17c478bd9Sstevel@tonic-gate /*
227dbc409San * Copyright (C) 1995-2004 by Darren Reed.
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * See the IPFILTER.LICENCE file for details on licencing.
57c478bd9Sstevel@tonic-gate *
633f2fefdSDarren Reed * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
77c478bd9Sstevel@tonic-gate * Use is subject to license terms.
87c478bd9Sstevel@tonic-gate */
97c478bd9Sstevel@tonic-gate
107c478bd9Sstevel@tonic-gate #if defined(KERNEL) || defined(_KERNEL)
117c478bd9Sstevel@tonic-gate # undef KERNEL
127c478bd9Sstevel@tonic-gate # undef _KERNEL
137c478bd9Sstevel@tonic-gate # define KERNEL 1
147c478bd9Sstevel@tonic-gate # define _KERNEL 1
157c478bd9Sstevel@tonic-gate #endif
167c478bd9Sstevel@tonic-gate #include <sys/errno.h>
177c478bd9Sstevel@tonic-gate #include <sys/types.h>
187c478bd9Sstevel@tonic-gate #include <sys/param.h>
197c478bd9Sstevel@tonic-gate #include <sys/time.h>
207c478bd9Sstevel@tonic-gate #include <sys/file.h>
217c478bd9Sstevel@tonic-gate #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
227c478bd9Sstevel@tonic-gate defined(_KERNEL)
237c478bd9Sstevel@tonic-gate # include "opt_ipfilter_log.h"
247c478bd9Sstevel@tonic-gate #endif
257c478bd9Sstevel@tonic-gate #if !defined(_KERNEL)
267c478bd9Sstevel@tonic-gate # include <stdio.h>
277c478bd9Sstevel@tonic-gate # include <string.h>
287c478bd9Sstevel@tonic-gate # include <stdlib.h>
297c478bd9Sstevel@tonic-gate # define _KERNEL
307c478bd9Sstevel@tonic-gate # ifdef __OpenBSD__
317c478bd9Sstevel@tonic-gate struct file;
327c478bd9Sstevel@tonic-gate # endif
337c478bd9Sstevel@tonic-gate # include <sys/uio.h>
347c478bd9Sstevel@tonic-gate # undef _KERNEL
357c478bd9Sstevel@tonic-gate #endif
367c478bd9Sstevel@tonic-gate #if defined(_KERNEL) && (__FreeBSD_version >= 220000)
377c478bd9Sstevel@tonic-gate # include <sys/filio.h>
387c478bd9Sstevel@tonic-gate # include <sys/fcntl.h>
397c478bd9Sstevel@tonic-gate #else
407c478bd9Sstevel@tonic-gate # include <sys/ioctl.h>
417c478bd9Sstevel@tonic-gate #endif
42ab25eeb5Syz #if !defined(AIX)
43ab25eeb5Syz # include <sys/fcntl.h>
44ab25eeb5Syz #endif
45ab25eeb5Syz #if !defined(linux)
46ab25eeb5Syz # include <sys/protosw.h>
47ab25eeb5Syz #endif
487c478bd9Sstevel@tonic-gate #include <sys/socket.h>
497c478bd9Sstevel@tonic-gate #if defined(_KERNEL)
507c478bd9Sstevel@tonic-gate # include <sys/systm.h>
517c478bd9Sstevel@tonic-gate # if !defined(__SVR4) && !defined(__svr4__)
527c478bd9Sstevel@tonic-gate # include <sys/mbuf.h>
537c478bd9Sstevel@tonic-gate # endif
547c478bd9Sstevel@tonic-gate #endif
557c478bd9Sstevel@tonic-gate #if defined(__SVR4) || defined(__svr4__)
567c478bd9Sstevel@tonic-gate # include <sys/filio.h>
577c478bd9Sstevel@tonic-gate # include <sys/byteorder.h>
587c478bd9Sstevel@tonic-gate # ifdef _KERNEL
597c478bd9Sstevel@tonic-gate # include <sys/dditypes.h>
607c478bd9Sstevel@tonic-gate # endif
617c478bd9Sstevel@tonic-gate # include <sys/stream.h>
627c478bd9Sstevel@tonic-gate # include <sys/kmem.h>
637c478bd9Sstevel@tonic-gate #endif
647c478bd9Sstevel@tonic-gate #if __FreeBSD_version >= 300000
657c478bd9Sstevel@tonic-gate # include <sys/queue.h>
667c478bd9Sstevel@tonic-gate #endif
677c478bd9Sstevel@tonic-gate #include <net/if.h>
687c478bd9Sstevel@tonic-gate #if __FreeBSD_version >= 300000
697c478bd9Sstevel@tonic-gate # include <net/if_var.h>
707c478bd9Sstevel@tonic-gate # if defined(_KERNEL) && !defined(IPFILTER_LKM)
717c478bd9Sstevel@tonic-gate # include "opt_ipfilter.h"
727c478bd9Sstevel@tonic-gate # endif
737c478bd9Sstevel@tonic-gate #endif
747c478bd9Sstevel@tonic-gate #ifdef sun
757c478bd9Sstevel@tonic-gate # include <net/af.h>
767c478bd9Sstevel@tonic-gate #endif
777c478bd9Sstevel@tonic-gate #include <net/route.h>
787c478bd9Sstevel@tonic-gate #include <netinet/in.h>
797c478bd9Sstevel@tonic-gate #include <netinet/in_systm.h>
807c478bd9Sstevel@tonic-gate #include <netinet/ip.h>
817c478bd9Sstevel@tonic-gate
827c478bd9Sstevel@tonic-gate #ifdef RFC1825
837c478bd9Sstevel@tonic-gate # include <vpn/md5.h>
847c478bd9Sstevel@tonic-gate # include <vpn/ipsec.h>
857c478bd9Sstevel@tonic-gate extern struct ifnet vpnif;
867c478bd9Sstevel@tonic-gate #endif
877c478bd9Sstevel@tonic-gate
88ab25eeb5Syz #if !defined(linux)
89ab25eeb5Syz # include <netinet/ip_var.h>
90ab25eeb5Syz #endif
917c478bd9Sstevel@tonic-gate #include <netinet/tcp.h>
927c478bd9Sstevel@tonic-gate #include <netinet/udp.h>
937c478bd9Sstevel@tonic-gate #include <netinet/ip_icmp.h>
947c478bd9Sstevel@tonic-gate #include "netinet/ip_compat.h"
95ab25eeb5Syz #include <netinet/tcpip.h>
967c478bd9Sstevel@tonic-gate #include "netinet/ip_fil.h"
977c478bd9Sstevel@tonic-gate #include "netinet/ip_nat.h"
987c478bd9Sstevel@tonic-gate #include "netinet/ip_frag.h"
997c478bd9Sstevel@tonic-gate #include "netinet/ip_state.h"
1007c478bd9Sstevel@tonic-gate #include "netinet/ip_proxy.h"
101f4b3ec61Sdh #include "netinet/ipf_stack.h"
1027c478bd9Sstevel@tonic-gate #ifdef IPFILTER_SYNC
1037c478bd9Sstevel@tonic-gate #include "netinet/ip_sync.h"
1047c478bd9Sstevel@tonic-gate #endif
1057c478bd9Sstevel@tonic-gate #if (__FreeBSD_version >= 300000)
1067c478bd9Sstevel@tonic-gate # include <sys/malloc.h>
1077c478bd9Sstevel@tonic-gate #endif
108ab25eeb5Syz /* END OF INCLUDES */
109ab25eeb5Syz
1107c478bd9Sstevel@tonic-gate #undef SOCKADDR_IN
1117c478bd9Sstevel@tonic-gate #define SOCKADDR_IN struct sockaddr_in
1127c478bd9Sstevel@tonic-gate
1137c478bd9Sstevel@tonic-gate #if !defined(lint)
1147c478bd9Sstevel@tonic-gate static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
115ab25eeb5Syz static const char rcsid[] = "@(#)$Id: ip_nat.c,v 2.195.2.42 2005/08/11 19:51:36 darrenr Exp $";
1167c478bd9Sstevel@tonic-gate #endif
1177c478bd9Sstevel@tonic-gate
1187c478bd9Sstevel@tonic-gate
1197c478bd9Sstevel@tonic-gate /* ======================================================================== */
1207c478bd9Sstevel@tonic-gate /* How the NAT is organised and works. */
1217c478bd9Sstevel@tonic-gate /* */
1227c478bd9Sstevel@tonic-gate /* Inside (interface y) NAT Outside (interface x) */
1237c478bd9Sstevel@tonic-gate /* -------------------- -+- ------------------------------------- */
1247c478bd9Sstevel@tonic-gate /* Packet going | out, processsed by fr_checknatout() for x */
1257c478bd9Sstevel@tonic-gate /* ------------> | ------------> */
1267c478bd9Sstevel@tonic-gate /* src=10.1.1.1 | src=192.1.1.1 */
1277c478bd9Sstevel@tonic-gate /* | */
1287c478bd9Sstevel@tonic-gate /* | in, processed by fr_checknatin() for x */
1297c478bd9Sstevel@tonic-gate /* <------------ | <------------ */
1307c478bd9Sstevel@tonic-gate /* dst=10.1.1.1 | dst=192.1.1.1 */
1317c478bd9Sstevel@tonic-gate /* -------------------- -+- ------------------------------------- */
1327c478bd9Sstevel@tonic-gate /* fr_checknatout() - changes ip_src and if required, sport */
1337c478bd9Sstevel@tonic-gate /* - creates a new mapping, if required. */
1347c478bd9Sstevel@tonic-gate /* fr_checknatin() - changes ip_dst and if required, dport */
1357c478bd9Sstevel@tonic-gate /* */
1367c478bd9Sstevel@tonic-gate /* In the NAT table, internal source is recorded as "in" and externally */
1377c478bd9Sstevel@tonic-gate /* seen as "out". */
1387c478bd9Sstevel@tonic-gate /* ======================================================================== */
1397c478bd9Sstevel@tonic-gate
1407c478bd9Sstevel@tonic-gate
141f4b3ec61Sdh static int nat_clearlist __P((ipf_stack_t *));
142f4b3ec61Sdh static void nat_addnat __P((struct ipnat *, ipf_stack_t *));
143f4b3ec61Sdh static void nat_addrdr __P((struct ipnat *, ipf_stack_t *));
144f4b3ec61Sdh static int fr_natgetent __P((caddr_t, ipf_stack_t *));
145f4b3ec61Sdh static int fr_natgetsz __P((caddr_t, ipf_stack_t *));
146f4b3ec61Sdh static int fr_natputent __P((caddr_t, int, ipf_stack_t *));
147f4b3ec61Sdh static void nat_tabmove __P((nat_t *, ipf_stack_t *));
1487c478bd9Sstevel@tonic-gate static int nat_match __P((fr_info_t *, ipnat_t *));
1497c478bd9Sstevel@tonic-gate static INLINE int nat_newmap __P((fr_info_t *, nat_t *, natinfo_t *));
1507c478bd9Sstevel@tonic-gate static INLINE int nat_newrdr __P((fr_info_t *, nat_t *, natinfo_t *));
1517c478bd9Sstevel@tonic-gate static hostmap_t *nat_hostmap __P((ipnat_t *, struct in_addr,
152*55fea89dSDan Cross struct in_addr, struct in_addr, u_32_t,
153f4b3ec61Sdh ipf_stack_t *));
1547c478bd9Sstevel@tonic-gate static INLINE int nat_icmpquerytype4 __P((int));
155d6c23f6fSyx static int nat_ruleaddrinit __P((ipnat_t *));
156d6c23f6fSyx static int nat_siocaddnat __P((ipnat_t *, ipnat_t **, int, ipf_stack_t *));
157d6c23f6fSyx static void nat_siocdelnat __P((ipnat_t *, ipnat_t **, int, ipf_stack_t *));
158f4b3ec61Sdh static INLINE int nat_icmperrortype4 __P((int));
1597c478bd9Sstevel@tonic-gate static INLINE int nat_finalise __P((fr_info_t *, nat_t *, natinfo_t *,
1607c478bd9Sstevel@tonic-gate tcphdr_t *, nat_t **, int));
161dcf3e898Sjojemann static INLINE int nat_resolverule __P((ipnat_t *, ipf_stack_t *));
162381a2a9aSdr static void nat_mssclamp __P((tcphdr_t *, u_32_t, u_short *));
163f4b3ec61Sdh static int nat_getnext __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *));
164f4b3ec61Sdh static int nat_iterator __P((ipftoken_t *, ipfgeniter_t *, ipf_stack_t *));
165ea8244dcSJohn Ojemann static int nat_flushtable __P((int, ipf_stack_t *));
1667c478bd9Sstevel@tonic-gate
1673c50f6d6San #define NAT_HAS_L4_CHANGED(n) \
16827dbc409San (((n)->nat_flags & (IPN_TCPUDPICMP)) && \
16927dbc409San (n)->nat_inport != (n)->nat_outport)
1707c478bd9Sstevel@tonic-gate
171ea8244dcSJohn Ojemann
1727c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
1737c478bd9Sstevel@tonic-gate /* Function: fr_natinit */
1747c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, -1 == failure */
1757c478bd9Sstevel@tonic-gate /* Parameters: Nil */
1767c478bd9Sstevel@tonic-gate /* */
1777c478bd9Sstevel@tonic-gate /* Initialise all of the NAT locks, tables and other structures. */
1787c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_natinit(ifs)179f4b3ec61Sdh int fr_natinit(ifs)
180f4b3ec61Sdh ipf_stack_t *ifs;
1817c478bd9Sstevel@tonic-gate {
1827c478bd9Sstevel@tonic-gate int i;
1837c478bd9Sstevel@tonic-gate
184f4b3ec61Sdh KMALLOCS(ifs->ifs_nat_table[0], nat_t **,
185f4b3ec61Sdh sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz);
186f4b3ec61Sdh if (ifs->ifs_nat_table[0] != NULL)
187f4b3ec61Sdh bzero((char *)ifs->ifs_nat_table[0],
188f4b3ec61Sdh ifs->ifs_ipf_nattable_sz * sizeof(nat_t *));
1897c478bd9Sstevel@tonic-gate else
1907c478bd9Sstevel@tonic-gate return -1;
1917c478bd9Sstevel@tonic-gate
192f4b3ec61Sdh KMALLOCS(ifs->ifs_nat_table[1], nat_t **,
193f4b3ec61Sdh sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz);
194f4b3ec61Sdh if (ifs->ifs_nat_table[1] != NULL)
195f4b3ec61Sdh bzero((char *)ifs->ifs_nat_table[1],
196f4b3ec61Sdh ifs->ifs_ipf_nattable_sz * sizeof(nat_t *));
1977c478bd9Sstevel@tonic-gate else
198ab25eeb5Syz return -2;
1997c478bd9Sstevel@tonic-gate
200f4b3ec61Sdh KMALLOCS(ifs->ifs_nat_rules, ipnat_t **,
201f4b3ec61Sdh sizeof(ipnat_t *) * ifs->ifs_ipf_natrules_sz);
202f4b3ec61Sdh if (ifs->ifs_nat_rules != NULL)
203f4b3ec61Sdh bzero((char *)ifs->ifs_nat_rules,
204f4b3ec61Sdh ifs->ifs_ipf_natrules_sz * sizeof(ipnat_t *));
2057c478bd9Sstevel@tonic-gate else
206ab25eeb5Syz return -3;
2077c478bd9Sstevel@tonic-gate
208f4b3ec61Sdh KMALLOCS(ifs->ifs_rdr_rules, ipnat_t **,
209f4b3ec61Sdh sizeof(ipnat_t *) * ifs->ifs_ipf_rdrrules_sz);
210f4b3ec61Sdh if (ifs->ifs_rdr_rules != NULL)
211f4b3ec61Sdh bzero((char *)ifs->ifs_rdr_rules,
212f4b3ec61Sdh ifs->ifs_ipf_rdrrules_sz * sizeof(ipnat_t *));
2137c478bd9Sstevel@tonic-gate else
214ab25eeb5Syz return -4;
2157c478bd9Sstevel@tonic-gate
216f4b3ec61Sdh KMALLOCS(ifs->ifs_maptable, hostmap_t **,
217f4b3ec61Sdh sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz);
218f4b3ec61Sdh if (ifs->ifs_maptable != NULL)
219f4b3ec61Sdh bzero((char *)ifs->ifs_maptable,
220f4b3ec61Sdh sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz);
2217c478bd9Sstevel@tonic-gate else
222ab25eeb5Syz return -5;
2237c478bd9Sstevel@tonic-gate
224f4b3ec61Sdh ifs->ifs_ipf_hm_maplist = NULL;
225f4b3ec61Sdh
226f4b3ec61Sdh KMALLOCS(ifs->ifs_nat_stats.ns_bucketlen[0], u_long *,
227f4b3ec61Sdh ifs->ifs_ipf_nattable_sz * sizeof(u_long));
228f4b3ec61Sdh if (ifs->ifs_nat_stats.ns_bucketlen[0] == NULL)
229f4b3ec61Sdh return -1;
230f4b3ec61Sdh bzero((char *)ifs->ifs_nat_stats.ns_bucketlen[0],
231f4b3ec61Sdh ifs->ifs_ipf_nattable_sz * sizeof(u_long));
232f4b3ec61Sdh
233f4b3ec61Sdh KMALLOCS(ifs->ifs_nat_stats.ns_bucketlen[1], u_long *,
234f4b3ec61Sdh ifs->ifs_ipf_nattable_sz * sizeof(u_long));
235f4b3ec61Sdh if (ifs->ifs_nat_stats.ns_bucketlen[1] == NULL)
236f4b3ec61Sdh return -1;
237f4b3ec61Sdh bzero((char *)ifs->ifs_nat_stats.ns_bucketlen[1],
238f4b3ec61Sdh ifs->ifs_ipf_nattable_sz * sizeof(u_long));
239f4b3ec61Sdh
240f4b3ec61Sdh if (ifs->ifs_fr_nat_maxbucket == 0) {
241f4b3ec61Sdh for (i = ifs->ifs_ipf_nattable_sz; i > 0; i >>= 1)
242f4b3ec61Sdh ifs->ifs_fr_nat_maxbucket++;
243f4b3ec61Sdh ifs->ifs_fr_nat_maxbucket *= 2;
2447c478bd9Sstevel@tonic-gate }
2457c478bd9Sstevel@tonic-gate
246f4b3ec61Sdh fr_sttab_init(ifs->ifs_nat_tqb, ifs);
2477c478bd9Sstevel@tonic-gate /*
2487c478bd9Sstevel@tonic-gate * Increase this because we may have "keep state" following this too
2497c478bd9Sstevel@tonic-gate * and packet storms can occur if this is removed too quickly.
2507c478bd9Sstevel@tonic-gate */
251f4b3ec61Sdh ifs->ifs_nat_tqb[IPF_TCPS_CLOSED].ifq_ttl = ifs->ifs_fr_tcplastack;
252f4b3ec61Sdh ifs->ifs_nat_tqb[IPF_TCP_NSTATES - 1].ifq_next = &ifs->ifs_nat_udptq;
253f4b3ec61Sdh ifs->ifs_nat_udptq.ifq_ttl = ifs->ifs_fr_defnatage;
254f4b3ec61Sdh ifs->ifs_nat_udptq.ifq_ref = 1;
255f4b3ec61Sdh ifs->ifs_nat_udptq.ifq_head = NULL;
256f4b3ec61Sdh ifs->ifs_nat_udptq.ifq_tail = &ifs->ifs_nat_udptq.ifq_head;
257f4b3ec61Sdh MUTEX_INIT(&ifs->ifs_nat_udptq.ifq_lock, "nat ipftq udp tab");
258f4b3ec61Sdh ifs->ifs_nat_udptq.ifq_next = &ifs->ifs_nat_icmptq;
259f4b3ec61Sdh ifs->ifs_nat_icmptq.ifq_ttl = ifs->ifs_fr_defnaticmpage;
260f4b3ec61Sdh ifs->ifs_nat_icmptq.ifq_ref = 1;
261f4b3ec61Sdh ifs->ifs_nat_icmptq.ifq_head = NULL;
262f4b3ec61Sdh ifs->ifs_nat_icmptq.ifq_tail = &ifs->ifs_nat_icmptq.ifq_head;
263f4b3ec61Sdh MUTEX_INIT(&ifs->ifs_nat_icmptq.ifq_lock, "nat icmp ipftq tab");
264f4b3ec61Sdh ifs->ifs_nat_icmptq.ifq_next = &ifs->ifs_nat_iptq;
265f4b3ec61Sdh ifs->ifs_nat_iptq.ifq_ttl = ifs->ifs_fr_defnatipage;
266f4b3ec61Sdh ifs->ifs_nat_iptq.ifq_ref = 1;
267f4b3ec61Sdh ifs->ifs_nat_iptq.ifq_head = NULL;
268f4b3ec61Sdh ifs->ifs_nat_iptq.ifq_tail = &ifs->ifs_nat_iptq.ifq_head;
269f4b3ec61Sdh MUTEX_INIT(&ifs->ifs_nat_iptq.ifq_lock, "nat ip ipftq tab");
270f4b3ec61Sdh ifs->ifs_nat_iptq.ifq_next = NULL;
2717c478bd9Sstevel@tonic-gate
2727c478bd9Sstevel@tonic-gate for (i = 0; i < IPF_TCP_NSTATES; i++) {
273f4b3ec61Sdh if (ifs->ifs_nat_tqb[i].ifq_ttl < ifs->ifs_fr_defnaticmpage)
274f4b3ec61Sdh ifs->ifs_nat_tqb[i].ifq_ttl = ifs->ifs_fr_defnaticmpage;
2757c478bd9Sstevel@tonic-gate #ifdef LARGE_NAT
276f4b3ec61Sdh else if (ifs->ifs_nat_tqb[i].ifq_ttl > ifs->ifs_fr_defnatage)
277f4b3ec61Sdh ifs->ifs_nat_tqb[i].ifq_ttl = ifs->ifs_fr_defnatage;
2787c478bd9Sstevel@tonic-gate #endif
2797c478bd9Sstevel@tonic-gate }
2807c478bd9Sstevel@tonic-gate
2817c478bd9Sstevel@tonic-gate /*
2827c478bd9Sstevel@tonic-gate * Increase this because we may have "keep state" following
2837c478bd9Sstevel@tonic-gate * this too and packet storms can occur if this is removed
2847c478bd9Sstevel@tonic-gate * too quickly.
2857c478bd9Sstevel@tonic-gate */
286f4b3ec61Sdh ifs->ifs_nat_tqb[IPF_TCPS_CLOSED].ifq_ttl =
287f4b3ec61Sdh ifs->ifs_nat_tqb[IPF_TCPS_LAST_ACK].ifq_ttl;
2887c478bd9Sstevel@tonic-gate
289f4b3ec61Sdh RWLOCK_INIT(&ifs->ifs_ipf_nat, "ipf IP NAT rwlock");
290f4b3ec61Sdh RWLOCK_INIT(&ifs->ifs_ipf_natfrag, "ipf IP NAT-Frag rwlock");
291f4b3ec61Sdh MUTEX_INIT(&ifs->ifs_ipf_nat_new, "ipf nat new mutex");
292f4b3ec61Sdh MUTEX_INIT(&ifs->ifs_ipf_natio, "ipf nat io mutex");
2937c478bd9Sstevel@tonic-gate
294f4b3ec61Sdh ifs->ifs_fr_nat_init = 1;
295ea8244dcSJohn Ojemann ifs->ifs_nat_last_force_flush = ifs->ifs_fr_ticks;
2967c478bd9Sstevel@tonic-gate return 0;
2977c478bd9Sstevel@tonic-gate }
2987c478bd9Sstevel@tonic-gate
2997c478bd9Sstevel@tonic-gate
3007c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
3017c478bd9Sstevel@tonic-gate /* Function: nat_addrdr */
3027c478bd9Sstevel@tonic-gate /* Returns: Nil */
3037c478bd9Sstevel@tonic-gate /* Parameters: n(I) - pointer to NAT rule to add */
3047c478bd9Sstevel@tonic-gate /* */
3057c478bd9Sstevel@tonic-gate /* Adds a redirect rule to the hash table of redirect rules and the list of */
3067c478bd9Sstevel@tonic-gate /* loaded NAT rules. Updates the bitmask indicating which netmasks are in */
3077c478bd9Sstevel@tonic-gate /* use by redirect rules. */
3087c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_addrdr(n,ifs)309f4b3ec61Sdh static void nat_addrdr(n, ifs)
3107c478bd9Sstevel@tonic-gate ipnat_t *n;
311f4b3ec61Sdh ipf_stack_t *ifs;
3127c478bd9Sstevel@tonic-gate {
3137c478bd9Sstevel@tonic-gate ipnat_t **np;
3147c478bd9Sstevel@tonic-gate u_32_t j;
3157c478bd9Sstevel@tonic-gate u_int hv;
3167c478bd9Sstevel@tonic-gate int k;
3177c478bd9Sstevel@tonic-gate
3187c478bd9Sstevel@tonic-gate k = count4bits(n->in_outmsk);
3197c478bd9Sstevel@tonic-gate if ((k >= 0) && (k != 32))
320f4b3ec61Sdh ifs->ifs_rdr_masks |= 1 << k;
3217c478bd9Sstevel@tonic-gate j = (n->in_outip & n->in_outmsk);
322f4b3ec61Sdh hv = NAT_HASH_FN(j, 0, ifs->ifs_ipf_rdrrules_sz);
323f4b3ec61Sdh np = ifs->ifs_rdr_rules + hv;
3247c478bd9Sstevel@tonic-gate while (*np != NULL)
3257c478bd9Sstevel@tonic-gate np = &(*np)->in_rnext;
3267c478bd9Sstevel@tonic-gate n->in_rnext = NULL;
3277c478bd9Sstevel@tonic-gate n->in_prnext = np;
328ab25eeb5Syz n->in_hv = hv;
3297c478bd9Sstevel@tonic-gate *np = n;
3307c478bd9Sstevel@tonic-gate }
3317c478bd9Sstevel@tonic-gate
3327c478bd9Sstevel@tonic-gate
3337c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
3347c478bd9Sstevel@tonic-gate /* Function: nat_addnat */
3357c478bd9Sstevel@tonic-gate /* Returns: Nil */
3367c478bd9Sstevel@tonic-gate /* Parameters: n(I) - pointer to NAT rule to add */
3377c478bd9Sstevel@tonic-gate /* */
3387c478bd9Sstevel@tonic-gate /* Adds a NAT map rule to the hash table of rules and the list of loaded */
3397c478bd9Sstevel@tonic-gate /* NAT rules. Updates the bitmask indicating which netmasks are in use by */
3407c478bd9Sstevel@tonic-gate /* redirect rules. */
3417c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_addnat(n,ifs)342f4b3ec61Sdh static void nat_addnat(n, ifs)
3437c478bd9Sstevel@tonic-gate ipnat_t *n;
344f4b3ec61Sdh ipf_stack_t *ifs;
3457c478bd9Sstevel@tonic-gate {
3467c478bd9Sstevel@tonic-gate ipnat_t **np;
3477c478bd9Sstevel@tonic-gate u_32_t j;
3487c478bd9Sstevel@tonic-gate u_int hv;
3497c478bd9Sstevel@tonic-gate int k;
3507c478bd9Sstevel@tonic-gate
3517c478bd9Sstevel@tonic-gate k = count4bits(n->in_inmsk);
3527c478bd9Sstevel@tonic-gate if ((k >= 0) && (k != 32))
353f4b3ec61Sdh ifs->ifs_nat_masks |= 1 << k;
3547c478bd9Sstevel@tonic-gate j = (n->in_inip & n->in_inmsk);
355f4b3ec61Sdh hv = NAT_HASH_FN(j, 0, ifs->ifs_ipf_natrules_sz);
356f4b3ec61Sdh np = ifs->ifs_nat_rules + hv;
3577c478bd9Sstevel@tonic-gate while (*np != NULL)
3587c478bd9Sstevel@tonic-gate np = &(*np)->in_mnext;
3597c478bd9Sstevel@tonic-gate n->in_mnext = NULL;
3607c478bd9Sstevel@tonic-gate n->in_pmnext = np;
361ab25eeb5Syz n->in_hv = hv;
3627c478bd9Sstevel@tonic-gate *np = n;
3637c478bd9Sstevel@tonic-gate }
3647c478bd9Sstevel@tonic-gate
3657c478bd9Sstevel@tonic-gate
3667c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
3677c478bd9Sstevel@tonic-gate /* Function: nat_delrdr */
3687c478bd9Sstevel@tonic-gate /* Returns: Nil */
3697c478bd9Sstevel@tonic-gate /* Parameters: n(I) - pointer to NAT rule to delete */
3707c478bd9Sstevel@tonic-gate /* */
3717c478bd9Sstevel@tonic-gate /* Removes a redirect rule from the hash table of redirect rules. */
3727c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_delrdr(n)373d6c23f6fSyx void nat_delrdr(n)
3747c478bd9Sstevel@tonic-gate ipnat_t *n;
3757c478bd9Sstevel@tonic-gate {
3767c478bd9Sstevel@tonic-gate if (n->in_rnext)
3777c478bd9Sstevel@tonic-gate n->in_rnext->in_prnext = n->in_prnext;
3787c478bd9Sstevel@tonic-gate *n->in_prnext = n->in_rnext;
3797c478bd9Sstevel@tonic-gate }
3807c478bd9Sstevel@tonic-gate
3817c478bd9Sstevel@tonic-gate
3827c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
3837c478bd9Sstevel@tonic-gate /* Function: nat_delnat */
3847c478bd9Sstevel@tonic-gate /* Returns: Nil */
3857c478bd9Sstevel@tonic-gate /* Parameters: n(I) - pointer to NAT rule to delete */
3867c478bd9Sstevel@tonic-gate /* */
3877c478bd9Sstevel@tonic-gate /* Removes a NAT map rule from the hash table of NAT map rules. */
3887c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_delnat(n)389d6c23f6fSyx void nat_delnat(n)
3907c478bd9Sstevel@tonic-gate ipnat_t *n;
3917c478bd9Sstevel@tonic-gate {
3927c478bd9Sstevel@tonic-gate if (n->in_mnext != NULL)
3937c478bd9Sstevel@tonic-gate n->in_mnext->in_pmnext = n->in_pmnext;
3947c478bd9Sstevel@tonic-gate *n->in_pmnext = n->in_mnext;
3957c478bd9Sstevel@tonic-gate }
3967c478bd9Sstevel@tonic-gate
3977c478bd9Sstevel@tonic-gate
3987c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
3997c478bd9Sstevel@tonic-gate /* Function: nat_hostmap */
4007c478bd9Sstevel@tonic-gate /* Returns: struct hostmap* - NULL if no hostmap could be created, */
4017c478bd9Sstevel@tonic-gate /* else a pointer to the hostmapping to use */
4027c478bd9Sstevel@tonic-gate /* Parameters: np(I) - pointer to NAT rule */
4037c478bd9Sstevel@tonic-gate /* real(I) - real IP address */
4047c478bd9Sstevel@tonic-gate /* map(I) - mapped IP address */
4057c478bd9Sstevel@tonic-gate /* port(I) - destination port number */
4067c478bd9Sstevel@tonic-gate /* Write Locks: ipf_nat */
4077c478bd9Sstevel@tonic-gate /* */
4087c478bd9Sstevel@tonic-gate /* Check if an ip address has already been allocated for a given mapping */
4097c478bd9Sstevel@tonic-gate /* that is not doing port based translation. If is not yet allocated, then */
410ab25eeb5Syz /* create a new entry if a non-NULL NAT rule pointer has been supplied. */
4117c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_hostmap(np,src,dst,map,port,ifs)412f4b3ec61Sdh static struct hostmap *nat_hostmap(np, src, dst, map, port, ifs)
4137c478bd9Sstevel@tonic-gate ipnat_t *np;
4147c478bd9Sstevel@tonic-gate struct in_addr src;
4157c478bd9Sstevel@tonic-gate struct in_addr dst;
4167c478bd9Sstevel@tonic-gate struct in_addr map;
4177c478bd9Sstevel@tonic-gate u_32_t port;
418f4b3ec61Sdh ipf_stack_t *ifs;
4197c478bd9Sstevel@tonic-gate {
4207c478bd9Sstevel@tonic-gate hostmap_t *hm;
4217c478bd9Sstevel@tonic-gate u_int hv;
4227c478bd9Sstevel@tonic-gate
4237c478bd9Sstevel@tonic-gate hv = (src.s_addr ^ dst.s_addr);
4247c478bd9Sstevel@tonic-gate hv += src.s_addr;
4257c478bd9Sstevel@tonic-gate hv += dst.s_addr;
4267c478bd9Sstevel@tonic-gate hv %= HOSTMAP_SIZE;
427f4b3ec61Sdh for (hm = ifs->ifs_maptable[hv]; hm; hm = hm->hm_next)
4287c478bd9Sstevel@tonic-gate if ((hm->hm_srcip.s_addr == src.s_addr) &&
4297c478bd9Sstevel@tonic-gate (hm->hm_dstip.s_addr == dst.s_addr) &&
4307c478bd9Sstevel@tonic-gate ((np == NULL) || (np == hm->hm_ipnat)) &&
4317c478bd9Sstevel@tonic-gate ((port == 0) || (port == hm->hm_port))) {
4327c478bd9Sstevel@tonic-gate hm->hm_ref++;
4337c478bd9Sstevel@tonic-gate return hm;
4347c478bd9Sstevel@tonic-gate }
4357c478bd9Sstevel@tonic-gate
4367c478bd9Sstevel@tonic-gate if (np == NULL)
4377c478bd9Sstevel@tonic-gate return NULL;
4387c478bd9Sstevel@tonic-gate
4397c478bd9Sstevel@tonic-gate KMALLOC(hm, hostmap_t *);
4407c478bd9Sstevel@tonic-gate if (hm) {
441f4b3ec61Sdh hm->hm_hnext = ifs->ifs_ipf_hm_maplist;
442f4b3ec61Sdh hm->hm_phnext = &ifs->ifs_ipf_hm_maplist;
443f4b3ec61Sdh if (ifs->ifs_ipf_hm_maplist != NULL)
444f4b3ec61Sdh ifs->ifs_ipf_hm_maplist->hm_phnext = &hm->hm_hnext;
445f4b3ec61Sdh ifs->ifs_ipf_hm_maplist = hm;
446f4b3ec61Sdh
447f4b3ec61Sdh hm->hm_next = ifs->ifs_maptable[hv];
448f4b3ec61Sdh hm->hm_pnext = ifs->ifs_maptable + hv;
449f4b3ec61Sdh if (ifs->ifs_maptable[hv] != NULL)
450f4b3ec61Sdh ifs->ifs_maptable[hv]->hm_pnext = &hm->hm_next;
451f4b3ec61Sdh ifs->ifs_maptable[hv] = hm;
4527c478bd9Sstevel@tonic-gate hm->hm_ipnat = np;
4537c478bd9Sstevel@tonic-gate hm->hm_srcip = src;
4547c478bd9Sstevel@tonic-gate hm->hm_dstip = dst;
4557c478bd9Sstevel@tonic-gate hm->hm_mapip = map;
4567c478bd9Sstevel@tonic-gate hm->hm_ref = 1;
4577c478bd9Sstevel@tonic-gate hm->hm_port = port;
458d6c23f6fSyx hm->hm_v = 4;
4597c478bd9Sstevel@tonic-gate }
4607c478bd9Sstevel@tonic-gate return hm;
4617c478bd9Sstevel@tonic-gate }
4627c478bd9Sstevel@tonic-gate
4637c478bd9Sstevel@tonic-gate
4647c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
46590b0a856Sjojemann /* Function: fr_hostmapdel */
4667c478bd9Sstevel@tonic-gate /* Returns: Nil */
46790b0a856Sjojemann /* Parameters: hmp(I) - pointer to pointer to hostmap structure */
4687c478bd9Sstevel@tonic-gate /* Write Locks: ipf_nat */
4697c478bd9Sstevel@tonic-gate /* */
4707c478bd9Sstevel@tonic-gate /* Decrement the references to this hostmap structure by one. If this */
4717c478bd9Sstevel@tonic-gate /* reaches zero then remove it and free it. */
4727c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_hostmapdel(hmp)47390b0a856Sjojemann void fr_hostmapdel(hmp)
47490b0a856Sjojemann struct hostmap **hmp;
4757c478bd9Sstevel@tonic-gate {
47690b0a856Sjojemann struct hostmap *hm;
47790b0a856Sjojemann
47890b0a856Sjojemann hm = *hmp;
47990b0a856Sjojemann *hmp = NULL;
48090b0a856Sjojemann
4817c478bd9Sstevel@tonic-gate hm->hm_ref--;
4827c478bd9Sstevel@tonic-gate if (hm->hm_ref == 0) {
4837c478bd9Sstevel@tonic-gate if (hm->hm_next)
4847c478bd9Sstevel@tonic-gate hm->hm_next->hm_pnext = hm->hm_pnext;
4857c478bd9Sstevel@tonic-gate *hm->hm_pnext = hm->hm_next;
486f4b3ec61Sdh if (hm->hm_hnext)
487f4b3ec61Sdh hm->hm_hnext->hm_phnext = hm->hm_phnext;
488f4b3ec61Sdh *hm->hm_phnext = hm->hm_hnext;
4897c478bd9Sstevel@tonic-gate KFREE(hm);
4907c478bd9Sstevel@tonic-gate }
4917c478bd9Sstevel@tonic-gate }
4927c478bd9Sstevel@tonic-gate
4937c478bd9Sstevel@tonic-gate
4947c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
4957c478bd9Sstevel@tonic-gate /* Function: fix_outcksum */
4967c478bd9Sstevel@tonic-gate /* Returns: Nil */
497381a2a9aSdr /* Parameters: sp(I) - location of 16bit checksum to update */
4987c478bd9Sstevel@tonic-gate /* n((I) - amount to adjust checksum by */
4997c478bd9Sstevel@tonic-gate /* */
5007c478bd9Sstevel@tonic-gate /* Adjusts the 16bit checksum by "n" for packets going out. */
5017c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fix_outcksum(sp,n)502381a2a9aSdr void fix_outcksum(sp, n)
5037c478bd9Sstevel@tonic-gate u_short *sp;
5047c478bd9Sstevel@tonic-gate u_32_t n;
5057c478bd9Sstevel@tonic-gate {
5067c478bd9Sstevel@tonic-gate u_short sumshort;
5077c478bd9Sstevel@tonic-gate u_32_t sum1;
5087c478bd9Sstevel@tonic-gate
5097c478bd9Sstevel@tonic-gate if (n == 0)
5107c478bd9Sstevel@tonic-gate return;
5117c478bd9Sstevel@tonic-gate
5127c478bd9Sstevel@tonic-gate sum1 = (~ntohs(*sp)) & 0xffff;
5137c478bd9Sstevel@tonic-gate sum1 += (n);
5147c478bd9Sstevel@tonic-gate sum1 = (sum1 >> 16) + (sum1 & 0xffff);
5157c478bd9Sstevel@tonic-gate /* Again */
5167c478bd9Sstevel@tonic-gate sum1 = (sum1 >> 16) + (sum1 & 0xffff);
5177c478bd9Sstevel@tonic-gate sumshort = ~(u_short)sum1;
5187c478bd9Sstevel@tonic-gate *(sp) = htons(sumshort);
5197c478bd9Sstevel@tonic-gate }
5207c478bd9Sstevel@tonic-gate
5217c478bd9Sstevel@tonic-gate
5227c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
5237c478bd9Sstevel@tonic-gate /* Function: fix_incksum */
5247c478bd9Sstevel@tonic-gate /* Returns: Nil */
525381a2a9aSdr /* Parameters: sp(I) - location of 16bit checksum to update */
5267c478bd9Sstevel@tonic-gate /* n((I) - amount to adjust checksum by */
5277c478bd9Sstevel@tonic-gate /* */
5287c478bd9Sstevel@tonic-gate /* Adjusts the 16bit checksum by "n" for packets going in. */
5297c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fix_incksum(sp,n)530381a2a9aSdr void fix_incksum(sp, n)
5317c478bd9Sstevel@tonic-gate u_short *sp;
5327c478bd9Sstevel@tonic-gate u_32_t n;
5337c478bd9Sstevel@tonic-gate {
5347c478bd9Sstevel@tonic-gate u_short sumshort;
5357c478bd9Sstevel@tonic-gate u_32_t sum1;
5367c478bd9Sstevel@tonic-gate
5377c478bd9Sstevel@tonic-gate if (n == 0)
5387c478bd9Sstevel@tonic-gate return;
5397c478bd9Sstevel@tonic-gate
5407c478bd9Sstevel@tonic-gate sum1 = (~ntohs(*sp)) & 0xffff;
5417c478bd9Sstevel@tonic-gate sum1 += ~(n) & 0xffff;
5427c478bd9Sstevel@tonic-gate sum1 = (sum1 >> 16) + (sum1 & 0xffff);
5437c478bd9Sstevel@tonic-gate /* Again */
5447c478bd9Sstevel@tonic-gate sum1 = (sum1 >> 16) + (sum1 & 0xffff);
5457c478bd9Sstevel@tonic-gate sumshort = ~(u_short)sum1;
5467c478bd9Sstevel@tonic-gate *(sp) = htons(sumshort);
5477c478bd9Sstevel@tonic-gate }
5487c478bd9Sstevel@tonic-gate
5497c478bd9Sstevel@tonic-gate
5507c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
5517c478bd9Sstevel@tonic-gate /* Function: fix_datacksum */
5527c478bd9Sstevel@tonic-gate /* Returns: Nil */
5537c478bd9Sstevel@tonic-gate /* Parameters: sp(I) - location of 16bit checksum to update */
5547c478bd9Sstevel@tonic-gate /* n((I) - amount to adjust checksum by */
5557c478bd9Sstevel@tonic-gate /* */
5567c478bd9Sstevel@tonic-gate /* Fix_datacksum is used *only* for the adjustments of checksums in the */
5577c478bd9Sstevel@tonic-gate /* data section of an IP packet. */
5587c478bd9Sstevel@tonic-gate /* */
5597c478bd9Sstevel@tonic-gate /* The only situation in which you need to do this is when NAT'ing an */
5607c478bd9Sstevel@tonic-gate /* ICMP error message. Such a message, contains in its body the IP header */
5617c478bd9Sstevel@tonic-gate /* of the original IP packet, that causes the error. */
5627c478bd9Sstevel@tonic-gate /* */
5637c478bd9Sstevel@tonic-gate /* You can't use fix_incksum or fix_outcksum in that case, because for the */
5647c478bd9Sstevel@tonic-gate /* kernel the data section of the ICMP error is just data, and no special */
5657c478bd9Sstevel@tonic-gate /* processing like hardware cksum or ntohs processing have been done by the */
5667c478bd9Sstevel@tonic-gate /* kernel on the data section. */
5677c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fix_datacksum(sp,n)5687c478bd9Sstevel@tonic-gate void fix_datacksum(sp, n)
5697c478bd9Sstevel@tonic-gate u_short *sp;
5707c478bd9Sstevel@tonic-gate u_32_t n;
5717c478bd9Sstevel@tonic-gate {
5727c478bd9Sstevel@tonic-gate u_short sumshort;
5737c478bd9Sstevel@tonic-gate u_32_t sum1;
5747c478bd9Sstevel@tonic-gate
5757c478bd9Sstevel@tonic-gate if (n == 0)
5767c478bd9Sstevel@tonic-gate return;
5777c478bd9Sstevel@tonic-gate
5787c478bd9Sstevel@tonic-gate sum1 = (~ntohs(*sp)) & 0xffff;
5797c478bd9Sstevel@tonic-gate sum1 += (n);
5807c478bd9Sstevel@tonic-gate sum1 = (sum1 >> 16) + (sum1 & 0xffff);
5817c478bd9Sstevel@tonic-gate /* Again */
5827c478bd9Sstevel@tonic-gate sum1 = (sum1 >> 16) + (sum1 & 0xffff);
5837c478bd9Sstevel@tonic-gate sumshort = ~(u_short)sum1;
5847c478bd9Sstevel@tonic-gate *(sp) = htons(sumshort);
5857c478bd9Sstevel@tonic-gate }
5867c478bd9Sstevel@tonic-gate
5877c478bd9Sstevel@tonic-gate
5887c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
5897c478bd9Sstevel@tonic-gate /* Function: fr_nat_ioctl */
5907c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, != 0 == failure */
5917c478bd9Sstevel@tonic-gate /* Parameters: data(I) - pointer to ioctl data */
5927c478bd9Sstevel@tonic-gate /* cmd(I) - ioctl command integer */
5937c478bd9Sstevel@tonic-gate /* mode(I) - file mode bits used with open */
594ea8244dcSJohn Ojemann /* uid(I) - uid of caller */
595ea8244dcSJohn Ojemann /* ctx(I) - pointer to give the uid context */
596ea8244dcSJohn Ojemann /* ifs - ipf stack instance */
5977c478bd9Sstevel@tonic-gate /* */
5987c478bd9Sstevel@tonic-gate /* Processes an ioctl call made to operate on the IP Filter NAT device. */
5997c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_nat_ioctl(data,cmd,mode,uid,ctx,ifs)600f4b3ec61Sdh int fr_nat_ioctl(data, cmd, mode, uid, ctx, ifs)
601ab25eeb5Syz ioctlcmd_t cmd;
6027c478bd9Sstevel@tonic-gate caddr_t data;
603f4b3ec61Sdh int mode, uid;
604f4b3ec61Sdh void *ctx;
605f4b3ec61Sdh ipf_stack_t *ifs;
6067c478bd9Sstevel@tonic-gate {
6077c478bd9Sstevel@tonic-gate ipnat_t *nat, *nt, *n = NULL, **np = NULL;
6087c478bd9Sstevel@tonic-gate int error = 0, ret, arg, getlock;
6097c478bd9Sstevel@tonic-gate ipnat_t natd;
6107c478bd9Sstevel@tonic-gate
6117c478bd9Sstevel@tonic-gate #if (BSD >= 199306) && defined(_KERNEL)
6127c478bd9Sstevel@tonic-gate if ((securelevel >= 2) && (mode & FWRITE))
6137c478bd9Sstevel@tonic-gate return EPERM;
6147c478bd9Sstevel@tonic-gate #endif
6157c478bd9Sstevel@tonic-gate
6167c478bd9Sstevel@tonic-gate #if defined(__osf__) && defined(_KERNEL)
6177c478bd9Sstevel@tonic-gate getlock = 0;
6187c478bd9Sstevel@tonic-gate #else
6197c478bd9Sstevel@tonic-gate getlock = (mode & NAT_LOCKHELD) ? 0 : 1;
6207c478bd9Sstevel@tonic-gate #endif
6217c478bd9Sstevel@tonic-gate
6227c478bd9Sstevel@tonic-gate nat = NULL; /* XXX gcc -Wuninitialized */
623ab25eeb5Syz if (cmd == (ioctlcmd_t)SIOCADNAT) {
6247c478bd9Sstevel@tonic-gate KMALLOC(nt, ipnat_t *);
6257c478bd9Sstevel@tonic-gate } else {
6267c478bd9Sstevel@tonic-gate nt = NULL;
6277c478bd9Sstevel@tonic-gate }
6287c478bd9Sstevel@tonic-gate
629ab25eeb5Syz if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) {
6307c478bd9Sstevel@tonic-gate if (mode & NAT_SYSSPACE) {
6317c478bd9Sstevel@tonic-gate bcopy(data, (char *)&natd, sizeof(natd));
6327c478bd9Sstevel@tonic-gate error = 0;
6337c478bd9Sstevel@tonic-gate } else {
6347c478bd9Sstevel@tonic-gate error = fr_inobj(data, &natd, IPFOBJ_IPNAT);
6357c478bd9Sstevel@tonic-gate }
6367c478bd9Sstevel@tonic-gate
6377c478bd9Sstevel@tonic-gate }
6387c478bd9Sstevel@tonic-gate
6397c478bd9Sstevel@tonic-gate if (error != 0)
6407c478bd9Sstevel@tonic-gate goto done;
6417c478bd9Sstevel@tonic-gate
6427c478bd9Sstevel@tonic-gate /*
6437c478bd9Sstevel@tonic-gate * For add/delete, look to see if the NAT entry is already present
6447c478bd9Sstevel@tonic-gate */
645ab25eeb5Syz if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT)) {
6467c478bd9Sstevel@tonic-gate nat = &natd;
647ab25eeb5Syz if (nat->in_v == 0) /* For backward compat. */
648ab25eeb5Syz nat->in_v = 4;
6497c478bd9Sstevel@tonic-gate nat->in_flags &= IPN_USERFLAGS;
6507c478bd9Sstevel@tonic-gate if ((nat->in_redir & NAT_MAPBLK) == 0) {
6517c478bd9Sstevel@tonic-gate if ((nat->in_flags & IPN_SPLIT) == 0)
6527c478bd9Sstevel@tonic-gate nat->in_inip &= nat->in_inmsk;
6537c478bd9Sstevel@tonic-gate if ((nat->in_flags & IPN_IPRANGE) == 0)
6547c478bd9Sstevel@tonic-gate nat->in_outip &= nat->in_outmsk;
6557c478bd9Sstevel@tonic-gate }
656f4b3ec61Sdh MUTEX_ENTER(&ifs->ifs_ipf_natio);
657f4b3ec61Sdh for (np = &ifs->ifs_nat_list; ((n = *np) != NULL);
658f4b3ec61Sdh np = &n->in_next)
6598899fcfaSjojemann if (bcmp((char *)&nat->in_flags, (char *)&n->in_flags,
6608899fcfaSjojemann IPN_CMPSIZ) == 0) {
6618899fcfaSjojemann if (nat->in_redir == NAT_REDIRECT &&
6628899fcfaSjojemann nat->in_pnext != n->in_pnext)
6638899fcfaSjojemann continue;
6647c478bd9Sstevel@tonic-gate break;
6658899fcfaSjojemann }
6667c478bd9Sstevel@tonic-gate }
6677c478bd9Sstevel@tonic-gate
6687c478bd9Sstevel@tonic-gate switch (cmd)
6697c478bd9Sstevel@tonic-gate {
670f4b3ec61Sdh case SIOCGENITER :
671f4b3ec61Sdh {
672f4b3ec61Sdh ipfgeniter_t iter;
673f4b3ec61Sdh ipftoken_t *token;
674f4b3ec61Sdh
675f4b3ec61Sdh error = fr_inobj(data, &iter, IPFOBJ_GENITER);
676f4b3ec61Sdh if (error != 0)
677f4b3ec61Sdh break;
678f4b3ec61Sdh
679f4b3ec61Sdh token = ipf_findtoken(iter.igi_type, uid, ctx, ifs);
680f4b3ec61Sdh if (token != NULL)
681f4b3ec61Sdh error = nat_iterator(token, &iter, ifs);
682f4b3ec61Sdh else
683f4b3ec61Sdh error = ESRCH;
684f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_tokens);
685f4b3ec61Sdh break;
686f4b3ec61Sdh }
6877c478bd9Sstevel@tonic-gate #ifdef IPFILTER_LOG
6887c478bd9Sstevel@tonic-gate case SIOCIPFFB :
6897c478bd9Sstevel@tonic-gate {
6907c478bd9Sstevel@tonic-gate int tmp;
6917c478bd9Sstevel@tonic-gate
6927c478bd9Sstevel@tonic-gate if (!(mode & FWRITE))
6937c478bd9Sstevel@tonic-gate error = EPERM;
6947c478bd9Sstevel@tonic-gate else {
695f4b3ec61Sdh tmp = ipflog_clear(IPL_LOGNAT, ifs);
696bb1d9de5SJohn Ojemann error = BCOPYOUT((char *)&tmp, (char *)data,
697bb1d9de5SJohn Ojemann sizeof(tmp));
698bb1d9de5SJohn Ojemann if (error != 0)
699bb1d9de5SJohn Ojemann error = EFAULT;
7007c478bd9Sstevel@tonic-gate }
7017c478bd9Sstevel@tonic-gate break;
7027c478bd9Sstevel@tonic-gate }
7037c478bd9Sstevel@tonic-gate case SIOCSETLG :
704bb1d9de5SJohn Ojemann if (!(mode & FWRITE)) {
7057c478bd9Sstevel@tonic-gate error = EPERM;
706bb1d9de5SJohn Ojemann } else {
707bb1d9de5SJohn Ojemann error = BCOPYIN((char *)data,
708bb1d9de5SJohn Ojemann (char *)&ifs->ifs_nat_logging,
709bb1d9de5SJohn Ojemann sizeof(ifs->ifs_nat_logging));
710bb1d9de5SJohn Ojemann if (error != 0)
711bb1d9de5SJohn Ojemann error = EFAULT;
7127c478bd9Sstevel@tonic-gate }
7137c478bd9Sstevel@tonic-gate break;
7147c478bd9Sstevel@tonic-gate case SIOCGETLG :
715bb1d9de5SJohn Ojemann error = BCOPYOUT((char *)&ifs->ifs_nat_logging, (char *)data,
716bb1d9de5SJohn Ojemann sizeof(ifs->ifs_nat_logging));
717bb1d9de5SJohn Ojemann if (error != 0)
718bb1d9de5SJohn Ojemann error = EFAULT;
7197c478bd9Sstevel@tonic-gate break;
7207c478bd9Sstevel@tonic-gate case FIONREAD :
721f4b3ec61Sdh arg = ifs->ifs_iplused[IPL_LOGNAT];
722bb1d9de5SJohn Ojemann error = BCOPYOUT(&arg, data, sizeof(arg));
723bb1d9de5SJohn Ojemann if (error != 0)
724bb1d9de5SJohn Ojemann error = EFAULT;
7257c478bd9Sstevel@tonic-gate break;
7267c478bd9Sstevel@tonic-gate #endif
7277c478bd9Sstevel@tonic-gate case SIOCADNAT :
7287c478bd9Sstevel@tonic-gate if (!(mode & FWRITE)) {
7297c478bd9Sstevel@tonic-gate error = EPERM;
7307c478bd9Sstevel@tonic-gate } else if (n != NULL) {
7317c478bd9Sstevel@tonic-gate error = EEXIST;
7327c478bd9Sstevel@tonic-gate } else if (nt == NULL) {
7337c478bd9Sstevel@tonic-gate error = ENOMEM;
7347c478bd9Sstevel@tonic-gate }
7357c478bd9Sstevel@tonic-gate if (error != 0) {
736f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipf_natio);
7377c478bd9Sstevel@tonic-gate break;
7387c478bd9Sstevel@tonic-gate }
7397c478bd9Sstevel@tonic-gate bcopy((char *)nat, (char *)nt, sizeof(*n));
740f4b3ec61Sdh error = nat_siocaddnat(nt, np, getlock, ifs);
741f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipf_natio);
7427c478bd9Sstevel@tonic-gate if (error == 0)
7437c478bd9Sstevel@tonic-gate nt = NULL;
7447c478bd9Sstevel@tonic-gate break;
7457c478bd9Sstevel@tonic-gate case SIOCRMNAT :
7467c478bd9Sstevel@tonic-gate if (!(mode & FWRITE)) {
7477c478bd9Sstevel@tonic-gate error = EPERM;
7487c478bd9Sstevel@tonic-gate n = NULL;
7497c478bd9Sstevel@tonic-gate } else if (n == NULL) {
7507c478bd9Sstevel@tonic-gate error = ESRCH;
7517c478bd9Sstevel@tonic-gate }
7527c478bd9Sstevel@tonic-gate
7537c478bd9Sstevel@tonic-gate if (error != 0) {
754f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipf_natio);
7557c478bd9Sstevel@tonic-gate break;
7567c478bd9Sstevel@tonic-gate }
757f4b3ec61Sdh nat_siocdelnat(n, np, getlock, ifs);
7587c478bd9Sstevel@tonic-gate
759f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipf_natio);
7607c478bd9Sstevel@tonic-gate n = NULL;
7617c478bd9Sstevel@tonic-gate break;
7627c478bd9Sstevel@tonic-gate case SIOCGNATS :
763f4b3ec61Sdh ifs->ifs_nat_stats.ns_table[0] = ifs->ifs_nat_table[0];
764f4b3ec61Sdh ifs->ifs_nat_stats.ns_table[1] = ifs->ifs_nat_table[1];
765f4b3ec61Sdh ifs->ifs_nat_stats.ns_list = ifs->ifs_nat_list;
766f4b3ec61Sdh ifs->ifs_nat_stats.ns_maptable = ifs->ifs_maptable;
767f4b3ec61Sdh ifs->ifs_nat_stats.ns_maplist = ifs->ifs_ipf_hm_maplist;
768f4b3ec61Sdh ifs->ifs_nat_stats.ns_nattab_max = ifs->ifs_ipf_nattable_max;
769f4b3ec61Sdh ifs->ifs_nat_stats.ns_nattab_sz = ifs->ifs_ipf_nattable_sz;
770f4b3ec61Sdh ifs->ifs_nat_stats.ns_rultab_sz = ifs->ifs_ipf_natrules_sz;
771f4b3ec61Sdh ifs->ifs_nat_stats.ns_rdrtab_sz = ifs->ifs_ipf_rdrrules_sz;
772f4b3ec61Sdh ifs->ifs_nat_stats.ns_hostmap_sz = ifs->ifs_ipf_hostmap_sz;
773f4b3ec61Sdh ifs->ifs_nat_stats.ns_instances = ifs->ifs_nat_instances;
774f4b3ec61Sdh ifs->ifs_nat_stats.ns_apslist = ifs->ifs_ap_sess_list;
775f4b3ec61Sdh error = fr_outobj(data, &ifs->ifs_nat_stats, IPFOBJ_NATSTAT);
7767c478bd9Sstevel@tonic-gate break;
7777c478bd9Sstevel@tonic-gate case SIOCGNATL :
7787c478bd9Sstevel@tonic-gate {
7797c478bd9Sstevel@tonic-gate natlookup_t nl;
7807c478bd9Sstevel@tonic-gate
7817c478bd9Sstevel@tonic-gate if (getlock) {
782f4b3ec61Sdh READ_ENTER(&ifs->ifs_ipf_nat);
7837c478bd9Sstevel@tonic-gate }
7847c478bd9Sstevel@tonic-gate error = fr_inobj(data, &nl, IPFOBJ_NATLOOKUP);
785d6c23f6fSyx if (nl.nl_v != 6)
786d6c23f6fSyx nl.nl_v = 4;
78787c3980eSdr if (error == 0) {
788d6c23f6fSyx void *ptr;
789d6c23f6fSyx
790d6c23f6fSyx switch (nl.nl_v)
791d6c23f6fSyx {
792d6c23f6fSyx case 4:
793d6c23f6fSyx ptr = nat_lookupredir(&nl, ifs);
794d6c23f6fSyx break;
795d6c23f6fSyx #ifdef USE_INET6
796d6c23f6fSyx case 6:
797d6c23f6fSyx ptr = nat6_lookupredir(&nl, ifs);
798d6c23f6fSyx break;
799d6c23f6fSyx #endif
800d6c23f6fSyx default:
801d6c23f6fSyx ptr = NULL;
802d6c23f6fSyx break;
803d6c23f6fSyx }
804d6c23f6fSyx
805d6c23f6fSyx if (ptr != NULL) {
80687c3980eSdr error = fr_outobj(data, &nl, IPFOBJ_NATLOOKUP);
807ab25eeb5Syz } else {
80887c3980eSdr error = ESRCH;
809ab25eeb5Syz }
81087c3980eSdr }
8117c478bd9Sstevel@tonic-gate if (getlock) {
812f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
8137c478bd9Sstevel@tonic-gate }
8147c478bd9Sstevel@tonic-gate break;
8157c478bd9Sstevel@tonic-gate }
8167c478bd9Sstevel@tonic-gate case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */
8177c478bd9Sstevel@tonic-gate if (!(mode & FWRITE)) {
8187c478bd9Sstevel@tonic-gate error = EPERM;
8197c478bd9Sstevel@tonic-gate break;
8207c478bd9Sstevel@tonic-gate }
8217c478bd9Sstevel@tonic-gate if (getlock) {
822f4b3ec61Sdh WRITE_ENTER(&ifs->ifs_ipf_nat);
8237c478bd9Sstevel@tonic-gate }
824bb1d9de5SJohn Ojemann error = BCOPYIN(data, &arg, sizeof(arg));
825bb1d9de5SJohn Ojemann if (error != 0) {
826bb1d9de5SJohn Ojemann error = EFAULT;
827bb1d9de5SJohn Ojemann } else {
828ea8244dcSJohn Ojemann if (arg == FLUSH_LIST)
829bb1d9de5SJohn Ojemann ret = nat_clearlist(ifs);
830ea8244dcSJohn Ojemann else if (VALID_TABLE_FLUSH_OPT(arg))
831ea8244dcSJohn Ojemann ret = nat_flushtable(arg, ifs);
832bb1d9de5SJohn Ojemann else
833bb1d9de5SJohn Ojemann error = EINVAL;
834bb1d9de5SJohn Ojemann }
8357c478bd9Sstevel@tonic-gate if (getlock) {
836f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
8377c478bd9Sstevel@tonic-gate }
8387c478bd9Sstevel@tonic-gate if (error == 0) {
839bb1d9de5SJohn Ojemann error = BCOPYOUT(&ret, data, sizeof(ret));
840bb1d9de5SJohn Ojemann if (error != 0)
841bb1d9de5SJohn Ojemann error = EFAULT;
8427c478bd9Sstevel@tonic-gate }
8437c478bd9Sstevel@tonic-gate break;
8447c478bd9Sstevel@tonic-gate case SIOCPROXY :
845f4b3ec61Sdh error = appr_ioctl(data, cmd, mode, ifs);
8467c478bd9Sstevel@tonic-gate break;
8477c478bd9Sstevel@tonic-gate case SIOCSTLCK :
848ab25eeb5Syz if (!(mode & FWRITE)) {
849ab25eeb5Syz error = EPERM;
850ab25eeb5Syz } else {
851bb1d9de5SJohn Ojemann error = fr_lock(data, &ifs->ifs_fr_nat_lock);
852ab25eeb5Syz }
8537c478bd9Sstevel@tonic-gate break;
8547c478bd9Sstevel@tonic-gate case SIOCSTPUT :
8553c3c3491Sjojemann if ((mode & FWRITE) != 0) {
856f4b3ec61Sdh error = fr_natputent(data, getlock, ifs);
8574556481eSjojemann } else {
8587c478bd9Sstevel@tonic-gate error = EACCES;
8594556481eSjojemann }
8607c478bd9Sstevel@tonic-gate break;
8617c478bd9Sstevel@tonic-gate case SIOCSTGSZ :
862f4b3ec61Sdh if (ifs->ifs_fr_nat_lock) {
8637c478bd9Sstevel@tonic-gate if (getlock) {
864f4b3ec61Sdh READ_ENTER(&ifs->ifs_ipf_nat);
8657c478bd9Sstevel@tonic-gate }
866f4b3ec61Sdh error = fr_natgetsz(data, ifs);
8677c478bd9Sstevel@tonic-gate if (getlock) {
868f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
8697c478bd9Sstevel@tonic-gate }
8707c478bd9Sstevel@tonic-gate } else
8717c478bd9Sstevel@tonic-gate error = EACCES;
8727c478bd9Sstevel@tonic-gate break;
8737c478bd9Sstevel@tonic-gate case SIOCSTGET :
874f4b3ec61Sdh if (ifs->ifs_fr_nat_lock) {
8757c478bd9Sstevel@tonic-gate if (getlock) {
876f4b3ec61Sdh READ_ENTER(&ifs->ifs_ipf_nat);
8777c478bd9Sstevel@tonic-gate }
878f4b3ec61Sdh error = fr_natgetent(data, ifs);
8797c478bd9Sstevel@tonic-gate if (getlock) {
880f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
8817c478bd9Sstevel@tonic-gate }
8827c478bd9Sstevel@tonic-gate } else
8837c478bd9Sstevel@tonic-gate error = EACCES;
8847c478bd9Sstevel@tonic-gate break;
885f4b3ec61Sdh case SIOCIPFDELTOK :
886bb1d9de5SJohn Ojemann error = BCOPYIN((caddr_t)data, (caddr_t)&arg, sizeof(arg));
887bb1d9de5SJohn Ojemann if (error != 0) {
888bb1d9de5SJohn Ojemann error = EFAULT;
889bb1d9de5SJohn Ojemann } else {
890bb1d9de5SJohn Ojemann error = ipf_deltoken(arg, uid, ctx, ifs);
891bb1d9de5SJohn Ojemann }
892f4b3ec61Sdh break;
8937c478bd9Sstevel@tonic-gate default :
8947c478bd9Sstevel@tonic-gate error = EINVAL;
8957c478bd9Sstevel@tonic-gate break;
8967c478bd9Sstevel@tonic-gate }
8977c478bd9Sstevel@tonic-gate done:
8987c478bd9Sstevel@tonic-gate if (nt)
8997c478bd9Sstevel@tonic-gate KFREE(nt);
9007c478bd9Sstevel@tonic-gate return error;
9017c478bd9Sstevel@tonic-gate }
9027c478bd9Sstevel@tonic-gate
9037c478bd9Sstevel@tonic-gate
9047c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
9057c478bd9Sstevel@tonic-gate /* Function: nat_siocaddnat */
9067c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, != 0 == failure */
9077c478bd9Sstevel@tonic-gate /* Parameters: n(I) - pointer to new NAT rule */
9087c478bd9Sstevel@tonic-gate /* np(I) - pointer to where to insert new NAT rule */
9097c478bd9Sstevel@tonic-gate /* getlock(I) - flag indicating if lock on ipf_nat is held */
9107c478bd9Sstevel@tonic-gate /* Mutex Locks: ipf_natio */
9117c478bd9Sstevel@tonic-gate /* */
9127c478bd9Sstevel@tonic-gate /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
9137c478bd9Sstevel@tonic-gate /* from information passed to the kernel, then add it to the appropriate */
9147c478bd9Sstevel@tonic-gate /* NAT rule table(s). */
9157c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_siocaddnat(n,np,getlock,ifs)916f4b3ec61Sdh static int nat_siocaddnat(n, np, getlock, ifs)
9177c478bd9Sstevel@tonic-gate ipnat_t *n, **np;
9187c478bd9Sstevel@tonic-gate int getlock;
919f4b3ec61Sdh ipf_stack_t *ifs;
9207c478bd9Sstevel@tonic-gate {
9217c478bd9Sstevel@tonic-gate int error = 0, i, j;
9227c478bd9Sstevel@tonic-gate
923dcf3e898Sjojemann if (nat_resolverule(n, ifs) != 0)
924dcf3e898Sjojemann return ENOENT;
9257c478bd9Sstevel@tonic-gate
926ab25eeb5Syz if ((n->in_age[0] == 0) && (n->in_age[1] != 0))
927ab25eeb5Syz return EINVAL;
928ab25eeb5Syz
9297c478bd9Sstevel@tonic-gate n->in_use = 0;
9307c478bd9Sstevel@tonic-gate if (n->in_redir & NAT_MAPBLK)
9317c478bd9Sstevel@tonic-gate n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk);
9327c478bd9Sstevel@tonic-gate else if (n->in_flags & IPN_AUTOPORTMAP)
9337c478bd9Sstevel@tonic-gate n->in_space = USABLE_PORTS * ~ntohl(n->in_inmsk);
9347c478bd9Sstevel@tonic-gate else if (n->in_flags & IPN_IPRANGE)
9357c478bd9Sstevel@tonic-gate n->in_space = ntohl(n->in_outmsk) - ntohl(n->in_outip);
9367c478bd9Sstevel@tonic-gate else if (n->in_flags & IPN_SPLIT)
9377c478bd9Sstevel@tonic-gate n->in_space = 2;
938ab25eeb5Syz else if (n->in_outmsk != 0)
9397c478bd9Sstevel@tonic-gate n->in_space = ~ntohl(n->in_outmsk);
940ab25eeb5Syz else
941ab25eeb5Syz n->in_space = 1;
942f507f892SPaul Wernau if ((n->in_flags & NAT_TCPUDPICMPQ) && (n->in_redir != NAT_REDIRECT)) {
94333f2fefdSDarren Reed if (ntohs(n->in_pmax) < ntohs(n->in_pmin))
94433f2fefdSDarren Reed return EINVAL;
94533f2fefdSDarren Reed }
946ab25eeb5Syz
9477c478bd9Sstevel@tonic-gate /*
9487c478bd9Sstevel@tonic-gate * Calculate the number of valid IP addresses in the output
9497c478bd9Sstevel@tonic-gate * mapping range. In all cases, the range is inclusive of
9507c478bd9Sstevel@tonic-gate * the start and ending IP addresses.
9517c478bd9Sstevel@tonic-gate * If to a CIDR address, lose 2: broadcast + network address
9527c478bd9Sstevel@tonic-gate * (so subtract 1)
9537c478bd9Sstevel@tonic-gate * If to a range, add one.
9547c478bd9Sstevel@tonic-gate * If to a single IP address, set to 1.
9557c478bd9Sstevel@tonic-gate */
9567c478bd9Sstevel@tonic-gate if (n->in_space) {
9577c478bd9Sstevel@tonic-gate if ((n->in_flags & IPN_IPRANGE) != 0)
9587c478bd9Sstevel@tonic-gate n->in_space += 1;
9597c478bd9Sstevel@tonic-gate else
9607c478bd9Sstevel@tonic-gate n->in_space -= 1;
9617c478bd9Sstevel@tonic-gate } else
9627c478bd9Sstevel@tonic-gate n->in_space = 1;
963ab25eeb5Syz
964d6c23f6fSyx #ifdef USE_INET6
965d6c23f6fSyx if (n->in_v == 6 && (n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0 &&
966d6c23f6fSyx !IP6_ISONES(&n->in_out[1]) && !IP6_ISZERO(&n->in_out[1]))
967d6c23f6fSyx IP6_ADD(&n->in_out[0], 1, &n->in_next6)
968d6c23f6fSyx else if (n->in_v == 6 &&
969d6c23f6fSyx (n->in_flags & IPN_SPLIT) && (n->in_redir & NAT_REDIRECT))
970d6c23f6fSyx n->in_next6 = n->in_in[0];
971d6c23f6fSyx else if (n->in_v == 6)
972d6c23f6fSyx n->in_next6 = n->in_out[0];
973d6c23f6fSyx else
974d6c23f6fSyx #endif
9757c478bd9Sstevel@tonic-gate if ((n->in_outmsk != 0xffffffff) && (n->in_outmsk != 0) &&
9767c478bd9Sstevel@tonic-gate ((n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0))
9777c478bd9Sstevel@tonic-gate n->in_nip = ntohl(n->in_outip) + 1;
9787c478bd9Sstevel@tonic-gate else if ((n->in_flags & IPN_SPLIT) &&
9797c478bd9Sstevel@tonic-gate (n->in_redir & NAT_REDIRECT))
9807c478bd9Sstevel@tonic-gate n->in_nip = ntohl(n->in_inip);
9817c478bd9Sstevel@tonic-gate else
9827c478bd9Sstevel@tonic-gate n->in_nip = ntohl(n->in_outip);
983d6c23f6fSyx
9847c478bd9Sstevel@tonic-gate if (n->in_redir & NAT_MAP) {
9857c478bd9Sstevel@tonic-gate n->in_pnext = ntohs(n->in_pmin);
9867c478bd9Sstevel@tonic-gate /*
9877c478bd9Sstevel@tonic-gate * Multiply by the number of ports made available.
9887c478bd9Sstevel@tonic-gate */
9897c478bd9Sstevel@tonic-gate if (ntohs(n->in_pmax) >= ntohs(n->in_pmin)) {
9907c478bd9Sstevel@tonic-gate n->in_space *= (ntohs(n->in_pmax) -
9917c478bd9Sstevel@tonic-gate ntohs(n->in_pmin) + 1);
9927c478bd9Sstevel@tonic-gate /*
9937c478bd9Sstevel@tonic-gate * Because two different sources can map to
9947c478bd9Sstevel@tonic-gate * different destinations but use the same
9957c478bd9Sstevel@tonic-gate * local IP#/port #.
9967c478bd9Sstevel@tonic-gate * If the result is smaller than in_space, then
9977c478bd9Sstevel@tonic-gate * we may have wrapped around 32bits.
9987c478bd9Sstevel@tonic-gate */
9997c478bd9Sstevel@tonic-gate i = n->in_inmsk;
10007c478bd9Sstevel@tonic-gate if ((i != 0) && (i != 0xffffffff)) {
10017c478bd9Sstevel@tonic-gate j = n->in_space * (~ntohl(i) + 1);
10027c478bd9Sstevel@tonic-gate if (j >= n->in_space)
10037c478bd9Sstevel@tonic-gate n->in_space = j;
10047c478bd9Sstevel@tonic-gate else
10057c478bd9Sstevel@tonic-gate n->in_space = 0xffffffff;
10067c478bd9Sstevel@tonic-gate }
10077c478bd9Sstevel@tonic-gate }
10087c478bd9Sstevel@tonic-gate /*
10097c478bd9Sstevel@tonic-gate * If no protocol is specified, multiple by 256 to allow for
10107c478bd9Sstevel@tonic-gate * at least one IP:IP mapping per protocol.
10117c478bd9Sstevel@tonic-gate */
10127c478bd9Sstevel@tonic-gate if ((n->in_flags & IPN_TCPUDPICMP) == 0) {
10137c478bd9Sstevel@tonic-gate j = n->in_space * 256;
10147c478bd9Sstevel@tonic-gate if (j >= n->in_space)
10157c478bd9Sstevel@tonic-gate n->in_space = j;
10167c478bd9Sstevel@tonic-gate else
10177c478bd9Sstevel@tonic-gate n->in_space = 0xffffffff;
10187c478bd9Sstevel@tonic-gate }
10197c478bd9Sstevel@tonic-gate }
1020ab25eeb5Syz
10217c478bd9Sstevel@tonic-gate /* Otherwise, these fields are preset */
10227c478bd9Sstevel@tonic-gate
10237c478bd9Sstevel@tonic-gate if (getlock) {
1024f4b3ec61Sdh WRITE_ENTER(&ifs->ifs_ipf_nat);
10257c478bd9Sstevel@tonic-gate }
10267c478bd9Sstevel@tonic-gate n->in_next = NULL;
10277c478bd9Sstevel@tonic-gate *np = n;
10287c478bd9Sstevel@tonic-gate
10297c478bd9Sstevel@tonic-gate if (n->in_age[0] != 0)
1030f4b3ec61Sdh n->in_tqehead[0] = fr_addtimeoutqueue(&ifs->ifs_nat_utqe,
1031f4b3ec61Sdh n->in_age[0], ifs);
10327c478bd9Sstevel@tonic-gate
10337c478bd9Sstevel@tonic-gate if (n->in_age[1] != 0)
1034f4b3ec61Sdh n->in_tqehead[1] = fr_addtimeoutqueue(&ifs->ifs_nat_utqe,
1035f4b3ec61Sdh n->in_age[1], ifs);
10367c478bd9Sstevel@tonic-gate
10377c478bd9Sstevel@tonic-gate if (n->in_redir & NAT_REDIRECT) {
10387c478bd9Sstevel@tonic-gate n->in_flags &= ~IPN_NOTDST;
1039d6c23f6fSyx switch (n->in_v)
1040d6c23f6fSyx {
1041d6c23f6fSyx case 4 :
1042d6c23f6fSyx nat_addrdr(n, ifs);
1043d6c23f6fSyx break;
1044d6c23f6fSyx #ifdef USE_INET6
1045d6c23f6fSyx case 6 :
1046d6c23f6fSyx nat6_addrdr(n, ifs);
1047d6c23f6fSyx break;
1048d6c23f6fSyx #endif
1049d6c23f6fSyx default :
1050d6c23f6fSyx break;
1051d6c23f6fSyx }
10527c478bd9Sstevel@tonic-gate }
10537c478bd9Sstevel@tonic-gate if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
10547c478bd9Sstevel@tonic-gate n->in_flags &= ~IPN_NOTSRC;
1055d6c23f6fSyx switch (n->in_v)
1056d6c23f6fSyx {
1057d6c23f6fSyx case 4 :
1058d6c23f6fSyx nat_addnat(n, ifs);
1059d6c23f6fSyx break;
1060d6c23f6fSyx #ifdef USE_INET6
1061d6c23f6fSyx case 6 :
1062d6c23f6fSyx nat6_addnat(n, ifs);
1063d6c23f6fSyx break;
1064d6c23f6fSyx #endif
1065d6c23f6fSyx default :
1066d6c23f6fSyx break;
1067d6c23f6fSyx }
10687c478bd9Sstevel@tonic-gate }
10697c478bd9Sstevel@tonic-gate n = NULL;
1070f4b3ec61Sdh ifs->ifs_nat_stats.ns_rules++;
10717c478bd9Sstevel@tonic-gate if (getlock) {
1072f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat); /* WRITE */
10737c478bd9Sstevel@tonic-gate }
10747c478bd9Sstevel@tonic-gate
10757c478bd9Sstevel@tonic-gate return error;
10767c478bd9Sstevel@tonic-gate }
10777c478bd9Sstevel@tonic-gate
10787c478bd9Sstevel@tonic-gate
10797c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
10807c478bd9Sstevel@tonic-gate /* Function: nat_resolvrule */
1081dcf3e898Sjojemann /* Returns: int - 0 == success, -1 == failure */
10827c478bd9Sstevel@tonic-gate /* Parameters: n(I) - pointer to NAT rule */
10837c478bd9Sstevel@tonic-gate /* */
1084dcf3e898Sjojemann /* Resolve some of the details inside the NAT rule. Includes resolving */
1085dcf3e898Sjojemann /* any specified interfaces and proxy labels, and determines whether or not */
1086dcf3e898Sjojemann /* all proxy labels are correctly specified. */
1087dcf3e898Sjojemann /* */
1088dcf3e898Sjojemann /* Called by nat_siocaddnat() (SIOCADNAT) and fr_natputent (SIOCSTPUT). */
10897c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_resolverule(n,ifs)1090dcf3e898Sjojemann static int nat_resolverule(n, ifs)
10917c478bd9Sstevel@tonic-gate ipnat_t *n;
1092f4b3ec61Sdh ipf_stack_t *ifs;
10937c478bd9Sstevel@tonic-gate {
1094ab25eeb5Syz n->in_ifnames[0][LIFNAMSIZ - 1] = '\0';
1095d6c23f6fSyx n->in_ifps[0] = fr_resolvenic(n->in_ifnames[0], n->in_v, ifs);
1096ab25eeb5Syz
1097ab25eeb5Syz n->in_ifnames[1][LIFNAMSIZ - 1] = '\0';
10987c478bd9Sstevel@tonic-gate if (n->in_ifnames[1][0] == '\0') {
10997c478bd9Sstevel@tonic-gate (void) strncpy(n->in_ifnames[1], n->in_ifnames[0], LIFNAMSIZ);
11007c478bd9Sstevel@tonic-gate n->in_ifps[1] = n->in_ifps[0];
11017c478bd9Sstevel@tonic-gate } else {
1102d6c23f6fSyx n->in_ifps[1] = fr_resolvenic(n->in_ifnames[1], n->in_v, ifs);
11037c478bd9Sstevel@tonic-gate }
11047c478bd9Sstevel@tonic-gate
11057c478bd9Sstevel@tonic-gate if (n->in_plabel[0] != '\0') {
1106f4b3ec61Sdh n->in_apr = appr_lookup(n->in_p, n->in_plabel, ifs);
1107dcf3e898Sjojemann if (n->in_apr == NULL)
1108dcf3e898Sjojemann return -1;
11097c478bd9Sstevel@tonic-gate }
1110dcf3e898Sjojemann return 0;
11117c478bd9Sstevel@tonic-gate }
11127c478bd9Sstevel@tonic-gate
11137c478bd9Sstevel@tonic-gate
11147c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
11157c478bd9Sstevel@tonic-gate /* Function: nat_siocdelnat */
11167c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, != 0 == failure */
11177c478bd9Sstevel@tonic-gate /* Parameters: n(I) - pointer to new NAT rule */
11187c478bd9Sstevel@tonic-gate /* np(I) - pointer to where to insert new NAT rule */
11197c478bd9Sstevel@tonic-gate /* getlock(I) - flag indicating if lock on ipf_nat is held */
11207c478bd9Sstevel@tonic-gate /* Mutex Locks: ipf_natio */
11217c478bd9Sstevel@tonic-gate /* */
11227c478bd9Sstevel@tonic-gate /* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
11237c478bd9Sstevel@tonic-gate /* from information passed to the kernel, then add it to the appropriate */
11247c478bd9Sstevel@tonic-gate /* NAT rule table(s). */
11257c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_siocdelnat(n,np,getlock,ifs)1126f4b3ec61Sdh static void nat_siocdelnat(n, np, getlock, ifs)
11277c478bd9Sstevel@tonic-gate ipnat_t *n, **np;
11287c478bd9Sstevel@tonic-gate int getlock;
1129f4b3ec61Sdh ipf_stack_t *ifs;
11307c478bd9Sstevel@tonic-gate {
1131d6c23f6fSyx int i;
1132d6c23f6fSyx
11337c478bd9Sstevel@tonic-gate if (getlock) {
1134f4b3ec61Sdh WRITE_ENTER(&ifs->ifs_ipf_nat);
11357c478bd9Sstevel@tonic-gate }
11367c478bd9Sstevel@tonic-gate if (n->in_redir & NAT_REDIRECT)
11377c478bd9Sstevel@tonic-gate nat_delrdr(n);
11387c478bd9Sstevel@tonic-gate if (n->in_redir & (NAT_MAPBLK|NAT_MAP))
11397c478bd9Sstevel@tonic-gate nat_delnat(n);
1140f4b3ec61Sdh if (ifs->ifs_nat_list == NULL) {
1141f4b3ec61Sdh ifs->ifs_nat_masks = 0;
1142f4b3ec61Sdh ifs->ifs_rdr_masks = 0;
1143d6c23f6fSyx for (i = 0; i < 4; i++) {
1144d6c23f6fSyx ifs->ifs_nat6_masks[i] = 0;
1145d6c23f6fSyx ifs->ifs_rdr6_masks[i] = 0;
1146d6c23f6fSyx }
11477c478bd9Sstevel@tonic-gate }
11487c478bd9Sstevel@tonic-gate
1149ab25eeb5Syz if (n->in_tqehead[0] != NULL) {
1150ab25eeb5Syz if (fr_deletetimeoutqueue(n->in_tqehead[0]) == 0) {
11513805c50fSan fr_freetimeoutqueue(n->in_tqehead[0], ifs);
1152ab25eeb5Syz }
1153ab25eeb5Syz }
11547c478bd9Sstevel@tonic-gate
1155ab25eeb5Syz if (n->in_tqehead[1] != NULL) {
1156ab25eeb5Syz if (fr_deletetimeoutqueue(n->in_tqehead[1]) == 0) {
1157f4b3ec61Sdh fr_freetimeoutqueue(n->in_tqehead[1], ifs);
1158ab25eeb5Syz }
1159ab25eeb5Syz }
11607c478bd9Sstevel@tonic-gate
11617c478bd9Sstevel@tonic-gate *np = n->in_next;
11627c478bd9Sstevel@tonic-gate
11637c478bd9Sstevel@tonic-gate if (n->in_use == 0) {
11647c478bd9Sstevel@tonic-gate if (n->in_apr)
11657c478bd9Sstevel@tonic-gate appr_free(n->in_apr);
11667c478bd9Sstevel@tonic-gate KFREE(n);
1167f4b3ec61Sdh ifs->ifs_nat_stats.ns_rules--;
11687c478bd9Sstevel@tonic-gate } else {
11697c478bd9Sstevel@tonic-gate n->in_flags |= IPN_DELETE;
11707c478bd9Sstevel@tonic-gate n->in_next = NULL;
11717c478bd9Sstevel@tonic-gate }
11727c478bd9Sstevel@tonic-gate if (getlock) {
1173f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat); /* READ/WRITE */
11747c478bd9Sstevel@tonic-gate }
11757c478bd9Sstevel@tonic-gate }
11767c478bd9Sstevel@tonic-gate
11777c478bd9Sstevel@tonic-gate
11787c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
11797c478bd9Sstevel@tonic-gate /* Function: fr_natgetsz */
11807c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, != 0 is the error value. */
11817c478bd9Sstevel@tonic-gate /* Parameters: data(I) - pointer to natget structure with kernel pointer */
11827c478bd9Sstevel@tonic-gate /* get the size of. */
11837c478bd9Sstevel@tonic-gate /* */
11847c478bd9Sstevel@tonic-gate /* Handle SIOCSTGSZ. */
11857c478bd9Sstevel@tonic-gate /* Return the size of the nat list entry to be copied back to user space. */
11867c478bd9Sstevel@tonic-gate /* The size of the entry is stored in the ng_sz field and the enture natget */
11877c478bd9Sstevel@tonic-gate /* structure is copied back to the user. */
11887c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_natgetsz(data,ifs)1189f4b3ec61Sdh static int fr_natgetsz(data, ifs)
11907c478bd9Sstevel@tonic-gate caddr_t data;
1191f4b3ec61Sdh ipf_stack_t *ifs;
11927c478bd9Sstevel@tonic-gate {
11937c478bd9Sstevel@tonic-gate ap_session_t *aps;
11947c478bd9Sstevel@tonic-gate nat_t *nat, *n;
11957c478bd9Sstevel@tonic-gate natget_t ng;
1196bb1d9de5SJohn Ojemann int err;
11977c478bd9Sstevel@tonic-gate
1198bb1d9de5SJohn Ojemann err = BCOPYIN(data, &ng, sizeof(ng));
1199bb1d9de5SJohn Ojemann if (err != 0)
1200bb1d9de5SJohn Ojemann return EFAULT;
12017c478bd9Sstevel@tonic-gate
12027c478bd9Sstevel@tonic-gate nat = ng.ng_ptr;
12037c478bd9Sstevel@tonic-gate if (!nat) {
1204f4b3ec61Sdh nat = ifs->ifs_nat_instances;
12057c478bd9Sstevel@tonic-gate ng.ng_sz = 0;
12067c478bd9Sstevel@tonic-gate /*
12077c478bd9Sstevel@tonic-gate * Empty list so the size returned is 0. Simple.
12087c478bd9Sstevel@tonic-gate */
12097c478bd9Sstevel@tonic-gate if (nat == NULL) {
1210bb1d9de5SJohn Ojemann err = BCOPYOUT(&ng, data, sizeof(ng));
1211bb1d9de5SJohn Ojemann if (err != 0) {
1212bb1d9de5SJohn Ojemann return EFAULT;
1213bb1d9de5SJohn Ojemann } else {
1214bb1d9de5SJohn Ojemann return 0;
1215bb1d9de5SJohn Ojemann }
12167c478bd9Sstevel@tonic-gate }
12177c478bd9Sstevel@tonic-gate } else {
12187c478bd9Sstevel@tonic-gate /*
12197c478bd9Sstevel@tonic-gate * Make sure the pointer we're copying from exists in the
12207c478bd9Sstevel@tonic-gate * current list of entries. Security precaution to prevent
12217c478bd9Sstevel@tonic-gate * copying of random kernel data.
12227c478bd9Sstevel@tonic-gate */
1223f4b3ec61Sdh for (n = ifs->ifs_nat_instances; n; n = n->nat_next)
12247c478bd9Sstevel@tonic-gate if (n == nat)
12257c478bd9Sstevel@tonic-gate break;
12267c478bd9Sstevel@tonic-gate if (!n)
12277c478bd9Sstevel@tonic-gate return ESRCH;
12287c478bd9Sstevel@tonic-gate }
12297c478bd9Sstevel@tonic-gate
12307c478bd9Sstevel@tonic-gate /*
12317c478bd9Sstevel@tonic-gate * Incluse any space required for proxy data structures.
12327c478bd9Sstevel@tonic-gate */
12337c478bd9Sstevel@tonic-gate ng.ng_sz = sizeof(nat_save_t);
12347c478bd9Sstevel@tonic-gate aps = nat->nat_aps;
1235ab25eeb5Syz if (aps != NULL) {
1236ab25eeb5Syz ng.ng_sz += sizeof(ap_session_t) - 4;
1237ab25eeb5Syz if (aps->aps_data != 0)
1238ab25eeb5Syz ng.ng_sz += aps->aps_psiz;
12397c478bd9Sstevel@tonic-gate }
12407c478bd9Sstevel@tonic-gate
1241bb1d9de5SJohn Ojemann err = BCOPYOUT(&ng, data, sizeof(ng));
1242bb1d9de5SJohn Ojemann if (err != 0)
1243bb1d9de5SJohn Ojemann return EFAULT;
12447c478bd9Sstevel@tonic-gate return 0;
12457c478bd9Sstevel@tonic-gate }
12467c478bd9Sstevel@tonic-gate
12477c478bd9Sstevel@tonic-gate
12487c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
12497c478bd9Sstevel@tonic-gate /* Function: fr_natgetent */
12507c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, != 0 is the error value. */
12517c478bd9Sstevel@tonic-gate /* Parameters: data(I) - pointer to natget structure with kernel pointer */
12527c478bd9Sstevel@tonic-gate /* to NAT structure to copy out. */
12537c478bd9Sstevel@tonic-gate /* */
12547c478bd9Sstevel@tonic-gate /* Handle SIOCSTGET. */
12557c478bd9Sstevel@tonic-gate /* Copies out NAT entry to user space. Any additional data held for a */
12567c478bd9Sstevel@tonic-gate /* proxy is also copied, as to is the NAT rule which was responsible for it */
12577c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_natgetent(data,ifs)1258f4b3ec61Sdh static int fr_natgetent(data, ifs)
12597c478bd9Sstevel@tonic-gate caddr_t data;
1260f4b3ec61Sdh ipf_stack_t *ifs;
12617c478bd9Sstevel@tonic-gate {
1262ab25eeb5Syz int error, outsize;
12637c478bd9Sstevel@tonic-gate ap_session_t *aps;
1264ab25eeb5Syz nat_save_t *ipn, ipns;
12657c478bd9Sstevel@tonic-gate nat_t *n, *nat;
12667c478bd9Sstevel@tonic-gate
1267ab25eeb5Syz error = fr_inobj(data, &ipns, IPFOBJ_NATSAVE);
12687c478bd9Sstevel@tonic-gate if (error != 0)
12697c478bd9Sstevel@tonic-gate return error;
12707c478bd9Sstevel@tonic-gate
1271ab25eeb5Syz if ((ipns.ipn_dsize < sizeof(ipns)) || (ipns.ipn_dsize > 81920))
1272ab25eeb5Syz return EINVAL;
1273ab25eeb5Syz
1274ab25eeb5Syz KMALLOCS(ipn, nat_save_t *, ipns.ipn_dsize);
1275ab25eeb5Syz if (ipn == NULL)
1276ab25eeb5Syz return ENOMEM;
1277ab25eeb5Syz
1278ab25eeb5Syz ipn->ipn_dsize = ipns.ipn_dsize;
1279ab25eeb5Syz nat = ipns.ipn_next;
12807c478bd9Sstevel@tonic-gate if (nat == NULL) {
1281f4b3ec61Sdh nat = ifs->ifs_nat_instances;
12827c478bd9Sstevel@tonic-gate if (nat == NULL) {
1283f4b3ec61Sdh if (ifs->ifs_nat_instances == NULL)
1284ab25eeb5Syz error = ENOENT;
1285ab25eeb5Syz goto finished;
12867c478bd9Sstevel@tonic-gate }
12877c478bd9Sstevel@tonic-gate } else {
12887c478bd9Sstevel@tonic-gate /*
12897c478bd9Sstevel@tonic-gate * Make sure the pointer we're copying from exists in the
12907c478bd9Sstevel@tonic-gate * current list of entries. Security precaution to prevent
12917c478bd9Sstevel@tonic-gate * copying of random kernel data.
12927c478bd9Sstevel@tonic-gate */
1293f4b3ec61Sdh for (n = ifs->ifs_nat_instances; n; n = n->nat_next)
12947c478bd9Sstevel@tonic-gate if (n == nat)
12957c478bd9Sstevel@tonic-gate break;
1296ab25eeb5Syz if (n == NULL) {
1297ab25eeb5Syz error = ESRCH;
1298ab25eeb5Syz goto finished;
1299ab25eeb5Syz }
13007c478bd9Sstevel@tonic-gate }
1301ab25eeb5Syz ipn->ipn_next = nat->nat_next;
13027c478bd9Sstevel@tonic-gate
13037c478bd9Sstevel@tonic-gate /*
1304ab25eeb5Syz * Copy the NAT structure.
13057c478bd9Sstevel@tonic-gate */
1306ab25eeb5Syz bcopy((char *)nat, &ipn->ipn_nat, sizeof(*nat));
13077c478bd9Sstevel@tonic-gate
13087c478bd9Sstevel@tonic-gate /*
13097c478bd9Sstevel@tonic-gate * If we have a pointer to the NAT rule it belongs to, save that too.
13107c478bd9Sstevel@tonic-gate */
1311ab25eeb5Syz if (nat->nat_ptr != NULL)
1312ab25eeb5Syz bcopy((char *)nat->nat_ptr, (char *)&ipn->ipn_ipnat,
1313ab25eeb5Syz sizeof(ipn->ipn_ipnat));
13147c478bd9Sstevel@tonic-gate
13157c478bd9Sstevel@tonic-gate /*
13167c478bd9Sstevel@tonic-gate * If we also know the NAT entry has an associated filter rule,
13177c478bd9Sstevel@tonic-gate * save that too.
13187c478bd9Sstevel@tonic-gate */
1319ab25eeb5Syz if (nat->nat_fr != NULL)
1320ab25eeb5Syz bcopy((char *)nat->nat_fr, (char *)&ipn->ipn_fr,
1321ab25eeb5Syz sizeof(ipn->ipn_fr));
13227c478bd9Sstevel@tonic-gate
13237c478bd9Sstevel@tonic-gate /*
13247c478bd9Sstevel@tonic-gate * Last but not least, if there is an application proxy session set
13257c478bd9Sstevel@tonic-gate * up for this NAT entry, then copy that out too, including any
13267c478bd9Sstevel@tonic-gate * private data saved along side it by the proxy.
13277c478bd9Sstevel@tonic-gate */
13287c478bd9Sstevel@tonic-gate aps = nat->nat_aps;
1329ab25eeb5Syz outsize = ipn->ipn_dsize - sizeof(*ipn) + sizeof(ipn->ipn_data);
13307c478bd9Sstevel@tonic-gate if (aps != NULL) {
1331ab25eeb5Syz char *s;
1332ab25eeb5Syz
1333ab25eeb5Syz if (outsize < sizeof(*aps)) {
1334ab25eeb5Syz error = ENOBUFS;
1335ab25eeb5Syz goto finished;
13367c478bd9Sstevel@tonic-gate }
1337ab25eeb5Syz
1338ab25eeb5Syz s = ipn->ipn_data;
1339ab25eeb5Syz bcopy((char *)aps, s, sizeof(*aps));
1340ab25eeb5Syz s += sizeof(*aps);
1341ab25eeb5Syz outsize -= sizeof(*aps);
1342ab25eeb5Syz if ((aps->aps_data != NULL) && (outsize >= aps->aps_psiz))
1343ab25eeb5Syz bcopy(aps->aps_data, s, aps->aps_psiz);
1344ab25eeb5Syz else
1345ab25eeb5Syz error = ENOBUFS;
1346ab25eeb5Syz }
1347ab25eeb5Syz if (error == 0) {
1348ab25eeb5Syz error = fr_outobjsz(data, ipn, IPFOBJ_NATSAVE, ipns.ipn_dsize);
1349ab25eeb5Syz }
1350ab25eeb5Syz
1351ab25eeb5Syz finished:
1352ab25eeb5Syz if (ipn != NULL) {
1353ab25eeb5Syz KFREES(ipn, ipns.ipn_dsize);
13547c478bd9Sstevel@tonic-gate }
13557c478bd9Sstevel@tonic-gate return error;
13567c478bd9Sstevel@tonic-gate }
13577c478bd9Sstevel@tonic-gate
13583c50f6d6San /* ------------------------------------------------------------------------ */
13593c50f6d6San /* Function: nat_calc_chksum_diffs */
13603c50f6d6San /* Returns: void */
13613c50f6d6San /* Parameters: nat - pointer to NAT table entry */
13623c50f6d6San /* */
13633c50f6d6San /* Function calculates chksum deltas for IP header (nat_ipsumd) and TCP/UDP */
13643c50f6d6San /* headers (nat_sumd). The things for L4 (UDP/TCP) get complicated when */
13653c50f6d6San /* we are dealing with partial chksum offload. For these cases we need to */
13663c50f6d6San /* compute a 'partial chksum delta'. The 'partial chksum delta'is stored */
13673c50f6d6San /* into nat_sumd[1], while ordinary chksum delta for TCP/UDP is in */
13683c50f6d6San /* nat_sumd[0]. */
13693c50f6d6San /* */
13703c50f6d6San /* The function accepts initialized NAT table entry and computes the deltas */
13713c50f6d6San /* from nat_inip/nat_outip members. The function is called right before */
13723c50f6d6San /* the new entry is inserted into the table. */
13733c50f6d6San /* */
13743c50f6d6San /* The ipsumd (IP hedaer chksum delta adjustment) is computed as a chksum */
13753c50f6d6San /* of delta between original and new IP addresses. */
13763c50f6d6San /* */
13773c50f6d6San /* the nat_sumd[0] (TCP/UDP header chksum delta adjustment) is computed as */
13783c50f6d6San /* a chkusm of delta between original an new IP addrress:port tupples. */
13793c50f6d6San /* */
13803c50f6d6San /* Some facts about chksum, we should remember: */
13813c50f6d6San /* IP header chksum covers IP header only */
1382*55fea89dSDan Cross /* */
13833c50f6d6San /* TCP/UDP chksum covers data payload and so called pseudo header */
13843c50f6d6San /* SRC, DST IP address */
13853c50f6d6San /* SRC, DST Port */
13863c50f6d6San /* length of payload */
13873c50f6d6San /* */
13883c50f6d6San /* The partial chksum delta (nat_sumd[1] is used to adjust db_ckusm16 */
13893c50f6d6San /* member of dblk_t structure. The db_ckusm16 member is not part of */
13903c50f6d6San /* IP/UDP/TCP header it is 16 bit value computed by NIC driver with partial */
13913c50f6d6San /* chksum offload capacbility for every inbound packet. The db_cksum16 is */
13923c50f6d6San /* stored along with other IP packet data in dblk_t structure and used in */
13933c50f6d6San /* for IP/UDP/TCP chksum validation later in ip.c. */
13943c50f6d6San /* */
13953c50f6d6San /* The partial chksum delta (adjustment, nat_sumd[1]) is computed as chksum */
13963c50f6d6San /* of delta between new and orig address. NOTE: the order of operands for */
13973c50f6d6San /* partial delta operation is swapped compared to computing the IP/TCP/UDP */
13983c50f6d6San /* header adjustment. It is by design see (IP_CKSUM_RECV() macro in ip.c). */
13993c50f6d6San /* */
14003c50f6d6San /* ------------------------------------------------------------------------ */
nat_calc_chksum_diffs(nat)1401d6c23f6fSyx void nat_calc_chksum_diffs(nat)
14023c50f6d6San nat_t *nat;
14033c50f6d6San {
14043c50f6d6San u_32_t sum_orig = 0;
14053c50f6d6San u_32_t sum_changed = 0;
14063c50f6d6San u_32_t sumd;
14073c50f6d6San u_32_t ipsum_orig = 0;
14083c50f6d6San u_32_t ipsum_changed = 0;
14093c50f6d6San
1410d6c23f6fSyx if (nat->nat_v != 4 && nat->nat_v != 6)
1411d6c23f6fSyx return;
1412d6c23f6fSyx
14133c50f6d6San /*
14143c50f6d6San * the switch calculates operands for CALC_SUMD(),
14153c50f6d6San * which will compute the partial chksum delta.
14163c50f6d6San */
1417*55fea89dSDan Cross switch (nat->nat_dir)
14183c50f6d6San {
14193c50f6d6San case NAT_INBOUND:
1420*55fea89dSDan Cross /*
14213c50f6d6San * we are dealing with RDR rule (DST address gets
14223c50f6d6San * modified on packet from client)
14233c50f6d6San */
1424d6c23f6fSyx if (nat->nat_v == 4) {
1425d6c23f6fSyx sum_changed = LONG_SUM(ntohl(nat->nat_inip.s_addr));
1426d6c23f6fSyx sum_orig = LONG_SUM(ntohl(nat->nat_outip.s_addr));
1427d6c23f6fSyx } else {
1428d6c23f6fSyx sum_changed = LONG_SUM6(&nat->nat_inip6);
1429d6c23f6fSyx sum_orig = LONG_SUM6(&nat->nat_outip6);
1430d6c23f6fSyx }
14313c50f6d6San break;
14323c50f6d6San case NAT_OUTBOUND:
1433*55fea89dSDan Cross /*
14343c50f6d6San * we are dealing with MAP rule (SRC address gets
14353c50f6d6San * modified on packet from client)
14363c50f6d6San */
1437d6c23f6fSyx if (nat->nat_v == 4) {
1438d6c23f6fSyx sum_changed = LONG_SUM(ntohl(nat->nat_outip.s_addr));
1439d6c23f6fSyx sum_orig = LONG_SUM(ntohl(nat->nat_inip.s_addr));
1440d6c23f6fSyx } else {
1441d6c23f6fSyx sum_changed = LONG_SUM6(&nat->nat_outip6);
1442d6c23f6fSyx sum_orig = LONG_SUM6(&nat->nat_inip6);
1443d6c23f6fSyx }
14443c50f6d6San break;
14453c50f6d6San default: ;
14463c50f6d6San break;
14473c50f6d6San }
14483c50f6d6San
14493c50f6d6San /*
1450*55fea89dSDan Cross * we also preserve CALC_SUMD() operands here, for IP chksum delta
14513c50f6d6San * calculation, which happens at the end of function.
14523c50f6d6San */
14533c50f6d6San ipsum_changed = sum_changed;
14543c50f6d6San ipsum_orig = sum_orig;
14553c50f6d6San /*
1456*55fea89dSDan Cross * NOTE: the order of operands for partial chksum adjustment
14573c50f6d6San * computation has to be swapped!
14583c50f6d6San */
14593c50f6d6San CALC_SUMD(sum_changed, sum_orig, sumd);
14603c50f6d6San nat->nat_sumd[1] = (sumd & 0xffff) + (sumd >> 16);
14613c50f6d6San
146227dbc409San if (nat->nat_flags & (IPN_TCPUDP | IPN_ICMPQUERY)) {
1463*55fea89dSDan Cross
14643c50f6d6San /*
14653c50f6d6San * switch calculates operands for CALC_SUMD(), which will
14663c50f6d6San * compute the full chksum delta.
14673c50f6d6San */
1468*55fea89dSDan Cross switch (nat->nat_dir)
14693c50f6d6San {
14703c50f6d6San case NAT_INBOUND:
1471d6c23f6fSyx if (nat->nat_v == 4) {
1472d6c23f6fSyx sum_changed = LONG_SUM(
1473d6c23f6fSyx ntohl(nat->nat_inip.s_addr) +
1474d6c23f6fSyx ntohs(nat->nat_inport));
1475d6c23f6fSyx sum_orig = LONG_SUM(
1476d6c23f6fSyx ntohl(nat->nat_outip.s_addr) +
1477d6c23f6fSyx ntohs(nat->nat_outport));
1478d6c23f6fSyx } else {
1479d6c23f6fSyx sum_changed = LONG_SUM6(&nat->nat_inip6) +
1480d6c23f6fSyx ntohs(nat->nat_inport);
1481d6c23f6fSyx sum_orig = LONG_SUM6(&nat->nat_outip6) +
1482d6c23f6fSyx ntohs(nat->nat_outport);
1483d6c23f6fSyx }
14843c50f6d6San break;
14853c50f6d6San case NAT_OUTBOUND:
1486d6c23f6fSyx if (nat->nat_v == 4) {
1487d6c23f6fSyx sum_changed = LONG_SUM(
1488d6c23f6fSyx ntohl(nat->nat_outip.s_addr) +
1489d6c23f6fSyx ntohs(nat->nat_outport));
1490d6c23f6fSyx sum_orig = LONG_SUM(
1491d6c23f6fSyx ntohl(nat->nat_inip.s_addr) +
1492d6c23f6fSyx ntohs(nat->nat_inport));
1493d6c23f6fSyx } else {
1494d6c23f6fSyx sum_changed = LONG_SUM6(&nat->nat_outip6) +
1495d6c23f6fSyx ntohs(nat->nat_outport);
1496d6c23f6fSyx sum_orig = LONG_SUM6(&nat->nat_inip6) +
1497d6c23f6fSyx ntohs(nat->nat_inport);
1498d6c23f6fSyx }
14993c50f6d6San break;
15003c50f6d6San default: ;
15013c50f6d6San break;
15023c50f6d6San }
15033c50f6d6San
15043c50f6d6San CALC_SUMD(sum_orig, sum_changed, sumd);
15053c50f6d6San nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
150627dbc409San
150727dbc409San if (!(nat->nat_flags & IPN_TCPUDP)) {
150827dbc409San /*
150927dbc409San * partial HW chksum offload works for TCP/UDP headers only,
151027dbc409San * so we need to enforce full chksum adjustment for ICMP
151127dbc409San */
151227dbc409San nat->nat_sumd[1] = nat->nat_sumd[0];
151327dbc409San }
15143c50f6d6San }
15153c50f6d6San else
15163c50f6d6San nat->nat_sumd[0] = nat->nat_sumd[1];
15173c50f6d6San
15183c50f6d6San /*
15193c50f6d6San * we may reuse the already computed nat_sumd[0] for IP header chksum
15203c50f6d6San * adjustment in case the L4 (TCP/UDP header) is not changed by NAT.
15213c50f6d6San */
1522d6c23f6fSyx if (nat->nat_v == 4) {
1523d6c23f6fSyx if (NAT_HAS_L4_CHANGED(nat)) {
1524d6c23f6fSyx /*
1525d6c23f6fSyx * bad luck, NAT changes also the L4 header, use IP
1526d6c23f6fSyx * addresses to compute chksum adjustment for IP header.
1527d6c23f6fSyx */
1528d6c23f6fSyx CALC_SUMD(ipsum_orig, ipsum_changed, sumd);
1529d6c23f6fSyx nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16);
1530d6c23f6fSyx } else {
1531d6c23f6fSyx /*
1532d6c23f6fSyx * the NAT does not change L4 hdr -> reuse chksum
1533d6c23f6fSyx * adjustment for IP hdr.
1534d6c23f6fSyx */
1535d6c23f6fSyx nat->nat_ipsumd = nat->nat_sumd[0];
153627dbc409San
1537d6c23f6fSyx /*
1538d6c23f6fSyx * if L4 header does not use chksum - zero out deltas
1539d6c23f6fSyx */
1540d6c23f6fSyx if (!(nat->nat_flags & IPN_TCPUDP)) {
1541d6c23f6fSyx nat->nat_sumd[0] = 0;
1542d6c23f6fSyx nat->nat_sumd[1] = 0;
1543d6c23f6fSyx }
154427dbc409San }
15453c50f6d6San }
15463c50f6d6San
15473c50f6d6San return;
15483c50f6d6San }
15497c478bd9Sstevel@tonic-gate
15507c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
15517c478bd9Sstevel@tonic-gate /* Function: fr_natputent */
15527c478bd9Sstevel@tonic-gate /* Returns: int - 0 == success, != 0 is the error value. */
1553ea8244dcSJohn Ojemann /* Parameters: data(I) - pointer to natget structure with NAT */
1554ea8244dcSJohn Ojemann /* structure information to load into the kernel */
1555ab25eeb5Syz /* getlock(I) - flag indicating whether or not a write lock */
1556ab25eeb5Syz /* on ipf_nat is already held. */
1557ea8244dcSJohn Ojemann /* ifs - ipf stack instance */
15587c478bd9Sstevel@tonic-gate /* */
15597c478bd9Sstevel@tonic-gate /* Handle SIOCSTPUT. */
15607c478bd9Sstevel@tonic-gate /* Loads a NAT table entry from user space, including a NAT rule, proxy and */
15617c478bd9Sstevel@tonic-gate /* firewall rule data structures, if pointers to them indicate so. */
15627c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_natputent(data,getlock,ifs)1563f4b3ec61Sdh static int fr_natputent(data, getlock, ifs)
15647c478bd9Sstevel@tonic-gate caddr_t data;
15654556481eSjojemann int getlock;
1566f4b3ec61Sdh ipf_stack_t *ifs;
15677c478bd9Sstevel@tonic-gate {
15687c478bd9Sstevel@tonic-gate nat_save_t ipn, *ipnn;
15697c478bd9Sstevel@tonic-gate ap_session_t *aps;
15707c478bd9Sstevel@tonic-gate nat_t *n, *nat;
15717c478bd9Sstevel@tonic-gate frentry_t *fr;
15725b6dcef9Sdr fr_info_t fin;
15737c478bd9Sstevel@tonic-gate ipnat_t *in;
15747c478bd9Sstevel@tonic-gate int error;
15757c478bd9Sstevel@tonic-gate
15767c478bd9Sstevel@tonic-gate error = fr_inobj(data, &ipn, IPFOBJ_NATSAVE);
15777c478bd9Sstevel@tonic-gate if (error != 0)
15787c478bd9Sstevel@tonic-gate return error;
15797c478bd9Sstevel@tonic-gate
15803805c50fSan /*
1581ea8244dcSJohn Ojemann * Trigger automatic call to nat_flushtable() if the
15823805c50fSan * table has reached capcity specified by hi watermark.
15833805c50fSan */
1584ea8244dcSJohn Ojemann if (NAT_TAB_WATER_LEVEL(ifs) > ifs->ifs_nat_flush_level_hi)
15853805c50fSan ifs->ifs_nat_doflush = 1;
15863805c50fSan
15875b48165cSJohn Ojemann /*
15885b48165cSJohn Ojemann * If automatic flushing did not do its job, and the table
15895b48165cSJohn Ojemann * has filled up, don't try to create a new entry.
15905b48165cSJohn Ojemann */
15915b48165cSJohn Ojemann if (ifs->ifs_nat_stats.ns_inuse >= ifs->ifs_ipf_nattable_max) {
15925b48165cSJohn Ojemann ifs->ifs_nat_stats.ns_memfail++;
15935b48165cSJohn Ojemann return ENOMEM;
15945b48165cSJohn Ojemann }
15955b48165cSJohn Ojemann
1596ab25eeb5Syz /*
1597ab25eeb5Syz * Initialise early because of code at junkput label.
1598ab25eeb5Syz */
1599ab25eeb5Syz in = NULL;
1600ab25eeb5Syz aps = NULL;
16017c478bd9Sstevel@tonic-gate nat = NULL;
1602ab25eeb5Syz ipnn = NULL;
1603ab25eeb5Syz
1604ab25eeb5Syz /*
1605ab25eeb5Syz * New entry, copy in the rest of the NAT entry if it's size is more
1606ab25eeb5Syz * than just the nat_t structure.
1607ab25eeb5Syz */
1608ab25eeb5Syz fr = NULL;
1609ab25eeb5Syz if (ipn.ipn_dsize > sizeof(ipn)) {
1610ab25eeb5Syz if (ipn.ipn_dsize > 81920) {
1611ab25eeb5Syz error = ENOMEM;
1612ab25eeb5Syz goto junkput;
1613ab25eeb5Syz }
1614ab25eeb5Syz
1615ab25eeb5Syz KMALLOCS(ipnn, nat_save_t *, ipn.ipn_dsize);
16167c478bd9Sstevel@tonic-gate if (ipnn == NULL)
16177c478bd9Sstevel@tonic-gate return ENOMEM;
16187c478bd9Sstevel@tonic-gate
1619ab25eeb5Syz error = fr_inobjsz(data, ipnn, IPFOBJ_NATSAVE, ipn.ipn_dsize);
16207c478bd9Sstevel@tonic-gate if (error != 0) {
16217c478bd9Sstevel@tonic-gate error = EFAULT;
16227c478bd9Sstevel@tonic-gate goto junkput;
16237c478bd9Sstevel@tonic-gate }
16247c478bd9Sstevel@tonic-gate } else
1625ab25eeb5Syz ipnn = &ipn;
16267c478bd9Sstevel@tonic-gate
16277c478bd9Sstevel@tonic-gate KMALLOC(nat, nat_t *);
16287c478bd9Sstevel@tonic-gate if (nat == NULL) {
16297c478bd9Sstevel@tonic-gate error = ENOMEM;
16307c478bd9Sstevel@tonic-gate goto junkput;
16317c478bd9Sstevel@tonic-gate }
16327c478bd9Sstevel@tonic-gate
1633ab25eeb5Syz bcopy((char *)&ipnn->ipn_nat, (char *)nat, sizeof(*nat));
16347c478bd9Sstevel@tonic-gate /*
16357c478bd9Sstevel@tonic-gate * Initialize all these so that nat_delete() doesn't cause a crash.
16367c478bd9Sstevel@tonic-gate */
1637ab25eeb5Syz bzero((char *)nat, offsetof(struct nat, nat_tqe));
1638ab25eeb5Syz nat->nat_tqe.tqe_pnext = NULL;
1639ab25eeb5Syz nat->nat_tqe.tqe_next = NULL;
1640ab25eeb5Syz nat->nat_tqe.tqe_ifq = NULL;
1641ab25eeb5Syz nat->nat_tqe.tqe_parent = nat;
16427c478bd9Sstevel@tonic-gate
16437c478bd9Sstevel@tonic-gate /*
16447c478bd9Sstevel@tonic-gate * Restore the rule associated with this nat session
16457c478bd9Sstevel@tonic-gate */
1646ab25eeb5Syz in = ipnn->ipn_nat.nat_ptr;
16477c478bd9Sstevel@tonic-gate if (in != NULL) {
16487c478bd9Sstevel@tonic-gate KMALLOC(in, ipnat_t *);
1649ab25eeb5Syz nat->nat_ptr = in;
16507c478bd9Sstevel@tonic-gate if (in == NULL) {
16517c478bd9Sstevel@tonic-gate error = ENOMEM;
16527c478bd9Sstevel@tonic-gate goto junkput;
16537c478bd9Sstevel@tonic-gate }
1654ab25eeb5Syz bzero((char *)in, offsetof(struct ipnat, in_next6));
1655ab25eeb5Syz bcopy((char *)&ipnn->ipn_ipnat, (char *)in, sizeof(*in));
16567c478bd9Sstevel@tonic-gate in->in_use = 1;
16577c478bd9Sstevel@tonic-gate in->in_flags |= IPN_DELETE;
1658ab25eeb5Syz
1659f4b3ec61Sdh ATOMIC_INC(ifs->ifs_nat_stats.ns_rules);
16607c478bd9Sstevel@tonic-gate
1661dcf3e898Sjojemann if (nat_resolverule(in, ifs) != 0) {
1662dcf3e898Sjojemann error = ESRCH;
1663dcf3e898Sjojemann goto junkput;
1664dcf3e898Sjojemann }
16657c478bd9Sstevel@tonic-gate }
16667c478bd9Sstevel@tonic-gate
16675b6dcef9Sdr /*
16685b6dcef9Sdr * Check that the NAT entry doesn't already exist in the kernel.
16695b6dcef9Sdr */
1670d6c23f6fSyx if (nat->nat_v != 6)
1671d6c23f6fSyx nat->nat_v = 4;
16725b6dcef9Sdr bzero((char *)&fin, sizeof(fin));
16735b6dcef9Sdr fin.fin_p = nat->nat_p;
167475c9105fSjojemann fin.fin_ifs = ifs;
16755b6dcef9Sdr if (nat->nat_dir == NAT_OUTBOUND) {
16765b6dcef9Sdr fin.fin_data[0] = ntohs(nat->nat_oport);
16775b6dcef9Sdr fin.fin_data[1] = ntohs(nat->nat_outport);
1678e6c6c1faSyz fin.fin_ifp = nat->nat_ifps[0];
16794556481eSjojemann if (getlock) {
1680f4b3ec61Sdh READ_ENTER(&ifs->ifs_ipf_nat);
16814556481eSjojemann }
1682d6c23f6fSyx
1683d6c23f6fSyx switch (nat->nat_v)
1684d6c23f6fSyx {
1685d6c23f6fSyx case 4:
1686d6c23f6fSyx fin.fin_v = nat->nat_v;
1687d6c23f6fSyx n = nat_inlookup(&fin, nat->nat_flags, fin.fin_p,
1688d6c23f6fSyx nat->nat_oip, nat->nat_outip);
1689d6c23f6fSyx break;
1690d6c23f6fSyx #ifdef USE_INET6
1691d6c23f6fSyx case 6:
1692d6c23f6fSyx n = nat6_inlookup(&fin, nat->nat_flags, fin.fin_p,
1693d6c23f6fSyx &nat->nat_oip6.in6, &nat->nat_outip6.in6);
1694d6c23f6fSyx break;
1695d6c23f6fSyx #endif
1696d6c23f6fSyx default:
1697d6c23f6fSyx n = NULL;
1698d6c23f6fSyx break;
1699d6c23f6fSyx }
1700d6c23f6fSyx
17014556481eSjojemann if (getlock) {
1702f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
17034556481eSjojemann }
17044556481eSjojemann if (n != NULL) {
17055b6dcef9Sdr error = EEXIST;
17065b6dcef9Sdr goto junkput;
17075b6dcef9Sdr }
17085b6dcef9Sdr } else if (nat->nat_dir == NAT_INBOUND) {
17094d886df3Sjojemann fin.fin_data[0] = ntohs(nat->nat_inport);
17105b6dcef9Sdr fin.fin_data[1] = ntohs(nat->nat_oport);
1711e6c6c1faSyz fin.fin_ifp = nat->nat_ifps[1];
17124556481eSjojemann if (getlock) {
1713f4b3ec61Sdh READ_ENTER(&ifs->ifs_ipf_nat);
17144556481eSjojemann }
1715d6c23f6fSyx
1716d6c23f6fSyx switch (nat->nat_v)
1717d6c23f6fSyx {
1718d6c23f6fSyx case 4:
1719d6c23f6fSyx n = nat_outlookup(&fin, nat->nat_flags, fin.fin_p,
1720d6c23f6fSyx nat->nat_inip, nat->nat_oip);
1721d6c23f6fSyx break;
1722d6c23f6fSyx #ifdef USE_INET6
1723d6c23f6fSyx case 6:
1724d6c23f6fSyx n = nat6_outlookup(&fin, nat->nat_flags, fin.fin_p,
1725d6c23f6fSyx &nat->nat_inip6.in6, &nat->nat_oip6.in6);
1726d6c23f6fSyx break;
1727d6c23f6fSyx #endif
1728d6c23f6fSyx default:
1729d6c23f6fSyx n = NULL;
1730d6c23f6fSyx break;
1731d6c23f6fSyx }
1732d6c23f6fSyx
17334556481eSjojemann if (getlock) {
1734f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
17354556481eSjojemann }
17364556481eSjojemann if (n != NULL) {
17375b6dcef9Sdr error = EEXIST;
17385b6dcef9Sdr goto junkput;
17395b6dcef9Sdr }
17405b6dcef9Sdr } else {
17415b6dcef9Sdr error = EINVAL;
17425b6dcef9Sdr goto junkput;
17435b6dcef9Sdr }
17445b6dcef9Sdr
17457c478bd9Sstevel@tonic-gate /*
17467c478bd9Sstevel@tonic-gate * Restore ap_session_t structure. Include the private data allocated
17477c478bd9Sstevel@tonic-gate * if it was there.
17487c478bd9Sstevel@tonic-gate */
1749ab25eeb5Syz aps = nat->nat_aps;
17507c478bd9Sstevel@tonic-gate if (aps != NULL) {
17517c478bd9Sstevel@tonic-gate KMALLOC(aps, ap_session_t *);
1752ab25eeb5Syz nat->nat_aps = aps;
17537c478bd9Sstevel@tonic-gate if (aps == NULL) {
17547c478bd9Sstevel@tonic-gate error = ENOMEM;
17557c478bd9Sstevel@tonic-gate goto junkput;
17567c478bd9Sstevel@tonic-gate }
17577c478bd9Sstevel@tonic-gate bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps));
1758ab25eeb5Syz if (in != NULL)
17597c478bd9Sstevel@tonic-gate aps->aps_apr = in->in_apr;
1760ab25eeb5Syz else
1761ab25eeb5Syz aps->aps_apr = NULL;
17627c478bd9Sstevel@tonic-gate if (aps->aps_psiz != 0) {
1763ab25eeb5Syz if (aps->aps_psiz > 81920) {
1764ab25eeb5Syz error = ENOMEM;
1765ab25eeb5Syz goto junkput;
1766ab25eeb5Syz }
17677c478bd9Sstevel@tonic-gate KMALLOCS(aps->aps_data, void *, aps->aps_psiz);
17687c478bd9Sstevel@tonic-gate if (aps->aps_data == NULL) {
17697c478bd9Sstevel@tonic-gate error = ENOMEM;
17707c478bd9Sstevel@tonic-gate goto junkput;
17717c478bd9Sstevel@tonic-gate }
17727c478bd9Sstevel@tonic-gate bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data,
17737c478bd9Sstevel@tonic-gate aps->aps_psiz);
17747c478bd9Sstevel@tonic-gate } else {
17757c478bd9Sstevel@tonic-gate aps->aps_psiz = 0;
17767c478bd9Sstevel@tonic-gate aps->aps_data = NULL;
17777c478bd9Sstevel@tonic-gate }
17787c478bd9Sstevel@tonic-gate }
17797c478bd9Sstevel@tonic-gate
17807c478bd9Sstevel@tonic-gate /*
17817c478bd9Sstevel@tonic-gate * If there was a filtering rule associated with this entry then
17827c478bd9Sstevel@tonic-gate * build up a new one.
17837c478bd9Sstevel@tonic-gate */
1784ab25eeb5Syz fr = nat->nat_fr;
17857c478bd9Sstevel@tonic-gate if (fr != NULL) {
1786ab25eeb5Syz if ((nat->nat_flags & SI_NEWFR) != 0) {
17877c478bd9Sstevel@tonic-gate KMALLOC(fr, frentry_t *);
17887c478bd9Sstevel@tonic-gate nat->nat_fr = fr;
17897c478bd9Sstevel@tonic-gate if (fr == NULL) {
17907c478bd9Sstevel@tonic-gate error = ENOMEM;
17917c478bd9Sstevel@tonic-gate goto junkput;
17927c478bd9Sstevel@tonic-gate }
1793ab25eeb5Syz ipnn->ipn_nat.nat_fr = fr;
1794ab25eeb5Syz (void) fr_outobj(data, ipnn, IPFOBJ_NATSAVE);
1795ab25eeb5Syz bcopy((char *)&ipnn->ipn_fr, (char *)fr, sizeof(*fr));
1796dcf3e898Sjojemann
1797dcf3e898Sjojemann fr->fr_ref = 1;
1798dcf3e898Sjojemann fr->fr_dsize = 0;
1799dcf3e898Sjojemann fr->fr_data = NULL;
1800dcf3e898Sjojemann fr->fr_type = FR_T_NONE;
1801dcf3e898Sjojemann
18027c478bd9Sstevel@tonic-gate MUTEX_NUKE(&fr->fr_lock);
18037c478bd9Sstevel@tonic-gate MUTEX_INIT(&fr->fr_lock, "nat-filter rule lock");
18047c478bd9Sstevel@tonic-gate } else {
1805dcf3e898Sjojemann if (getlock) {
1806dcf3e898Sjojemann READ_ENTER(&ifs->ifs_ipf_nat);
1807dcf3e898Sjojemann }
1808f4b3ec61Sdh for (n = ifs->ifs_nat_instances; n; n = n->nat_next)
18097c478bd9Sstevel@tonic-gate if (n->nat_fr == fr)
18107c478bd9Sstevel@tonic-gate break;
1811ab25eeb5Syz
18124556481eSjojemann if (n != NULL) {
18134556481eSjojemann MUTEX_ENTER(&fr->fr_lock);
18144556481eSjojemann fr->fr_ref++;
18154556481eSjojemann MUTEX_EXIT(&fr->fr_lock);
18164556481eSjojemann }
1817dcf3e898Sjojemann if (getlock) {
1818dcf3e898Sjojemann RWLOCK_EXIT(&ifs->ifs_ipf_nat);
1819dcf3e898Sjojemann }
18207c478bd9Sstevel@tonic-gate if (!n) {
18217c478bd9Sstevel@tonic-gate error = ESRCH;
18227c478bd9Sstevel@tonic-gate goto junkput;
18237c478bd9Sstevel@tonic-gate }
18247c478bd9Sstevel@tonic-gate }
18257c478bd9Sstevel@tonic-gate }
18267c478bd9Sstevel@tonic-gate
1827ab25eeb5Syz if (ipnn != &ipn) {
1828ab25eeb5Syz KFREES(ipnn, ipn.ipn_dsize);
1829ab25eeb5Syz ipnn = NULL;
1830ab25eeb5Syz }
1831ab25eeb5Syz
18323c50f6d6San nat_calc_chksum_diffs(nat);
18333c50f6d6San
18344556481eSjojemann if (getlock) {
1835f4b3ec61Sdh WRITE_ENTER(&ifs->ifs_ipf_nat);
18364556481eSjojemann }
1837d6c23f6fSyx
1838d6c23f6fSyx nat_calc_chksum_diffs(nat);
1839d6c23f6fSyx
1840d6c23f6fSyx switch (nat->nat_v)
1841d6c23f6fSyx {
1842d6c23f6fSyx case 4 :
1843d6c23f6fSyx error = nat_insert(nat, nat->nat_rev, ifs);
1844d6c23f6fSyx break;
1845d6c23f6fSyx #ifdef USE_INET6
1846d6c23f6fSyx case 6 :
1847d6c23f6fSyx error = nat6_insert(nat, nat->nat_rev, ifs);
1848d6c23f6fSyx break;
1849d6c23f6fSyx #endif
1850d6c23f6fSyx default :
1851d6c23f6fSyx break;
1852d6c23f6fSyx }
1853d6c23f6fSyx
1854ab25eeb5Syz if ((error == 0) && (aps != NULL)) {
1855f4b3ec61Sdh aps->aps_next = ifs->ifs_ap_sess_list;
1856f4b3ec61Sdh ifs->ifs_ap_sess_list = aps;
1857ab25eeb5Syz }
18584556481eSjojemann if (getlock) {
1859f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
18604556481eSjojemann }
1861ab25eeb5Syz
1862ab25eeb5Syz if (error == 0)
1863ab25eeb5Syz return 0;
1864ab25eeb5Syz
18650ab54cfbSjojemann error = ENOMEM;
18660ab54cfbSjojemann
18677c478bd9Sstevel@tonic-gate junkput:
1868ab25eeb5Syz if (fr != NULL)
1869f4b3ec61Sdh (void) fr_derefrule(&fr, ifs);
1870ab25eeb5Syz
1871ab25eeb5Syz if ((ipnn != NULL) && (ipnn != &ipn)) {
1872ab25eeb5Syz KFREES(ipnn, ipn.ipn_dsize);
18737c478bd9Sstevel@tonic-gate }
18740ab54cfbSjojemann if (nat != NULL) {
18750ab54cfbSjojemann if (aps != NULL) {
18760ab54cfbSjojemann if (aps->aps_data != NULL) {
18770ab54cfbSjojemann KFREES(aps->aps_data, aps->aps_psiz);
18780ab54cfbSjojemann }
18790ab54cfbSjojemann KFREE(aps);
18800ab54cfbSjojemann }
18810ab54cfbSjojemann if (in != NULL) {
18820ab54cfbSjojemann if (in->in_apr)
18830ab54cfbSjojemann appr_free(in->in_apr);
18840ab54cfbSjojemann KFREE(in);
18850ab54cfbSjojemann }
18860ab54cfbSjojemann KFREE(nat);
18870ab54cfbSjojemann }
1888ab25eeb5Syz return error;
18897c478bd9Sstevel@tonic-gate }
18907c478bd9Sstevel@tonic-gate
18917c478bd9Sstevel@tonic-gate
18927c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
18937c478bd9Sstevel@tonic-gate /* Function: nat_delete */
1894ea8244dcSJohn Ojemann /* Returns: int - 0 if entry deleted. Otherwise, ref count on entry */
1895ea8244dcSJohn Ojemann /* Parameters: nat - pointer to the NAT entry to delete */
1896ea8244dcSJohn Ojemann /* logtype - type of LOG record to create before deleting */
1897ea8244dcSJohn Ojemann /* ifs - ipf stack instance */
18987c478bd9Sstevel@tonic-gate /* Write Lock: ipf_nat */
18997c478bd9Sstevel@tonic-gate /* */
19007c478bd9Sstevel@tonic-gate /* Delete a nat entry from the various lists and table. If NAT logging is */
19017c478bd9Sstevel@tonic-gate /* enabled then generate a NAT log record for this event. */
19027c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_delete(nat,logtype,ifs)1903ea8244dcSJohn Ojemann int nat_delete(nat, logtype, ifs)
19047c478bd9Sstevel@tonic-gate struct nat *nat;
19057c478bd9Sstevel@tonic-gate int logtype;
1906f4b3ec61Sdh ipf_stack_t *ifs;
19077c478bd9Sstevel@tonic-gate {
19087c478bd9Sstevel@tonic-gate struct ipnat *ipn;
19095b48165cSJohn Ojemann int removed = 0;
19107c478bd9Sstevel@tonic-gate
1911f4b3ec61Sdh if (logtype != 0 && ifs->ifs_nat_logging != 0)
1912f4b3ec61Sdh nat_log(nat, logtype, ifs);
19137c478bd9Sstevel@tonic-gate
19147c478bd9Sstevel@tonic-gate /*
19155b48165cSJohn Ojemann * Start by removing the entry from the hash table of nat entries
19165b48165cSJohn Ojemann * so it will not be "used" again.
19175b48165cSJohn Ojemann *
19185b48165cSJohn Ojemann * It will remain in the "list" of nat entries until all references
19195b48165cSJohn Ojemann * have been accounted for.
19207c478bd9Sstevel@tonic-gate */
19215b48165cSJohn Ojemann if ((nat->nat_phnext[0] != NULL) && (nat->nat_phnext[1] != NULL)) {
19225b48165cSJohn Ojemann removed = 1;
19235b48165cSJohn Ojemann
1924f4b3ec61Sdh ifs->ifs_nat_stats.ns_bucketlen[0][nat->nat_hv[0]]--;
1925f4b3ec61Sdh ifs->ifs_nat_stats.ns_bucketlen[1][nat->nat_hv[1]]--;
19267c478bd9Sstevel@tonic-gate
19277c478bd9Sstevel@tonic-gate *nat->nat_phnext[0] = nat->nat_hnext[0];
19287c478bd9Sstevel@tonic-gate if (nat->nat_hnext[0] != NULL) {
19297c478bd9Sstevel@tonic-gate nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
19307c478bd9Sstevel@tonic-gate nat->nat_hnext[0] = NULL;
19317c478bd9Sstevel@tonic-gate }
19327c478bd9Sstevel@tonic-gate nat->nat_phnext[0] = NULL;
19337c478bd9Sstevel@tonic-gate
19347c478bd9Sstevel@tonic-gate *nat->nat_phnext[1] = nat->nat_hnext[1];
19357c478bd9Sstevel@tonic-gate if (nat->nat_hnext[1] != NULL) {
19367c478bd9Sstevel@tonic-gate nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
19377c478bd9Sstevel@tonic-gate nat->nat_hnext[1] = NULL;
19387c478bd9Sstevel@tonic-gate }
19397c478bd9Sstevel@tonic-gate nat->nat_phnext[1] = NULL;
19407c478bd9Sstevel@tonic-gate
19417c478bd9Sstevel@tonic-gate if ((nat->nat_flags & SI_WILDP) != 0)
1942f4b3ec61Sdh ifs->ifs_nat_stats.ns_wilds--;
19437c478bd9Sstevel@tonic-gate }
19447c478bd9Sstevel@tonic-gate
19455b48165cSJohn Ojemann /*
19465b48165cSJohn Ojemann * Next, remove it from the timeout queue it is in.
19475b48165cSJohn Ojemann */
19485b48165cSJohn Ojemann fr_deletequeueentry(&nat->nat_tqe);
19495b48165cSJohn Ojemann
19507c478bd9Sstevel@tonic-gate if (nat->nat_me != NULL) {
19517c478bd9Sstevel@tonic-gate *nat->nat_me = NULL;
19527c478bd9Sstevel@tonic-gate nat->nat_me = NULL;
19537c478bd9Sstevel@tonic-gate }
19547c478bd9Sstevel@tonic-gate
19550e01ff8bSdr MUTEX_ENTER(&nat->nat_lock);
195633f2fefdSDarren Reed if (nat->nat_ref > 1) {
19570e01ff8bSdr nat->nat_ref--;
19580e01ff8bSdr MUTEX_EXIT(&nat->nat_lock);
19595b48165cSJohn Ojemann if (removed)
19605b48165cSJohn Ojemann ifs->ifs_nat_stats.ns_orphans++;
1961ea8244dcSJohn Ojemann return (nat->nat_ref);
19627c478bd9Sstevel@tonic-gate }
19630e01ff8bSdr MUTEX_EXIT(&nat->nat_lock);
19640e01ff8bSdr
19655b48165cSJohn Ojemann nat->nat_ref = 0;
19665b48165cSJohn Ojemann
19670e01ff8bSdr /*
19685b48165cSJohn Ojemann * If entry had already been removed,
19695b48165cSJohn Ojemann * it means we're cleaning up an orphan.
19700e01ff8bSdr */
19715b48165cSJohn Ojemann if (!removed)
19725b48165cSJohn Ojemann ifs->ifs_nat_stats.ns_orphans--;
19737c478bd9Sstevel@tonic-gate
19747c478bd9Sstevel@tonic-gate #ifdef IPFILTER_SYNC
19757c478bd9Sstevel@tonic-gate if (nat->nat_sync)
19767c478bd9Sstevel@tonic-gate ipfsync_del(nat->nat_sync);
19777c478bd9Sstevel@tonic-gate #endif
19787c478bd9Sstevel@tonic-gate
19795b48165cSJohn Ojemann /*
19805b48165cSJohn Ojemann * Now remove it from master list of nat table entries
19815b48165cSJohn Ojemann */
19825b48165cSJohn Ojemann if (nat->nat_pnext != NULL) {
19835b48165cSJohn Ojemann *nat->nat_pnext = nat->nat_next;
19845b48165cSJohn Ojemann if (nat->nat_next != NULL) {
19855b48165cSJohn Ojemann nat->nat_next->nat_pnext = nat->nat_pnext;
19865b48165cSJohn Ojemann nat->nat_next = NULL;
19875b48165cSJohn Ojemann }
19885b48165cSJohn Ojemann nat->nat_pnext = NULL;
19895b48165cSJohn Ojemann }
1990ea8244dcSJohn Ojemann
19917c478bd9Sstevel@tonic-gate if (nat->nat_fr != NULL)
1992f4b3ec61Sdh (void)fr_derefrule(&nat->nat_fr, ifs);
19937c478bd9Sstevel@tonic-gate
19947c478bd9Sstevel@tonic-gate if (nat->nat_hm != NULL)
199590b0a856Sjojemann fr_hostmapdel(&nat->nat_hm);
19967c478bd9Sstevel@tonic-gate
19977c478bd9Sstevel@tonic-gate /*
19987c478bd9Sstevel@tonic-gate * If there is an active reference from the nat entry to its parent
19997c478bd9Sstevel@tonic-gate * rule, decrement the rule's reference count and free it too if no
20007c478bd9Sstevel@tonic-gate * longer being used.
20017c478bd9Sstevel@tonic-gate */
20027c478bd9Sstevel@tonic-gate ipn = nat->nat_ptr;
20037c478bd9Sstevel@tonic-gate if (ipn != NULL) {
20047c478bd9Sstevel@tonic-gate ipn->in_space++;
20057c478bd9Sstevel@tonic-gate ipn->in_use--;
20067c478bd9Sstevel@tonic-gate if (ipn->in_use == 0 && (ipn->in_flags & IPN_DELETE)) {
20077c478bd9Sstevel@tonic-gate if (ipn->in_apr)
20087c478bd9Sstevel@tonic-gate appr_free(ipn->in_apr);
20097c478bd9Sstevel@tonic-gate KFREE(ipn);
2010f4b3ec61Sdh ifs->ifs_nat_stats.ns_rules--;
20117c478bd9Sstevel@tonic-gate }
20127c478bd9Sstevel@tonic-gate }
20137c478bd9Sstevel@tonic-gate
20147c478bd9Sstevel@tonic-gate MUTEX_DESTROY(&nat->nat_lock);
20157c478bd9Sstevel@tonic-gate
2016f4b3ec61Sdh aps_free(nat->nat_aps, ifs);
2017f4b3ec61Sdh ifs->ifs_nat_stats.ns_inuse--;
20187c478bd9Sstevel@tonic-gate
20197c478bd9Sstevel@tonic-gate /*
20207c478bd9Sstevel@tonic-gate * If there's a fragment table entry too for this nat entry, then
20217c478bd9Sstevel@tonic-gate * dereference that as well. This is after nat_lock is released
20227c478bd9Sstevel@tonic-gate * because of Tru64.
20237c478bd9Sstevel@tonic-gate */
2024f4b3ec61Sdh fr_forgetnat((void *)nat, ifs);
20257c478bd9Sstevel@tonic-gate
20267c478bd9Sstevel@tonic-gate KFREE(nat);
20277c478bd9Sstevel@tonic-gate
2028ea8244dcSJohn Ojemann return (0);
20297c478bd9Sstevel@tonic-gate }
20307c478bd9Sstevel@tonic-gate
20317c478bd9Sstevel@tonic-gate
20327c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
20337c478bd9Sstevel@tonic-gate /* Function: nat_clearlist */
20347c478bd9Sstevel@tonic-gate /* Returns: int - number of NAT/RDR rules deleted */
20357c478bd9Sstevel@tonic-gate /* Parameters: Nil */
20367c478bd9Sstevel@tonic-gate /* */
20377c478bd9Sstevel@tonic-gate /* Delete all rules in the current list of rules. There is nothing elegant */
20387c478bd9Sstevel@tonic-gate /* about this cleanup: simply free all entries on the list of rules and */
20397c478bd9Sstevel@tonic-gate /* clear out the tables used for hashed NAT rule lookups. */
20407c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_clearlist(ifs)2041f4b3ec61Sdh static int nat_clearlist(ifs)
2042f4b3ec61Sdh ipf_stack_t *ifs;
20437c478bd9Sstevel@tonic-gate {
2044f4b3ec61Sdh ipnat_t *n, **np = &ifs->ifs_nat_list;
20457c478bd9Sstevel@tonic-gate int i = 0;
20467c478bd9Sstevel@tonic-gate
2047f4b3ec61Sdh if (ifs->ifs_nat_rules != NULL)
2048f4b3ec61Sdh bzero((char *)ifs->ifs_nat_rules,
2049f4b3ec61Sdh sizeof(*ifs->ifs_nat_rules) * ifs->ifs_ipf_natrules_sz);
2050f4b3ec61Sdh if (ifs->ifs_rdr_rules != NULL)
2051f4b3ec61Sdh bzero((char *)ifs->ifs_rdr_rules,
2052f4b3ec61Sdh sizeof(*ifs->ifs_rdr_rules) * ifs->ifs_ipf_rdrrules_sz);
20537c478bd9Sstevel@tonic-gate
20547c478bd9Sstevel@tonic-gate while ((n = *np) != NULL) {
20557c478bd9Sstevel@tonic-gate *np = n->in_next;
20567c478bd9Sstevel@tonic-gate if (n->in_use == 0) {
20577c478bd9Sstevel@tonic-gate if (n->in_apr != NULL)
20587c478bd9Sstevel@tonic-gate appr_free(n->in_apr);
20597c478bd9Sstevel@tonic-gate KFREE(n);
2060f4b3ec61Sdh ifs->ifs_nat_stats.ns_rules--;
20617c478bd9Sstevel@tonic-gate } else {
20627c478bd9Sstevel@tonic-gate n->in_flags |= IPN_DELETE;
20637c478bd9Sstevel@tonic-gate n->in_next = NULL;
20647c478bd9Sstevel@tonic-gate }
20657c478bd9Sstevel@tonic-gate i++;
20667c478bd9Sstevel@tonic-gate }
2067f4b3ec61Sdh ifs->ifs_nat_masks = 0;
2068f4b3ec61Sdh ifs->ifs_rdr_masks = 0;
2069d6c23f6fSyx for (i = 0; i < 4; i++) {
2070d6c23f6fSyx ifs->ifs_nat6_masks[i] = 0;
2071d6c23f6fSyx ifs->ifs_rdr6_masks[i] = 0;
2072d6c23f6fSyx }
20737c478bd9Sstevel@tonic-gate return i;
20747c478bd9Sstevel@tonic-gate }
20757c478bd9Sstevel@tonic-gate
20767c478bd9Sstevel@tonic-gate
20777c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
20787c478bd9Sstevel@tonic-gate /* Function: nat_newmap */
20797c478bd9Sstevel@tonic-gate /* Returns: int - -1 == error, 0 == success */
20807c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */
20817c478bd9Sstevel@tonic-gate /* nat(I) - pointer to NAT entry */
20827c478bd9Sstevel@tonic-gate /* ni(I) - pointer to structure with misc. information needed */
20837c478bd9Sstevel@tonic-gate /* to create new NAT entry. */
20847c478bd9Sstevel@tonic-gate /* */
20857c478bd9Sstevel@tonic-gate /* Given an empty NAT structure, populate it with new information about a */
20867c478bd9Sstevel@tonic-gate /* new NAT session, as defined by the matching NAT rule. */
2087ab25eeb5Syz /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
2088ab25eeb5Syz /* to the new IP address for the translation. */
20897c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_newmap(fin,nat,ni)20907c478bd9Sstevel@tonic-gate static INLINE int nat_newmap(fin, nat, ni)
20917c478bd9Sstevel@tonic-gate fr_info_t *fin;
20927c478bd9Sstevel@tonic-gate nat_t *nat;
20937c478bd9Sstevel@tonic-gate natinfo_t *ni;
20947c478bd9Sstevel@tonic-gate {
20957c478bd9Sstevel@tonic-gate u_short st_port, dport, sport, port, sp, dp;
20967c478bd9Sstevel@tonic-gate struct in_addr in, inb;
20977c478bd9Sstevel@tonic-gate hostmap_t *hm;
20987c478bd9Sstevel@tonic-gate u_32_t flags;
20997c478bd9Sstevel@tonic-gate u_32_t st_ip;
21007c478bd9Sstevel@tonic-gate ipnat_t *np;
21017c478bd9Sstevel@tonic-gate nat_t *natl;
21027c478bd9Sstevel@tonic-gate int l;
2103f4b3ec61Sdh ipf_stack_t *ifs = fin->fin_ifs;
21047c478bd9Sstevel@tonic-gate
21057c478bd9Sstevel@tonic-gate /*
21067c478bd9Sstevel@tonic-gate * If it's an outbound packet which doesn't match any existing
21077c478bd9Sstevel@tonic-gate * record, then create a new port
21087c478bd9Sstevel@tonic-gate */
21097c478bd9Sstevel@tonic-gate l = 0;
21107c478bd9Sstevel@tonic-gate hm = NULL;
21117c478bd9Sstevel@tonic-gate np = ni->nai_np;
21127c478bd9Sstevel@tonic-gate st_ip = np->in_nip;
21137c478bd9Sstevel@tonic-gate st_port = np->in_pnext;
21147c478bd9Sstevel@tonic-gate flags = ni->nai_flags;
21157c478bd9Sstevel@tonic-gate sport = ni->nai_sport;
21167c478bd9Sstevel@tonic-gate dport = ni->nai_dport;
21177c478bd9Sstevel@tonic-gate
21187c478bd9Sstevel@tonic-gate /*
21197c478bd9Sstevel@tonic-gate * Do a loop until we either run out of entries to try or we find
21207c478bd9Sstevel@tonic-gate * a NAT mapping that isn't currently being used. This is done
21217c478bd9Sstevel@tonic-gate * because the change to the source is not (usually) being fixed.
21227c478bd9Sstevel@tonic-gate */
21237c478bd9Sstevel@tonic-gate do {
21247c478bd9Sstevel@tonic-gate port = 0;
21257c478bd9Sstevel@tonic-gate in.s_addr = htonl(np->in_nip);
21267c478bd9Sstevel@tonic-gate if (l == 0) {
21277c478bd9Sstevel@tonic-gate /*
21287c478bd9Sstevel@tonic-gate * Check to see if there is an existing NAT
21297c478bd9Sstevel@tonic-gate * setup for this IP address pair.
21307c478bd9Sstevel@tonic-gate */
21317c478bd9Sstevel@tonic-gate hm = nat_hostmap(np, fin->fin_src, fin->fin_dst,
2132f4b3ec61Sdh in, 0, ifs);
21337c478bd9Sstevel@tonic-gate if (hm != NULL)
21347c478bd9Sstevel@tonic-gate in.s_addr = hm->hm_mapip.s_addr;
21357c478bd9Sstevel@tonic-gate } else if ((l == 1) && (hm != NULL)) {
213690b0a856Sjojemann fr_hostmapdel(&hm);
21377c478bd9Sstevel@tonic-gate }
21387c478bd9Sstevel@tonic-gate in.s_addr = ntohl(in.s_addr);
21397c478bd9Sstevel@tonic-gate
21407c478bd9Sstevel@tonic-gate nat->nat_hm = hm;
21417c478bd9Sstevel@tonic-gate
21427c478bd9Sstevel@tonic-gate if ((np->in_outmsk == 0xffffffff) && (np->in_pnext == 0)) {
21437c478bd9Sstevel@tonic-gate if (l > 0)
21447c478bd9Sstevel@tonic-gate return -1;
21457c478bd9Sstevel@tonic-gate }
21467c478bd9Sstevel@tonic-gate
21477c478bd9Sstevel@tonic-gate if (np->in_redir == NAT_BIMAP &&
21487c478bd9Sstevel@tonic-gate np->in_inmsk == np->in_outmsk) {
21497c478bd9Sstevel@tonic-gate /*
21507c478bd9Sstevel@tonic-gate * map the address block in a 1:1 fashion
21517c478bd9Sstevel@tonic-gate */
21527c478bd9Sstevel@tonic-gate in.s_addr = np->in_outip;
21537c478bd9Sstevel@tonic-gate in.s_addr |= fin->fin_saddr & ~np->in_inmsk;
21547c478bd9Sstevel@tonic-gate in.s_addr = ntohl(in.s_addr);
21557c478bd9Sstevel@tonic-gate
21567c478bd9Sstevel@tonic-gate } else if (np->in_redir & NAT_MAPBLK) {
21577c478bd9Sstevel@tonic-gate if ((l >= np->in_ppip) || ((l > 0) &&
21587c478bd9Sstevel@tonic-gate !(flags & IPN_TCPUDP)))
21597c478bd9Sstevel@tonic-gate return -1;
21607c478bd9Sstevel@tonic-gate /*
21617c478bd9Sstevel@tonic-gate * map-block - Calculate destination address.
21627c478bd9Sstevel@tonic-gate */
21637c478bd9Sstevel@tonic-gate in.s_addr = ntohl(fin->fin_saddr);
21647c478bd9Sstevel@tonic-gate in.s_addr &= ntohl(~np->in_inmsk);
21657c478bd9Sstevel@tonic-gate inb.s_addr = in.s_addr;
21667c478bd9Sstevel@tonic-gate in.s_addr /= np->in_ippip;
21677c478bd9Sstevel@tonic-gate in.s_addr &= ntohl(~np->in_outmsk);
21687c478bd9Sstevel@tonic-gate in.s_addr += ntohl(np->in_outip);
21697c478bd9Sstevel@tonic-gate /*
21707c478bd9Sstevel@tonic-gate * Calculate destination port.
21717c478bd9Sstevel@tonic-gate */
21727c478bd9Sstevel@tonic-gate if ((flags & IPN_TCPUDP) &&
21737c478bd9Sstevel@tonic-gate (np->in_ppip != 0)) {
21747c478bd9Sstevel@tonic-gate port = ntohs(sport) + l;
21757c478bd9Sstevel@tonic-gate port %= np->in_ppip;
21767c478bd9Sstevel@tonic-gate port += np->in_ppip *
21777c478bd9Sstevel@tonic-gate (inb.s_addr % np->in_ippip);
21787c478bd9Sstevel@tonic-gate port += MAPBLK_MINPORT;
21797c478bd9Sstevel@tonic-gate port = htons(port);
21807c478bd9Sstevel@tonic-gate }
21817c478bd9Sstevel@tonic-gate
21827c478bd9Sstevel@tonic-gate } else if ((np->in_outip == 0) &&
21837c478bd9Sstevel@tonic-gate (np->in_outmsk == 0xffffffff)) {
21847c478bd9Sstevel@tonic-gate /*
21857c478bd9Sstevel@tonic-gate * 0/32 - use the interface's IP address.
21867c478bd9Sstevel@tonic-gate */
21877c478bd9Sstevel@tonic-gate if ((l > 0) ||
21887c478bd9Sstevel@tonic-gate fr_ifpaddr(4, FRI_NORMAL, fin->fin_ifp,
2189f4b3ec61Sdh &in, NULL, fin->fin_ifs) == -1)
21907c478bd9Sstevel@tonic-gate return -1;
21917c478bd9Sstevel@tonic-gate in.s_addr = ntohl(in.s_addr);
21927c478bd9Sstevel@tonic-gate
21937c478bd9Sstevel@tonic-gate } else if ((np->in_outip == 0) && (np->in_outmsk == 0)) {
21947c478bd9Sstevel@tonic-gate /*
21957c478bd9Sstevel@tonic-gate * 0/0 - use the original source address/port.
21967c478bd9Sstevel@tonic-gate */
21977c478bd9Sstevel@tonic-gate if (l > 0)
21987c478bd9Sstevel@tonic-gate return -1;
21997c478bd9Sstevel@tonic-gate in.s_addr = ntohl(fin->fin_saddr);
22007c478bd9Sstevel@tonic-gate
22017c478bd9Sstevel@tonic-gate } else if ((np->in_outmsk != 0xffffffff) &&
22027c478bd9Sstevel@tonic-gate (np->in_pnext == 0) && ((l > 0) || (hm == NULL)))
22037c478bd9Sstevel@tonic-gate np->in_nip++;
22047c478bd9Sstevel@tonic-gate
22057c478bd9Sstevel@tonic-gate natl = NULL;
22067c478bd9Sstevel@tonic-gate
22077c478bd9Sstevel@tonic-gate if ((flags & IPN_TCPUDP) &&
22087c478bd9Sstevel@tonic-gate ((np->in_redir & NAT_MAPBLK) == 0) &&
22097c478bd9Sstevel@tonic-gate (np->in_flags & IPN_AUTOPORTMAP)) {
22107c478bd9Sstevel@tonic-gate /*
22117c478bd9Sstevel@tonic-gate * "ports auto" (without map-block)
22127c478bd9Sstevel@tonic-gate */
22137c478bd9Sstevel@tonic-gate if ((l > 0) && (l % np->in_ppip == 0)) {
22147c478bd9Sstevel@tonic-gate if (l > np->in_space) {
22157c478bd9Sstevel@tonic-gate return -1;
22167c478bd9Sstevel@tonic-gate } else if ((l > np->in_ppip) &&
22177c478bd9Sstevel@tonic-gate np->in_outmsk != 0xffffffff)
22187c478bd9Sstevel@tonic-gate np->in_nip++;
22197c478bd9Sstevel@tonic-gate }
22207c478bd9Sstevel@tonic-gate if (np->in_ppip != 0) {
22217c478bd9Sstevel@tonic-gate port = ntohs(sport);
22227c478bd9Sstevel@tonic-gate port += (l % np->in_ppip);
22237c478bd9Sstevel@tonic-gate port %= np->in_ppip;
22247c478bd9Sstevel@tonic-gate port += np->in_ppip *
22257c478bd9Sstevel@tonic-gate (ntohl(fin->fin_saddr) %
22267c478bd9Sstevel@tonic-gate np->in_ippip);
22277c478bd9Sstevel@tonic-gate port += MAPBLK_MINPORT;
22287c478bd9Sstevel@tonic-gate port = htons(port);
22297c478bd9Sstevel@tonic-gate }
22307c478bd9Sstevel@tonic-gate
22317c478bd9Sstevel@tonic-gate } else if (((np->in_redir & NAT_MAPBLK) == 0) &&
22327c478bd9Sstevel@tonic-gate (flags & IPN_TCPUDPICMP) && (np->in_pnext != 0)) {
22337c478bd9Sstevel@tonic-gate /*
22347c478bd9Sstevel@tonic-gate * Standard port translation. Select next port.
22357c478bd9Sstevel@tonic-gate */
2236ab073b32Sdr if (np->in_flags & IPN_SEQUENTIAL) {
2237ab073b32Sdr port = np->in_pnext;
2238ab073b32Sdr } else {
2239ab073b32Sdr port = ipf_random() % (ntohs(np->in_pmax) -
224033f2fefdSDarren Reed ntohs(np->in_pmin) + 1);
2241ab073b32Sdr port += ntohs(np->in_pmin);
2242ab073b32Sdr }
2243ab073b32Sdr port = htons(port);
2244ab073b32Sdr np->in_pnext++;
22457c478bd9Sstevel@tonic-gate
22467c478bd9Sstevel@tonic-gate if (np->in_pnext > ntohs(np->in_pmax)) {
22477c478bd9Sstevel@tonic-gate np->in_pnext = ntohs(np->in_pmin);
22487c478bd9Sstevel@tonic-gate if (np->in_outmsk != 0xffffffff)
22497c478bd9Sstevel@tonic-gate np->in_nip++;
22507c478bd9Sstevel@tonic-gate }
22517c478bd9Sstevel@tonic-gate }
22527c478bd9Sstevel@tonic-gate
22537c478bd9Sstevel@tonic-gate if (np->in_flags & IPN_IPRANGE) {
22547c478bd9Sstevel@tonic-gate if (np->in_nip > ntohl(np->in_outmsk))
22557c478bd9Sstevel@tonic-gate np->in_nip = ntohl(np->in_outip);
22567c478bd9Sstevel@tonic-gate } else {
22577c478bd9Sstevel@tonic-gate if ((np->in_outmsk != 0xffffffff) &&
22587c478bd9Sstevel@tonic-gate ((np->in_nip + 1) & ntohl(np->in_outmsk)) >
22597c478bd9Sstevel@tonic-gate ntohl(np->in_outip))
22607c478bd9Sstevel@tonic-gate np->in_nip = ntohl(np->in_outip) + 1;
22617c478bd9Sstevel@tonic-gate }
22627c478bd9Sstevel@tonic-gate
22637c478bd9Sstevel@tonic-gate if ((port == 0) && (flags & (IPN_TCPUDPICMP|IPN_ICMPQUERY)))
22647c478bd9Sstevel@tonic-gate port = sport;
22657c478bd9Sstevel@tonic-gate
22667c478bd9Sstevel@tonic-gate /*
22677c478bd9Sstevel@tonic-gate * Here we do a lookup of the connection as seen from
22687c478bd9Sstevel@tonic-gate * the outside. If an IP# pair already exists, try
22697c478bd9Sstevel@tonic-gate * again. So if you have A->B becomes C->B, you can
22707c478bd9Sstevel@tonic-gate * also have D->E become C->E but not D->B causing
22717c478bd9Sstevel@tonic-gate * another C->B. Also take protocol and ports into
22727c478bd9Sstevel@tonic-gate * account when determining whether a pre-existing
22737c478bd9Sstevel@tonic-gate * NAT setup will cause an external conflict where
22747c478bd9Sstevel@tonic-gate * this is appropriate.
22757c478bd9Sstevel@tonic-gate */
22767c478bd9Sstevel@tonic-gate inb.s_addr = htonl(in.s_addr);
22777c478bd9Sstevel@tonic-gate sp = fin->fin_data[0];
22787c478bd9Sstevel@tonic-gate dp = fin->fin_data[1];
22797c478bd9Sstevel@tonic-gate fin->fin_data[0] = fin->fin_data[1];
22807c478bd9Sstevel@tonic-gate fin->fin_data[1] = htons(port);
22817c478bd9Sstevel@tonic-gate natl = nat_inlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
22827c478bd9Sstevel@tonic-gate (u_int)fin->fin_p, fin->fin_dst, inb);
22837c478bd9Sstevel@tonic-gate fin->fin_data[0] = sp;
22847c478bd9Sstevel@tonic-gate fin->fin_data[1] = dp;
22857c478bd9Sstevel@tonic-gate
22867c478bd9Sstevel@tonic-gate /*
22877c478bd9Sstevel@tonic-gate * Has the search wrapped around and come back to the
22887c478bd9Sstevel@tonic-gate * start ?
22897c478bd9Sstevel@tonic-gate */
22907c478bd9Sstevel@tonic-gate if ((natl != NULL) &&
22917c478bd9Sstevel@tonic-gate (np->in_pnext != 0) && (st_port == np->in_pnext) &&
22927c478bd9Sstevel@tonic-gate (np->in_nip != 0) && (st_ip == np->in_nip))
22937c478bd9Sstevel@tonic-gate return -1;
22947c478bd9Sstevel@tonic-gate l++;
22957c478bd9Sstevel@tonic-gate } while (natl != NULL);
22967c478bd9Sstevel@tonic-gate
22977c478bd9Sstevel@tonic-gate if (np->in_space > 0)
22987c478bd9Sstevel@tonic-gate np->in_space--;
22997c478bd9Sstevel@tonic-gate
23007c478bd9Sstevel@tonic-gate /* Setup the NAT table */
23017c478bd9Sstevel@tonic-gate nat->nat_inip = fin->fin_src;
23027c478bd9Sstevel@tonic-gate nat->nat_outip.s_addr = htonl(in.s_addr);
23037c478bd9Sstevel@tonic-gate nat->nat_oip = fin->fin_dst;
23047c478bd9Sstevel@tonic-gate if (nat->nat_hm == NULL)
23057c478bd9Sstevel@tonic-gate nat->nat_hm = nat_hostmap(np, fin->fin_src, fin->fin_dst,
2306f4b3ec61Sdh nat->nat_outip, 0, ifs);
23077c478bd9Sstevel@tonic-gate
2308ab25eeb5Syz if (flags & IPN_TCPUDP) {
23097c478bd9Sstevel@tonic-gate nat->nat_inport = sport;
23107c478bd9Sstevel@tonic-gate nat->nat_outport = port; /* sport */
23117c478bd9Sstevel@tonic-gate nat->nat_oport = dport;
23127c478bd9Sstevel@tonic-gate ((tcphdr_t *)fin->fin_dp)->th_sport = port;
2313ab25eeb5Syz } else if (flags & IPN_ICMPQUERY) {
23147c478bd9Sstevel@tonic-gate ((icmphdr_t *)fin->fin_dp)->icmp_id = port;
2315ab25eeb5Syz nat->nat_inport = port;
2316ab25eeb5Syz nat->nat_outport = port;
23177c478bd9Sstevel@tonic-gate }
2318*55fea89dSDan Cross
2319ab25eeb5Syz ni->nai_ip.s_addr = in.s_addr;
23207c478bd9Sstevel@tonic-gate ni->nai_port = port;
23217c478bd9Sstevel@tonic-gate ni->nai_nport = dport;
23227c478bd9Sstevel@tonic-gate return 0;
23237c478bd9Sstevel@tonic-gate }
23247c478bd9Sstevel@tonic-gate
23257c478bd9Sstevel@tonic-gate
23267c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
23277c478bd9Sstevel@tonic-gate /* Function: nat_newrdr */
23287c478bd9Sstevel@tonic-gate /* Returns: int - -1 == error, 0 == success (no move), 1 == success and */
23297c478bd9Sstevel@tonic-gate /* allow rule to be moved if IPN_ROUNDR is set. */
23307c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */
23317c478bd9Sstevel@tonic-gate /* nat(I) - pointer to NAT entry */
23327c478bd9Sstevel@tonic-gate /* ni(I) - pointer to structure with misc. information needed */
23337c478bd9Sstevel@tonic-gate /* to create new NAT entry. */
23347c478bd9Sstevel@tonic-gate /* */
2335ab25eeb5Syz /* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
2336ab25eeb5Syz /* to the new IP address for the translation. */
23377c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_newrdr(fin,nat,ni)23387c478bd9Sstevel@tonic-gate static INLINE int nat_newrdr(fin, nat, ni)
23397c478bd9Sstevel@tonic-gate fr_info_t *fin;
23407c478bd9Sstevel@tonic-gate nat_t *nat;
23417c478bd9Sstevel@tonic-gate natinfo_t *ni;
23427c478bd9Sstevel@tonic-gate {
23437c478bd9Sstevel@tonic-gate u_short nport, dport, sport;
23448899fcfaSjojemann struct in_addr in, inb;
23458899fcfaSjojemann u_short sp, dp;
23467c478bd9Sstevel@tonic-gate hostmap_t *hm;
23477c478bd9Sstevel@tonic-gate u_32_t flags;
23487c478bd9Sstevel@tonic-gate ipnat_t *np;
23498899fcfaSjojemann nat_t *natl;
23507c478bd9Sstevel@tonic-gate int move;
2351f4b3ec61Sdh ipf_stack_t *ifs = fin->fin_ifs;
23527c478bd9Sstevel@tonic-gate
23537c478bd9Sstevel@tonic-gate move = 1;
23547c478bd9Sstevel@tonic-gate hm = NULL;
2355ab25eeb5Syz in.s_addr = 0;
23567c478bd9Sstevel@tonic-gate np = ni->nai_np;
23577c478bd9Sstevel@tonic-gate flags = ni->nai_flags;
23587c478bd9Sstevel@tonic-gate sport = ni->nai_sport;
23597c478bd9Sstevel@tonic-gate dport = ni->nai_dport;
23607c478bd9Sstevel@tonic-gate
23617c478bd9Sstevel@tonic-gate /*
23627c478bd9Sstevel@tonic-gate * If the matching rule has IPN_STICKY set, then we want to have the
23637c478bd9Sstevel@tonic-gate * same rule kick in as before. Why would this happen? If you have
23647c478bd9Sstevel@tonic-gate * a collection of rdr rules with "round-robin sticky", the current
23657c478bd9Sstevel@tonic-gate * packet might match a different one to the previous connection but
23667c478bd9Sstevel@tonic-gate * we want the same destination to be used.
23677c478bd9Sstevel@tonic-gate */
23687c478bd9Sstevel@tonic-gate if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) ==
23697c478bd9Sstevel@tonic-gate (IPN_ROUNDR|IPN_STICKY)) {
23707c478bd9Sstevel@tonic-gate hm = nat_hostmap(NULL, fin->fin_src, fin->fin_dst, in,
2371f4b3ec61Sdh (u_32_t)dport, ifs);
23727c478bd9Sstevel@tonic-gate if (hm != NULL) {
2373ab25eeb5Syz in.s_addr = ntohl(hm->hm_mapip.s_addr);
23747c478bd9Sstevel@tonic-gate np = hm->hm_ipnat;
23757c478bd9Sstevel@tonic-gate ni->nai_np = np;
23767c478bd9Sstevel@tonic-gate move = 0;
23777c478bd9Sstevel@tonic-gate }
23787c478bd9Sstevel@tonic-gate }
23797c478bd9Sstevel@tonic-gate
23807c478bd9Sstevel@tonic-gate /*
23817c478bd9Sstevel@tonic-gate * Otherwise, it's an inbound packet. Most likely, we don't
23827c478bd9Sstevel@tonic-gate * want to rewrite source ports and source addresses. Instead,
23837c478bd9Sstevel@tonic-gate * we want to rewrite to a fixed internal address and fixed
23847c478bd9Sstevel@tonic-gate * internal port.
23857c478bd9Sstevel@tonic-gate */
23867c478bd9Sstevel@tonic-gate if (np->in_flags & IPN_SPLIT) {
23877c478bd9Sstevel@tonic-gate in.s_addr = np->in_nip;
23887c478bd9Sstevel@tonic-gate
23897c478bd9Sstevel@tonic-gate if ((np->in_flags & (IPN_ROUNDR|IPN_STICKY)) == IPN_STICKY) {
23907c478bd9Sstevel@tonic-gate hm = nat_hostmap(np, fin->fin_src, fin->fin_dst,
2391f4b3ec61Sdh in, (u_32_t)dport, ifs);
23927c478bd9Sstevel@tonic-gate if (hm != NULL) {
23937c478bd9Sstevel@tonic-gate in.s_addr = hm->hm_mapip.s_addr;
23947c478bd9Sstevel@tonic-gate move = 0;
23957c478bd9Sstevel@tonic-gate }
23967c478bd9Sstevel@tonic-gate }
23977c478bd9Sstevel@tonic-gate
23987c478bd9Sstevel@tonic-gate if (hm == NULL || hm->hm_ref == 1) {
23997c478bd9Sstevel@tonic-gate if (np->in_inip == htonl(in.s_addr)) {
24007c478bd9Sstevel@tonic-gate np->in_nip = ntohl(np->in_inmsk);
24017c478bd9Sstevel@tonic-gate move = 0;
24027c478bd9Sstevel@tonic-gate } else {
24037c478bd9Sstevel@tonic-gate np->in_nip = ntohl(np->in_inip);
24047c478bd9Sstevel@tonic-gate }
24057c478bd9Sstevel@tonic-gate }
24067c478bd9Sstevel@tonic-gate
24077c478bd9Sstevel@tonic-gate } else if ((np->in_inip == 0) && (np->in_inmsk == 0xffffffff)) {
24087c478bd9Sstevel@tonic-gate /*
24097c478bd9Sstevel@tonic-gate * 0/32 - use the interface's IP address.
24107c478bd9Sstevel@tonic-gate */
2411f4b3ec61Sdh if (fr_ifpaddr(4, FRI_NORMAL, fin->fin_ifp, &in, NULL,
2412f4b3ec61Sdh fin->fin_ifs) == -1)
24137c478bd9Sstevel@tonic-gate return -1;
24147c478bd9Sstevel@tonic-gate in.s_addr = ntohl(in.s_addr);
24157c478bd9Sstevel@tonic-gate
24167c478bd9Sstevel@tonic-gate } else if ((np->in_inip == 0) && (np->in_inmsk== 0)) {
24177c478bd9Sstevel@tonic-gate /*
24187c478bd9Sstevel@tonic-gate * 0/0 - use the original destination address/port.
24197c478bd9Sstevel@tonic-gate */
24207c478bd9Sstevel@tonic-gate in.s_addr = ntohl(fin->fin_daddr);
24217c478bd9Sstevel@tonic-gate
24227c478bd9Sstevel@tonic-gate } else if (np->in_redir == NAT_BIMAP &&
24237c478bd9Sstevel@tonic-gate np->in_inmsk == np->in_outmsk) {
24247c478bd9Sstevel@tonic-gate /*
24257c478bd9Sstevel@tonic-gate * map the address block in a 1:1 fashion
24267c478bd9Sstevel@tonic-gate */
2427ab25eeb5Syz in.s_addr = np->in_inip;
2428ab25eeb5Syz in.s_addr |= fin->fin_daddr & ~np->in_inmsk;
2429ab25eeb5Syz in.s_addr = ntohl(in.s_addr);
24307c478bd9Sstevel@tonic-gate } else {
24317c478bd9Sstevel@tonic-gate in.s_addr = ntohl(np->in_inip);
24327c478bd9Sstevel@tonic-gate }
24337c478bd9Sstevel@tonic-gate
24347c478bd9Sstevel@tonic-gate if ((np->in_pnext == 0) || ((flags & NAT_NOTRULEPORT) != 0))
24357c478bd9Sstevel@tonic-gate nport = dport;
24367c478bd9Sstevel@tonic-gate else {
24377c478bd9Sstevel@tonic-gate /*
24387c478bd9Sstevel@tonic-gate * Whilst not optimized for the case where
24397c478bd9Sstevel@tonic-gate * pmin == pmax, the gain is not significant.
24407c478bd9Sstevel@tonic-gate */
2441ab25eeb5Syz if (((np->in_flags & IPN_FIXEDDPORT) == 0) &&
2442ab25eeb5Syz (np->in_pmin != np->in_pmax)) {
24437c478bd9Sstevel@tonic-gate nport = ntohs(dport) - ntohs(np->in_pmin) +
24447c478bd9Sstevel@tonic-gate ntohs(np->in_pnext);
24457c478bd9Sstevel@tonic-gate nport = htons(nport);
24467c478bd9Sstevel@tonic-gate } else
24477c478bd9Sstevel@tonic-gate nport = np->in_pnext;
24487c478bd9Sstevel@tonic-gate }
24497c478bd9Sstevel@tonic-gate
24507c478bd9Sstevel@tonic-gate /*
24517c478bd9Sstevel@tonic-gate * When the redirect-to address is set to 0.0.0.0, just
24527c478bd9Sstevel@tonic-gate * assume a blank `forwarding' of the packet. We don't
24537c478bd9Sstevel@tonic-gate * setup any translation for this either.
24547c478bd9Sstevel@tonic-gate */
24557c478bd9Sstevel@tonic-gate if (in.s_addr == 0) {
24567c478bd9Sstevel@tonic-gate if (nport == dport)
24577c478bd9Sstevel@tonic-gate return -1;
24587c478bd9Sstevel@tonic-gate in.s_addr = ntohl(fin->fin_daddr);
24597c478bd9Sstevel@tonic-gate }
24607c478bd9Sstevel@tonic-gate
24618899fcfaSjojemann /*
24628899fcfaSjojemann * Check to see if this redirect mapping already exists and if
24638899fcfaSjojemann * it does, return "failure" (allowing it to be created will just
24648899fcfaSjojemann * cause one or both of these "connections" to stop working.)
24658899fcfaSjojemann */
24668899fcfaSjojemann inb.s_addr = htonl(in.s_addr);
24678899fcfaSjojemann sp = fin->fin_data[0];
24688899fcfaSjojemann dp = fin->fin_data[1];
24698899fcfaSjojemann fin->fin_data[1] = fin->fin_data[0];
24708899fcfaSjojemann fin->fin_data[0] = ntohs(nport);
24718899fcfaSjojemann natl = nat_outlookup(fin, flags & ~(SI_WILDP|NAT_SEARCH),
24728899fcfaSjojemann (u_int)fin->fin_p, inb, fin->fin_src);
24738899fcfaSjojemann fin->fin_data[0] = sp;
24748899fcfaSjojemann fin->fin_data[1] = dp;
24758899fcfaSjojemann if (natl != NULL)
24768899fcfaSjojemann return (-1);
24778899fcfaSjojemann
24787c478bd9Sstevel@tonic-gate nat->nat_inip.s_addr = htonl(in.s_addr);
24797c478bd9Sstevel@tonic-gate nat->nat_outip = fin->fin_dst;
24807c478bd9Sstevel@tonic-gate nat->nat_oip = fin->fin_src;
24817c478bd9Sstevel@tonic-gate
2482ab25eeb5Syz ni->nai_ip.s_addr = in.s_addr;
24837c478bd9Sstevel@tonic-gate ni->nai_nport = nport;
24847c478bd9Sstevel@tonic-gate ni->nai_port = sport;
24857c478bd9Sstevel@tonic-gate
24867c478bd9Sstevel@tonic-gate if (flags & IPN_TCPUDP) {
24877c478bd9Sstevel@tonic-gate nat->nat_inport = nport;
24887c478bd9Sstevel@tonic-gate nat->nat_outport = dport;
24897c478bd9Sstevel@tonic-gate nat->nat_oport = sport;
24907c478bd9Sstevel@tonic-gate ((tcphdr_t *)fin->fin_dp)->th_dport = nport;
24917c478bd9Sstevel@tonic-gate } else if (flags & IPN_ICMPQUERY) {
24927c478bd9Sstevel@tonic-gate ((icmphdr_t *)fin->fin_dp)->icmp_id = nport;
2493ab25eeb5Syz nat->nat_inport = nport;
2494ab25eeb5Syz nat->nat_outport = nport;
24957c478bd9Sstevel@tonic-gate }
24967c478bd9Sstevel@tonic-gate
24977c478bd9Sstevel@tonic-gate return move;
24987c478bd9Sstevel@tonic-gate }
24997c478bd9Sstevel@tonic-gate
25007c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
25017c478bd9Sstevel@tonic-gate /* Function: nat_new */
25027c478bd9Sstevel@tonic-gate /* Returns: nat_t* - NULL == failure to create new NAT structure, */
25037c478bd9Sstevel@tonic-gate /* else pointer to new NAT structure */
25047c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */
25057c478bd9Sstevel@tonic-gate /* np(I) - pointer to NAT rule */
25067c478bd9Sstevel@tonic-gate /* natsave(I) - pointer to where to store NAT struct pointer */
25077c478bd9Sstevel@tonic-gate /* flags(I) - flags describing the current packet */
25087c478bd9Sstevel@tonic-gate /* direction(I) - direction of packet (in/out) */
25097c478bd9Sstevel@tonic-gate /* Write Lock: ipf_nat */
25107c478bd9Sstevel@tonic-gate /* */
25117c478bd9Sstevel@tonic-gate /* Attempts to create a new NAT entry. Does not actually change the packet */
25127c478bd9Sstevel@tonic-gate /* in any way. */
25137c478bd9Sstevel@tonic-gate /* */
25147c478bd9Sstevel@tonic-gate /* This fucntion is in three main parts: (1) deal with creating a new NAT */
25157c478bd9Sstevel@tonic-gate /* structure for a "MAP" rule (outgoing NAT translation); (2) deal with */
25167c478bd9Sstevel@tonic-gate /* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */
25177c478bd9Sstevel@tonic-gate /* and (3) building that structure and putting it into the NAT table(s). */
25187c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_new(fin,np,natsave,flags,direction)25197c478bd9Sstevel@tonic-gate nat_t *nat_new(fin, np, natsave, flags, direction)
25207c478bd9Sstevel@tonic-gate fr_info_t *fin;
25217c478bd9Sstevel@tonic-gate ipnat_t *np;
25227c478bd9Sstevel@tonic-gate nat_t **natsave;
25237c478bd9Sstevel@tonic-gate u_int flags;
25247c478bd9Sstevel@tonic-gate int direction;
25257c478bd9Sstevel@tonic-gate {
25267c478bd9Sstevel@tonic-gate tcphdr_t *tcp = NULL;
25277c478bd9Sstevel@tonic-gate hostmap_t *hm = NULL;
25287c478bd9Sstevel@tonic-gate nat_t *nat, *natl;
25297c478bd9Sstevel@tonic-gate u_int nflags;
25307c478bd9Sstevel@tonic-gate natinfo_t ni;
25317c478bd9Sstevel@tonic-gate int move;
2532f4b3ec61Sdh ipf_stack_t *ifs = fin->fin_ifs;
25337c478bd9Sstevel@tonic-gate
25343805c50fSan /*
2535ea8244dcSJohn Ojemann * Trigger automatic call to nat_flushtable() if the
25363805c50fSan * table has reached capcity specified by hi watermark.
25373805c50fSan */
2538ea8244dcSJohn Ojemann if (NAT_TAB_WATER_LEVEL(ifs) > ifs->ifs_nat_flush_level_hi)
25393805c50fSan ifs->ifs_nat_doflush = 1;
25403805c50fSan
25415b48165cSJohn Ojemann /*
25425b48165cSJohn Ojemann * If automatic flushing did not do its job, and the table
25435b48165cSJohn Ojemann * has filled up, don't try to create a new entry.
25445b48165cSJohn Ojemann */
2545f4b3ec61Sdh if (ifs->ifs_nat_stats.ns_inuse >= ifs->ifs_ipf_nattable_max) {
2546f4b3ec61Sdh ifs->ifs_nat_stats.ns_memfail++;
2547ab25eeb5Syz return NULL;
2548ab25eeb5Syz }
2549ab25eeb5Syz
25507c478bd9Sstevel@tonic-gate move = 1;
25517c478bd9Sstevel@tonic-gate nflags = np->in_flags & flags;
25527c478bd9Sstevel@tonic-gate nflags &= NAT_FROMRULE;
25537c478bd9Sstevel@tonic-gate
25547c478bd9Sstevel@tonic-gate ni.nai_np = np;
25557c478bd9Sstevel@tonic-gate ni.nai_nflags = nflags;
25567c478bd9Sstevel@tonic-gate ni.nai_flags = flags;
25577c478bd9Sstevel@tonic-gate
25587c478bd9Sstevel@tonic-gate /* Give me a new nat */
25597c478bd9Sstevel@tonic-gate KMALLOC(nat, nat_t *);
25607c478bd9Sstevel@tonic-gate if (nat == NULL) {
2561f4b3ec61Sdh ifs->ifs_nat_stats.ns_memfail++;
2562ab25eeb5Syz /*
2563ab25eeb5Syz * Try to automatically tune the max # of entries in the
2564ab25eeb5Syz * table allowed to be less than what will cause kmem_alloc()
2565ab25eeb5Syz * to fail and try to eliminate panics due to out of memory
2566ab25eeb5Syz * conditions arising.
2567ab25eeb5Syz */
2568f4b3ec61Sdh if (ifs->ifs_ipf_nattable_max > ifs->ifs_ipf_nattable_sz) {
2569f4b3ec61Sdh ifs->ifs_ipf_nattable_max = ifs->ifs_nat_stats.ns_inuse - 100;
2570ab25eeb5Syz printf("ipf_nattable_max reduced to %d\n",
2571f4b3ec61Sdh ifs->ifs_ipf_nattable_max);
2572ab25eeb5Syz }
25737c478bd9Sstevel@tonic-gate return NULL;
25747c478bd9Sstevel@tonic-gate }
25757c478bd9Sstevel@tonic-gate
25767c478bd9Sstevel@tonic-gate if (flags & IPN_TCPUDP) {
25777c478bd9Sstevel@tonic-gate tcp = fin->fin_dp;
25787c478bd9Sstevel@tonic-gate ni.nai_sport = htons(fin->fin_sport);
25797c478bd9Sstevel@tonic-gate ni.nai_dport = htons(fin->fin_dport);
25807c478bd9Sstevel@tonic-gate } else if (flags & IPN_ICMPQUERY) {
25817c478bd9Sstevel@tonic-gate /*
25827c478bd9Sstevel@tonic-gate * In the ICMP query NAT code, we translate the ICMP id fields
2583ab25eeb5Syz * to make them unique. This is indepedent of the ICMP type
2584ab25eeb5Syz * (e.g. in the unlikely event that a host sends an echo and
2585ab25eeb5Syz * an tstamp request with the same id, both packets will have
25867c478bd9Sstevel@tonic-gate * their ip address/id field changed in the same way).
25877c478bd9Sstevel@tonic-gate */
25887c478bd9Sstevel@tonic-gate /* The icmp_id field is used by the sender to identify the
2589ab25eeb5Syz * process making the icmp request. (the receiver justs
2590ab25eeb5Syz * copies it back in its response). So, it closely matches
2591ab25eeb5Syz * the concept of source port. We overlay sport, so we can
25927c478bd9Sstevel@tonic-gate * maximally reuse the existing code.
25937c478bd9Sstevel@tonic-gate */
25947c478bd9Sstevel@tonic-gate ni.nai_sport = ((icmphdr_t *)fin->fin_dp)->icmp_id;
25957c478bd9Sstevel@tonic-gate ni.nai_dport = ni.nai_sport;
25967c478bd9Sstevel@tonic-gate }
25977c478bd9Sstevel@tonic-gate
25987c478bd9Sstevel@tonic-gate bzero((char *)nat, sizeof(*nat));
25997c478bd9Sstevel@tonic-gate nat->nat_flags = flags;
2600f4b3ec61Sdh nat->nat_redir = np->in_redir;
26017c478bd9Sstevel@tonic-gate
2602ab25eeb5Syz if ((flags & NAT_SLAVE) == 0) {
2603f4b3ec61Sdh MUTEX_ENTER(&ifs->ifs_ipf_nat_new);
2604ab25eeb5Syz }
26057c478bd9Sstevel@tonic-gate
26067c478bd9Sstevel@tonic-gate /*
26077c478bd9Sstevel@tonic-gate * Search the current table for a match.
26087c478bd9Sstevel@tonic-gate */
26097c478bd9Sstevel@tonic-gate if (direction == NAT_OUTBOUND) {
26107c478bd9Sstevel@tonic-gate /*
26117c478bd9Sstevel@tonic-gate * We can now arrange to call this for the same connection
26127c478bd9Sstevel@tonic-gate * because ipf_nat_new doesn't protect the code path into
26137c478bd9Sstevel@tonic-gate * this function.
26147c478bd9Sstevel@tonic-gate */
26157c478bd9Sstevel@tonic-gate natl = nat_outlookup(fin, nflags, (u_int)fin->fin_p,
26167c478bd9Sstevel@tonic-gate fin->fin_src, fin->fin_dst);
26177c478bd9Sstevel@tonic-gate if (natl != NULL) {
2618dcf3e898Sjojemann KFREE(nat);
2619ab25eeb5Syz nat = natl;
2620ab25eeb5Syz goto done;
26217c478bd9Sstevel@tonic-gate }
26227c478bd9Sstevel@tonic-gate
26237c478bd9Sstevel@tonic-gate move = nat_newmap(fin, nat, &ni);
2624ab25eeb5Syz if (move == -1)
26257c478bd9Sstevel@tonic-gate goto badnat;
26267c478bd9Sstevel@tonic-gate
26277c478bd9Sstevel@tonic-gate np = ni.nai_np;
26287c478bd9Sstevel@tonic-gate } else {
2629ab25eeb5Syz /*
26307c478bd9Sstevel@tonic-gate * NAT_INBOUND is used only for redirects rules
26317c478bd9Sstevel@tonic-gate */
26327c478bd9Sstevel@tonic-gate natl = nat_inlookup(fin, nflags, (u_int)fin->fin_p,
26337c478bd9Sstevel@tonic-gate fin->fin_src, fin->fin_dst);
26347c478bd9Sstevel@tonic-gate if (natl != NULL) {
2635dcf3e898Sjojemann KFREE(nat);
2636ab25eeb5Syz nat = natl;
2637ab25eeb5Syz goto done;
26387c478bd9Sstevel@tonic-gate }
26397c478bd9Sstevel@tonic-gate
26407c478bd9Sstevel@tonic-gate move = nat_newrdr(fin, nat, &ni);
2641ab25eeb5Syz if (move == -1)
26427c478bd9Sstevel@tonic-gate goto badnat;
26437c478bd9Sstevel@tonic-gate
26447c478bd9Sstevel@tonic-gate np = ni.nai_np;
26457c478bd9Sstevel@tonic-gate }
26467c478bd9Sstevel@tonic-gate
26477c478bd9Sstevel@tonic-gate if ((move == 1) && (np->in_flags & IPN_ROUNDR)) {
26487c478bd9Sstevel@tonic-gate if (np->in_redir == NAT_REDIRECT) {
26497c478bd9Sstevel@tonic-gate nat_delrdr(np);
2650f4b3ec61Sdh nat_addrdr(np, ifs);
26517c478bd9Sstevel@tonic-gate } else if (np->in_redir == NAT_MAP) {
26527c478bd9Sstevel@tonic-gate nat_delnat(np);
2653f4b3ec61Sdh nat_addnat(np, ifs);
26547c478bd9Sstevel@tonic-gate }
26557c478bd9Sstevel@tonic-gate }
26567c478bd9Sstevel@tonic-gate
26577c478bd9Sstevel@tonic-gate if (nat_finalise(fin, nat, &ni, tcp, natsave, direction) == -1) {
2658ab25eeb5Syz goto badnat;
26597c478bd9Sstevel@tonic-gate }
26603c50f6d6San
26613c50f6d6San nat_calc_chksum_diffs(nat);
26623c50f6d6San
26637c478bd9Sstevel@tonic-gate if (flags & SI_WILDP)
2664f4b3ec61Sdh ifs->ifs_nat_stats.ns_wilds++;
26655b48165cSJohn Ojemann fin->fin_flx |= FI_NEWNAT;
2666ab25eeb5Syz goto done;
26677c478bd9Sstevel@tonic-gate badnat:
2668f4b3ec61Sdh ifs->ifs_nat_stats.ns_badnat++;
26697c478bd9Sstevel@tonic-gate if ((hm = nat->nat_hm) != NULL)
267090b0a856Sjojemann fr_hostmapdel(&hm);
26717c478bd9Sstevel@tonic-gate KFREE(nat);
2672ab25eeb5Syz nat = NULL;
2673ab25eeb5Syz done:
2674ab25eeb5Syz if ((flags & NAT_SLAVE) == 0) {
2675f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipf_nat_new);
2676ab25eeb5Syz }
2677ab25eeb5Syz return nat;
26787c478bd9Sstevel@tonic-gate }
26797c478bd9Sstevel@tonic-gate
26807c478bd9Sstevel@tonic-gate
26817c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
26827c478bd9Sstevel@tonic-gate /* Function: nat_finalise */
26837c478bd9Sstevel@tonic-gate /* Returns: int - 0 == sucess, -1 == failure */
26847c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */
26857c478bd9Sstevel@tonic-gate /* nat(I) - pointer to NAT entry */
26867c478bd9Sstevel@tonic-gate /* ni(I) - pointer to structure with misc. information needed */
26877c478bd9Sstevel@tonic-gate /* to create new NAT entry. */
26887c478bd9Sstevel@tonic-gate /* Write Lock: ipf_nat */
26897c478bd9Sstevel@tonic-gate /* */
26907c478bd9Sstevel@tonic-gate /* This is the tail end of constructing a new NAT entry and is the same */
26917c478bd9Sstevel@tonic-gate /* for both IPv4 and IPv6. */
26927c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
26937c478bd9Sstevel@tonic-gate /*ARGSUSED*/
nat_finalise(fin,nat,ni,tcp,natsave,direction)26947c478bd9Sstevel@tonic-gate static INLINE int nat_finalise(fin, nat, ni, tcp, natsave, direction)
26957c478bd9Sstevel@tonic-gate fr_info_t *fin;
26967c478bd9Sstevel@tonic-gate nat_t *nat;
26977c478bd9Sstevel@tonic-gate natinfo_t *ni;
26987c478bd9Sstevel@tonic-gate tcphdr_t *tcp;
26997c478bd9Sstevel@tonic-gate nat_t **natsave;
27007c478bd9Sstevel@tonic-gate int direction;
27017c478bd9Sstevel@tonic-gate {
27027c478bd9Sstevel@tonic-gate frentry_t *fr;
27037c478bd9Sstevel@tonic-gate ipnat_t *np;
2704f4b3ec61Sdh ipf_stack_t *ifs = fin->fin_ifs;
27057c478bd9Sstevel@tonic-gate
27067c478bd9Sstevel@tonic-gate np = ni->nai_np;
27077c478bd9Sstevel@tonic-gate
2708381a2a9aSdr COPYIFNAME(fin->fin_ifp, nat->nat_ifnames[0], fin->fin_v);
2709381a2a9aSdr
27107c478bd9Sstevel@tonic-gate #ifdef IPFILTER_SYNC
271134b11c4dSjojemann if ((nat->nat_flags & SI_CLONE) == 0)
271234b11c4dSjojemann nat->nat_sync = ipfsync_new(SMC_NAT, fin, nat);
27137c478bd9Sstevel@tonic-gate #endif
27147c478bd9Sstevel@tonic-gate
27157c478bd9Sstevel@tonic-gate nat->nat_me = natsave;
27167c478bd9Sstevel@tonic-gate nat->nat_dir = direction;
2717e6c6c1faSyz nat->nat_ifps[0] = np->in_ifps[0];
2718e6c6c1faSyz nat->nat_ifps[1] = np->in_ifps[1];
27197c478bd9Sstevel@tonic-gate nat->nat_ptr = np;
27207c478bd9Sstevel@tonic-gate nat->nat_p = fin->fin_p;
2721d6c23f6fSyx nat->nat_v = fin->fin_v;
27227c478bd9Sstevel@tonic-gate nat->nat_mssclamp = np->in_mssclamp;
27237c478bd9Sstevel@tonic-gate fr = fin->fin_fr;
27247c478bd9Sstevel@tonic-gate nat->nat_fr = fr;
27257c478bd9Sstevel@tonic-gate
27267c478bd9Sstevel@tonic-gate if ((np->in_apr != NULL) && ((ni->nai_flags & NAT_SLAVE) == 0))
27277c478bd9Sstevel@tonic-gate if (appr_new(fin, nat) == -1)
27287c478bd9Sstevel@tonic-gate return -1;
27297c478bd9Sstevel@tonic-gate
2730f4b3ec61Sdh if (nat_insert(nat, fin->fin_rev, ifs) == 0) {
2731f4b3ec61Sdh if (ifs->ifs_nat_logging)
2732f4b3ec61Sdh nat_log(nat, (u_int)np->in_redir, ifs);
27337c478bd9Sstevel@tonic-gate np->in_use++;
27347c478bd9Sstevel@tonic-gate if (fr != NULL) {
27357c478bd9Sstevel@tonic-gate MUTEX_ENTER(&fr->fr_lock);
27367c478bd9Sstevel@tonic-gate fr->fr_ref++;
27377c478bd9Sstevel@tonic-gate MUTEX_EXIT(&fr->fr_lock);
27387c478bd9Sstevel@tonic-gate }
27397c478bd9Sstevel@tonic-gate return 0;
27407c478bd9Sstevel@tonic-gate }
27417c478bd9Sstevel@tonic-gate
27427c478bd9Sstevel@tonic-gate /*
27437c478bd9Sstevel@tonic-gate * nat_insert failed, so cleanup time...
27447c478bd9Sstevel@tonic-gate */
27457c478bd9Sstevel@tonic-gate return -1;
27467c478bd9Sstevel@tonic-gate }
27477c478bd9Sstevel@tonic-gate
27487c478bd9Sstevel@tonic-gate
27497c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
2750ab25eeb5Syz /* Function: nat_insert */
2751ab25eeb5Syz /* Returns: int - 0 == sucess, -1 == failure */
2752ab25eeb5Syz /* Parameters: nat(I) - pointer to NAT structure */
2753ab25eeb5Syz /* rev(I) - flag indicating forward/reverse direction of packet */
2754ab25eeb5Syz /* Write Lock: ipf_nat */
27557c478bd9Sstevel@tonic-gate /* */
27567c478bd9Sstevel@tonic-gate /* Insert a NAT entry into the hash tables for searching and add it to the */
27577c478bd9Sstevel@tonic-gate /* list of active NAT entries. Adjust global counters when complete. */
27587c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_insert(nat,rev,ifs)2759f4b3ec61Sdh int nat_insert(nat, rev, ifs)
27607c478bd9Sstevel@tonic-gate nat_t *nat;
2761ab25eeb5Syz int rev;
2762f4b3ec61Sdh ipf_stack_t *ifs;
27637c478bd9Sstevel@tonic-gate {
27647c478bd9Sstevel@tonic-gate u_int hv1, hv2;
27657c478bd9Sstevel@tonic-gate nat_t **natp;
27667c478bd9Sstevel@tonic-gate
27677c478bd9Sstevel@tonic-gate /*
27687c478bd9Sstevel@tonic-gate * Try and return an error as early as possible, so calculate the hash
27697c478bd9Sstevel@tonic-gate * entry numbers first and then proceed.
27707c478bd9Sstevel@tonic-gate */
27717c478bd9Sstevel@tonic-gate if ((nat->nat_flags & (SI_W_SPORT|SI_W_DPORT)) == 0) {
27727c478bd9Sstevel@tonic-gate hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport,
27737c478bd9Sstevel@tonic-gate 0xffffffff);
27747c478bd9Sstevel@tonic-gate hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1 + nat->nat_oport,
2775f4b3ec61Sdh ifs->ifs_ipf_nattable_sz);
27767c478bd9Sstevel@tonic-gate hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport,
27777c478bd9Sstevel@tonic-gate 0xffffffff);
27787c478bd9Sstevel@tonic-gate hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2 + nat->nat_oport,
2779f4b3ec61Sdh ifs->ifs_ipf_nattable_sz);
27807c478bd9Sstevel@tonic-gate } else {
27817c478bd9Sstevel@tonic-gate hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, 0, 0xffffffff);
2782f4b3ec61Sdh hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1,
2783f4b3ec61Sdh ifs->ifs_ipf_nattable_sz);
27847c478bd9Sstevel@tonic-gate hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, 0, 0xffffffff);
2785f4b3ec61Sdh hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2,
2786f4b3ec61Sdh ifs->ifs_ipf_nattable_sz);
27877c478bd9Sstevel@tonic-gate }
27887c478bd9Sstevel@tonic-gate
2789f4b3ec61Sdh if (ifs->ifs_nat_stats.ns_bucketlen[0][hv1] >= ifs->ifs_fr_nat_maxbucket ||
2790f4b3ec61Sdh ifs->ifs_nat_stats.ns_bucketlen[1][hv2] >= ifs->ifs_fr_nat_maxbucket) {
27917c478bd9Sstevel@tonic-gate return -1;
2792ab25eeb5Syz }
27937c478bd9Sstevel@tonic-gate
27947c478bd9Sstevel@tonic-gate nat->nat_hv[0] = hv1;
27957c478bd9Sstevel@tonic-gate nat->nat_hv[1] = hv2;
27967c478bd9Sstevel@tonic-gate
27977c478bd9Sstevel@tonic-gate MUTEX_INIT(&nat->nat_lock, "nat entry lock");
27987c478bd9Sstevel@tonic-gate
2799ab25eeb5Syz nat->nat_rev = rev;
28007c478bd9Sstevel@tonic-gate nat->nat_ref = 1;
28017c478bd9Sstevel@tonic-gate nat->nat_bytes[0] = 0;
28027c478bd9Sstevel@tonic-gate nat->nat_pkts[0] = 0;
28037c478bd9Sstevel@tonic-gate nat->nat_bytes[1] = 0;
28047c478bd9Sstevel@tonic-gate nat->nat_pkts[1] = 0;
2805ab25eeb5Syz
2806ab25eeb5Syz nat->nat_ifnames[0][LIFNAMSIZ - 1] = '\0';
2807f4b3ec61Sdh nat->nat_ifps[0] = fr_resolvenic(nat->nat_ifnames[0], 4, ifs);
2808ab25eeb5Syz
2809ab25eeb5Syz if (nat->nat_ifnames[1][0] !='\0') {
2810ab25eeb5Syz nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
2811f4b3ec61Sdh nat->nat_ifps[1] = fr_resolvenic(nat->nat_ifnames[1], 4, ifs);
28127c478bd9Sstevel@tonic-gate } else {
281334b11c4dSjojemann (void) strncpy(nat->nat_ifnames[1], nat->nat_ifnames[0],
2814ab25eeb5Syz LIFNAMSIZ);
2815ab25eeb5Syz nat->nat_ifnames[1][LIFNAMSIZ - 1] = '\0';
28167c478bd9Sstevel@tonic-gate nat->nat_ifps[1] = nat->nat_ifps[0];
28177c478bd9Sstevel@tonic-gate }
28187c478bd9Sstevel@tonic-gate
2819f4b3ec61Sdh nat->nat_next = ifs->ifs_nat_instances;
2820f4b3ec61Sdh nat->nat_pnext = &ifs->ifs_nat_instances;
2821f4b3ec61Sdh if (ifs->ifs_nat_instances)
2822f4b3ec61Sdh ifs->ifs_nat_instances->nat_pnext = &nat->nat_next;
2823f4b3ec61Sdh ifs->ifs_nat_instances = nat;
28247c478bd9Sstevel@tonic-gate
2825f4b3ec61Sdh natp = &ifs->ifs_nat_table[0][hv1];
28267c478bd9Sstevel@tonic-gate if (*natp)
28277c478bd9Sstevel@tonic-gate (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
28287c478bd9Sstevel@tonic-gate nat->nat_phnext[0] = natp;
28297c478bd9Sstevel@tonic-gate nat->nat_hnext[0] = *natp;
28307c478bd9Sstevel@tonic-gate *natp = nat;
2831f4b3ec61Sdh ifs->ifs_nat_stats.ns_bucketlen[0][hv1]++;
28327c478bd9Sstevel@tonic-gate
2833f4b3ec61Sdh natp = &ifs->ifs_nat_table[1][hv2];
28347c478bd9Sstevel@tonic-gate if (*natp)
28357c478bd9Sstevel@tonic-gate (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
28367c478bd9Sstevel@tonic-gate nat->nat_phnext[1] = natp;
28377c478bd9Sstevel@tonic-gate nat->nat_hnext[1] = *natp;
28387c478bd9Sstevel@tonic-gate *natp = nat;
2839f4b3ec61Sdh ifs->ifs_nat_stats.ns_bucketlen[1][hv2]++;
28407c478bd9Sstevel@tonic-gate
2841f4b3ec61Sdh fr_setnatqueue(nat, rev, ifs);
28427c478bd9Sstevel@tonic-gate
2843f4b3ec61Sdh ifs->ifs_nat_stats.ns_added++;
2844f4b3ec61Sdh ifs->ifs_nat_stats.ns_inuse++;
28457c478bd9Sstevel@tonic-gate return 0;
28467c478bd9Sstevel@tonic-gate }
28477c478bd9Sstevel@tonic-gate
28487c478bd9Sstevel@tonic-gate
28497c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
28507c478bd9Sstevel@tonic-gate /* Function: nat_icmperrorlookup */
28517c478bd9Sstevel@tonic-gate /* Returns: nat_t* - point to matching NAT structure */
28527c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */
28537c478bd9Sstevel@tonic-gate /* dir(I) - direction of packet (in/out) */
28547c478bd9Sstevel@tonic-gate /* */
28557c478bd9Sstevel@tonic-gate /* Check if the ICMP error message is related to an existing TCP, UDP or */
2856ab25eeb5Syz /* ICMP query nat entry. It is assumed that the packet is already of the */
2857ab25eeb5Syz /* the required length. */
28587c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_icmperrorlookup(fin,dir)28597c478bd9Sstevel@tonic-gate nat_t *nat_icmperrorlookup(fin, dir)
28607c478bd9Sstevel@tonic-gate fr_info_t *fin;
28617c478bd9Sstevel@tonic-gate int dir;
28627c478bd9Sstevel@tonic-gate {
2863ab25eeb5Syz int flags = 0, minlen;
2864ab25eeb5Syz icmphdr_t *orgicmp;
28657c478bd9Sstevel@tonic-gate tcphdr_t *tcp = NULL;
2866ab25eeb5Syz u_short data[2];
2867ab25eeb5Syz nat_t *nat;
28687c478bd9Sstevel@tonic-gate ip_t *oip;
28697c478bd9Sstevel@tonic-gate u_int p;
28707c478bd9Sstevel@tonic-gate
28717c478bd9Sstevel@tonic-gate /*
28727c478bd9Sstevel@tonic-gate * Does it at least have the return (basic) IP header ?
28737c478bd9Sstevel@tonic-gate * Only a basic IP header (no options) should be with an ICMP error
2874ab25eeb5Syz * header. Also, if it's not an error type, then return.
28757c478bd9Sstevel@tonic-gate */
2876ab25eeb5Syz if ((fin->fin_hlen != sizeof(ip_t)) || !(fin->fin_flx & FI_ICMPERR))
28777c478bd9Sstevel@tonic-gate return NULL;
28787c478bd9Sstevel@tonic-gate
28797c478bd9Sstevel@tonic-gate /*
2880ab25eeb5Syz * Check packet size
28817c478bd9Sstevel@tonic-gate */
28827c478bd9Sstevel@tonic-gate oip = (ip_t *)((char *)fin->fin_dp + 8);
28837c478bd9Sstevel@tonic-gate minlen = IP_HL(oip) << 2;
2884ab25eeb5Syz if ((minlen < sizeof(ip_t)) ||
2885ab25eeb5Syz (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen))
28867c478bd9Sstevel@tonic-gate return NULL;
28877c478bd9Sstevel@tonic-gate /*
28887c478bd9Sstevel@tonic-gate * Is the buffer big enough for all of it ? It's the size of the IP
28897c478bd9Sstevel@tonic-gate * header claimed in the encapsulated part which is of concern. It
28907c478bd9Sstevel@tonic-gate * may be too big to be in this buffer but not so big that it's
28917c478bd9Sstevel@tonic-gate * outside the ICMP packet, leading to TCP deref's causing problems.
28927c478bd9Sstevel@tonic-gate * This is possible because we don't know how big oip_hl is when we
28937c478bd9Sstevel@tonic-gate * do the pullup early in fr_check() and thus can't gaurantee it is
28947c478bd9Sstevel@tonic-gate * all here now.
28957c478bd9Sstevel@tonic-gate */
28967c478bd9Sstevel@tonic-gate #ifdef _KERNEL
28977c478bd9Sstevel@tonic-gate {
28987c478bd9Sstevel@tonic-gate mb_t *m;
28997c478bd9Sstevel@tonic-gate
29007c478bd9Sstevel@tonic-gate m = fin->fin_m;
29017c478bd9Sstevel@tonic-gate # if defined(MENTAT)
29027c478bd9Sstevel@tonic-gate if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > (char *)m->b_wptr)
29037c478bd9Sstevel@tonic-gate return NULL;
2904ab25eeb5Syz # else
29057c478bd9Sstevel@tonic-gate if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
29067c478bd9Sstevel@tonic-gate (char *)fin->fin_ip + M_LEN(m))
2907ab25eeb5Syz return NULL;
2908ab25eeb5Syz # endif
2909ab25eeb5Syz }
29107c478bd9Sstevel@tonic-gate #endif
2911ab25eeb5Syz
2912ab25eeb5Syz if (fin->fin_daddr != oip->ip_src.s_addr)
2913ab25eeb5Syz return NULL;
2914ab25eeb5Syz
29157c478bd9Sstevel@tonic-gate p = oip->ip_p;
29167c478bd9Sstevel@tonic-gate if (p == IPPROTO_TCP)
29177c478bd9Sstevel@tonic-gate flags = IPN_TCP;
29187c478bd9Sstevel@tonic-gate else if (p == IPPROTO_UDP)
29197c478bd9Sstevel@tonic-gate flags = IPN_UDP;
29207c478bd9Sstevel@tonic-gate else if (p == IPPROTO_ICMP) {
29217c478bd9Sstevel@tonic-gate orgicmp = (icmphdr_t *)((char *)oip + (IP_HL(oip) << 2));
29227c478bd9Sstevel@tonic-gate
29237c478bd9Sstevel@tonic-gate /* see if this is related to an ICMP query */
29247c478bd9Sstevel@tonic-gate if (nat_icmpquerytype4(orgicmp->icmp_type)) {
2925ab25eeb5Syz data[0] = fin->fin_data[0];
2926ab25eeb5Syz data[1] = fin->fin_data[1];
2927ab25eeb5Syz fin->fin_data[0] = 0;
2928ab25eeb5Syz fin->fin_data[1] = orgicmp->icmp_id;
2929ab25eeb5Syz
2930ab25eeb5Syz flags = IPN_ICMPERR|IPN_ICMPQUERY;
29317c478bd9Sstevel@tonic-gate /*
29327c478bd9Sstevel@tonic-gate * NOTE : dir refers to the direction of the original
29337c478bd9Sstevel@tonic-gate * ip packet. By definition the icmp error
29347c478bd9Sstevel@tonic-gate * message flows in the opposite direction.
29357c478bd9Sstevel@tonic-gate */
29367c478bd9Sstevel@tonic-gate if (dir == NAT_INBOUND)
2937ab25eeb5Syz nat = nat_inlookup(fin, flags, p, oip->ip_dst,
2938ab25eeb5Syz oip->ip_src);
29397c478bd9Sstevel@tonic-gate else
2940ab25eeb5Syz nat = nat_outlookup(fin, flags, p, oip->ip_dst,
2941ab25eeb5Syz oip->ip_src);
2942ab25eeb5Syz fin->fin_data[0] = data[0];
2943ab25eeb5Syz fin->fin_data[1] = data[1];
2944ab25eeb5Syz return nat;
29457c478bd9Sstevel@tonic-gate }
29467c478bd9Sstevel@tonic-gate }
2947*55fea89dSDan Cross
29487c478bd9Sstevel@tonic-gate if (flags & IPN_TCPUDP) {
29497c478bd9Sstevel@tonic-gate minlen += 8; /* + 64bits of data to get ports */
29507c478bd9Sstevel@tonic-gate if (fin->fin_plen < ICMPERR_IPICMPHLEN + minlen)
29517c478bd9Sstevel@tonic-gate return NULL;
29527c478bd9Sstevel@tonic-gate
29537c478bd9Sstevel@tonic-gate data[0] = fin->fin_data[0];
29547c478bd9Sstevel@tonic-gate data[1] = fin->fin_data[1];
29557c478bd9Sstevel@tonic-gate tcp = (tcphdr_t *)((char *)oip + (IP_HL(oip) << 2));
29567c478bd9Sstevel@tonic-gate fin->fin_data[0] = ntohs(tcp->th_dport);
29577c478bd9Sstevel@tonic-gate fin->fin_data[1] = ntohs(tcp->th_sport);
29587c478bd9Sstevel@tonic-gate
29597c478bd9Sstevel@tonic-gate if (dir == NAT_INBOUND) {
29607c478bd9Sstevel@tonic-gate nat = nat_inlookup(fin, flags, p, oip->ip_dst,
29617c478bd9Sstevel@tonic-gate oip->ip_src);
29627c478bd9Sstevel@tonic-gate } else {
29637c478bd9Sstevel@tonic-gate nat = nat_outlookup(fin, flags, p, oip->ip_dst,
29647c478bd9Sstevel@tonic-gate oip->ip_src);
29657c478bd9Sstevel@tonic-gate }
29667c478bd9Sstevel@tonic-gate fin->fin_data[0] = data[0];
29677c478bd9Sstevel@tonic-gate fin->fin_data[1] = data[1];
29687c478bd9Sstevel@tonic-gate return nat;
29697c478bd9Sstevel@tonic-gate }
29707c478bd9Sstevel@tonic-gate if (dir == NAT_INBOUND)
29717c478bd9Sstevel@tonic-gate return nat_inlookup(fin, 0, p, oip->ip_dst, oip->ip_src);
29727c478bd9Sstevel@tonic-gate else
29737c478bd9Sstevel@tonic-gate return nat_outlookup(fin, 0, p, oip->ip_dst, oip->ip_src);
29747c478bd9Sstevel@tonic-gate }
29757c478bd9Sstevel@tonic-gate
29767c478bd9Sstevel@tonic-gate
29777c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
29787c478bd9Sstevel@tonic-gate /* Function: nat_icmperror */
29797c478bd9Sstevel@tonic-gate /* Returns: nat_t* - point to matching NAT structure */
29807c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */
29817c478bd9Sstevel@tonic-gate /* nflags(I) - NAT flags for this packet */
29827c478bd9Sstevel@tonic-gate /* dir(I) - direction of packet (in/out) */
29837c478bd9Sstevel@tonic-gate /* */
29847c478bd9Sstevel@tonic-gate /* Fix up an ICMP packet which is an error message for an existing NAT */
29857c478bd9Sstevel@tonic-gate /* session. This will correct both packet header data and checksums. */
29867c478bd9Sstevel@tonic-gate /* */
29877c478bd9Sstevel@tonic-gate /* This should *ONLY* be used for incoming ICMP error packets to make sure */
29887c478bd9Sstevel@tonic-gate /* a NAT'd ICMP packet gets correctly recognised. */
29897c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_icmperror(fin,nflags,dir)29907c478bd9Sstevel@tonic-gate nat_t *nat_icmperror(fin, nflags, dir)
29917c478bd9Sstevel@tonic-gate fr_info_t *fin;
29927c478bd9Sstevel@tonic-gate u_int *nflags;
29937c478bd9Sstevel@tonic-gate int dir;
29947c478bd9Sstevel@tonic-gate {
29955142ed1fSjojemann u_32_t sum1, sum2, sumd, psum1, psum2, psumd, sumd2;
29967c478bd9Sstevel@tonic-gate struct in_addr in;
29975142ed1fSjojemann icmphdr_t *icmp, *orgicmp;
29985142ed1fSjojemann int dlen;
29995142ed1fSjojemann udphdr_t *udp;
30007c478bd9Sstevel@tonic-gate tcphdr_t *tcp;
30017c478bd9Sstevel@tonic-gate nat_t *nat;
30027c478bd9Sstevel@tonic-gate ip_t *oip;
3003ab25eeb5Syz if ((fin->fin_flx & (FI_SHORT|FI_FRAGBODY)))
30047c478bd9Sstevel@tonic-gate return NULL;
30055142ed1fSjojemann
30067c478bd9Sstevel@tonic-gate /*
30075142ed1fSjojemann * nat_icmperrorlookup() looks up nat entry associated with the
30085142ed1fSjojemann * offending IP packet and returns pointer to the entry, or NULL
30095142ed1fSjojemann * if packet wasn't natted or for `defective' packets.
30107c478bd9Sstevel@tonic-gate */
30115142ed1fSjojemann
30127c478bd9Sstevel@tonic-gate if ((fin->fin_v != 4) || !(nat = nat_icmperrorlookup(fin, dir)))
30137c478bd9Sstevel@tonic-gate return NULL;
30147c478bd9Sstevel@tonic-gate
30157c478bd9Sstevel@tonic-gate sumd2 = 0;
30167c478bd9Sstevel@tonic-gate *nflags = IPN_ICMPERR;
30177c478bd9Sstevel@tonic-gate icmp = fin->fin_dp;
30187c478bd9Sstevel@tonic-gate oip = (ip_t *)&icmp->icmp_ip;
30195142ed1fSjojemann udp = (udphdr_t *)((((char *)oip) + (IP_HL(oip) << 2)));
30205142ed1fSjojemann tcp = (tcphdr_t *)udp;
30215142ed1fSjojemann dlen = fin->fin_plen - ((char *)udp - (char *)fin->fin_ip);
30227c478bd9Sstevel@tonic-gate
30237c478bd9Sstevel@tonic-gate /*
30247c478bd9Sstevel@tonic-gate * Need to adjust ICMP header to include the real IP#'s and
30255142ed1fSjojemann * port #'s. There are three steps required.
30265142ed1fSjojemann *
30277c478bd9Sstevel@tonic-gate * Step 1
30285142ed1fSjojemann * Fix the IP addresses in the offending IP packet and update
30295142ed1fSjojemann * ip header checksum to compensate for the change.
30307c478bd9Sstevel@tonic-gate *
30315142ed1fSjojemann * No update needed here for icmp_cksum because the ICMP checksum
30325142ed1fSjojemann * is calculated over the complete ICMP packet, which includes the
30335142ed1fSjojemann * changed oip IP addresses and oip->ip_sum. These two changes
30345142ed1fSjojemann * cancel each other out (if the delta for the IP address is x,
30355142ed1fSjojemann * then the delta for ip_sum is minus x).
30367c478bd9Sstevel@tonic-gate */
30377c478bd9Sstevel@tonic-gate
30387c478bd9Sstevel@tonic-gate if (oip->ip_dst.s_addr == nat->nat_oip.s_addr) {
30397c478bd9Sstevel@tonic-gate sum1 = LONG_SUM(ntohl(oip->ip_src.s_addr));
30407c478bd9Sstevel@tonic-gate in = nat->nat_inip;
30417c478bd9Sstevel@tonic-gate oip->ip_src = in;
30427c478bd9Sstevel@tonic-gate } else {
30437c478bd9Sstevel@tonic-gate sum1 = LONG_SUM(ntohl(oip->ip_dst.s_addr));
30447c478bd9Sstevel@tonic-gate in = nat->nat_outip;
30457c478bd9Sstevel@tonic-gate oip->ip_dst = in;
30467c478bd9Sstevel@tonic-gate }
30477c478bd9Sstevel@tonic-gate
30487c478bd9Sstevel@tonic-gate sum2 = LONG_SUM(ntohl(in.s_addr));
30497c478bd9Sstevel@tonic-gate CALC_SUMD(sum1, sum2, sumd);
3050ab25eeb5Syz fix_datacksum(&oip->ip_sum, sumd);
3051ab25eeb5Syz
3052ab25eeb5Syz /*
30535142ed1fSjojemann * Step 2
30545142ed1fSjojemann * Perform other adjustments based on protocol of offending packet.
3055ab25eeb5Syz */
30567c478bd9Sstevel@tonic-gate
30575142ed1fSjojemann switch (oip->ip_p) {
30585142ed1fSjojemann case IPPROTO_TCP :
30595142ed1fSjojemann case IPPROTO_UDP :
30607c478bd9Sstevel@tonic-gate
30615142ed1fSjojemann /*
30625142ed1fSjojemann * For offending TCP/UDP IP packets, translate the ports
30635142ed1fSjojemann * based on the NAT specification.
30645142ed1fSjojemann *
30655142ed1fSjojemann * Advance notice : Now it becomes complicated :-)
30665142ed1fSjojemann *
30675142ed1fSjojemann * Since the port and IP addresse fields are both part
30685142ed1fSjojemann * of the TCP/UDP checksum of the offending IP packet,
30695142ed1fSjojemann * we need to adjust that checksum as well.
30705142ed1fSjojemann *
30715142ed1fSjojemann * To further complicate things, the TCP/UDP checksum
30725142ed1fSjojemann * may not be present. We must check to see if the
30735142ed1fSjojemann * length of the data portion is big enough to hold
30745142ed1fSjojemann * the checksum. In the UDP case, a test to determine
30755142ed1fSjojemann * if the checksum is even set is also required.
30765142ed1fSjojemann *
30775142ed1fSjojemann * Any changes to an IP address, port or checksum within
30785142ed1fSjojemann * the ICMP packet requires a change to icmp_cksum.
30795142ed1fSjojemann *
30805142ed1fSjojemann * Be extremely careful here ... The change is dependent
30815142ed1fSjojemann * upon whether or not the TCP/UPD checksum is present.
30825142ed1fSjojemann *
30835142ed1fSjojemann * If TCP/UPD checksum is present, the icmp_cksum must
30845142ed1fSjojemann * compensate for checksum modification resulting from
30855142ed1fSjojemann * IP address change only. Port change and resulting
30865142ed1fSjojemann * data checksum adjustments cancel each other out.
30875142ed1fSjojemann *
30885142ed1fSjojemann * If TCP/UDP checksum is not present, icmp_cksum must
30895142ed1fSjojemann * compensate for port change only. The IP address
30905142ed1fSjojemann * change does not modify anything else in this case.
30915142ed1fSjojemann */
30925142ed1fSjojemann
30935142ed1fSjojemann psum1 = 0;
30945142ed1fSjojemann psum2 = 0;
30955142ed1fSjojemann psumd = 0;
30965142ed1fSjojemann
30975142ed1fSjojemann if ((tcp->th_dport == nat->nat_oport) &&
30985142ed1fSjojemann (tcp->th_sport != nat->nat_inport)) {
30997c478bd9Sstevel@tonic-gate
31005142ed1fSjojemann /*
31015142ed1fSjojemann * Translate the source port.
31025142ed1fSjojemann */
31037c478bd9Sstevel@tonic-gate
31045142ed1fSjojemann psum1 = ntohs(tcp->th_sport);
31055142ed1fSjojemann psum2 = ntohs(nat->nat_inport);
31065142ed1fSjojemann tcp->th_sport = nat->nat_inport;
31077c478bd9Sstevel@tonic-gate
31085142ed1fSjojemann } else if ((tcp->th_sport == nat->nat_oport) &&
31095142ed1fSjojemann (tcp->th_dport != nat->nat_outport)) {
31107c478bd9Sstevel@tonic-gate
31115142ed1fSjojemann /*
31125142ed1fSjojemann * Translate the destination port.
31135142ed1fSjojemann */
31147c478bd9Sstevel@tonic-gate
31155142ed1fSjojemann psum1 = ntohs(tcp->th_dport);
31165142ed1fSjojemann psum2 = ntohs(nat->nat_outport);
31175142ed1fSjojemann tcp->th_dport = nat->nat_outport;
31185142ed1fSjojemann }
31197c478bd9Sstevel@tonic-gate
31205142ed1fSjojemann if ((oip->ip_p == IPPROTO_TCP) && (dlen >= 18)) {
31217c478bd9Sstevel@tonic-gate
31227c478bd9Sstevel@tonic-gate /*
31235142ed1fSjojemann * TCP checksum present.
31245142ed1fSjojemann *
31255142ed1fSjojemann * Adjust data checksum and icmp checksum to
31265142ed1fSjojemann * compensate for any IP address change.
31277c478bd9Sstevel@tonic-gate */
31285142ed1fSjojemann
31295142ed1fSjojemann sum1 = ntohs(tcp->th_sum);
31305142ed1fSjojemann fix_datacksum(&tcp->th_sum, sumd);
31315142ed1fSjojemann sum2 = ntohs(tcp->th_sum);
31325142ed1fSjojemann sumd2 = sumd << 1;
31337c478bd9Sstevel@tonic-gate CALC_SUMD(sum1, sum2, sumd);
31347c478bd9Sstevel@tonic-gate sumd2 += sumd;
31357c478bd9Sstevel@tonic-gate
31365142ed1fSjojemann /*
31375142ed1fSjojemann * Also make data checksum adjustment to
31385142ed1fSjojemann * compensate for any port change.
31395142ed1fSjojemann */
31407c478bd9Sstevel@tonic-gate
31415142ed1fSjojemann if (psum1 != psum2) {
31425142ed1fSjojemann CALC_SUMD(psum1, psum2, psumd);
31435142ed1fSjojemann fix_datacksum(&tcp->th_sum, psumd);
31445142ed1fSjojemann }
31457c478bd9Sstevel@tonic-gate
31465142ed1fSjojemann } else if ((oip->ip_p == IPPROTO_UDP) &&
31475142ed1fSjojemann (dlen >= 8) && (udp->uh_sum != 0)) {
31487c478bd9Sstevel@tonic-gate
31497c478bd9Sstevel@tonic-gate /*
31505142ed1fSjojemann * The UDP checksum is present and set.
31515142ed1fSjojemann *
31525142ed1fSjojemann * Adjust data checksum and icmp checksum to
31535142ed1fSjojemann * compensate for any IP address change.
31547c478bd9Sstevel@tonic-gate */
31555142ed1fSjojemann
31565142ed1fSjojemann sum1 = ntohs(udp->uh_sum);
31575142ed1fSjojemann fix_datacksum(&udp->uh_sum, sumd);
31585142ed1fSjojemann sum2 = ntohs(udp->uh_sum);
31595142ed1fSjojemann sumd2 = sumd << 1;
3160ab25eeb5Syz CALC_SUMD(sum1, sum2, sumd);
3161ab25eeb5Syz sumd2 += sumd;
31627c478bd9Sstevel@tonic-gate
31635142ed1fSjojemann /*
31645142ed1fSjojemann * Also make data checksum adjustment to
31655142ed1fSjojemann * compensate for any port change.
31665142ed1fSjojemann */
31675142ed1fSjojemann
31685142ed1fSjojemann if (psum1 != psum2) {
31695142ed1fSjojemann CALC_SUMD(psum1, psum2, psumd);
31705142ed1fSjojemann fix_datacksum(&udp->uh_sum, psumd);
31717c478bd9Sstevel@tonic-gate }
31725142ed1fSjojemann
31735142ed1fSjojemann } else {
31745142ed1fSjojemann
31755142ed1fSjojemann /*
31765142ed1fSjojemann * Data checksum was not present.
31775142ed1fSjojemann *
31785142ed1fSjojemann * Compensate for any port change.
31795142ed1fSjojemann */
31805142ed1fSjojemann
31815142ed1fSjojemann CALC_SUMD(psum2, psum1, psumd);
31825142ed1fSjojemann sumd2 += psumd;
31837c478bd9Sstevel@tonic-gate }
31845142ed1fSjojemann break;
31857c478bd9Sstevel@tonic-gate
31865142ed1fSjojemann case IPPROTO_ICMP :
31877c478bd9Sstevel@tonic-gate
31885142ed1fSjojemann orgicmp = (icmphdr_t *)udp;
31895142ed1fSjojemann
31905142ed1fSjojemann if ((nat->nat_dir == NAT_OUTBOUND) &&
31915142ed1fSjojemann (orgicmp->icmp_id != nat->nat_inport) &&
31925142ed1fSjojemann (dlen >= 8)) {
31937c478bd9Sstevel@tonic-gate
3194ab25eeb5Syz /*
31957c478bd9Sstevel@tonic-gate * Fix ICMP checksum (of the offening ICMP
31967c478bd9Sstevel@tonic-gate * query packet) to compensate the change
31977c478bd9Sstevel@tonic-gate * in the ICMP id of the offending ICMP
31987c478bd9Sstevel@tonic-gate * packet.
31997c478bd9Sstevel@tonic-gate *
32007c478bd9Sstevel@tonic-gate * Since you modify orgicmp->icmp_id with
32017c478bd9Sstevel@tonic-gate * a delta (say x) and you compensate that
32027c478bd9Sstevel@tonic-gate * in origicmp->icmp_cksum with a delta
32037c478bd9Sstevel@tonic-gate * minus x, you don't have to adjust the
3204ab25eeb5Syz * overall icmp->icmp_cksum
32057c478bd9Sstevel@tonic-gate */
32065142ed1fSjojemann
32077c478bd9Sstevel@tonic-gate sum1 = ntohs(orgicmp->icmp_id);
32087c478bd9Sstevel@tonic-gate sum2 = ntohs(nat->nat_inport);
32097c478bd9Sstevel@tonic-gate CALC_SUMD(sum1, sum2, sumd);
32107c478bd9Sstevel@tonic-gate orgicmp->icmp_id = nat->nat_inport;
32117c478bd9Sstevel@tonic-gate fix_datacksum(&orgicmp->icmp_cksum, sumd);
32125142ed1fSjojemann
32135142ed1fSjojemann } /* nat_dir can't be NAT_INBOUND for icmp queries */
32145142ed1fSjojemann
32155142ed1fSjojemann break;
32165142ed1fSjojemann
32175142ed1fSjojemann default :
32185142ed1fSjojemann
32195142ed1fSjojemann break;
32205142ed1fSjojemann
32215142ed1fSjojemann } /* switch (oip->ip_p) */
32225142ed1fSjojemann
32235142ed1fSjojemann /*
32245142ed1fSjojemann * Step 3
32255142ed1fSjojemann * Make the adjustments to icmp checksum.
32265142ed1fSjojemann */
32275142ed1fSjojemann
32285142ed1fSjojemann if (sumd2 != 0) {
32295142ed1fSjojemann sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
32305142ed1fSjojemann sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
3231381a2a9aSdr fix_incksum(&icmp->icmp_cksum, sumd2);
32327c478bd9Sstevel@tonic-gate }
32337c478bd9Sstevel@tonic-gate return nat;
32347c478bd9Sstevel@tonic-gate }
32357c478bd9Sstevel@tonic-gate
32367c478bd9Sstevel@tonic-gate
32377c478bd9Sstevel@tonic-gate /*
32387c478bd9Sstevel@tonic-gate * NB: these lookups don't lock access to the list, it assumed that it has
32397c478bd9Sstevel@tonic-gate * already been done!
32407c478bd9Sstevel@tonic-gate */
32417c478bd9Sstevel@tonic-gate
32427c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
32437c478bd9Sstevel@tonic-gate /* Function: nat_inlookup */
32447c478bd9Sstevel@tonic-gate /* Returns: nat_t* - NULL == no match, */
32457c478bd9Sstevel@tonic-gate /* else pointer to matching NAT entry */
32467c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */
32477c478bd9Sstevel@tonic-gate /* flags(I) - NAT flags for this packet */
32487c478bd9Sstevel@tonic-gate /* p(I) - protocol for this packet */
32497c478bd9Sstevel@tonic-gate /* src(I) - source IP address */
32507c478bd9Sstevel@tonic-gate /* mapdst(I) - destination IP address */
32517c478bd9Sstevel@tonic-gate /* */
32527c478bd9Sstevel@tonic-gate /* Lookup a nat entry based on the mapped destination ip address/port and */
32537c478bd9Sstevel@tonic-gate /* real source address/port. We use this lookup when receiving a packet, */
32547c478bd9Sstevel@tonic-gate /* we're looking for a table entry, based on the destination address. */
32557c478bd9Sstevel@tonic-gate /* */
32567c478bd9Sstevel@tonic-gate /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */
32577c478bd9Sstevel@tonic-gate /* */
32587c478bd9Sstevel@tonic-gate /* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN */
32597c478bd9Sstevel@tonic-gate /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */
32607c478bd9Sstevel@tonic-gate /* */
32617c478bd9Sstevel@tonic-gate /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */
32627c478bd9Sstevel@tonic-gate /* the packet is of said protocol */
32637c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_inlookup(fin,flags,p,src,mapdst)32647c478bd9Sstevel@tonic-gate nat_t *nat_inlookup(fin, flags, p, src, mapdst)
32657c478bd9Sstevel@tonic-gate fr_info_t *fin;
32667c478bd9Sstevel@tonic-gate u_int flags, p;
32677c478bd9Sstevel@tonic-gate struct in_addr src , mapdst;
32687c478bd9Sstevel@tonic-gate {
32697c478bd9Sstevel@tonic-gate u_short sport, dport;
32707c478bd9Sstevel@tonic-gate ipnat_t *ipn;
32717c478bd9Sstevel@tonic-gate u_int sflags;
32727c478bd9Sstevel@tonic-gate nat_t *nat;
32737c478bd9Sstevel@tonic-gate int nflags;
32747c478bd9Sstevel@tonic-gate u_32_t dst;
32757c478bd9Sstevel@tonic-gate void *ifp;
32767c478bd9Sstevel@tonic-gate u_int hv;
3277f4b3ec61Sdh ipf_stack_t *ifs = fin->fin_ifs;
32787c478bd9Sstevel@tonic-gate
32797c478bd9Sstevel@tonic-gate if (fin != NULL)
32807c478bd9Sstevel@tonic-gate ifp = fin->fin_ifp;
32817c478bd9Sstevel@tonic-gate else
32827c478bd9Sstevel@tonic-gate ifp = NULL;
3283ab25eeb5Syz sport = 0;
3284ab25eeb5Syz dport = 0;
32857c478bd9Sstevel@tonic-gate dst = mapdst.s_addr;
32867c478bd9Sstevel@tonic-gate sflags = flags & NAT_TCPUDPICMP;
3287ab25eeb5Syz
3288ab25eeb5Syz switch (p)
3289ab25eeb5Syz {
3290ab25eeb5Syz case IPPROTO_TCP :
3291ab25eeb5Syz case IPPROTO_UDP :
32927c478bd9Sstevel@tonic-gate sport = htons(fin->fin_data[0]);
32937c478bd9Sstevel@tonic-gate dport = htons(fin->fin_data[1]);
3294ab25eeb5Syz break;
3295ab25eeb5Syz case IPPROTO_ICMP :
3296ab25eeb5Syz if (flags & IPN_ICMPERR)
3297ab25eeb5Syz sport = fin->fin_data[1];
3298ab25eeb5Syz else
3299ab25eeb5Syz dport = fin->fin_data[1];
3300ab25eeb5Syz break;
3301ab25eeb5Syz default :
3302ab25eeb5Syz break;
33037c478bd9Sstevel@tonic-gate }
3304ab25eeb5Syz
3305ab25eeb5Syz
33067c478bd9Sstevel@tonic-gate if ((flags & SI_WILDP) != 0)
33077c478bd9Sstevel@tonic-gate goto find_in_wild_ports;
33087c478bd9Sstevel@tonic-gate
33097c478bd9Sstevel@tonic-gate hv = NAT_HASH_FN(dst, dport, 0xffffffff);
3310f4b3ec61Sdh hv = NAT_HASH_FN(src.s_addr, hv + sport, ifs->ifs_ipf_nattable_sz);
3311f4b3ec61Sdh nat = ifs->ifs_nat_table[1][hv];
33127c478bd9Sstevel@tonic-gate for (; nat; nat = nat->nat_hnext[1]) {
3313d6c23f6fSyx if (nat->nat_v != 4)
3314d6c23f6fSyx continue;
3315d6c23f6fSyx
3316e6c6c1faSyz if (nat->nat_ifps[0] != NULL) {
3317e6c6c1faSyz if ((ifp != NULL) && (ifp != nat->nat_ifps[0]))
3318e6c6c1faSyz continue;
3319e6c6c1faSyz } else if (ifp != NULL)
3320e6c6c1faSyz nat->nat_ifps[0] = ifp;
33217c478bd9Sstevel@tonic-gate
3322e6c6c1faSyz nflags = nat->nat_flags;
3323ab25eeb5Syz
33247c478bd9Sstevel@tonic-gate if (nat->nat_oip.s_addr == src.s_addr &&
33257c478bd9Sstevel@tonic-gate nat->nat_outip.s_addr == dst &&
3326ab25eeb5Syz (((p == 0) &&
3327ab25eeb5Syz (sflags == (nat->nat_flags & IPN_TCPUDPICMP)))
33287c478bd9Sstevel@tonic-gate || (p == nat->nat_p))) {
33297c478bd9Sstevel@tonic-gate switch (p)
33307c478bd9Sstevel@tonic-gate {
3331ab25eeb5Syz #if 0
33327c478bd9Sstevel@tonic-gate case IPPROTO_GRE :
3333ab25eeb5Syz if (nat->nat_call[1] != fin->fin_data[0])
33347c478bd9Sstevel@tonic-gate continue;
33357c478bd9Sstevel@tonic-gate break;
3336ab25eeb5Syz #endif
3337ab25eeb5Syz case IPPROTO_ICMP :
3338ab25eeb5Syz if ((flags & IPN_ICMPERR) != 0) {
3339ab25eeb5Syz if (nat->nat_outport != sport)
3340ab25eeb5Syz continue;
3341ab25eeb5Syz } else {
3342ab25eeb5Syz if (nat->nat_outport != dport)
3343ab25eeb5Syz continue;
3344ab25eeb5Syz }
3345ab25eeb5Syz break;
33467c478bd9Sstevel@tonic-gate case IPPROTO_TCP :
33477c478bd9Sstevel@tonic-gate case IPPROTO_UDP :
33487c478bd9Sstevel@tonic-gate if (nat->nat_oport != sport)
33497c478bd9Sstevel@tonic-gate continue;
33507c478bd9Sstevel@tonic-gate if (nat->nat_outport != dport)
33517c478bd9Sstevel@tonic-gate continue;
33527c478bd9Sstevel@tonic-gate break;
33537c478bd9Sstevel@tonic-gate default :
33547c478bd9Sstevel@tonic-gate break;
33557c478bd9Sstevel@tonic-gate }
33567c478bd9Sstevel@tonic-gate
33577c478bd9Sstevel@tonic-gate ipn = nat->nat_ptr;
33587c478bd9Sstevel@tonic-gate if ((ipn != NULL) && (nat->nat_aps != NULL))
33597c478bd9Sstevel@tonic-gate if (appr_match(fin, nat) != 0)
33607c478bd9Sstevel@tonic-gate continue;
33617c478bd9Sstevel@tonic-gate return nat;
33627c478bd9Sstevel@tonic-gate }
33637c478bd9Sstevel@tonic-gate }
33647c478bd9Sstevel@tonic-gate
33657c478bd9Sstevel@tonic-gate /*
33667c478bd9Sstevel@tonic-gate * So if we didn't find it but there are wildcard members in the hash
33677c478bd9Sstevel@tonic-gate * table, go back and look for them. We do this search and update here
33687c478bd9Sstevel@tonic-gate * because it is modifying the NAT table and we want to do this only
33697c478bd9Sstevel@tonic-gate * for the first packet that matches. The exception, of course, is
33707c478bd9Sstevel@tonic-gate * for "dummy" (FI_IGNORE) lookups.
33717c478bd9Sstevel@tonic-gate */
33727c478bd9Sstevel@tonic-gate find_in_wild_ports:
33737c478bd9Sstevel@tonic-gate if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH))
33747c478bd9Sstevel@tonic-gate return NULL;
3375f4b3ec61Sdh if (ifs->ifs_nat_stats.ns_wilds == 0)
33767c478bd9Sstevel@tonic-gate return NULL;
33777c478bd9Sstevel@tonic-gate
3378f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
33797c478bd9Sstevel@tonic-gate
33807c478bd9Sstevel@tonic-gate hv = NAT_HASH_FN(dst, 0, 0xffffffff);
3381f4b3ec61Sdh hv = NAT_HASH_FN(src.s_addr, hv, ifs->ifs_ipf_nattable_sz);
33827c478bd9Sstevel@tonic-gate
3383f4b3ec61Sdh WRITE_ENTER(&ifs->ifs_ipf_nat);
33847c478bd9Sstevel@tonic-gate
3385f4b3ec61Sdh nat = ifs->ifs_nat_table[1][hv];
33867c478bd9Sstevel@tonic-gate for (; nat; nat = nat->nat_hnext[1]) {
3387d6c23f6fSyx if (nat->nat_v != 4)
3388d6c23f6fSyx continue;
3389d6c23f6fSyx
3390e6c6c1faSyz if (nat->nat_ifps[0] != NULL) {
3391e6c6c1faSyz if ((ifp != NULL) && (ifp != nat->nat_ifps[0]))
3392e6c6c1faSyz continue;
3393e6c6c1faSyz } else if (ifp != NULL)
3394e6c6c1faSyz nat->nat_ifps[0] = ifp;
33957c478bd9Sstevel@tonic-gate
33967c478bd9Sstevel@tonic-gate if (nat->nat_p != fin->fin_p)
33977c478bd9Sstevel@tonic-gate continue;
33987c478bd9Sstevel@tonic-gate if (nat->nat_oip.s_addr != src.s_addr ||
33997c478bd9Sstevel@tonic-gate nat->nat_outip.s_addr != dst)
34007c478bd9Sstevel@tonic-gate continue;
34017c478bd9Sstevel@tonic-gate
34027c478bd9Sstevel@tonic-gate nflags = nat->nat_flags;
34037c478bd9Sstevel@tonic-gate if (!(nflags & (NAT_TCPUDP|SI_WILDP)))
34047c478bd9Sstevel@tonic-gate continue;
34057c478bd9Sstevel@tonic-gate
34067c478bd9Sstevel@tonic-gate if (nat_wildok(nat, (int)sport, (int)dport, nflags,
34077c478bd9Sstevel@tonic-gate NAT_INBOUND) == 1) {
34087c478bd9Sstevel@tonic-gate if ((fin->fin_flx & FI_IGNORE) != 0)
34097c478bd9Sstevel@tonic-gate break;
34107c478bd9Sstevel@tonic-gate if ((nflags & SI_CLONE) != 0) {
34117c478bd9Sstevel@tonic-gate nat = fr_natclone(fin, nat);
34127c478bd9Sstevel@tonic-gate if (nat == NULL)
34137c478bd9Sstevel@tonic-gate break;
34147c478bd9Sstevel@tonic-gate } else {
3415f4b3ec61Sdh MUTEX_ENTER(&ifs->ifs_ipf_nat_new);
3416f4b3ec61Sdh ifs->ifs_nat_stats.ns_wilds--;
3417f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipf_nat_new);
34187c478bd9Sstevel@tonic-gate }
34197c478bd9Sstevel@tonic-gate nat->nat_oport = sport;
34207c478bd9Sstevel@tonic-gate nat->nat_outport = dport;
34217c478bd9Sstevel@tonic-gate nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT);
3422f4b3ec61Sdh nat_tabmove(nat, ifs);
34237c478bd9Sstevel@tonic-gate break;
34247c478bd9Sstevel@tonic-gate }
34257c478bd9Sstevel@tonic-gate }
34267c478bd9Sstevel@tonic-gate
3427f4b3ec61Sdh MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat);
34287c478bd9Sstevel@tonic-gate
34297c478bd9Sstevel@tonic-gate return nat;
34307c478bd9Sstevel@tonic-gate }
34317c478bd9Sstevel@tonic-gate
34327c478bd9Sstevel@tonic-gate
34337c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
34347c478bd9Sstevel@tonic-gate /* Function: nat_tabmove */
34357c478bd9Sstevel@tonic-gate /* Returns: Nil */
34367c478bd9Sstevel@tonic-gate /* Parameters: nat(I) - pointer to NAT structure */
34377c478bd9Sstevel@tonic-gate /* Write Lock: ipf_nat */
34387c478bd9Sstevel@tonic-gate /* */
34397c478bd9Sstevel@tonic-gate /* This function is only called for TCP/UDP NAT table entries where the */
34407c478bd9Sstevel@tonic-gate /* original was placed in the table without hashing on the ports and we now */
34417c478bd9Sstevel@tonic-gate /* want to include hashing on port numbers. */
34427c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_tabmove(nat,ifs)3443f4b3ec61Sdh static void nat_tabmove(nat, ifs)
34447c478bd9Sstevel@tonic-gate nat_t *nat;
3445f4b3ec61Sdh ipf_stack_t *ifs;
34467c478bd9Sstevel@tonic-gate {
34477c478bd9Sstevel@tonic-gate nat_t **natp;
34487c478bd9Sstevel@tonic-gate u_int hv;
34497c478bd9Sstevel@tonic-gate
34507c478bd9Sstevel@tonic-gate if (nat->nat_flags & SI_CLONE)
34517c478bd9Sstevel@tonic-gate return;
34527c478bd9Sstevel@tonic-gate
34537c478bd9Sstevel@tonic-gate /*
34547c478bd9Sstevel@tonic-gate * Remove the NAT entry from the old location
34557c478bd9Sstevel@tonic-gate */
34567c478bd9Sstevel@tonic-gate if (nat->nat_hnext[0])
34577c478bd9Sstevel@tonic-gate nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
34587c478bd9Sstevel@tonic-gate *nat->nat_phnext[0] = nat->nat_hnext[0];
3459f4b3ec61Sdh ifs->ifs_nat_stats.ns_bucketlen[0][nat->nat_hv[0]]--;
34607c478bd9Sstevel@tonic-gate
34617c478bd9Sstevel@tonic-gate if (nat->nat_hnext[1])
34627c478bd9Sstevel@tonic-gate nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
34637c478bd9Sstevel@tonic-gate *nat->nat_phnext[1] = nat->nat_hnext[1];
3464f4b3ec61Sdh ifs->ifs_nat_stats.ns_bucketlen[1][nat->nat_hv[1]]--;
34657c478bd9Sstevel@tonic-gate
34667c478bd9Sstevel@tonic-gate /*
34677c478bd9Sstevel@tonic-gate * Add into the NAT table in the new position
34687c478bd9Sstevel@tonic-gate */
34697c478bd9Sstevel@tonic-gate hv = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport, 0xffffffff);
34707c478bd9Sstevel@tonic-gate hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + nat->nat_oport,
3471f4b3ec61Sdh ifs->ifs_ipf_nattable_sz);
34727c478bd9Sstevel@tonic-gate nat->nat_hv[0] = hv;
3473f4b3ec61Sdh natp = &ifs->ifs_nat_table[0][hv];
34747c478bd9Sstevel@tonic-gate if (*natp)
34757c478bd9Sstevel@tonic-gate (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
34767c478bd9Sstevel@tonic-gate nat->nat_phnext[0] = natp;
34777c478bd9Sstevel@tonic-gate nat->nat_hnext[0] = *natp;
34787c478bd9Sstevel@tonic-gate *natp = nat;
3479f4b3ec61Sdh ifs->ifs_nat_stats.ns_bucketlen[0][hv]++;
34807c478bd9Sstevel@tonic-gate
34817c478bd9Sstevel@tonic-gate hv = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport, 0xffffffff);
34827c478bd9Sstevel@tonic-gate hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + nat->nat_oport,
3483f4b3ec61Sdh ifs->ifs_ipf_nattable_sz);
34847c478bd9Sstevel@tonic-gate nat->nat_hv[1] = hv;
3485f4b3ec61Sdh natp = &ifs->ifs_nat_table[1][hv];
34867c478bd9Sstevel@tonic-gate if (*natp)
34877c478bd9Sstevel@tonic-gate (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
34887c478bd9Sstevel@tonic-gate nat->nat_phnext[1] = natp;
34897c478bd9Sstevel@tonic-gate nat->nat_hnext[1] = *natp;
34907c478bd9Sstevel@tonic-gate *natp = nat;
3491f4b3ec61Sdh ifs->ifs_nat_stats.ns_bucketlen[1][hv]++;
34927c478bd9Sstevel@tonic-gate }
34937c478bd9Sstevel@tonic-gate
34947c478bd9Sstevel@tonic-gate
34957c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
34967c478bd9Sstevel@tonic-gate /* Function: nat_outlookup */
34977c478bd9Sstevel@tonic-gate /* Returns: nat_t* - NULL == no match, */
34987c478bd9Sstevel@tonic-gate /* else pointer to matching NAT entry */
34997c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */
35007c478bd9Sstevel@tonic-gate /* flags(I) - NAT flags for this packet */
35017c478bd9Sstevel@tonic-gate /* p(I) - protocol for this packet */
35027c478bd9Sstevel@tonic-gate /* src(I) - source IP address */
35037c478bd9Sstevel@tonic-gate /* dst(I) - destination IP address */
35047c478bd9Sstevel@tonic-gate /* rw(I) - 1 == write lock on ipf_nat held, 0 == read lock. */
35057c478bd9Sstevel@tonic-gate /* */
35067c478bd9Sstevel@tonic-gate /* Lookup a nat entry based on the source 'real' ip address/port and */
35077c478bd9Sstevel@tonic-gate /* destination address/port. We use this lookup when sending a packet out, */
35087c478bd9Sstevel@tonic-gate /* we're looking for a table entry, based on the source address. */
35097c478bd9Sstevel@tonic-gate /* */
35107c478bd9Sstevel@tonic-gate /* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */
35117c478bd9Sstevel@tonic-gate /* */
35127c478bd9Sstevel@tonic-gate /* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN */
35137c478bd9Sstevel@tonic-gate /* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */
35147c478bd9Sstevel@tonic-gate /* */
35157c478bd9Sstevel@tonic-gate /* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */
35167c478bd9Sstevel@tonic-gate /* the packet is of said protocol */
35177c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_outlookup(fin,flags,p,src,dst)35187c478bd9Sstevel@tonic-gate nat_t *nat_outlookup(fin, flags, p, src, dst)
35197c478bd9Sstevel@tonic-gate fr_info_t *fin;
35207c478bd9Sstevel@tonic-gate u_int flags, p;
35217c478bd9Sstevel@tonic-gate struct in_addr src , dst;
35227c478bd9Sstevel@tonic-gate {
35237c478bd9Sstevel@tonic-gate u_short sport, dport;
35247c478bd9Sstevel@tonic-gate u_int sflags;
35257c478bd9Sstevel@tonic-gate ipnat_t *ipn;
35267c478bd9Sstevel@tonic-gate u_32_t srcip;
35277c478bd9Sstevel@tonic-gate nat_t *nat;
35287c478bd9Sstevel@tonic-gate int nflags;
35297c478bd9Sstevel@tonic-gate void *ifp;
35307c478bd9Sstevel@tonic-gate u_int hv;
3531f4b3ec61Sdh ipf_stack_t *ifs = fin->fin_ifs;
3532e6c6c1faSyz
3533d3675867Sjojemann ifp = fin->fin_ifp;
35347c478bd9Sstevel@tonic-gate
35357c478bd9Sstevel@tonic-gate srcip = src.s_addr;
35367c478bd9Sstevel@tonic-gate sflags = flags & IPN_TCPUDPICMP;
3537ab25eeb5Syz sport = 0;
3538ab25eeb5Syz dport = 0;
3539ab25eeb5Syz
3540ab25eeb5Syz switch (p)
3541ab25eeb5Syz {
3542ab25eeb5Syz case IPPROTO_TCP :
3543ab25eeb5Syz case IPPROTO_UDP :
3544ab25eeb5Syz sport = htons(fin->fin_data[0]);
3545ab25eeb5Syz dport = htons(fin->fin_data[1]);
3546ab25eeb5Syz break;
3547ab25eeb5Syz case IPPROTO_ICMP :
3548ab25eeb5Syz if (flags & IPN_ICMPERR)
3549ab25eeb5Syz sport = fin->fin_data[1];
3550ab25eeb5Syz else
3551ab25eeb5Syz dport = fin->fin_data[1];
3552ab25eeb5Syz break;
3553ab25eeb5Syz default :
3554ab25eeb5Syz break;
35557c478bd9Sstevel@tonic-gate }
3556ab25eeb5Syz
35577c478bd9Sstevel@tonic-gate if ((flags & SI_WILDP) != 0)
35587c478bd9Sstevel@tonic-gate goto find_out_wild_ports;
35597c478bd9Sstevel@tonic-gate
35607c478bd9Sstevel@tonic-gate hv = NAT_HASH_FN(srcip, sport, 0xffffffff);
3561f4b3ec61Sdh hv = NAT_HASH_FN(dst.s_addr, hv + dport, ifs->ifs_ipf_nattable_sz);
3562f4b3ec61Sdh nat = ifs->ifs_nat_table[0][hv];
35637c478bd9Sstevel@tonic-gate for (; nat; nat = nat->nat_hnext[0]) {
3564d6c23f6fSyx if (nat->nat_v != 4)
3565d6c23f6fSyx continue;
3566d6c23f6fSyx
3567e6c6c1faSyz if (nat->nat_ifps[1] != NULL) {
3568e6c6c1faSyz if ((ifp != NULL) && (ifp != nat->nat_ifps[1]))
3569e6c6c1faSyz continue;
3570e6c6c1faSyz } else if (ifp != NULL)
3571e6c6c1faSyz nat->nat_ifps[1] = ifp;
3572ab25eeb5Syz
3573e6c6c1faSyz nflags = nat->nat_flags;
3574*55fea89dSDan Cross
35757c478bd9Sstevel@tonic-gate if (nat->nat_inip.s_addr == srcip &&
35767c478bd9Sstevel@tonic-gate nat->nat_oip.s_addr == dst.s_addr &&
35777c478bd9Sstevel@tonic-gate (((p == 0) && (sflags == (nflags & NAT_TCPUDPICMP)))
35787c478bd9Sstevel@tonic-gate || (p == nat->nat_p))) {
35797c478bd9Sstevel@tonic-gate switch (p)
35807c478bd9Sstevel@tonic-gate {
3581ab25eeb5Syz #if 0
35827c478bd9Sstevel@tonic-gate case IPPROTO_GRE :
3583ab25eeb5Syz if (nat->nat_call[1] != fin->fin_data[0])
3584ab25eeb5Syz continue;
35857c478bd9Sstevel@tonic-gate break;
3586ab25eeb5Syz #endif
35877c478bd9Sstevel@tonic-gate case IPPROTO_TCP :
35887c478bd9Sstevel@tonic-gate case IPPROTO_UDP :
35897c478bd9Sstevel@tonic-gate if (nat->nat_oport != dport)
35907c478bd9Sstevel@tonic-gate continue;
35917c478bd9Sstevel@tonic-gate if (nat->nat_inport != sport)
35927c478bd9Sstevel@tonic-gate continue;
35937c478bd9Sstevel@tonic-gate break;
35947c478bd9Sstevel@tonic-gate default :
35957c478bd9Sstevel@tonic-gate break;
35967c478bd9Sstevel@tonic-gate }
35977c478bd9Sstevel@tonic-gate
35987c478bd9Sstevel@tonic-gate ipn = nat->nat_ptr;
35997c478bd9Sstevel@tonic-gate if ((ipn != NULL) && (nat->nat_aps != NULL))
36007c478bd9Sstevel@tonic-gate if (appr_match(fin, nat) != 0)
36017c478bd9Sstevel@tonic-gate continue;
36027c478bd9Sstevel@tonic-gate return nat;
36037c478bd9Sstevel@tonic-gate }
36047c478bd9Sstevel@tonic-gate }
36057c478bd9Sstevel@tonic-gate
36067c478bd9Sstevel@tonic-gate /*
36077c478bd9Sstevel@tonic-gate * So if we didn't find it but there are wildcard members in the hash
36087c478bd9Sstevel@tonic-gate * table, go back and look for them. We do this search and update here
36097c478bd9Sstevel@tonic-gate * because it is modifying the NAT table and we want to do this only
36107c478bd9Sstevel@tonic-gate * for the first packet that matches. The exception, of course, is
36117c478bd9Sstevel@tonic-gate * for "dummy" (FI_IGNORE) lookups.
36127c478bd9Sstevel@tonic-gate */
36137c478bd9Sstevel@tonic-gate find_out_wild_ports:
36147c478bd9Sstevel@tonic-gate if (!(flags & NAT_TCPUDP) || !(flags & NAT_SEARCH))
36157c478bd9Sstevel@tonic-gate return NULL;
3616f4b3ec61Sdh if (ifs->ifs_nat_stats.ns_wilds == 0)
36177c478bd9Sstevel@tonic-gate return NULL;
36187c478bd9Sstevel@tonic-gate
3619f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
36207c478bd9Sstevel@tonic-gate
36217c478bd9Sstevel@tonic-gate hv = NAT_HASH_FN(srcip, 0, 0xffffffff);
3622f4b3ec61Sdh hv = NAT_HASH_FN(dst.s_addr, hv, ifs->ifs_ipf_nattable_sz);
36237c478bd9Sstevel@tonic-gate
3624f4b3ec61Sdh WRITE_ENTER(&ifs->ifs_ipf_nat);
36257c478bd9Sstevel@tonic-gate
3626f4b3ec61Sdh nat = ifs->ifs_nat_table[0][hv];
36277c478bd9Sstevel@tonic-gate for (; nat; nat = nat->nat_hnext[0]) {
3628d6c23f6fSyx if (nat->nat_v != 4)
3629d6c23f6fSyx continue;
3630d6c23f6fSyx
3631e6c6c1faSyz if (nat->nat_ifps[1] != NULL) {
3632e6c6c1faSyz if ((ifp != NULL) && (ifp != nat->nat_ifps[1]))
3633f4b3ec61Sdh continue;
3634e6c6c1faSyz } else if (ifp != NULL)
3635e6c6c1faSyz nat->nat_ifps[1] = ifp;
36367c478bd9Sstevel@tonic-gate
36377c478bd9Sstevel@tonic-gate if (nat->nat_p != fin->fin_p)
36387c478bd9Sstevel@tonic-gate continue;
36397c478bd9Sstevel@tonic-gate if ((nat->nat_inip.s_addr != srcip) ||
36407c478bd9Sstevel@tonic-gate (nat->nat_oip.s_addr != dst.s_addr))
36417c478bd9Sstevel@tonic-gate continue;
36427c478bd9Sstevel@tonic-gate
36437c478bd9Sstevel@tonic-gate nflags = nat->nat_flags;
36447c478bd9Sstevel@tonic-gate if (!(nflags & (NAT_TCPUDP|SI_WILDP)))
36457c478bd9Sstevel@tonic-gate continue;
36467c478bd9Sstevel@tonic-gate
36477c478bd9Sstevel@tonic-gate if (nat_wildok(nat, (int)sport, (int)dport, nflags,
36487c478bd9Sstevel@tonic-gate NAT_OUTBOUND) == 1) {
36497c478bd9Sstevel@tonic-gate if ((fin->fin_flx & FI_IGNORE) != 0)
36507c478bd9Sstevel@tonic-gate break;
36517c478bd9Sstevel@tonic-gate if ((nflags & SI_CLONE) != 0) {
36527c478bd9Sstevel@tonic-gate nat = fr_natclone(fin, nat);
36537c478bd9Sstevel@tonic-gate if (nat == NULL)
36547c478bd9Sstevel@tonic-gate break;
36557c478bd9Sstevel@tonic-gate } else {
3656f4b3ec61Sdh MUTEX_ENTER(&ifs->ifs_ipf_nat_new);
3657f4b3ec61Sdh ifs->ifs_nat_stats.ns_wilds--;
3658f4b3ec61Sdh MUTEX_EXIT(&ifs->ifs_ipf_nat_new);
36597c478bd9Sstevel@tonic-gate }
36607c478bd9Sstevel@tonic-gate nat->nat_inport = sport;
36617c478bd9Sstevel@tonic-gate nat->nat_oport = dport;
36627c478bd9Sstevel@tonic-gate if (nat->nat_outport == 0)
36637c478bd9Sstevel@tonic-gate nat->nat_outport = sport;
36647c478bd9Sstevel@tonic-gate nat->nat_flags &= ~(SI_W_DPORT|SI_W_SPORT);
3665f4b3ec61Sdh nat_tabmove(nat, ifs);
36667c478bd9Sstevel@tonic-gate break;
36677c478bd9Sstevel@tonic-gate }
36687c478bd9Sstevel@tonic-gate }
36697c478bd9Sstevel@tonic-gate
3670f4b3ec61Sdh MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat);
36717c478bd9Sstevel@tonic-gate
36727c478bd9Sstevel@tonic-gate return nat;
36737c478bd9Sstevel@tonic-gate }
36747c478bd9Sstevel@tonic-gate
36757c478bd9Sstevel@tonic-gate
36767c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
36777c478bd9Sstevel@tonic-gate /* Function: nat_lookupredir */
36787c478bd9Sstevel@tonic-gate /* Returns: nat_t* - NULL == no match, */
36797c478bd9Sstevel@tonic-gate /* else pointer to matching NAT entry */
36807c478bd9Sstevel@tonic-gate /* Parameters: np(I) - pointer to description of packet to find NAT table */
36817c478bd9Sstevel@tonic-gate /* entry for. */
36827c478bd9Sstevel@tonic-gate /* */
36837c478bd9Sstevel@tonic-gate /* Lookup the NAT tables to search for a matching redirect */
36847c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_lookupredir(np,ifs)3685f4b3ec61Sdh nat_t *nat_lookupredir(np, ifs)
36867c478bd9Sstevel@tonic-gate natlookup_t *np;
3687f4b3ec61Sdh ipf_stack_t *ifs;
36887c478bd9Sstevel@tonic-gate {
36897c478bd9Sstevel@tonic-gate fr_info_t fi;
36907c478bd9Sstevel@tonic-gate nat_t *nat;
36917c478bd9Sstevel@tonic-gate
36927c478bd9Sstevel@tonic-gate bzero((char *)&fi, sizeof(fi));
3693ab25eeb5Syz if (np->nl_flags & IPN_IN) {
3694ab25eeb5Syz fi.fin_data[0] = ntohs(np->nl_realport);
3695ab25eeb5Syz fi.fin_data[1] = ntohs(np->nl_outport);
3696ab25eeb5Syz } else {
3697ab25eeb5Syz fi.fin_data[0] = ntohs(np->nl_inport);
3698ab25eeb5Syz fi.fin_data[1] = ntohs(np->nl_outport);
3699ab25eeb5Syz }
37005b6dcef9Sdr if (np->nl_flags & IPN_TCP)
37015b6dcef9Sdr fi.fin_p = IPPROTO_TCP;
37025b6dcef9Sdr else if (np->nl_flags & IPN_UDP)
37035b6dcef9Sdr fi.fin_p = IPPROTO_UDP;
37045b6dcef9Sdr else if (np->nl_flags & (IPN_ICMPERR|IPN_ICMPQUERY))
37055b6dcef9Sdr fi.fin_p = IPPROTO_ICMP;
37067c478bd9Sstevel@tonic-gate
3707f4b3ec61Sdh fi.fin_ifs = ifs;
37087c478bd9Sstevel@tonic-gate /*
3709ab25eeb5Syz * We can do two sorts of lookups:
3710ab25eeb5Syz * - IPN_IN: we have the `real' and `out' address, look for `in'.
3711ab25eeb5Syz * - default: we have the `in' and `out' address, look for `real'.
37127c478bd9Sstevel@tonic-gate */
3713ab25eeb5Syz if (np->nl_flags & IPN_IN) {
3714ab25eeb5Syz if ((nat = nat_inlookup(&fi, np->nl_flags, fi.fin_p,
3715ab25eeb5Syz np->nl_realip, np->nl_outip))) {
3716ab25eeb5Syz np->nl_inip = nat->nat_inip;
3717ab25eeb5Syz np->nl_inport = nat->nat_inport;
37185b6dcef9Sdr }
3719ab25eeb5Syz } else {
3720ab25eeb5Syz /*
3721ab25eeb5Syz * If nl_inip is non null, this is a lookup based on the real
3722ab25eeb5Syz * ip address. Else, we use the fake.
3723ab25eeb5Syz */
3724ab25eeb5Syz if ((nat = nat_outlookup(&fi, np->nl_flags, fi.fin_p,
3725ab25eeb5Syz np->nl_inip, np->nl_outip))) {
3726ab25eeb5Syz
3727ab25eeb5Syz if ((np->nl_flags & IPN_FINDFORWARD) != 0) {
3728ab25eeb5Syz fr_info_t fin;
3729ab25eeb5Syz bzero((char *)&fin, sizeof(fin));
3730ab25eeb5Syz fin.fin_p = nat->nat_p;
3731ab25eeb5Syz fin.fin_data[0] = ntohs(nat->nat_outport);
3732ab25eeb5Syz fin.fin_data[1] = ntohs(nat->nat_oport);
3733f4b3ec61Sdh fin.fin_ifs = ifs;
3734ab25eeb5Syz if (nat_inlookup(&fin, np->nl_flags, fin.fin_p,
3735ab25eeb5Syz nat->nat_outip,
3736ab25eeb5Syz nat->nat_oip) != NULL) {
3737ab25eeb5Syz np->nl_flags &= ~IPN_FINDFORWARD;
3738ab25eeb5Syz }
3739ab25eeb5Syz }
37405b6dcef9Sdr
3741ab25eeb5Syz np->nl_realip = nat->nat_outip;
3742ab25eeb5Syz np->nl_realport = nat->nat_outport;
3743ab25eeb5Syz }
3744ab25eeb5Syz }
37455b6dcef9Sdr
37467c478bd9Sstevel@tonic-gate return nat;
37477c478bd9Sstevel@tonic-gate }
37487c478bd9Sstevel@tonic-gate
37497c478bd9Sstevel@tonic-gate
37507c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
37517c478bd9Sstevel@tonic-gate /* Function: nat_match */
37527c478bd9Sstevel@tonic-gate /* Returns: int - 0 == no match, 1 == match */
37537c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */
37547c478bd9Sstevel@tonic-gate /* np(I) - pointer to NAT rule */
37557c478bd9Sstevel@tonic-gate /* */
37567c478bd9Sstevel@tonic-gate /* Pull the matching of a packet against a NAT rule out of that complex */
37577c478bd9Sstevel@tonic-gate /* loop inside fr_checknatin() and lay it out properly in its own function. */
37587c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_match(fin,np)37597c478bd9Sstevel@tonic-gate static int nat_match(fin, np)
37607c478bd9Sstevel@tonic-gate fr_info_t *fin;
37617c478bd9Sstevel@tonic-gate ipnat_t *np;
37627c478bd9Sstevel@tonic-gate {
37637c478bd9Sstevel@tonic-gate frtuc_t *ft;
37647c478bd9Sstevel@tonic-gate
37657c478bd9Sstevel@tonic-gate if (fin->fin_v != 4)
37667c478bd9Sstevel@tonic-gate return 0;
37677c478bd9Sstevel@tonic-gate
37687c478bd9Sstevel@tonic-gate if (np->in_p && fin->fin_p != np->in_p)
37697c478bd9Sstevel@tonic-gate return 0;
37707c478bd9Sstevel@tonic-gate
37717c478bd9Sstevel@tonic-gate if (fin->fin_out) {
37727c478bd9Sstevel@tonic-gate if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK)))
37737c478bd9Sstevel@tonic-gate return 0;
37747c478bd9Sstevel@tonic-gate if (((fin->fin_fi.fi_saddr & np->in_inmsk) != np->in_inip)
37757c478bd9Sstevel@tonic-gate ^ ((np->in_flags & IPN_NOTSRC) != 0))
37767c478bd9Sstevel@tonic-gate return 0;
37777c478bd9Sstevel@tonic-gate if (((fin->fin_fi.fi_daddr & np->in_srcmsk) != np->in_srcip)
37787c478bd9Sstevel@tonic-gate ^ ((np->in_flags & IPN_NOTDST) != 0))
37797c478bd9Sstevel@tonic-gate return 0;
37807c478bd9Sstevel@tonic-gate } else {
37817c478bd9Sstevel@tonic-gate if (!(np->in_redir & NAT_REDIRECT))
37827c478bd9Sstevel@tonic-gate return 0;
37837c478bd9Sstevel@tonic-gate if (((fin->fin_fi.fi_saddr & np->in_srcmsk) != np->in_srcip)
37847c478bd9Sstevel@tonic-gate ^ ((np->in_flags & IPN_NOTSRC) != 0))
37857c478bd9Sstevel@tonic-gate return 0;
37867c478bd9Sstevel@tonic-gate if (((fin->fin_fi.fi_daddr & np->in_outmsk) != np->in_outip)
37877c478bd9Sstevel@tonic-gate ^ ((np->in_flags & IPN_NOTDST) != 0))
37887c478bd9Sstevel@tonic-gate return 0;
37897c478bd9Sstevel@tonic-gate }
37907c478bd9Sstevel@tonic-gate
37917c478bd9Sstevel@tonic-gate ft = &np->in_tuc;
37927c478bd9Sstevel@tonic-gate if (!(fin->fin_flx & FI_TCPUDP) ||
3793ab25eeb5Syz (fin->fin_flx & (FI_SHORT|FI_FRAGBODY))) {
37947c478bd9Sstevel@tonic-gate if (ft->ftu_scmp || ft->ftu_dcmp)
37957c478bd9Sstevel@tonic-gate return 0;
37967c478bd9Sstevel@tonic-gate return 1;
37977c478bd9Sstevel@tonic-gate }
37987c478bd9Sstevel@tonic-gate
37997c478bd9Sstevel@tonic-gate return fr_tcpudpchk(fin, ft);
38007c478bd9Sstevel@tonic-gate }
38017c478bd9Sstevel@tonic-gate
38027c478bd9Sstevel@tonic-gate
38037c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
38047c478bd9Sstevel@tonic-gate /* Function: nat_update */
38057c478bd9Sstevel@tonic-gate /* Returns: Nil */
380690907f62SJohn Ojemann /* Parameters: fin(I) - pointer to packet information */
380790907f62SJohn Ojemann /* nat(I) - pointer to NAT structure */
38087c478bd9Sstevel@tonic-gate /* np(I) - pointer to NAT rule */
380990907f62SJohn Ojemann /* Locks: nat_lock */
38107c478bd9Sstevel@tonic-gate /* */
38117c478bd9Sstevel@tonic-gate /* Updates the lifetime of a NAT table entry for non-TCP packets. Must be */
38127c478bd9Sstevel@tonic-gate /* called with fin_rev updated - i.e. after calling nat_proto(). */
38137c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_update(fin,nat,np)38147c478bd9Sstevel@tonic-gate void nat_update(fin, nat, np)
38157c478bd9Sstevel@tonic-gate fr_info_t *fin;
38167c478bd9Sstevel@tonic-gate nat_t *nat;
38177c478bd9Sstevel@tonic-gate ipnat_t *np;
38187c478bd9Sstevel@tonic-gate {
38197c478bd9Sstevel@tonic-gate ipftq_t *ifq, *ifq2;
38207c478bd9Sstevel@tonic-gate ipftqent_t *tqe;
3821f4b3ec61Sdh ipf_stack_t *ifs = fin->fin_ifs;
38227c478bd9Sstevel@tonic-gate
38237c478bd9Sstevel@tonic-gate tqe = &nat->nat_tqe;
38247c478bd9Sstevel@tonic-gate ifq = tqe->tqe_ifq;
38257c478bd9Sstevel@tonic-gate
38267c478bd9Sstevel@tonic-gate /*
38277c478bd9Sstevel@tonic-gate * We allow over-riding of NAT timeouts from NAT rules, even for
38287c478bd9Sstevel@tonic-gate * TCP, however, if it is TCP and there is no rule timeout set,
38297c478bd9Sstevel@tonic-gate * then do not update the timeout here.
38307c478bd9Sstevel@tonic-gate */
38317c478bd9Sstevel@tonic-gate if (np != NULL)
38327c478bd9Sstevel@tonic-gate ifq2 = np->in_tqehead[fin->fin_rev];
38337c478bd9Sstevel@tonic-gate else
38347c478bd9Sstevel@tonic-gate ifq2 = NULL;
38357c478bd9Sstevel@tonic-gate
38367c478bd9Sstevel@tonic-gate if (nat->nat_p == IPPROTO_TCP && ifq2 == NULL) {
3837f4b3ec61Sdh (void) fr_tcp_age(&nat->nat_tqe, fin, ifs->ifs_nat_tqb, 0);
38387c478bd9Sstevel@tonic-gate } else {
38397c478bd9Sstevel@tonic-gate if (ifq2 == NULL) {
38407c478bd9Sstevel@tonic-gate if (nat->nat_p == IPPROTO_UDP)
3841f4b3ec61Sdh ifq2 = &ifs->ifs_nat_udptq;
38427c478bd9Sstevel@tonic-gate else if (nat->nat_p == IPPROTO_ICMP)
3843f4b3ec61Sdh ifq2 = &ifs->ifs_nat_icmptq;
38447c478bd9Sstevel@tonic-gate else
3845f4b3ec61Sdh ifq2 = &ifs->ifs_nat_iptq;
38467c478bd9Sstevel@tonic-gate }
38477c478bd9Sstevel@tonic-gate
3848f4b3ec61Sdh fr_movequeue(tqe, ifq, ifq2, ifs);
38497c478bd9Sstevel@tonic-gate }
38507c478bd9Sstevel@tonic-gate }
38517c478bd9Sstevel@tonic-gate
38527c478bd9Sstevel@tonic-gate
38537c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
38547c478bd9Sstevel@tonic-gate /* Function: fr_checknatout */
38557c478bd9Sstevel@tonic-gate /* Returns: int - -1 == packet failed NAT checks so block it, */
38567c478bd9Sstevel@tonic-gate /* 0 == no packet translation occurred, */
38577c478bd9Sstevel@tonic-gate /* 1 == packet was successfully translated. */
38587c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */
38597c478bd9Sstevel@tonic-gate /* passp(I) - pointer to filtering result flags */
38607c478bd9Sstevel@tonic-gate /* */
38617c478bd9Sstevel@tonic-gate /* Check to see if an outcoming packet should be changed. ICMP packets are */
38627c478bd9Sstevel@tonic-gate /* first checked to see if they match an existing entry (if an error), */
38637c478bd9Sstevel@tonic-gate /* otherwise a search of the current NAT table is made. If neither results */
38647c478bd9Sstevel@tonic-gate /* in a match then a search for a matching NAT rule is made. Create a new */
38657c478bd9Sstevel@tonic-gate /* NAT entry if a we matched a NAT rule. Lastly, actually change the */
38667c478bd9Sstevel@tonic-gate /* packet header(s) as required. */
38677c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_checknatout(fin,passp)38687c478bd9Sstevel@tonic-gate int fr_checknatout(fin, passp)
38697c478bd9Sstevel@tonic-gate fr_info_t *fin;
38707c478bd9Sstevel@tonic-gate u_32_t *passp;
38717c478bd9Sstevel@tonic-gate {
3872cbded9aeSdr ipnat_t *np = NULL, *npnext;
3873ab25eeb5Syz struct ifnet *ifp, *sifp;
38747c478bd9Sstevel@tonic-gate icmphdr_t *icmp = NULL;
38757c478bd9Sstevel@tonic-gate tcphdr_t *tcp = NULL;
3876ab25eeb5Syz int rval, natfailed;
38777c478bd9Sstevel@tonic-gate u_int nflags = 0;
38787c478bd9Sstevel@tonic-gate u_32_t ipa, iph;
38797c478bd9Sstevel@tonic-gate int natadd = 1;
38807c478bd9Sstevel@tonic-gate frentry_t *fr;
38817c478bd9Sstevel@tonic-gate nat_t *nat;
3882f4b3ec61Sdh ipf_stack_t *ifs = fin->fin_ifs;
38837c478bd9Sstevel@tonic-gate
38845b48165cSJohn Ojemann if (ifs->ifs_fr_nat_lock != 0)
38855b48165cSJohn Ojemann return 0;
38865b48165cSJohn Ojemann if (ifs->ifs_nat_stats.ns_rules == 0 && ifs->ifs_nat_instances == NULL)
38877c478bd9Sstevel@tonic-gate return 0;
38887c478bd9Sstevel@tonic-gate
3889ab25eeb5Syz natfailed = 0;
38907c478bd9Sstevel@tonic-gate fr = fin->fin_fr;
389134b11c4dSjojemann sifp = fin->fin_ifp;
38927c478bd9Sstevel@tonic-gate if ((fr != NULL) && !(fr->fr_flags & FR_DUP) &&
3893d3675867Sjojemann fr->fr_tifs[fin->fin_rev].fd_ifp &&
3894d3675867Sjojemann fr->fr_tifs[fin->fin_rev].fd_ifp != (void *)-1)
3895d3675867Sjojemann fin->fin_ifp = fr->fr_tifs[fin->fin_rev].fd_ifp;
389634b11c4dSjojemann ifp = fin->fin_ifp;
38977c478bd9Sstevel@tonic-gate
38987c478bd9Sstevel@tonic-gate if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
38997c478bd9Sstevel@tonic-gate switch (fin->fin_p)
39007c478bd9Sstevel@tonic-gate {
39017c478bd9Sstevel@tonic-gate case IPPROTO_TCP :
39027c478bd9Sstevel@tonic-gate nflags = IPN_TCP;
39037c478bd9Sstevel@tonic-gate break;
39047c478bd9Sstevel@tonic-gate case IPPROTO_UDP :
39057c478bd9Sstevel@tonic-gate nflags = IPN_UDP;
39067c478bd9Sstevel@tonic-gate break;
39077c478bd9Sstevel@tonic-gate case IPPROTO_ICMP :
39087c478bd9Sstevel@tonic-gate icmp = fin->fin_dp;
39097c478bd9Sstevel@tonic-gate
39107c478bd9Sstevel@tonic-gate /*
39117c478bd9Sstevel@tonic-gate * This is an incoming packet, so the destination is
39127c478bd9Sstevel@tonic-gate * the icmp_id and the source port equals 0
39137c478bd9Sstevel@tonic-gate */
39147c478bd9Sstevel@tonic-gate if (nat_icmpquerytype4(icmp->icmp_type))
39157c478bd9Sstevel@tonic-gate nflags = IPN_ICMPQUERY;
39167c478bd9Sstevel@tonic-gate break;
39177c478bd9Sstevel@tonic-gate default :
39187c478bd9Sstevel@tonic-gate break;
39197c478bd9Sstevel@tonic-gate }
3920*55fea89dSDan Cross
39217c478bd9Sstevel@tonic-gate if ((nflags & IPN_TCPUDP))
39227c478bd9Sstevel@tonic-gate tcp = fin->fin_dp;
39237c478bd9Sstevel@tonic-gate }
39247c478bd9Sstevel@tonic-gate
39257c478bd9Sstevel@tonic-gate ipa = fin->fin_saddr;
39267c478bd9Sstevel@tonic-gate
3927f4b3ec61Sdh READ_ENTER(&ifs->ifs_ipf_nat);
39287c478bd9Sstevel@tonic-gate
39297c478bd9Sstevel@tonic-gate if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
39307c478bd9Sstevel@tonic-gate (nat = nat_icmperror(fin, &nflags, NAT_OUTBOUND)))
39317c478bd9Sstevel@tonic-gate /*EMPTY*/;
39327c478bd9Sstevel@tonic-gate else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin)))
39337c478bd9Sstevel@tonic-gate natadd = 0;
39347c478bd9Sstevel@tonic-gate else if ((nat = nat_outlookup(fin, nflags|NAT_SEARCH, (u_int)fin->fin_p,
39357c478bd9Sstevel@tonic-gate fin->fin_src, fin->fin_dst))) {
39367c478bd9Sstevel@tonic-gate nflags = nat->nat_flags;
39377c478bd9Sstevel@tonic-gate } else {
39387c478bd9Sstevel@tonic-gate u_32_t hv, msk, nmsk;
39397c478bd9Sstevel@tonic-gate
39407c478bd9Sstevel@tonic-gate /*
3941bb1d9de5SJohn Ojemann * There is no current entry in the nat table for this packet.
3942bb1d9de5SJohn Ojemann *
3943bb1d9de5SJohn Ojemann * If the packet is a fragment, but not the first fragment,
3944bb1d9de5SJohn Ojemann * then don't do anything. Otherwise, if there is a matching
3945bb1d9de5SJohn Ojemann * nat rule, try to create a new nat entry.
39467c478bd9Sstevel@tonic-gate */
3947bb1d9de5SJohn Ojemann if ((fin->fin_off != 0) && (fin->fin_flx & FI_TCPUDP))
3948bb1d9de5SJohn Ojemann goto nonatfrag;
3949bb1d9de5SJohn Ojemann
39507c478bd9Sstevel@tonic-gate msk = 0xffffffff;
3951f4b3ec61Sdh nmsk = ifs->ifs_nat_masks;
39527c478bd9Sstevel@tonic-gate maskloop:
39537c478bd9Sstevel@tonic-gate iph = ipa & htonl(msk);
3954f4b3ec61Sdh hv = NAT_HASH_FN(iph, 0, ifs->ifs_ipf_natrules_sz);
3955cbded9aeSdr for (np = ifs->ifs_nat_rules[hv]; np; np = npnext) {
3956cbded9aeSdr npnext = np->in_mnext;
3957e6c6c1faSyz if ((np->in_ifps[1] && (np->in_ifps[1] != ifp)))
3958ab25eeb5Syz continue;
3959ab25eeb5Syz if (np->in_v != fin->fin_v)
3960ab25eeb5Syz continue;
3961ab25eeb5Syz if (np->in_p && (np->in_p != fin->fin_p))
39627c478bd9Sstevel@tonic-gate continue;
39637c478bd9Sstevel@tonic-gate if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags))
39647c478bd9Sstevel@tonic-gate continue;
39657c478bd9Sstevel@tonic-gate if (np->in_flags & IPN_FILTER) {
39667c478bd9Sstevel@tonic-gate if (!nat_match(fin, np))
39677c478bd9Sstevel@tonic-gate continue;
39687c478bd9Sstevel@tonic-gate } else if ((ipa & np->in_inmsk) != np->in_inip)
39697c478bd9Sstevel@tonic-gate continue;
39707c478bd9Sstevel@tonic-gate
39717c478bd9Sstevel@tonic-gate if ((fr != NULL) &&
39727c478bd9Sstevel@tonic-gate !fr_matchtag(&np->in_tag, &fr->fr_nattag))
39737c478bd9Sstevel@tonic-gate continue;
39747c478bd9Sstevel@tonic-gate
39757c478bd9Sstevel@tonic-gate if (*np->in_plabel != '\0') {
39767c478bd9Sstevel@tonic-gate if (((np->in_flags & IPN_FILTER) == 0) &&
39777c478bd9Sstevel@tonic-gate (np->in_dport != tcp->th_dport))
39787c478bd9Sstevel@tonic-gate continue;
39797c478bd9Sstevel@tonic-gate if (appr_ok(fin, tcp, np) == 0)
39807c478bd9Sstevel@tonic-gate continue;
39817c478bd9Sstevel@tonic-gate }
39827c478bd9Sstevel@tonic-gate
3983cbded9aeSdr ATOMIC_INC32(np->in_use);
3984cbded9aeSdr RWLOCK_EXIT(&ifs->ifs_ipf_nat);
3985cbded9aeSdr WRITE_ENTER(&ifs->ifs_ipf_nat);
3986cbded9aeSdr nat = nat_new(fin, np, NULL, nflags, NAT_OUTBOUND);
3987cbded9aeSdr if (nat != NULL) {
3988cbded9aeSdr np->in_use--;
39897c478bd9Sstevel@tonic-gate np->in_hits++;
3990cbded9aeSdr MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat);
39917c478bd9Sstevel@tonic-gate break;
3992cbded9aeSdr }
3993cbded9aeSdr natfailed = -1;
3994cbded9aeSdr npnext = np->in_mnext;
3995cbded9aeSdr fr_ipnatderef(&np, ifs);
3996cbded9aeSdr MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat);
39977c478bd9Sstevel@tonic-gate }
39987c478bd9Sstevel@tonic-gate if ((np == NULL) && (nmsk != 0)) {
39997c478bd9Sstevel@tonic-gate while (nmsk) {
40007c478bd9Sstevel@tonic-gate msk <<= 1;
40017c478bd9Sstevel@tonic-gate if (nmsk & 0x80000000)
40027c478bd9Sstevel@tonic-gate break;
40037c478bd9Sstevel@tonic-gate nmsk <<= 1;
40047c478bd9Sstevel@tonic-gate }
40057c478bd9Sstevel@tonic-gate if (nmsk != 0) {
40067c478bd9Sstevel@tonic-gate nmsk <<= 1;
40077c478bd9Sstevel@tonic-gate goto maskloop;
40087c478bd9Sstevel@tonic-gate }
40097c478bd9Sstevel@tonic-gate }
40107c478bd9Sstevel@tonic-gate }
40117c478bd9Sstevel@tonic-gate
4012bb1d9de5SJohn Ojemann nonatfrag:
40137c478bd9Sstevel@tonic-gate if (nat != NULL) {
40147c478bd9Sstevel@tonic-gate rval = fr_natout(fin, nat, natadd, nflags);
40157c478bd9Sstevel@tonic-gate if (rval == 1) {
40167c478bd9Sstevel@tonic-gate MUTEX_ENTER(&nat->nat_lock);
401790907f62SJohn Ojemann nat_update(fin, nat, nat->nat_ptr);
401890907f62SJohn Ojemann nat->nat_bytes[1] += fin->fin_plen;
401990907f62SJohn Ojemann nat->nat_pkts[1]++;
402033f2fefdSDarren Reed fin->fin_pktnum = nat->nat_pkts[1];
40217c478bd9Sstevel@tonic-gate MUTEX_EXIT(&nat->nat_lock);
40227c478bd9Sstevel@tonic-gate }
40237c478bd9Sstevel@tonic-gate } else
4024ab25eeb5Syz rval = natfailed;
4025f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
40267c478bd9Sstevel@tonic-gate
40277c478bd9Sstevel@tonic-gate if (rval == -1) {
40287c478bd9Sstevel@tonic-gate if (passp != NULL)
40297c478bd9Sstevel@tonic-gate *passp = FR_BLOCK;
40307c478bd9Sstevel@tonic-gate fin->fin_flx |= FI_BADNAT;
40317c478bd9Sstevel@tonic-gate }
403234b11c4dSjojemann fin->fin_ifp = sifp;
40337c478bd9Sstevel@tonic-gate return rval;
40347c478bd9Sstevel@tonic-gate }
40357c478bd9Sstevel@tonic-gate
40367c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
40377c478bd9Sstevel@tonic-gate /* Function: fr_natout */
40387c478bd9Sstevel@tonic-gate /* Returns: int - -1 == packet failed NAT checks so block it, */
40397c478bd9Sstevel@tonic-gate /* 1 == packet was successfully translated. */
40407c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */
40417c478bd9Sstevel@tonic-gate /* nat(I) - pointer to NAT structure */
40427c478bd9Sstevel@tonic-gate /* natadd(I) - flag indicating if it is safe to add frag cache */
40437c478bd9Sstevel@tonic-gate /* nflags(I) - NAT flags set for this packet */
40447c478bd9Sstevel@tonic-gate /* */
40457c478bd9Sstevel@tonic-gate /* Translate a packet coming "out" on an interface. */
40467c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_natout(fin,nat,natadd,nflags)40477c478bd9Sstevel@tonic-gate int fr_natout(fin, nat, natadd, nflags)
40487c478bd9Sstevel@tonic-gate fr_info_t *fin;
40497c478bd9Sstevel@tonic-gate nat_t *nat;
40507c478bd9Sstevel@tonic-gate int natadd;
40517c478bd9Sstevel@tonic-gate u_32_t nflags;
40527c478bd9Sstevel@tonic-gate {
40537c478bd9Sstevel@tonic-gate icmphdr_t *icmp;
40547c478bd9Sstevel@tonic-gate u_short *csump;
4055381a2a9aSdr u_32_t sumd;
40567c478bd9Sstevel@tonic-gate tcphdr_t *tcp;
40577c478bd9Sstevel@tonic-gate ipnat_t *np;
40587c478bd9Sstevel@tonic-gate int i;
4059f4b3ec61Sdh ipf_stack_t *ifs = fin->fin_ifs;
40607c478bd9Sstevel@tonic-gate
4061d6c23f6fSyx if (fin->fin_v == 6) {
4062d6c23f6fSyx #ifdef USE_INET6
4063d6c23f6fSyx return fr_nat6out(fin, nat, natadd, nflags);
4064d6c23f6fSyx #else
4065d6c23f6fSyx return NULL;
4066d6c23f6fSyx #endif
4067d6c23f6fSyx }
4068d6c23f6fSyx
4069af5f29ddSToomas Soome #if defined(SOLARIS) && defined(_KERNEL)
40707ddc9b1aSDarren Reed net_handle_t net_data_p = ifs->ifs_ipf_ipv4;
4071381a2a9aSdr #endif
4072381a2a9aSdr
40737c478bd9Sstevel@tonic-gate tcp = NULL;
40747c478bd9Sstevel@tonic-gate icmp = NULL;
40757c478bd9Sstevel@tonic-gate csump = NULL;
40767c478bd9Sstevel@tonic-gate np = nat->nat_ptr;
40777c478bd9Sstevel@tonic-gate
407815013d88Szf if ((natadd != 0) && (fin->fin_flx & FI_FRAG))
40797c478bd9Sstevel@tonic-gate (void) fr_nat_newfrag(fin, 0, nat);
4080*55fea89dSDan Cross
40817c478bd9Sstevel@tonic-gate /*
40827c478bd9Sstevel@tonic-gate * Fix up checksums, not by recalculating them, but
40837c478bd9Sstevel@tonic-gate * simply computing adjustments.
4084ab25eeb5Syz * This is only done for STREAMS based IP implementations where the
4085ab25eeb5Syz * checksum has already been calculated by IP. In all other cases,
4086ab25eeb5Syz * IPFilter is called before the checksum needs calculating so there
4087ab25eeb5Syz * is no call to modify whatever is in the header now.
40887c478bd9Sstevel@tonic-gate */
4089381a2a9aSdr ASSERT(fin->fin_m != NULL);
4090381a2a9aSdr if (fin->fin_v == 4 && !NET_IS_HCK_L3_FULL(net_data_p, fin->fin_m)) {
4091ab25eeb5Syz if (nflags == IPN_ICMPERR) {
4092381a2a9aSdr u_32_t s1, s2;
4093ab25eeb5Syz
4094ab25eeb5Syz s1 = LONG_SUM(ntohl(fin->fin_saddr));
4095ab25eeb5Syz s2 = LONG_SUM(ntohl(nat->nat_outip.s_addr));
4096ab25eeb5Syz CALC_SUMD(s1, s2, sumd);
4097381a2a9aSdr
4098381a2a9aSdr fix_outcksum(&fin->fin_ip->ip_sum, sumd);
4099ab25eeb5Syz }
4100ab25eeb5Syz #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
4101ab25eeb5Syz defined(linux) || defined(BRIDGE_IPF)
4102ab25eeb5Syz else {
4103ab25eeb5Syz /*
4104ab25eeb5Syz * Strictly speaking, this isn't necessary on BSD
4105ab25eeb5Syz * kernels because they do checksum calculation after
4106ab25eeb5Syz * this code has run BUT if ipfilter is being used
4107ab25eeb5Syz * to do NAT as a bridge, that code doesn't exist.
4108ab25eeb5Syz */
41097c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_OUTBOUND)
4110381a2a9aSdr fix_outcksum(&fin->fin_ip->ip_sum,
4111ab25eeb5Syz nat->nat_ipsumd);
4112381a2a9aSdr else
4113381a2a9aSdr fix_incksum(&fin->fin_ip->ip_sum,
4114381a2a9aSdr nat->nat_ipsumd);
41157c478bd9Sstevel@tonic-gate }
41167c478bd9Sstevel@tonic-gate #endif
4117ab25eeb5Syz }
4118ab25eeb5Syz
41197c478bd9Sstevel@tonic-gate if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
41207c478bd9Sstevel@tonic-gate if ((nat->nat_outport != 0) && (nflags & IPN_TCPUDP)) {
41217c478bd9Sstevel@tonic-gate tcp = fin->fin_dp;
41227c478bd9Sstevel@tonic-gate
41237c478bd9Sstevel@tonic-gate tcp->th_sport = nat->nat_outport;
41247c478bd9Sstevel@tonic-gate fin->fin_data[0] = ntohs(nat->nat_outport);
41257c478bd9Sstevel@tonic-gate }
41267c478bd9Sstevel@tonic-gate
41277c478bd9Sstevel@tonic-gate if ((nat->nat_outport != 0) && (nflags & IPN_ICMPQUERY)) {
41287c478bd9Sstevel@tonic-gate icmp = fin->fin_dp;
41297c478bd9Sstevel@tonic-gate icmp->icmp_id = nat->nat_outport;
41307c478bd9Sstevel@tonic-gate }
41317c478bd9Sstevel@tonic-gate
41327c478bd9Sstevel@tonic-gate csump = nat_proto(fin, nat, nflags);
41337c478bd9Sstevel@tonic-gate }
41347c478bd9Sstevel@tonic-gate
4135ab25eeb5Syz fin->fin_ip->ip_src = nat->nat_outip;
4136ab25eeb5Syz
4137ab25eeb5Syz /*
4138ab25eeb5Syz * The above comments do not hold for layer 4 (or higher) checksums...
4139ab25eeb5Syz */
4140381a2a9aSdr if (csump != NULL && !NET_IS_HCK_L4_FULL(net_data_p, fin->fin_m)) {
4141381a2a9aSdr if (nflags & IPN_TCPUDP &&
4142381a2a9aSdr NET_IS_HCK_L4_PART(net_data_p, fin->fin_m))
4143381a2a9aSdr sumd = nat->nat_sumd[1];
4144381a2a9aSdr else
4145381a2a9aSdr sumd = nat->nat_sumd[0];
4146381a2a9aSdr
41477c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_OUTBOUND)
4148381a2a9aSdr fix_outcksum(csump, sumd);
41497c478bd9Sstevel@tonic-gate else
4150381a2a9aSdr fix_incksum(csump, sumd);
41517c478bd9Sstevel@tonic-gate }
41527c478bd9Sstevel@tonic-gate #ifdef IPFILTER_SYNC
41537c478bd9Sstevel@tonic-gate ipfsync_update(SMC_NAT, fin, nat->nat_sync);
41547c478bd9Sstevel@tonic-gate #endif
41557c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------- */
41567c478bd9Sstevel@tonic-gate /* A few quick notes: */
41577c478bd9Sstevel@tonic-gate /* Following are test conditions prior to calling the */
41587c478bd9Sstevel@tonic-gate /* appr_check routine. */
41597c478bd9Sstevel@tonic-gate /* */
41607c478bd9Sstevel@tonic-gate /* A NULL tcp indicates a non TCP/UDP packet. When dealing */
41617c478bd9Sstevel@tonic-gate /* with a redirect rule, we attempt to match the packet's */
41627c478bd9Sstevel@tonic-gate /* source port against in_dport, otherwise we'd compare the */
41637c478bd9Sstevel@tonic-gate /* packet's destination. */
41647c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------- */
41657c478bd9Sstevel@tonic-gate if ((np != NULL) && (np->in_apr != NULL)) {
41667c478bd9Sstevel@tonic-gate i = appr_check(fin, nat);
41677c478bd9Sstevel@tonic-gate if (i == 0)
41687c478bd9Sstevel@tonic-gate i = 1;
4169ab25eeb5Syz } else
41707c478bd9Sstevel@tonic-gate i = 1;
4171cbded9aeSdr ifs->ifs_nat_stats.ns_mapped[1]++;
41727c478bd9Sstevel@tonic-gate fin->fin_flx |= FI_NATED;
41737c478bd9Sstevel@tonic-gate return i;
41747c478bd9Sstevel@tonic-gate }
41757c478bd9Sstevel@tonic-gate
41767c478bd9Sstevel@tonic-gate
41777c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
41787c478bd9Sstevel@tonic-gate /* Function: fr_checknatin */
41797c478bd9Sstevel@tonic-gate /* Returns: int - -1 == packet failed NAT checks so block it, */
41807c478bd9Sstevel@tonic-gate /* 0 == no packet translation occurred, */
41817c478bd9Sstevel@tonic-gate /* 1 == packet was successfully translated. */
41827c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */
41837c478bd9Sstevel@tonic-gate /* passp(I) - pointer to filtering result flags */
41847c478bd9Sstevel@tonic-gate /* */
41857c478bd9Sstevel@tonic-gate /* Check to see if an incoming packet should be changed. ICMP packets are */
41867c478bd9Sstevel@tonic-gate /* first checked to see if they match an existing entry (if an error), */
41877c478bd9Sstevel@tonic-gate /* otherwise a search of the current NAT table is made. If neither results */
41887c478bd9Sstevel@tonic-gate /* in a match then a search for a matching NAT rule is made. Create a new */
41897c478bd9Sstevel@tonic-gate /* NAT entry if a we matched a NAT rule. Lastly, actually change the */
41907c478bd9Sstevel@tonic-gate /* packet header(s) as required. */
41917c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_checknatin(fin,passp)41927c478bd9Sstevel@tonic-gate int fr_checknatin(fin, passp)
41937c478bd9Sstevel@tonic-gate fr_info_t *fin;
41947c478bd9Sstevel@tonic-gate u_32_t *passp;
41957c478bd9Sstevel@tonic-gate {
41967c478bd9Sstevel@tonic-gate u_int nflags, natadd;
4197cbded9aeSdr ipnat_t *np, *npnext;
4198ab25eeb5Syz int rval, natfailed;
41997c478bd9Sstevel@tonic-gate struct ifnet *ifp;
42007c478bd9Sstevel@tonic-gate struct in_addr in;
42017c478bd9Sstevel@tonic-gate icmphdr_t *icmp;
42027c478bd9Sstevel@tonic-gate tcphdr_t *tcp;
42037c478bd9Sstevel@tonic-gate u_short dport;
42047c478bd9Sstevel@tonic-gate nat_t *nat;
42057c478bd9Sstevel@tonic-gate u_32_t iph;
4206f4b3ec61Sdh ipf_stack_t *ifs = fin->fin_ifs;
42077c478bd9Sstevel@tonic-gate
42085b48165cSJohn Ojemann if (ifs->ifs_fr_nat_lock != 0)
42095b48165cSJohn Ojemann return 0;
42105b48165cSJohn Ojemann if (ifs->ifs_nat_stats.ns_rules == 0 && ifs->ifs_nat_instances == NULL)
42117c478bd9Sstevel@tonic-gate return 0;
42127c478bd9Sstevel@tonic-gate
42137c478bd9Sstevel@tonic-gate tcp = NULL;
42147c478bd9Sstevel@tonic-gate icmp = NULL;
42157c478bd9Sstevel@tonic-gate dport = 0;
42167c478bd9Sstevel@tonic-gate natadd = 1;
42177c478bd9Sstevel@tonic-gate nflags = 0;
4218ab25eeb5Syz natfailed = 0;
42197c478bd9Sstevel@tonic-gate ifp = fin->fin_ifp;
42207c478bd9Sstevel@tonic-gate
42217c478bd9Sstevel@tonic-gate if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
42227c478bd9Sstevel@tonic-gate switch (fin->fin_p)
42237c478bd9Sstevel@tonic-gate {
42247c478bd9Sstevel@tonic-gate case IPPROTO_TCP :
42257c478bd9Sstevel@tonic-gate nflags = IPN_TCP;
42267c478bd9Sstevel@tonic-gate break;
42277c478bd9Sstevel@tonic-gate case IPPROTO_UDP :
42287c478bd9Sstevel@tonic-gate nflags = IPN_UDP;
42297c478bd9Sstevel@tonic-gate break;
42307c478bd9Sstevel@tonic-gate case IPPROTO_ICMP :
42317c478bd9Sstevel@tonic-gate icmp = fin->fin_dp;
42327c478bd9Sstevel@tonic-gate
42337c478bd9Sstevel@tonic-gate /*
42347c478bd9Sstevel@tonic-gate * This is an incoming packet, so the destination is
42357c478bd9Sstevel@tonic-gate * the icmp_id and the source port equals 0
42367c478bd9Sstevel@tonic-gate */
42377c478bd9Sstevel@tonic-gate if (nat_icmpquerytype4(icmp->icmp_type)) {
42387c478bd9Sstevel@tonic-gate nflags = IPN_ICMPQUERY;
4239*55fea89dSDan Cross dport = icmp->icmp_id;
42407c478bd9Sstevel@tonic-gate } break;
42417c478bd9Sstevel@tonic-gate default :
42427c478bd9Sstevel@tonic-gate break;
42437c478bd9Sstevel@tonic-gate }
4244*55fea89dSDan Cross
42457c478bd9Sstevel@tonic-gate if ((nflags & IPN_TCPUDP)) {
42467c478bd9Sstevel@tonic-gate tcp = fin->fin_dp;
42477c478bd9Sstevel@tonic-gate dport = tcp->th_dport;
42487c478bd9Sstevel@tonic-gate }
42497c478bd9Sstevel@tonic-gate }
42507c478bd9Sstevel@tonic-gate
42517c478bd9Sstevel@tonic-gate in = fin->fin_dst;
42527c478bd9Sstevel@tonic-gate
4253f4b3ec61Sdh READ_ENTER(&ifs->ifs_ipf_nat);
42547c478bd9Sstevel@tonic-gate
42557c478bd9Sstevel@tonic-gate if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
42567c478bd9Sstevel@tonic-gate (nat = nat_icmperror(fin, &nflags, NAT_INBOUND)))
42577c478bd9Sstevel@tonic-gate /*EMPTY*/;
42587c478bd9Sstevel@tonic-gate else if ((fin->fin_flx & FI_FRAG) && (nat = fr_nat_knownfrag(fin)))
42597c478bd9Sstevel@tonic-gate natadd = 0;
42607c478bd9Sstevel@tonic-gate else if ((nat = nat_inlookup(fin, nflags|NAT_SEARCH, (u_int)fin->fin_p,
42617c478bd9Sstevel@tonic-gate fin->fin_src, in))) {
42627c478bd9Sstevel@tonic-gate nflags = nat->nat_flags;
42637c478bd9Sstevel@tonic-gate } else {
42647c478bd9Sstevel@tonic-gate u_32_t hv, msk, rmsk;
42657c478bd9Sstevel@tonic-gate
42667c478bd9Sstevel@tonic-gate /*
4267bb1d9de5SJohn Ojemann * There is no current entry in the nat table for this packet.
4268bb1d9de5SJohn Ojemann *
4269bb1d9de5SJohn Ojemann * If the packet is a fragment, but not the first fragment,
4270bb1d9de5SJohn Ojemann * then don't do anything. Otherwise, if there is a matching
4271bb1d9de5SJohn Ojemann * nat rule, try to create a new nat entry.
42727c478bd9Sstevel@tonic-gate */
4273bb1d9de5SJohn Ojemann if ((fin->fin_off != 0) && (fin->fin_flx & FI_TCPUDP))
4274bb1d9de5SJohn Ojemann goto nonatfrag;
4275bb1d9de5SJohn Ojemann
4276bb1d9de5SJohn Ojemann rmsk = ifs->ifs_rdr_masks;
4277bb1d9de5SJohn Ojemann msk = 0xffffffff;
42787c478bd9Sstevel@tonic-gate maskloop:
42797c478bd9Sstevel@tonic-gate iph = in.s_addr & htonl(msk);
4280f4b3ec61Sdh hv = NAT_HASH_FN(iph, 0, ifs->ifs_ipf_rdrrules_sz);
4281cbded9aeSdr for (np = ifs->ifs_rdr_rules[hv]; np; np = npnext) {
4282cbded9aeSdr npnext = np->in_rnext;
42837c478bd9Sstevel@tonic-gate if (np->in_ifps[0] && (np->in_ifps[0] != ifp))
42847c478bd9Sstevel@tonic-gate continue;
4285ab25eeb5Syz if (np->in_v != fin->fin_v)
4286ab25eeb5Syz continue;
42877c478bd9Sstevel@tonic-gate if (np->in_p && (np->in_p != fin->fin_p))
42887c478bd9Sstevel@tonic-gate continue;
42897c478bd9Sstevel@tonic-gate if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags))
42907c478bd9Sstevel@tonic-gate continue;
42917c478bd9Sstevel@tonic-gate if (np->in_flags & IPN_FILTER) {
42927c478bd9Sstevel@tonic-gate if (!nat_match(fin, np))
42937c478bd9Sstevel@tonic-gate continue;
42947c478bd9Sstevel@tonic-gate } else {
42957c478bd9Sstevel@tonic-gate if ((in.s_addr & np->in_outmsk) != np->in_outip)
42967c478bd9Sstevel@tonic-gate continue;
42977c478bd9Sstevel@tonic-gate if (np->in_pmin &&
42987c478bd9Sstevel@tonic-gate ((ntohs(np->in_pmax) < ntohs(dport)) ||
42997c478bd9Sstevel@tonic-gate (ntohs(dport) < ntohs(np->in_pmin))))
43007c478bd9Sstevel@tonic-gate continue;
43017c478bd9Sstevel@tonic-gate }
43027c478bd9Sstevel@tonic-gate
43037c478bd9Sstevel@tonic-gate if (*np->in_plabel != '\0') {
43047c478bd9Sstevel@tonic-gate if (!appr_ok(fin, tcp, np)) {
43057c478bd9Sstevel@tonic-gate continue;
43067c478bd9Sstevel@tonic-gate }
43077c478bd9Sstevel@tonic-gate }
43087c478bd9Sstevel@tonic-gate
4309cbded9aeSdr ATOMIC_INC32(np->in_use);
4310cbded9aeSdr RWLOCK_EXIT(&ifs->ifs_ipf_nat);
4311cbded9aeSdr WRITE_ENTER(&ifs->ifs_ipf_nat);
43127c478bd9Sstevel@tonic-gate nat = nat_new(fin, np, NULL, nflags, NAT_INBOUND);
43137c478bd9Sstevel@tonic-gate if (nat != NULL) {
4314cbded9aeSdr np->in_use--;
43157c478bd9Sstevel@tonic-gate np->in_hits++;
4316cbded9aeSdr MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat);
43177c478bd9Sstevel@tonic-gate break;
4318*55fea89dSDan Cross }
4319cbded9aeSdr natfailed = -1;
4320cbded9aeSdr npnext = np->in_rnext;
4321cbded9aeSdr fr_ipnatderef(&np, ifs);
4322cbded9aeSdr MUTEX_DOWNGRADE(&ifs->ifs_ipf_nat);
43237c478bd9Sstevel@tonic-gate }
43247c478bd9Sstevel@tonic-gate
43257c478bd9Sstevel@tonic-gate if ((np == NULL) && (rmsk != 0)) {
43267c478bd9Sstevel@tonic-gate while (rmsk) {
43277c478bd9Sstevel@tonic-gate msk <<= 1;
43287c478bd9Sstevel@tonic-gate if (rmsk & 0x80000000)
43297c478bd9Sstevel@tonic-gate break;
43307c478bd9Sstevel@tonic-gate rmsk <<= 1;
43317c478bd9Sstevel@tonic-gate }
43327c478bd9Sstevel@tonic-gate if (rmsk != 0) {
43337c478bd9Sstevel@tonic-gate rmsk <<= 1;
43347c478bd9Sstevel@tonic-gate goto maskloop;
43357c478bd9Sstevel@tonic-gate }
43367c478bd9Sstevel@tonic-gate }
43377c478bd9Sstevel@tonic-gate }
4338bb1d9de5SJohn Ojemann
4339bb1d9de5SJohn Ojemann nonatfrag:
43407c478bd9Sstevel@tonic-gate if (nat != NULL) {
43417c478bd9Sstevel@tonic-gate rval = fr_natin(fin, nat, natadd, nflags);
43427c478bd9Sstevel@tonic-gate if (rval == 1) {
43437c478bd9Sstevel@tonic-gate MUTEX_ENTER(&nat->nat_lock);
434490907f62SJohn Ojemann nat_update(fin, nat, nat->nat_ptr);
434590907f62SJohn Ojemann nat->nat_bytes[0] += fin->fin_plen;
434690907f62SJohn Ojemann nat->nat_pkts[0]++;
434733f2fefdSDarren Reed fin->fin_pktnum = nat->nat_pkts[0];
43487c478bd9Sstevel@tonic-gate MUTEX_EXIT(&nat->nat_lock);
43497c478bd9Sstevel@tonic-gate }
43507c478bd9Sstevel@tonic-gate } else
4351ab25eeb5Syz rval = natfailed;
4352f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
43537c478bd9Sstevel@tonic-gate
43547c478bd9Sstevel@tonic-gate if (rval == -1) {
43557c478bd9Sstevel@tonic-gate if (passp != NULL)
43567c478bd9Sstevel@tonic-gate *passp = FR_BLOCK;
43577c478bd9Sstevel@tonic-gate fin->fin_flx |= FI_BADNAT;
43587c478bd9Sstevel@tonic-gate }
43597c478bd9Sstevel@tonic-gate return rval;
43607c478bd9Sstevel@tonic-gate }
43617c478bd9Sstevel@tonic-gate
43627c478bd9Sstevel@tonic-gate
43637c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
43647c478bd9Sstevel@tonic-gate /* Function: fr_natin */
43657c478bd9Sstevel@tonic-gate /* Returns: int - -1 == packet failed NAT checks so block it, */
43667c478bd9Sstevel@tonic-gate /* 1 == packet was successfully translated. */
43677c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */
43687c478bd9Sstevel@tonic-gate /* nat(I) - pointer to NAT structure */
43697c478bd9Sstevel@tonic-gate /* natadd(I) - flag indicating if it is safe to add frag cache */
43707c478bd9Sstevel@tonic-gate /* nflags(I) - NAT flags set for this packet */
43717c478bd9Sstevel@tonic-gate /* Locks Held: ipf_nat (READ) */
43727c478bd9Sstevel@tonic-gate /* */
43737c478bd9Sstevel@tonic-gate /* Translate a packet coming "in" on an interface. */
43747c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_natin(fin,nat,natadd,nflags)43757c478bd9Sstevel@tonic-gate int fr_natin(fin, nat, natadd, nflags)
43767c478bd9Sstevel@tonic-gate fr_info_t *fin;
43777c478bd9Sstevel@tonic-gate nat_t *nat;
43787c478bd9Sstevel@tonic-gate int natadd;
43797c478bd9Sstevel@tonic-gate u_32_t nflags;
43807c478bd9Sstevel@tonic-gate {
43817c478bd9Sstevel@tonic-gate icmphdr_t *icmp;
438224109627Syx u_short *csump;
43837c478bd9Sstevel@tonic-gate tcphdr_t *tcp;
43847c478bd9Sstevel@tonic-gate ipnat_t *np;
43857c478bd9Sstevel@tonic-gate int i;
4386f4b3ec61Sdh ipf_stack_t *ifs = fin->fin_ifs;
43877c478bd9Sstevel@tonic-gate
4388d6c23f6fSyx if (fin->fin_v == 6) {
4389d6c23f6fSyx #ifdef USE_INET6
4390d6c23f6fSyx return fr_nat6in(fin, nat, natadd, nflags);
4391d6c23f6fSyx #else
4392d6c23f6fSyx return NULL;
4393d6c23f6fSyx #endif
4394d6c23f6fSyx }
4395d6c23f6fSyx
4396af5f29ddSToomas Soome #if defined(SOLARIS) && defined(_KERNEL)
43977ddc9b1aSDarren Reed net_handle_t net_data_p = ifs->ifs_ipf_ipv4;
4398381a2a9aSdr #endif
4399381a2a9aSdr
44007c478bd9Sstevel@tonic-gate tcp = NULL;
44017c478bd9Sstevel@tonic-gate csump = NULL;
44027c478bd9Sstevel@tonic-gate np = nat->nat_ptr;
44037c478bd9Sstevel@tonic-gate fin->fin_fr = nat->nat_fr;
44047c478bd9Sstevel@tonic-gate
440515013d88Szf if ((natadd != 0) && (fin->fin_flx & FI_FRAG))
440615013d88Szf (void) fr_nat_newfrag(fin, 0, nat);
440715013d88Szf
44087c478bd9Sstevel@tonic-gate if (np != NULL) {
44097c478bd9Sstevel@tonic-gate
44107c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------- */
44117c478bd9Sstevel@tonic-gate /* A few quick notes: */
44127c478bd9Sstevel@tonic-gate /* Following are test conditions prior to calling the */
44137c478bd9Sstevel@tonic-gate /* appr_check routine. */
44147c478bd9Sstevel@tonic-gate /* */
44157c478bd9Sstevel@tonic-gate /* A NULL tcp indicates a non TCP/UDP packet. When dealing */
44167c478bd9Sstevel@tonic-gate /* with a map rule, we attempt to match the packet's */
44177c478bd9Sstevel@tonic-gate /* source port against in_dport, otherwise we'd compare the */
44187c478bd9Sstevel@tonic-gate /* packet's destination. */
44197c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------- */
44207c478bd9Sstevel@tonic-gate if (np->in_apr != NULL) {
44217c478bd9Sstevel@tonic-gate i = appr_check(fin, nat);
44227c478bd9Sstevel@tonic-gate if (i == -1) {
44237c478bd9Sstevel@tonic-gate return -1;
44247c478bd9Sstevel@tonic-gate }
44257c478bd9Sstevel@tonic-gate }
44267c478bd9Sstevel@tonic-gate }
44277c478bd9Sstevel@tonic-gate
44287c478bd9Sstevel@tonic-gate #ifdef IPFILTER_SYNC
44297c478bd9Sstevel@tonic-gate ipfsync_update(SMC_NAT, fin, nat->nat_sync);
44307c478bd9Sstevel@tonic-gate #endif
44317c478bd9Sstevel@tonic-gate
44327c478bd9Sstevel@tonic-gate fin->fin_ip->ip_dst = nat->nat_inip;
44337c478bd9Sstevel@tonic-gate fin->fin_fi.fi_daddr = nat->nat_inip.s_addr;
44347c478bd9Sstevel@tonic-gate if (nflags & IPN_TCPUDP)
44357c478bd9Sstevel@tonic-gate tcp = fin->fin_dp;
44367c478bd9Sstevel@tonic-gate
44377c478bd9Sstevel@tonic-gate /*
44387c478bd9Sstevel@tonic-gate * Fix up checksums, not by recalculating them, but
44397c478bd9Sstevel@tonic-gate * simply computing adjustments.
4440ab25eeb5Syz * Why only do this for some platforms on inbound packets ?
4441ab25eeb5Syz * Because for those that it is done, IP processing is yet to happen
4442ab25eeb5Syz * and so the IPv4 header checksum has not yet been evaluated.
4443ab25eeb5Syz * Perhaps it should always be done for the benefit of things like
4444ab25eeb5Syz * fast forwarding (so that it doesn't need to be recomputed) but with
4445ab25eeb5Syz * header checksum offloading, perhaps it is a moot point.
44467c478bd9Sstevel@tonic-gate */
4447ab25eeb5Syz #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
4448ab25eeb5Syz defined(__osf__) || defined(linux)
44497c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_OUTBOUND)
4450381a2a9aSdr fix_incksum(&fin->fin_ip->ip_sum, nat->nat_ipsumd);
44517c478bd9Sstevel@tonic-gate else
4452381a2a9aSdr fix_outcksum(&fin->fin_ip->ip_sum, nat->nat_ipsumd);
44537c478bd9Sstevel@tonic-gate #endif
44547c478bd9Sstevel@tonic-gate
44557c478bd9Sstevel@tonic-gate if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
44567c478bd9Sstevel@tonic-gate if ((nat->nat_inport != 0) && (nflags & IPN_TCPUDP)) {
44577c478bd9Sstevel@tonic-gate tcp->th_dport = nat->nat_inport;
44587c478bd9Sstevel@tonic-gate fin->fin_data[1] = ntohs(nat->nat_inport);
44597c478bd9Sstevel@tonic-gate }
44607c478bd9Sstevel@tonic-gate
44617c478bd9Sstevel@tonic-gate
44627c478bd9Sstevel@tonic-gate if ((nat->nat_inport != 0) && (nflags & IPN_ICMPQUERY)) {
44637c478bd9Sstevel@tonic-gate icmp = fin->fin_dp;
44647c478bd9Sstevel@tonic-gate
44657c478bd9Sstevel@tonic-gate icmp->icmp_id = nat->nat_inport;
44667c478bd9Sstevel@tonic-gate }
44677c478bd9Sstevel@tonic-gate
44687c478bd9Sstevel@tonic-gate csump = nat_proto(fin, nat, nflags);
44697c478bd9Sstevel@tonic-gate }
44707c478bd9Sstevel@tonic-gate
4471ab25eeb5Syz /*
447224109627Syx * In case they are being forwarded, inbound packets always need to have
447324109627Syx * their checksum adjusted even if hardware checksum validation said OK.
4474ab25eeb5Syz */
44757c478bd9Sstevel@tonic-gate if (csump != NULL) {
44767c478bd9Sstevel@tonic-gate if (nat->nat_dir == NAT_OUTBOUND)
447724109627Syx fix_incksum(csump, nat->nat_sumd[0]);
44787c478bd9Sstevel@tonic-gate else
447924109627Syx fix_outcksum(csump, nat->nat_sumd[0]);
448024109627Syx }
448124109627Syx
4482af5f29ddSToomas Soome #if defined(SOLARIS) && defined(_KERNEL)
448324109627Syx if (nflags & IPN_TCPUDP &&
448424109627Syx NET_IS_HCK_L4_PART(net_data_p, fin->fin_m)) {
448524109627Syx /*
448624109627Syx * Need to adjust the partial checksum result stored in
448724109627Syx * db_cksum16, which will be used for validation in IP.
448824109627Syx * See IP_CKSUM_RECV().
448924109627Syx * Adjustment data should be the inverse of the IP address
449024109627Syx * changes, because db_cksum16 is supposed to be the complement
449124109627Syx * of the pesudo header.
449224109627Syx */
449324109627Syx csump = &fin->fin_m->b_datap->db_cksum16;
449424109627Syx if (nat->nat_dir == NAT_OUTBOUND)
449524109627Syx fix_outcksum(csump, nat->nat_sumd[1]);
449624109627Syx else
449724109627Syx fix_incksum(csump, nat->nat_sumd[1]);
44987c478bd9Sstevel@tonic-gate }
449924109627Syx #endif
450024109627Syx
4501cbded9aeSdr ifs->ifs_nat_stats.ns_mapped[0]++;
45027c478bd9Sstevel@tonic-gate fin->fin_flx |= FI_NATED;
45037c478bd9Sstevel@tonic-gate if (np != NULL && np->in_tag.ipt_num[0] != 0)
45047c478bd9Sstevel@tonic-gate fin->fin_nattag = &np->in_tag;
45057c478bd9Sstevel@tonic-gate return 1;
45067c478bd9Sstevel@tonic-gate }
45077c478bd9Sstevel@tonic-gate
45087c478bd9Sstevel@tonic-gate
45097c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
45107c478bd9Sstevel@tonic-gate /* Function: nat_proto */
45117c478bd9Sstevel@tonic-gate /* Returns: u_short* - pointer to transport header checksum to update, */
45127c478bd9Sstevel@tonic-gate /* NULL if the transport protocol is not recognised */
45137c478bd9Sstevel@tonic-gate /* as needing a checksum update. */
45147c478bd9Sstevel@tonic-gate /* Parameters: fin(I) - pointer to packet information */
45157c478bd9Sstevel@tonic-gate /* nat(I) - pointer to NAT structure */
45167c478bd9Sstevel@tonic-gate /* nflags(I) - NAT flags set for this packet */
45177c478bd9Sstevel@tonic-gate /* */
4518ab25eeb5Syz /* Return the pointer to the checksum field for each protocol so understood.*/
4519ab25eeb5Syz /* If support for making other changes to a protocol header is required, */
4520ab25eeb5Syz /* that is not strictly 'address' translation, such as clamping the MSS in */
4521ab25eeb5Syz /* TCP down to a specific value, then do it from here. */
45227c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_proto(fin,nat,nflags)45237c478bd9Sstevel@tonic-gate u_short *nat_proto(fin, nat, nflags)
45247c478bd9Sstevel@tonic-gate fr_info_t *fin;
45257c478bd9Sstevel@tonic-gate nat_t *nat;
45267c478bd9Sstevel@tonic-gate u_int nflags;
45277c478bd9Sstevel@tonic-gate {
45287c478bd9Sstevel@tonic-gate icmphdr_t *icmp;
4529d6c23f6fSyx struct icmp6_hdr *icmp6;
45307c478bd9Sstevel@tonic-gate u_short *csump;
45317c478bd9Sstevel@tonic-gate tcphdr_t *tcp;
45327c478bd9Sstevel@tonic-gate udphdr_t *udp;
45337c478bd9Sstevel@tonic-gate
45347c478bd9Sstevel@tonic-gate csump = NULL;
45357c478bd9Sstevel@tonic-gate if (fin->fin_out == 0) {
45367c478bd9Sstevel@tonic-gate fin->fin_rev = (nat->nat_dir == NAT_OUTBOUND);
45377c478bd9Sstevel@tonic-gate } else {
45387c478bd9Sstevel@tonic-gate fin->fin_rev = (nat->nat_dir == NAT_INBOUND);
45397c478bd9Sstevel@tonic-gate }
45407c478bd9Sstevel@tonic-gate
45417c478bd9Sstevel@tonic-gate switch (fin->fin_p)
45427c478bd9Sstevel@tonic-gate {
45437c478bd9Sstevel@tonic-gate case IPPROTO_TCP :
45447c478bd9Sstevel@tonic-gate tcp = fin->fin_dp;
45457c478bd9Sstevel@tonic-gate
45467c478bd9Sstevel@tonic-gate csump = &tcp->th_sum;
45477c478bd9Sstevel@tonic-gate
45487c478bd9Sstevel@tonic-gate /*
45497c478bd9Sstevel@tonic-gate * Do a MSS CLAMPING on a SYN packet,
45507c478bd9Sstevel@tonic-gate * only deal IPv4 for now.
45517c478bd9Sstevel@tonic-gate */
45527c478bd9Sstevel@tonic-gate if ((nat->nat_mssclamp != 0) && (tcp->th_flags & TH_SYN) != 0)
4553381a2a9aSdr nat_mssclamp(tcp, nat->nat_mssclamp, csump);
45547c478bd9Sstevel@tonic-gate
45557c478bd9Sstevel@tonic-gate break;
45567c478bd9Sstevel@tonic-gate
45577c478bd9Sstevel@tonic-gate case IPPROTO_UDP :
45587c478bd9Sstevel@tonic-gate udp = fin->fin_dp;
45597c478bd9Sstevel@tonic-gate
45607c478bd9Sstevel@tonic-gate if (udp->uh_sum)
45617c478bd9Sstevel@tonic-gate csump = &udp->uh_sum;
45627c478bd9Sstevel@tonic-gate break;
45637c478bd9Sstevel@tonic-gate
45647c478bd9Sstevel@tonic-gate case IPPROTO_ICMP :
45657c478bd9Sstevel@tonic-gate icmp = fin->fin_dp;
45667c478bd9Sstevel@tonic-gate
45677c478bd9Sstevel@tonic-gate if ((nflags & IPN_ICMPQUERY) != 0) {
45687c478bd9Sstevel@tonic-gate if (icmp->icmp_cksum != 0)
45697c478bd9Sstevel@tonic-gate csump = &icmp->icmp_cksum;
45707c478bd9Sstevel@tonic-gate }
45717c478bd9Sstevel@tonic-gate break;
4572d6c23f6fSyx
4573d6c23f6fSyx case IPPROTO_ICMPV6 :
4574d6c23f6fSyx icmp6 = fin->fin_dp;
4575d6c23f6fSyx
4576d6c23f6fSyx if ((nflags & IPN_ICMPQUERY) != 0) {
4577d6c23f6fSyx if (icmp6->icmp6_cksum != 0)
4578d6c23f6fSyx csump = &icmp6->icmp6_cksum;
4579d6c23f6fSyx }
4580d6c23f6fSyx break;
45817c478bd9Sstevel@tonic-gate }
45827c478bd9Sstevel@tonic-gate return csump;
45837c478bd9Sstevel@tonic-gate }
45847c478bd9Sstevel@tonic-gate
45857c478bd9Sstevel@tonic-gate
45867c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
45877c478bd9Sstevel@tonic-gate /* Function: fr_natunload */
45887c478bd9Sstevel@tonic-gate /* Returns: Nil */
4589ea8244dcSJohn Ojemann /* Parameters: ifs - ipf stack instance */
45907c478bd9Sstevel@tonic-gate /* */
45917c478bd9Sstevel@tonic-gate /* Free all memory used by NAT structures allocated at runtime. */
45927c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_natunload(ifs)4593f4b3ec61Sdh void fr_natunload(ifs)
4594f4b3ec61Sdh ipf_stack_t *ifs;
45957c478bd9Sstevel@tonic-gate {
4596ab25eeb5Syz ipftq_t *ifq, *ifqnext;
4597ab25eeb5Syz
4598f4b3ec61Sdh (void) nat_clearlist(ifs);
4599ea8244dcSJohn Ojemann (void) nat_flushtable(FLUSH_TABLE_ALL, ifs);
46007c478bd9Sstevel@tonic-gate
4601ab25eeb5Syz /*
4602ab25eeb5Syz * Proxy timeout queues are not cleaned here because although they
4603ab25eeb5Syz * exist on the NAT list, appr_unload is called after fr_natunload
4604ab25eeb5Syz * and the proxies actually are responsible for them being created.
4605ab25eeb5Syz * Should the proxy timeouts have their own list? There's no real
4606ab25eeb5Syz * justification as this is the only complication.
4607ab25eeb5Syz */
4608f4b3ec61Sdh for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) {
4609ab25eeb5Syz ifqnext = ifq->ifq_next;
4610ab25eeb5Syz if (((ifq->ifq_flags & IFQF_PROXY) == 0) &&
4611ab25eeb5Syz (fr_deletetimeoutqueue(ifq) == 0))
4612f4b3ec61Sdh fr_freetimeoutqueue(ifq, ifs);
4613ab25eeb5Syz }
4614ab25eeb5Syz
4615f4b3ec61Sdh if (ifs->ifs_nat_table[0] != NULL) {
4616f4b3ec61Sdh KFREES(ifs->ifs_nat_table[0],
4617f4b3ec61Sdh sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz);
4618f4b3ec61Sdh ifs->ifs_nat_table[0] = NULL;
46197c478bd9Sstevel@tonic-gate }
4620f4b3ec61Sdh if (ifs->ifs_nat_table[1] != NULL) {
4621f4b3ec61Sdh KFREES(ifs->ifs_nat_table[1],
4622f4b3ec61Sdh sizeof(nat_t *) * ifs->ifs_ipf_nattable_sz);
4623f4b3ec61Sdh ifs->ifs_nat_table[1] = NULL;
46247c478bd9Sstevel@tonic-gate }
4625f4b3ec61Sdh if (ifs->ifs_nat_rules != NULL) {
4626*55fea89dSDan Cross KFREES(ifs->ifs_nat_rules,
4627f4b3ec61Sdh sizeof(ipnat_t *) * ifs->ifs_ipf_natrules_sz);
4628f4b3ec61Sdh ifs->ifs_nat_rules = NULL;
46297c478bd9Sstevel@tonic-gate }
4630f4b3ec61Sdh if (ifs->ifs_rdr_rules != NULL) {
4631f4b3ec61Sdh KFREES(ifs->ifs_rdr_rules,
4632f4b3ec61Sdh sizeof(ipnat_t *) * ifs->ifs_ipf_rdrrules_sz);
4633f4b3ec61Sdh ifs->ifs_rdr_rules = NULL;
46347c478bd9Sstevel@tonic-gate }
4635f4b3ec61Sdh if (ifs->ifs_maptable != NULL) {
4636*55fea89dSDan Cross KFREES(ifs->ifs_maptable,
4637f4b3ec61Sdh sizeof(hostmap_t *) * ifs->ifs_ipf_hostmap_sz);
4638f4b3ec61Sdh ifs->ifs_maptable = NULL;
46397c478bd9Sstevel@tonic-gate }
4640f4b3ec61Sdh if (ifs->ifs_nat_stats.ns_bucketlen[0] != NULL) {
4641f4b3ec61Sdh KFREES(ifs->ifs_nat_stats.ns_bucketlen[0],
4642f4b3ec61Sdh sizeof(u_long *) * ifs->ifs_ipf_nattable_sz);
4643f4b3ec61Sdh ifs->ifs_nat_stats.ns_bucketlen[0] = NULL;
46447c478bd9Sstevel@tonic-gate }
4645f4b3ec61Sdh if (ifs->ifs_nat_stats.ns_bucketlen[1] != NULL) {
4646f4b3ec61Sdh KFREES(ifs->ifs_nat_stats.ns_bucketlen[1],
4647f4b3ec61Sdh sizeof(u_long *) * ifs->ifs_ipf_nattable_sz);
4648f4b3ec61Sdh ifs->ifs_nat_stats.ns_bucketlen[1] = NULL;
46497c478bd9Sstevel@tonic-gate }
46507c478bd9Sstevel@tonic-gate
4651f4b3ec61Sdh if (ifs->ifs_fr_nat_maxbucket_reset == 1)
4652f4b3ec61Sdh ifs->ifs_fr_nat_maxbucket = 0;
46537c478bd9Sstevel@tonic-gate
4654f4b3ec61Sdh if (ifs->ifs_fr_nat_init == 1) {
4655f4b3ec61Sdh ifs->ifs_fr_nat_init = 0;
4656f4b3ec61Sdh fr_sttab_destroy(ifs->ifs_nat_tqb);
46577c478bd9Sstevel@tonic-gate
4658f4b3ec61Sdh RW_DESTROY(&ifs->ifs_ipf_natfrag);
4659f4b3ec61Sdh RW_DESTROY(&ifs->ifs_ipf_nat);
46607c478bd9Sstevel@tonic-gate
4661f4b3ec61Sdh MUTEX_DESTROY(&ifs->ifs_ipf_nat_new);
4662f4b3ec61Sdh MUTEX_DESTROY(&ifs->ifs_ipf_natio);
46637c478bd9Sstevel@tonic-gate
4664f4b3ec61Sdh MUTEX_DESTROY(&ifs->ifs_nat_udptq.ifq_lock);
4665f4b3ec61Sdh MUTEX_DESTROY(&ifs->ifs_nat_icmptq.ifq_lock);
4666f4b3ec61Sdh MUTEX_DESTROY(&ifs->ifs_nat_iptq.ifq_lock);
46677c478bd9Sstevel@tonic-gate }
46687c478bd9Sstevel@tonic-gate }
46697c478bd9Sstevel@tonic-gate
46707c478bd9Sstevel@tonic-gate
46717c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
46727c478bd9Sstevel@tonic-gate /* Function: fr_natexpire */
46737c478bd9Sstevel@tonic-gate /* Returns: Nil */
4674ea8244dcSJohn Ojemann /* Parameters: ifs - ipf stack instance */
46757c478bd9Sstevel@tonic-gate /* */
46767c478bd9Sstevel@tonic-gate /* Check all of the timeout queues for entries at the top which need to be */
46777c478bd9Sstevel@tonic-gate /* expired. */
46787c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_natexpire(ifs)4679f4b3ec61Sdh void fr_natexpire(ifs)
4680f4b3ec61Sdh ipf_stack_t *ifs;
46817c478bd9Sstevel@tonic-gate {
46827c478bd9Sstevel@tonic-gate ipftq_t *ifq, *ifqnext;
46837c478bd9Sstevel@tonic-gate ipftqent_t *tqe, *tqn;
46847c478bd9Sstevel@tonic-gate int i;
4685ab25eeb5Syz SPL_INT(s);
46867c478bd9Sstevel@tonic-gate
46877c478bd9Sstevel@tonic-gate SPL_NET(s);
4688f4b3ec61Sdh WRITE_ENTER(&ifs->ifs_ipf_nat);
4689f4b3ec61Sdh for (ifq = ifs->ifs_nat_tqb, i = 0; ifq != NULL; ifq = ifq->ifq_next) {
46907c478bd9Sstevel@tonic-gate for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
4691f4b3ec61Sdh if (tqe->tqe_die > ifs->ifs_fr_ticks)
46927c478bd9Sstevel@tonic-gate break;
46937c478bd9Sstevel@tonic-gate tqn = tqe->tqe_next;
4694ea8244dcSJohn Ojemann (void) nat_delete(tqe->tqe_parent, NL_EXPIRE, ifs);
46957c478bd9Sstevel@tonic-gate }
46967c478bd9Sstevel@tonic-gate }
46977c478bd9Sstevel@tonic-gate
4698f4b3ec61Sdh for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) {
46997c478bd9Sstevel@tonic-gate ifqnext = ifq->ifq_next;
47007c478bd9Sstevel@tonic-gate
47017c478bd9Sstevel@tonic-gate for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
4702f4b3ec61Sdh if (tqe->tqe_die > ifs->ifs_fr_ticks)
47037c478bd9Sstevel@tonic-gate break;
47047c478bd9Sstevel@tonic-gate tqn = tqe->tqe_next;
4705ea8244dcSJohn Ojemann (void) nat_delete(tqe->tqe_parent, NL_EXPIRE, ifs);
47067c478bd9Sstevel@tonic-gate }
47077c478bd9Sstevel@tonic-gate }
47087c478bd9Sstevel@tonic-gate
4709f4b3ec61Sdh for (ifq = ifs->ifs_nat_utqe; ifq != NULL; ifq = ifqnext) {
4710ab25eeb5Syz ifqnext = ifq->ifq_next;
4711ab25eeb5Syz
4712ab25eeb5Syz if (((ifq->ifq_flags & IFQF_DELETE) != 0) &&
4713ab25eeb5Syz (ifq->ifq_ref == 0)) {
4714f4b3ec61Sdh fr_freetimeoutqueue(ifq, ifs);
4715ab25eeb5Syz }
4716ab25eeb5Syz }
4717ab25eeb5Syz
47183805c50fSan if (ifs->ifs_nat_doflush != 0) {
4719ea8244dcSJohn Ojemann (void) nat_flushtable(FLUSH_TABLE_EXTRA, ifs);
47203805c50fSan ifs->ifs_nat_doflush = 0;
47213805c50fSan }
47223805c50fSan
4723f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
47247c478bd9Sstevel@tonic-gate SPL_X(s);
47257c478bd9Sstevel@tonic-gate }
47267c478bd9Sstevel@tonic-gate
47277c478bd9Sstevel@tonic-gate
47287c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
4729381a2a9aSdr /* Function: fr_nataddrsync */
47307c478bd9Sstevel@tonic-gate /* Returns: Nil */
4731381a2a9aSdr /* Parameters: ifp(I) - pointer to network interface */
4732381a2a9aSdr /* addr(I) - pointer to new network address */
47337c478bd9Sstevel@tonic-gate /* */
47347c478bd9Sstevel@tonic-gate /* Walk through all of the currently active NAT sessions, looking for those */
4735381a2a9aSdr /* which need to have their translated address updated (where the interface */
4736381a2a9aSdr /* matches the one passed in) and change it, recalculating the checksum sum */
4737381a2a9aSdr /* difference too. */
47387c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_nataddrsync(v,ifp,addr,ifs)4739d6c23f6fSyx void fr_nataddrsync(v, ifp, addr, ifs)
4740d6c23f6fSyx int v;
47417c478bd9Sstevel@tonic-gate void *ifp;
4742d6c23f6fSyx void *addr;
4743f4b3ec61Sdh ipf_stack_t *ifs;
47447c478bd9Sstevel@tonic-gate {
47457c478bd9Sstevel@tonic-gate u_32_t sum1, sum2, sumd;
47467c478bd9Sstevel@tonic-gate nat_t *nat;
4747381a2a9aSdr ipnat_t *np;
4748ab25eeb5Syz SPL_INT(s);
47497c478bd9Sstevel@tonic-gate
47505338faaaSToomas Soome sum1 = 0;
47515338faaaSToomas Soome sum2 = 0;
4752f4b3ec61Sdh if (ifs->ifs_fr_running <= 0)
47537c478bd9Sstevel@tonic-gate return;
47547c478bd9Sstevel@tonic-gate
47557c478bd9Sstevel@tonic-gate SPL_NET(s);
4756f4b3ec61Sdh WRITE_ENTER(&ifs->ifs_ipf_nat);
47577c478bd9Sstevel@tonic-gate
4758f4b3ec61Sdh if (ifs->ifs_fr_running <= 0) {
4759f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
47607c478bd9Sstevel@tonic-gate return;
47617c478bd9Sstevel@tonic-gate }
47627c478bd9Sstevel@tonic-gate
4763381a2a9aSdr /*
4764381a2a9aSdr * Change IP addresses for NAT sessions for any protocol except TCP
4765381a2a9aSdr * since it will break the TCP connection anyway. The only rules
4766381a2a9aSdr * which will get changed are those which are "map ... -> 0/32",
4767381a2a9aSdr * where the rule specifies the address is taken from the interface.
4768381a2a9aSdr */
4769f4b3ec61Sdh for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) {
4770381a2a9aSdr if (addr != NULL) {
4771381a2a9aSdr if (((ifp != NULL) && ifp != (nat->nat_ifps[0])) ||
4772381a2a9aSdr ((nat->nat_flags & IPN_TCP) != 0))
4773381a2a9aSdr continue;
4774d6c23f6fSyx if ((np = nat->nat_ptr) == NULL)
4775d6c23f6fSyx continue;
4776d6c23f6fSyx if (v == 4 && np->in_v == 4) {
4777d6c23f6fSyx if (np->in_nip || np->in_outmsk != 0xffffffff)
4778d6c23f6fSyx continue;
4779d6c23f6fSyx /*
4780d6c23f6fSyx * Change the map-to address to be the same as
4781d6c23f6fSyx * the new one.
4782d6c23f6fSyx */
4783d6c23f6fSyx sum1 = nat->nat_outip.s_addr;
4784d6c23f6fSyx nat->nat_outip = *(struct in_addr *)addr;
4785d6c23f6fSyx sum2 = nat->nat_outip.s_addr;
4786d6c23f6fSyx } else if (v == 6 && np->in_v == 6) {
4787d6c23f6fSyx if (!IP6_ISZERO(&np->in_next6.in6) ||
4788d6c23f6fSyx !IP6_ISONES(&np->in_out[1].in6))
4789d6c23f6fSyx continue;
4790d6c23f6fSyx /*
4791d6c23f6fSyx * Change the map-to address to be the same as
4792d6c23f6fSyx * the new one.
4793d6c23f6fSyx */
4794d6c23f6fSyx nat->nat_outip6.in6 = *(struct in6_addr *)addr;
4795d6c23f6fSyx } else
479634b11c4dSjojemann continue;
47977c478bd9Sstevel@tonic-gate
4798381a2a9aSdr } else if (((ifp == NULL) || (ifp == nat->nat_ifps[0])) &&
4799d6c23f6fSyx !(nat->nat_flags & IPN_TCP) && (np = nat->nat_ptr)) {
4800d6c23f6fSyx if (np->in_v == 4 && (v == 4 || v == 0)) {
4801d6c23f6fSyx struct in_addr in;
4802d6c23f6fSyx if (np->in_outmsk != 0xffffffff || np->in_nip)
4803d6c23f6fSyx continue;
4804d6c23f6fSyx /*
4805d6c23f6fSyx * Change the map-to address to be the same as
4806d6c23f6fSyx * the new one.
4807d6c23f6fSyx */
4808d6c23f6fSyx sum1 = nat->nat_outip.s_addr;
4809d6c23f6fSyx if (fr_ifpaddr(4, FRI_NORMAL, nat->nat_ifps[0],
4810d6c23f6fSyx &in, NULL, ifs) != -1)
4811d6c23f6fSyx nat->nat_outip = in;
4812d6c23f6fSyx sum2 = nat->nat_outip.s_addr;
4813d6c23f6fSyx } else if (np->in_v == 6 && (v == 6 || v == 0)) {
4814d6c23f6fSyx struct in6_addr in6;
4815d6c23f6fSyx if (!IP6_ISZERO(&np->in_next6.in6) ||
4816d6c23f6fSyx !IP6_ISONES(&np->in_out[1].in6))
4817d6c23f6fSyx continue;
4818d6c23f6fSyx /*
4819d6c23f6fSyx * Change the map-to address to be the same as
4820d6c23f6fSyx * the new one.
4821d6c23f6fSyx */
4822d6c23f6fSyx if (fr_ifpaddr(6, FRI_NORMAL, nat->nat_ifps[0],
4823d6c23f6fSyx (void *)&in6, NULL, ifs) != -1)
4824d6c23f6fSyx nat->nat_outip6.in6 = in6;
4825d6c23f6fSyx } else
4826d6c23f6fSyx continue;
4827381a2a9aSdr } else {
4828381a2a9aSdr continue;
48297c478bd9Sstevel@tonic-gate }
4830381a2a9aSdr
4831381a2a9aSdr if (sum1 == sum2)
4832381a2a9aSdr continue;
4833381a2a9aSdr /*
4834381a2a9aSdr * Readjust the checksum adjustment to take into
4835381a2a9aSdr * account the new IP#.
4836381a2a9aSdr */
4837381a2a9aSdr CALC_SUMD(sum1, sum2, sumd);
4838381a2a9aSdr /* XXX - dont change for TCP when solaris does
4839381a2a9aSdr * hardware checksumming.
4840381a2a9aSdr */
4841381a2a9aSdr sumd += nat->nat_sumd[0];
4842381a2a9aSdr nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
4843381a2a9aSdr nat->nat_sumd[1] = nat->nat_sumd[0];
484434b11c4dSjojemann }
484534b11c4dSjojemann
4846f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
4847381a2a9aSdr SPL_X(s);
4848381a2a9aSdr }
4849381a2a9aSdr
4850381a2a9aSdr
4851381a2a9aSdr /* ------------------------------------------------------------------------ */
4852381a2a9aSdr /* Function: fr_natifpsync */
4853381a2a9aSdr /* Returns: Nil */
4854381a2a9aSdr /* Parameters: action(I) - how we are syncing */
4855381a2a9aSdr /* ifp(I) - pointer to network interface */
4856381a2a9aSdr /* name(I) - name of interface to sync to */
4857381a2a9aSdr /* */
4858381a2a9aSdr /* This function is used to resync the mapping of interface names and their */
4859381a2a9aSdr /* respective 'pointers'. For "action == IPFSYNC_RESYNC", resync all */
4860381a2a9aSdr /* interfaces by doing a new lookup of name to 'pointer'. For "action == */
4861381a2a9aSdr /* IPFSYNC_NEWIFP", treat ifp as the new pointer value associated with */
4862381a2a9aSdr /* "name" and for "action == IPFSYNC_OLDIFP", ifp is a pointer for which */
4863381a2a9aSdr /* there is no longer any interface associated with it. */
4864381a2a9aSdr /* ------------------------------------------------------------------------ */
fr_natifpsync(action,v,ifp,name,ifs)4865d6c23f6fSyx void fr_natifpsync(action, v, ifp, name, ifs)
4866d6c23f6fSyx int action, v;
4867381a2a9aSdr void *ifp;
4868381a2a9aSdr char *name;
4869f4b3ec61Sdh ipf_stack_t *ifs;
4870381a2a9aSdr {
4871381a2a9aSdr #if defined(_KERNEL) && !defined(MENTAT) && defined(USE_SPL)
4872381a2a9aSdr int s;
4873381a2a9aSdr #endif
4874381a2a9aSdr nat_t *nat;
4875381a2a9aSdr ipnat_t *n;
4876d6c23f6fSyx int nv;
4877381a2a9aSdr
4878f4b3ec61Sdh if (ifs->ifs_fr_running <= 0)
4879381a2a9aSdr return;
4880381a2a9aSdr
4881381a2a9aSdr SPL_NET(s);
4882f4b3ec61Sdh WRITE_ENTER(&ifs->ifs_ipf_nat);
4883381a2a9aSdr
4884f4b3ec61Sdh if (ifs->ifs_fr_running <= 0) {
4885f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
4886381a2a9aSdr return;
4887381a2a9aSdr }
4888381a2a9aSdr
4889381a2a9aSdr switch (action)
4890381a2a9aSdr {
4891381a2a9aSdr case IPFSYNC_RESYNC :
4892f4b3ec61Sdh for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) {
4893d6c23f6fSyx nv = (v == 0) ? nat->nat_v : v;
4894d6c23f6fSyx if (nat->nat_v != nv)
4895d6c23f6fSyx continue;
4896381a2a9aSdr if ((ifp == nat->nat_ifps[0]) ||
4897381a2a9aSdr (nat->nat_ifps[0] == (void *)-1)) {
4898381a2a9aSdr nat->nat_ifps[0] =
4899d6c23f6fSyx fr_resolvenic(nat->nat_ifnames[0], nv, ifs);
4900381a2a9aSdr }
4901381a2a9aSdr
4902381a2a9aSdr if ((ifp == nat->nat_ifps[1]) ||
4903381a2a9aSdr (nat->nat_ifps[1] == (void *)-1)) {
4904381a2a9aSdr nat->nat_ifps[1] =
4905d6c23f6fSyx fr_resolvenic(nat->nat_ifnames[1], nv, ifs);
4906381a2a9aSdr }
4907381a2a9aSdr }
4908381a2a9aSdr
4909f4b3ec61Sdh for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) {
4910d6c23f6fSyx nv = (v == 0) ? (int)n->in_v : v;
4911d6c23f6fSyx if ((int)n->in_v != nv)
4912d6c23f6fSyx continue;
4913381a2a9aSdr if (n->in_ifps[0] == ifp ||
4914381a2a9aSdr n->in_ifps[0] == (void *)-1) {
4915381a2a9aSdr n->in_ifps[0] =
4916d6c23f6fSyx fr_resolvenic(n->in_ifnames[0], nv, ifs);
4917381a2a9aSdr }
4918381a2a9aSdr if (n->in_ifps[1] == ifp ||
4919381a2a9aSdr n->in_ifps[1] == (void *)-1) {
4920381a2a9aSdr n->in_ifps[1] =
4921d6c23f6fSyx fr_resolvenic(n->in_ifnames[1], nv, ifs);
4922381a2a9aSdr }
4923381a2a9aSdr }
4924381a2a9aSdr break;
4925381a2a9aSdr case IPFSYNC_NEWIFP :
4926f4b3ec61Sdh for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) {
4927d6c23f6fSyx if (nat->nat_v != v)
4928d6c23f6fSyx continue;
4929381a2a9aSdr if (!strncmp(name, nat->nat_ifnames[0],
4930381a2a9aSdr sizeof(nat->nat_ifnames[0])))
4931381a2a9aSdr nat->nat_ifps[0] = ifp;
4932381a2a9aSdr if (!strncmp(name, nat->nat_ifnames[1],
4933381a2a9aSdr sizeof(nat->nat_ifnames[1])))
4934381a2a9aSdr nat->nat_ifps[1] = ifp;
4935381a2a9aSdr }
4936f4b3ec61Sdh for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) {
4937d6c23f6fSyx if ((int)n->in_v != v)
4938d6c23f6fSyx continue;
4939381a2a9aSdr if (!strncmp(name, n->in_ifnames[0],
4940381a2a9aSdr sizeof(n->in_ifnames[0])))
4941381a2a9aSdr n->in_ifps[0] = ifp;
4942381a2a9aSdr if (!strncmp(name, n->in_ifnames[1],
4943381a2a9aSdr sizeof(n->in_ifnames[1])))
4944381a2a9aSdr n->in_ifps[1] = ifp;
4945381a2a9aSdr }
4946381a2a9aSdr break;
4947381a2a9aSdr case IPFSYNC_OLDIFP :
4948f4b3ec61Sdh for (nat = ifs->ifs_nat_instances; nat; nat = nat->nat_next) {
4949d6c23f6fSyx if (nat->nat_v != v)
4950d6c23f6fSyx continue;
4951381a2a9aSdr if (ifp == nat->nat_ifps[0])
4952381a2a9aSdr nat->nat_ifps[0] = (void *)-1;
4953381a2a9aSdr if (ifp == nat->nat_ifps[1])
4954381a2a9aSdr nat->nat_ifps[1] = (void *)-1;
4955381a2a9aSdr }
4956f4b3ec61Sdh for (n = ifs->ifs_nat_list; (n != NULL); n = n->in_next) {
4957d6c23f6fSyx if ((int)n->in_v != v)
4958d6c23f6fSyx continue;
4959381a2a9aSdr if (n->in_ifps[0] == ifp)
4960381a2a9aSdr n->in_ifps[0] = (void *)-1;
4961381a2a9aSdr if (n->in_ifps[1] == ifp)
4962381a2a9aSdr n->in_ifps[1] = (void *)-1;
4963381a2a9aSdr }
4964381a2a9aSdr break;
49657c478bd9Sstevel@tonic-gate }
4966f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
49677c478bd9Sstevel@tonic-gate SPL_X(s);
49687c478bd9Sstevel@tonic-gate }
4969ab25eeb5Syz
4970e8d569f4SAlexandr Nedvedicky #if SOLARIS2 >= 10
4971e8d569f4SAlexandr Nedvedicky /* ------------------------------------------------------------------------ */
4972e8d569f4SAlexandr Nedvedicky /* Function: fr_natifindexsync */
4973e8d569f4SAlexandr Nedvedicky /* Returns: void */
4974e8d569f4SAlexandr Nedvedicky /* Parameters: ifp - interface, which is being sync'd */
4975e8d569f4SAlexandr Nedvedicky /* newifp - new ifindex value for interface */
4976e8d569f4SAlexandr Nedvedicky /* ifs - IPF's stack */
4977e8d569f4SAlexandr Nedvedicky /* */
4978e8d569f4SAlexandr Nedvedicky /* Write Locks: assumes ipf_mutex is locked */
4979e8d569f4SAlexandr Nedvedicky /* */
4980e8d569f4SAlexandr Nedvedicky /* Updates all interface index references in NAT rules and NAT entries. */
4981e8d569f4SAlexandr Nedvedicky /* the index, which is about to be updated must match ifp value. */
4982e8d569f4SAlexandr Nedvedicky /* ------------------------------------------------------------------------ */
fr_natifindexsync(ifp,newifp,ifs)4983e8d569f4SAlexandr Nedvedicky void fr_natifindexsync(ifp, newifp, ifs)
4984e8d569f4SAlexandr Nedvedicky void *ifp;
4985e8d569f4SAlexandr Nedvedicky void *newifp;
4986e8d569f4SAlexandr Nedvedicky ipf_stack_t *ifs;
4987e8d569f4SAlexandr Nedvedicky {
4988e8d569f4SAlexandr Nedvedicky nat_t *nat;
4989e8d569f4SAlexandr Nedvedicky ipnat_t *n;
4990e8d569f4SAlexandr Nedvedicky
4991e8d569f4SAlexandr Nedvedicky WRITE_ENTER(&ifs->ifs_ipf_nat);
4992e8d569f4SAlexandr Nedvedicky
4993e8d569f4SAlexandr Nedvedicky for (nat = ifs->ifs_nat_instances; nat != NULL; nat = nat->nat_next) {
4994e8d569f4SAlexandr Nedvedicky if (ifp == nat->nat_ifps[0])
4995e8d569f4SAlexandr Nedvedicky nat->nat_ifps[0] = newifp;
4996e8d569f4SAlexandr Nedvedicky
4997e8d569f4SAlexandr Nedvedicky if (ifp == nat->nat_ifps[1])
4998e8d569f4SAlexandr Nedvedicky nat->nat_ifps[1] = newifp;
4999e8d569f4SAlexandr Nedvedicky }
5000e8d569f4SAlexandr Nedvedicky
5001e8d569f4SAlexandr Nedvedicky for (n = ifs->ifs_nat_list; n != NULL; n = n->in_next) {
5002e8d569f4SAlexandr Nedvedicky if (ifp == n->in_ifps[0])
5003e8d569f4SAlexandr Nedvedicky n->in_ifps[0] = newifp;
5004e8d569f4SAlexandr Nedvedicky
5005e8d569f4SAlexandr Nedvedicky if (ifp == n->in_ifps[1])
5006e8d569f4SAlexandr Nedvedicky n->in_ifps[1] = newifp;
5007e8d569f4SAlexandr Nedvedicky }
5008e8d569f4SAlexandr Nedvedicky
5009e8d569f4SAlexandr Nedvedicky RWLOCK_EXIT(&ifs->ifs_ipf_nat);
5010e8d569f4SAlexandr Nedvedicky }
5011e8d569f4SAlexandr Nedvedicky #endif
50127c478bd9Sstevel@tonic-gate
50137c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
50147c478bd9Sstevel@tonic-gate /* Function: nat_icmpquerytype4 */
50157c478bd9Sstevel@tonic-gate /* Returns: int - 1 == success, 0 == failure */
50167c478bd9Sstevel@tonic-gate /* Parameters: icmptype(I) - ICMP type number */
50177c478bd9Sstevel@tonic-gate /* */
50187c478bd9Sstevel@tonic-gate /* Tests to see if the ICMP type number passed is a query/response type or */
50197c478bd9Sstevel@tonic-gate /* not. */
50207c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_icmpquerytype4(icmptype)50217c478bd9Sstevel@tonic-gate static INLINE int nat_icmpquerytype4(icmptype)
50227c478bd9Sstevel@tonic-gate int icmptype;
50237c478bd9Sstevel@tonic-gate {
50247c478bd9Sstevel@tonic-gate
50257c478bd9Sstevel@tonic-gate /*
50267c478bd9Sstevel@tonic-gate * For the ICMP query NAT code, it is essential that both the query
50277c478bd9Sstevel@tonic-gate * and the reply match on the NAT rule. Because the NAT structure
50287c478bd9Sstevel@tonic-gate * does not keep track of the icmptype, and a single NAT structure
50297c478bd9Sstevel@tonic-gate * is used for all icmp types with the same src, dest and id, we
50307c478bd9Sstevel@tonic-gate * simply define the replies as queries as well. The funny thing is,
50317c478bd9Sstevel@tonic-gate * altough it seems silly to call a reply a query, this is exactly
50327c478bd9Sstevel@tonic-gate * as it is defined in the IPv4 specification
50337c478bd9Sstevel@tonic-gate */
5034*55fea89dSDan Cross
50357c478bd9Sstevel@tonic-gate switch (icmptype)
5036ab25eeb5Syz {
5037*55fea89dSDan Cross
50387c478bd9Sstevel@tonic-gate case ICMP_ECHOREPLY:
50397c478bd9Sstevel@tonic-gate case ICMP_ECHO:
50407c478bd9Sstevel@tonic-gate /* route aedvertisement/solliciation is currently unsupported: */
50417c478bd9Sstevel@tonic-gate /* it would require rewriting the ICMP data section */
50427c478bd9Sstevel@tonic-gate case ICMP_TSTAMP:
50437c478bd9Sstevel@tonic-gate case ICMP_TSTAMPREPLY:
50447c478bd9Sstevel@tonic-gate case ICMP_IREQ:
50457c478bd9Sstevel@tonic-gate case ICMP_IREQREPLY:
50467c478bd9Sstevel@tonic-gate case ICMP_MASKREQ:
50477c478bd9Sstevel@tonic-gate case ICMP_MASKREPLY:
50487c478bd9Sstevel@tonic-gate return 1;
5049ab25eeb5Syz default:
50507c478bd9Sstevel@tonic-gate return 0;
50517c478bd9Sstevel@tonic-gate }
50527c478bd9Sstevel@tonic-gate }
50537c478bd9Sstevel@tonic-gate
50547c478bd9Sstevel@tonic-gate
50557c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
50567c478bd9Sstevel@tonic-gate /* Function: nat_log */
50577c478bd9Sstevel@tonic-gate /* Returns: Nil */
50587c478bd9Sstevel@tonic-gate /* Parameters: nat(I) - pointer to NAT structure */
50597c478bd9Sstevel@tonic-gate /* type(I) - type of log entry to create */
50607c478bd9Sstevel@tonic-gate /* */
50617c478bd9Sstevel@tonic-gate /* Creates a NAT log entry. */
50627c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_log(nat,type,ifs)5063f4b3ec61Sdh void nat_log(nat, type, ifs)
50647c478bd9Sstevel@tonic-gate struct nat *nat;
50657c478bd9Sstevel@tonic-gate u_int type;
5066f4b3ec61Sdh ipf_stack_t *ifs;
50677c478bd9Sstevel@tonic-gate {
50687c478bd9Sstevel@tonic-gate #ifdef IPFILTER_LOG
5069ab25eeb5Syz # ifndef LARGE_NAT
50707c478bd9Sstevel@tonic-gate struct ipnat *np;
5071ab25eeb5Syz int rulen;
5072ab25eeb5Syz # endif
50737c478bd9Sstevel@tonic-gate struct natlog natl;
50747c478bd9Sstevel@tonic-gate void *items[1];
50757c478bd9Sstevel@tonic-gate size_t sizes[1];
5076ab25eeb5Syz int types[1];
50777c478bd9Sstevel@tonic-gate
5078d6c23f6fSyx natl.nlg_inip = nat->nat_inip6;
5079d6c23f6fSyx natl.nlg_outip = nat->nat_outip6;
5080d6c23f6fSyx natl.nlg_origip = nat->nat_oip6;
5081d6c23f6fSyx natl.nlg_bytes[0] = nat->nat_bytes[0];
5082d6c23f6fSyx natl.nlg_bytes[1] = nat->nat_bytes[1];
5083d6c23f6fSyx natl.nlg_pkts[0] = nat->nat_pkts[0];
5084d6c23f6fSyx natl.nlg_pkts[1] = nat->nat_pkts[1];
5085d6c23f6fSyx natl.nlg_origport = nat->nat_oport;
5086d6c23f6fSyx natl.nlg_inport = nat->nat_inport;
5087d6c23f6fSyx natl.nlg_outport = nat->nat_outport;
5088d6c23f6fSyx natl.nlg_p = nat->nat_p;
5089d6c23f6fSyx natl.nlg_type = type;
5090d6c23f6fSyx natl.nlg_rule = -1;
5091d6c23f6fSyx natl.nlg_v = nat->nat_v;
50927c478bd9Sstevel@tonic-gate # ifndef LARGE_NAT
50937c478bd9Sstevel@tonic-gate if (nat->nat_ptr != NULL) {
5094f4b3ec61Sdh for (rulen = 0, np = ifs->ifs_nat_list; np;
5095f4b3ec61Sdh np = np->in_next, rulen++)
50967c478bd9Sstevel@tonic-gate if (np == nat->nat_ptr) {
5097d6c23f6fSyx natl.nlg_rule = rulen;
50987c478bd9Sstevel@tonic-gate break;
50997c478bd9Sstevel@tonic-gate }
51007c478bd9Sstevel@tonic-gate }
51017c478bd9Sstevel@tonic-gate # endif
51027c478bd9Sstevel@tonic-gate items[0] = &natl;
51037c478bd9Sstevel@tonic-gate sizes[0] = sizeof(natl);
51047c478bd9Sstevel@tonic-gate types[0] = 0;
51057c478bd9Sstevel@tonic-gate
5106f4b3ec61Sdh (void) ipllog(IPL_LOGNAT, NULL, items, sizes, types, 1, ifs);
51077c478bd9Sstevel@tonic-gate #endif
51087c478bd9Sstevel@tonic-gate }
51097c478bd9Sstevel@tonic-gate
51107c478bd9Sstevel@tonic-gate
51117c478bd9Sstevel@tonic-gate #if defined(__OpenBSD__)
51127c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
51137c478bd9Sstevel@tonic-gate /* Function: nat_ifdetach */
51147c478bd9Sstevel@tonic-gate /* Returns: Nil */
51157c478bd9Sstevel@tonic-gate /* Parameters: ifp(I) - pointer to network interface */
51167c478bd9Sstevel@tonic-gate /* */
51177c478bd9Sstevel@tonic-gate /* Compatibility interface for OpenBSD to trigger the correct updating of */
51187c478bd9Sstevel@tonic-gate /* interface references within IPFilter. */
51197c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_ifdetach(ifp,ifs)5120f4b3ec61Sdh void nat_ifdetach(ifp, ifs)
51217c478bd9Sstevel@tonic-gate void *ifp;
5122f4b3ec61Sdh ipf_stack_t *ifs;
51237c478bd9Sstevel@tonic-gate {
5124f4b3ec61Sdh frsync(ifp, ifs);
51257c478bd9Sstevel@tonic-gate return;
51267c478bd9Sstevel@tonic-gate }
51277c478bd9Sstevel@tonic-gate #endif
51287c478bd9Sstevel@tonic-gate
51297c478bd9Sstevel@tonic-gate
5130f4b3ec61Sdh /* ------------------------------------------------------------------------ */
5131f4b3ec61Sdh /* Function: fr_ipnatderef */
5132f4b3ec61Sdh /* Returns: Nil */
5133cbded9aeSdr /* Parameters: inp(I) - pointer to pointer to NAT rule */
5134f4b3ec61Sdh /* Write Locks: ipf_nat */
5135f4b3ec61Sdh /* */
5136f4b3ec61Sdh /* ------------------------------------------------------------------------ */
fr_ipnatderef(inp,ifs)5137f4b3ec61Sdh void fr_ipnatderef(inp, ifs)
5138f4b3ec61Sdh ipnat_t **inp;
5139f4b3ec61Sdh ipf_stack_t *ifs;
5140f4b3ec61Sdh {
5141f4b3ec61Sdh ipnat_t *in;
5142f4b3ec61Sdh
5143f4b3ec61Sdh in = *inp;
5144f4b3ec61Sdh *inp = NULL;
5145f4b3ec61Sdh in->in_use--;
5146f4b3ec61Sdh if (in->in_use == 0 && (in->in_flags & IPN_DELETE)) {
5147f4b3ec61Sdh if (in->in_apr)
5148f4b3ec61Sdh appr_free(in->in_apr);
5149f4b3ec61Sdh KFREE(in);
5150f4b3ec61Sdh ifs->ifs_nat_stats.ns_rules--;
5151f4b3ec61Sdh #ifdef notdef
5152f4b3ec61Sdh #if SOLARIS
5153f4b3ec61Sdh if (ifs->ifs_nat_stats.ns_rules == 0)
5154f4b3ec61Sdh ifs->ifs_pfil_delayed_copy = 1;
5155f4b3ec61Sdh #endif
5156f4b3ec61Sdh #endif
5157f4b3ec61Sdh }
5158f4b3ec61Sdh }
5159f4b3ec61Sdh
5160f4b3ec61Sdh
51617c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
51627c478bd9Sstevel@tonic-gate /* Function: fr_natderef */
51637c478bd9Sstevel@tonic-gate /* Returns: Nil */
5164ea8244dcSJohn Ojemann /* Parameters: natp - pointer to pointer to NAT table entry */
5165ea8244dcSJohn Ojemann /* ifs - ipf stack instance */
51667c478bd9Sstevel@tonic-gate /* */
51677c478bd9Sstevel@tonic-gate /* Decrement the reference counter for this NAT table entry and free it if */
51687c478bd9Sstevel@tonic-gate /* there are no more things using it. */
51690e01ff8bSdr /* */
51700e01ff8bSdr /* IF nat_ref == 1 when this function is called, then we have an orphan nat */
51710e01ff8bSdr /* structure *because* it only gets called on paths _after_ nat_ref has been*/
51720e01ff8bSdr /* incremented. If nat_ref == 1 then we shouldn't decrement it here */
51730e01ff8bSdr /* because nat_delete() will do that and send nat_ref to -1. */
51740e01ff8bSdr /* */
51750e01ff8bSdr /* Holding the lock on nat_lock is required to serialise nat_delete() being */
51760e01ff8bSdr /* called from a NAT flush ioctl with a deref happening because of a packet.*/
51777c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_natderef(natp,ifs)5178f4b3ec61Sdh void fr_natderef(natp, ifs)
51797c478bd9Sstevel@tonic-gate nat_t **natp;
5180f4b3ec61Sdh ipf_stack_t *ifs;
51817c478bd9Sstevel@tonic-gate {
51827c478bd9Sstevel@tonic-gate nat_t *nat;
51837c478bd9Sstevel@tonic-gate
51847c478bd9Sstevel@tonic-gate nat = *natp;
51857c478bd9Sstevel@tonic-gate *natp = NULL;
51860e01ff8bSdr
51870e01ff8bSdr MUTEX_ENTER(&nat->nat_lock);
51880e01ff8bSdr if (nat->nat_ref > 1) {
51890e01ff8bSdr nat->nat_ref--;
51900e01ff8bSdr MUTEX_EXIT(&nat->nat_lock);
51910e01ff8bSdr return;
51920e01ff8bSdr }
51930e01ff8bSdr MUTEX_EXIT(&nat->nat_lock);
51940e01ff8bSdr
5195f4b3ec61Sdh WRITE_ENTER(&ifs->ifs_ipf_nat);
5196ea8244dcSJohn Ojemann (void) nat_delete(nat, NL_EXPIRE, ifs);
5197f4b3ec61Sdh RWLOCK_EXIT(&ifs->ifs_ipf_nat);
51987c478bd9Sstevel@tonic-gate }
51997c478bd9Sstevel@tonic-gate
52007c478bd9Sstevel@tonic-gate
52017c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
52027c478bd9Sstevel@tonic-gate /* Function: fr_natclone */
52037c478bd9Sstevel@tonic-gate /* Returns: ipstate_t* - NULL == cloning failed, */
5204ea8244dcSJohn Ojemann /* else pointer to new NAT structure */
5205ea8244dcSJohn Ojemann /* Parameters: fin(I) - pointer to packet information */
5206ea8244dcSJohn Ojemann /* nat(I) - pointer to master NAT structure */
52077c478bd9Sstevel@tonic-gate /* Write Lock: ipf_nat */
52087c478bd9Sstevel@tonic-gate /* */
5209ea8244dcSJohn Ojemann /* Create a "duplicate" NAT table entry from the master. */
52107c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
fr_natclone(fin,nat)5211d6c23f6fSyx nat_t *fr_natclone(fin, nat)
52127c478bd9Sstevel@tonic-gate fr_info_t *fin;
52137c478bd9Sstevel@tonic-gate nat_t *nat;
52147c478bd9Sstevel@tonic-gate {
52157c478bd9Sstevel@tonic-gate frentry_t *fr;
52167c478bd9Sstevel@tonic-gate nat_t *clone;
52177c478bd9Sstevel@tonic-gate ipnat_t *np;
5218f4b3ec61Sdh ipf_stack_t *ifs = fin->fin_ifs;
52197c478bd9Sstevel@tonic-gate
5220ea8244dcSJohn Ojemann /*
5221ea8244dcSJohn Ojemann * Trigger automatic call to nat_flushtable() if the
5222ea8244dcSJohn Ojemann * table has reached capcity specified by hi watermark.
5223ea8244dcSJohn Ojemann */
5224ea8244dcSJohn Ojemann if (NAT_TAB_WATER_LEVEL(ifs) > ifs->ifs_nat_flush_level_hi)
5225ea8244dcSJohn Ojemann ifs->ifs_nat_doflush = 1;
5226ea8244dcSJohn Ojemann
5227ea8244dcSJohn Ojemann /*
5228ea8244dcSJohn Ojemann * If automatic flushing did not do its job, and the table
5229ea8244dcSJohn Ojemann * has filled up, don't try to create a new entry.
5230ea8244dcSJohn Ojemann */
5231ea8244dcSJohn Ojemann if (ifs->ifs_nat_stats.ns_inuse >= ifs->ifs_ipf_nattable_max) {
5232ea8244dcSJohn Ojemann ifs->ifs_nat_stats.ns_memfail++;
5233ea8244dcSJohn Ojemann return NULL;
5234ea8244dcSJohn Ojemann }
5235ea8244dcSJohn Ojemann
52367c478bd9Sstevel@tonic-gate KMALLOC(clone, nat_t *);
52377c478bd9Sstevel@tonic-gate if (clone == NULL)
52387c478bd9Sstevel@tonic-gate return NULL;
52397c478bd9Sstevel@tonic-gate bcopy((char *)nat, (char *)clone, sizeof(*clone));
52407c478bd9Sstevel@tonic-gate
52417c478bd9Sstevel@tonic-gate MUTEX_NUKE(&clone->nat_lock);
52427c478bd9Sstevel@tonic-gate
5243ab25eeb5Syz clone->nat_aps = NULL;
5244ab25eeb5Syz /*
5245ab25eeb5Syz * Initialize all these so that nat_delete() doesn't cause a crash.
5246ab25eeb5Syz */
5247ab25eeb5Syz clone->nat_tqe.tqe_pnext = NULL;
5248ab25eeb5Syz clone->nat_tqe.tqe_next = NULL;
5249ab25eeb5Syz clone->nat_tqe.tqe_ifq = NULL;
5250ab25eeb5Syz clone->nat_tqe.tqe_parent = clone;
5251ab25eeb5Syz
5252ab25eeb5Syz clone->nat_flags &= ~SI_CLONE;
5253ab25eeb5Syz clone->nat_flags |= SI_CLONED;
5254ab25eeb5Syz
5255ab25eeb5Syz if (clone->nat_hm)
5256ab25eeb5Syz clone->nat_hm->hm_ref++;
5257ab25eeb5Syz
5258f4b3ec61Sdh if (nat_insert(clone, fin->fin_rev, ifs) == -1) {
5259ab25eeb5Syz KFREE(clone);
5260ab25eeb5Syz return NULL;
5261ab25eeb5Syz }
52627c478bd9Sstevel@tonic-gate np = clone->nat_ptr;
52637c478bd9Sstevel@tonic-gate if (np != NULL) {
5264f4b3ec61Sdh if (ifs->ifs_nat_logging)
5265f4b3ec61Sdh nat_log(clone, (u_int)np->in_redir, ifs);
52667c478bd9Sstevel@tonic-gate np->in_use++;
52677c478bd9Sstevel@tonic-gate }
52687c478bd9Sstevel@tonic-gate fr = clone->nat_fr;
52697c478bd9Sstevel@tonic-gate if (fr != NULL) {
52707c478bd9Sstevel@tonic-gate MUTEX_ENTER(&fr->fr_lock);
52717c478bd9Sstevel@tonic-gate fr->fr_ref++;
52727c478bd9Sstevel@tonic-gate MUTEX_EXIT(&fr->fr_lock);
52737c478bd9Sstevel@tonic-gate }
52747c478bd9Sstevel@tonic-gate
5275ab25eeb5Syz /*
5276ab25eeb5Syz * Because the clone is created outside the normal loop of things and
5277ab25eeb5Syz * TCP has special needs in terms of state, initialise the timeout
5278ab25eeb5Syz * state of the new NAT from here.
5279ab25eeb5Syz */
52807c478bd9Sstevel@tonic-gate if (clone->nat_p == IPPROTO_TCP) {
5281f4b3ec61Sdh (void) fr_tcp_age(&clone->nat_tqe, fin, ifs->ifs_nat_tqb,
5282ab25eeb5Syz clone->nat_flags);
52837c478bd9Sstevel@tonic-gate }
5284ab25eeb5Syz #ifdef IPFILTER_SYNC
5285ab25eeb5Syz clone->nat_sync = ipfsync_new(SMC_NAT, fin, clone);
5286ab25eeb5Syz #endif
5287f4b3ec61Sdh if (ifs->ifs_nat_logging)
5288f4b3ec61Sdh nat_log(clone, NL_CLONE, ifs);
52897c478bd9Sstevel@tonic-gate return clone;
52907c478bd9Sstevel@tonic-gate }
52917c478bd9Sstevel@tonic-gate
52927c478bd9Sstevel@tonic-gate
5293ab25eeb5Syz /* ------------------------------------------------------------------------ */
5294ab25eeb5Syz /* Function: nat_wildok */
5295ab25eeb5Syz /* Returns: int - 1 == packet's ports match wildcards */
5296ab25eeb5Syz /* 0 == packet's ports don't match wildcards */
5297ab25eeb5Syz /* Parameters: nat(I) - NAT entry */
5298ab25eeb5Syz /* sport(I) - source port */
5299ab25eeb5Syz /* dport(I) - destination port */
5300ab25eeb5Syz /* flags(I) - wildcard flags */
5301ab25eeb5Syz /* dir(I) - packet direction */
5302ab25eeb5Syz /* */
5303ab25eeb5Syz /* Use NAT entry and packet direction to determine which combination of */
5304ab25eeb5Syz /* wildcard flags should be used. */
5305ab25eeb5Syz /* ------------------------------------------------------------------------ */
nat_wildok(nat,sport,dport,flags,dir)5306d6c23f6fSyx int nat_wildok(nat, sport, dport, flags, dir)
53077c478bd9Sstevel@tonic-gate nat_t *nat;
53087c478bd9Sstevel@tonic-gate int sport;
53097c478bd9Sstevel@tonic-gate int dport;
53107c478bd9Sstevel@tonic-gate int flags;
53117c478bd9Sstevel@tonic-gate int dir;
53127c478bd9Sstevel@tonic-gate {
53137c478bd9Sstevel@tonic-gate /*
53147c478bd9Sstevel@tonic-gate * When called by dir is set to
53157c478bd9Sstevel@tonic-gate * nat_inlookup NAT_INBOUND (0)
53167c478bd9Sstevel@tonic-gate * nat_outlookup NAT_OUTBOUND (1)
53177c478bd9Sstevel@tonic-gate *
53187c478bd9Sstevel@tonic-gate * We simply combine the packet's direction in dir with the original
53197c478bd9Sstevel@tonic-gate * "intended" direction of that NAT entry in nat->nat_dir to decide
53207c478bd9Sstevel@tonic-gate * which combination of wildcard flags to allow.
53217c478bd9Sstevel@tonic-gate */
53227c478bd9Sstevel@tonic-gate
53237c478bd9Sstevel@tonic-gate switch ((dir << 1) | nat->nat_dir)
53247c478bd9Sstevel@tonic-gate {
53257c478bd9Sstevel@tonic-gate case 3: /* outbound packet / outbound entry */
53267c478bd9Sstevel@tonic-gate if (((nat->nat_inport == sport) ||
53277c478bd9Sstevel@tonic-gate (flags & SI_W_SPORT)) &&
53287c478bd9Sstevel@tonic-gate ((nat->nat_oport == dport) ||
53297c478bd9Sstevel@tonic-gate (flags & SI_W_DPORT)))
53307c478bd9Sstevel@tonic-gate return 1;
53317c478bd9Sstevel@tonic-gate break;
53327c478bd9Sstevel@tonic-gate case 2: /* outbound packet / inbound entry */
53337c478bd9Sstevel@tonic-gate if (((nat->nat_outport == sport) ||
53347c478bd9Sstevel@tonic-gate (flags & SI_W_DPORT)) &&
53357c478bd9Sstevel@tonic-gate ((nat->nat_oport == dport) ||
53367c478bd9Sstevel@tonic-gate (flags & SI_W_SPORT)))
53377c478bd9Sstevel@tonic-gate return 1;
53387c478bd9Sstevel@tonic-gate break;
53397c478bd9Sstevel@tonic-gate case 1: /* inbound packet / outbound entry */
53407c478bd9Sstevel@tonic-gate if (((nat->nat_oport == sport) ||
53417c478bd9Sstevel@tonic-gate (flags & SI_W_DPORT)) &&
53427c478bd9Sstevel@tonic-gate ((nat->nat_outport == dport) ||
53437c478bd9Sstevel@tonic-gate (flags & SI_W_SPORT)))
53447c478bd9Sstevel@tonic-gate return 1;
53457c478bd9Sstevel@tonic-gate break;
53467c478bd9Sstevel@tonic-gate case 0: /* inbound packet / inbound entry */
53477c478bd9Sstevel@tonic-gate if (((nat->nat_oport == sport) ||
53487c478bd9Sstevel@tonic-gate (flags & SI_W_SPORT)) &&
53497c478bd9Sstevel@tonic-gate ((nat->nat_outport == dport) ||
53507c478bd9Sstevel@tonic-gate (flags & SI_W_DPORT)))
53517c478bd9Sstevel@tonic-gate return 1;
53527c478bd9Sstevel@tonic-gate break;
53537c478bd9Sstevel@tonic-gate default:
53547c478bd9Sstevel@tonic-gate break;
53557c478bd9Sstevel@tonic-gate }
53567c478bd9Sstevel@tonic-gate
53577c478bd9Sstevel@tonic-gate return(0);
53587c478bd9Sstevel@tonic-gate }
53597c478bd9Sstevel@tonic-gate
53607c478bd9Sstevel@tonic-gate
53617c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
53627c478bd9Sstevel@tonic-gate /* Function: nat_mssclamp */
53637c478bd9Sstevel@tonic-gate /* Returns: Nil */
53647c478bd9Sstevel@tonic-gate /* Parameters: tcp(I) - pointer to TCP header */
53657c478bd9Sstevel@tonic-gate /* maxmss(I) - value to clamp the TCP MSS to */
53667c478bd9Sstevel@tonic-gate /* csump(I) - pointer to TCP checksum */
53677c478bd9Sstevel@tonic-gate /* */
53687c478bd9Sstevel@tonic-gate /* Check for MSS option and clamp it if necessary. If found and changed, */
53697c478bd9Sstevel@tonic-gate /* then the TCP header checksum will be updated to reflect the change in */
53707c478bd9Sstevel@tonic-gate /* the MSS. */
53717c478bd9Sstevel@tonic-gate /* ------------------------------------------------------------------------ */
nat_mssclamp(tcp,maxmss,csump)5372381a2a9aSdr static void nat_mssclamp(tcp, maxmss, csump)
53737c478bd9Sstevel@tonic-gate tcphdr_t *tcp;
53747c478bd9Sstevel@tonic-gate u_32_t maxmss;
53757c478bd9Sstevel@tonic-gate u_short *csump;
53767c478bd9Sstevel@tonic-gate {
53777c478bd9Sstevel@tonic-gate u_char *cp, *ep, opt;
53787c478bd9Sstevel@tonic-gate int hlen, advance;
53797c478bd9Sstevel@tonic-gate u_32_t mss, sumd;
53807c478bd9Sstevel@tonic-gate
53817c478bd9Sstevel@tonic-gate hlen = TCP_OFF(tcp) << 2;
53827c478bd9Sstevel@tonic-gate if (hlen > sizeof(*tcp)) {
53837c478bd9Sstevel@tonic-gate cp = (u_char *)tcp + sizeof(*tcp);
53847c478bd9Sstevel@tonic-gate ep = (u_char *)tcp + hlen;
53857c478bd9Sstevel@tonic-gate
53867c478bd9Sstevel@tonic-gate while (cp < ep) {
53877c478bd9Sstevel@tonic-gate opt = cp[0];
53887c478bd9Sstevel@tonic-gate if (opt == TCPOPT_EOL)
53897c478bd9Sstevel@tonic-gate break;
53907c478bd9Sstevel@tonic-gate else if (opt == TCPOPT_NOP) {
53917c478bd9Sstevel@tonic-gate cp++;
53927c478bd9Sstevel@tonic-gate continue;
53937c478bd9Sstevel@tonic-gate }
53947c478bd9Sstevel@tonic-gate
53957c478bd9Sstevel@tonic-gate if (cp + 1 >= ep)
53967c478bd9Sstevel@tonic-gate break;
53977c478bd9Sstevel@tonic-gate advance = cp[1];
5398ab25eeb5Syz if ((cp + advance > ep) || (advance <= 0))
53997c478bd9Sstevel@tonic-gate break;
54007c478bd9Sstevel@tonic-gate switch (opt)
54017c478bd9Sstevel@tonic-gate {
54027c478bd9Sstevel@tonic-gate case TCPOPT_MAXSEG:
54037c478bd9Sstevel@tonic-gate if (advance != 4)
54047c478bd9Sstevel@tonic-gate break;
5405ab25eeb5Syz mss = cp[2] * 256 + cp[3];
54067c478bd9Sstevel@tonic-gate if (mss > maxmss) {
5407ab25eeb5Syz cp[2] = maxmss / 256;
5408ab25eeb5Syz cp[3] = maxmss & 0xff;
54097c478bd9Sstevel@tonic-gate CALC_SUMD(mss, maxmss, sumd);
5410381a2a9aSdr fix_outcksum(csump, sumd);
54117c478bd9Sstevel@tonic-gate }
54127c478bd9Sstevel@tonic-gate break;
54137c478bd9Sstevel@tonic-gate default:
54147c478bd9Sstevel@tonic-gate /* ignore unknown options */
54157c478bd9Sstevel@tonic-gate break;
54167c478bd9Sstevel@tonic-gate }
54177c478bd9Sstevel@tonic-gate
54187c478bd9Sstevel@tonic-gate cp += advance;
54197c478bd9Sstevel@tonic-gate }
54207c478bd9Sstevel@tonic-gate }
54217c478bd9Sstevel@tonic-gate }
5422ab25eeb5Syz
5423ab25eeb5Syz
5424ab25eeb5Syz /* ------------------------------------------------------------------------ */
5425ab25eeb5Syz /* Function: fr_setnatqueue */
5426ab25eeb5Syz /* Returns: Nil */
5427ab25eeb5Syz /* Parameters: nat(I)- pointer to NAT structure */
5428ab25eeb5Syz /* rev(I) - forward(0) or reverse(1) direction */
5429ab25eeb5Syz /* Locks: ipf_nat (read or write) */
5430ab25eeb5Syz /* */
5431ab25eeb5Syz /* Put the NAT entry on its default queue entry, using rev as a helped in */
5432ab25eeb5Syz /* determining which queue it should be placed on. */
5433ab25eeb5Syz /* ------------------------------------------------------------------------ */
fr_setnatqueue(nat,rev,ifs)5434f4b3ec61Sdh void fr_setnatqueue(nat, rev, ifs)
5435ab25eeb5Syz nat_t *nat;
5436ab25eeb5Syz int rev;
5437f4b3ec61Sdh ipf_stack_t *ifs;
5438ab25eeb5Syz {
5439ab25eeb5Syz ipftq_t *oifq, *nifq;
5440ab25eeb5Syz
5441ab25eeb5Syz if (nat->nat_ptr != NULL)
5442ab25eeb5Syz nifq = nat->nat_ptr->in_tqehead[rev];
5443ab25eeb5Syz else
5444ab25eeb5Syz nifq = NULL;
5445ab25eeb5Syz
5446ab25eeb5Syz if (nifq == NULL) {
5447ab25eeb5Syz switch (nat->nat_p)
5448ab25eeb5Syz {
5449ab25eeb5Syz case IPPROTO_UDP :
5450f4b3ec61Sdh nifq = &ifs->ifs_nat_udptq;
5451ab25eeb5Syz break;
5452ab25eeb5Syz case IPPROTO_ICMP :
5453f4b3ec61Sdh nifq = &ifs->ifs_nat_icmptq;
5454ab25eeb5Syz break;
5455ab25eeb5Syz case IPPROTO_TCP :
5456f4b3ec61Sdh nifq = ifs->ifs_nat_tqb + nat->nat_tqe.tqe_state[rev];
5457ab25eeb5Syz break;
5458ab25eeb5Syz default :
5459f4b3ec61Sdh nifq = &ifs->ifs_nat_iptq;
5460ab25eeb5Syz break;
5461ab25eeb5Syz }
5462ab25eeb5Syz }
5463ab25eeb5Syz
5464ab25eeb5Syz oifq = nat->nat_tqe.tqe_ifq;
5465ab25eeb5Syz /*
5466ab25eeb5Syz * If it's currently on a timeout queue, move it from one queue to
5467ab25eeb5Syz * another, else put it on the end of the newly determined queue.
5468ab25eeb5Syz */
5469ab25eeb5Syz if (oifq != NULL)
5470f4b3ec61Sdh fr_movequeue(&nat->nat_tqe, oifq, nifq, ifs);
5471ab25eeb5Syz else
5472f4b3ec61Sdh fr_queueappend(&nat->nat_tqe, nifq, nat, ifs);
5473ab25eeb5Syz return;
5474ab25eeb5Syz }
5475f4b3ec61Sdh
547690b0a856Sjojemann /* ------------------------------------------------------------------------ */
5477f4b3ec61Sdh /* Function: nat_getnext */
5478f4b3ec61Sdh /* Returns: int - 0 == ok, else error */
5479f4b3ec61Sdh /* Parameters: t(I) - pointer to ipftoken structure */
5480f4b3ec61Sdh /* itp(I) - pointer to ipfgeniter_t structure */
548190b0a856Sjojemann /* ifs - ipf stack instance */
5482f4b3ec61Sdh /* */
548390b0a856Sjojemann /* Fetch the next nat/ipnat/hostmap structure pointer from the linked list */
548490b0a856Sjojemann /* and copy it out to the storage space pointed to by itp. The next item */
5485f4b3ec61Sdh /* in the list to look at is put back in the ipftoken struture. */
5486f4b3ec61Sdh /* ------------------------------------------------------------------------ */
nat_getnext(t,itp,ifs)5487f4b3ec61Sdh static int nat_getnext(t, itp, ifs)
5488f4b3ec61Sdh ipftoken_t *t;
5489f4b3ec61Sdh ipfgeniter_t *itp;
5490f4b3ec61Sdh ipf_stack_t *ifs;
5491f4b3ec61Sdh {
5492f4b3ec61Sdh hostmap_t *hm, *nexthm = NULL, zerohm;
5493f4b3ec61Sdh ipnat_t *ipn, *nextipnat = NULL, zeroipn;
5494f4b3ec61Sdh nat_t *nat, *nextnat = NULL, zeronat;
549590b0a856Sjojemann int error = 0, count;
549690b0a856Sjojemann char *dst;
549790b0a856Sjojemann
549890b0a856Sjojemann if (itp->igi_nitems == 0)
549990b0a856Sjojemann return EINVAL;
5500f4b3ec61Sdh
5501f4b3ec61Sdh READ_ENTER(&ifs->ifs_ipf_nat);
550290b0a856Sjojemann
5503786c7074Sjojemann /*
5504786c7074Sjojemann * Get "previous" entry from the token and find the next entry.
5505786c7074Sjojemann */
5506f4b3ec61Sdh switch (itp->igi_type)
5507f4b3ec61Sdh {
5508f4b3ec61Sdh case IPFGENITER_HOSTMAP :
5509f4b3ec61Sdh hm = t->ipt_data;
5510f4b3ec61Sdh if (hm == NULL) {
5511f4b3ec61Sdh nexthm = ifs->ifs_ipf_hm_maplist;
5512f4b3ec61Sdh } else {
551390b0a856Sjojemann nexthm = hm->hm_next;
5514f4b3ec61Sdh }
5515f4b3ec61Sdh break;
5516f4b3ec61Sdh
5517f4b3ec61Sdh case IPFGENITER_IPNAT :
5518f4b3ec61Sdh ipn = t->ipt_data;
5519f4b3ec61Sdh if (ipn == NULL) {
5520f4b3ec61Sdh nextipnat = ifs->ifs_nat_list;
5521f4b3ec61Sdh } else {
5522f4b3ec61Sdh nextipnat = ipn->in_next;
5523f4b3ec61Sdh }
5524f4b3ec61Sdh break;
5525f4b3ec61Sdh
5526f4b3ec61Sdh case IPFGENITER_NAT :
5527f4b3ec61Sdh nat = t->ipt_data;
5528f4b3ec61Sdh if (nat == NULL) {
5529f4b3ec61Sdh nextnat = ifs->ifs_nat_instances;
5530f4b3ec61Sdh } else {
5531f4b3ec61Sdh nextnat = nat->nat_next;
5532f4b3ec61Sdh }
553390b0a856Sjojemann break;
553490b0a856Sjojemann default :
553590b0a856Sjojemann RWLOCK_EXIT(&ifs->ifs_ipf_nat);
553690b0a856Sjojemann return EINVAL;
553790b0a856Sjojemann }
553858d7f9e6SRobert Mustacchi
553958d7f9e6SRobert Mustacchi /*
554058d7f9e6SRobert Mustacchi * Note, this loop is based on the number of items that a user
554158d7f9e6SRobert Mustacchi * requested. The user can request any number, potentially far more than
554258d7f9e6SRobert Mustacchi * the number of items that actually exist. If a user does that, we'll
554358d7f9e6SRobert Mustacchi * break out of this by setting the value of count to 1 which terminates
554458d7f9e6SRobert Mustacchi * the loop. This should be fine from an ioctl perspective, because the
554558d7f9e6SRobert Mustacchi * last entry that we insert will be the zero entry which terminates the
554658d7f9e6SRobert Mustacchi * chain.
554758d7f9e6SRobert Mustacchi */
554890b0a856Sjojemann dst = itp->igi_data;
554990b0a856Sjojemann for (count = itp->igi_nitems; count > 0; count--) {
5550786c7074Sjojemann /*
5551786c7074Sjojemann * If we found an entry, add a reference to it and update the token.
5552786c7074Sjojemann * Otherwise, zero out data to be returned and NULL out token.
5553786c7074Sjojemann */
555490b0a856Sjojemann switch (itp->igi_type)
555590b0a856Sjojemann {
555690b0a856Sjojemann case IPFGENITER_HOSTMAP :
555790b0a856Sjojemann if (nexthm != NULL) {
555890b0a856Sjojemann ATOMIC_INC32(nexthm->hm_ref);
555990b0a856Sjojemann t->ipt_data = nexthm;
5560f4b3ec61Sdh } else {
556190b0a856Sjojemann bzero(&zerohm, sizeof(zerohm));
556290b0a856Sjojemann nexthm = &zerohm;
556390b0a856Sjojemann t->ipt_data = NULL;
556490b0a856Sjojemann }
556590b0a856Sjojemann break;
556690b0a856Sjojemann case IPFGENITER_IPNAT :
556790b0a856Sjojemann if (nextipnat != NULL) {
556890b0a856Sjojemann ATOMIC_INC32(nextipnat->in_use);
556990b0a856Sjojemann t->ipt_data = nextipnat;
557090b0a856Sjojemann } else {
557190b0a856Sjojemann bzero(&zeroipn, sizeof(zeroipn));
557290b0a856Sjojemann nextipnat = &zeroipn;
557390b0a856Sjojemann t->ipt_data = NULL;
557490b0a856Sjojemann }
557590b0a856Sjojemann break;
557690b0a856Sjojemann case IPFGENITER_NAT :
557790b0a856Sjojemann if (nextnat != NULL) {
5578f4b3ec61Sdh MUTEX_ENTER(&nextnat->nat_lock);
5579f4b3ec61Sdh nextnat->nat_ref++;
5580f4b3ec61Sdh MUTEX_EXIT(&nextnat->nat_lock);
558190b0a856Sjojemann t->ipt_data = nextnat;
558290b0a856Sjojemann } else {
558390b0a856Sjojemann bzero(&zeronat, sizeof(zeronat));
558490b0a856Sjojemann nextnat = &zeronat;
558590b0a856Sjojemann t->ipt_data = NULL;
5586f4b3ec61Sdh }
558790b0a856Sjojemann break;
558890b0a856Sjojemann default :
558990b0a856Sjojemann break;
5590f4b3ec61Sdh }
5591f4b3ec61Sdh
559290b0a856Sjojemann /*
5593786c7074Sjojemann * Now that we have ref, it's save to give up lock.
559490b0a856Sjojemann */
559590b0a856Sjojemann RWLOCK_EXIT(&ifs->ifs_ipf_nat);
5596f4b3ec61Sdh
5597786c7074Sjojemann /*
5598786c7074Sjojemann * Copy out data and clean up references and token as needed.
5599786c7074Sjojemann */
560090b0a856Sjojemann switch (itp->igi_type)
560190b0a856Sjojemann {
560290b0a856Sjojemann case IPFGENITER_HOSTMAP :
560390b0a856Sjojemann error = COPYOUT(nexthm, dst, sizeof(*nexthm));
5604786c7074Sjojemann if (error != 0)
560590b0a856Sjojemann error = EFAULT;
5606786c7074Sjojemann if (t->ipt_data == NULL) {
5607786c7074Sjojemann ipf_freetoken(t, ifs);
560858d7f9e6SRobert Mustacchi count = 1;
5609786c7074Sjojemann break;
561090b0a856Sjojemann } else {
5611786c7074Sjojemann if (hm != NULL) {
5612786c7074Sjojemann WRITE_ENTER(&ifs->ifs_ipf_nat);
5613786c7074Sjojemann fr_hostmapdel(&hm);
5614786c7074Sjojemann RWLOCK_EXIT(&ifs->ifs_ipf_nat);
5615786c7074Sjojemann }
5616786c7074Sjojemann if (nexthm->hm_next == NULL) {
5617786c7074Sjojemann ipf_freetoken(t, ifs);
561858d7f9e6SRobert Mustacchi count = 1;
5619786c7074Sjojemann break;
5620786c7074Sjojemann }
562190b0a856Sjojemann dst += sizeof(*nexthm);
562290b0a856Sjojemann hm = nexthm;
562390b0a856Sjojemann nexthm = nexthm->hm_next;
562490b0a856Sjojemann }
562590b0a856Sjojemann break;
5626786c7074Sjojemann
562790b0a856Sjojemann case IPFGENITER_IPNAT :
562890b0a856Sjojemann error = COPYOUT(nextipnat, dst, sizeof(*nextipnat));
5629786c7074Sjojemann if (error != 0)
563090b0a856Sjojemann error = EFAULT;
5631786c7074Sjojemann if (t->ipt_data == NULL) {
5632786c7074Sjojemann ipf_freetoken(t, ifs);
563358d7f9e6SRobert Mustacchi count = 1;
5634786c7074Sjojemann break;
563590b0a856Sjojemann } else {
5636786c7074Sjojemann if (ipn != NULL) {
5637786c7074Sjojemann WRITE_ENTER(&ifs->ifs_ipf_nat);
5638786c7074Sjojemann fr_ipnatderef(&ipn, ifs);
5639786c7074Sjojemann RWLOCK_EXIT(&ifs->ifs_ipf_nat);
5640786c7074Sjojemann }
5641786c7074Sjojemann if (nextipnat->in_next == NULL) {
5642786c7074Sjojemann ipf_freetoken(t, ifs);
564358d7f9e6SRobert Mustacchi count = 1;
5644786c7074Sjojemann break;
5645786c7074Sjojemann }
564690b0a856Sjojemann dst += sizeof(*nextipnat);
564790b0a856Sjojemann ipn = nextipnat;
564890b0a856Sjojemann nextipnat = nextipnat->in_next;
564990b0a856Sjojemann }
565090b0a856Sjojemann break;
5651786c7074Sjojemann
565290b0a856Sjojemann case IPFGENITER_NAT :
565390b0a856Sjojemann error = COPYOUT(nextnat, dst, sizeof(*nextnat));
5654786c7074Sjojemann if (error != 0)
565590b0a856Sjojemann error = EFAULT;
5656786c7074Sjojemann if (t->ipt_data == NULL) {
5657786c7074Sjojemann ipf_freetoken(t, ifs);
565858d7f9e6SRobert Mustacchi count = 1;
5659786c7074Sjojemann break;
566090b0a856Sjojemann } else {
5661786c7074Sjojemann if (nat != NULL)
5662786c7074Sjojemann fr_natderef(&nat, ifs);
5663786c7074Sjojemann if (nextnat->nat_next == NULL) {
5664786c7074Sjojemann ipf_freetoken(t, ifs);
566558d7f9e6SRobert Mustacchi count = 1;
5666786c7074Sjojemann break;
5667786c7074Sjojemann }
566890b0a856Sjojemann dst += sizeof(*nextnat);
566990b0a856Sjojemann nat = nextnat;
567090b0a856Sjojemann nextnat = nextnat->nat_next;
567190b0a856Sjojemann }
567290b0a856Sjojemann break;
567390b0a856Sjojemann default :
567490b0a856Sjojemann break;
5675f4b3ec61Sdh }
5676*55fea89dSDan Cross
567790b0a856Sjojemann if ((count == 1) || (error != 0))
567890b0a856Sjojemann break;
5679*55fea89dSDan Cross
568090b0a856Sjojemann READ_ENTER(&ifs->ifs_ipf_nat);
5681f4b3ec61Sdh }
5682f4b3ec61Sdh
5683f4b3ec61Sdh return error;
5684f4b3ec61Sdh }
5685f4b3ec61Sdh
5686f4b3ec61Sdh
5687f4b3ec61Sdh /* ------------------------------------------------------------------------ */
5688f4b3ec61Sdh /* Function: nat_iterator */
5689f4b3ec61Sdh /* Returns: int - 0 == ok, else error */
5690f4b3ec61Sdh /* Parameters: token(I) - pointer to ipftoken structure */
5691f4b3ec61Sdh /* itp(I) - pointer to ipfgeniter_t structure */
5692f4b3ec61Sdh /* */
5693f4b3ec61Sdh /* This function acts as a handler for the SIOCGENITER ioctls that use a */
5694f4b3ec61Sdh /* generic structure to iterate through a list. There are three different */
5695f4b3ec61Sdh /* linked lists of NAT related information to go through: NAT rules, active */
5696f4b3ec61Sdh /* NAT mappings and the NAT fragment cache. */
5697f4b3ec61Sdh /* ------------------------------------------------------------------------ */
nat_iterator(token,itp,ifs)5698f4b3ec61Sdh static int nat_iterator(token, itp, ifs)
5699f4b3ec61Sdh ipftoken_t *token;
5700f4b3ec61Sdh ipfgeniter_t *itp;
5701f4b3ec61Sdh ipf_stack_t *ifs;
5702f4b3ec61Sdh {
5703f4b3ec61Sdh int error;
5704f4b3ec61Sdh
5705f4b3ec61Sdh if (itp->igi_data == NULL)
5706f4b3ec61Sdh return EFAULT;
5707f4b3ec61Sdh
5708f4b3ec61Sdh token->ipt_subtype = itp->igi_type;
5709f4b3ec61Sdh
5710f4b3ec61Sdh switch (itp->igi_type)
5711f4b3ec61Sdh {
5712f4b3ec61Sdh case IPFGENITER_HOSTMAP :
5713f4b3ec61Sdh case IPFGENITER_IPNAT :
5714f4b3ec61Sdh case IPFGENITER_NAT :
5715f4b3ec61Sdh error = nat_getnext(token, itp, ifs);
5716f4b3ec61Sdh break;
5717f4b3ec61Sdh case IPFGENITER_NATFRAG :
5718f4b3ec61Sdh error = fr_nextfrag(token, itp, &ifs->ifs_ipfr_natlist,
5719f4b3ec61Sdh &ifs->ifs_ipfr_nattail,
5720f4b3ec61Sdh &ifs->ifs_ipf_natfrag, ifs);
5721f4b3ec61Sdh break;
5722f4b3ec61Sdh default :
5723f4b3ec61Sdh error = EINVAL;
5724f4b3ec61Sdh break;
5725f4b3ec61Sdh }
5726f4b3ec61Sdh
5727f4b3ec61Sdh return error;
5728f4b3ec61Sdh }
57293805c50fSan
57303805c50fSan
5731ea8244dcSJohn Ojemann /* ---------------------------------------------------------------------- */
5732ea8244dcSJohn Ojemann /* Function: nat_flushtable */
5733ea8244dcSJohn Ojemann /* Returns: int - 0 == success, -1 == failure */
5734ea8244dcSJohn Ojemann /* Parameters: flush_option - how to flush the active NAT table */
5735ea8244dcSJohn Ojemann /* ifs - ipf stack instance */
5736ea8244dcSJohn Ojemann /* Write Locks: ipf_nat */
5737ea8244dcSJohn Ojemann /* */
5738ea8244dcSJohn Ojemann /* Flush NAT tables. Three actions currently defined: */
5739ea8244dcSJohn Ojemann /* */
5740ea8244dcSJohn Ojemann /* FLUSH_TABLE_ALL : Flush all NAT table entries */
5741ea8244dcSJohn Ojemann /* */
5742ea8244dcSJohn Ojemann /* FLUSH_TABLE_CLOSING : Flush entries with TCP connections which */
5743ea8244dcSJohn Ojemann /* have started to close on both ends using */
5744ea8244dcSJohn Ojemann /* ipf_flushclosing(). */
5745ea8244dcSJohn Ojemann /* */
5746ea8244dcSJohn Ojemann /* FLUSH_TABLE_EXTRA : First, flush entries which are "almost" closed. */
5747ea8244dcSJohn Ojemann /* Then, if needed, flush entries with TCP */
5748ea8244dcSJohn Ojemann /* connections which have been idle for a long */
5749ea8244dcSJohn Ojemann /* time with ipf_extraflush(). */
5750ea8244dcSJohn Ojemann /* ---------------------------------------------------------------------- */
nat_flushtable(flush_option,ifs)5751ea8244dcSJohn Ojemann static int nat_flushtable(flush_option, ifs)
5752ea8244dcSJohn Ojemann int flush_option;
57533805c50fSan ipf_stack_t *ifs;
57543805c50fSan {
5755ea8244dcSJohn Ojemann nat_t *nat, *natn;
5756ea8244dcSJohn Ojemann int removed;
5757ea8244dcSJohn Ojemann SPL_INT(s);
5758ea8244dcSJohn Ojemann
5759ea8244dcSJohn Ojemann removed = 0;
5760ea8244dcSJohn Ojemann
5761ea8244dcSJohn Ojemann SPL_NET(s);
5762ea8244dcSJohn Ojemann switch (flush_option)
5763ea8244dcSJohn Ojemann {
5764ea8244dcSJohn Ojemann case FLUSH_TABLE_ALL:
5765ea8244dcSJohn Ojemann natn = ifs->ifs_nat_instances;
5766ea8244dcSJohn Ojemann while ((nat = natn) != NULL) {
5767ea8244dcSJohn Ojemann natn = nat->nat_next;
5768ea8244dcSJohn Ojemann if (nat_delete(nat, NL_FLUSH, ifs) == 0)
5769ea8244dcSJohn Ojemann removed++;
57703805c50fSan }
5771ea8244dcSJohn Ojemann break;
5772ea8244dcSJohn Ojemann
5773ea8244dcSJohn Ojemann case FLUSH_TABLE_CLOSING:
5774ea8244dcSJohn Ojemann removed = ipf_flushclosing(NAT_FLUSH,
5775ea8244dcSJohn Ojemann IPF_TCPS_CLOSE_WAIT,
5776ea8244dcSJohn Ojemann ifs->ifs_nat_tqb,
5777ea8244dcSJohn Ojemann ifs->ifs_nat_utqe,
5778ea8244dcSJohn Ojemann ifs);
5779ea8244dcSJohn Ojemann break;
5780ea8244dcSJohn Ojemann
5781ea8244dcSJohn Ojemann case FLUSH_TABLE_EXTRA:
5782ea8244dcSJohn Ojemann removed = ipf_flushclosing(NAT_FLUSH,
5783ea8244dcSJohn Ojemann IPF_TCPS_FIN_WAIT_2,
5784ea8244dcSJohn Ojemann ifs->ifs_nat_tqb,
5785ea8244dcSJohn Ojemann ifs->ifs_nat_utqe,
5786ea8244dcSJohn Ojemann ifs);
5787ea8244dcSJohn Ojemann
5788ea8244dcSJohn Ojemann /*
5789ea8244dcSJohn Ojemann * Be sure we haven't done this in the last 10 seconds.
5790ea8244dcSJohn Ojemann */
5791ea8244dcSJohn Ojemann if (ifs->ifs_fr_ticks - ifs->ifs_nat_last_force_flush <
5792ea8244dcSJohn Ojemann IPF_TTLVAL(10))
5793ea8244dcSJohn Ojemann break;
5794ea8244dcSJohn Ojemann ifs->ifs_nat_last_force_flush = ifs->ifs_fr_ticks;
5795ea8244dcSJohn Ojemann removed += ipf_extraflush(NAT_FLUSH,
5796ea8244dcSJohn Ojemann &ifs->ifs_nat_tqb[IPF_TCPS_ESTABLISHED],
5797ea8244dcSJohn Ojemann ifs->ifs_nat_utqe,
5798ea8244dcSJohn Ojemann ifs);
5799ea8244dcSJohn Ojemann break;
5800ea8244dcSJohn Ojemann
5801ea8244dcSJohn Ojemann default: /* Flush Nothing */
5802ea8244dcSJohn Ojemann break;
5803ea8244dcSJohn Ojemann }
5804ea8244dcSJohn Ojemann
5805ea8244dcSJohn Ojemann SPL_X(s);
5806ea8244dcSJohn Ojemann return (removed);
58073805c50fSan }
580833f2fefdSDarren Reed
580933f2fefdSDarren Reed
581033f2fefdSDarren Reed /* ------------------------------------------------------------------------ */
581133f2fefdSDarren Reed /* Function: nat_uncreate */
581233f2fefdSDarren Reed /* Returns: Nil */
581333f2fefdSDarren Reed /* Parameters: fin(I) - pointer to packet information */
581433f2fefdSDarren Reed /* */
581533f2fefdSDarren Reed /* This function is used to remove a NAT entry from the NAT table when we */
581633f2fefdSDarren Reed /* decide that the create was actually in error. It is thus assumed that */
581733f2fefdSDarren Reed /* fin_flx will have both FI_NATED and FI_NATNEW set. Because we're dealing */
581833f2fefdSDarren Reed /* with the translated packet (not the original), we have to reverse the */
581933f2fefdSDarren Reed /* lookup. Although doing the lookup is expensive (relatively speaking), it */
582033f2fefdSDarren Reed /* is not anticipated that this will be a frequent occurance for normal */
582133f2fefdSDarren Reed /* traffic patterns. */
582233f2fefdSDarren Reed /* ------------------------------------------------------------------------ */
nat_uncreate(fin)582333f2fefdSDarren Reed void nat_uncreate(fin)
582433f2fefdSDarren Reed fr_info_t *fin;
582533f2fefdSDarren Reed {
582633f2fefdSDarren Reed ipf_stack_t *ifs = fin->fin_ifs;
582733f2fefdSDarren Reed int nflags;
582833f2fefdSDarren Reed nat_t *nat;
582933f2fefdSDarren Reed
583033f2fefdSDarren Reed switch (fin->fin_p)
583133f2fefdSDarren Reed {
583233f2fefdSDarren Reed case IPPROTO_TCP :
583333f2fefdSDarren Reed nflags = IPN_TCP;
583433f2fefdSDarren Reed break;
583533f2fefdSDarren Reed case IPPROTO_UDP :
583633f2fefdSDarren Reed nflags = IPN_UDP;
583733f2fefdSDarren Reed break;
583833f2fefdSDarren Reed default :
583933f2fefdSDarren Reed nflags = 0;
584033f2fefdSDarren Reed break;
584133f2fefdSDarren Reed }
584233f2fefdSDarren Reed
584333f2fefdSDarren Reed WRITE_ENTER(&ifs->ifs_ipf_nat);
584433f2fefdSDarren Reed
584533f2fefdSDarren Reed if (fin->fin_out == 0) {
584633f2fefdSDarren Reed nat = nat_outlookup(fin, nflags, (u_int)fin->fin_p,
584733f2fefdSDarren Reed fin->fin_dst, fin->fin_src);
584833f2fefdSDarren Reed } else {
584933f2fefdSDarren Reed nat = nat_inlookup(fin, nflags, (u_int)fin->fin_p,
585033f2fefdSDarren Reed fin->fin_src, fin->fin_dst);
585133f2fefdSDarren Reed }
585233f2fefdSDarren Reed
585333f2fefdSDarren Reed if (nat != NULL) {
585433f2fefdSDarren Reed ifs->ifs_nat_stats.ns_uncreate[fin->fin_out][0]++;
5855150efaafSDarren Reed (void) nat_delete(nat, NL_DESTROY, ifs);
585633f2fefdSDarren Reed } else {
585733f2fefdSDarren Reed ifs->ifs_nat_stats.ns_uncreate[fin->fin_out][1]++;
585833f2fefdSDarren Reed }
585933f2fefdSDarren Reed
586033f2fefdSDarren Reed RWLOCK_EXIT(&ifs->ifs_ipf_nat);
586133f2fefdSDarren Reed }
5862