1 /*
2  * Copyright (C) 1995-2001, 2003 by Darren Reed.
3  *
4  * See the IPFILTER.LICENCE file for details on licencing.
5  *
6  * @(#)ip_nat.h	1.5 2/4/96
7  * $Id: ip_nat.h,v 2.90.2.11 2005/06/18 02:41:32 darrenr Exp $
8 *
9  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
10  * Use is subject to license terms.
11  */
12 #pragma ident	"%Z%%M%	%I%	%E% SMI"
13 
14 #ifndef	__IP_NAT_H__
15 #define	__IP_NAT_H__
16 
17 #ifndef SOLARIS
18 #define	SOLARIS	(defined(sun) && (defined(__svr4__) || defined(__SVR4)))
19 #endif
20 
21 #if defined(__STDC__) || defined(__GNUC__) || defined(_AIX51)
22 #define	SIOCADNAT	_IOW('r', 60, struct ipfobj)
23 #define	SIOCRMNAT	_IOW('r', 61, struct ipfobj)
24 #define	SIOCGNATS	_IOWR('r', 62, struct ipfobj)
25 #define	SIOCGNATL	_IOWR('r', 63, struct ipfobj)
26 #else
27 #define	SIOCADNAT	_IOW(r, 60, struct ipfobj)
28 #define	SIOCRMNAT	_IOW(r, 61, struct ipfobj)
29 #define	SIOCGNATS	_IOWR(r, 62, struct ipfobj)
30 #define	SIOCGNATL	_IOWR(r, 63, struct ipfobj)
31 #endif
32 
33 #undef	LARGE_NAT	/* define	this if you're setting up a system to NAT
34 			 * LARGE numbers of networks/hosts - i.e. in the
35 			 * hundreds or thousands.  In such a case, you should
36 			 * also change the RDR_SIZE and NAT_SIZE below to more
37 			 * appropriate sizes.  The figures below were used for
38 			 * a setup with 1000-2000 networks to NAT.
39 			 */
40 #ifndef NAT_SIZE
41 # ifdef LARGE_NAT
42 #  define	NAT_SIZE	2047
43 # else
44 #  define	NAT_SIZE	127
45 # endif
46 #endif
47 #ifndef RDR_SIZE
48 # ifdef LARGE_NAT
49 #  define	RDR_SIZE	2047
50 # else
51 #  define	RDR_SIZE	127
52 # endif
53 #endif
54 #ifndef HOSTMAP_SIZE
55 # ifdef LARGE_NAT
56 #  define	HOSTMAP_SIZE	8191
57 # else
58 #  define	HOSTMAP_SIZE	2047
59 # endif
60 #endif
61 #ifndef NAT_TABLE_MAX
62 /*
63  * This is newly introduced and for the sake of "least surprise", the numbers
64  * present aren't what we'd normally use for creating a proper hash table.
65  */
66 # ifdef	LARGE_NAT
67 #  define	NAT_TABLE_MAX	180000
68 # else
69 #  define	NAT_TABLE_MAX	30000
70 # endif
71 #endif
72 #ifndef NAT_TABLE_SZ
73 # ifdef LARGE_NAT
74 #  define	NAT_TABLE_SZ	16383
75 # else
76 #  define	NAT_TABLE_SZ	2047
77 # endif
78 #endif
79 #ifndef	APR_LABELLEN
80 #define	APR_LABELLEN	16
81 #endif
82 
83 #define	DEF_NAT_AGE	1200     /* 10 minutes (600 seconds) */
84 
85 struct ipstate;
86 struct ap_session;
87 
88 typedef	struct	nat	{
89 	ipfmutex_t	nat_lock;
90 	struct	nat	*nat_next;
91 	struct	nat	**nat_pnext;
92 	struct	nat	*nat_hnext[2];
93 	struct	nat	**nat_phnext[2];
94 	struct	hostmap	*nat_hm;
95 	void		*nat_data;
96 	struct	nat	**nat_me;
97 	struct	ipstate	*nat_state;
98 	struct	ap_session	*nat_aps;		/* proxy session */
99 	frentry_t	*nat_fr;	/* filter rule ptr if appropriate */
100 	struct	ipnat	*nat_ptr;	/* pointer back to the rule */
101 	void		*nat_ifps[2];
102 	void		*nat_sync;
103 	ipftqent_t	nat_tqe;
104 	u_32_t		nat_flags;
105 	u_32_t		nat_sumd[2];	/* ip checksum delta for data segment*/
106 	u_32_t		nat_ipsumd;	/* ip checksum delta for ip header */
107 	u_32_t		nat_mssclamp;	/* if != zero clamp MSS to this */
108 	i6addr_t	nat_inip6;
109 	i6addr_t	nat_outip6;
110 	i6addr_t	nat_oip6;		/* other ip */
111 	U_QUAD_T	nat_pkts[2];
112 	U_QUAD_T	nat_bytes[2];
113 	union	{
114 		udpinfo_t	nat_unu;
115 		tcpinfo_t	nat_unt;
116 		icmpinfo_t	nat_uni;
117 		greinfo_t	nat_ugre;
118 	} nat_un;
119 	u_short		nat_oport;		/* other port */
120 	u_short		nat_use;
121 	u_char		nat_p;			/* protocol for NAT */
122 	int		nat_dir;
123 	int		nat_ref;		/* reference count */
124 	int		nat_hv[2];
125 	char		nat_ifnames[2][LIFNAMSIZ];
126 	int		nat_rev;		/* 0 = forward, 1 = reverse */
127 	int		nat_redir;		/* copy of in_redir */
128 } nat_t;
129 
130 #define	nat_inip	nat_inip6.in4
131 #define	nat_outip	nat_outip6.in4
132 #define	nat_oip		nat_oip6.in4
133 #define	nat_age		nat_tqe.tqe_die
134 #define	nat_inport	nat_un.nat_unt.ts_sport
135 #define	nat_outport	nat_un.nat_unt.ts_dport
136 #define	nat_type	nat_un.nat_uni.ici_type
137 #define	nat_seq		nat_un.nat_uni.ici_seq
138 #define	nat_id		nat_un.nat_uni.ici_id
139 #define	nat_tcpstate	nat_tqe.tqe_state
140 
141 /*
142  * Values for nat_dir
143  */
144 #define	NAT_INBOUND	0
145 #define	NAT_OUTBOUND	1
146 
147 /*
148  * Definitions for nat_flags
149  */
150 #define	NAT_TCP		0x0001	/* IPN_TCP */
151 #define	NAT_UDP		0x0002	/* IPN_UDP */
152 #define	NAT_ICMPERR	0x0004	/* IPN_ICMPERR */
153 #define	NAT_ICMPQUERY	0x0008	/* IPN_ICMPQUERY */
154 #define	NAT_SEARCH	0x0010
155 #define	NAT_SLAVE	0x0020	/* Slave connection for a proxy */
156 #define	NAT_NOTRULEPORT	0x0040
157 
158 #define	NAT_TCPUDP	(NAT_TCP|NAT_UDP)
159 #define	NAT_TCPUDPICMP	(NAT_TCP|NAT_UDP|NAT_ICMPERR)
160 #define	NAT_TCPUDPICMPQ	(NAT_TCP|NAT_UDP|NAT_ICMPQUERY)
161 #define	NAT_FROMRULE	(NAT_TCP|NAT_UDP)
162 
163 /* 0x0100 reserved for FI_W_SPORT */
164 /* 0x0200 reserved for FI_W_DPORT */
165 /* 0x0400 reserved for FI_W_SADDR */
166 /* 0x0800 reserved for FI_W_DADDR */
167 /* 0x1000 reserved for FI_W_NEWFR */
168 /* 0x2000 reserved for SI_CLONE */
169 /* 0x4000 reserved for SI_CLONED */
170 /* 0x8000 reserved for SI_IGNOREPKT */
171 
172 #define	NAT_DEBUG	0x800000
173 
174 typedef	struct	ipnat	{
175 	struct	ipnat	*in_next;		/* NAT rule list next */
176 	struct	ipnat	*in_rnext;		/* rdr rule hash next */
177 	struct	ipnat	**in_prnext;		/* prior rdr next ptr */
178 	struct	ipnat	*in_mnext;		/* map rule hash next */
179 	struct	ipnat	**in_pmnext;		/* prior map next ptr */
180 	struct	ipftq	*in_tqehead[2];
181 	void		*in_ifps[2];
182 	void		*in_apr;
183 	char		*in_comment;
184 	i6addr_t	in_next6;
185 	u_long		in_space;
186 	u_long		in_hits;
187 	u_int		in_use;
188 	u_int		in_hv;
189 	int		in_flineno;		/* conf. file line number */
190 	u_short		in_pnext;
191 	u_char		in_v;
192 	u_char		in_xxx;
193 	/* From here to the end is covered by IPN_CMPSIZ */
194 	u_32_t		in_flags;
195 	u_32_t		in_mssclamp;		/* if != 0 clamp MSS to this */
196 	u_int		in_age[2];
197 	int		in_redir;		/* see below for values */
198 	int		in_p;			/* protocol. */
199 	i6addr_t	in_in[2];
200 	i6addr_t	in_out[2];
201 	i6addr_t	in_src[2];
202 	frtuc_t		in_tuc;
203 	u_short		in_port[2];
204 	u_short		in_ppip;		/* ports per IP. */
205 	u_short		in_ippip;		/* IP #'s per IP# */
206 	char		in_ifnames[2][LIFNAMSIZ];
207 	char		in_plabel[APR_LABELLEN];	/* proxy label. */
208 	ipftag_t	in_tag;
209 } ipnat_t;
210 
211 #define	in_pmin		in_port[0]	/* Also holds static redir port */
212 #define	in_pmax		in_port[1]
213 #define	in_nextip	in_next6.in4
214 #define	in_nip		in_next6.in4.s_addr
215 #define	in_inip		in_in[0].in4.s_addr
216 #define	in_inmsk	in_in[1].in4.s_addr
217 #define	in_outip	in_out[0].in4.s_addr
218 #define	in_outmsk	in_out[1].in4.s_addr
219 #define	in_srcip	in_src[0].in4.s_addr
220 #define	in_srcmsk	in_src[1].in4.s_addr
221 #define	in_scmp		in_tuc.ftu_scmp
222 #define	in_dcmp		in_tuc.ftu_dcmp
223 #define	in_stop		in_tuc.ftu_stop
224 #define	in_dtop		in_tuc.ftu_dtop
225 #define	in_sport	in_tuc.ftu_sport
226 #define	in_dport	in_tuc.ftu_dport
227 
228 /*
229  * Bit definitions for in_flags
230  */
231 #define	IPN_ANY		0x00000
232 #define	IPN_TCP		0x00001
233 #define	IPN_UDP		0x00002
234 #define	IPN_TCPUDP	(IPN_TCP|IPN_UDP)
235 #define	IPN_ICMPERR	0x00004
236 #define	IPN_TCPUDPICMP	(IPN_TCP|IPN_UDP|IPN_ICMPERR)
237 #define	IPN_ICMPQUERY	0x00008
238 #define	IPN_TCPUDPICMPQ	(IPN_TCP|IPN_UDP|IPN_ICMPQUERY)
239 #define	IPN_RF		(IPN_TCPUDP|IPN_DELETE|IPN_ICMPERR)
240 #define	IPN_AUTOPORTMAP	0x00010
241 #define	IPN_IPRANGE	0x00020
242 #define	IPN_FILTER	0x00040
243 #define	IPN_SPLIT	0x00080
244 #define	IPN_ROUNDR	0x00100
245 #define	IPN_NOTSRC	0x04000
246 #define	IPN_NOTDST	0x08000
247 #define	IPN_DYNSRCIP	0x10000	/* dynamic src IP# */
248 #define	IPN_DYNDSTIP	0x20000	/* dynamic dst IP# */
249 #define	IPN_DELETE	0x40000
250 #define	IPN_STICKY	0x80000
251 #define	IPN_FRAG	0x100000
252 #define	IPN_FIXEDDPORT	0x200000
253 #define	IPN_FINDFORWARD	0x400000
254 #define	IPN_IN		0x800000
255 #define	IPN_USERFLAGS	(IPN_TCPUDP|IPN_AUTOPORTMAP|IPN_IPRANGE|IPN_SPLIT|\
256 			 IPN_ROUNDR|IPN_FILTER|IPN_NOTSRC|IPN_NOTDST|\
257 			 IPN_FRAG|IPN_STICKY|IPN_FIXEDDPORT|IPN_ICMPQUERY)
258 
259 /*
260  * Values for in_redir
261  */
262 #define	NAT_MAP		0x01
263 #define	NAT_REDIRECT	0x02
264 #define	NAT_BIMAP	(NAT_MAP|NAT_REDIRECT)
265 #define	NAT_MAPBLK	0x04
266 
267 #define	MAPBLK_MINPORT	1024	/* don't use reserved ports for src port */
268 #define	USABLE_PORTS	(65536 - MAPBLK_MINPORT)
269 
270 #define	IPN_CMPSIZ	(sizeof(ipnat_t) - offsetof(ipnat_t, in_flags))
271 
272 typedef	struct	natlookup {
273 	struct	in_addr	nl_inip;
274 	struct	in_addr	nl_outip;
275 	struct	in_addr	nl_realip;
276 	int	nl_flags;
277 	u_short	nl_inport;
278 	u_short	nl_outport;
279 	u_short	nl_realport;
280 } natlookup_t;
281 
282 
283 typedef struct  nat_save    {
284 	void	*ipn_next;
285 	struct	nat	ipn_nat;
286 	struct	ipnat	ipn_ipnat;
287 	struct	frentry ipn_fr;
288 	int	ipn_dsize;
289 	char	ipn_data[4];
290 } nat_save_t;
291 
292 #define	ipn_rule	ipn_nat.nat_fr
293 
294 typedef	struct	natget	{
295 	void	*ng_ptr;
296 	int	ng_sz;
297 } natget_t;
298 
299 
300 #undef	tr_flags
301 typedef	struct	nattrpnt	{
302 	struct	in_addr	tr_dstip;	/* real destination IP# */
303 	struct	in_addr	tr_srcip;	/* real source IP# */
304 	struct	in_addr	tr_locip;	/* local source IP# */
305 	u_int	tr_flags;
306 	int	tr_expire;
307 	u_short	tr_dstport;	/* real destination port# */
308 	u_short	tr_srcport;	/* real source port# */
309 	u_short	tr_locport;	/* local source port# */
310 	struct	nattrpnt	*tr_hnext;
311 	struct	nattrpnt	**tr_phnext;
312 	struct	nattrpnt	*tr_next;
313 	struct	nattrpnt	**tr_pnext;	/* previous next */
314 } nattrpnt_t;
315 
316 #define	TN_CMPSIZ	offsetof(nattrpnt_t, tr_hnext)
317 
318 
319 /*
320  * This structure gets used to help NAT sessions keep the same NAT rule (and
321  * thus translation for IP address) when:
322  * (a) round-robin redirects are in use
323  * (b) different IP add
324  */
325 typedef	struct	hostmap	{
326 	struct	hostmap	*hm_next;
327 	struct	hostmap	**hm_pnext;
328 	struct	hostmap	*hm_hnext;
329 	struct	hostmap	**hm_phnext;
330 	struct	ipnat	*hm_ipnat;
331 	struct	in_addr	hm_srcip;
332 	struct	in_addr	hm_dstip;
333 	struct	in_addr	hm_mapip;
334 	u_32_t		hm_port;
335 	int		hm_ref;
336 } hostmap_t;
337 
338 
339 /*
340  * Structure used to pass information in to nat_newmap and nat_newrdr.
341  */
342 typedef struct	natinfo	{
343 	ipnat_t		*nai_np;
344 	u_32_t		nai_sum1;
345 	u_32_t		nai_sum2;
346 	u_32_t		nai_nflags;
347 	u_32_t		nai_flags;
348 	struct	in_addr	nai_ip;
349 	u_short		nai_port;
350 	u_short		nai_nport;
351 	u_short		nai_sport;
352 	u_short		nai_dport;
353 } natinfo_t;
354 
355 
356 typedef	struct	natstat	{
357 	u_long	ns_mapped[2];
358 	u_long	ns_rules;
359 	u_long	ns_added;
360 	u_long	ns_expire;
361 	u_long	ns_inuse;
362 	u_long	ns_logged;
363 	u_long	ns_logfail;
364 	u_long	ns_memfail;
365 	u_long	ns_badnat;
366 	u_long	ns_addtrpnt;
367 	nat_t	**ns_table[2];
368 	hostmap_t **ns_maptable;
369 	ipnat_t	*ns_list;
370 	void	*ns_apslist;
371 	u_int	ns_wilds;
372 	u_int	ns_nattab_sz;
373 	u_int	ns_nattab_max;
374 	u_int	ns_rultab_sz;
375 	u_int	ns_rdrtab_sz;
376 	u_int	ns_trpntab_sz;
377 	u_int	ns_hostmap_sz;
378 	nat_t	*ns_instances;
379 	nattrpnt_t *ns_trpntlist;
380 	hostmap_t *ns_maplist;
381 	u_long	*ns_bucketlen[2];
382 } natstat_t;
383 
384 typedef	struct	natlog {
385 	struct	in_addr	nl_origip;
386 	struct	in_addr	nl_outip;
387 	struct	in_addr	nl_inip;
388 	u_short	nl_origport;
389 	u_short	nl_outport;
390 	u_short	nl_inport;
391 	u_short	nl_type;
392 	int	nl_rule;
393 	U_QUAD_T	nl_pkts[2];
394 	U_QUAD_T	nl_bytes[2];
395 	u_char	nl_p;
396 } natlog_t;
397 
398 
399 #define	NL_NEWMAP	NAT_MAP
400 #define	NL_NEWRDR	NAT_REDIRECT
401 #define	NL_NEWBIMAP	NAT_BIMAP
402 #define	NL_NEWBLOCK	NAT_MAPBLK
403 #define	NL_CLONE	0xfffd
404 #define	NL_FLUSH	0xfffe
405 #define	NL_EXPIRE	0xffff
406 
407 #define	NAT_HASH_FN(k,l,m)	(((k) + ((k) >> 12) + l) % (m))
408 
409 #define	LONG_SUM(in)	(((in) & 0xffff) + ((in) >> 16))
410 
411 #define	CALC_SUMD(s1, s2, sd) { \
412 			    (s1) = ((s1) & 0xffff) + ((s1) >> 16); \
413 			    (s2) = ((s2) & 0xffff) + ((s2) >> 16); \
414 			    /* Do it twice */ \
415 			    (s1) = ((s1) & 0xffff) + ((s1) >> 16); \
416 			    (s2) = ((s2) & 0xffff) + ((s2) >> 16); \
417 			    /* Because ~1 == -2, We really need ~1 == -1 */ \
418 			    if ((s1) > (s2)) (s2)--; \
419 			    (sd) = (s2) - (s1); \
420 			    (sd) = ((sd) & 0xffff) + ((sd) >> 16); }
421 
422 #define	NAT_SYSSPACE		0x80000000
423 #define	NAT_LOCKHELD		0x40000000
424 
425 
426 extern	void	fr_natsync __P((void *, ipf_stack_t *));
427 extern	void	fr_nataddrsync __P((void *, struct in_addr *, ipf_stack_t *));
428 extern	void	fr_natifpsync __P((int, void *, char *, ipf_stack_t *));
429 
430 #if defined(__OpenBSD__)
431 extern	void	nat_ifdetach __P((void *, ipf_stack_t *));
432 #endif
433 extern	int	fr_nat_ioctl __P((caddr_t, ioctlcmd_t, int, int, void *, ipf_stack_t *));
434 extern	int	fr_natinit __P((ipf_stack_t *));
435 extern	nat_t	*nat_new __P((fr_info_t *, ipnat_t *, nat_t **, u_int, int));
436 extern	nat_t	*nat_outlookup __P((fr_info_t *, u_int, u_int, struct in_addr,
437 				 struct in_addr));
438 extern	void	fix_datacksum __P((u_short *, u_32_t));
439 extern	nat_t	*nat_inlookup __P((fr_info_t *, u_int, u_int, struct in_addr,
440 				struct in_addr));
441 extern	nat_t	*nat_tnlookup __P((fr_info_t *, int));
442 extern	nat_t	*nat_maplookup __P((void *, u_int, struct in_addr,
443 				struct in_addr));
444 extern	nat_t	*nat_lookupredir __P((natlookup_t *, ipf_stack_t *));
445 extern	nat_t	*nat_icmperrorlookup __P((fr_info_t *, int));
446 extern	nat_t	*nat_icmperror __P((fr_info_t *, u_int *, int));
447 extern	int	nat_insert __P((nat_t *, int, ipf_stack_t *));
448 
449 extern	int	fr_checknatout __P((fr_info_t *, u_32_t *));
450 extern	int	fr_natout __P((fr_info_t *, nat_t *, int, u_32_t));
451 extern	int	fr_checknatin __P((fr_info_t *, u_32_t *));
452 extern	int	fr_natin __P((fr_info_t *, nat_t *, int, u_32_t));
453 extern	void	fr_natunload __P((ipf_stack_t *));
454 extern	void	fr_natexpire __P((ipf_stack_t *));
455 extern	void	nat_log __P((struct nat *, u_int, ipf_stack_t *));
456 extern	void	fix_incksum __P((u_short *, u_32_t));
457 extern	void	fix_outcksum __P((u_short *, u_32_t));
458 extern  void    fr_ipnatderef __P((ipnat_t **, ipf_stack_t *));
459 extern	void	fr_natderef __P((nat_t **, ipf_stack_t *));
460 extern	u_short	*nat_proto __P((fr_info_t *, nat_t *, u_int));
461 extern	void	nat_update __P((fr_info_t *, nat_t *, ipnat_t *));
462 extern	void	fr_setnatqueue __P((nat_t *, int, ipf_stack_t *));
463 extern  void    fr_hostmapderef __P((hostmap_t **));
464 
465 #endif /* __IP_NAT_H__ */
466