xref: /illumos-gate/usr/src/cmd/ipf/tools/ipnat.c (revision af5f29dd)
1 /*
2  * Copyright (C) 1993-2001 by Darren Reed.
3  *
4  * See the IPFILTER.LICENCE file for details on licencing.
5  *
6  * Added redirect stuff and a variety of bug fixes. (mcn@EnGarde.com)
7  *
8  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
9  * Use is subject to license terms.
10  *
11  * Copyright (c) 2014, Joyent, Inc.  All rights reserved.
12  */
13 
14 #include <stdio.h>
15 #include <string.h>
16 #include <fcntl.h>
17 #include <errno.h>
18 #include <sys/types.h>
19 #if !defined(__SVR4) && !defined(__svr4__)
20 #include <strings.h>
21 #else
22 #include <sys/byteorder.h>
23 #endif
24 #include <sys/time.h>
25 #include <sys/param.h>
26 #include <stdlib.h>
27 #include <unistd.h>
28 #include <stddef.h>
29 #include <sys/file.h>
30 #define _KERNEL
31 #include <sys/uio.h>
32 #undef _KERNEL
33 #include <sys/socket.h>
34 #include <sys/ioctl.h>
35 #if defined(sun) && (defined(__svr4__) || defined(__SVR4))
36 # include <sys/ioccom.h>
37 # include <sys/sysmacros.h>
38 #endif
39 #include <netinet/in.h>
40 #include <netinet/in_systm.h>
41 #include <netinet/ip.h>
42 #include <netinet/tcp.h>
43 #include <net/if.h>
44 #if __FreeBSD_version >= 300000
45 # include <net/if_var.h>
46 #endif
47 #include <netdb.h>
48 #include <arpa/nameser.h>
49 #include <arpa/inet.h>
50 #include <resolv.h>
51 #include <ctype.h>
52 #if defined(linux)
53 # include <linux/a.out.h>
54 #else
55 # include <nlist.h>
56 #endif
57 #include "ipf.h"
58 #include "netinet/ipl.h"
59 #include "kmem.h"
60 #include "ipfzone.h"
61 
62 #ifdef	__hpux
63 # define	nlist	nlist64
64 #endif
65 
66 #if	defined(sun) && !SOLARIS2
67 # define	STRERROR(x)	sys_errlist[x]
68 extern	char	*sys_errlist[];
69 #else
70 # define	STRERROR(x)	strerror(x)
71 #endif
72 
73 #if !defined(lint)
74 static const char sccsid[] ="@(#)ipnat.c	1.9 6/5/96 (C) 1993 Darren Reed";
75 static const char rcsid[] = "@(#)$Id: ipnat.c,v 1.24.2.2 2005/05/10 21:19:30 darrenr Exp $";
76 #endif
77 
78 
79 #ifdef	SOLARIS
80 #define	bzero(a,b)	memset(a,0,b)
81 #endif
82 int	use_inet6 = 0;
83 char	thishost[MAXHOSTNAMELEN];
84 
85 extern	char	*optarg;
86 
87 void	dostats __P((int, natstat_t *, int, int));
88 void	flushtable __P((int, int));
89 void	usage __P((char *));
90 int	main __P((int, char*[]));
91 void	showhostmap __P((natstat_t *nsp));
92 void	natstat_dead __P((natstat_t *, char *));
93 void	dostats_live __P((int, natstat_t *, int));
94 void	showhostmap_live __P((int, natstat_t *));
95 
96 int	opts;
97 
usage(name)98 void usage(name)
99 char *name;
100 {
101 	fprintf(stderr, "Usage: %s [-CdFhlnrRsv] [-f filename]", name);
102 	fprintf(stderr, " [-G|-z zonename]\n");
103 	exit(1);
104 }
105 
106 
main(argc,argv)107 int main(argc, argv)
108 int argc;
109 char *argv[];
110 {
111 	char *file, *core, *kernel;
112 	natstat_t ns, *nsp;
113 	int fd, c, mode;
114 	ipfobj_t obj;
115 
116 	fd = -1;
117 	opts = 0;
118 	nsp = &ns;
119 	file = NULL;
120 	core = NULL;
121 	kernel = NULL;
122 	mode = O_RDWR;
123 
124 	while ((c = getopt(argc, argv, "CdFf:G:hlM:N:nrRsvz:")) != -1)
125 		switch (c)
126 		{
127 		case 'C' :
128 			opts |= OPT_CLEAR;
129 			break;
130 		case 'd' :
131 			opts |= OPT_DEBUG;
132 			break;
133 		case 'f' :
134 			file = optarg;
135 			break;
136 		case 'F' :
137 			opts |= OPT_FLUSH;
138 			break;
139 		case 'G' :
140 			setzonename_global(optarg);
141 			break;
142 		case 'h' :
143 			opts |=OPT_HITS;
144 			break;
145 		case 'l' :
146 			opts |= OPT_LIST;
147 			mode = O_RDONLY;
148 			break;
149 		case 'M' :
150 			core = optarg;
151 			break;
152 		case 'N' :
153 			kernel = optarg;
154 			break;
155 		case 'n' :
156 			opts |= OPT_DONOTHING;
157 			mode = O_RDONLY;
158 			break;
159 		case 'R' :
160 			opts |= OPT_NORESOLVE;
161 			break;
162 		case 'r' :
163 			opts |= OPT_REMOVE;
164 			break;
165 		case 's' :
166 			opts |= OPT_STAT;
167 			mode = O_RDONLY;
168 			break;
169 		case 'v' :
170 			opts |= OPT_VERBOSE;
171 			break;
172 		case 'z' :
173 			setzonename(optarg);
174 			break;
175 		default :
176 			usage(argv[0]);
177 		}
178 
179 	initparse();
180 
181 	if ((kernel != NULL) || (core != NULL)) {
182 		(void) setgid(getgid());
183 		(void) setreuid(getuid(), getuid());
184 	}
185 
186 	bzero((char *)&ns, sizeof(ns));
187 
188 	if ((opts & OPT_DONOTHING) == 0) {
189 		if (checkrev(IPL_NAME) == -1) {
190 			fprintf(stderr, "User/kernel version check failed\n");
191 			exit(1);
192 		}
193 	}
194 
195 
196 	if (!(opts & OPT_DONOTHING) && (kernel == NULL) && (core == NULL)) {
197 #ifdef notdef
198 		if (openkmem(kernel, core) == -1)
199 			exit(1);
200 #endif
201 		if (((fd = open(IPNAT_NAME, mode)) == -1) &&
202 		    ((fd = open(IPNAT_NAME, O_RDONLY)) == -1)) {
203 			(void) fprintf(stderr, "%s: open: %s\n", IPNAT_NAME,
204 				STRERROR(errno));
205 			exit(1);
206 		}
207 
208 		if (setzone(fd) != 0) {
209 			close(fd);
210 			exit(1);
211 		}
212 
213 		bzero((char *)&obj, sizeof(obj));
214 		obj.ipfo_rev = IPFILTER_VERSION;
215 		obj.ipfo_size = sizeof(*nsp);
216 		obj.ipfo_type = IPFOBJ_NATSTAT;
217 		obj.ipfo_ptr = (void *)nsp;
218 		if (ioctl(fd, SIOCGNATS, &obj) == -1) {
219 			perror("ioctl(SIOCGNATS)");
220 			exit(1);
221 		}
222 		(void) setgid(getgid());
223 		(void) setreuid(getuid(), getuid());
224 	} else if ((kernel != NULL) || (core != NULL)) {
225 		if (openkmem(kernel, core) == -1)
226 			exit(1);
227 
228 		natstat_dead(nsp, kernel);
229 		if (opts & (OPT_LIST|OPT_STAT))
230 			dostats(fd, nsp, opts, 0);
231 		exit(0);
232 	}
233 
234 	if (opts & (OPT_FLUSH|OPT_CLEAR))
235 		flushtable(fd, opts);
236 	if (file) {
237 		ipnat_parsefile(fd, ipnat_addrule, ioctl, file);
238 	}
239 	if (opts & (OPT_LIST|OPT_STAT))
240 		dostats(fd, nsp, opts, 1);
241 	return 0;
242 }
243 
244 
245 /*
246  * Read NAT statistic information in using a symbol table and memory file
247  * rather than doing ioctl's.
248  */
natstat_dead(nsp,kernel)249 void natstat_dead(nsp, kernel)
250 natstat_t *nsp;
251 char *kernel;
252 {
253 	struct nlist nat_nlist[10] = {
254 		{ "nat_table" },		/* 0 */
255 		{ "nat_list" },
256 		{ "maptable" },
257 		{ "ipf_nattable_sz" },
258 		{ "ipf_natrules_sz" },
259 		{ "ipf_rdrrules_sz" },		/* 5 */
260 		{ "ipf_hostmap_sz" },
261 		{ "nat_instances" },
262 		{ "ap_sess_list" },
263 		{ NULL }
264 	};
265 	void *tables[2];
266 
267 	if (nlist(kernel, nat_nlist) == -1) {
268 		fprintf(stderr, "nlist error\n");
269 		return;
270 	}
271 
272 	/*
273 	 * Normally the ioctl copies all of these values into the structure
274 	 * for us, before returning it to userland, so here we must copy each
275 	 * one in individually.
276 	 */
277 	kmemcpy((char *)&tables, nat_nlist[0].n_value, sizeof(tables));
278 	nsp->ns_table[0] = tables[0];
279 	nsp->ns_table[1] = tables[1];
280 
281 	kmemcpy((char *)&nsp->ns_list, nat_nlist[1].n_value,
282 		sizeof(nsp->ns_list));
283 	kmemcpy((char *)&nsp->ns_maptable, nat_nlist[2].n_value,
284 		sizeof(nsp->ns_maptable));
285 	kmemcpy((char *)&nsp->ns_nattab_sz, nat_nlist[3].n_value,
286 		sizeof(nsp->ns_nattab_sz));
287 	kmemcpy((char *)&nsp->ns_rultab_sz, nat_nlist[4].n_value,
288 		sizeof(nsp->ns_rultab_sz));
289 	kmemcpy((char *)&nsp->ns_rdrtab_sz, nat_nlist[5].n_value,
290 		sizeof(nsp->ns_rdrtab_sz));
291 	kmemcpy((char *)&nsp->ns_hostmap_sz, nat_nlist[6].n_value,
292 		sizeof(nsp->ns_hostmap_sz));
293 	kmemcpy((char *)&nsp->ns_instances, nat_nlist[7].n_value,
294 		sizeof(nsp->ns_instances));
295 	kmemcpy((char *)&nsp->ns_apslist, nat_nlist[8].n_value,
296 		sizeof(nsp->ns_apslist));
297 }
298 
299 
300 /*
301  * Display NAT statistics.
302  */
dostats(fd,nsp,opts,alive)303 void dostats(fd, nsp, opts, alive)
304 natstat_t *nsp;
305 int fd, opts, alive;
306 {
307 	nat_t *np, nat;
308 	ipnat_t	ipn;
309 
310 	/*
311 	 * Show statistics ?
312 	 */
313 	if (opts & OPT_STAT) {
314 		printf("mapped\tin\t%lu\tout\t%lu\n",
315 			nsp->ns_mapped[0], nsp->ns_mapped[1]);
316 		printf("added\t%lu\texpired\t%lu\n",
317 			nsp->ns_added, nsp->ns_expire);
318 		printf("no memory\t%lu\tbad nat\t%lu\n",
319 			nsp->ns_memfail, nsp->ns_badnat);
320 		printf("inuse\t%lu\norphans\t%u\nrules\t%lu\n",
321 			nsp->ns_inuse, nsp->ns_orphans, nsp->ns_rules);
322 		printf("wilds\t%u\n", nsp->ns_wilds);
323 		if (opts & OPT_VERBOSE)
324 			printf("table %p list %p\n",
325 				nsp->ns_table, nsp->ns_list);
326 	}
327 
328 	/*
329 	 * Show list of NAT rules and NAT sessions ?
330 	 */
331 	if (opts & OPT_LIST) {
332 		if (alive) {
333 			dostats_live(fd, nsp, opts);
334 			return;
335 		}
336 		printf("List of active MAP/Redirect filters:\n");
337 		while (nsp->ns_list) {
338 			if (kmemcpy((char *)&ipn, (long)nsp->ns_list,
339 				    sizeof(ipn))) {
340 				perror("kmemcpy");
341 				break;
342 			}
343 			if (opts & OPT_HITS)
344 				printf("%lu ", ipn.in_hits);
345 			printnat(&ipn, opts & (OPT_DEBUG|OPT_VERBOSE));
346 			nsp->ns_list = ipn.in_next;
347 		}
348 
349 		printf("\nList of active sessions:\n");
350 
351 		for (np = nsp->ns_instances; np; np = nat.nat_next) {
352 			if (kmemcpy((char *)&nat, (long)np, sizeof(nat)))
353 				break;
354 			printactivenat(&nat, opts, 0);
355 			if (nat.nat_aps)
356 				printaps(nat.nat_aps, opts);
357 		}
358 
359 		if (opts & OPT_VERBOSE)
360 			showhostmap(nsp);
361 	}
362 }
363 
364 
365 /*
366  * Display the active host mapping table.
367  */
showhostmap(nsp)368 void showhostmap(nsp)
369 natstat_t *nsp;
370 {
371 	hostmap_t hm, *hmp, **maptable;
372 	u_int hv;
373 
374 	printf("\nList of active host mappings:\n");
375 
376 	maptable = (hostmap_t **)malloc(sizeof(hostmap_t *) *
377 					nsp->ns_hostmap_sz);
378 	if (maptable == NULL) {
379 		perror("malloc");
380 		exit(1);
381 	}
382 	if (kmemcpy((char *)maptable, (u_long)nsp->ns_maptable,
383 		    sizeof(hostmap_t *) * nsp->ns_hostmap_sz)) {
384 		perror("kmemcpy (maptable)");
385 		return;
386 	}
387 
388 	for (hv = 0; hv < nsp->ns_hostmap_sz; hv++) {
389 		hmp = maptable[hv];
390 
391 		while (hmp) {
392 			if (kmemcpy((char *)&hm, (u_long)hmp, sizeof(hm))) {
393 				perror("kmemcpy (hostmap)");
394 				return;
395 			}
396 
397 			printhostmap(&hm, hv);
398 			hmp = hm.hm_next;
399 		}
400 	}
401 	free(maptable);
402 }
403 
404 
405 /*
406  * Issue an ioctl to flush either the NAT rules table or the active mapping
407  * table or both.
408  */
flushtable(fd,opts)409 void flushtable(fd, opts)
410 int fd, opts;
411 {
412 	int n = 0;
413 
414 	if (opts & OPT_FLUSH) {
415 		n = FLUSH_TABLE_ALL;
416 		if (!(opts & OPT_DONOTHING) && ioctl(fd, SIOCIPFFL, &n) == -1)
417 			perror("ioctl(SIOCFLNAT)");
418 		else
419 			printf("%d entries flushed from NAT table\n", n);
420 	}
421 
422 	if (opts & OPT_CLEAR) {
423 		n = FLUSH_LIST;
424 		if (!(opts & OPT_DONOTHING) && ioctl(fd, SIOCIPFFL, &n) == -1)
425 			perror("ioctl(SIOCCNATL)");
426 		else
427 			printf("%d entries flushed from NAT list\n", n);
428 	}
429 }
430 
431 /*
432  * Display NAT statistics.
433  */
dostats_live(fd,nsp,opts)434 void dostats_live(fd, nsp, opts)
435 natstat_t *nsp;
436 int fd, opts;
437 {
438 	ipfgeniter_t iter;
439 	ipfobj_t obj;
440 	ipnat_t	ipn;
441 	nat_t nat;
442 
443 	bzero((char *)&obj, sizeof(obj));
444 	obj.ipfo_rev = IPFILTER_VERSION;
445 	obj.ipfo_type = IPFOBJ_GENITER;
446 	obj.ipfo_size = sizeof(iter);
447 	obj.ipfo_ptr = &iter;
448 
449 	iter.igi_type = IPFGENITER_IPNAT;
450 	iter.igi_nitems = 1;
451 	iter.igi_data = &ipn;
452 
453 	/*
454 	 * Show list of NAT rules and NAT sessions ?
455 	 */
456 	printf("List of active MAP/Redirect filters:\n");
457 	while (nsp->ns_list) {
458 		if (ioctl(fd, SIOCGENITER, &obj) == -1)
459 			break;
460 		if (opts & OPT_HITS)
461 			printf("%lu ", ipn.in_hits);
462 		printnat(&ipn, opts & (OPT_DEBUG|OPT_VERBOSE));
463 		nsp->ns_list = ipn.in_next;
464 	}
465 
466 	printf("\nList of active sessions:\n");
467 
468 	iter.igi_type = IPFGENITER_NAT;
469 	iter.igi_nitems = 1;
470 	iter.igi_data = &nat;
471 
472 	while (nsp->ns_instances != NULL) {
473 		if (ioctl(fd, SIOCGENITER, &obj) == -1)
474 			break;
475 		printactivenat(&nat, opts, 1);
476 		if (nat.nat_aps)
477 			printaps(nat.nat_aps, opts);
478 		nsp->ns_instances = nat.nat_next;
479 	}
480 
481 	if (opts & OPT_VERBOSE)
482 		showhostmap_live(fd, nsp);
483 }
484 
485 /*
486  * Display the active host mapping table.
487  */
showhostmap_live(fd,nsp)488 void showhostmap_live(fd, nsp)
489 int fd;
490 natstat_t *nsp;
491 {
492 	hostmap_t hm, *hmp;
493 	ipfgeniter_t iter;
494 	ipfobj_t obj;
495 
496 	bzero((char *)&obj, sizeof(obj));
497 	obj.ipfo_rev = IPFILTER_VERSION;
498 	obj.ipfo_type = IPFOBJ_GENITER;
499 	obj.ipfo_size = sizeof(iter);
500 	obj.ipfo_ptr = &iter;
501 
502 	iter.igi_type = IPFGENITER_HOSTMAP;
503 	iter.igi_nitems = 1;
504 	iter.igi_data = &hm;
505 
506 	printf("\nList of active host mappings:\n");
507 
508 	while (nsp->ns_maplist != NULL) {
509 		if (ioctl(fd, SIOCGENITER, &obj) == -1)
510 			break;
511 		printhostmap(&hm, 0);
512 		nsp->ns_maplist = hm.hm_next;
513 	}
514 }
515