2 * Copyright (C) 1995-2001 by Darren Reed.
4 * See the IPFILTER.LICENCE file for details on licencing.
6 * Added redirect stuff and a LOT of bug fixes. (mcn@EnGarde.com)
8 * @(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed
9 * @(#)$Id: ip_nat.c,v 2.37.2.70 2002/08/28 12:45:48 darrenr Exp $
10 * $FreeBSD: src/sys/contrib/ipfilter/netinet/ip_nat.c,v 1.22.2.7 2003/03/01 03:55:54 darrenr Exp $
11 * $DragonFly: src/sys/contrib/ipfilter/netinet/ip_nat.c,v 1.2 2003/06/17 04:28:20 dillon Exp $
13 #if defined(__FreeBSD__) && defined(KERNEL) && !defined(_KERNEL)
17 #if defined(__sgi) && (IRIX > 602)
18 # include <sys/ptimers.h>
20 #include <sys/errno.h>
21 #include <sys/types.h>
22 #include <sys/param.h>
25 #if defined(__NetBSD__) && (NetBSD >= 199905) && !defined(IPFILTER_LKM) && \
27 # include "opt_ipfilter_log.h"
29 #if !defined(_KERNEL) && !defined(KERNEL)
34 #if (defined(KERNEL) || defined(_KERNEL)) && (__FreeBSD_version >= 220000)
35 # include <sys/filio.h>
36 # include <sys/fcntl.h>
38 # include <sys/ioctl.h>
40 #include <sys/fcntl.h>
42 # include <sys/protosw.h>
44 #include <sys/socket.h>
45 #if defined(_KERNEL) && !defined(linux)
46 # include <sys/systm.h>
48 #if !defined(__SVR4) && !defined(__svr4__)
50 # include <sys/mbuf.h>
53 # include <sys/filio.h>
54 # include <sys/byteorder.h>
56 # include <sys/dditypes.h>
58 # include <sys/stream.h>
59 # include <sys/kmem.h>
61 #if __FreeBSD_version >= 300000
62 # include <sys/queue.h>
65 #if __FreeBSD_version >= 300000
66 # include <net/if_var.h>
67 # if defined(_KERNEL) && !defined(IPFILTER_LKM)
68 # include "opt_ipfilter.h"
74 #include <net/route.h>
75 #include <netinet/in.h>
76 #include <netinet/in_systm.h>
77 #include <netinet/ip.h>
80 # ifdef IFF_DRVRLOCK /* IRIX6 */
81 #include <sys/hashing.h>
82 #include <netinet/in_var.h>
88 # include <vpn/ipsec.h>
89 extern struct ifnet vpnif;
93 # include <netinet/ip_var.h>
94 # include <netinet/tcp_fsm.h>
96 #include <netinet/tcp.h>
97 #include <netinet/udp.h>
98 #include <netinet/ip_icmp.h>
99 #include "netinet/ip_compat.h"
100 #include <netinet/tcpip.h>
101 #include "netinet/ip_fil.h"
102 #include "netinet/ip_nat.h"
103 #include "netinet/ip_frag.h"
104 #include "netinet/ip_state.h"
105 #include "netinet/ip_proxy.h"
106 #if (__FreeBSD_version >= 300000)
107 # include <sys/malloc.h>
110 # define MIN(a,b) (((a)<(b))?(a):(b))
113 #define SOCKADDR_IN struct sockaddr_in
115 static const char sccsid[] = "@(#)ip_nat.c 1.11 6/5/96 (C) 1995 Darren Reed";
117 nat_t **nat_table[2] = { NULL, NULL },
118 *nat_instances = NULL;
119 ipnat_t *nat_list = NULL;
120 u_int ipf_nattable_sz = NAT_TABLE_SZ;
121 u_int ipf_natrules_sz = NAT_SIZE;
122 u_int ipf_rdrrules_sz = RDR_SIZE;
123 u_int ipf_hostmap_sz = HOSTMAP_SIZE;
124 u_32_t nat_masks = 0;
125 u_32_t rdr_masks = 0;
126 ipnat_t **nat_rules = NULL;
127 ipnat_t **rdr_rules = NULL;
128 hostmap_t **maptable = NULL;
130 u_long fr_defnatage = DEF_NAT_AGE,
131 fr_defnaticmpage = 6; /* 3 seconds */
134 #if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
135 extern kmutex_t ipf_rw;
136 extern KRWLOCK_T ipf_nat;
139 static int nat_flushtable __P((void));
140 static void nat_addnat __P((struct ipnat *));
141 static void nat_addrdr __P((struct ipnat *));
142 static void nat_delete __P((struct nat *));
143 static void nat_delrdr __P((struct ipnat *));
144 static void nat_delnat __P((struct ipnat *));
145 static int fr_natgetent __P((caddr_t));
146 static int fr_natgetsz __P((caddr_t));
147 static int fr_natputent __P((caddr_t));
148 static void nat_tabmove __P((fr_info_t *, nat_t *));
149 static int nat_match __P((fr_info_t *, ipnat_t *, ip_t *));
150 static hostmap_t *nat_hostmap __P((ipnat_t *, struct in_addr,
152 static void nat_hostmapdel __P((struct hostmap *));
153 static void nat_mssclamp __P((tcphdr_t *, u_32_t, fr_info_t *, u_short *));
158 KMALLOCS(nat_table[0], nat_t **, sizeof(nat_t *) * ipf_nattable_sz);
159 if (nat_table[0] != NULL)
160 bzero((char *)nat_table[0], ipf_nattable_sz * sizeof(nat_t *));
164 KMALLOCS(nat_table[1], nat_t **, sizeof(nat_t *) * ipf_nattable_sz);
165 if (nat_table[1] != NULL)
166 bzero((char *)nat_table[1], ipf_nattable_sz * sizeof(nat_t *));
170 KMALLOCS(nat_rules, ipnat_t **, sizeof(ipnat_t *) * ipf_natrules_sz);
171 if (nat_rules != NULL)
172 bzero((char *)nat_rules, ipf_natrules_sz * sizeof(ipnat_t *));
176 KMALLOCS(rdr_rules, ipnat_t **, sizeof(ipnat_t *) * ipf_rdrrules_sz);
177 if (rdr_rules != NULL)
178 bzero((char *)rdr_rules, ipf_rdrrules_sz * sizeof(ipnat_t *));
182 KMALLOCS(maptable, hostmap_t **, sizeof(hostmap_t *) * ipf_hostmap_sz);
183 if (maptable != NULL)
184 bzero((char *)maptable, sizeof(hostmap_t *) * ipf_hostmap_sz);
191 static void nat_addrdr(n)
199 k = countbits(n->in_outmsk);
200 if ((k >= 0) && (k != 32))
202 j = (n->in_outip & n->in_outmsk);
203 hv = NAT_HASH_FN(j, 0, ipf_rdrrules_sz);
206 np = &(*np)->in_rnext;
213 static void nat_addnat(n)
221 k = countbits(n->in_inmsk);
222 if ((k >= 0) && (k != 32))
224 j = (n->in_inip & n->in_inmsk);
225 hv = NAT_HASH_FN(j, 0, ipf_natrules_sz);
228 np = &(*np)->in_mnext;
235 static void nat_delrdr(n)
239 n->in_rnext->in_prnext = n->in_prnext;
240 *n->in_prnext = n->in_rnext;
244 static void nat_delnat(n)
248 n->in_mnext->in_pmnext = n->in_pmnext;
249 *n->in_pmnext = n->in_mnext;
254 * check if an ip address has already been allocated for a given mapping that
255 * is not doing port based translation.
257 * Must be called with ipf_nat held as a write lock.
259 static struct hostmap *nat_hostmap(np, real, map)
267 hv = real.s_addr % HOSTMAP_SIZE;
268 for (hm = maptable[hv]; hm; hm = hm->hm_next)
269 if ((hm->hm_realip.s_addr == real.s_addr) &&
270 (np == hm->hm_ipnat)) {
275 KMALLOC(hm, hostmap_t *);
277 hm->hm_next = maptable[hv];
278 hm->hm_pnext = maptable + hv;
280 maptable[hv]->hm_pnext = &hm->hm_next;
283 hm->hm_realip = real;
292 * Must be called with ipf_nat held as a write lock.
294 static void nat_hostmapdel(hm)
297 ATOMIC_DEC32(hm->hm_ref);
298 if (hm->hm_ref == 0) {
300 hm->hm_next->hm_pnext = hm->hm_pnext;
301 *hm->hm_pnext = hm->hm_next;
307 void fix_outcksum(fin, sp, n)
312 register u_short sumshort;
313 register u_32_t sum1;
317 else if (n & NAT_HW_CKSUM) {
320 n = (n & 0xffff) + (n >> 16);
324 sum1 = (~ntohs(*sp)) & 0xffff;
326 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
328 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
329 sumshort = ~(u_short)sum1;
330 *(sp) = htons(sumshort);
334 void fix_incksum(fin, sp, n)
339 register u_short sumshort;
340 register u_32_t sum1;
344 else if (n & NAT_HW_CKSUM) {
347 n = (n & 0xffff) + (n >> 16);
352 sum1 = (~(*sp)) & 0xffff;
354 sum1 = (~ntohs(*sp)) & 0xffff;
356 sum1 += ~(n) & 0xffff;
357 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
359 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
360 sumshort = ~(u_short)sum1;
361 *(sp) = htons(sumshort);
366 * fix_datacksum is used *only* for the adjustments of checksums in the data
367 * section of an IP packet.
369 * The only situation in which you need to do this is when NAT'ing an
370 * ICMP error message. Such a message, contains in its body the IP header
371 * of the original IP packet, that causes the error.
373 * You can't use fix_incksum or fix_outcksum in that case, because for the
374 * kernel the data section of the ICMP error is just data, and no special
375 * processing like hardware cksum or ntohs processing have been done by the
376 * kernel on the data section.
378 void fix_datacksum(sp, n)
382 register u_short sumshort;
383 register u_32_t sum1;
388 sum1 = (~ntohs(*sp)) & 0xffff;
390 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
392 sum1 = (sum1 >> 16) + (sum1 & 0xffff);
393 sumshort = ~(u_short)sum1;
394 *(sp) = htons(sumshort);
398 * How the NAT is organised and works.
400 * Inside (interface y) NAT Outside (interface x)
401 * -------------------- -+- -------------------------------------
402 * Packet going | out, processsed by ip_natout() for x
403 * ------------> | ------------>
404 * src=10.1.1.1 | src=192.1.1.1
406 * | in, processed by ip_natin() for x
407 * <------------ | <------------
408 * dst=10.1.1.1 | dst=192.1.1.1
409 * -------------------- -+- -------------------------------------
410 * ip_natout() - changes ip_src and if required, sport
411 * - creates a new mapping, if required.
412 * ip_natin() - changes ip_dst and if required, dport
414 * In the NAT table, internal source is recorded as "in" and externally
419 * Handle ioctls which manipulate the NAT.
421 int nat_ioctl(data, cmd, mode)
422 #if defined(__NetBSD__) || defined(__OpenBSD__) || (__FreeBSD_version >= 300003)
430 register ipnat_t *nat, *nt, *n = NULL, **np = NULL;
431 int error = 0, ret, arg, getlock;
435 #if (BSD >= 199306) && defined(_KERNEL)
436 if ((securelevel >= 3) && (mode & FWRITE))
440 nat = NULL; /* XXX gcc -Wuninitialized */
441 KMALLOC(nt, ipnat_t *);
442 getlock = (mode & NAT_LOCKHELD) ? 0 : 1;
443 if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT)) {
444 if (mode & NAT_SYSSPACE) {
445 bcopy(data, (char *)&natd, sizeof(natd));
448 error = IRCOPYPTR(data, (char *)&natd, sizeof(natd));
450 } else if (cmd == SIOCIPFFL) { /* SIOCFLNAT & SIOCCNATL */
451 error = IRCOPY(data, (char *)&arg, sizeof(arg));
460 * For add/delete, look to see if the NAT entry is already present
463 WRITE_ENTER(&ipf_nat);
465 if ((cmd == SIOCADNAT) || (cmd == SIOCRMNAT)) {
467 nat->in_flags &= IPN_USERFLAGS;
468 if ((nat->in_redir & NAT_MAPBLK) == 0) {
469 if ((nat->in_flags & IPN_SPLIT) == 0)
470 nat->in_inip &= nat->in_inmsk;
471 if ((nat->in_flags & IPN_IPRANGE) == 0)
472 nat->in_outip &= nat->in_outmsk;
474 for (np = &nat_list; (n = *np); np = &n->in_next)
475 if (!bcmp((char *)&nat->in_flags, (char *)&n->in_flags,
477 if (n->in_redir == NAT_REDIRECT &&
478 n->in_pnext != nat->in_pnext)
491 if (!(mode & FWRITE))
494 tmp = ipflog_clear(IPL_LOGNAT);
495 IWCOPY((char *)&tmp, (char *)data, sizeof(tmp));
501 if (!(mode & FWRITE)) {
515 bcopy((char *)nat, (char *)n, sizeof(*n));
516 n->in_ifp = (void *)GETUNIT(n->in_ifname, 4);
518 n->in_ifp = (void *)-1;
519 if (n->in_plabel[0] != '\0') {
520 n->in_apr = appr_lookup(n->in_p, n->in_plabel);
529 if (n->in_redir & NAT_REDIRECT) {
530 n->in_flags &= ~IPN_NOTDST;
533 if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
534 n->in_flags &= ~IPN_NOTSRC;
539 if (n->in_redir & NAT_MAPBLK)
540 n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk);
541 else if (n->in_flags & IPN_AUTOPORTMAP)
542 n->in_space = USABLE_PORTS * ~ntohl(n->in_inmsk);
543 else if (n->in_flags & IPN_IPRANGE)
544 n->in_space = ntohl(n->in_outmsk) - ntohl(n->in_outip);
545 else if (n->in_flags & IPN_SPLIT)
548 n->in_space = ~ntohl(n->in_outmsk);
550 * Calculate the number of valid IP addresses in the output
551 * mapping range. In all cases, the range is inclusive of
552 * the start and ending IP addresses.
553 * If to a CIDR address, lose 2: broadcast + network address
555 * If to a range, add one.
556 * If to a single IP address, set to 1.
559 if ((n->in_flags & IPN_IPRANGE) != 0)
565 if ((n->in_outmsk != 0xffffffff) && (n->in_outmsk != 0) &&
566 ((n->in_flags & (IPN_IPRANGE|IPN_SPLIT)) == 0))
567 n->in_nip = ntohl(n->in_outip) + 1;
568 else if ((n->in_flags & IPN_SPLIT) &&
569 (n->in_redir & NAT_REDIRECT))
570 n->in_nip = ntohl(n->in_inip);
572 n->in_nip = ntohl(n->in_outip);
573 if (n->in_redir & NAT_MAP) {
574 n->in_pnext = ntohs(n->in_pmin);
576 * Multiply by the number of ports made available.
578 if (ntohs(n->in_pmax) >= ntohs(n->in_pmin)) {
579 n->in_space *= (ntohs(n->in_pmax) -
580 ntohs(n->in_pmin) + 1);
582 * Because two different sources can map to
583 * different destinations but use the same
585 * If the result is smaller than in_space, then
586 * we may have wrapped around 32bits.
589 if ((i != 0) && (i != 0xffffffff)) {
590 j = n->in_space * (~ntohl(i) + 1);
591 if (j >= n->in_space)
594 n->in_space = 0xffffffff;
598 * If no protocol is specified, multiple by 256.
600 if ((n->in_flags & IPN_TCPUDP) == 0) {
601 j = n->in_space * 256;
602 if (j >= n->in_space)
605 n->in_space = 0xffffffff;
608 /* Otherwise, these fields are preset */
610 nat_stats.ns_rules++;
613 if (!(mode & FWRITE)) {
622 if (n->in_redir & NAT_REDIRECT)
624 if (n->in_redir & (NAT_MAPBLK|NAT_MAP))
626 if (nat_list == NULL) {
633 appr_free(n->in_apr);
635 nat_stats.ns_rules--;
637 n->in_flags |= IPN_DELETE;
643 MUTEX_DOWNGRADE(&ipf_nat);
644 nat_stats.ns_table[0] = nat_table[0];
645 nat_stats.ns_table[1] = nat_table[1];
646 nat_stats.ns_list = nat_list;
647 nat_stats.ns_maptable = maptable;
648 nat_stats.ns_nattab_sz = ipf_nattable_sz;
649 nat_stats.ns_rultab_sz = ipf_natrules_sz;
650 nat_stats.ns_rdrtab_sz = ipf_rdrrules_sz;
651 nat_stats.ns_hostmap_sz = ipf_hostmap_sz;
652 nat_stats.ns_instances = nat_instances;
653 nat_stats.ns_apslist = ap_sess_list;
654 error = IWCOPYPTR((char *)&nat_stats, (char *)data,
661 MUTEX_DOWNGRADE(&ipf_nat);
662 error = IRCOPYPTR((char *)data, (char *)&nl, sizeof(nl));
666 if (nat_lookupredir(&nl)) {
667 error = IWCOPYPTR((char *)&nl, (char *)data,
673 case SIOCIPFFL : /* old SIOCFLNAT & SIOCCNATL */
674 if (!(mode & FWRITE)) {
680 ret = nat_flushtable();
682 ret = nat_clearlist();
685 MUTEX_DOWNGRADE(&ipf_nat);
687 error = IWCOPY((caddr_t)&ret, data, sizeof(ret));
693 error = IRCOPY(data, (caddr_t)&arg, sizeof(arg));
695 error = IWCOPY((caddr_t)&fr_nat_lock, data,
696 sizeof(fr_nat_lock));
704 error = fr_natputent(data);
710 error = fr_natgetsz(data);
716 error = fr_natgetent(data);
722 arg = (int)iplused[IPL_LOGNAT];
723 MUTEX_DOWNGRADE(&ipf_nat);
724 error = IWCOPY((caddr_t)&arg, (caddr_t)data, sizeof(arg));
734 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */
743 static int fr_natgetsz(data)
751 error = IRCOPY(data, (caddr_t)&ng, sizeof(ng));
760 error = IWCOPY((caddr_t)&ng, data, sizeof(ng));
767 * Make sure the pointer we're copying from exists in the
768 * current list of entries. Security precaution to prevent
769 * copying of random kernel data.
771 for (n = nat_instances; n; n = n->nat_next)
778 ng.ng_sz = sizeof(nat_save_t);
780 if ((aps != NULL) && (aps->aps_data != 0)) {
781 ng.ng_sz += sizeof(ap_session_t);
782 ng.ng_sz += aps->aps_psiz;
785 error = IWCOPY((caddr_t)&ng, data, sizeof(ng));
792 static int fr_natgetent(data)
795 nat_save_t ipn, *ipnp, *ipnn = NULL;
796 register nat_t *n, *nat;
800 error = IRCOPY(data, (caddr_t)&ipnp, sizeof(ipnp));
803 error = IRCOPY((caddr_t)ipnp, (caddr_t)&ipn, sizeof(ipn));
811 if (nat_instances == NULL)
817 * Make sure the pointer we're copying from exists in the
818 * current list of entries. Security precaution to prevent
819 * copying of random kernel data.
821 for (n = nat_instances; n; n = n->nat_next)
828 ipn.ipn_next = nat->nat_next;
830 bcopy((char *)nat, (char *)&ipn.ipn_nat, sizeof(ipn.ipn_nat));
831 ipn.ipn_nat.nat_data = NULL;
834 bcopy((char *)nat->nat_ptr, (char *)&ipn.ipn_ipnat,
835 sizeof(ipn.ipn_ipnat));
839 bcopy((char *)nat->nat_fr, (char *)&ipn.ipn_rule,
840 sizeof(ipn.ipn_rule));
842 if ((aps = nat->nat_aps)) {
843 ipn.ipn_dsize = sizeof(*aps);
845 ipn.ipn_dsize += aps->aps_psiz;
846 KMALLOCS(ipnn, nat_save_t *, sizeof(*ipnn) + ipn.ipn_dsize);
849 bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn));
851 bcopy((char *)aps, (char *)ipnn->ipn_data, sizeof(*aps));
853 bcopy(aps->aps_data, ipnn->ipn_data + sizeof(*aps),
855 ipnn->ipn_dsize += aps->aps_psiz;
857 error = IWCOPY((caddr_t)ipnn, ipnp,
858 sizeof(ipn) + ipn.ipn_dsize);
861 KFREES(ipnn, sizeof(*ipnn) + ipn.ipn_dsize);
863 error = IWCOPY((caddr_t)&ipn, ipnp, sizeof(ipn));
871 static int fr_natputent(data)
874 nat_save_t ipn, *ipnp, *ipnn = NULL;
875 register nat_t *n, *nat;
882 error = IRCOPY(data, (caddr_t)&ipnp, sizeof(ipnp));
885 error = IRCOPY((caddr_t)ipnp, (caddr_t)&ipn, sizeof(ipn));
890 KMALLOCS(ipnn, nat_save_t *, sizeof(ipn) + ipn.ipn_dsize);
893 bcopy((char *)&ipn, (char *)ipnn, sizeof(ipn));
894 error = IRCOPY((caddr_t)ipnp, (caddr_t)ipn.ipn_data,
903 KMALLOC(nat, nat_t *);
909 bcopy((char *)&ipn.ipn_nat, (char *)nat, sizeof(*nat));
911 * Initialize all these so that nat_delete() doesn't cause a crash.
913 nat->nat_phnext[0] = NULL;
914 nat->nat_phnext[1] = NULL;
922 nat->nat_data = NULL;
923 nat->nat_ifp = GETUNIT(nat->nat_ifname, 4);
926 * Restore the rule associated with this nat session
929 KMALLOC(in, ipnat_t *);
935 bcopy((char *)&ipn.ipn_ipnat, (char *)in, sizeof(*in));
937 in->in_flags |= IPN_DELETE;
940 in->in_prnext = NULL;
942 in->in_pmnext = NULL;
943 in->in_ifp = GETUNIT(in->in_ifname, 4);
944 if (in->in_plabel[0] != '\0') {
945 in->in_apr = appr_lookup(in->in_p, in->in_plabel);
950 * Restore ap_session_t structure. Include the private data allocated
954 KMALLOC(aps, ap_session_t *);
960 aps->aps_next = ap_sess_list;
962 bcopy(ipnn->ipn_data, (char *)aps, sizeof(*aps));
964 aps->aps_apr = in->in_apr;
966 KMALLOCS(aps->aps_data, void *, aps->aps_psiz);
967 if (aps->aps_data == NULL) {
971 bcopy(ipnn->ipn_data + sizeof(*aps), aps->aps_data,
975 aps->aps_data = NULL;
980 * If there was a filtering rule associated with this entry then
981 * build up a new one.
984 if (nat->nat_flags & FI_NEWFR) {
985 KMALLOC(fr, frentry_t *);
991 bcopy((char *)&ipn.ipn_fr, (char *)fr, sizeof(*fr));
992 ipn.ipn_nat.nat_fr = fr;
993 error = IWCOPY((caddr_t)&ipn, ipnp, sizeof(ipn));
999 for (n = nat_instances; n; n = n->nat_next)
1000 if (n->nat_fr == fr)
1010 KFREES(ipnn, sizeof(ipn) + ipn.ipn_dsize);
1015 KFREES(ipnn, sizeof(ipn) + ipn.ipn_dsize);
1023 * Delete a nat entry from the various lists and table.
1025 static void nat_delete(natd)
1030 if (natd->nat_flags & FI_WILDP)
1031 nat_stats.ns_wilds--;
1032 if (natd->nat_hnext[0])
1033 natd->nat_hnext[0]->nat_phnext[0] = natd->nat_phnext[0];
1034 *natd->nat_phnext[0] = natd->nat_hnext[0];
1035 if (natd->nat_hnext[1])
1036 natd->nat_hnext[1]->nat_phnext[1] = natd->nat_phnext[1];
1037 *natd->nat_phnext[1] = natd->nat_hnext[1];
1038 if (natd->nat_me != NULL)
1039 *natd->nat_me = NULL;
1041 if (natd->nat_fr != NULL) {
1042 ATOMIC_DEC32(natd->nat_fr->fr_ref);
1045 if (natd->nat_hm != NULL)
1046 nat_hostmapdel(natd->nat_hm);
1049 * If there is an active reference from the nat entry to its parent
1050 * rule, decrement the rule's reference count and free it too if no
1051 * longer being used.
1053 ipn = natd->nat_ptr;
1057 if (!ipn->in_use && (ipn->in_flags & IPN_DELETE)) {
1059 appr_free(ipn->in_apr);
1061 nat_stats.ns_rules--;
1065 MUTEX_DESTROY(&natd->nat_lock);
1067 * If there's a fragment table entry too for this nat entry, then
1068 * dereference that as well.
1070 ipfr_forget((void *)natd);
1071 aps_free(natd->nat_aps);
1072 nat_stats.ns_inuse--;
1078 * nat_flushtable - clear the NAT table of all mapping entries.
1079 * (this is for the dynamic mappings)
1081 static int nat_flushtable()
1083 register nat_t *nat, **natp;
1087 * ALL NAT mappings deleted, so lets just make the deletions
1090 if (nat_table[0] != NULL)
1091 bzero((char *)nat_table[0],
1092 sizeof(nat_table[0]) * ipf_nattable_sz);
1093 if (nat_table[1] != NULL)
1094 bzero((char *)nat_table[1],
1095 sizeof(nat_table[1]) * ipf_nattable_sz);
1097 for (natp = &nat_instances; (nat = *natp); ) {
1098 *natp = nat->nat_next;
1100 nat_log(nat, NL_FLUSH);
1105 nat_stats.ns_inuse = 0;
1111 * nat_clearlist - delete all rules in the active NAT mapping list.
1112 * (this is for NAT/RDR rules)
1116 register ipnat_t *n, **np = &nat_list;
1119 if (nat_rules != NULL)
1120 bzero((char *)nat_rules, sizeof(*nat_rules) * ipf_natrules_sz);
1121 if (rdr_rules != NULL)
1122 bzero((char *)rdr_rules, sizeof(*rdr_rules) * ipf_rdrrules_sz);
1128 appr_free(n->in_apr);
1130 nat_stats.ns_rules--;
1132 n->in_flags |= IPN_DELETE;
1144 * Create a new NAT table entry.
1145 * NOTE: Assumes write lock on ipf_nat has been obtained already.
1146 * If you intend on changing this, beware: appr_new() may call nat_new()
1149 nat_t *nat_new(fin, ip, np, natsave, flags, direction)
1157 register u_32_t sum1, sum2, sumd, l;
1158 u_short port = 0, sport = 0, dport = 0, nport = 0;
1159 struct in_addr in, inb;
1160 u_short nflags, sp, dp;
1161 tcphdr_t *tcp = NULL;
1162 hostmap_t *hm = NULL;
1164 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
1165 qif_t *qf = fin->fin_qif;
1168 nflags = flags & np->in_flags;
1169 if (flags & IPN_TCPUDP) {
1170 tcp = (tcphdr_t *)fin->fin_dp;
1171 sport = htons(fin->fin_data[0]);
1172 dport = htons(fin->fin_data[1]);
1175 /* Give me a new nat */
1176 KMALLOC(nat, nat_t *);
1178 nat_stats.ns_memfail++;
1182 bzero((char *)nat, sizeof(*nat));
1183 nat->nat_flags = flags;
1184 if (flags & FI_WILDP)
1185 nat_stats.ns_wilds++;
1187 * Search the current table for a match.
1189 if (direction == NAT_OUTBOUND) {
1191 * Values at which the search for a free resouce starts.
1197 * If it's an outbound packet which doesn't match any existing
1198 * record, then create a new port
1202 st_port = np->in_pnext;
1206 in.s_addr = htonl(np->in_nip);
1209 * Check to see if there is an existing NAT
1210 * setup for this IP address pair.
1212 hm = nat_hostmap(np, fin->fin_src, in);
1214 in.s_addr = hm->hm_mapip.s_addr;
1215 } else if ((l == 1) && (hm != NULL)) {
1219 in.s_addr = ntohl(in.s_addr);
1223 if ((np->in_outmsk == 0xffffffff) &&
1224 (np->in_pnext == 0)) {
1229 if (np->in_redir & NAT_MAPBLK) {
1230 if ((l >= np->in_ppip) || ((l > 0) &&
1231 !(flags & IPN_TCPUDP)))
1234 * map-block - Calculate destination address.
1236 in.s_addr = ntohl(fin->fin_saddr);
1237 in.s_addr &= ntohl(~np->in_inmsk);
1238 inb.s_addr = in.s_addr;
1239 in.s_addr /= np->in_ippip;
1240 in.s_addr &= ntohl(~np->in_outmsk);
1241 in.s_addr += ntohl(np->in_outip);
1243 * Calculate destination port.
1245 if ((flags & IPN_TCPUDP) &&
1246 (np->in_ppip != 0)) {
1247 port = ntohs(sport) + l;
1248 port %= np->in_ppip;
1249 port += np->in_ppip *
1250 (inb.s_addr % np->in_ippip);
1251 port += MAPBLK_MINPORT;
1254 } else if (!np->in_outip &&
1255 (np->in_outmsk == 0xffffffff)) {
1257 * 0/32 - use the interface's IP address.
1260 fr_ifpaddr(4, fin->fin_ifp, &in) == -1)
1262 in.s_addr = ntohl(in.s_addr);
1263 } else if (!np->in_outip && !np->in_outmsk) {
1265 * 0/0 - use the original source address/port.
1269 in.s_addr = ntohl(fin->fin_saddr);
1270 } else if ((np->in_outmsk != 0xffffffff) &&
1271 (np->in_pnext == 0) &&
1272 ((l > 0) || (hm == NULL)))
1276 if ((nflags & IPN_TCPUDP) &&
1277 ((np->in_redir & NAT_MAPBLK) == 0) &&
1278 (np->in_flags & IPN_AUTOPORTMAP)) {
1279 if ((l > 0) && (l % np->in_ppip == 0)) {
1280 if (l > np->in_space) {
1282 } else if ((l > np->in_ppip) &&
1283 np->in_outmsk != 0xffffffff)
1286 if (np->in_ppip != 0) {
1287 port = ntohs(sport);
1288 port += (l % np->in_ppip);
1289 port %= np->in_ppip;
1290 port += np->in_ppip *
1291 (ntohl(fin->fin_saddr) %
1293 port += MAPBLK_MINPORT;
1296 } else if (((np->in_redir & NAT_MAPBLK) == 0) &&
1297 (nflags & IPN_TCPUDP) &&
1298 (np->in_pnext != 0)) {
1299 port = htons(np->in_pnext++);
1300 if (np->in_pnext > ntohs(np->in_pmax)) {
1301 np->in_pnext = ntohs(np->in_pmin);
1302 if (np->in_outmsk != 0xffffffff)
1307 if (np->in_flags & IPN_IPRANGE) {
1308 if (np->in_nip > ntohl(np->in_outmsk))
1309 np->in_nip = ntohl(np->in_outip);
1311 if ((np->in_outmsk != 0xffffffff) &&
1312 ((np->in_nip + 1) & ntohl(np->in_outmsk)) >
1313 ntohl(np->in_outip))
1314 np->in_nip = ntohl(np->in_outip) + 1;
1317 if (!port && (flags & IPN_TCPUDP))
1321 * Here we do a lookup of the connection as seen from
1322 * the outside. If an IP# pair already exists, try
1323 * again. So if you have A->B becomes C->B, you can
1324 * also have D->E become C->E but not D->B causing
1325 * another C->B. Also take protocol and ports into
1326 * account when determining whether a pre-existing
1327 * NAT setup will cause an external conflict where
1328 * this is appropriate.
1330 inb.s_addr = htonl(in.s_addr);
1331 sp = fin->fin_data[0];
1332 dp = fin->fin_data[1];
1333 fin->fin_data[0] = fin->fin_data[1];
1334 fin->fin_data[1] = htons(port);
1335 natl = nat_inlookup(fin, flags & ~FI_WILDP,
1336 (u_int)fin->fin_p, fin->fin_dst,
1338 fin->fin_data[0] = sp;
1339 fin->fin_data[1] = dp;
1342 * Has the search wrapped around and come back to the
1345 if ((natl != NULL) &&
1346 (np->in_pnext != 0) && (st_port == np->in_pnext) &&
1347 (np->in_nip != 0) && (st_ip == np->in_nip))
1350 } while (natl != NULL);
1352 if (np->in_space > 0)
1355 /* Setup the NAT table */
1356 nat->nat_inip = fin->fin_src;
1357 nat->nat_outip.s_addr = htonl(in.s_addr);
1358 nat->nat_oip = fin->fin_dst;
1359 if (nat->nat_hm == NULL)
1360 nat->nat_hm = nat_hostmap(np, fin->fin_src,
1363 sum1 = LONG_SUM(ntohl(fin->fin_saddr)) + ntohs(sport);
1364 sum2 = LONG_SUM(in.s_addr) + ntohs(port);
1366 if (flags & IPN_TCPUDP) {
1367 nat->nat_inport = sport;
1368 nat->nat_outport = port; /* sport */
1369 nat->nat_oport = dport;
1373 * Otherwise, it's an inbound packet. Most likely, we don't
1374 * want to rewrite source ports and source addresses. Instead,
1375 * we want to rewrite to a fixed internal address and fixed
1378 if (np->in_flags & IPN_SPLIT) {
1379 in.s_addr = np->in_nip;
1380 if (np->in_inip == htonl(in.s_addr))
1381 np->in_nip = ntohl(np->in_inmsk);
1383 np->in_nip = ntohl(np->in_inip);
1384 if (np->in_flags & IPN_ROUNDR) {
1390 in.s_addr = ntohl(np->in_inip);
1391 if (np->in_flags & IPN_ROUNDR) {
1400 * Whilst not optimized for the case where
1401 * pmin == pmax, the gain is not significant.
1403 if (np->in_pmin != np->in_pmax) {
1404 nport = ntohs(dport) - ntohs(np->in_pmin) +
1405 ntohs(np->in_pnext);
1406 nport = ntohs(nport);
1408 nport = np->in_pnext;
1412 * When the redirect-to address is set to 0.0.0.0, just
1413 * assume a blank `forwarding' of the packet.
1416 in.s_addr = ntohl(fin->fin_daddr);
1418 nat->nat_inip.s_addr = htonl(in.s_addr);
1419 nat->nat_outip = fin->fin_dst;
1420 nat->nat_oip = fin->fin_src;
1422 sum1 = LONG_SUM(ntohl(fin->fin_daddr)) + ntohs(dport);
1423 sum2 = LONG_SUM(in.s_addr) + ntohs(nport);
1425 if (flags & IPN_TCPUDP) {
1426 nat->nat_inport = nport;
1427 nat->nat_outport = dport;
1428 nat->nat_oport = sport;
1432 CALC_SUMD(sum1, sum2, sumd);
1433 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
1434 #if SOLARIS && defined(_KERNEL) && (SOLARIS2 >= 6)
1435 if ((flags & IPN_TCPUDP) && dohwcksum &&
1436 (qf->qf_ill->ill_ick.ick_magic == ICK_M_CTL_MAGIC)) {
1437 if (direction == NAT_OUTBOUND)
1438 sum1 = LONG_SUM(ntohl(in.s_addr));
1440 sum1 = LONG_SUM(ntohl(fin->fin_saddr));
1441 sum1 += LONG_SUM(ntohl(fin->fin_daddr));
1442 sum1 += IPPROTO_TCP;
1443 sum1 = (sum1 & 0xffff) + (sum1 >> 16);
1444 nat->nat_sumd[1] = NAT_HW_CKSUM|(sum1 & 0xffff);
1447 nat->nat_sumd[1] = nat->nat_sumd[0];
1449 if ((flags & IPN_TCPUDP) && ((sport != port) || (dport != nport))) {
1450 if (direction == NAT_OUTBOUND)
1451 sum1 = LONG_SUM(ntohl(fin->fin_saddr));
1453 sum1 = LONG_SUM(ntohl(fin->fin_daddr));
1455 sum2 = LONG_SUM(in.s_addr);
1457 CALC_SUMD(sum1, sum2, sumd);
1458 nat->nat_ipsumd = (sumd & 0xffff) + (sumd >> 16);
1460 nat->nat_ipsumd = nat->nat_sumd[0];
1462 in.s_addr = htonl(in.s_addr);
1464 strncpy(nat->nat_ifname, IFNAME(fin->fin_ifp), IFNAMSIZ);
1466 nat->nat_me = natsave;
1467 nat->nat_dir = direction;
1468 nat->nat_ifp = fin->fin_ifp;
1470 nat->nat_p = fin->fin_p;
1473 nat->nat_mssclamp = np->in_mssclamp;
1474 nat->nat_fr = fin->fin_fr;
1475 if (nat->nat_fr != NULL) {
1476 ATOMIC_INC32(nat->nat_fr->fr_ref);
1478 if (direction == NAT_OUTBOUND) {
1479 if (flags & IPN_TCPUDP)
1480 tcp->th_sport = port;
1482 if (flags & IPN_TCPUDP)
1483 tcp->th_dport = nport;
1488 if ((np->in_apr != NULL) && (np->in_dport == 0 ||
1489 (tcp != NULL && dport == np->in_dport)))
1490 (void) appr_new(fin, ip, nat);
1494 nat_log(nat, (u_int)np->in_redir);
1498 nat_stats.ns_badnat++;
1499 if ((hm = nat->nat_hm) != NULL)
1507 * Insert a NAT entry into the hash tables for searching and add it to the
1508 * list of active NAT entries. Adjust global counters when complete.
1510 void nat_insert(nat)
1516 MUTEX_INIT(&nat->nat_lock, "nat entry lock", NULL);
1518 nat->nat_age = fr_defnatage;
1519 nat->nat_ifname[sizeof(nat->nat_ifname) - 1] = '\0';
1520 if (nat->nat_ifname[0] !='\0') {
1521 nat->nat_ifp = GETUNIT(nat->nat_ifname, 4);
1524 nat->nat_next = nat_instances;
1525 nat_instances = nat;
1527 if (!(nat->nat_flags & (FI_W_SPORT|FI_W_DPORT))) {
1528 hv1 = NAT_HASH_FN(nat->nat_inip.s_addr, nat->nat_inport,
1530 hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, hv1 + nat->nat_oport,
1532 hv2 = NAT_HASH_FN(nat->nat_outip.s_addr, nat->nat_outport,
1534 hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, hv2 + nat->nat_oport,
1537 hv1 = NAT_HASH_FN(nat->nat_oip.s_addr, nat->nat_inip.s_addr,
1539 hv2 = NAT_HASH_FN(nat->nat_oip.s_addr, nat->nat_outip.s_addr,
1543 natp = &nat_table[0][hv1];
1545 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
1546 nat->nat_phnext[0] = natp;
1547 nat->nat_hnext[0] = *natp;
1550 natp = &nat_table[1][hv2];
1552 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
1553 nat->nat_phnext[1] = natp;
1554 nat->nat_hnext[1] = *natp;
1557 nat_stats.ns_added++;
1558 nat_stats.ns_inuse++;
1562 nat_t *nat_icmplookup(ip, fin, dir)
1568 tcphdr_t *tcp = NULL;
1570 int flags = 0, type, minlen;
1572 icmp = (icmphdr_t *)fin->fin_dp;
1574 * Does it at least have the return (basic) IP header ?
1575 * Only a basic IP header (no options) should be with an ICMP error
1578 if ((ip->ip_hl != 5) || (ip->ip_len < ICMPERR_MINPKTLEN))
1580 type = icmp->icmp_type;
1582 * If it's not an error type, then return.
1584 if ((type != ICMP_UNREACH) && (type != ICMP_SOURCEQUENCH) &&
1585 (type != ICMP_REDIRECT) && (type != ICMP_TIMXCEED) &&
1586 (type != ICMP_PARAMPROB))
1589 oip = (ip_t *)((char *)fin->fin_dp + 8);
1590 minlen = (oip->ip_hl << 2);
1591 if (minlen < sizeof(ip_t))
1593 if (ip->ip_len < ICMPERR_IPICMPHLEN + minlen)
1596 * Is the buffer big enough for all of it ? It's the size of the IP
1597 * header claimed in the encapsulated part which is of concern. It
1598 * may be too big to be in this buffer but not so big that it's
1599 * outside the ICMP packet, leading to TCP deref's causing problems.
1600 * This is possible because we don't know how big oip_hl is when we
1601 * do the pullup early in fr_check() and thus can't gaurantee it is
1610 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN > (char *)m->b_wptr)
1613 m = *(mb_t **)fin->fin_mp;
1614 if ((char *)oip + fin->fin_dlen - ICMPERR_ICMPHLEN >
1615 (char *)ip + m->m_len)
1621 if (oip->ip_p == IPPROTO_TCP)
1623 else if (oip->ip_p == IPPROTO_UDP)
1625 if (flags & IPN_TCPUDP) {
1629 minlen += 8; /* + 64bits of data to get ports */
1630 if (ip->ip_len < ICMPERR_IPICMPHLEN + minlen)
1633 data[0] = fin->fin_data[0];
1634 data[1] = fin->fin_data[1];
1635 tcp = (tcphdr_t *)((char *)oip + (oip->ip_hl << 2));
1636 fin->fin_data[0] = ntohs(tcp->th_dport);
1637 fin->fin_data[1] = ntohs(tcp->th_sport);
1639 if (dir == NAT_INBOUND) {
1640 nat = nat_inlookup(fin, flags, (u_int)oip->ip_p,
1641 oip->ip_dst, oip->ip_src, 0);
1643 nat = nat_outlookup(fin, flags, (u_int)oip->ip_p,
1644 oip->ip_dst, oip->ip_src, 0);
1646 fin->fin_data[0] = data[0];
1647 fin->fin_data[1] = data[1];
1650 if (dir == NAT_INBOUND)
1651 return nat_inlookup(fin, 0, (u_int)oip->ip_p,
1652 oip->ip_dst, oip->ip_src, 0);
1654 return nat_outlookup(fin, 0, (u_int)oip->ip_p,
1655 oip->ip_dst, oip->ip_src, 0);
1660 * This should *ONLY* be used for incoming packets to make sure a NAT'd ICMP
1661 * packet gets correctly recognised.
1663 nat_t *nat_icmp(ip, fin, nflags, dir)
1669 u_32_t sum1, sum2, sumd, sumd2 = 0;
1678 if ((fin->fin_fl & FI_SHORT) || (fin->fin_off != 0))
1681 * nat_icmplookup() will return NULL for `defective' packets.
1683 if ((ip->ip_v != 4) || !(nat = nat_icmplookup(ip, fin, dir)))
1687 *nflags = IPN_ICMPERR;
1688 icmp = (icmphdr_t *)fin->fin_dp;
1689 oip = (ip_t *)&icmp->icmp_ip;
1690 if (oip->ip_p == IPPROTO_TCP)
1692 else if (oip->ip_p == IPPROTO_UDP)
1694 udp = (udphdr_t *)((((char *)oip) + (oip->ip_hl << 2)));
1695 dlen = ip->ip_len - ((char *)udp - (char *)ip);
1697 * XXX - what if this is bogus hl and we go off the end ?
1698 * In this case, nat_icmplookup() will have returned NULL.
1700 tcp = (tcphdr_t *)udp;
1703 * Need to adjust ICMP header to include the real IP#'s and
1704 * port #'s. Only apply a checksum change relative to the
1705 * IP address change as it will be modified again in ip_natout
1706 * for both address and port. Two checksum changes are
1707 * necessary for the two header address changes. Be careful
1708 * to only modify the checksum once for the port # and twice
1714 * Fix the IP addresses in the offending IP packet. You also need
1715 * to adjust the IP header checksum of that offending IP packet
1716 * and the ICMP checksum of the ICMP error message itself.
1718 * Unfortunately, for UDP and TCP, the IP addresses are also contained
1719 * in the pseudo header that is used to compute the UDP resp. TCP
1720 * checksum. So, we must compensate that as well. Even worse, the
1721 * change in the UDP and TCP checksums require yet another
1722 * adjustment of the ICMP checksum of the ICMP error message.
1726 if (oip->ip_dst.s_addr == nat->nat_oip.s_addr) {
1727 sum1 = LONG_SUM(ntohl(oip->ip_src.s_addr));
1731 sum1 = LONG_SUM(ntohl(oip->ip_dst.s_addr));
1732 in = nat->nat_outip;
1736 sum2 = LONG_SUM(ntohl(in.s_addr));
1738 CALC_SUMD(sum1, sum2, sumd);
1740 if (nat->nat_dir == NAT_OUTBOUND) {
1742 * Fix IP checksum of the offending IP packet to adjust for
1743 * the change in the IP address.
1745 * Normally, you would expect that the ICMP checksum of the
1746 * ICMP error message needs to be adjusted as well for the
1747 * IP address change in oip.
1748 * However, this is a NOP, because the ICMP checksum is
1749 * calculated over the complete ICMP packet, which includes the
1750 * changed oip IP addresses and oip->ip_sum. However, these
1751 * two changes cancel each other out (if the delta for
1752 * the IP address is x, then the delta for ip_sum is minus x),
1753 * so no change in the icmp_cksum is necessary.
1755 * Be careful that nat_dir refers to the direction of the
1756 * offending IP packet (oip), not to its ICMP response (icmp)
1758 fix_datacksum(&oip->ip_sum, sumd);
1761 * Fix UDP pseudo header checksum to compensate for the
1762 * IP address change.
1764 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
1766 * The UDP checksum is optional, only adjust it
1767 * if it has been set.
1769 sum1 = ntohs(udp->uh_sum);
1770 fix_datacksum(&udp->uh_sum, sumd);
1771 sum2 = ntohs(udp->uh_sum);
1774 * Fix ICMP checksum to compensate the UDP
1775 * checksum adjustment.
1777 CALC_SUMD(sum1, sum2, sumd);
1782 * Fix TCP pseudo header checksum to compensate for the
1783 * IP address change. Before we can do the change, we
1784 * must make sure that oip is sufficient large to hold
1785 * the TCP checksum (normally it does not!).
1787 if (oip->ip_p == IPPROTO_TCP && dlen >= 18) {
1789 sum1 = ntohs(tcp->th_sum);
1790 fix_datacksum(&tcp->th_sum, sumd);
1791 sum2 = ntohs(tcp->th_sum);
1794 * Fix ICMP checksum to compensate the TCP
1795 * checksum adjustment.
1797 CALC_SUMD(sum1, sum2, sumd);
1803 * Fix IP checksum of the offending IP packet to adjust for
1804 * the change in the IP address.
1806 * Normally, you would expect that the ICMP checksum of the
1807 * ICMP error message needs to be adjusted as well for the
1808 * IP address change in oip.
1809 * However, this is a NOP, because the ICMP checksum is
1810 * calculated over the complete ICMP packet, which includes the
1811 * changed oip IP addresses and oip->ip_sum. However, these
1812 * two changes cancel each other out (if the delta for
1813 * the IP address is x, then the delta for ip_sum is minus x),
1814 * so no change in the icmp_cksum is necessary.
1816 * Be careful that nat_dir refers to the direction of the
1817 * offending IP packet (oip), not to its ICMP response (icmp)
1819 fix_datacksum(&oip->ip_sum, sumd);
1821 /* XXX FV : without having looked at Solaris source code, it seems unlikely
1822 * that SOLARIS would compensate this in the kernel (a body of an IP packet
1823 * in the data section of an ICMP packet). I have the feeling that this should
1824 * be unconditional, but I'm not in a position to check.
1826 #if !SOLARIS && !defined(__sgi)
1828 * Fix UDP pseudo header checksum to compensate for the
1829 * IP address change.
1831 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
1833 * The UDP checksum is optional, only adjust it
1834 * if it has been set
1836 sum1 = ntohs(udp->uh_sum);
1837 fix_datacksum(&udp->uh_sum, sumd);
1838 sum2 = ntohs(udp->uh_sum);
1841 * Fix ICMP checksum to compensate the UDP
1842 * checksum adjustment.
1844 CALC_SUMD(sum1, sum2, sumd);
1849 * Fix TCP pseudo header checksum to compensate for the
1850 * IP address change. Before we can do the change, we
1851 * must make sure that oip is sufficient large to hold
1852 * the TCP checksum (normally it does not!).
1854 if (oip->ip_p == IPPROTO_TCP && dlen >= 18) {
1856 sum1 = ntohs(tcp->th_sum);
1857 fix_datacksum(&tcp->th_sum, sumd);
1858 sum2 = ntohs(tcp->th_sum);
1861 * Fix ICMP checksum to compensate the TCP
1862 * checksum adjustment.
1864 CALC_SUMD(sum1, sum2, sumd);
1870 if ((flags & IPN_TCPUDP) != 0) {
1873 * For offending TCP/UDP IP packets, translate the ports as
1874 * well, based on the NAT specification. Of course such
1875 * a change must be reflected in the ICMP checksum as well.
1877 * Advance notice : Now it becomes complicated :-)
1879 * Since the port fields are part of the TCP/UDP checksum
1880 * of the offending IP packet, you need to adjust that checksum
1881 * as well... but, if you change, you must change the icmp
1882 * checksum *again*, to reflect that change.
1884 * To further complicate: the TCP checksum is not in the first
1885 * 8 bytes of the offending ip packet, so it most likely is not
1886 * available. Some OSses like Solaris return enough bytes to
1887 * include the TCP checksum. So we have to check if the
1888 * ip->ip_len actually holds the TCP checksum of the oip!
1891 if (nat->nat_oport == tcp->th_dport) {
1892 if (tcp->th_sport != nat->nat_inport) {
1894 * Fix ICMP checksum to compensate port
1897 sum1 = ntohs(tcp->th_sport);
1898 sum2 = ntohs(nat->nat_inport);
1899 CALC_SUMD(sum1, sum2, sumd);
1901 tcp->th_sport = nat->nat_inport;
1904 * Fix udp checksum to compensate port
1905 * adjustment. NOTE : the offending IP packet
1906 * flows the other direction compared to the
1909 * The UDP checksum is optional, only adjust
1910 * it if it has been set.
1912 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
1914 sum1 = ntohs(udp->uh_sum);
1915 fix_datacksum(&udp->uh_sum, sumd);
1916 sum2 = ntohs(udp->uh_sum);
1919 * Fix ICMP checksum to
1920 * compensate UDP checksum
1923 CALC_SUMD(sum1, sum2, sumd);
1928 * Fix tcp checksum (if present) to compensate
1929 * port adjustment. NOTE : the offending IP
1930 * packet flows the other direction compared to
1933 if (oip->ip_p == IPPROTO_TCP && dlen >= 18) {
1935 sum1 = ntohs(tcp->th_sum);
1936 fix_datacksum(&tcp->th_sum, sumd);
1937 sum2 = ntohs(tcp->th_sum);
1940 * Fix ICMP checksum to
1941 * compensate TCP checksum
1944 CALC_SUMD(sum1, sum2, sumd);
1949 if (tcp->th_dport != nat->nat_outport) {
1951 * Fix ICMP checksum to compensate port
1954 sum1 = ntohs(tcp->th_dport);
1955 sum2 = ntohs(nat->nat_outport);
1956 CALC_SUMD(sum1, sum2, sumd);
1958 tcp->th_dport = nat->nat_outport;
1961 * Fix udp checksum to compensate port
1962 * adjustment. NOTE : the offending IP
1963 * packet flows the other direction compared
1964 * to the ICMP message.
1966 * The UDP checksum is optional, only adjust
1967 * it if it has been set.
1969 if (oip->ip_p == IPPROTO_UDP && udp->uh_sum) {
1971 sum1 = ntohs(udp->uh_sum);
1972 fix_datacksum(&udp->uh_sum, sumd);
1973 sum2 = ntohs(udp->uh_sum);
1976 * Fix ICMP checksum to compensate
1977 * UDP checksum adjustment.
1979 CALC_SUMD(sum1, sum2, sumd);
1984 * Fix tcp checksum (if present) to compensate
1985 * port adjustment. NOTE : the offending IP
1986 * packet flows the other direction compared to
1989 if (oip->ip_p == IPPROTO_TCP && dlen >= 18) {
1991 sum1 = ntohs(tcp->th_sum);
1992 fix_datacksum(&tcp->th_sum, sumd);
1993 sum2 = ntohs(tcp->th_sum);
1996 * Fix ICMP checksum to compensate
1997 * UDP checksum adjustment.
1999 CALC_SUMD(sum1, sum2, sumd);
2005 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
2006 sumd2 = (sumd2 & 0xffff) + (sumd2 >> 16);
2007 if (nat->nat_dir == NAT_OUTBOUND) {
2008 fix_outcksum(fin, &icmp->icmp_cksum, sumd2);
2010 fix_incksum(fin, &icmp->icmp_cksum, sumd2);
2014 if (oip->ip_p == IPPROTO_ICMP)
2015 nat->nat_age = fr_defnaticmpage;
2021 * NB: these lookups don't lock access to the list, it assume it has already
2025 * Lookup a nat entry based on the mapped destination ip address/port and
2026 * real source address/port. We use this lookup when receiving a packet,
2027 * we're looking for a table entry, based on the destination address.
2028 * NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY.
2030 nat_t *nat_inlookup(fin, flags, p, src, mapdst, rw)
2032 register u_int flags, p;
2033 struct in_addr src , mapdst;
2036 register u_short sport, dport;
2037 register nat_t *nat;
2038 register int nflags;
2039 register u_32_t dst;
2048 dst = mapdst.s_addr;
2049 if (flags & IPN_TCPUDP) {
2050 sport = htons(fin->fin_data[0]);
2051 dport = htons(fin->fin_data[1]);
2057 hv = NAT_HASH_FN(dst, dport, 0xffffffff);
2058 hv = NAT_HASH_FN(src.s_addr, hv + sport, ipf_nattable_sz);
2059 nat = nat_table[1][hv];
2060 for (; nat; nat = nat->nat_hnext[1]) {
2061 nflags = nat->nat_flags;
2062 if ((!ifp || ifp == nat->nat_ifp) &&
2063 nat->nat_oip.s_addr == src.s_addr &&
2064 nat->nat_outip.s_addr == dst &&
2065 ((p == 0) || (p == nat->nat_p))) {
2070 if (nat->nat_oport != sport)
2072 if (nat->nat_outport != dport)
2080 if ((ipn != NULL) && (nat->nat_aps != NULL))
2081 if (appr_match(fin, nat) != 0)
2086 if (!nat_stats.ns_wilds || !(flags & FI_WILDP))
2089 RWLOCK_EXIT(&ipf_nat);
2091 hv = NAT_HASH_FN(dst, 0, 0xffffffff);
2092 hv = NAT_HASH_FN(src.s_addr, dst, ipf_nattable_sz);
2094 WRITE_ENTER(&ipf_nat);
2096 nat = nat_table[1][hv];
2097 for (; nat; nat = nat->nat_hnext[1]) {
2098 nflags = nat->nat_flags;
2099 if (ifp && ifp != nat->nat_ifp)
2101 if (!(nflags & FI_WILDP))
2103 if (nat->nat_oip.s_addr != src.s_addr ||
2104 nat->nat_outip.s_addr != dst)
2106 if (((nat->nat_oport == sport) || (nflags & FI_W_DPORT)) &&
2107 ((nat->nat_outport == dport) || (nflags & FI_W_SPORT))) {
2108 nat_tabmove(fin, nat);
2113 MUTEX_DOWNGRADE(&ipf_nat);
2120 * This function is only called for TCP/UDP NAT table entries where the
2121 * original was placed in the table without hashing on the ports and we now
2122 * want to include hashing on port numbers.
2124 static void nat_tabmove(fin, nat)
2128 register u_short sport, dport;
2132 nflags = nat->nat_flags;
2134 sport = ntohs(fin->fin_data[0]);
2135 dport = ntohs(fin->fin_data[1]);
2138 * Remove the NAT entry from the old location
2140 if (nat->nat_hnext[0])
2141 nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0];
2142 *nat->nat_phnext[0] = nat->nat_hnext[0];
2144 if (nat->nat_hnext[1])
2145 nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1];
2146 *nat->nat_phnext[1] = nat->nat_hnext[1];
2149 * Add into the NAT table in the new position
2151 hv = NAT_HASH_FN(nat->nat_inip.s_addr, sport, 0xffffffff);
2152 hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + dport, ipf_nattable_sz);
2153 natp = &nat_table[0][hv];
2155 (*natp)->nat_phnext[0] = &nat->nat_hnext[0];
2156 nat->nat_phnext[0] = natp;
2157 nat->nat_hnext[0] = *natp;
2160 hv = NAT_HASH_FN(nat->nat_outip.s_addr, sport, 0xffffffff);
2161 hv = NAT_HASH_FN(nat->nat_oip.s_addr, hv + dport, ipf_nattable_sz);
2162 natp = &nat_table[1][hv];
2164 (*natp)->nat_phnext[1] = &nat->nat_hnext[1];
2165 nat->nat_phnext[1] = natp;
2166 nat->nat_hnext[1] = *natp;
2172 * Lookup a nat entry based on the source 'real' ip address/port and
2173 * destination address/port. We use this lookup when sending a packet out,
2174 * we're looking for a table entry, based on the source address.
2175 * NOTE: THE PACKET BEING CHECKED (IF FOUND) HAS A MAPPING ALREADY.
2177 nat_t *nat_outlookup(fin, flags, p, src, dst, rw)
2179 register u_int flags, p;
2180 struct in_addr src , dst;
2183 register u_short sport, dport;
2184 register nat_t *nat;
2185 register int nflags;
2193 if (flags & IPN_TCPUDP) {
2194 sport = ntohs(fin->fin_data[0]);
2195 dport = ntohs(fin->fin_data[1]);
2201 hv = NAT_HASH_FN(srcip, sport, 0xffffffff);
2202 hv = NAT_HASH_FN(dst.s_addr, hv + dport, ipf_nattable_sz);
2203 nat = nat_table[0][hv];
2204 for (; nat; nat = nat->nat_hnext[0]) {
2205 nflags = nat->nat_flags;
2207 if ((!ifp || ifp == nat->nat_ifp) &&
2208 nat->nat_inip.s_addr == srcip &&
2209 nat->nat_oip.s_addr == dst.s_addr &&
2210 ((p == 0) || (p == nat->nat_p))) {
2215 if (nat->nat_oport != dport)
2217 if (nat->nat_inport != sport)
2225 if ((ipn != NULL) && (nat->nat_aps != NULL))
2226 if (appr_match(fin, nat) != 0)
2231 if (!nat_stats.ns_wilds || !(flags & FI_WILDP))
2234 RWLOCK_EXIT(&ipf_nat);
2237 hv = NAT_HASH_FN(dst.s_addr, srcip, ipf_nattable_sz);
2239 WRITE_ENTER(&ipf_nat);
2241 nat = nat_table[0][hv];
2242 for (; nat; nat = nat->nat_hnext[0]) {
2243 nflags = nat->nat_flags;
2244 if (ifp && ifp != nat->nat_ifp)
2246 if (!(nflags & FI_WILDP))
2248 if ((nat->nat_inip.s_addr != srcip) ||
2249 (nat->nat_oip.s_addr != dst.s_addr))
2251 if (((nat->nat_inport == sport) || (nflags & FI_W_SPORT)) &&
2252 ((nat->nat_oport == dport) || (nflags & FI_W_DPORT))) {
2253 nat_tabmove(fin, nat);
2258 MUTEX_DOWNGRADE(&ipf_nat);
2265 * Lookup the NAT tables to search for a matching redirect
2267 nat_t *nat_lookupredir(np)
2268 register natlookup_t *np;
2273 bzero((char *)&fi, sizeof(fi));
2274 fi.fin_data[0] = ntohs(np->nl_inport);
2275 fi.fin_data[1] = ntohs(np->nl_outport);
2278 * If nl_inip is non null, this is a lookup based on the real
2279 * ip address. Else, we use the fake.
2281 if ((nat = nat_outlookup(&fi, np->nl_flags, 0, np->nl_inip,
2282 np->nl_outip, 0))) {
2283 np->nl_realip = nat->nat_outip;
2284 np->nl_realport = nat->nat_outport;
2290 static int nat_match(fin, np, ip)
2300 if (np->in_p && fin->fin_p != np->in_p)
2303 if (!(np->in_redir & (NAT_MAP|NAT_MAPBLK)))
2305 if (((fin->fin_fi.fi_saddr & np->in_inmsk) != np->in_inip)
2306 ^ ((np->in_flags & IPN_NOTSRC) != 0))
2308 if (((fin->fin_fi.fi_daddr & np->in_srcmsk) != np->in_srcip)
2309 ^ ((np->in_flags & IPN_NOTDST) != 0))
2312 if (!(np->in_redir & NAT_REDIRECT))
2314 if (((fin->fin_fi.fi_saddr & np->in_srcmsk) != np->in_srcip)
2315 ^ ((np->in_flags & IPN_NOTSRC) != 0))
2317 if (((fin->fin_fi.fi_daddr & np->in_outmsk) != np->in_outip)
2318 ^ ((np->in_flags & IPN_NOTDST) != 0))
2323 if (!(fin->fin_fl & FI_TCPUDP) ||
2324 (fin->fin_fl & FI_SHORT) || (fin->fin_off != 0)) {
2325 if (ft->ftu_scmp || ft->ftu_dcmp)
2330 return fr_tcpudpchk(ft, fin);
2335 * Packets going out on the external interface go through this.
2336 * Here, the source address requires alteration, if anything.
2338 int ip_natout(ip, fin)
2342 register ipnat_t *np = NULL;
2343 register u_32_t ipa;
2344 tcphdr_t *tcp = NULL;
2345 u_short sport = 0, dport = 0, *csump = NULL;
2346 int natadd = 1, i, icmpset = 1;
2347 u_int nflags = 0, hv, msk;
2354 if (nat_list == NULL || (fr_nat_lock))
2357 if ((fr = fin->fin_fr) && !(fr->fr_flags & FR_DUP) &&
2358 fr->fr_tif.fd_ifp && fr->fr_tif.fd_ifp != (void *)-1) {
2359 sifp = fin->fin_ifp;
2360 fin->fin_ifp = fr->fr_tif.fd_ifp;
2362 sifp = fin->fin_ifp;
2365 if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
2366 if (fin->fin_p == IPPROTO_TCP)
2368 else if (fin->fin_p == IPPROTO_UDP)
2370 if ((nflags & IPN_TCPUDP)) {
2371 tcp = (tcphdr_t *)fin->fin_dp;
2372 sport = tcp->th_sport;
2373 dport = tcp->th_dport;
2377 ipa = fin->fin_saddr;
2379 READ_ENTER(&ipf_nat);
2381 if ((fin->fin_p == IPPROTO_ICMP) &&
2382 (nat = nat_icmp(ip, fin, &nflags, NAT_OUTBOUND)))
2384 else if ((fin->fin_fl & FI_FRAG) &&
2385 (nat = ipfr_nat_knownfrag(ip, fin)))
2387 else if ((nat = nat_outlookup(fin, nflags|FI_WILDP|FI_WILDA,
2388 (u_int)fin->fin_p, fin->fin_src,
2389 fin->fin_dst, 0))) {
2390 nflags = nat->nat_flags;
2391 if ((nflags & (FI_W_SPORT|FI_W_DPORT)) != 0) {
2392 if ((nflags & FI_W_SPORT) &&
2393 (nat->nat_inport != sport))
2394 nat->nat_inport = sport;
2395 if ((nflags & FI_W_DPORT) &&
2396 (nat->nat_oport != dport))
2397 nat->nat_oport = dport;
2399 if (nat->nat_outport == 0)
2400 nat->nat_outport = sport;
2401 nat->nat_flags &= ~(FI_W_DPORT|FI_W_SPORT);
2402 nflags = nat->nat_flags;
2403 nat_stats.ns_wilds--;
2406 RWLOCK_EXIT(&ipf_nat);
2411 WRITE_ENTER(&ipf_nat);
2413 * If there is no current entry in the nat table for this IP#,
2414 * create one for it (if there is a matching rule).
2417 iph = ipa & htonl(msk);
2418 hv = NAT_HASH_FN(iph, 0, ipf_natrules_sz);
2419 for (np = nat_rules[hv]; np; np = np->in_mnext)
2421 if (np->in_ifp && (np->in_ifp != ifp))
2423 if ((np->in_flags & IPN_RF) &&
2424 !(np->in_flags & nflags))
2426 if (np->in_flags & IPN_FILTER) {
2427 if (!nat_match(fin, np, ip))
2429 } else if ((ipa & np->in_inmsk) != np->in_inip)
2431 if (*np->in_plabel && !appr_ok(ip, tcp, np))
2433 nat = nat_new(fin, ip, np, NULL,
2434 (u_int)nflags, NAT_OUTBOUND);
2440 if ((np == NULL) && (i > 0)) {
2444 } while ((i >= 0) && ((nat_masks & (1 << i)) == 0));
2448 MUTEX_DOWNGRADE(&ipf_nat);
2452 * NOTE: ipf_nat must now only be held as a read lock
2456 if (natadd && (fin->fin_fl & FI_FRAG) && np)
2457 ipfr_nat_newfrag(ip, fin, nat);
2458 MUTEX_ENTER(&nat->nat_lock);
2459 if (fin->fin_p != IPPROTO_TCP) {
2460 if (np && np->in_age[1])
2461 nat->nat_age = np->in_age[1];
2462 else if (!icmpset && (fin->fin_p == IPPROTO_ICMP))
2463 nat->nat_age = fr_defnaticmpage;
2465 nat->nat_age = fr_defnatage;
2467 nat->nat_bytes += ip->ip_len;
2469 MUTEX_EXIT(&nat->nat_lock);
2472 * Fix up checksums, not by recalculating them, but
2473 * simply computing adjustments.
2475 if (nflags == IPN_ICMPERR) {
2476 u_32_t s1, s2, sumd;
2478 s1 = LONG_SUM(ntohl(fin->fin_saddr));
2479 s2 = LONG_SUM(ntohl(nat->nat_outip.s_addr));
2480 CALC_SUMD(s1, s2, sumd);
2482 if (nat->nat_dir == NAT_OUTBOUND)
2483 fix_outcksum(fin, &ip->ip_sum, sumd);
2485 fix_incksum(fin, &ip->ip_sum, sumd);
2487 #if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
2489 if (nat->nat_dir == NAT_OUTBOUND)
2490 fix_outcksum(fin, &ip->ip_sum, nat->nat_ipsumd);
2492 fix_incksum(fin, &ip->ip_sum, nat->nat_ipsumd);
2496 * Only change the packet contents, not what is filtered upon.
2498 ip->ip_src = nat->nat_outip;
2500 if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
2502 if ((nat->nat_outport != 0) && (tcp != NULL)) {
2503 tcp->th_sport = nat->nat_outport;
2504 fin->fin_data[0] = ntohs(tcp->th_sport);
2507 if (fin->fin_p == IPPROTO_TCP) {
2508 csump = &tcp->th_sum;
2509 MUTEX_ENTER(&nat->nat_lock);
2510 fr_tcp_age(&nat->nat_age,
2511 nat->nat_tcpstate, fin, 1, 0);
2512 if (nat->nat_age < fr_defnaticmpage)
2513 nat->nat_age = fr_defnaticmpage;
2515 else if (nat->nat_age > fr_defnatage)
2516 nat->nat_age = fr_defnatage;
2519 * Increase this because we may have
2520 * "keep state" following this too and
2521 * packet storms can occur if this is
2522 * removed too quickly.
2524 if (nat->nat_age == fr_tcpclosed)
2525 nat->nat_age = fr_tcplastack;
2528 * Do a MSS CLAMPING on a SYN packet,
2529 * only deal IPv4 for now.
2531 if (nat->nat_mssclamp &&
2532 (tcp->th_flags & TH_SYN) != 0)
2533 nat_mssclamp(tcp, nat->nat_mssclamp,
2536 MUTEX_EXIT(&nat->nat_lock);
2537 } else if (fin->fin_p == IPPROTO_UDP) {
2538 udphdr_t *udp = (udphdr_t *)tcp;
2541 csump = &udp->uh_sum;
2545 if (nat->nat_dir == NAT_OUTBOUND)
2546 fix_outcksum(fin, csump,
2549 fix_incksum(fin, csump,
2554 if (np && (np->in_apr != NULL) && (np->in_dport == 0 ||
2555 (tcp != NULL && dport == np->in_dport))) {
2556 i = appr_check(ip, fin, nat);
2563 ATOMIC_INCL(nat_stats.ns_mapped[1]);
2564 RWLOCK_EXIT(&ipf_nat); /* READ */
2565 fin->fin_ifp = sifp;
2568 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */
2569 fin->fin_ifp = sifp;
2575 * Packets coming in from the external interface go through this.
2576 * Here, the destination address requires alteration, if anything.
2578 int ip_natin(ip, fin)
2582 register struct in_addr src;
2583 register struct in_addr in;
2584 register ipnat_t *np;
2585 u_short sport = 0, dport = 0, *csump = NULL;
2586 u_int nflags = 0, natadd = 1, hv, msk;
2587 struct ifnet *ifp = fin->fin_ifp;
2588 tcphdr_t *tcp = NULL;
2593 if ((nat_list == NULL) || (ip->ip_v != 4) || (fr_nat_lock))
2596 if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
2597 if (fin->fin_p == IPPROTO_TCP)
2599 else if (fin->fin_p == IPPROTO_UDP)
2601 if ((nflags & IPN_TCPUDP)) {
2602 tcp = (tcphdr_t *)fin->fin_dp;
2603 sport = tcp->th_sport;
2604 dport = tcp->th_dport;
2609 /* make sure the source address is to be redirected */
2612 READ_ENTER(&ipf_nat);
2614 if ((fin->fin_p == IPPROTO_ICMP) &&
2615 (nat = nat_icmp(ip, fin, &nflags, NAT_INBOUND)))
2617 else if ((fin->fin_fl & FI_FRAG) &&
2618 (nat = ipfr_nat_knownfrag(ip, fin)))
2620 else if ((nat = nat_inlookup(fin, nflags|FI_WILDP|FI_WILDA,
2621 (u_int)fin->fin_p, fin->fin_src, in, 0))) {
2622 nflags = nat->nat_flags;
2623 if ((nflags & (FI_W_SPORT|FI_W_DPORT)) != 0) {
2624 if ((nat->nat_oport != sport) && (nflags & FI_W_DPORT))
2625 nat->nat_oport = sport;
2626 if ((nat->nat_outport != dport) &&
2627 (nflags & FI_W_SPORT))
2628 nat->nat_outport = dport;
2629 nat->nat_flags &= ~(FI_W_SPORT|FI_W_DPORT);
2630 nflags = nat->nat_flags;
2631 nat_stats.ns_wilds--;
2634 RWLOCK_EXIT(&ipf_nat);
2639 WRITE_ENTER(&ipf_nat);
2641 * If there is no current entry in the nat table for this IP#,
2642 * create one for it (if there is a matching rule).
2645 iph = in.s_addr & htonl(msk);
2646 hv = NAT_HASH_FN(iph, 0, ipf_rdrrules_sz);
2647 for (np = rdr_rules[hv]; np; np = np->in_rnext) {
2648 if ((np->in_ifp && (np->in_ifp != ifp)) ||
2649 (np->in_p && (np->in_p != fin->fin_p)) ||
2650 (np->in_flags && !(nflags & np->in_flags)))
2652 if (np->in_flags & IPN_FILTER) {
2653 if (!nat_match(fin, np, ip))
2655 } else if ((in.s_addr & np->in_outmsk) != np->in_outip)
2657 if ((!np->in_pmin || (np->in_flags & IPN_FILTER) ||
2658 ((ntohs(np->in_pmax) >= ntohs(dport)) &&
2659 (ntohs(dport) >= ntohs(np->in_pmin)))))
2660 if ((nat = nat_new(fin, ip, np, NULL, nflags,
2667 if ((np == NULL) && (i > 0)) {
2671 } while ((i >= 0) && ((rdr_masks & (1 << i)) == 0));
2675 MUTEX_DOWNGRADE(&ipf_nat);
2679 * NOTE: ipf_nat must now only be held as a read lock
2683 fin->fin_fr = nat->nat_fr;
2684 if (natadd && (fin->fin_fl & FI_FRAG) && np)
2685 ipfr_nat_newfrag(ip, fin, nat);
2686 if (np && (np->in_apr != NULL) && (np->in_dport == 0 ||
2687 (tcp != NULL && sport == np->in_dport))) {
2688 i = appr_check(ip, fin, nat);
2691 RWLOCK_EXIT(&ipf_nat);
2696 MUTEX_ENTER(&nat->nat_lock);
2697 if (fin->fin_p != IPPROTO_TCP) {
2698 if (np && np->in_age[0])
2699 nat->nat_age = np->in_age[0];
2700 else if (!icmpset && (fin->fin_p == IPPROTO_ICMP))
2701 nat->nat_age = fr_defnaticmpage;
2703 nat->nat_age = fr_defnatage;
2705 nat->nat_bytes += ip->ip_len;
2707 MUTEX_EXIT(&nat->nat_lock);
2708 ip->ip_dst = nat->nat_inip;
2709 fin->fin_fi.fi_daddr = nat->nat_inip.s_addr;
2712 * Fix up checksums, not by recalculating them, but
2713 * simply computing adjustments.
2715 #if (SOLARIS || defined(__sgi)) && defined(_KERNEL)
2716 if (nat->nat_dir == NAT_OUTBOUND)
2717 fix_incksum(fin, &ip->ip_sum, nat->nat_ipsumd);
2719 fix_outcksum(fin, &ip->ip_sum, nat->nat_ipsumd);
2721 if ((fin->fin_off == 0) && !(fin->fin_fl & FI_SHORT)) {
2723 if ((nat->nat_inport != 0) && (tcp != NULL)) {
2724 tcp->th_dport = nat->nat_inport;
2725 fin->fin_data[1] = ntohs(tcp->th_dport);
2728 if (fin->fin_p == IPPROTO_TCP) {
2729 csump = &tcp->th_sum;
2730 MUTEX_ENTER(&nat->nat_lock);
2731 fr_tcp_age(&nat->nat_age,
2732 nat->nat_tcpstate, fin, 0, 0);
2733 if (nat->nat_age < fr_defnaticmpage)
2734 nat->nat_age = fr_defnaticmpage;
2736 else if (nat->nat_age > fr_defnatage)
2737 nat->nat_age = fr_defnatage;
2740 * Increase this because we may have
2741 * "keep state" following this too and
2742 * packet storms can occur if this is
2743 * removed too quickly.
2745 if (nat->nat_age == fr_tcpclosed)
2746 nat->nat_age = fr_tcplastack;
2748 * Do a MSS CLAMPING on a SYN packet,
2749 * only deal IPv4 for now.
2751 if (nat->nat_mssclamp &&
2752 (tcp->th_flags & TH_SYN) != 0)
2753 nat_mssclamp(tcp, nat->nat_mssclamp,
2756 MUTEX_EXIT(&nat->nat_lock);
2757 } else if (fin->fin_p == IPPROTO_UDP) {
2758 udphdr_t *udp = (udphdr_t *)tcp;
2761 csump = &udp->uh_sum;
2765 if (nat->nat_dir == NAT_OUTBOUND)
2766 fix_incksum(fin, csump,
2769 fix_outcksum(fin, csump,
2773 ATOMIC_INCL(nat_stats.ns_mapped[0]);
2774 RWLOCK_EXIT(&ipf_nat); /* READ */
2777 RWLOCK_EXIT(&ipf_nat); /* READ/WRITE */
2783 * Free all memory used by NAT structures allocated at runtime.
2787 WRITE_ENTER(&ipf_nat);
2788 (void) nat_clearlist();
2789 (void) nat_flushtable();
2790 RWLOCK_EXIT(&ipf_nat);
2792 if (nat_table[0] != NULL) {
2793 KFREES(nat_table[0], sizeof(nat_t *) * ipf_nattable_sz);
2794 nat_table[0] = NULL;
2796 if (nat_table[1] != NULL) {
2797 KFREES(nat_table[1], sizeof(nat_t *) * ipf_nattable_sz);
2798 nat_table[1] = NULL;
2800 if (nat_rules != NULL) {
2801 KFREES(nat_rules, sizeof(ipnat_t *) * ipf_natrules_sz);
2804 if (rdr_rules != NULL) {
2805 KFREES(rdr_rules, sizeof(ipnat_t *) * ipf_rdrrules_sz);
2808 if (maptable != NULL) {
2809 KFREES(maptable, sizeof(hostmap_t *) * ipf_hostmap_sz);
2816 * Slowly expire held state for NAT entries. Timeouts are set in
2817 * expectation of this being called twice per second.
2821 register struct nat *nat, **natp;
2822 #if defined(_KERNEL) && !SOLARIS
2827 WRITE_ENTER(&ipf_nat);
2828 for (natp = &nat_instances; (nat = *natp); ) {
2831 natp = &nat->nat_next;
2834 *natp = nat->nat_next;
2836 nat_log(nat, NL_EXPIRE);
2839 nat_stats.ns_expire++;
2841 RWLOCK_EXIT(&ipf_nat);
2848 void ip_natsync(ifp)
2851 register ipnat_t *n;
2852 register nat_t *nat;
2853 register u_32_t sum1, sum2, sumd;
2857 #if defined(_KERNEL) && !SOLARIS
2862 * Change IP addresses for NAT sessions for any protocol except TCP
2863 * since it will break the TCP connection anyway.
2866 WRITE_ENTER(&ipf_nat);
2867 for (nat = nat_instances; nat; nat = nat->nat_next)
2868 if (((ifp == NULL) || (ifp == nat->nat_ifp)) &&
2869 !(nat->nat_flags & IPN_TCP) && (np = nat->nat_ptr) &&
2870 (np->in_outmsk == 0xffffffff) && !np->in_nip) {
2871 ifp2 = nat->nat_ifp;
2873 * Change the map-to address to be the same as the
2876 sum1 = nat->nat_outip.s_addr;
2877 if (fr_ifpaddr(4, ifp2, &in) != -1)
2878 nat->nat_outip = in;
2879 sum2 = nat->nat_outip.s_addr;
2884 * Readjust the checksum adjustment to take into
2885 * account the new IP#.
2887 CALC_SUMD(sum1, sum2, sumd);
2888 /* XXX - dont change for TCP when solaris does
2889 * hardware checksumming.
2891 sumd += nat->nat_sumd[0];
2892 nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
2893 nat->nat_sumd[1] = nat->nat_sumd[0];
2896 for (n = nat_list; (n != NULL); n = n->in_next)
2897 if (n->in_ifp == ifp) {
2898 n->in_ifp = (void *)GETUNIT(n->in_ifname, 4);
2900 n->in_ifp = (void *)-1;
2902 RWLOCK_EXIT(&ipf_nat);
2908 void nat_log(nat, type)
2916 int rulen, types[1];
2918 natl.nl_inip = nat->nat_inip;
2919 natl.nl_outip = nat->nat_outip;
2920 natl.nl_origip = nat->nat_oip;
2921 natl.nl_bytes = nat->nat_bytes;
2922 natl.nl_pkts = nat->nat_pkts;
2923 natl.nl_origport = nat->nat_oport;
2924 natl.nl_inport = nat->nat_inport;
2925 natl.nl_outport = nat->nat_outport;
2926 natl.nl_p = nat->nat_p;
2927 natl.nl_type = type;
2930 if (nat->nat_ptr != NULL) {
2931 for (rulen = 0, np = nat_list; np; np = np->in_next, rulen++)
2932 if (np == nat->nat_ptr) {
2933 natl.nl_rule = rulen;
2939 sizes[0] = sizeof(natl);
2942 (void) ipllog(IPL_LOGNAT, NULL, items, sizes, types, 1);
2947 #if defined(__OpenBSD__)
2948 void nat_ifdetach(ifp)
2958 * Check for MSS option and clamp it if necessary.
2960 static void nat_mssclamp(tcp, maxmss, fin, csump)
2966 u_char *cp, *ep, opt;
2971 hlen = tcp->th_off << 2;
2972 if (hlen > sizeof(*tcp)) {
2973 cp = (u_char *)tcp + sizeof(*tcp);
2974 ep = (u_char *)tcp + hlen;
2978 if (opt == TCPOPT_EOL)
2980 else if (opt == TCPOPT_NOP) {
2988 if (&cp[advance] >= ep)
2994 bcopy(&cp[2], &v, sizeof(v));
2998 bcopy(&v, &cp[2], sizeof(v));
2999 CALC_SUMD(mss, maxmss, sumd);
3000 fix_outcksum(fin, csump, sumd);
3004 /* ignore unknown options */