The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netgraph/ng_nat.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright 2005, Gleb Smirnoff <glebius@FreeBSD.org>
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1. Redistributions of source code must retain the above copyright
    9  *    notice, this list of conditions and the following disclaimer.
   10  * 2. Redistributions in binary form must reproduce the above copyright
   11  *    notice, this list of conditions and the following disclaimer in the
   12  *    documentation and/or other materials provided with the distribution.
   13  *
   14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   24  * SUCH DAMAGE.
   25  *
   26  * $FreeBSD: releng/9.0/sys/netgraph/ng_nat.c 222808 2011-06-07 06:48:42Z ae $
   27  */
   28 
   29 #include <sys/param.h>
   30 #include <sys/systm.h>
   31 #include <sys/kernel.h>
   32 #include <sys/mbuf.h>
   33 #include <sys/malloc.h>
   34 #include <sys/ctype.h>
   35 #include <sys/errno.h>
   36 #include <sys/syslog.h>
   37 
   38 #include <netinet/in_systm.h>
   39 #include <netinet/in.h>
   40 #include <netinet/ip.h>
   41 #include <netinet/ip_var.h>
   42 #include <netinet/tcp.h>
   43 #include <machine/in_cksum.h>
   44 
   45 #include <netinet/libalias/alias.h>
   46 #include <netinet/libalias/alias_local.h>
   47 
   48 #include <netgraph/ng_message.h>
   49 #include <netgraph/ng_parse.h>
   50 #include <netgraph/ng_nat.h>
   51 #include <netgraph/netgraph.h>
   52 
   53 static ng_constructor_t ng_nat_constructor;
   54 static ng_rcvmsg_t      ng_nat_rcvmsg;
   55 static ng_shutdown_t    ng_nat_shutdown;
   56 static ng_newhook_t     ng_nat_newhook;
   57 static ng_rcvdata_t     ng_nat_rcvdata;
   58 static ng_disconnect_t  ng_nat_disconnect;
   59 
   60 static unsigned int     ng_nat_translate_flags(unsigned int x);
   61 
   62 /* Parse type for struct ng_nat_mode. */
   63 static const struct ng_parse_struct_field ng_nat_mode_fields[]
   64         = NG_NAT_MODE_INFO;
   65 static const struct ng_parse_type ng_nat_mode_type = {
   66         &ng_parse_struct_type,
   67         &ng_nat_mode_fields
   68 };
   69 
   70 /* Parse type for 'description' field in structs. */
   71 static const struct ng_parse_fixedstring_info ng_nat_description_info
   72         = { NG_NAT_DESC_LENGTH };
   73 static const struct ng_parse_type ng_nat_description_type = {
   74         &ng_parse_fixedstring_type,
   75         &ng_nat_description_info
   76 };
   77 
   78 /* Parse type for struct ng_nat_redirect_port. */
   79 static const struct ng_parse_struct_field ng_nat_redirect_port_fields[]
   80         = NG_NAT_REDIRECT_PORT_TYPE_INFO(&ng_nat_description_type);
   81 static const struct ng_parse_type ng_nat_redirect_port_type = {
   82         &ng_parse_struct_type,
   83         &ng_nat_redirect_port_fields
   84 };
   85 
   86 /* Parse type for struct ng_nat_redirect_addr. */
   87 static const struct ng_parse_struct_field ng_nat_redirect_addr_fields[]
   88         = NG_NAT_REDIRECT_ADDR_TYPE_INFO(&ng_nat_description_type);
   89 static const struct ng_parse_type ng_nat_redirect_addr_type = {
   90         &ng_parse_struct_type,
   91         &ng_nat_redirect_addr_fields
   92 };
   93 
   94 /* Parse type for struct ng_nat_redirect_proto. */
   95 static const struct ng_parse_struct_field ng_nat_redirect_proto_fields[]
   96         = NG_NAT_REDIRECT_PROTO_TYPE_INFO(&ng_nat_description_type);
   97 static const struct ng_parse_type ng_nat_redirect_proto_type = {
   98         &ng_parse_struct_type,
   99         &ng_nat_redirect_proto_fields
  100 };
  101 
  102 /* Parse type for struct ng_nat_add_server. */
  103 static const struct ng_parse_struct_field ng_nat_add_server_fields[]
  104         = NG_NAT_ADD_SERVER_TYPE_INFO;
  105 static const struct ng_parse_type ng_nat_add_server_type = {
  106         &ng_parse_struct_type,
  107         &ng_nat_add_server_fields
  108 };
  109 
  110 /* Parse type for one struct ng_nat_listrdrs_entry. */
  111 static const struct ng_parse_struct_field ng_nat_listrdrs_entry_fields[]
  112         = NG_NAT_LISTRDRS_ENTRY_TYPE_INFO(&ng_nat_description_type);
  113 static const struct ng_parse_type ng_nat_listrdrs_entry_type = {
  114         &ng_parse_struct_type,
  115         &ng_nat_listrdrs_entry_fields
  116 };
  117 
  118 /* Parse type for 'redirects' array in struct ng_nat_list_redirects. */
  119 static int
  120 ng_nat_listrdrs_ary_getLength(const struct ng_parse_type *type,
  121         const u_char *start, const u_char *buf)
  122 {
  123         const struct ng_nat_list_redirects *lr;
  124 
  125         lr = (const struct ng_nat_list_redirects *)
  126             (buf - offsetof(struct ng_nat_list_redirects, redirects));
  127         return lr->total_count;
  128 }
  129 
  130 static const struct ng_parse_array_info ng_nat_listrdrs_ary_info = {
  131         &ng_nat_listrdrs_entry_type,
  132         &ng_nat_listrdrs_ary_getLength,
  133         NULL
  134 };
  135 static const struct ng_parse_type ng_nat_listrdrs_ary_type = {
  136         &ng_parse_array_type,
  137         &ng_nat_listrdrs_ary_info
  138 };
  139 
  140 /* Parse type for struct ng_nat_list_redirects. */
  141 static const struct ng_parse_struct_field ng_nat_list_redirects_fields[]
  142         = NG_NAT_LIST_REDIRECTS_TYPE_INFO(&ng_nat_listrdrs_ary_type);
  143 static const struct ng_parse_type ng_nat_list_redirects_type = {
  144         &ng_parse_struct_type,
  145         &ng_nat_list_redirects_fields
  146 };
  147 
  148 /* List of commands and how to convert arguments to/from ASCII. */
  149 static const struct ng_cmdlist ng_nat_cmdlist[] = {
  150         {
  151           NGM_NAT_COOKIE,
  152           NGM_NAT_SET_IPADDR,
  153           "setaliasaddr",
  154           &ng_parse_ipaddr_type,
  155           NULL
  156         },
  157         {
  158           NGM_NAT_COOKIE,
  159           NGM_NAT_SET_MODE,
  160           "setmode",
  161           &ng_nat_mode_type,
  162           NULL
  163         },
  164         {
  165           NGM_NAT_COOKIE,
  166           NGM_NAT_SET_TARGET,
  167           "settarget",
  168           &ng_parse_ipaddr_type,
  169           NULL
  170         },
  171         {
  172           NGM_NAT_COOKIE,
  173           NGM_NAT_REDIRECT_PORT,
  174           "redirectport",
  175           &ng_nat_redirect_port_type,
  176           &ng_parse_uint32_type
  177         },
  178         {
  179           NGM_NAT_COOKIE,
  180           NGM_NAT_REDIRECT_ADDR,
  181           "redirectaddr",
  182           &ng_nat_redirect_addr_type,
  183           &ng_parse_uint32_type
  184         },
  185         {
  186           NGM_NAT_COOKIE,
  187           NGM_NAT_REDIRECT_PROTO,
  188           "redirectproto",
  189           &ng_nat_redirect_proto_type,
  190           &ng_parse_uint32_type
  191         },
  192         {
  193           NGM_NAT_COOKIE,
  194           NGM_NAT_REDIRECT_DYNAMIC,
  195           "redirectdynamic",
  196           &ng_parse_uint32_type,
  197           NULL
  198         },
  199         {
  200           NGM_NAT_COOKIE,
  201           NGM_NAT_REDIRECT_DELETE,
  202           "redirectdelete",
  203           &ng_parse_uint32_type,
  204           NULL
  205         },
  206         {
  207           NGM_NAT_COOKIE,
  208           NGM_NAT_ADD_SERVER,
  209           "addserver",
  210           &ng_nat_add_server_type,
  211           NULL
  212         },
  213         {
  214           NGM_NAT_COOKIE,
  215           NGM_NAT_LIST_REDIRECTS,
  216           "listredirects",
  217           NULL,
  218           &ng_nat_list_redirects_type
  219         },
  220         {
  221           NGM_NAT_COOKIE,
  222           NGM_NAT_PROXY_RULE,
  223           "proxyrule",
  224           &ng_parse_string_type,
  225           NULL
  226         },
  227         { 0 }
  228 };
  229 
  230 /* Netgraph node type descriptor. */
  231 static struct ng_type typestruct = {
  232         .version =      NG_ABI_VERSION,
  233         .name =         NG_NAT_NODE_TYPE,
  234         .constructor =  ng_nat_constructor,
  235         .rcvmsg =       ng_nat_rcvmsg,
  236         .shutdown =     ng_nat_shutdown,
  237         .newhook =      ng_nat_newhook,
  238         .rcvdata =      ng_nat_rcvdata,
  239         .disconnect =   ng_nat_disconnect,
  240         .cmdlist =      ng_nat_cmdlist,
  241 };
  242 NETGRAPH_INIT(nat, &typestruct);
  243 MODULE_DEPEND(ng_nat, libalias, 1, 1, 1);
  244 
  245 /* Element for list of redirects. */
  246 struct ng_nat_rdr_lst {
  247         STAILQ_ENTRY(ng_nat_rdr_lst) entries;
  248         struct alias_link       *lnk;
  249         struct ng_nat_listrdrs_entry rdr;
  250 };
  251 STAILQ_HEAD(rdrhead, ng_nat_rdr_lst);
  252 
  253 /* Information we store for each node. */
  254 struct ng_nat_priv {
  255         node_p          node;           /* back pointer to node */
  256         hook_p          in;             /* hook for demasquerading */
  257         hook_p          out;            /* hook for masquerading */
  258         struct libalias *lib;           /* libalias handler */
  259         uint32_t        flags;          /* status flags */
  260         uint32_t        rdrcount;       /* number or redirects in list */
  261         uint32_t        nextid;         /* for next in turn in list */
  262         struct rdrhead  redirhead;      /* redirect list header */
  263 };
  264 typedef struct ng_nat_priv *priv_p;
  265 
  266 /* Values of flags */
  267 #define NGNAT_CONNECTED         0x1     /* We have both hooks connected */
  268 #define NGNAT_ADDR_DEFINED      0x2     /* NGM_NAT_SET_IPADDR happened */
  269 
  270 static int
  271 ng_nat_constructor(node_p node)
  272 {
  273         priv_p priv;
  274 
  275         /* Initialize private descriptor. */
  276         priv = malloc(sizeof(*priv), M_NETGRAPH, M_WAITOK | M_ZERO);
  277 
  278         /* Init aliasing engine. */
  279         priv->lib = LibAliasInit(NULL);
  280 
  281         /* Set same ports on. */
  282         (void )LibAliasSetMode(priv->lib, PKT_ALIAS_SAME_PORTS,
  283             PKT_ALIAS_SAME_PORTS);
  284 
  285         /* Init redirects housekeeping. */
  286         priv->rdrcount = 0;
  287         priv->nextid = 1;
  288         STAILQ_INIT(&priv->redirhead);
  289 
  290         /* Link structs together. */
  291         NG_NODE_SET_PRIVATE(node, priv);
  292         priv->node = node;
  293 
  294         /*
  295          * libalias is not thread safe, so our node
  296          * must be single threaded.
  297          */
  298         NG_NODE_FORCE_WRITER(node);
  299 
  300         return (0);
  301 }
  302 
  303 static int
  304 ng_nat_newhook(node_p node, hook_p hook, const char *name)
  305 {
  306         const priv_p priv = NG_NODE_PRIVATE(node);
  307 
  308         if (strcmp(name, NG_NAT_HOOK_IN) == 0) {
  309                 priv->in = hook;
  310         } else if (strcmp(name, NG_NAT_HOOK_OUT) == 0) {
  311                 priv->out = hook;
  312         } else
  313                 return (EINVAL);
  314 
  315         if (priv->out != NULL &&
  316             priv->in != NULL)
  317                 priv->flags |= NGNAT_CONNECTED;
  318 
  319         return(0);
  320 }
  321 
  322 static int
  323 ng_nat_rcvmsg(node_p node, item_p item, hook_p lasthook)
  324 {
  325         const priv_p priv = NG_NODE_PRIVATE(node);
  326         struct ng_mesg *resp = NULL;
  327         struct ng_mesg *msg;
  328         int error = 0;
  329 
  330         NGI_GET_MSG(item, msg);
  331 
  332         switch (msg->header.typecookie) {
  333         case NGM_NAT_COOKIE:
  334                 switch (msg->header.cmd) {
  335                 case NGM_NAT_SET_IPADDR:
  336                     {
  337                         struct in_addr *const ia = (struct in_addr *)msg->data;
  338 
  339                         if (msg->header.arglen < sizeof(*ia)) {
  340                                 error = EINVAL;
  341                                 break;
  342                         }
  343 
  344                         LibAliasSetAddress(priv->lib, *ia);
  345 
  346                         priv->flags |= NGNAT_ADDR_DEFINED;
  347                     }
  348                         break;
  349                 case NGM_NAT_SET_MODE:
  350                     {
  351                         struct ng_nat_mode *const mode = 
  352                             (struct ng_nat_mode *)msg->data;
  353 
  354                         if (msg->header.arglen < sizeof(*mode)) {
  355                                 error = EINVAL;
  356                                 break;
  357                         }
  358                         
  359                         if (LibAliasSetMode(priv->lib, 
  360                             ng_nat_translate_flags(mode->flags),
  361                             ng_nat_translate_flags(mode->mask)) < 0) {
  362                                 error = ENOMEM;
  363                                 break;
  364                         }
  365                     }
  366                         break;
  367                 case NGM_NAT_SET_TARGET:
  368                     {
  369                         struct in_addr *const ia = (struct in_addr *)msg->data;
  370 
  371                         if (msg->header.arglen < sizeof(*ia)) {
  372                                 error = EINVAL;
  373                                 break;
  374                         }
  375 
  376                         LibAliasSetTarget(priv->lib, *ia);
  377                     }
  378                         break;
  379                 case NGM_NAT_REDIRECT_PORT:
  380                     {
  381                         struct ng_nat_rdr_lst *entry;
  382                         struct ng_nat_redirect_port *const rp =
  383                             (struct ng_nat_redirect_port *)msg->data;
  384 
  385                         if (msg->header.arglen < sizeof(*rp)) {
  386                                 error = EINVAL;
  387                                 break;
  388                         }
  389 
  390                         if ((entry = malloc(sizeof(struct ng_nat_rdr_lst),
  391                             M_NETGRAPH, M_NOWAIT | M_ZERO)) == NULL) {
  392                                 error = ENOMEM;
  393                                 break;
  394                         }
  395 
  396                         /* Try actual redirect. */
  397                         entry->lnk = LibAliasRedirectPort(priv->lib,
  398                                 rp->local_addr, htons(rp->local_port),
  399                                 rp->remote_addr, htons(rp->remote_port),
  400                                 rp->alias_addr, htons(rp->alias_port),
  401                                 rp->proto);
  402 
  403                         if (entry->lnk == NULL) {
  404                                 error = ENOMEM;
  405                                 free(entry, M_NETGRAPH);
  406                                 break;
  407                         }
  408 
  409                         /* Successful, save info in our internal list. */
  410                         entry->rdr.local_addr = rp->local_addr;
  411                         entry->rdr.alias_addr = rp->alias_addr;
  412                         entry->rdr.remote_addr = rp->remote_addr;
  413                         entry->rdr.local_port = rp->local_port;
  414                         entry->rdr.alias_port = rp->alias_port;
  415                         entry->rdr.remote_port = rp->remote_port;
  416                         entry->rdr.proto = rp->proto;
  417                         bcopy(rp->description, entry->rdr.description,
  418                             NG_NAT_DESC_LENGTH);
  419 
  420                         /* Safety precaution. */
  421                         entry->rdr.description[NG_NAT_DESC_LENGTH-1] = '\0';
  422 
  423                         entry->rdr.id = priv->nextid++;
  424                         priv->rdrcount++;
  425 
  426                         /* Link to list of redirects. */
  427                         STAILQ_INSERT_TAIL(&priv->redirhead, entry, entries);
  428 
  429                         /* Response with id of newly added entry. */
  430                         NG_MKRESPONSE(resp, msg, sizeof(entry->rdr.id), M_NOWAIT);
  431                         if (resp == NULL) {
  432                                 error = ENOMEM;
  433                                 break;
  434                         }
  435                         bcopy(&entry->rdr.id, resp->data, sizeof(entry->rdr.id));
  436                     }
  437                         break;
  438                 case NGM_NAT_REDIRECT_ADDR:
  439                     {
  440                         struct ng_nat_rdr_lst *entry;
  441                         struct ng_nat_redirect_addr *const ra =
  442                             (struct ng_nat_redirect_addr *)msg->data;
  443 
  444                         if (msg->header.arglen < sizeof(*ra)) {
  445                                 error = EINVAL;
  446                                 break;
  447                         }
  448 
  449                         if ((entry = malloc(sizeof(struct ng_nat_rdr_lst),
  450                             M_NETGRAPH, M_NOWAIT | M_ZERO)) == NULL) {
  451                                 error = ENOMEM;
  452                                 break;
  453                         }
  454 
  455                         /* Try actual redirect. */
  456                         entry->lnk = LibAliasRedirectAddr(priv->lib,
  457                                 ra->local_addr, ra->alias_addr);
  458 
  459                         if (entry->lnk == NULL) {
  460                                 error = ENOMEM;
  461                                 free(entry, M_NETGRAPH);
  462                                 break;
  463                         }
  464 
  465                         /* Successful, save info in our internal list. */
  466                         entry->rdr.local_addr = ra->local_addr;
  467                         entry->rdr.alias_addr = ra->alias_addr;
  468                         entry->rdr.proto = NG_NAT_REDIRPROTO_ADDR;
  469                         bcopy(ra->description, entry->rdr.description,
  470                             NG_NAT_DESC_LENGTH);
  471 
  472                         /* Safety precaution. */
  473                         entry->rdr.description[NG_NAT_DESC_LENGTH-1] = '\0';
  474 
  475                         entry->rdr.id = priv->nextid++;
  476                         priv->rdrcount++;
  477 
  478                         /* Link to list of redirects. */
  479                         STAILQ_INSERT_TAIL(&priv->redirhead, entry, entries);
  480 
  481                         /* Response with id of newly added entry. */
  482                         NG_MKRESPONSE(resp, msg, sizeof(entry->rdr.id), M_NOWAIT);
  483                         if (resp == NULL) {
  484                                 error = ENOMEM;
  485                                 break;
  486                         }
  487                         bcopy(&entry->rdr.id, resp->data, sizeof(entry->rdr.id));
  488                     }
  489                         break;
  490                 case NGM_NAT_REDIRECT_PROTO:
  491                     {
  492                         struct ng_nat_rdr_lst *entry;
  493                         struct ng_nat_redirect_proto *const rp =
  494                             (struct ng_nat_redirect_proto *)msg->data;
  495 
  496                         if (msg->header.arglen < sizeof(*rp)) {
  497                                 error = EINVAL;
  498                                 break;
  499                         }
  500 
  501                         if ((entry = malloc(sizeof(struct ng_nat_rdr_lst),
  502                             M_NETGRAPH, M_NOWAIT | M_ZERO)) == NULL) {
  503                                 error = ENOMEM;
  504                                 break;
  505                         }
  506 
  507                         /* Try actual redirect. */
  508                         entry->lnk = LibAliasRedirectProto(priv->lib,
  509                                 rp->local_addr, rp->remote_addr,
  510                                 rp->alias_addr, rp->proto);
  511 
  512                         if (entry->lnk == NULL) {
  513                                 error = ENOMEM;
  514                                 free(entry, M_NETGRAPH);
  515                                 break;
  516                         }
  517 
  518                         /* Successful, save info in our internal list. */
  519                         entry->rdr.local_addr = rp->local_addr;
  520                         entry->rdr.alias_addr = rp->alias_addr;
  521                         entry->rdr.remote_addr = rp->remote_addr;
  522                         entry->rdr.proto = rp->proto;
  523                         bcopy(rp->description, entry->rdr.description,
  524                             NG_NAT_DESC_LENGTH);
  525 
  526                         /* Safety precaution. */
  527                         entry->rdr.description[NG_NAT_DESC_LENGTH-1] = '\0';
  528 
  529                         entry->rdr.id = priv->nextid++;
  530                         priv->rdrcount++;
  531 
  532                         /* Link to list of redirects. */
  533                         STAILQ_INSERT_TAIL(&priv->redirhead, entry, entries);
  534 
  535                         /* Response with id of newly added entry. */
  536                         NG_MKRESPONSE(resp, msg, sizeof(entry->rdr.id), M_NOWAIT);
  537                         if (resp == NULL) {
  538                                 error = ENOMEM;
  539                                 break;
  540                         }
  541                         bcopy(&entry->rdr.id, resp->data, sizeof(entry->rdr.id));
  542                     }
  543                         break;
  544                 case NGM_NAT_REDIRECT_DYNAMIC:
  545                 case NGM_NAT_REDIRECT_DELETE:
  546                     {
  547                         struct ng_nat_rdr_lst *entry;
  548                         uint32_t *const id = (uint32_t *)msg->data;
  549 
  550                         if (msg->header.arglen < sizeof(*id)) {
  551                                 error = EINVAL;
  552                                 break;
  553                         }
  554 
  555                         /* Find entry with supplied id. */
  556                         STAILQ_FOREACH(entry, &priv->redirhead, entries) {
  557                                 if (entry->rdr.id == *id)
  558                                         break;
  559                         }
  560 
  561                         /* Not found. */
  562                         if (entry == NULL) {
  563                                 error = ENOENT;
  564                                 break;
  565                         }
  566 
  567                         if (msg->header.cmd == NGM_NAT_REDIRECT_DYNAMIC) {
  568                                 if (LibAliasRedirectDynamic(priv->lib,
  569                                     entry->lnk) == -1) {
  570                                         error = ENOTTY; /* XXX Something better? */
  571                                         break;
  572                                 }
  573                         } else {        /* NGM_NAT_REDIRECT_DELETE */
  574                                 LibAliasRedirectDelete(priv->lib, entry->lnk);
  575                         }
  576 
  577                         /* Delete entry from our internal list. */
  578                         priv->rdrcount--;
  579                         STAILQ_REMOVE(&priv->redirhead, entry, ng_nat_rdr_lst, entries);
  580                         free(entry, M_NETGRAPH);
  581                     }
  582                         break;
  583                 case NGM_NAT_ADD_SERVER:
  584                     {
  585                         struct ng_nat_rdr_lst *entry;
  586                         struct ng_nat_add_server *const as =
  587                             (struct ng_nat_add_server *)msg->data;
  588 
  589                         if (msg->header.arglen < sizeof(*as)) {
  590                                 error = EINVAL;
  591                                 break;
  592                         }
  593 
  594                         /* Find entry with supplied id. */
  595                         STAILQ_FOREACH(entry, &priv->redirhead, entries) {
  596                                 if (entry->rdr.id == as->id)
  597                                         break;
  598                         }
  599 
  600                         /* Not found. */
  601                         if (entry == NULL) {
  602                                 error = ENOENT;
  603                                 break;
  604                         }
  605 
  606                         if (LibAliasAddServer(priv->lib, entry->lnk,
  607                             as->addr, htons(as->port)) == -1) {
  608                                 error = ENOMEM;
  609                                 break;
  610                         }
  611 
  612                         entry->rdr.lsnat++;
  613                     }
  614                         break;
  615                 case NGM_NAT_LIST_REDIRECTS:
  616                     {
  617                         struct ng_nat_rdr_lst *entry;
  618                         struct ng_nat_list_redirects *ary; 
  619                         int i = 0;
  620 
  621                         NG_MKRESPONSE(resp, msg, sizeof(*ary) +
  622                             (priv->rdrcount) * sizeof(*entry), M_NOWAIT);
  623                         if (resp == NULL) {
  624                                 error = ENOMEM;
  625                                 break;
  626                         }
  627 
  628                         ary = (struct ng_nat_list_redirects *)resp->data;
  629                         ary->total_count = priv->rdrcount;
  630 
  631                         STAILQ_FOREACH(entry, &priv->redirhead, entries) {
  632                                 bcopy(&entry->rdr, &ary->redirects[i++],
  633                                     sizeof(struct ng_nat_listrdrs_entry));
  634                         }
  635                     }
  636                         break;
  637                 case NGM_NAT_PROXY_RULE:
  638                     {
  639                         char *cmd = (char *)msg->data;
  640 
  641                         if (msg->header.arglen < 6) {
  642                                 error = EINVAL;
  643                                 break;
  644                         }
  645 
  646                         if (LibAliasProxyRule(priv->lib, cmd) != 0)
  647                                 error = ENOMEM;
  648                     }
  649                         break;
  650                 default:
  651                         error = EINVAL;         /* unknown command */
  652                         break;
  653                 }
  654                 break;
  655         default:
  656                 error = EINVAL;                 /* unknown cookie type */
  657                 break;
  658         }
  659 
  660         NG_RESPOND_MSG(error, node, item, resp);
  661         NG_FREE_MSG(msg);
  662         return (error);
  663 }
  664 
  665 static int
  666 ng_nat_rcvdata(hook_p hook, item_p item )
  667 {
  668         const priv_p priv = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
  669         struct mbuf     *m;
  670         struct ip       *ip;
  671         int rval, error = 0;
  672         char *c;
  673 
  674         /* We have no required hooks. */
  675         if (!(priv->flags & NGNAT_CONNECTED)) {
  676                 NG_FREE_ITEM(item);
  677                 return (ENXIO);
  678         }
  679 
  680         /* We have no alias address yet to do anything. */
  681         if (!(priv->flags & NGNAT_ADDR_DEFINED))
  682                 goto send;
  683 
  684         m = NGI_M(item);
  685 
  686         if ((m = m_megapullup(m, m->m_pkthdr.len)) == NULL) {
  687                 NGI_M(item) = NULL;     /* avoid double free */
  688                 NG_FREE_ITEM(item);
  689                 return (ENOBUFS);
  690         }
  691 
  692         NGI_M(item) = m;
  693 
  694         c = mtod(m, char *);
  695         ip = mtod(m, struct ip *);
  696 
  697         KASSERT(m->m_pkthdr.len == ntohs(ip->ip_len),
  698             ("ng_nat: ip_len != m_pkthdr.len"));
  699 
  700         /*
  701          * We drop packet when:
  702          * 1. libalias returns PKT_ALIAS_ERROR;
  703          * 2. For incoming packets:
  704          *      a) for unresolved fragments;
  705          *      b) libalias returns PKT_ALIAS_IGNORED and
  706          *              PKT_ALIAS_DENY_INCOMING flag is set.
  707          */
  708         if (hook == priv->in) {
  709                 rval = LibAliasIn(priv->lib, c, m->m_len + M_TRAILINGSPACE(m));
  710                 if (rval == PKT_ALIAS_ERROR ||
  711                     rval == PKT_ALIAS_UNRESOLVED_FRAGMENT ||
  712                     (rval == PKT_ALIAS_IGNORED &&
  713                      (priv->lib->packetAliasMode &
  714                       PKT_ALIAS_DENY_INCOMING) != 0)) {
  715                         NG_FREE_ITEM(item);
  716                         return (EINVAL);
  717                 }
  718         } else if (hook == priv->out) {
  719                 rval = LibAliasOut(priv->lib, c, m->m_len + M_TRAILINGSPACE(m));
  720                 if (rval == PKT_ALIAS_ERROR) {
  721                         NG_FREE_ITEM(item);
  722                         return (EINVAL);
  723                 }
  724         } else
  725                 panic("ng_nat: unknown hook!\n");
  726 
  727         if (rval == PKT_ALIAS_RESPOND)
  728                 m->m_flags |= M_SKIP_FIREWALL;
  729         m->m_pkthdr.len = m->m_len = ntohs(ip->ip_len);
  730 
  731         if ((ip->ip_off & htons(IP_OFFMASK)) == 0 &&
  732             ip->ip_p == IPPROTO_TCP) {
  733                 struct tcphdr *th = (struct tcphdr *)((caddr_t)ip +
  734                     (ip->ip_hl << 2));
  735 
  736                 /*
  737                  * Here is our terrible HACK.
  738                  *
  739                  * Sometimes LibAlias edits contents of TCP packet.
  740                  * In this case it needs to recompute full TCP
  741                  * checksum. However, the problem is that LibAlias
  742                  * doesn't have any idea about checksum offloading
  743                  * in kernel. To workaround this, we do not do
  744                  * checksumming in LibAlias, but only mark the
  745                  * packets in th_x2 field. If we receive a marked
  746                  * packet, we calculate correct checksum for it
  747                  * aware of offloading.
  748                  *
  749                  * Why do I do such a terrible hack instead of
  750                  * recalculating checksum for each packet?
  751                  * Because the previous checksum was not checked!
  752                  * Recalculating checksums for EVERY packet will
  753                  * hide ALL transmission errors. Yes, marked packets
  754                  * still suffer from this problem. But, sigh, natd(8)
  755                  * has this problem, too.
  756                  */
  757 
  758                 if (th->th_x2) {
  759                         th->th_x2 = 0;
  760                         ip->ip_len = ntohs(ip->ip_len);
  761                         th->th_sum = in_pseudo(ip->ip_src.s_addr,
  762                             ip->ip_dst.s_addr, htons(IPPROTO_TCP +
  763                             ip->ip_len - (ip->ip_hl << 2)));
  764         
  765                         if ((m->m_pkthdr.csum_flags & CSUM_TCP) == 0) {
  766                                 m->m_pkthdr.csum_data = offsetof(struct tcphdr,
  767                                     th_sum);
  768                                 in_delayed_cksum(m);
  769                         }
  770                         ip->ip_len = htons(ip->ip_len);
  771                 }
  772         }
  773 
  774 send:
  775         if (hook == priv->in)
  776                 NG_FWD_ITEM_HOOK(error, item, priv->out);
  777         else
  778                 NG_FWD_ITEM_HOOK(error, item, priv->in);
  779 
  780         return (error);
  781 }
  782 
  783 static int
  784 ng_nat_shutdown(node_p node)
  785 {
  786         const priv_p priv = NG_NODE_PRIVATE(node);
  787 
  788         NG_NODE_SET_PRIVATE(node, NULL);
  789         NG_NODE_UNREF(node);
  790 
  791         /* Free redirects list. */
  792         while (!STAILQ_EMPTY(&priv->redirhead)) {
  793                 struct ng_nat_rdr_lst *entry = STAILQ_FIRST(&priv->redirhead);
  794                 STAILQ_REMOVE_HEAD(&priv->redirhead, entries);
  795                 free(entry, M_NETGRAPH);
  796         };
  797 
  798         /* Final free. */
  799         LibAliasUninit(priv->lib);
  800         free(priv, M_NETGRAPH);
  801 
  802         return (0);
  803 }
  804 
  805 static int
  806 ng_nat_disconnect(hook_p hook)
  807 {
  808         const priv_p priv = NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
  809 
  810         priv->flags &= ~NGNAT_CONNECTED;
  811 
  812         if (hook == priv->out)
  813                 priv->out = NULL;
  814         if (hook == priv->in)
  815                 priv->in = NULL;
  816 
  817         if (priv->out == NULL && priv->in == NULL)
  818                 ng_rmnode_self(NG_HOOK_NODE(hook));
  819 
  820         return (0);
  821 }
  822 
  823 static unsigned int
  824 ng_nat_translate_flags(unsigned int x)
  825 {
  826         unsigned int    res = 0;
  827         
  828         if (x & NG_NAT_LOG)
  829                 res |= PKT_ALIAS_LOG;
  830         if (x & NG_NAT_DENY_INCOMING)
  831                 res |= PKT_ALIAS_DENY_INCOMING;
  832         if (x & NG_NAT_SAME_PORTS)
  833                 res |= PKT_ALIAS_SAME_PORTS;
  834         if (x & NG_NAT_UNREGISTERED_ONLY)
  835                 res |= PKT_ALIAS_UNREGISTERED_ONLY;
  836         if (x & NG_NAT_RESET_ON_ADDR_CHANGE)
  837                 res |= PKT_ALIAS_RESET_ON_ADDR_CHANGE;
  838         if (x & NG_NAT_PROXY_ONLY)
  839                 res |= PKT_ALIAS_PROXY_ONLY;
  840         if (x & NG_NAT_REVERSE)
  841                 res |= PKT_ALIAS_REVERSE;
  842 
  843         return (res);
  844 }

Cache object: 657b994c35f484e7ebaf35413234de69


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.