n->in_ndstip6);
8564 /* ------------------------------------------------------------------------ */
8565 /* Function: ipf_nat_rule_fini */
8566 /* Returns: int - 0 == success, else rules do not match. */
8567 /* Parameters: softc(I) - pointer to soft context main structure */
8568 /* n(I) - rule to work on */
8570 /* This function is used to release any objects that were referenced during */
8571 /* the rule initialisation. This is useful both when free'ing the rule and */
8572 /* when handling ioctls that need to initialise these fields but not */
8573 /* actually use them after the ioctl processing has finished. */
8574 /* ------------------------------------------------------------------------ */
8576 ipf_nat_rule_fini(softc, n)
8577 ipf_main_softc_t *softc;
8580 if (n->in_odst.na_atype == FRI_LOOKUP && n->in_odst.na_ptr != NULL)
8581 ipf_lookup_deref(softc, n->in_odst.na_type, n->in_odst.na_ptr);
8583 if (n->in_osrc.na_atype == FRI_LOOKUP && n->in_osrc.na_ptr != NULL)
8584 ipf_lookup_deref(softc, n->in_osrc.na_type, n->in_osrc.na_ptr);
8586 if (n->in_ndst.na_atype == FRI_LOOKUP && n->in_ndst.na_ptr != NULL)
8587 ipf_lookup_deref(softc, n->in_ndst.na_type, n->in_ndst.na_ptr);
8589 if (n->in_nsrc.na_atype == FRI_LOOKUP && n->in_nsrc.na_ptr != NULL)
8590 ipf_lookup_deref(softc, n->in_nsrc.na_type, n->in_nsrc.na_ptr);
8592 if (n->in_divmp != NULL)
8593 FREE_MB_T(n->in_divmp);