17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * Copyright (C) 1993-2001 by Darren Reed.
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * See the IPFILTER.LICENCE file for details on licencing.
57c478bd9Sstevel@tonic-gate *
67c478bd9Sstevel@tonic-gate * Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com)
77c478bd9Sstevel@tonic-gate *
8786c7074Sjojemann * Copyright 2008 Sun Microsystems, Inc. All rights reserved.
97c478bd9Sstevel@tonic-gate * Use is subject to license terms.
1094bdecd9SRob Gulewich *
1194bdecd9SRob Gulewich * Copyright (c) 2014, Joyent, Inc. All rights reserved.
127c478bd9Sstevel@tonic-gate */
137c478bd9Sstevel@tonic-gate
147c478bd9Sstevel@tonic-gate #include <stdio.h>
157c478bd9Sstevel@tonic-gate #include <string.h>
167c478bd9Sstevel@tonic-gate #include <fcntl.h>
177c478bd9Sstevel@tonic-gate #include <errno.h>
187c478bd9Sstevel@tonic-gate #include <sys/types.h>
197c478bd9Sstevel@tonic-gate #if !defined(__SVR4) && !defined(__svr4__)
207c478bd9Sstevel@tonic-gate #include <strings.h>
217c478bd9Sstevel@tonic-gate #else
227c478bd9Sstevel@tonic-gate #include <sys/byteorder.h>
237c478bd9Sstevel@tonic-gate #endif
247c478bd9Sstevel@tonic-gate #include <sys/time.h>
257c478bd9Sstevel@tonic-gate #include <sys/param.h>
267c478bd9Sstevel@tonic-gate #include <stdlib.h>
277c478bd9Sstevel@tonic-gate #include <unistd.h>
287c478bd9Sstevel@tonic-gate #include <stddef.h>
297c478bd9Sstevel@tonic-gate #include <sys/file.h>
30*64410b34SToomas Soome #define _KERNEL
317c478bd9Sstevel@tonic-gate #include <sys/uio.h>
327c478bd9Sstevel@tonic-gate #undef _KERNEL
337c478bd9Sstevel@tonic-gate #include <sys/socket.h>
347c478bd9Sstevel@tonic-gate #include <sys/ioctl.h>
357c478bd9Sstevel@tonic-gate #if defined(sun) && (defined(__svr4__) || defined(__SVR4))
36*64410b34SToomas Soome #include <sys/ioccom.h>
37*64410b34SToomas Soome #include <sys/sysmacros.h>
387c478bd9Sstevel@tonic-gate #endif
397c478bd9Sstevel@tonic-gate #include <netinet/in.h>
407c478bd9Sstevel@tonic-gate #include <netinet/in_systm.h>
417c478bd9Sstevel@tonic-gate #include <netinet/ip.h>
427c478bd9Sstevel@tonic-gate #include <netinet/tcp.h>
437c478bd9Sstevel@tonic-gate #include <net/if.h>
447c478bd9Sstevel@tonic-gate #if __FreeBSD_version >= 300000
45*64410b34SToomas Soome #include <net/if_var.h>
467c478bd9Sstevel@tonic-gate #endif
477c478bd9Sstevel@tonic-gate #include <netdb.h>
487c478bd9Sstevel@tonic-gate #include <arpa/nameser.h>
497c478bd9Sstevel@tonic-gate #include <arpa/inet.h>
507c478bd9Sstevel@tonic-gate #include <resolv.h>
517c478bd9Sstevel@tonic-gate #include <ctype.h>
52ab25eeb5Syz #if defined(linux)
53*64410b34SToomas Soome #include <linux/a.out.h>
54ab25eeb5Syz #else
55*64410b34SToomas Soome #include <nlist.h>
56ab25eeb5Syz #endif
577c478bd9Sstevel@tonic-gate #include "ipf.h"
58ab25eeb5Syz #include "netinet/ipl.h"
597c478bd9Sstevel@tonic-gate #include "kmem.h"
6094bdecd9SRob Gulewich #include "ipfzone.h"
617c478bd9Sstevel@tonic-gate
627c478bd9Sstevel@tonic-gate #ifdef __hpux
63*64410b34SToomas Soome #define nlist nlist64
647c478bd9Sstevel@tonic-gate #endif
657c478bd9Sstevel@tonic-gate
667c478bd9Sstevel@tonic-gate #if defined(sun) && !SOLARIS2
67*64410b34SToomas Soome #define STRERROR(x) sys_errlist[x]
687c478bd9Sstevel@tonic-gate extern char *sys_errlist[];
697c478bd9Sstevel@tonic-gate #else
70*64410b34SToomas Soome #define STRERROR(x) strerror(x)
717c478bd9Sstevel@tonic-gate #endif
727c478bd9Sstevel@tonic-gate
737c478bd9Sstevel@tonic-gate int use_inet6 = 0;
74*64410b34SToomas Soome extern char thishost[MAXHOSTNAMELEN];
757c478bd9Sstevel@tonic-gate
767c478bd9Sstevel@tonic-gate extern char *optarg;
777c478bd9Sstevel@tonic-gate
78f4b3ec61Sdh void dostats __P((int, natstat_t *, int, int));
79f4b3ec61Sdh void flushtable __P((int, int));
807c478bd9Sstevel@tonic-gate void usage __P((char *));
81*64410b34SToomas Soome int main __P((int, char *[]));
827c478bd9Sstevel@tonic-gate void showhostmap __P((natstat_t *nsp));
837c478bd9Sstevel@tonic-gate void natstat_dead __P((natstat_t *, char *));
84f4b3ec61Sdh void dostats_live __P((int, natstat_t *, int));
85f4b3ec61Sdh void showhostmap_live __P((int, natstat_t *));
867c478bd9Sstevel@tonic-gate
877c478bd9Sstevel@tonic-gate int opts;
887c478bd9Sstevel@tonic-gate
89*64410b34SToomas Soome void
usage(char * name)90*64410b34SToomas Soome usage(char *name)
917c478bd9Sstevel@tonic-gate {
9294bdecd9SRob Gulewich fprintf(stderr, "Usage: %s [-CdFhlnrRsv] [-f filename]", name);
9394bdecd9SRob Gulewich fprintf(stderr, " [-G|-z zonename]\n");
947c478bd9Sstevel@tonic-gate exit(1);
957c478bd9Sstevel@tonic-gate }
967c478bd9Sstevel@tonic-gate
977c478bd9Sstevel@tonic-gate
98*64410b34SToomas Soome int
main(int argc,char * argv[])99*64410b34SToomas Soome main(int argc, char *argv[])
1007c478bd9Sstevel@tonic-gate {
1017c478bd9Sstevel@tonic-gate char *file, *core, *kernel;
1027c478bd9Sstevel@tonic-gate natstat_t ns, *nsp;
1037c478bd9Sstevel@tonic-gate int fd, c, mode;
1047c478bd9Sstevel@tonic-gate ipfobj_t obj;
1057c478bd9Sstevel@tonic-gate
1067c478bd9Sstevel@tonic-gate fd = -1;
1077c478bd9Sstevel@tonic-gate opts = 0;
1087c478bd9Sstevel@tonic-gate nsp = &ns;
1097c478bd9Sstevel@tonic-gate file = NULL;
1107c478bd9Sstevel@tonic-gate core = NULL;
1117c478bd9Sstevel@tonic-gate kernel = NULL;
1127c478bd9Sstevel@tonic-gate mode = O_RDWR;
1137c478bd9Sstevel@tonic-gate
11494bdecd9SRob Gulewich while ((c = getopt(argc, argv, "CdFf:G:hlM:N:nrRsvz:")) != -1)
115*64410b34SToomas Soome switch (c) {
1167c478bd9Sstevel@tonic-gate case 'C' :
1177c478bd9Sstevel@tonic-gate opts |= OPT_CLEAR;
1187c478bd9Sstevel@tonic-gate break;
1197c478bd9Sstevel@tonic-gate case 'd' :
1207c478bd9Sstevel@tonic-gate opts |= OPT_DEBUG;
1217c478bd9Sstevel@tonic-gate break;
1227c478bd9Sstevel@tonic-gate case 'f' :
1237c478bd9Sstevel@tonic-gate file = optarg;
1247c478bd9Sstevel@tonic-gate break;
1257c478bd9Sstevel@tonic-gate case 'F' :
1267c478bd9Sstevel@tonic-gate opts |= OPT_FLUSH;
1277c478bd9Sstevel@tonic-gate break;
12894bdecd9SRob Gulewich case 'G' :
12994bdecd9SRob Gulewich setzonename_global(optarg);
13094bdecd9SRob Gulewich break;
1317c478bd9Sstevel@tonic-gate case 'h' :
132*64410b34SToomas Soome opts |= OPT_HITS;
1337c478bd9Sstevel@tonic-gate break;
1347c478bd9Sstevel@tonic-gate case 'l' :
1357c478bd9Sstevel@tonic-gate opts |= OPT_LIST;
1367c478bd9Sstevel@tonic-gate mode = O_RDONLY;
1377c478bd9Sstevel@tonic-gate break;
1387c478bd9Sstevel@tonic-gate case 'M' :
1397c478bd9Sstevel@tonic-gate core = optarg;
1407c478bd9Sstevel@tonic-gate break;
1417c478bd9Sstevel@tonic-gate case 'N' :
1427c478bd9Sstevel@tonic-gate kernel = optarg;
1437c478bd9Sstevel@tonic-gate break;
1447c478bd9Sstevel@tonic-gate case 'n' :
1457c478bd9Sstevel@tonic-gate opts |= OPT_DONOTHING;
1467c478bd9Sstevel@tonic-gate mode = O_RDONLY;
1477c478bd9Sstevel@tonic-gate break;
148ab25eeb5Syz case 'R' :
149ab25eeb5Syz opts |= OPT_NORESOLVE;
150ab25eeb5Syz break;
1517c478bd9Sstevel@tonic-gate case 'r' :
1527c478bd9Sstevel@tonic-gate opts |= OPT_REMOVE;
1537c478bd9Sstevel@tonic-gate break;
1547c478bd9Sstevel@tonic-gate case 's' :
1557c478bd9Sstevel@tonic-gate opts |= OPT_STAT;
1567c478bd9Sstevel@tonic-gate mode = O_RDONLY;
1577c478bd9Sstevel@tonic-gate break;
1587c478bd9Sstevel@tonic-gate case 'v' :
1597c478bd9Sstevel@tonic-gate opts |= OPT_VERBOSE;
1607c478bd9Sstevel@tonic-gate break;
16194bdecd9SRob Gulewich case 'z' :
16294bdecd9SRob Gulewich setzonename(optarg);
16394bdecd9SRob Gulewich break;
1647c478bd9Sstevel@tonic-gate default :
1657c478bd9Sstevel@tonic-gate usage(argv[0]);
1667c478bd9Sstevel@tonic-gate }
1677c478bd9Sstevel@tonic-gate
1687c478bd9Sstevel@tonic-gate initparse();
1697c478bd9Sstevel@tonic-gate
1707c478bd9Sstevel@tonic-gate if ((kernel != NULL) || (core != NULL)) {
1717c478bd9Sstevel@tonic-gate (void) setgid(getgid());
1727c478bd9Sstevel@tonic-gate (void) setreuid(getuid(), getuid());
1737c478bd9Sstevel@tonic-gate }
1747c478bd9Sstevel@tonic-gate
175*64410b34SToomas Soome bzero((char *)&ns, sizeof (ns));
1767c478bd9Sstevel@tonic-gate
1777c478bd9Sstevel@tonic-gate if ((opts & OPT_DONOTHING) == 0) {
1787c478bd9Sstevel@tonic-gate if (checkrev(IPL_NAME) == -1) {
1797c478bd9Sstevel@tonic-gate fprintf(stderr, "User/kernel version check failed\n");
1807c478bd9Sstevel@tonic-gate exit(1);
1817c478bd9Sstevel@tonic-gate }
1827c478bd9Sstevel@tonic-gate }
1837c478bd9Sstevel@tonic-gate
1847c478bd9Sstevel@tonic-gate
1857c478bd9Sstevel@tonic-gate if (!(opts & OPT_DONOTHING) && (kernel == NULL) && (core == NULL)) {
186f4b3ec61Sdh #ifdef notdef
1877c478bd9Sstevel@tonic-gate if (openkmem(kernel, core) == -1)
1887c478bd9Sstevel@tonic-gate exit(1);
189f4b3ec61Sdh #endif
1907c478bd9Sstevel@tonic-gate if (((fd = open(IPNAT_NAME, mode)) == -1) &&
1917c478bd9Sstevel@tonic-gate ((fd = open(IPNAT_NAME, O_RDONLY)) == -1)) {
1927c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s: open: %s\n", IPNAT_NAME,
193*64410b34SToomas Soome STRERROR(errno));
1947c478bd9Sstevel@tonic-gate exit(1);
1957c478bd9Sstevel@tonic-gate }
1967c478bd9Sstevel@tonic-gate
19794bdecd9SRob Gulewich if (setzone(fd) != 0) {
19894bdecd9SRob Gulewich close(fd);
19994bdecd9SRob Gulewich exit(1);
20094bdecd9SRob Gulewich }
20194bdecd9SRob Gulewich
202*64410b34SToomas Soome bzero((char *)&obj, sizeof (obj));
2037c478bd9Sstevel@tonic-gate obj.ipfo_rev = IPFILTER_VERSION;
204*64410b34SToomas Soome obj.ipfo_size = sizeof (*nsp);
2057c478bd9Sstevel@tonic-gate obj.ipfo_type = IPFOBJ_NATSTAT;
2067c478bd9Sstevel@tonic-gate obj.ipfo_ptr = (void *)nsp;
2077c478bd9Sstevel@tonic-gate if (ioctl(fd, SIOCGNATS, &obj) == -1) {
2087c478bd9Sstevel@tonic-gate perror("ioctl(SIOCGNATS)");
2097c478bd9Sstevel@tonic-gate exit(1);
2107c478bd9Sstevel@tonic-gate }
2117c478bd9Sstevel@tonic-gate (void) setgid(getgid());
2127c478bd9Sstevel@tonic-gate (void) setreuid(getuid(), getuid());
2137c478bd9Sstevel@tonic-gate } else if ((kernel != NULL) || (core != NULL)) {
2147c478bd9Sstevel@tonic-gate if (openkmem(kernel, core) == -1)
2157c478bd9Sstevel@tonic-gate exit(1);
2167c478bd9Sstevel@tonic-gate
2177c478bd9Sstevel@tonic-gate natstat_dead(nsp, kernel);
2187c478bd9Sstevel@tonic-gate if (opts & (OPT_LIST|OPT_STAT))
219f4b3ec61Sdh dostats(fd, nsp, opts, 0);
2207c478bd9Sstevel@tonic-gate exit(0);
2217c478bd9Sstevel@tonic-gate }
2227c478bd9Sstevel@tonic-gate
2237c478bd9Sstevel@tonic-gate if (opts & (OPT_FLUSH|OPT_CLEAR))
2247c478bd9Sstevel@tonic-gate flushtable(fd, opts);
2257c478bd9Sstevel@tonic-gate if (file) {
2267c478bd9Sstevel@tonic-gate ipnat_parsefile(fd, ipnat_addrule, ioctl, file);
2277c478bd9Sstevel@tonic-gate }
2287c478bd9Sstevel@tonic-gate if (opts & (OPT_LIST|OPT_STAT))
229f4b3ec61Sdh dostats(fd, nsp, opts, 1);
230*64410b34SToomas Soome return (0);
2317c478bd9Sstevel@tonic-gate }
2327c478bd9Sstevel@tonic-gate
2337c478bd9Sstevel@tonic-gate
2347c478bd9Sstevel@tonic-gate /*
2357c478bd9Sstevel@tonic-gate * Read NAT statistic information in using a symbol table and memory file
2367c478bd9Sstevel@tonic-gate * rather than doing ioctl's.
2377c478bd9Sstevel@tonic-gate */
238*64410b34SToomas Soome void
natstat_dead(natstat_t * nsp,char * kernel)239*64410b34SToomas Soome natstat_dead(natstat_t *nsp, char *kernel)
2407c478bd9Sstevel@tonic-gate {
2417c478bd9Sstevel@tonic-gate struct nlist nat_nlist[10] = {
2427c478bd9Sstevel@tonic-gate { "nat_table" }, /* 0 */
2437c478bd9Sstevel@tonic-gate { "nat_list" },
2447c478bd9Sstevel@tonic-gate { "maptable" },
2457c478bd9Sstevel@tonic-gate { "ipf_nattable_sz" },
2467c478bd9Sstevel@tonic-gate { "ipf_natrules_sz" },
2477c478bd9Sstevel@tonic-gate { "ipf_rdrrules_sz" }, /* 5 */
2487c478bd9Sstevel@tonic-gate { "ipf_hostmap_sz" },
2497c478bd9Sstevel@tonic-gate { "nat_instances" },
2507c478bd9Sstevel@tonic-gate { "ap_sess_list" },
2517c478bd9Sstevel@tonic-gate { NULL }
2527c478bd9Sstevel@tonic-gate };
2537c478bd9Sstevel@tonic-gate void *tables[2];
2547c478bd9Sstevel@tonic-gate
2557c478bd9Sstevel@tonic-gate if (nlist(kernel, nat_nlist) == -1) {
2567c478bd9Sstevel@tonic-gate fprintf(stderr, "nlist error\n");
2577c478bd9Sstevel@tonic-gate return;
2587c478bd9Sstevel@tonic-gate }
2597c478bd9Sstevel@tonic-gate
2607c478bd9Sstevel@tonic-gate /*
2617c478bd9Sstevel@tonic-gate * Normally the ioctl copies all of these values into the structure
2627c478bd9Sstevel@tonic-gate * for us, before returning it to userland, so here we must copy each
2637c478bd9Sstevel@tonic-gate * one in individually.
2647c478bd9Sstevel@tonic-gate */
265*64410b34SToomas Soome kmemcpy((char *)&tables, nat_nlist[0].n_value, sizeof (tables));
2667c478bd9Sstevel@tonic-gate nsp->ns_table[0] = tables[0];
2677c478bd9Sstevel@tonic-gate nsp->ns_table[1] = tables[1];
2687c478bd9Sstevel@tonic-gate
2697c478bd9Sstevel@tonic-gate kmemcpy((char *)&nsp->ns_list, nat_nlist[1].n_value,
270*64410b34SToomas Soome sizeof (nsp->ns_list));
2717c478bd9Sstevel@tonic-gate kmemcpy((char *)&nsp->ns_maptable, nat_nlist[2].n_value,
272*64410b34SToomas Soome sizeof (nsp->ns_maptable));
2737c478bd9Sstevel@tonic-gate kmemcpy((char *)&nsp->ns_nattab_sz, nat_nlist[3].n_value,
274*64410b34SToomas Soome sizeof (nsp->ns_nattab_sz));
2757c478bd9Sstevel@tonic-gate kmemcpy((char *)&nsp->ns_rultab_sz, nat_nlist[4].n_value,
276*64410b34SToomas Soome sizeof (nsp->ns_rultab_sz));
2777c478bd9Sstevel@tonic-gate kmemcpy((char *)&nsp->ns_rdrtab_sz, nat_nlist[5].n_value,
278*64410b34SToomas Soome sizeof (nsp->ns_rdrtab_sz));
2797c478bd9Sstevel@tonic-gate kmemcpy((char *)&nsp->ns_hostmap_sz, nat_nlist[6].n_value,
280*64410b34SToomas Soome sizeof (nsp->ns_hostmap_sz));
2817c478bd9Sstevel@tonic-gate kmemcpy((char *)&nsp->ns_instances, nat_nlist[7].n_value,
282*64410b34SToomas Soome sizeof (nsp->ns_instances));
2837c478bd9Sstevel@tonic-gate kmemcpy((char *)&nsp->ns_apslist, nat_nlist[8].n_value,
284*64410b34SToomas Soome sizeof (nsp->ns_apslist));
2857c478bd9Sstevel@tonic-gate }
2867c478bd9Sstevel@tonic-gate
2877c478bd9Sstevel@tonic-gate
2887c478bd9Sstevel@tonic-gate /*
2897c478bd9Sstevel@tonic-gate * Display NAT statistics.
2907c478bd9Sstevel@tonic-gate */
291*64410b34SToomas Soome void
dostats(int fd,natstat_t * nsp,int opts,int alive)292*64410b34SToomas Soome dostats(int fd, natstat_t *nsp, int opts, int alive)
2937c478bd9Sstevel@tonic-gate {
2947c478bd9Sstevel@tonic-gate nat_t *np, nat;
2957c478bd9Sstevel@tonic-gate ipnat_t ipn;
2967c478bd9Sstevel@tonic-gate
2977c478bd9Sstevel@tonic-gate /*
2987c478bd9Sstevel@tonic-gate * Show statistics ?
2997c478bd9Sstevel@tonic-gate */
3007c478bd9Sstevel@tonic-gate if (opts & OPT_STAT) {
3017c478bd9Sstevel@tonic-gate printf("mapped\tin\t%lu\tout\t%lu\n",
302*64410b34SToomas Soome nsp->ns_mapped[0], nsp->ns_mapped[1]);
3037c478bd9Sstevel@tonic-gate printf("added\t%lu\texpired\t%lu\n",
304*64410b34SToomas Soome nsp->ns_added, nsp->ns_expire);
3057c478bd9Sstevel@tonic-gate printf("no memory\t%lu\tbad nat\t%lu\n",
306*64410b34SToomas Soome nsp->ns_memfail, nsp->ns_badnat);
3075b48165cSJohn Ojemann printf("inuse\t%lu\norphans\t%u\nrules\t%lu\n",
308*64410b34SToomas Soome nsp->ns_inuse, nsp->ns_orphans, nsp->ns_rules);
3097c478bd9Sstevel@tonic-gate printf("wilds\t%u\n", nsp->ns_wilds);
3107c478bd9Sstevel@tonic-gate if (opts & OPT_VERBOSE)
3117c478bd9Sstevel@tonic-gate printf("table %p list %p\n",
312*64410b34SToomas Soome nsp->ns_table, nsp->ns_list);
3137c478bd9Sstevel@tonic-gate }
3147c478bd9Sstevel@tonic-gate
3157c478bd9Sstevel@tonic-gate /*
3167c478bd9Sstevel@tonic-gate * Show list of NAT rules and NAT sessions ?
3177c478bd9Sstevel@tonic-gate */
3187c478bd9Sstevel@tonic-gate if (opts & OPT_LIST) {
319f4b3ec61Sdh if (alive) {
320f4b3ec61Sdh dostats_live(fd, nsp, opts);
321f4b3ec61Sdh return;
322f4b3ec61Sdh }
3237c478bd9Sstevel@tonic-gate printf("List of active MAP/Redirect filters:\n");
3247c478bd9Sstevel@tonic-gate while (nsp->ns_list) {
3257c478bd9Sstevel@tonic-gate if (kmemcpy((char *)&ipn, (long)nsp->ns_list,
326*64410b34SToomas Soome sizeof (ipn))) {
3277c478bd9Sstevel@tonic-gate perror("kmemcpy");
3287c478bd9Sstevel@tonic-gate break;
3297c478bd9Sstevel@tonic-gate }
3307c478bd9Sstevel@tonic-gate if (opts & OPT_HITS)
331ab25eeb5Syz printf("%lu ", ipn.in_hits);
3327c478bd9Sstevel@tonic-gate printnat(&ipn, opts & (OPT_DEBUG|OPT_VERBOSE));
3337c478bd9Sstevel@tonic-gate nsp->ns_list = ipn.in_next;
3347c478bd9Sstevel@tonic-gate }
3357c478bd9Sstevel@tonic-gate
3367c478bd9Sstevel@tonic-gate printf("\nList of active sessions:\n");
3377c478bd9Sstevel@tonic-gate
3387c478bd9Sstevel@tonic-gate for (np = nsp->ns_instances; np; np = nat.nat_next) {
339*64410b34SToomas Soome if (kmemcpy((char *)&nat, (long)np, sizeof (nat)))
3407c478bd9Sstevel@tonic-gate break;
341f4b3ec61Sdh printactivenat(&nat, opts, 0);
342ab25eeb5Syz if (nat.nat_aps)
343ab25eeb5Syz printaps(nat.nat_aps, opts);
3447c478bd9Sstevel@tonic-gate }
3457c478bd9Sstevel@tonic-gate
3467c478bd9Sstevel@tonic-gate if (opts & OPT_VERBOSE)
3477c478bd9Sstevel@tonic-gate showhostmap(nsp);
3487c478bd9Sstevel@tonic-gate }
3497c478bd9Sstevel@tonic-gate }
3507c478bd9Sstevel@tonic-gate
3517c478bd9Sstevel@tonic-gate
3527c478bd9Sstevel@tonic-gate /*
3537c478bd9Sstevel@tonic-gate * Display the active host mapping table.
3547c478bd9Sstevel@tonic-gate */
355*64410b34SToomas Soome void
showhostmap(natstat_t * nsp)356*64410b34SToomas Soome showhostmap(natstat_t *nsp)
3577c478bd9Sstevel@tonic-gate {
3587c478bd9Sstevel@tonic-gate hostmap_t hm, *hmp, **maptable;
359*64410b34SToomas Soome uint_t hv;
3607c478bd9Sstevel@tonic-gate
3617c478bd9Sstevel@tonic-gate printf("\nList of active host mappings:\n");
3627c478bd9Sstevel@tonic-gate
363*64410b34SToomas Soome maptable = (hostmap_t **)malloc(sizeof (hostmap_t *) *
364*64410b34SToomas Soome nsp->ns_hostmap_sz);
3655e985db5Sschuster if (maptable == NULL) {
3665e985db5Sschuster perror("malloc");
3675e985db5Sschuster exit(1);
3685e985db5Sschuster }
369*64410b34SToomas Soome if (kmemcpy((char *)maptable, (ulong_t)nsp->ns_maptable,
370*64410b34SToomas Soome sizeof (hostmap_t *) * nsp->ns_hostmap_sz)) {
3717c478bd9Sstevel@tonic-gate perror("kmemcpy (maptable)");
3727c478bd9Sstevel@tonic-gate return;
3737c478bd9Sstevel@tonic-gate }
3747c478bd9Sstevel@tonic-gate
3757c478bd9Sstevel@tonic-gate for (hv = 0; hv < nsp->ns_hostmap_sz; hv++) {
3767c478bd9Sstevel@tonic-gate hmp = maptable[hv];
3777c478bd9Sstevel@tonic-gate
3787c478bd9Sstevel@tonic-gate while (hmp) {
379*64410b34SToomas Soome if (kmemcpy((char *)&hm, (ulong_t)hmp, sizeof (hm))) {
3807c478bd9Sstevel@tonic-gate perror("kmemcpy (hostmap)");
3817c478bd9Sstevel@tonic-gate return;
3827c478bd9Sstevel@tonic-gate }
3837c478bd9Sstevel@tonic-gate
3847c478bd9Sstevel@tonic-gate printhostmap(&hm, hv);
3857c478bd9Sstevel@tonic-gate hmp = hm.hm_next;
3867c478bd9Sstevel@tonic-gate }
3877c478bd9Sstevel@tonic-gate }
3887c478bd9Sstevel@tonic-gate free(maptable);
3897c478bd9Sstevel@tonic-gate }
3907c478bd9Sstevel@tonic-gate
3917c478bd9Sstevel@tonic-gate
3927c478bd9Sstevel@tonic-gate /*
3937c478bd9Sstevel@tonic-gate * Issue an ioctl to flush either the NAT rules table or the active mapping
3947c478bd9Sstevel@tonic-gate * table or both.
3957c478bd9Sstevel@tonic-gate */
396*64410b34SToomas Soome void
flushtable(int fd,int opts)397*64410b34SToomas Soome flushtable(int fd, int opts)
3987c478bd9Sstevel@tonic-gate {
3997c478bd9Sstevel@tonic-gate int n = 0;
4007c478bd9Sstevel@tonic-gate
4017c478bd9Sstevel@tonic-gate if (opts & OPT_FLUSH) {
402ea8244dcSJohn Ojemann n = FLUSH_TABLE_ALL;
4037c478bd9Sstevel@tonic-gate if (!(opts & OPT_DONOTHING) && ioctl(fd, SIOCIPFFL, &n) == -1)
4047c478bd9Sstevel@tonic-gate perror("ioctl(SIOCFLNAT)");
4057c478bd9Sstevel@tonic-gate else
4067c478bd9Sstevel@tonic-gate printf("%d entries flushed from NAT table\n", n);
4077c478bd9Sstevel@tonic-gate }
4087c478bd9Sstevel@tonic-gate
4097c478bd9Sstevel@tonic-gate if (opts & OPT_CLEAR) {
410ea8244dcSJohn Ojemann n = FLUSH_LIST;
4117c478bd9Sstevel@tonic-gate if (!(opts & OPT_DONOTHING) && ioctl(fd, SIOCIPFFL, &n) == -1)
4127c478bd9Sstevel@tonic-gate perror("ioctl(SIOCCNATL)");
4137c478bd9Sstevel@tonic-gate else
4147c478bd9Sstevel@tonic-gate printf("%d entries flushed from NAT list\n", n);
4157c478bd9Sstevel@tonic-gate }
4167c478bd9Sstevel@tonic-gate }
417f4b3ec61Sdh
418f4b3ec61Sdh /*
419f4b3ec61Sdh * Display NAT statistics.
420f4b3ec61Sdh */
421*64410b34SToomas Soome void
dostats_live(int fd,natstat_t * nsp,int opts)422*64410b34SToomas Soome dostats_live(int fd, natstat_t *nsp, int opts)
423f4b3ec61Sdh {
424f4b3ec61Sdh ipfgeniter_t iter;
425f4b3ec61Sdh ipfobj_t obj;
426f4b3ec61Sdh ipnat_t ipn;
427f4b3ec61Sdh nat_t nat;
428f4b3ec61Sdh
429*64410b34SToomas Soome bzero((char *)&obj, sizeof (obj));
430f4b3ec61Sdh obj.ipfo_rev = IPFILTER_VERSION;
431f4b3ec61Sdh obj.ipfo_type = IPFOBJ_GENITER;
432*64410b34SToomas Soome obj.ipfo_size = sizeof (iter);
433f4b3ec61Sdh obj.ipfo_ptr = &iter;
434f4b3ec61Sdh
435f4b3ec61Sdh iter.igi_type = IPFGENITER_IPNAT;
43690b0a856Sjojemann iter.igi_nitems = 1;
437f4b3ec61Sdh iter.igi_data = &ipn;
438f4b3ec61Sdh
439f4b3ec61Sdh /*
440f4b3ec61Sdh * Show list of NAT rules and NAT sessions ?
441f4b3ec61Sdh */
442f4b3ec61Sdh printf("List of active MAP/Redirect filters:\n");
443f4b3ec61Sdh while (nsp->ns_list) {
444f4b3ec61Sdh if (ioctl(fd, SIOCGENITER, &obj) == -1)
445f4b3ec61Sdh break;
446f4b3ec61Sdh if (opts & OPT_HITS)
447f4b3ec61Sdh printf("%lu ", ipn.in_hits);
448f4b3ec61Sdh printnat(&ipn, opts & (OPT_DEBUG|OPT_VERBOSE));
449f4b3ec61Sdh nsp->ns_list = ipn.in_next;
450f4b3ec61Sdh }
451f4b3ec61Sdh
452f4b3ec61Sdh printf("\nList of active sessions:\n");
453f4b3ec61Sdh
454f4b3ec61Sdh iter.igi_type = IPFGENITER_NAT;
45590b0a856Sjojemann iter.igi_nitems = 1;
456f4b3ec61Sdh iter.igi_data = &nat;
457f4b3ec61Sdh
458f4b3ec61Sdh while (nsp->ns_instances != NULL) {
459f4b3ec61Sdh if (ioctl(fd, SIOCGENITER, &obj) == -1)
460f4b3ec61Sdh break;
461f4b3ec61Sdh printactivenat(&nat, opts, 1);
462f4b3ec61Sdh if (nat.nat_aps)
463f4b3ec61Sdh printaps(nat.nat_aps, opts);
464f4b3ec61Sdh nsp->ns_instances = nat.nat_next;
465f4b3ec61Sdh }
466f4b3ec61Sdh
467f4b3ec61Sdh if (opts & OPT_VERBOSE)
468f4b3ec61Sdh showhostmap_live(fd, nsp);
469f4b3ec61Sdh }
470f4b3ec61Sdh
471f4b3ec61Sdh /*
472f4b3ec61Sdh * Display the active host mapping table.
473f4b3ec61Sdh */
474*64410b34SToomas Soome void
showhostmap_live(int fd,natstat_t * nsp)475*64410b34SToomas Soome showhostmap_live(int fd, natstat_t *nsp)
476f4b3ec61Sdh {
477f4b3ec61Sdh hostmap_t hm, *hmp;
478f4b3ec61Sdh ipfgeniter_t iter;
479f4b3ec61Sdh ipfobj_t obj;
480f4b3ec61Sdh
481*64410b34SToomas Soome bzero((char *)&obj, sizeof (obj));
482f4b3ec61Sdh obj.ipfo_rev = IPFILTER_VERSION;
483f4b3ec61Sdh obj.ipfo_type = IPFOBJ_GENITER;
484*64410b34SToomas Soome obj.ipfo_size = sizeof (iter);
485f4b3ec61Sdh obj.ipfo_ptr = &iter;
486f4b3ec61Sdh
487f4b3ec61Sdh iter.igi_type = IPFGENITER_HOSTMAP;
488165f0692Sjojemann iter.igi_nitems = 1;
489f4b3ec61Sdh iter.igi_data = &hm;
490f4b3ec61Sdh
491f4b3ec61Sdh printf("\nList of active host mappings:\n");
492f4b3ec61Sdh
493f4b3ec61Sdh while (nsp->ns_maplist != NULL) {
494f4b3ec61Sdh if (ioctl(fd, SIOCGENITER, &obj) == -1)
495f4b3ec61Sdh break;
496f4b3ec61Sdh printhostmap(&hm, 0);
497f4b3ec61Sdh nsp->ns_maplist = hm.hm_next;
498f4b3ec61Sdh }
499165f0692Sjojemann }
500