/*
* Copyright (C) 1995-2004 by Darren Reed.
*
* See the IPFILTER.LICENCE file for details on licencing.
*
* Copyright 2009 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#endif
defined(_KERNEL)
# include "opt_ipfilter_log.h"
#endif
#if !defined(_KERNEL)
# include <stdio.h>
# include <string.h>
# include <stdlib.h>
# define _KERNEL
# ifdef __OpenBSD__
struct file;
# endif
#endif
#else
#endif
#if !defined(AIX)
#endif
#if !defined(linux)
#endif
#if defined(_KERNEL)
# endif
#endif
# include <sys/byteorder.h>
# ifdef _KERNEL
# include <sys/dditypes.h>
# endif
#endif
#if __FreeBSD_version >= 300000
#endif
#if __FreeBSD_version >= 300000
# if defined(_KERNEL) && !defined(IPFILTER_LKM)
# include "opt_ipfilter.h"
# endif
#endif
#ifdef sun
#endif
#include <netinet/in_systm.h>
#ifdef RFC1825
#endif
#if !defined(linux)
#endif
#include "netinet/ip_compat.h"
#include "netinet/ip_state.h"
#include "netinet/ip_proxy.h"
#include "netinet/ipf_stack.h"
#ifdef IPFILTER_SYNC
#endif
#if (__FreeBSD_version >= 300000)
#endif
/* END OF INCLUDES */
#if !defined(lint)
#endif
/* ======================================================================== */
/* How the NAT is organised and works. */
/* */
/* Inside (interface y) NAT Outside (interface x) */
/* -------------------- -+- ------------------------------------- */
/* Packet going | out, processsed by fr_checknatout() for x */
/* ------------> | ------------> */
/* src=10.1.1.1 | src=192.1.1.1 */
/* | */
/* | in, processed by fr_checknatin() for x */
/* <------------ | <------------ */
/* dst=10.1.1.1 | dst=192.1.1.1 */
/* -------------------- -+- ------------------------------------- */
/* fr_checknatout() - changes ip_src and if required, sport */
/* - creates a new mapping, if required. */
/* fr_checknatin() - changes ip_dst and if required, dport */
/* */
/* In the NAT table, internal source is recorded as "in" and externally */
/* seen as "out". */
/* ======================================================================== */
ipf_stack_t *));
#define NAT_HAS_L4_CHANGED(n) \
(((n)->nat_flags & (IPN_TCPUDPICMP)) && \
(n)->nat_inport != (n)->nat_outport)
/* ------------------------------------------------------------------------ */
/* Function: fr_natinit */
/* Returns: int - 0 == success, -1 == failure */
/* Parameters: Nil */
/* */
/* Initialise all of the NAT locks, tables and other structures. */
/* ------------------------------------------------------------------------ */
{
int i;
else
return -1;
else
return -2;
else
return -3;
else
return -4;
else
return -5;
return -1;
return -1;
if (ifs->ifs_fr_nat_maxbucket == 0) {
}
/*
* Increase this because we may have "keep state" following this too
* and packet storms can occur if this is removed too quickly.
*/
for (i = 0; i < IPF_TCP_NSTATES; i++) {
#ifdef LARGE_NAT
#endif
}
/*
* Increase this because we may have "keep state" following
* this too and packet storms can occur if this is removed
* too quickly.
*/
return 0;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_addrdr */
/* Returns: Nil */
/* Parameters: n(I) - pointer to NAT rule to add */
/* */
/* Adds a redirect rule to the hash table of redirect rules and the list of */
/* loaded NAT rules. Updates the bitmask indicating which netmasks are in */
/* use by redirect rules. */
/* ------------------------------------------------------------------------ */
ipnat_t *n;
{
u_32_t j;
int k;
k = count4bits(n->in_outmsk);
if ((k >= 0) && (k != 32))
*np = n;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_addnat */
/* Returns: Nil */
/* Parameters: n(I) - pointer to NAT rule to add */
/* */
/* Adds a NAT map rule to the hash table of rules and the list of loaded */
/* NAT rules. Updates the bitmask indicating which netmasks are in use by */
/* redirect rules. */
/* ------------------------------------------------------------------------ */
ipnat_t *n;
{
u_32_t j;
int k;
k = count4bits(n->in_inmsk);
if ((k >= 0) && (k != 32))
*np = n;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_delrdr */
/* Returns: Nil */
/* Parameters: n(I) - pointer to NAT rule to delete */
/* */
/* Removes a redirect rule from the hash table of redirect rules. */
/* ------------------------------------------------------------------------ */
void nat_delrdr(n)
ipnat_t *n;
{
if (n->in_rnext)
}
/* ------------------------------------------------------------------------ */
/* Function: nat_delnat */
/* Returns: Nil */
/* Parameters: n(I) - pointer to NAT rule to delete */
/* */
/* Removes a NAT map rule from the hash table of NAT map rules. */
/* ------------------------------------------------------------------------ */
void nat_delnat(n)
ipnat_t *n;
{
}
/* ------------------------------------------------------------------------ */
/* Function: nat_hostmap */
/* Returns: struct hostmap* - NULL if no hostmap could be created, */
/* else a pointer to the hostmapping to use */
/* Parameters: np(I) - pointer to NAT rule */
/* real(I) - real IP address */
/* map(I) - mapped IP address */
/* port(I) - destination port number */
/* Write Locks: ipf_nat */
/* */
/* Check if an ip address has already been allocated for a given mapping */
/* that is not doing port based translation. If is not yet allocated, then */
/* create a new entry if a non-NULL NAT rule pointer has been supplied. */
/* ------------------------------------------------------------------------ */
{
hv %= HOSTMAP_SIZE;
return hm;
}
return NULL;
if (hm) {
}
return hm;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_hostmapdel */
/* Returns: Nil */
/* Parameters: hmp(I) - pointer to pointer to hostmap structure */
/* Write Locks: ipf_nat */
/* */
/* Decrement the references to this hostmap structure by one. If this */
/* reaches zero then remove it and free it. */
/* ------------------------------------------------------------------------ */
{
}
}
/* ------------------------------------------------------------------------ */
/* Function: fix_outcksum */
/* Returns: Nil */
/* Parameters: sp(I) - location of 16bit checksum to update */
/* n((I) - amount to adjust checksum by */
/* */
/* Adjusts the 16bit checksum by "n" for packets going out. */
/* ------------------------------------------------------------------------ */
u_32_t n;
{
if (n == 0)
return;
sum1 += (n);
/* Again */
}
/* ------------------------------------------------------------------------ */
/* Function: fix_incksum */
/* Returns: Nil */
/* Parameters: sp(I) - location of 16bit checksum to update */
/* n((I) - amount to adjust checksum by */
/* */
/* Adjusts the 16bit checksum by "n" for packets going in. */
/* ------------------------------------------------------------------------ */
u_32_t n;
{
if (n == 0)
return;
sum1 += ~(n) & 0xffff;
/* Again */
}
/* ------------------------------------------------------------------------ */
/* Function: fix_datacksum */
/* Returns: Nil */
/* Parameters: sp(I) - location of 16bit checksum to update */
/* n((I) - amount to adjust checksum by */
/* */
/* Fix_datacksum is used *only* for the adjustments of checksums in the */
/* data section of an IP packet. */
/* */
/* The only situation in which you need to do this is when NAT'ing an */
/* ICMP error message. Such a message, contains in its body the IP header */
/* of the original IP packet, that causes the error. */
/* */
/* You can't use fix_incksum or fix_outcksum in that case, because for the */
/* kernel the data section of the ICMP error is just data, and no special */
/* processing like hardware cksum or ntohs processing have been done by the */
/* kernel on the data section. */
/* ------------------------------------------------------------------------ */
u_32_t n;
{
if (n == 0)
return;
sum1 += (n);
/* Again */
}
/* ------------------------------------------------------------------------ */
/* Function: fr_nat_ioctl */
/* Returns: int - 0 == success, != 0 == failure */
/* Parameters: data(I) - pointer to ioctl data */
/* cmd(I) - ioctl command integer */
/* mode(I) - file mode bits used with open */
/* uid(I) - uid of caller */
/* ctx(I) - pointer to give the uid context */
/* ifs - ipf stack instance */
/* */
/* Processes an ioctl call made to operate on the IP Filter NAT device. */
/* ------------------------------------------------------------------------ */
void *ctx;
{
return EPERM;
#endif
getlock = 0;
#else
#endif
} else {
}
if (mode & NAT_SYSSPACE) {
error = 0;
} else {
}
}
if (error != 0)
goto done;
/*
*/
}
IPN_CMPSIZ) == 0) {
continue;
break;
}
}
switch (cmd)
{
case SIOCGENITER :
{
if (error != 0)
break;
else
break;
}
#ifdef IPFILTER_LOG
case SIOCIPFFB :
{
int tmp;
else {
sizeof(tmp));
if (error != 0)
}
break;
}
case SIOCSETLG :
} else {
(char *)&ifs->ifs_nat_logging,
sizeof(ifs->ifs_nat_logging));
if (error != 0)
}
break;
case SIOCGETLG :
sizeof(ifs->ifs_nat_logging));
if (error != 0)
break;
case FIONREAD :
if (error != 0)
break;
#endif
case SIOCADNAT :
} else if (n != NULL) {
}
if (error != 0) {
break;
}
if (error == 0)
break;
case SIOCRMNAT :
n = NULL;
} else if (n == NULL) {
}
if (error != 0) {
break;
}
n = NULL;
break;
case SIOCGNATS :
break;
case SIOCGNATL :
{
if (getlock) {
}
if (error == 0) {
void *ptr;
{
case 4:
break;
#ifdef USE_INET6
case 6:
break;
#endif
default:
break;
}
} else {
}
}
if (getlock) {
}
break;
}
case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */
break;
}
if (getlock) {
}
if (error != 0) {
} else {
if (arg == FLUSH_LIST)
else if (VALID_TABLE_FLUSH_OPT(arg))
else
}
if (getlock) {
}
if (error == 0) {
if (error != 0)
}
break;
case SIOCPROXY :
break;
case SIOCSTLCK :
} else {
}
break;
case SIOCSTPUT :
} else {
}
break;
case SIOCSTGSZ :
if (ifs->ifs_fr_nat_lock) {
if (getlock) {
}
if (getlock) {
}
} else
break;
case SIOCSTGET :
if (ifs->ifs_fr_nat_lock) {
if (getlock) {
}
if (getlock) {
}
} else
break;
case SIOCIPFDELTOK :
if (error != 0) {
} else {
}
break;
default :
break;
}
done:
if (nt)
return error;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_siocaddnat */
/* Returns: int - 0 == success, != 0 == failure */
/* Parameters: n(I) - pointer to new NAT rule */
/* np(I) - pointer to where to insert new NAT rule */
/* getlock(I) - flag indicating if lock on ipf_nat is held */
/* Mutex Locks: ipf_natio */
/* */
/* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
/* from information passed to the kernel, then add it to the appropriate */
/* NAT rule table(s). */
/* ------------------------------------------------------------------------ */
int getlock;
{
int error = 0, i, j;
if (nat_resolverule(n, ifs) != 0)
return ENOENT;
return EINVAL;
n->in_use = 0;
if (n->in_redir & NAT_MAPBLK)
else if (n->in_flags & IPN_AUTOPORTMAP)
else if (n->in_flags & IPN_IPRANGE)
n->in_space = 2;
else if (n->in_outmsk != 0)
else
n->in_space = 1;
return EINVAL;
}
/*
* Calculate the number of valid IP addresses in the output
* mapping range. In all cases, the range is inclusive of
* the start and ending IP addresses.
* If to a CIDR address, lose 2: broadcast + network address
* (so subtract 1)
* If to a range, add one.
* If to a single IP address, set to 1.
*/
if (n->in_space) {
if ((n->in_flags & IPN_IPRANGE) != 0)
n->in_space += 1;
else
n->in_space -= 1;
} else
n->in_space = 1;
#ifdef USE_INET6
else if (n->in_v == 6 &&
else if (n->in_v == 6)
else
#endif
(n->in_redir & NAT_REDIRECT))
else
/*
* Multiply by the number of ports made available.
*/
/*
* Because two different sources can map to
* different destinations but use the same
* local IP#/port #.
* If the result is smaller than in_space, then
* we may have wrapped around 32bits.
*/
i = n->in_inmsk;
if ((i != 0) && (i != 0xffffffff)) {
if (j >= n->in_space)
n->in_space = j;
else
n->in_space = 0xffffffff;
}
}
/*
* If no protocol is specified, multiple by 256 to allow for
* at least one IP:IP mapping per protocol.
*/
if ((n->in_flags & IPN_TCPUDPICMP) == 0) {
j = n->in_space * 256;
if (j >= n->in_space)
n->in_space = j;
else
n->in_space = 0xffffffff;
}
}
/* Otherwise, these fields are preset */
if (getlock) {
}
*np = n;
if (n->in_age[0] != 0)
if (n->in_age[1] != 0)
if (n->in_redir & NAT_REDIRECT) {
n->in_flags &= ~IPN_NOTDST;
switch (n->in_v)
{
case 4 :
nat_addrdr(n, ifs);
break;
#ifdef USE_INET6
case 6 :
nat6_addrdr(n, ifs);
break;
#endif
default :
break;
}
}
n->in_flags &= ~IPN_NOTSRC;
switch (n->in_v)
{
case 4 :
nat_addnat(n, ifs);
break;
#ifdef USE_INET6
case 6 :
nat6_addnat(n, ifs);
break;
#endif
default :
break;
}
}
n = NULL;
if (getlock) {
}
return error;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_resolvrule */
/* Returns: int - 0 == success, -1 == failure */
/* Parameters: n(I) - pointer to NAT rule */
/* */
/* Resolve some of the details inside the NAT rule. Includes resolving */
/* any specified interfaces and proxy labels, and determines whether or not */
/* all proxy labels are correctly specified. */
/* */
/* Called by nat_siocaddnat() (SIOCADNAT) and fr_natputent (SIOCSTPUT). */
/* ------------------------------------------------------------------------ */
ipnat_t *n;
{
} else {
}
if (n->in_plabel[0] != '\0') {
return -1;
}
return 0;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_siocdelnat */
/* Returns: int - 0 == success, != 0 == failure */
/* Parameters: n(I) - pointer to new NAT rule */
/* np(I) - pointer to where to insert new NAT rule */
/* getlock(I) - flag indicating if lock on ipf_nat is held */
/* Mutex Locks: ipf_natio */
/* */
/* Handle SIOCADNAT. Resolve and calculate details inside the NAT rule */
/* from information passed to the kernel, then add it to the appropriate */
/* NAT rule table(s). */
/* ------------------------------------------------------------------------ */
int getlock;
{
int i;
if (getlock) {
}
if (n->in_redir & NAT_REDIRECT)
nat_delrdr(n);
nat_delnat(n);
ifs->ifs_nat_masks = 0;
ifs->ifs_rdr_masks = 0;
for (i = 0; i < 4; i++) {
ifs->ifs_nat6_masks[i] = 0;
ifs->ifs_rdr6_masks[i] = 0;
}
}
if (n->in_tqehead[0] != NULL) {
if (fr_deletetimeoutqueue(n->in_tqehead[0]) == 0) {
}
}
}
}
if (n->in_use == 0) {
if (n->in_apr)
KFREE(n);
} else {
n->in_flags |= IPN_DELETE;
}
if (getlock) {
}
}
/* ------------------------------------------------------------------------ */
/* Function: fr_natgetsz */
/* Returns: int - 0 == success, != 0 is the error value. */
/* Parameters: data(I) - pointer to natget structure with kernel pointer */
/* get the size of. */
/* */
/* Handle SIOCSTGSZ. */
/* Return the size of the nat list entry to be copied back to user space. */
/* The size of the entry is stored in the ng_sz field and the enture natget */
/* structure is copied back to the user. */
/* ------------------------------------------------------------------------ */
{
int err;
if (err != 0)
return EFAULT;
if (!nat) {
/*
* Empty list so the size returned is 0. Simple.
*/
if (err != 0) {
return EFAULT;
} else {
return 0;
}
}
} else {
/*
* Make sure the pointer we're copying from exists in the
* current list of entries. Security precaution to prevent
* copying of random kernel data.
*/
if (n == nat)
break;
if (!n)
return ESRCH;
}
/*
* Incluse any space required for proxy data structures.
*/
}
if (err != 0)
return EFAULT;
return 0;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_natgetent */
/* Returns: int - 0 == success, != 0 is the error value. */
/* Parameters: data(I) - pointer to natget structure with kernel pointer */
/* to NAT structure to copy out. */
/* */
/* Handle SIOCSTGET. */
/* Copies out NAT entry to user space. Any additional data held for a */
/* proxy is also copied, as to is the NAT rule which was responsible for it */
/* ------------------------------------------------------------------------ */
{
if (error != 0)
return error;
return EINVAL;
return ENOMEM;
goto finished;
}
} else {
/*
* Make sure the pointer we're copying from exists in the
* current list of entries. Security precaution to prevent
* copying of random kernel data.
*/
if (n == nat)
break;
if (n == NULL) {
goto finished;
}
}
/*
* Copy the NAT structure.
*/
/*
* If we have a pointer to the NAT rule it belongs to, save that too.
*/
/*
* If we also know the NAT entry has an associated filter rule,
* save that too.
*/
/*
* Last but not least, if there is an application proxy session set
* up for this NAT entry, then copy that out too, including any
* private data saved along side it by the proxy.
*/
char *s;
goto finished;
}
s += sizeof(*aps);
else
}
if (error == 0) {
}
}
return error;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_calc_chksum_diffs */
/* Returns: void */
/* Parameters: nat - pointer to NAT table entry */
/* */
/* we are dealing with partial chksum offload. For these cases we need to */
/* compute a 'partial chksum delta'. The 'partial chksum delta'is stored */
/* nat_sumd[0]. */
/* */
/* The function accepts initialized NAT table entry and computes the deltas */
/* the new entry is inserted into the table. */
/* */
/* The ipsumd (IP hedaer chksum delta adjustment) is computed as a chksum */
/* of delta between original and new IP addresses. */
/* */
/* a chkusm of delta between original an new IP addrress:port tupples. */
/* */
/* Some facts about chksum, we should remember: */
/* IP header chksum covers IP header only */
/* */
/* SRC, DST IP address */
/* SRC, DST Port */
/* length of payload */
/* */
/* The partial chksum delta (nat_sumd[1] is used to adjust db_ckusm16 */
/* member of dblk_t structure. The db_ckusm16 member is not part of */
/* chksum offload capacbility for every inbound packet. The db_cksum16 is */
/* stored along with other IP packet data in dblk_t structure and used in */
/* */
/* The partial chksum delta (adjustment, nat_sumd[1]) is computed as chksum */
/* of delta between new and orig address. NOTE: the order of operands for */
/* header adjustment. It is by design see (IP_CKSUM_RECV() macro in ip.c). */
/* */
/* ------------------------------------------------------------------------ */
{
return;
/*
* the switch calculates operands for CALC_SUMD(),
* which will compute the partial chksum delta.
*/
{
case NAT_INBOUND:
/*
* we are dealing with RDR rule (DST address gets
* modified on packet from client)
*/
} else {
}
break;
case NAT_OUTBOUND:
/*
* we are dealing with MAP rule (SRC address gets
* modified on packet from client)
*/
} else {
}
break;
default: ;
break;
}
/*
* we also preserve CALC_SUMD() operands here, for IP chksum delta
* calculation, which happens at the end of function.
*/
/*
* NOTE: the order of operands for partial chksum adjustment
* computation has to be swapped!
*/
/*
* switch calculates operands for CALC_SUMD(), which will
* compute the full chksum delta.
*/
{
case NAT_INBOUND:
} else {
}
break;
case NAT_OUTBOUND:
} else {
}
break;
default: ;
break;
}
/*
* so we need to enforce full chksum adjustment for ICMP
*/
}
}
else
/*
* we may reuse the already computed nat_sumd[0] for IP header chksum
*/
if (NAT_HAS_L4_CHANGED(nat)) {
/*
* bad luck, NAT changes also the L4 header, use IP
* addresses to compute chksum adjustment for IP header.
*/
} else {
/*
* the NAT does not change L4 hdr -> reuse chksum
* adjustment for IP hdr.
*/
/*
* if L4 header does not use chksum - zero out deltas
*/
}
}
}
return;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_natputent */
/* Returns: int - 0 == success, != 0 is the error value. */
/* Parameters: data(I) - pointer to natget structure with NAT */
/* structure information to load into the kernel */
/* getlock(I) - flag indicating whether or not a write lock */
/* on ipf_nat is already held. */
/* ifs - ipf stack instance */
/* */
/* Handle SIOCSTPUT. */
/* Loads a NAT table entry from user space, including a NAT rule, proxy and */
/* firewall rule data structures, if pointers to them indicate so. */
/* ------------------------------------------------------------------------ */
int getlock;
{
int error;
if (error != 0)
return error;
/*
* Trigger automatic call to nat_flushtable() if the
* table has reached capcity specified by hi watermark.
*/
/*
* If automatic flushing did not do its job, and the table
* has filled up, don't try to create a new entry.
*/
return ENOMEM;
}
/*
* Initialise early because of code at junkput label.
*/
/*
* New entry, copy in the rest of the NAT entry if it's size is more
* than just the nat_t structure.
*/
goto junkput;
}
return ENOMEM;
if (error != 0) {
goto junkput;
}
} else
goto junkput;
}
/*
* Initialize all these so that nat_delete() doesn't cause a crash.
*/
/*
* Restore the rule associated with this nat session
*/
goto junkput;
}
goto junkput;
}
}
/*
* Check that the NAT entry doesn't already exist in the kernel.
*/
if (getlock) {
}
{
case 4:
break;
#ifdef USE_INET6
case 6:
break;
#endif
default:
n = NULL;
break;
}
if (getlock) {
}
if (n != NULL) {
goto junkput;
}
if (getlock) {
}
{
case 4:
break;
#ifdef USE_INET6
case 6:
break;
#endif
default:
n = NULL;
break;
}
if (getlock) {
}
if (n != NULL) {
goto junkput;
}
} else {
goto junkput;
}
/*
* Restore ap_session_t structure. Include the private data allocated
* if it was there.
*/
goto junkput;
}
else
goto junkput;
}
goto junkput;
}
} else {
}
}
/*
* If there was a filtering rule associated with this entry then
* build up a new one.
*/
goto junkput;
}
} else {
if (getlock) {
}
break;
if (n != NULL) {
}
if (getlock) {
}
if (!n) {
goto junkput;
}
}
}
}
if (getlock) {
}
{
case 4 :
break;
#ifdef USE_INET6
case 6 :
break;
#endif
default :
break;
}
}
if (getlock) {
}
if (error == 0)
return 0;
}
}
}
}
}
return error;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_delete */
/* Returns: int - 0 if entry deleted. Otherwise, ref count on entry */
/* Parameters: nat - pointer to the NAT entry to delete */
/* logtype - type of LOG record to create before deleting */
/* ifs - ipf stack instance */
/* Write Lock: ipf_nat */
/* */
/* Delete a nat entry from the various lists and table. If NAT logging is */
/* enabled then generate a NAT log record for this event. */
/* ------------------------------------------------------------------------ */
int logtype;
{
int removed = 0;
/*
* Start by removing the entry from the hash table of nat entries
* so it will not be "used" again.
*
* It will remain in the "list" of nat entries until all references
* have been accounted for.
*/
removed = 1;
}
}
}
/*
* Next, remove it from the timeout queue it is in.
*/
}
if (removed)
}
/*
* If entry had already been removed,
* it means we're cleaning up an orphan.
*/
if (!removed)
#ifdef IPFILTER_SYNC
#endif
/*
* Now remove it from master list of nat table entries
*/
}
}
/*
* If there is an active reference from the nat entry to its parent
* rule, decrement the rule's reference count and free it too if no
* longer being used.
*/
}
}
/*
* If there's a fragment table entry too for this nat entry, then
* dereference that as well. This is after nat_lock is released
* because of Tru64.
*/
return (0);
}
/* ------------------------------------------------------------------------ */
/* Function: nat_clearlist */
/* Parameters: Nil */
/* */
/* Delete all rules in the current list of rules. There is nothing elegant */
/* about this cleanup: simply free all entries on the list of rules and */
/* clear out the tables used for hashed NAT rule lookups. */
/* ------------------------------------------------------------------------ */
{
int i = 0;
if (n->in_use == 0) {
KFREE(n);
} else {
n->in_flags |= IPN_DELETE;
}
i++;
}
ifs->ifs_nat_masks = 0;
ifs->ifs_rdr_masks = 0;
for (i = 0; i < 4; i++) {
ifs->ifs_nat6_masks[i] = 0;
ifs->ifs_rdr6_masks[i] = 0;
}
return i;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_newmap */
/* Returns: int - -1 == error, 0 == success */
/* Parameters: fin(I) - pointer to packet information */
/* nat(I) - pointer to NAT entry */
/* ni(I) - pointer to structure with misc. information needed */
/* to create new NAT entry. */
/* */
/* Given an empty NAT structure, populate it with new information about a */
/* new NAT session, as defined by the matching NAT rule. */
/* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
/* to the new IP address for the translation. */
/* ------------------------------------------------------------------------ */
{
int l;
/*
* If it's an outbound packet which doesn't match any existing
* record, then create a new port
*/
l = 0;
/*
* Do a loop until we either run out of entries to try or we find
* a NAT mapping that isn't currently being used. This is done
* because the change to the source is not (usually) being fixed.
*/
do {
port = 0;
if (l == 0) {
/*
* Check to see if there is an existing NAT
* setup for this IP address pair.
*/
fr_hostmapdel(&hm);
}
if (l > 0)
return -1;
}
/*
* map the address block in a 1:1 fashion
*/
!(flags & IPN_TCPUDP)))
return -1;
/*
* map-block - Calculate destination address.
*/
/*
* Calculate destination port.
*/
if ((flags & IPN_TCPUDP) &&
port += MAPBLK_MINPORT;
}
/*
* 0/32 - use the interface's IP address.
*/
if ((l > 0) ||
return -1;
/*
*/
if (l > 0)
return -1;
if ((flags & IPN_TCPUDP) &&
/*
* "ports auto" (without map-block)
*/
return -1;
}
port += MAPBLK_MINPORT;
}
/*
* Standard port translation. Select next port.
*/
} else {
}
}
}
} else {
}
/*
* Here we do a lookup of the connection as seen from
* the outside. If an IP# pair already exists, try
* again. So if you have A->B becomes C->B, you can
* also have D->E become C->E but not D->B causing
* another C->B. Also take protocol and ports into
* account when determining whether a pre-existing
* NAT setup will cause an external conflict where
* this is appropriate.
*/
/*
* Has the search wrapped around and come back to the
* start ?
*/
return -1;
l++;
/* Setup the NAT table */
if (flags & IPN_TCPUDP) {
} else if (flags & IPN_ICMPQUERY) {
}
return 0;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_newrdr */
/* Returns: int - -1 == error, 0 == success (no move), 1 == success and */
/* allow rule to be moved if IPN_ROUNDR is set. */
/* Parameters: fin(I) - pointer to packet information */
/* nat(I) - pointer to NAT entry */
/* ni(I) - pointer to structure with misc. information needed */
/* to create new NAT entry. */
/* */
/* ni.nai_ip is passed in uninitialised and must be set, in host byte order,*/
/* to the new IP address for the translation. */
/* ------------------------------------------------------------------------ */
{
int move;
move = 1;
/*
* If the matching rule has IPN_STICKY set, then we want to have the
* same rule kick in as before. Why would this happen? If you have
* a collection of rdr rules with "round-robin sticky", the current
* packet might match a different one to the previous connection but
* we want the same destination to be used.
*/
(IPN_ROUNDR|IPN_STICKY)) {
move = 0;
}
}
/*
* Otherwise, it's an inbound packet. Most likely, we don't
* want to rewrite source ports and source addresses. Instead,
* we want to rewrite to a fixed internal address and fixed
* internal port.
*/
move = 0;
}
}
move = 0;
} else {
}
}
/*
* 0/32 - use the interface's IP address.
*/
return -1;
/*
*/
/*
* map the address block in a 1:1 fashion
*/
} else {
}
else {
/*
* Whilst not optimized for the case where
* pmin == pmax, the gain is not significant.
*/
} else
}
/*
* When the redirect-to address is set to 0.0.0.0, just
* assume a blank `forwarding' of the packet. We don't
* setup any translation for this either.
*/
return -1;
}
/*
* Check to see if this redirect mapping already exists and if
* it does, return "failure" (allowing it to be created will just
* cause one or both of these "connections" to stop working.)
*/
return (-1);
if (flags & IPN_TCPUDP) {
} else if (flags & IPN_ICMPQUERY) {
}
return move;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_new */
/* Returns: nat_t* - NULL == failure to create new NAT structure, */
/* else pointer to new NAT structure */
/* Parameters: fin(I) - pointer to packet information */
/* np(I) - pointer to NAT rule */
/* natsave(I) - pointer to where to store NAT struct pointer */
/* flags(I) - flags describing the current packet */
/* Write Lock: ipf_nat */
/* */
/* Attempts to create a new NAT entry. Does not actually change the packet */
/* in any way. */
/* */
/* This fucntion is in three main parts: (1) deal with creating a new NAT */
/* structure for a "MAP" rule (outgoing NAT translation); (2) deal with */
/* creating a new NAT structure for a "RDR" rule (incoming NAT translation) */
/* and (3) building that structure and putting it into the NAT table(s). */
/* ------------------------------------------------------------------------ */
int direction;
{
int move;
/*
* Trigger automatic call to nat_flushtable() if the
* table has reached capcity specified by hi watermark.
*/
/*
* If automatic flushing did not do its job, and the table
* has filled up, don't try to create a new entry.
*/
return NULL;
}
move = 1;
nflags &= NAT_FROMRULE;
/* Give me a new nat */
/*
* Try to automatically tune the max # of entries in the
* table allowed to be less than what will cause kmem_alloc()
* to fail and try to eliminate panics due to out of memory
* conditions arising.
*/
printf("ipf_nattable_max reduced to %d\n",
}
return NULL;
}
if (flags & IPN_TCPUDP) {
} else if (flags & IPN_ICMPQUERY) {
/*
* In the ICMP query NAT code, we translate the ICMP id fields
* to make them unique. This is indepedent of the ICMP type
* (e.g. in the unlikely event that a host sends an echo and
* an tstamp request with the same id, both packets will have
*/
/* The icmp_id field is used by the sender to identify the
* process making the icmp request. (the receiver justs
* copies it back in its response). So, it closely matches
* the concept of source port. We overlay sport, so we can
* maximally reuse the existing code.
*/
}
}
/*
* Search the current table for a match.
*/
if (direction == NAT_OUTBOUND) {
/*
* We can now arrange to call this for the same connection
* because ipf_nat_new doesn't protect the code path into
* this function.
*/
goto done;
}
if (move == -1)
goto badnat;
} else {
/*
* NAT_INBOUND is used only for redirects rules
*/
goto done;
}
if (move == -1)
goto badnat;
}
nat_delrdr(np);
nat_delnat(np);
}
}
goto badnat;
}
goto done;
fr_hostmapdel(&hm);
done:
}
return nat;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_finalise */
/* Returns: int - 0 == sucess, -1 == failure */
/* Parameters: fin(I) - pointer to packet information */
/* nat(I) - pointer to NAT entry */
/* ni(I) - pointer to structure with misc. information needed */
/* to create new NAT entry. */
/* Write Lock: ipf_nat */
/* */
/* This is the tail end of constructing a new NAT entry and is the same */
/* for both IPv4 and IPv6. */
/* ------------------------------------------------------------------------ */
/*ARGSUSED*/
int direction;
{
#ifdef IPFILTER_SYNC
#endif
return -1;
if (ifs->ifs_nat_logging)
}
return 0;
}
/*
* nat_insert failed, so cleanup time...
*/
return -1;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_insert */
/* Returns: int - 0 == sucess, -1 == failure */
/* Parameters: nat(I) - pointer to NAT structure */
/* Write Lock: ipf_nat */
/* */
/* Insert a NAT entry into the hash tables for searching and add it to the */
/* list of active NAT entries. Adjust global counters when complete. */
/* ------------------------------------------------------------------------ */
int rev;
{
/*
* Try and return an error as early as possible, so calculate the hash
* entry numbers first and then proceed.
*/
0xffffffff);
0xffffffff);
} else {
}
return -1;
}
} else {
}
if (ifs->ifs_nat_instances)
if (*natp)
if (*natp)
return 0;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_icmperrorlookup */
/* Returns: nat_t* - point to matching NAT structure */
/* Parameters: fin(I) - pointer to packet information */
/* */
/* Check if the ICMP error message is related to an existing TCP, UDP or */
/* ICMP query nat entry. It is assumed that the packet is already of the */
/* the required length. */
/* ------------------------------------------------------------------------ */
int dir;
{
u_int p;
/*
* Does it at least have the return (basic) IP header ?
* Only a basic IP header (no options) should be with an ICMP error
* header. Also, if it's not an error type, then return.
*/
return NULL;
/*
* Check packet size
*/
return NULL;
/*
* Is the buffer big enough for all of it ? It's the size of the IP
* header claimed in the encapsulated part which is of concern. It
* may be too big to be in this buffer but not so big that it's
* outside the ICMP packet, leading to TCP deref's causing problems.
* This is possible because we don't know how big oip_hl is when we
* do the pullup early in fr_check() and thus can't gaurantee it is
* all here now.
*/
#ifdef _KERNEL
{
mb_t *m;
# if defined(MENTAT)
return NULL;
# else
return NULL;
# endif
}
#endif
return NULL;
if (p == IPPROTO_TCP)
else if (p == IPPROTO_UDP)
else if (p == IPPROTO_ICMP) {
/* see if this is related to an ICMP query */
/*
* NOTE : dir refers to the direction of the original
* ip packet. By definition the icmp error
* message flows in the opposite direction.
*/
if (dir == NAT_INBOUND)
else
return nat;
}
}
if (flags & IPN_TCPUDP) {
return NULL;
if (dir == NAT_INBOUND) {
} else {
}
return nat;
}
if (dir == NAT_INBOUND)
else
}
/* ------------------------------------------------------------------------ */
/* Function: nat_icmperror */
/* Returns: nat_t* - point to matching NAT structure */
/* Parameters: fin(I) - pointer to packet information */
/* nflags(I) - NAT flags for this packet */
/* */
/* Fix up an ICMP packet which is an error message for an existing NAT */
/* session. This will correct both packet header data and checksums. */
/* */
/* This should *ONLY* be used for incoming ICMP error packets to make sure */
/* a NAT'd ICMP packet gets correctly recognised. */
/* ------------------------------------------------------------------------ */
int dir;
{
int dlen;
return NULL;
/*
* nat_icmperrorlookup() looks up nat entry associated with the
* offending IP packet and returns pointer to the entry, or NULL
* if packet wasn't natted or for `defective' packets.
*/
return NULL;
sumd2 = 0;
*nflags = IPN_ICMPERR;
/*
* Need to adjust ICMP header to include the real IP#'s and
* port #'s. There are three steps required.
*
* Step 1
* Fix the IP addresses in the offending IP packet and update
* ip header checksum to compensate for the change.
*
* No update needed here for icmp_cksum because the ICMP checksum
* is calculated over the complete ICMP packet, which includes the
* changed oip IP addresses and oip->ip_sum. These two changes
* cancel each other out (if the delta for the IP address is x,
* then the delta for ip_sum is minus x).
*/
} else {
}
/*
* Step 2
* Perform other adjustments based on protocol of offending packet.
*/
case IPPROTO_TCP :
case IPPROTO_UDP :
/*
* based on the NAT specification.
*
* Advance notice : Now it becomes complicated :-)
*
* Since the port and IP addresse fields are both part
* we need to adjust that checksum as well.
*
* may not be present. We must check to see if the
* length of the data portion is big enough to hold
* the checksum. In the UDP case, a test to determine
* if the checksum is even set is also required.
*
* Any changes to an IP address, port or checksum within
* the ICMP packet requires a change to icmp_cksum.
*
* Be extremely careful here ... The change is dependent
*
* compensate for checksum modification resulting from
* IP address change only. Port change and resulting
* data checksum adjustments cancel each other out.
*
* compensate for port change only. The IP address
* change does not modify anything else in this case.
*/
psum1 = 0;
psum2 = 0;
psumd = 0;
/*
* Translate the source port.
*/
/*
* Translate the destination port.
*/
}
/*
* TCP checksum present.
*
* Adjust data checksum and icmp checksum to
* compensate for any IP address change.
*/
/*
* Also make data checksum adjustment to
* compensate for any port change.
*/
}
/*
* The UDP checksum is present and set.
*
* Adjust data checksum and icmp checksum to
* compensate for any IP address change.
*/
/*
* Also make data checksum adjustment to
* compensate for any port change.
*/
}
} else {
/*
* Data checksum was not present.
*
* Compensate for any port change.
*/
}
break;
case IPPROTO_ICMP :
(dlen >= 8)) {
/*
* Fix ICMP checksum (of the offening ICMP
* query packet) to compensate the change
* in the ICMP id of the offending ICMP
* packet.
*
* Since you modify orgicmp->icmp_id with
* a delta (say x) and you compensate that
* in origicmp->icmp_cksum with a delta
* minus x, you don't have to adjust the
* overall icmp->icmp_cksum
*/
} /* nat_dir can't be NAT_INBOUND for icmp queries */
break;
default :
break;
} /* switch (oip->ip_p) */
/*
* Step 3
* Make the adjustments to icmp checksum.
*/
if (sumd2 != 0) {
}
return nat;
}
/*
* NB: these lookups don't lock access to the list, it assumed that it has
* already been done!
*/
/* ------------------------------------------------------------------------ */
/* Function: nat_inlookup */
/* Returns: nat_t* - NULL == no match, */
/* else pointer to matching NAT entry */
/* Parameters: fin(I) - pointer to packet information */
/* flags(I) - NAT flags for this packet */
/* p(I) - protocol for this packet */
/* src(I) - source IP address */
/* mapdst(I) - destination IP address */
/* */
/* we're looking for a table entry, based on the destination address. */
/* */
/* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */
/* */
/* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN */
/* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */
/* */
/* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */
/* the packet is of said protocol */
/* ------------------------------------------------------------------------ */
{
int nflags;
void *ifp;
else
sport = 0;
dport = 0;
switch (p)
{
case IPPROTO_TCP :
case IPPROTO_UDP :
break;
case IPPROTO_ICMP :
if (flags & IPN_ICMPERR)
else
break;
default :
break;
}
goto find_in_wild_ports;
continue;
continue;
(((p == 0) &&
switch (p)
{
#if 0
case IPPROTO_GRE :
continue;
break;
#endif
case IPPROTO_ICMP :
if ((flags & IPN_ICMPERR) != 0) {
continue;
} else {
continue;
}
break;
case IPPROTO_TCP :
case IPPROTO_UDP :
continue;
continue;
break;
default :
break;
}
continue;
return nat;
}
}
/*
* So if we didn't find it but there are wildcard members in the hash
* table, go back and look for them. We do this search and update here
* because it is modifying the NAT table and we want to do this only
* for the first packet that matches. The exception, of course, is
* for "dummy" (FI_IGNORE) lookups.
*/
return NULL;
return NULL;
continue;
continue;
continue;
continue;
continue;
NAT_INBOUND) == 1) {
break;
break;
} else {
}
break;
}
}
return nat;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_tabmove */
/* Returns: Nil */
/* Parameters: nat(I) - pointer to NAT structure */
/* Write Lock: ipf_nat */
/* */
/* original was placed in the table without hashing on the ports and we now */
/* want to include hashing on port numbers. */
/* ------------------------------------------------------------------------ */
{
return;
/*
* Remove the NAT entry from the old location
*/
/*
* Add into the NAT table in the new position
*/
if (*natp)
if (*natp)
}
/* ------------------------------------------------------------------------ */
/* Function: nat_outlookup */
/* Returns: nat_t* - NULL == no match, */
/* else pointer to matching NAT entry */
/* Parameters: fin(I) - pointer to packet information */
/* flags(I) - NAT flags for this packet */
/* p(I) - protocol for this packet */
/* src(I) - source IP address */
/* dst(I) - destination IP address */
/* rw(I) - 1 == write lock on ipf_nat held, 0 == read lock. */
/* */
/* we're looking for a table entry, based on the source address. */
/* */
/* NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY. */
/* */
/* NOTE: IT IS ASSUMED THAT ipf_nat IS ONLY HELD WITH A READ LOCK WHEN */
/* THIS FUNCTION IS CALLED WITH NAT_SEARCH SET IN nflags. */
/* */
/* flags -> relevant are IPN_UDP/IPN_TCP/IPN_ICMPQUERY that indicate if */
/* the packet is of said protocol */
/* ------------------------------------------------------------------------ */
{
int nflags;
void *ifp;
sport = 0;
dport = 0;
switch (p)
{
case IPPROTO_TCP :
case IPPROTO_UDP :
break;
case IPPROTO_ICMP :
if (flags & IPN_ICMPERR)
else
break;
default :
break;
}
goto find_out_wild_ports;
continue;
continue;
switch (p)
{
#if 0
case IPPROTO_GRE :
continue;
break;
#endif
case IPPROTO_TCP :
case IPPROTO_UDP :
continue;
continue;
break;
default :
break;
}
continue;
return nat;
}
}
/*
* So if we didn't find it but there are wildcard members in the hash
* table, go back and look for them. We do this search and update here
* because it is modifying the NAT table and we want to do this only
* for the first packet that matches. The exception, of course, is
* for "dummy" (FI_IGNORE) lookups.
*/
return NULL;
return NULL;
continue;
continue;
continue;
continue;
continue;
NAT_OUTBOUND) == 1) {
break;
break;
} else {
}
if (nat->nat_outport == 0)
break;
}
}
return nat;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_lookupredir */
/* Returns: nat_t* - NULL == no match, */
/* else pointer to matching NAT entry */
/* Parameters: np(I) - pointer to description of packet to find NAT table */
/* entry for. */
/* */
/* Lookup the NAT tables to search for a matching redirect */
/* ------------------------------------------------------------------------ */
{
} else {
}
/*
* We can do two sorts of lookups:
* - IPN_IN: we have the `real' and `out' address, look for `in'.
* - default: we have the `in' and `out' address, look for `real'.
*/
}
} else {
/*
* If nl_inip is non null, this is a lookup based on the real
* ip address. Else, we use the fake.
*/
}
}
}
}
return nat;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_match */
/* Returns: int - 0 == no match, 1 == match */
/* Parameters: fin(I) - pointer to packet information */
/* np(I) - pointer to NAT rule */
/* */
/* Pull the matching of a packet against a NAT rule out of that complex */
/* loop inside fr_checknatin() and lay it out properly in its own function. */
/* ------------------------------------------------------------------------ */
{
return 0;
return 0;
return 0;
return 0;
return 0;
} else {
return 0;
return 0;
return 0;
}
return 0;
return 1;
}
}
/* ------------------------------------------------------------------------ */
/* Function: nat_update */
/* Returns: Nil */
/* Parameters: fin(I) - pointer to packet information */
/* nat(I) - pointer to NAT structure */
/* np(I) - pointer to NAT rule */
/* Locks: nat_lock */
/* */
/* Updates the lifetime of a NAT table entry for non-TCP packets. Must be */
/* called with fin_rev updated - i.e. after calling nat_proto(). */
/* ------------------------------------------------------------------------ */
{
/*
* We allow over-riding of NAT timeouts from NAT rules, even for
* TCP, however, if it is TCP and there is no rule timeout set,
* then do not update the timeout here.
*/
else
} else {
else
}
}
}
/* ------------------------------------------------------------------------ */
/* Function: fr_checknatout */
/* Returns: int - -1 == packet failed NAT checks so block it, */
/* 0 == no packet translation occurred, */
/* 1 == packet was successfully translated. */
/* Parameters: fin(I) - pointer to packet information */
/* passp(I) - pointer to filtering result flags */
/* */
/* Check to see if an outcoming packet should be changed. ICMP packets are */
/* first checked to see if they match an existing entry (if an error), */
/* otherwise a search of the current NAT table is made. If neither results */
/* in a match then a search for a matching NAT rule is made. Create a new */
/* NAT entry if a we matched a NAT rule. Lastly, actually change the */
/* packet header(s) as required. */
/* ------------------------------------------------------------------------ */
{
if (ifs->ifs_fr_nat_lock != 0)
return 0;
return 0;
natfailed = 0;
{
case IPPROTO_TCP :
break;
case IPPROTO_UDP :
break;
case IPPROTO_ICMP :
/*
* This is an incoming packet, so the destination is
* the icmp_id and the source port equals 0
*/
break;
default :
break;
}
if ((nflags & IPN_TCPUDP))
}
/*EMPTY*/;
natadd = 0;
} else {
/*
* There is no current entry in the nat table for this packet.
*
* If the packet is a fragment, but not the first fragment,
* then don't do anything. Otherwise, if there is a matching
* nat rule, try to create a new nat entry.
*/
goto nonatfrag;
msk = 0xffffffff;
continue;
continue;
continue;
continue;
continue;
continue;
continue;
continue;
continue;
}
break;
}
natfailed = -1;
}
while (nmsk) {
msk <<= 1;
if (nmsk & 0x80000000)
break;
nmsk <<= 1;
}
if (nmsk != 0) {
nmsk <<= 1;
goto maskloop;
}
}
}
if (rval == 1) {
}
} else
if (rval == -1) {
}
return rval;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_natout */
/* Returns: int - -1 == packet failed NAT checks so block it, */
/* 1 == packet was successfully translated. */
/* Parameters: fin(I) - pointer to packet information */
/* nat(I) - pointer to NAT structure */
/* natadd(I) - flag indicating if it is safe to add frag cache */
/* nflags(I) - NAT flags set for this packet */
/* */
/* Translate a packet coming "out" on an interface. */
/* ------------------------------------------------------------------------ */
int natadd;
{
int i;
#ifdef USE_INET6
#else
return NULL;
#endif
}
#endif
/*
* Fix up checksums, not by recalculating them, but
* simply computing adjustments.
* This is only done for STREAMS based IP implementations where the
* checksum has already been calculated by IP. In all other cases,
* IPFilter is called before the checksum needs calculating so there
* is no call to modify whatever is in the header now.
*/
if (nflags == IPN_ICMPERR) {
}
defined(linux) || defined(BRIDGE_IPF)
else {
/*
* Strictly speaking, this isn't necessary on BSD
* kernels because they do checksum calculation after
* this code has run BUT if ipfilter is being used
* to do NAT as a bridge, that code doesn't exist.
*/
nat->nat_ipsumd);
else
nat->nat_ipsumd);
}
#endif
}
}
}
}
/*
* The above comments do not hold for layer 4 (or higher) checksums...
*/
if (nflags & IPN_TCPUDP &&
else
else
}
#ifdef IPFILTER_SYNC
#endif
/* ------------------------------------------------------------- */
/* A few quick notes: */
/* Following are test conditions prior to calling the */
/* appr_check routine. */
/* */
/* with a redirect rule, we attempt to match the packet's */
/* source port against in_dport, otherwise we'd compare the */
/* packet's destination. */
/* ------------------------------------------------------------- */
if (i == 0)
i = 1;
} else
i = 1;
return i;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_checknatin */
/* Returns: int - -1 == packet failed NAT checks so block it, */
/* 0 == no packet translation occurred, */
/* 1 == packet was successfully translated. */
/* Parameters: fin(I) - pointer to packet information */
/* passp(I) - pointer to filtering result flags */
/* */
/* Check to see if an incoming packet should be changed. ICMP packets are */
/* first checked to see if they match an existing entry (if an error), */
/* otherwise a search of the current NAT table is made. If neither results */
/* in a match then a search for a matching NAT rule is made. Create a new */
/* NAT entry if a we matched a NAT rule. Lastly, actually change the */
/* packet header(s) as required. */
/* ------------------------------------------------------------------------ */
{
if (ifs->ifs_fr_nat_lock != 0)
return 0;
return 0;
dport = 0;
natadd = 1;
nflags = 0;
natfailed = 0;
{
case IPPROTO_TCP :
break;
case IPPROTO_UDP :
break;
case IPPROTO_ICMP :
/*
* This is an incoming packet, so the destination is
* the icmp_id and the source port equals 0
*/
} break;
default :
break;
}
if ((nflags & IPN_TCPUDP)) {
}
}
/*EMPTY*/;
natadd = 0;
} else {
/*
* There is no current entry in the nat table for this packet.
*
* If the packet is a fragment, but not the first fragment,
* then don't do anything. Otherwise, if there is a matching
* nat rule, try to create a new nat entry.
*/
goto nonatfrag;
msk = 0xffffffff;
continue;
continue;
continue;
continue;
continue;
} else {
continue;
continue;
}
continue;
}
}
break;
}
natfailed = -1;
}
while (rmsk) {
msk <<= 1;
if (rmsk & 0x80000000)
break;
rmsk <<= 1;
}
if (rmsk != 0) {
rmsk <<= 1;
goto maskloop;
}
}
}
if (rval == 1) {
}
} else
if (rval == -1) {
}
return rval;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_natin */
/* Returns: int - -1 == packet failed NAT checks so block it, */
/* 1 == packet was successfully translated. */
/* Parameters: fin(I) - pointer to packet information */
/* nat(I) - pointer to NAT structure */
/* natadd(I) - flag indicating if it is safe to add frag cache */
/* nflags(I) - NAT flags set for this packet */
/* Locks Held: ipf_nat (READ) */
/* */
/* Translate a packet coming "in" on an interface. */
/* ------------------------------------------------------------------------ */
int natadd;
{
int i;
#ifdef USE_INET6
#else
return NULL;
#endif
}
#endif
/* ------------------------------------------------------------- */
/* A few quick notes: */
/* Following are test conditions prior to calling the */
/* appr_check routine. */
/* */
/* with a map rule, we attempt to match the packet's */
/* source port against in_dport, otherwise we'd compare the */
/* packet's destination. */
/* ------------------------------------------------------------- */
if (i == -1) {
return -1;
}
}
}
#ifdef IPFILTER_SYNC
#endif
if (nflags & IPN_TCPUDP)
/*
* Fix up checksums, not by recalculating them, but
* simply computing adjustments.
* Why only do this for some platforms on inbound packets ?
* Because for those that it is done, IP processing is yet to happen
* and so the IPv4 header checksum has not yet been evaluated.
* Perhaps it should always be done for the benefit of things like
* fast forwarding (so that it doesn't need to be recomputed) but with
* header checksum offloading, perhaps it is a moot point.
*/
else
#endif
}
}
}
/*
* In case they are being forwarded, inbound packets always need to have
* their checksum adjusted even if hardware checksum validation said OK.
*/
else
}
if (nflags & IPN_TCPUDP &&
/*
* Need to adjust the partial checksum result stored in
* db_cksum16, which will be used for validation in IP.
* See IP_CKSUM_RECV().
* Adjustment data should be the inverse of the IP address
* changes, because db_cksum16 is supposed to be the complement
* of the pesudo header.
*/
else
}
#endif
return 1;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_proto */
/* Returns: u_short* - pointer to transport header checksum to update, */
/* NULL if the transport protocol is not recognised */
/* as needing a checksum update. */
/* Parameters: fin(I) - pointer to packet information */
/* nat(I) - pointer to NAT structure */
/* nflags(I) - NAT flags set for this packet */
/* */
/* Return the pointer to the checksum field for each protocol so understood.*/
/* If support for making other changes to a protocol header is required, */
/* that is not strictly 'address' translation, such as clamping the MSS in */
/* TCP down to a specific value, then do it from here. */
/* ------------------------------------------------------------------------ */
{
} else {
}
{
case IPPROTO_TCP :
/*
* Do a MSS CLAMPING on a SYN packet,
* only deal IPv4 for now.
*/
break;
case IPPROTO_UDP :
break;
case IPPROTO_ICMP :
if ((nflags & IPN_ICMPQUERY) != 0) {
if (icmp->icmp_cksum != 0)
}
break;
case IPPROTO_ICMPV6 :
if ((nflags & IPN_ICMPQUERY) != 0) {
if (icmp6->icmp6_cksum != 0)
}
break;
}
return csump;
}
/* ------------------------------------------------------------------------ */
/* Function: fr_natunload */
/* Returns: Nil */
/* Parameters: ifs - ipf stack instance */
/* */
/* Free all memory used by NAT structures allocated at runtime. */
/* ------------------------------------------------------------------------ */
{
(void) nat_clearlist(ifs);
/*
* Proxy timeout queues are not cleaned here because although they
* exist on the NAT list, appr_unload is called after fr_natunload
* and the proxies actually are responsible for them being created.
* Should the proxy timeouts have their own list? There's no real
* justification as this is the only complication.
*/
(fr_deletetimeoutqueue(ifq) == 0))
}
}
}
}
}
}
}
}
ifs->ifs_fr_nat_maxbucket = 0;
ifs->ifs_fr_nat_init = 0;
}
}
/* ------------------------------------------------------------------------ */
/* Function: fr_natexpire */
/* Returns: Nil */
/* Parameters: ifs - ipf stack instance */
/* */
/* Check all of the timeout queues for entries at the top which need to be */
/* expired. */
/* ------------------------------------------------------------------------ */
{
int i;
SPL_INT(s);
SPL_NET(s);
break;
}
}
break;
}
}
}
}
if (ifs->ifs_nat_doflush != 0) {
ifs->ifs_nat_doflush = 0;
}
SPL_X(s);
}
/* ------------------------------------------------------------------------ */
/* Function: fr_nataddrsync */
/* Returns: Nil */
/* Parameters: ifp(I) - pointer to network interface */
/* addr(I) - pointer to new network address */
/* */
/* Walk through all of the currently active NAT sessions, looking for those */
/* which need to have their translated address updated (where the interface */
/* matches the one passed in) and change it, recalculating the checksum sum */
/* difference too. */
/* ------------------------------------------------------------------------ */
int v;
void *ifp;
void *addr;
{
SPL_INT(s);
if (ifs->ifs_fr_running <= 0)
return;
SPL_NET(s);
if (ifs->ifs_fr_running <= 0) {
return;
}
/*
* Change IP addresses for NAT sessions for any protocol except TCP
* since it will break the TCP connection anyway. The only rules
* which will get changed are those which are "map ... -> 0/32",
* where the rule specifies the address is taken from the interface.
*/
continue;
continue;
continue;
/*
* Change the map-to address to be the same as
* the new one.
*/
continue;
/*
* Change the map-to address to be the same as
* the new one.
*/
} else
continue;
continue;
/*
* Change the map-to address to be the same as
* the new one.
*/
continue;
/*
* Change the map-to address to be the same as
* the new one.
*/
} else
continue;
} else {
continue;
}
continue;
/*
* Readjust the checksum adjustment to take into
* account the new IP#.
*/
/* XXX - dont change for TCP when solaris does
* hardware checksumming.
*/
}
SPL_X(s);
}
/* ------------------------------------------------------------------------ */
/* Function: fr_natifpsync */
/* Returns: Nil */
/* Parameters: action(I) - how we are syncing */
/* ifp(I) - pointer to network interface */
/* name(I) - name of interface to sync to */
/* */
/* This function is used to resync the mapping of interface names and their */
/* respective 'pointers'. For "action == IPFSYNC_RESYNC", resync all */
/* interfaces by doing a new lookup of name to 'pointer'. For "action == */
/* IPFSYNC_NEWIFP", treat ifp as the new pointer value associated with */
/* "name" and for "action == IPFSYNC_OLDIFP", ifp is a pointer for which */
/* there is no longer any interface associated with it. */
/* ------------------------------------------------------------------------ */
int action, v;
void *ifp;
char *name;
{
int s;
#endif
ipnat_t *n;
int nv;
if (ifs->ifs_fr_running <= 0)
return;
SPL_NET(s);
if (ifs->ifs_fr_running <= 0) {
return;
}
switch (action)
{
case IPFSYNC_RESYNC :
continue;
}
}
}
continue;
n->in_ifps[0] == (void *)-1) {
n->in_ifps[0] =
}
n->in_ifps[1] =
}
}
break;
case IPFSYNC_NEWIFP :
continue;
sizeof(nat->nat_ifnames[0])))
}
if ((int)n->in_v != v)
continue;
sizeof(n->in_ifnames[0])))
sizeof(n->in_ifnames[1])))
}
break;
case IPFSYNC_OLDIFP :
continue;
}
if ((int)n->in_v != v)
continue;
n->in_ifps[0] = (void *)-1;
}
break;
}
SPL_X(s);
}
#if SOLARIS2 >= 10
/* ------------------------------------------------------------------------ */
/* Function: fr_natifindexsync */
/* Returns: void */
/* Parameters: ifp - interface, which is being sync'd */
/* newifp - new ifindex value for interface */
/* ifs - IPF's stack */
/* */
/* Write Locks: assumes ipf_mutex is locked */
/* */
/* Updates all interface index references in NAT rules and NAT entries. */
/* the index, which is about to be updated must match ifp value. */
/* ------------------------------------------------------------------------ */
void *ifp;
void *newifp;
{
ipnat_t *n;
}
}
}
#endif
/* ------------------------------------------------------------------------ */
/* Function: nat_icmpquerytype4 */
/* Returns: int - 1 == success, 0 == failure */
/* Parameters: icmptype(I) - ICMP type number */
/* */
/* not. */
/* ------------------------------------------------------------------------ */
int icmptype;
{
/*
* For the ICMP query NAT code, it is essential that both the query
* and the reply match on the NAT rule. Because the NAT structure
* does not keep track of the icmptype, and a single NAT structure
* is used for all icmp types with the same src, dest and id, we
* simply define the replies as queries as well. The funny thing is,
* altough it seems silly to call a reply a query, this is exactly
* as it is defined in the IPv4 specification
*/
switch (icmptype)
{
case ICMP_ECHOREPLY:
case ICMP_ECHO:
/* route aedvertisement/solliciation is currently unsupported: */
/* it would require rewriting the ICMP data section */
case ICMP_TSTAMP:
case ICMP_TSTAMPREPLY:
case ICMP_IREQ:
case ICMP_IREQREPLY:
case ICMP_MASKREQ:
case ICMP_MASKREPLY:
return 1;
default:
return 0;
}
}
/* ------------------------------------------------------------------------ */
/* Function: nat_log */
/* Returns: Nil */
/* Parameters: nat(I) - pointer to NAT structure */
/* type(I) - type of log entry to create */
/* */
/* Creates a NAT log entry. */
/* ------------------------------------------------------------------------ */
{
#ifdef IPFILTER_LOG
# ifndef LARGE_NAT
int rulen;
# endif
# ifndef LARGE_NAT
break;
}
}
# endif
types[0] = 0;
#endif
}
#if defined(__OpenBSD__)
/* ------------------------------------------------------------------------ */
/* Function: nat_ifdetach */
/* Returns: Nil */
/* Parameters: ifp(I) - pointer to network interface */
/* */
/* Compatibility interface for OpenBSD to trigger the correct updating of */
/* interface references within IPFilter. */
/* ------------------------------------------------------------------------ */
void *ifp;
{
return;
}
#endif
/* ------------------------------------------------------------------------ */
/* Function: fr_ipnatderef */
/* Returns: Nil */
/* Parameters: inp(I) - pointer to pointer to NAT rule */
/* Write Locks: ipf_nat */
/* */
/* ------------------------------------------------------------------------ */
{
#ifdef notdef
#if SOLARIS
#endif
#endif
}
}
/* ------------------------------------------------------------------------ */
/* Function: fr_natderef */
/* Returns: Nil */
/* Parameters: natp - pointer to pointer to NAT table entry */
/* ifs - ipf stack instance */
/* */
/* Decrement the reference counter for this NAT table entry and free it if */
/* there are no more things using it. */
/* */
/* IF nat_ref == 1 when this function is called, then we have an orphan nat */
/* structure *because* it only gets called on paths _after_ nat_ref has been*/
/* incremented. If nat_ref == 1 then we shouldn't decrement it here */
/* because nat_delete() will do that and send nat_ref to -1. */
/* */
/* Holding the lock on nat_lock is required to serialise nat_delete() being */
/* called from a NAT flush ioctl with a deref happening because of a packet.*/
/* ------------------------------------------------------------------------ */
{
return;
}
}
/* ------------------------------------------------------------------------ */
/* Function: fr_natclone */
/* Returns: ipstate_t* - NULL == cloning failed, */
/* else pointer to new NAT structure */
/* Parameters: fin(I) - pointer to packet information */
/* nat(I) - pointer to master NAT structure */
/* Write Lock: ipf_nat */
/* */
/* Create a "duplicate" NAT table entry from the master. */
/* ------------------------------------------------------------------------ */
{
/*
* Trigger automatic call to nat_flushtable() if the
* table has reached capcity specified by hi watermark.
*/
/*
* If automatic flushing did not do its job, and the table
* has filled up, don't try to create a new entry.
*/
return NULL;
}
return NULL;
/*
* Initialize all these so that nat_delete() doesn't cause a crash.
*/
return NULL;
}
if (ifs->ifs_nat_logging)
}
}
/*
* Because the clone is created outside the normal loop of things and
* TCP has special needs in terms of state, initialise the timeout
* state of the new NAT from here.
*/
}
#ifdef IPFILTER_SYNC
#endif
if (ifs->ifs_nat_logging)
return clone;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_wildok */
/* Returns: int - 1 == packet's ports match wildcards */
/* 0 == packet's ports don't match wildcards */
/* Parameters: nat(I) - NAT entry */
/* sport(I) - source port */
/* dport(I) - destination port */
/* flags(I) - wildcard flags */
/* dir(I) - packet direction */
/* */
/* Use NAT entry and packet direction to determine which combination of */
/* wildcard flags should be used. */
/* ------------------------------------------------------------------------ */
int sport;
int dport;
int flags;
int dir;
{
/*
* When called by dir is set to
* nat_inlookup NAT_INBOUND (0)
* nat_outlookup NAT_OUTBOUND (1)
*
* We simply combine the packet's direction in dir with the original
* "intended" direction of that NAT entry in nat->nat_dir to decide
* which combination of wildcard flags to allow.
*/
{
case 3: /* outbound packet / outbound entry */
(flags & SI_W_SPORT)) &&
(flags & SI_W_DPORT)))
return 1;
break;
case 2: /* outbound packet / inbound entry */
(flags & SI_W_DPORT)) &&
(flags & SI_W_SPORT)))
return 1;
break;
case 1: /* inbound packet / outbound entry */
(flags & SI_W_DPORT)) &&
(flags & SI_W_SPORT)))
return 1;
break;
case 0: /* inbound packet / inbound entry */
(flags & SI_W_SPORT)) &&
(flags & SI_W_DPORT)))
return 1;
break;
default:
break;
}
return(0);
}
/* ------------------------------------------------------------------------ */
/* Function: nat_mssclamp */
/* Returns: Nil */
/* Parameters: tcp(I) - pointer to TCP header */
/* maxmss(I) - value to clamp the TCP MSS to */
/* csump(I) - pointer to TCP checksum */
/* */
/* Check for MSS option and clamp it if necessary. If found and changed, */
/* then the TCP header checksum will be updated to reflect the change in */
/* the MSS. */
/* ------------------------------------------------------------------------ */
{
if (opt == TCPOPT_EOL)
break;
else if (opt == TCPOPT_NOP) {
cp++;
continue;
}
break;
break;
switch (opt)
{
case TCPOPT_MAXSEG:
if (advance != 4)
break;
}
break;
default:
/* ignore unknown options */
break;
}
}
}
}
/* ------------------------------------------------------------------------ */
/* Function: fr_setnatqueue */
/* Returns: Nil */
/* Parameters: nat(I)- pointer to NAT structure */
/* rev(I) - forward(0) or reverse(1) direction */
/* Locks: ipf_nat (read or write) */
/* */
/* Put the NAT entry on its default queue entry, using rev as a helped in */
/* determining which queue it should be placed on. */
/* ------------------------------------------------------------------------ */
int rev;
{
else
{
case IPPROTO_UDP :
break;
case IPPROTO_ICMP :
break;
case IPPROTO_TCP :
break;
default :
break;
}
}
/*
* If it's currently on a timeout queue, move it from one queue to
* another, else put it on the end of the newly determined queue.
*/
else
return;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_getnext */
/* Returns: int - 0 == ok, else error */
/* Parameters: t(I) - pointer to ipftoken structure */
/* itp(I) - pointer to ipfgeniter_t structure */
/* ifs - ipf stack instance */
/* */
/* and copy it out to the storage space pointed to by itp. The next item */
/* in the list to look at is put back in the ipftoken struture. */
/* ------------------------------------------------------------------------ */
ipftoken_t *t;
{
char *dst;
if (itp->igi_nitems == 0)
return EINVAL;
/*
* Get "previous" entry from the token and find the next entry.
*/
{
case IPFGENITER_HOSTMAP :
} else {
}
break;
case IPFGENITER_IPNAT :
} else {
}
break;
case IPFGENITER_NAT :
} else {
}
break;
default :
return EINVAL;
}
/*
* Note, this loop is based on the number of items that a user
* requested. The user can request any number, potentially far more than
* the number of items that actually exist. If a user does that, we'll
* break out of this by setting the value of count to 1 which terminates
* the loop. This should be fine from an ioctl perspective, because the
* last entry that we insert will be the zero entry which terminates the
* chain.
*/
/*
* If we found an entry, add a reference to it and update the token.
* Otherwise, zero out data to be returned and NULL out token.
*/
{
case IPFGENITER_HOSTMAP :
} else {
}
break;
case IPFGENITER_IPNAT :
} else {
}
break;
case IPFGENITER_NAT :
} else {
}
break;
default :
break;
}
/*
* Now that we have ref, it's save to give up lock.
*/
/*
* Copy out data and clean up references and token as needed.
*/
{
case IPFGENITER_HOSTMAP :
if (error != 0)
ipf_freetoken(t, ifs);
count = 1;
break;
} else {
fr_hostmapdel(&hm);
}
ipf_freetoken(t, ifs);
count = 1;
break;
}
}
break;
case IPFGENITER_IPNAT :
if (error != 0)
ipf_freetoken(t, ifs);
count = 1;
break;
} else {
}
ipf_freetoken(t, ifs);
count = 1;
break;
}
}
break;
case IPFGENITER_NAT :
if (error != 0)
ipf_freetoken(t, ifs);
count = 1;
break;
} else {
ipf_freetoken(t, ifs);
count = 1;
break;
}
}
break;
default :
break;
}
break;
}
return error;
}
/* ------------------------------------------------------------------------ */
/* Function: nat_iterator */
/* Returns: int - 0 == ok, else error */
/* Parameters: token(I) - pointer to ipftoken structure */
/* itp(I) - pointer to ipfgeniter_t structure */
/* */
/* This function acts as a handler for the SIOCGENITER ioctls that use a */
/* generic structure to iterate through a list. There are three different */
/* linked lists of NAT related information to go through: NAT rules, active */
/* NAT mappings and the NAT fragment cache. */
/* ------------------------------------------------------------------------ */
{
int error;
return EFAULT;
{
case IPFGENITER_HOSTMAP :
case IPFGENITER_IPNAT :
case IPFGENITER_NAT :
break;
case IPFGENITER_NATFRAG :
break;
default :
break;
}
return error;
}
/* ---------------------------------------------------------------------- */
/* Function: nat_flushtable */
/* Returns: int - 0 == success, -1 == failure */
/* Parameters: flush_option - how to flush the active NAT table */
/* ifs - ipf stack instance */
/* Write Locks: ipf_nat */
/* */
/* Flush NAT tables. Three actions currently defined: */
/* */
/* FLUSH_TABLE_ALL : Flush all NAT table entries */
/* */
/* FLUSH_TABLE_CLOSING : Flush entries with TCP connections which */
/* have started to close on both ends using */
/* ipf_flushclosing(). */
/* */
/* FLUSH_TABLE_EXTRA : First, flush entries which are "almost" closed. */
/* Then, if needed, flush entries with TCP */
/* connections which have been idle for a long */
/* time with ipf_extraflush(). */
/* ---------------------------------------------------------------------- */
int flush_option;
{
int removed;
SPL_INT(s);
removed = 0;
SPL_NET(s);
switch (flush_option)
{
case FLUSH_TABLE_ALL:
removed++;
}
break;
case FLUSH_TABLE_CLOSING:
ifs);
break;
case FLUSH_TABLE_EXTRA:
ifs);
/*
* Be sure we haven't done this in the last 10 seconds.
*/
IPF_TTLVAL(10))
break;
ifs);
break;
default: /* Flush Nothing */
break;
}
SPL_X(s);
return (removed);
}
/* ------------------------------------------------------------------------ */
/* Function: nat_uncreate */
/* Returns: Nil */
/* Parameters: fin(I) - pointer to packet information */
/* */
/* This function is used to remove a NAT entry from the NAT table when we */
/* decide that the create was actually in error. It is thus assumed that */
/* fin_flx will have both FI_NATED and FI_NATNEW set. Because we're dealing */
/* with the translated packet (not the original), we have to reverse the */
/* lookup. Although doing the lookup is expensive (relatively speaking), it */
/* is not anticipated that this will be a frequent occurance for normal */
/* traffic patterns. */
/* ------------------------------------------------------------------------ */
{
int nflags;
{
case IPPROTO_TCP :
break;
case IPPROTO_UDP :
break;
default :
nflags = 0;
break;
}
} else {
}
} else {
}
}