2001-06-04 15:09:51 +00:00
|
|
|
/*-
|
2017-11-27 15:23:17 +00:00
|
|
|
* SPDX-License-Identifier: BSD-2-Clause-FreeBSD
|
|
|
|
*
|
2001-11-03 11:34:09 +00:00
|
|
|
* Copyright (c) 2001 Charles Mott <cm@linktel.net>
|
2001-06-04 15:09:51 +00:00
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*/
|
|
|
|
|
2001-09-30 21:03:33 +00:00
|
|
|
#include <sys/cdefs.h>
|
|
|
|
__FBSDID("$FreeBSD$");
|
|
|
|
|
2001-06-04 15:09:51 +00:00
|
|
|
/*
|
1997-05-23 04:41:31 +00:00
|
|
|
Alias_db.c encapsulates all data structures used for storing
|
|
|
|
packet aliasing data. Other parts of the aliasing software
|
|
|
|
access data through functions provided in this file.
|
|
|
|
|
|
|
|
Data storage is based on the notion of a "link", which is
|
|
|
|
established for ICMP echo/reply packets, UDP datagrams and
|
|
|
|
TCP stream connections. A link stores the original source
|
|
|
|
and destination addresses. For UDP and TCP, it also stores
|
|
|
|
source and destination port numbers, as well as an alias
|
|
|
|
port number. Links are also used to store information about
|
|
|
|
fragments.
|
|
|
|
|
|
|
|
There is a facility for sweeping through and deleting old
|
|
|
|
links as new packets are sent through. A simple timeout is
|
|
|
|
used for ICMP and UDP links. TCP links are left alone unless
|
|
|
|
there is an incomplete connection, in which case the link
|
|
|
|
can be deleted after a certain amount of time.
|
|
|
|
|
|
|
|
|
|
|
|
Initial version: August, 1996 (cjm)
|
|
|
|
|
|
|
|
Version 1.4: September 16, 1996 (cjm)
|
2004-07-05 10:53:28 +00:00
|
|
|
Facility for handling incoming links added.
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
Version 1.6: September 18, 1996 (cjm)
|
2004-07-05 10:53:28 +00:00
|
|
|
ICMP data handling simplified.
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
Version 1.7: January 9, 1997 (cjm)
|
2004-07-05 10:53:28 +00:00
|
|
|
Fragment handling simplified.
|
|
|
|
Saves pointers for unresolved fragments.
|
|
|
|
Permits links for unspecified remote ports
|
|
|
|
or unspecified remote addresses.
|
|
|
|
Fixed bug which did not properly zero port
|
|
|
|
table entries after a link was deleted.
|
|
|
|
Cleaned up some obsolete comments.
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
Version 1.8: January 14, 1997 (cjm)
|
2004-07-05 10:53:28 +00:00
|
|
|
Fixed data type error in StartPoint().
|
|
|
|
(This error did not exist prior to v1.7
|
|
|
|
and was discovered and fixed by Ari Suutari)
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
Version 1.9: February 1, 1997
|
2004-07-05 10:53:28 +00:00
|
|
|
Optionally, connections initiated from packet aliasing host
|
|
|
|
machine will will not have their port number aliased unless it
|
|
|
|
conflicts with an aliasing port already being used. (cjm)
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
All options earlier being #ifdef'ed are now available through
|
|
|
|
a new interface, SetPacketAliasMode(). This allows run time
|
|
|
|
control (which is now available in PPP+pktAlias through the
|
|
|
|
'alias' keyword). (ee)
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
Added ability to create an alias port without
|
|
|
|
either destination address or port specified.
|
|
|
|
port type = ALIAS_PORT_UNKNOWN_DEST_ALL (ee)
|
1999-02-27 02:16:01 +00:00
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
Removed K&R style function headers
|
|
|
|
and general cleanup. (ee)
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
Added packetAliasMode to replace compiler #defines's (ee)
|
1999-02-27 02:16:01 +00:00
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
Allocates sockets for partially specified
|
|
|
|
ports if ALIAS_USE_SOCKETS defined. (cjm)
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
Version 2.0: March, 1997
|
2004-07-05 10:53:28 +00:00
|
|
|
SetAliasAddress() will now clean up alias links
|
|
|
|
if the aliasing address is changed. (cjm)
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
PacketAliasPermanentLink() function added to support permanent
|
|
|
|
links. (J. Fortes suggested the need for this.)
|
|
|
|
Examples:
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
(192.168.0.1, port 23) <-> alias port 6002, unknown dest addr/port
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
(192.168.0.2, port 21) <-> alias port 3604, known dest addr
|
|
|
|
unknown dest port
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
These permanent links allow for incoming connections to
|
|
|
|
machines on the local network. They can be given with a
|
|
|
|
user-chosen amount of specificity, with increasing specificity
|
|
|
|
meaning more security. (cjm)
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
Quite a bit of rework to the basic engine. The portTable[]
|
|
|
|
array, which kept track of which ports were in use was replaced
|
|
|
|
by a table/linked list structure. (cjm)
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
SetExpire() function added. (cjm)
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
DeleteLink() no longer frees memory association with a pointer
|
|
|
|
to a fragment (this bug was first recognized by E. Eklund in
|
|
|
|
v1.9).
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
Version 2.1: May, 1997 (cjm)
|
2004-07-05 10:53:28 +00:00
|
|
|
Packet aliasing engine reworked so that it can handle
|
|
|
|
multiple external addresses rather than just a single
|
|
|
|
host address.
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
PacketAliasRedirectPort() and PacketAliasRedirectAddr()
|
|
|
|
added to the API. The first function is a more generalized
|
|
|
|
version of PacketAliasPermanentLink(). The second function
|
|
|
|
implements static network address translation.
|
1998-01-09 21:13:35 +00:00
|
|
|
|
2000-07-26 23:15:46 +00:00
|
|
|
Version 3.2: July, 2000 (salander and satoh)
|
2004-07-05 10:53:28 +00:00
|
|
|
Added FindNewPortGroup to get contiguous range of port values.
|
2000-07-26 23:15:46 +00:00
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
Added QueryUdpTcpIn and QueryUdpTcpOut to look for an aliasing
|
2000-07-26 23:15:46 +00:00
|
|
|
link but not actually add one.
|
|
|
|
|
2004-07-05 10:53:28 +00:00
|
|
|
Added FindRtspOut, which is closely derived from FindUdpTcpOut,
|
2000-07-26 23:15:46 +00:00
|
|
|
except that the alias port (from FindNewPortGroup) is provided
|
|
|
|
as input.
|
|
|
|
|
1998-01-09 21:13:35 +00:00
|
|
|
See HISTORY file for additional revisions.
|
1997-05-23 04:41:31 +00:00
|
|
|
*/
|
|
|
|
|
2005-05-05 19:27:32 +00:00
|
|
|
#ifdef _KERNEL
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
#include <machine/stdarg.h>
|
2005-05-05 19:27:32 +00:00
|
|
|
#include <sys/param.h>
|
|
|
|
#include <sys/kernel.h>
|
2013-10-26 18:18:50 +00:00
|
|
|
#include <sys/systm.h>
|
Conditionally compile out V_ globals while instantiating the appropriate
container structures, depending on VIMAGE_GLOBALS compile time option.
Make VIMAGE_GLOBALS a new compile-time option, which by default will not
be defined, resulting in instatiations of global variables selected for
V_irtualization (enclosed in #ifdef VIMAGE_GLOBALS blocks) to be
effectively compiled out. Instantiate new global container structures
to hold V_irtualized variables: vnet_net_0, vnet_inet_0, vnet_inet6_0,
vnet_ipsec_0, vnet_netgraph_0, and vnet_gif_0.
Update the VSYM() macro so that depending on VIMAGE_GLOBALS the V_
macros resolve either to the original globals, or to fields inside
container structures, i.e. effectively
#ifdef VIMAGE_GLOBALS
#define V_rt_tables rt_tables
#else
#define V_rt_tables vnet_net_0._rt_tables
#endif
Update SYSCTL_V_*() macros to operate either on globals or on fields
inside container structs.
Extend the internal kldsym() lookups with the ability to resolve
selected fields inside the virtualization container structs. This
applies only to the fields which are explicitly registered for kldsym()
visibility via VNET_MOD_DECLARE() and vnet_mod_register(), currently
this is done only in sys/net/if.c.
Fix a few broken instances of MODULE_GLOBAL() macro use in SCTP code,
and modify the MODULE_GLOBAL() macro to resolve to V_ macros, which in
turn result in proper code being generated depending on VIMAGE_GLOBALS.
De-virtualize local static variables in sys/contrib/pf/net/pf_subr.c
which were prematurely V_irtualized by automated V_ prepending scripts
during earlier merging steps. PF virtualization will be done
separately, most probably after next PF import.
Convert a few variable initializations at instantiation to
initialization in init functions, most notably in ipfw. Also convert
TUNABLE_INT() initializers for V_ variables to TUNABLE_FETCH_INT() in
initializer functions.
Discussed at: devsummit Strassburg
Reviewed by: bz, julian
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-12-10 23:12:39 +00:00
|
|
|
#include <sys/lock.h>
|
2005-05-05 19:27:32 +00:00
|
|
|
#include <sys/module.h>
|
Conditionally compile out V_ globals while instantiating the appropriate
container structures, depending on VIMAGE_GLOBALS compile time option.
Make VIMAGE_GLOBALS a new compile-time option, which by default will not
be defined, resulting in instatiations of global variables selected for
V_irtualization (enclosed in #ifdef VIMAGE_GLOBALS blocks) to be
effectively compiled out. Instantiate new global container structures
to hold V_irtualized variables: vnet_net_0, vnet_inet_0, vnet_inet6_0,
vnet_ipsec_0, vnet_netgraph_0, and vnet_gif_0.
Update the VSYM() macro so that depending on VIMAGE_GLOBALS the V_
macros resolve either to the original globals, or to fields inside
container structures, i.e. effectively
#ifdef VIMAGE_GLOBALS
#define V_rt_tables rt_tables
#else
#define V_rt_tables vnet_net_0._rt_tables
#endif
Update SYSCTL_V_*() macros to operate either on globals or on fields
inside container structs.
Extend the internal kldsym() lookups with the ability to resolve
selected fields inside the virtualization container structs. This
applies only to the fields which are explicitly registered for kldsym()
visibility via VNET_MOD_DECLARE() and vnet_mod_register(), currently
this is done only in sys/net/if.c.
Fix a few broken instances of MODULE_GLOBAL() macro use in SCTP code,
and modify the MODULE_GLOBAL() macro to resolve to V_ macros, which in
turn result in proper code being generated depending on VIMAGE_GLOBALS.
De-virtualize local static variables in sys/contrib/pf/net/pf_subr.c
which were prematurely V_irtualized by automated V_ prepending scripts
during earlier merging steps. PF virtualization will be done
separately, most probably after next PF import.
Convert a few variable initializations at instantiation to
initialization in init functions, most notably in ipfw. Also convert
TUNABLE_INT() initializers for V_ variables to TUNABLE_FETCH_INT() in
initializer functions.
Discussed at: devsummit Strassburg
Reviewed by: bz, julian
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-12-10 23:12:39 +00:00
|
|
|
#include <sys/rwlock.h>
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
#include <sys/syslog.h>
|
|
|
|
#else
|
|
|
|
#include <stdarg.h>
|
2005-05-05 19:27:32 +00:00
|
|
|
#include <stdlib.h>
|
|
|
|
#include <stdio.h>
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
#include <sys/errno.h>
|
|
|
|
#include <sys/time.h>
|
2005-05-05 19:27:32 +00:00
|
|
|
#include <unistd.h>
|
|
|
|
#endif
|
1997-05-23 04:41:31 +00:00
|
|
|
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
#include <sys/socket.h>
|
1997-05-23 04:41:31 +00:00
|
|
|
#include <netinet/tcp.h>
|
|
|
|
|
2005-05-05 19:27:32 +00:00
|
|
|
#ifdef _KERNEL
|
|
|
|
#include <netinet/libalias/alias.h>
|
|
|
|
#include <netinet/libalias/alias_local.h>
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
#include <netinet/libalias/alias_mod.h>
|
|
|
|
#include <net/if.h>
|
2005-05-05 19:27:32 +00:00
|
|
|
#else
|
1997-05-23 04:41:31 +00:00
|
|
|
#include "alias.h"
|
|
|
|
#include "alias_local.h"
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
#include "alias_mod.h"
|
2005-05-05 19:27:32 +00:00
|
|
|
#endif
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
static LIST_HEAD(, libalias) instancehead = LIST_HEAD_INITIALIZER(instancehead);
|
2004-01-17 10:52:21 +00:00
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
Constants (note: constants are also defined
|
2004-07-05 10:53:28 +00:00
|
|
|
near relevant functions or structs)
|
1997-05-23 04:41:31 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
/* Parameters used for cleanup of expired links */
|
2008-06-01 18:34:58 +00:00
|
|
|
/* NOTE: ALIAS_CLEANUP_INTERVAL_SECS must be less then LINK_TABLE_OUT_SIZE */
|
|
|
|
#define ALIAS_CLEANUP_INTERVAL_SECS 64
|
|
|
|
#define ALIAS_CLEANUP_MAX_SPOKES (LINK_TABLE_OUT_SIZE/5)
|
1997-05-23 04:41:31 +00:00
|
|
|
|
1999-09-21 08:40:20 +00:00
|
|
|
/* Timeouts (in seconds) for different link types */
|
1997-05-23 04:41:31 +00:00
|
|
|
#define ICMP_EXPIRE_TIME 60
|
|
|
|
#define UDP_EXPIRE_TIME 60
|
2000-04-28 13:44:49 +00:00
|
|
|
#define PROTO_EXPIRE_TIME 60
|
1997-05-23 04:41:31 +00:00
|
|
|
#define FRAGMENT_ID_EXPIRE_TIME 10
|
|
|
|
#define FRAGMENT_PTR_EXPIRE_TIME 30
|
|
|
|
|
1998-01-09 21:13:35 +00:00
|
|
|
/* TCP link expire time for different cases */
|
|
|
|
/* When the link has been used and closed - minimal grace time to
|
|
|
|
allow ACKs and potential re-connect in FTP (XXX - is this allowed?) */
|
|
|
|
#ifndef TCP_EXPIRE_DEAD
|
2004-03-16 21:30:41 +00:00
|
|
|
#define TCP_EXPIRE_DEAD 10
|
1998-01-09 21:13:35 +00:00
|
|
|
#endif
|
|
|
|
|
|
|
|
/* When the link has been used and closed on one side - the other side
|
|
|
|
is allowed to still send data */
|
|
|
|
#ifndef TCP_EXPIRE_SINGLEDEAD
|
2004-03-16 21:30:41 +00:00
|
|
|
#define TCP_EXPIRE_SINGLEDEAD 90
|
1998-01-09 21:13:35 +00:00
|
|
|
#endif
|
|
|
|
|
|
|
|
/* When the link isn't yet up */
|
|
|
|
#ifndef TCP_EXPIRE_INITIAL
|
2004-03-16 21:30:41 +00:00
|
|
|
#define TCP_EXPIRE_INITIAL 300
|
1998-01-09 21:13:35 +00:00
|
|
|
#endif
|
|
|
|
|
|
|
|
/* When the link is up */
|
|
|
|
#ifndef TCP_EXPIRE_CONNECTED
|
2004-03-16 21:30:41 +00:00
|
|
|
#define TCP_EXPIRE_CONNECTED 86400
|
1998-01-09 21:13:35 +00:00
|
|
|
#endif
|
|
|
|
|
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
/* Dummy port number codes used for FindLinkIn/Out() and AddLink().
|
|
|
|
These constants can be anything except zero, which indicates an
|
1999-02-27 02:16:01 +00:00
|
|
|
unknown port number. */
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
#define NO_DEST_PORT 1
|
|
|
|
#define NO_SRC_PORT 1
|
|
|
|
|
|
|
|
|
|
|
|
|
1999-02-27 02:16:01 +00:00
|
|
|
/* Data Structures
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
The fundamental data structure used in this program is
|
|
|
|
"struct alias_link". Whenever a TCP connection is made,
|
|
|
|
a UDP datagram is sent out, or an ICMP echo request is made,
|
|
|
|
a link record is made (if it has not already been created).
|
|
|
|
The link record is identified by the source address/port
|
|
|
|
and the destination address/port. In the case of an ICMP
|
|
|
|
echo request, the source port is treated as being equivalent
|
2000-04-18 10:18:21 +00:00
|
|
|
with the 16-bit ID number of the ICMP packet.
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
The link record also can store some auxiliary data. For
|
|
|
|
TCP connections that have had sequence and acknowledgment
|
|
|
|
modifications, data space is available to track these changes.
|
2000-04-18 10:18:21 +00:00
|
|
|
A state field is used to keep track in changes to the TCP
|
|
|
|
connection state. ID numbers of fragments can also be
|
1997-05-23 04:41:31 +00:00
|
|
|
stored in the auxiliary space. Pointers to unresolved
|
2000-04-18 10:18:21 +00:00
|
|
|
fragments can also be stored.
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
The link records support two independent chainings. Lookup
|
|
|
|
tables for input and out tables hold the initial pointers
|
|
|
|
the link chains. On input, the lookup table indexes on alias
|
|
|
|
port and link type. On output, the lookup table indexes on
|
2000-04-18 10:18:21 +00:00
|
|
|
source address, destination address, source port, destination
|
1997-05-23 04:41:31 +00:00
|
|
|
port and link type.
|
|
|
|
*/
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
struct ack_data_record { /* used to save changes to ACK/sequence
|
|
|
|
* numbers */
|
|
|
|
u_long ack_old;
|
|
|
|
u_long ack_new;
|
|
|
|
int delta;
|
|
|
|
int active;
|
1997-05-23 04:41:31 +00:00
|
|
|
};
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
struct tcp_state { /* Information about TCP connection */
|
|
|
|
int in; /* State for outside -> inside */
|
|
|
|
int out; /* State for inside -> outside */
|
|
|
|
int index; /* Index to ACK data array */
|
|
|
|
int ack_modified; /* Indicates whether ACK and
|
|
|
|
* sequence numbers */
|
|
|
|
/* been modified */
|
1997-05-23 04:41:31 +00:00
|
|
|
};
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
#define N_LINK_TCP_DATA 3 /* Number of distinct ACK number changes
|
|
|
|
* saved for a modified TCP stream */
|
|
|
|
struct tcp_dat {
|
|
|
|
struct tcp_state state;
|
|
|
|
struct ack_data_record ack[N_LINK_TCP_DATA];
|
|
|
|
int fwhole; /* Which firewall record is used for this
|
|
|
|
* hole? */
|
1997-05-23 04:41:31 +00:00
|
|
|
};
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
struct server { /* LSNAT server pool (circular list) */
|
|
|
|
struct in_addr addr;
|
|
|
|
u_short port;
|
|
|
|
struct server *next;
|
2000-04-27 17:37:03 +00:00
|
|
|
};
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
struct alias_link { /* Main data structure */
|
|
|
|
struct libalias *la;
|
|
|
|
struct in_addr src_addr; /* Address and port information */
|
|
|
|
struct in_addr dst_addr;
|
|
|
|
struct in_addr alias_addr;
|
|
|
|
struct in_addr proxy_addr;
|
|
|
|
u_short src_port;
|
|
|
|
u_short dst_port;
|
|
|
|
u_short alias_port;
|
|
|
|
u_short proxy_port;
|
|
|
|
struct server *server;
|
|
|
|
|
|
|
|
int link_type; /* Type of link: TCP, UDP, ICMP,
|
|
|
|
* proto, frag */
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
/* values for link_type */
|
2000-04-28 13:44:49 +00:00
|
|
|
#define LINK_ICMP IPPROTO_ICMP
|
|
|
|
#define LINK_UDP IPPROTO_UDP
|
|
|
|
#define LINK_TCP IPPROTO_TCP
|
|
|
|
#define LINK_FRAGMENT_ID (IPPROTO_MAX + 1)
|
|
|
|
#define LINK_FRAGMENT_PTR (IPPROTO_MAX + 2)
|
|
|
|
#define LINK_ADDR (IPPROTO_MAX + 3)
|
2000-06-20 11:41:48 +00:00
|
|
|
#define LINK_PPTP (IPPROTO_MAX + 4)
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
int flags; /* indicates special characteristics */
|
|
|
|
int pflags; /* protocol-specific flags */
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
/* flag bits */
|
|
|
|
#define LINK_UNKNOWN_DEST_PORT 0x01
|
|
|
|
#define LINK_UNKNOWN_DEST_ADDR 0x02
|
|
|
|
#define LINK_PERMANENT 0x04
|
2004-03-16 21:30:41 +00:00
|
|
|
#define LINK_PARTIALLY_SPECIFIED 0x03 /* logical-or of first two bits */
|
1998-01-09 21:13:35 +00:00
|
|
|
#define LINK_UNFIREWALLED 0x08
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
int timestamp; /* Time link was last accessed */
|
|
|
|
int expire_time; /* Expire time for link */
|
2005-05-05 20:25:12 +00:00
|
|
|
#ifndef NO_USE_SOCKETS
|
2004-03-16 21:30:41 +00:00
|
|
|
int sockfd; /* socket descriptor */
|
2005-05-05 20:25:12 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
LIST_ENTRY (alias_link) list_out; /* Linked list of
|
|
|
|
* pointers for */
|
|
|
|
LIST_ENTRY (alias_link) list_in; /* input and output
|
|
|
|
* lookup tables */
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
union { /* Auxiliary data */
|
|
|
|
char *frag_ptr;
|
|
|
|
struct in_addr frag_addr;
|
|
|
|
struct tcp_dat *tcp;
|
|
|
|
} data;
|
1997-05-23 04:41:31 +00:00
|
|
|
};
|
|
|
|
|
2005-05-05 21:05:38 +00:00
|
|
|
/* Clean up procedure. */
|
|
|
|
static void finishoff(void);
|
|
|
|
|
|
|
|
/* Kernel module definition. */
|
|
|
|
#ifdef _KERNEL
|
|
|
|
MALLOC_DEFINE(M_ALIAS, "libalias", "packet aliasing");
|
|
|
|
|
|
|
|
MODULE_VERSION(libalias, 1);
|
|
|
|
|
|
|
|
static int
|
|
|
|
alias_mod_handler(module_t mod, int type, void *data)
|
|
|
|
{
|
|
|
|
|
|
|
|
switch (type) {
|
|
|
|
case MOD_QUIESCE:
|
|
|
|
case MOD_UNLOAD:
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
finishoff();
|
2013-12-25 03:24:20 +00:00
|
|
|
case MOD_LOAD:
|
|
|
|
return (0);
|
2005-05-05 21:05:38 +00:00
|
|
|
default:
|
2013-12-25 03:24:20 +00:00
|
|
|
return (EINVAL);
|
2005-05-05 21:05:38 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static moduledata_t alias_mod = {
|
|
|
|
"alias", alias_mod_handler, NULL
|
|
|
|
};
|
|
|
|
|
|
|
|
DECLARE_MODULE(alias, alias_mod, SI_SUB_DRIVERS, SI_ORDER_SECOND);
|
|
|
|
#endif
|
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
/* Internal utility routines (used only in alias_db.c)
|
|
|
|
|
|
|
|
Lookup table starting points:
|
|
|
|
StartPointIn() -- link table initial search point for
|
2004-07-05 10:53:28 +00:00
|
|
|
incoming packets
|
2000-04-18 10:18:21 +00:00
|
|
|
StartPointOut() -- link table initial search point for
|
2004-07-05 10:53:28 +00:00
|
|
|
outgoing packets
|
2002-07-01 11:19:40 +00:00
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
Miscellaneous:
|
|
|
|
SeqDiff() -- difference between two TCP sequences
|
|
|
|
ShowAliasStats() -- send alias statistics to a monitor file
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
/* Local prototypes */
|
2004-03-16 21:30:41 +00:00
|
|
|
static u_int StartPointIn(struct in_addr, u_short, int);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
static u_int
|
|
|
|
StartPointOut(struct in_addr, struct in_addr,
|
|
|
|
u_short, u_short, int);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
static int SeqDiff(u_long, u_long);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
1998-04-19 21:42:07 +00:00
|
|
|
#ifndef NO_FW_PUNCH
|
1998-01-09 21:13:35 +00:00
|
|
|
/* Firewall control */
|
2004-07-05 11:10:57 +00:00
|
|
|
static void InitPunchFW(struct libalias *);
|
|
|
|
static void UninitPunchFW(struct libalias *);
|
|
|
|
static void ClearFWHole(struct alias_link *);
|
2004-03-16 21:30:41 +00:00
|
|
|
|
1998-04-19 21:42:07 +00:00
|
|
|
#endif
|
1998-01-09 21:13:35 +00:00
|
|
|
|
|
|
|
/* Log file control */
|
2005-05-05 20:22:09 +00:00
|
|
|
static void ShowAliasStats(struct libalias *);
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
static int InitPacketAliasLog(struct libalias *);
|
2004-07-05 11:10:57 +00:00
|
|
|
static void UninitPacketAliasLog(struct libalias *);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2009-02-07 18:49:42 +00:00
|
|
|
void SctpShowAliasStats(struct libalias *la);
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
static u_int
|
1997-05-23 04:41:31 +00:00
|
|
|
StartPointIn(struct in_addr alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
u_short alias_port,
|
|
|
|
int link_type)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
u_int n;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
n = alias_addr.s_addr;
|
|
|
|
if (link_type != LINK_PPTP)
|
|
|
|
n += alias_port;
|
|
|
|
n += link_type;
|
|
|
|
return (n % LINK_TABLE_IN_SIZE);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
static u_int
|
1997-05-23 04:41:31 +00:00
|
|
|
StartPointOut(struct in_addr src_addr, struct in_addr dst_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
u_short src_port, u_short dst_port, int link_type)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
u_int n;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
n = src_addr.s_addr;
|
|
|
|
n += dst_addr.s_addr;
|
|
|
|
if (link_type != LINK_PPTP) {
|
|
|
|
n += src_port;
|
|
|
|
n += dst_port;
|
|
|
|
}
|
|
|
|
n += link_type;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
return (n % LINK_TABLE_OUT_SIZE);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static int
|
|
|
|
SeqDiff(u_long x, u_long y)
|
|
|
|
{
|
|
|
|
/* Return the difference between two TCP sequence numbers */
|
|
|
|
|
|
|
|
/*
|
|
|
|
This function is encapsulated in case there are any unusual
|
|
|
|
arithmetic conditions that need to be considered.
|
|
|
|
*/
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
return (ntohl(y) - ntohl(x));
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
#ifdef _KERNEL
|
|
|
|
|
|
|
|
static void
|
|
|
|
AliasLog(char *str, const char *format, ...)
|
|
|
|
{
|
|
|
|
va_list ap;
|
|
|
|
|
|
|
|
va_start(ap, format);
|
|
|
|
vsnprintf(str, LIBALIAS_BUF_SIZE, format, ap);
|
|
|
|
va_end(ap);
|
|
|
|
}
|
|
|
|
#else
|
|
|
|
static void
|
|
|
|
AliasLog(FILE *stream, const char *format, ...)
|
|
|
|
{
|
|
|
|
va_list ap;
|
|
|
|
|
|
|
|
va_start(ap, format);
|
|
|
|
vfprintf(stream, format, ap);
|
|
|
|
va_end(ap);
|
|
|
|
fflush(stream);
|
|
|
|
}
|
|
|
|
#endif
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
static void
|
2004-01-17 10:52:21 +00:00
|
|
|
ShowAliasStats(struct libalias *la)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
1997-05-23 04:41:31 +00:00
|
|
|
/* Used for debugging */
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
if (la->logDesc) {
|
|
|
|
int tot = la->icmpLinkCount + la->udpLinkCount +
|
2009-02-07 18:49:42 +00:00
|
|
|
(la->sctpLinkCount>>1) + /* sctp counts half associations */
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
la->tcpLinkCount + la->pptpLinkCount +
|
|
|
|
la->protoLinkCount + la->fragmentIdLinkCount +
|
|
|
|
la->fragmentPtrLinkCount;
|
|
|
|
|
|
|
|
AliasLog(la->logDesc,
|
2009-02-07 18:49:42 +00:00
|
|
|
"icmp=%u, udp=%u, tcp=%u, sctp=%u, pptp=%u, proto=%u, frag_id=%u frag_ptr=%u / tot=%u",
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
la->icmpLinkCount,
|
|
|
|
la->udpLinkCount,
|
|
|
|
la->tcpLinkCount,
|
2009-02-07 18:49:42 +00:00
|
|
|
la->sctpLinkCount>>1, /* sctp counts half associations */
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
la->pptpLinkCount,
|
|
|
|
la->protoLinkCount,
|
|
|
|
la->fragmentIdLinkCount,
|
|
|
|
la->fragmentPtrLinkCount, tot);
|
|
|
|
#ifndef _KERNEL
|
|
|
|
AliasLog(la->logDesc, " (sock=%u)\n", la->sockCount);
|
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
2009-02-07 18:49:42 +00:00
|
|
|
void SctpShowAliasStats(struct libalias *la)
|
|
|
|
{
|
|
|
|
|
|
|
|
ShowAliasStats(la);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
/* Internal routines for finding, deleting and adding links
|
|
|
|
|
|
|
|
Port Allocation:
|
|
|
|
GetNewPort() -- find and reserve new alias port number
|
|
|
|
GetSocket() -- try to allocate a socket for a given port
|
|
|
|
|
|
|
|
Link creation and deletion:
|
|
|
|
CleanupAliasData() - remove all link chains from lookup table
|
|
|
|
IncrementalCleanup() - look for stale links in a single chain
|
|
|
|
DeleteLink() - remove link
|
2002-07-01 11:19:40 +00:00
|
|
|
AddLink() - add link
|
|
|
|
ReLink() - change link
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
Link search:
|
|
|
|
FindLinkOut() - find link for outgoing packets
|
|
|
|
FindLinkIn() - find link for incoming packets
|
2000-07-26 23:15:46 +00:00
|
|
|
|
|
|
|
Port search:
|
2002-07-01 11:19:40 +00:00
|
|
|
FindNewPortGroup() - find an available group of ports
|
1997-05-23 04:41:31 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
/* Local prototypes */
|
2004-03-16 21:30:41 +00:00
|
|
|
static int GetNewPort(struct libalias *, struct alias_link *, int);
|
2005-05-05 20:25:12 +00:00
|
|
|
#ifndef NO_USE_SOCKETS
|
2004-03-16 21:30:41 +00:00
|
|
|
static u_short GetSocket(struct libalias *, u_short, int *, int);
|
2005-05-05 20:25:12 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
static void CleanupAliasData(struct libalias *);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
static void IncrementalCleanup(struct libalias *);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
static void DeleteLink(struct alias_link *);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
1998-01-09 21:13:35 +00:00
|
|
|
static struct alias_link *
|
|
|
|
ReLink(struct alias_link *,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr, struct in_addr, struct in_addr,
|
|
|
|
u_short, u_short, int, int);
|
1998-01-09 21:13:35 +00:00
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
static struct alias_link *
|
2004-03-16 21:30:41 +00:00
|
|
|
FindLinkOut (struct libalias *, struct in_addr, struct in_addr, u_short, u_short, int, int);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
static struct alias_link *
|
2004-03-16 21:30:41 +00:00
|
|
|
FindLinkIn (struct libalias *, struct in_addr, struct in_addr, u_short, u_short, int, int);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
|
|
|
|
#define ALIAS_PORT_BASE 0x08000
|
|
|
|
#define ALIAS_PORT_MASK 0x07fff
|
2000-07-26 23:15:46 +00:00
|
|
|
#define ALIAS_PORT_MASK_EVEN 0x07ffe
|
1997-05-23 04:41:31 +00:00
|
|
|
#define GET_NEW_PORT_MAX_ATTEMPTS 20
|
|
|
|
|
2000-07-26 23:15:46 +00:00
|
|
|
#define FIND_EVEN_ALIAS_BASE 1
|
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
/* GetNewPort() allocates port numbers. Note that if a port number
|
|
|
|
is already in use, that does not mean that it cannot be used by
|
|
|
|
another link concurrently. This is because GetNewPort() looks for
|
|
|
|
unused triplets: (dest addr, dest port, alias port). */
|
|
|
|
|
|
|
|
static int
|
2004-07-05 11:10:57 +00:00
|
|
|
GetNewPort(struct libalias *la, struct alias_link *lnk, int alias_port_param)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
int i;
|
|
|
|
int max_trials;
|
|
|
|
u_short port_sys;
|
|
|
|
u_short port_net;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
1997-05-23 04:41:31 +00:00
|
|
|
/*
|
|
|
|
Description of alias_port_param for GetNewPort(). When
|
|
|
|
this parameter is zero or positive, it precisely specifies
|
|
|
|
the port number. GetNewPort() will return this number
|
|
|
|
without check that it is in use.
|
|
|
|
|
2000-06-20 11:41:48 +00:00
|
|
|
When this parameter is GET_ALIAS_PORT, it indicates to get a randomly
|
1997-05-23 04:41:31 +00:00
|
|
|
selected port number.
|
|
|
|
*/
|
2002-07-01 11:19:40 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
if (alias_port_param == GET_ALIAS_PORT) {
|
|
|
|
/*
|
|
|
|
* The aliasing port is automatically selected by one of
|
|
|
|
* two methods below:
|
|
|
|
*/
|
|
|
|
max_trials = GET_NEW_PORT_MAX_ATTEMPTS;
|
|
|
|
|
|
|
|
if (la->packetAliasMode & PKT_ALIAS_SAME_PORTS) {
|
|
|
|
/*
|
|
|
|
* When the PKT_ALIAS_SAME_PORTS option is chosen,
|
|
|
|
* the first try will be the actual source port. If
|
|
|
|
* this is already in use, the remainder of the
|
|
|
|
* trials will be random.
|
|
|
|
*/
|
2004-07-05 11:10:57 +00:00
|
|
|
port_net = lnk->src_port;
|
2004-03-16 21:30:41 +00:00
|
|
|
port_sys = ntohs(port_net);
|
|
|
|
} else {
|
|
|
|
/* First trial and all subsequent are random. */
|
2008-08-30 20:58:34 +00:00
|
|
|
port_sys = arc4random() & ALIAS_PORT_MASK;
|
2004-03-16 21:30:41 +00:00
|
|
|
port_sys += ALIAS_PORT_BASE;
|
|
|
|
port_net = htons(port_sys);
|
|
|
|
}
|
|
|
|
} else if (alias_port_param >= 0 && alias_port_param < 0x10000) {
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->alias_port = (u_short) alias_port_param;
|
2004-03-16 21:30:41 +00:00
|
|
|
return (0);
|
|
|
|
} else {
|
2005-05-06 11:07:49 +00:00
|
|
|
#ifdef LIBALIAS_DEBUG
|
2004-03-16 21:30:41 +00:00
|
|
|
fprintf(stderr, "PacketAlias/GetNewPort(): ");
|
|
|
|
fprintf(stderr, "input parameter error\n");
|
1999-03-09 23:44:00 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
return (-1);
|
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
|
|
|
|
/* Port number search */
|
2004-03-16 21:30:41 +00:00
|
|
|
for (i = 0; i < max_trials; i++) {
|
|
|
|
int go_ahead;
|
|
|
|
struct alias_link *search_result;
|
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
search_result = FindLinkIn(la, lnk->dst_addr, lnk->alias_addr,
|
|
|
|
lnk->dst_port, port_net,
|
|
|
|
lnk->link_type, 0);
|
2004-03-16 21:30:41 +00:00
|
|
|
|
|
|
|
if (search_result == NULL)
|
|
|
|
go_ahead = 1;
|
2004-07-05 11:10:57 +00:00
|
|
|
else if (!(lnk->flags & LINK_PARTIALLY_SPECIFIED)
|
2004-03-16 21:30:41 +00:00
|
|
|
&& (search_result->flags & LINK_PARTIALLY_SPECIFIED))
|
|
|
|
go_ahead = 1;
|
|
|
|
else
|
|
|
|
go_ahead = 0;
|
|
|
|
|
|
|
|
if (go_ahead) {
|
2005-05-05 20:25:12 +00:00
|
|
|
#ifndef NO_USE_SOCKETS
|
2004-03-16 21:30:41 +00:00
|
|
|
if ((la->packetAliasMode & PKT_ALIAS_USE_SOCKETS)
|
2004-07-05 11:10:57 +00:00
|
|
|
&& (lnk->flags & LINK_PARTIALLY_SPECIFIED)
|
|
|
|
&& ((lnk->link_type == LINK_TCP) ||
|
|
|
|
(lnk->link_type == LINK_UDP))) {
|
|
|
|
if (GetSocket(la, port_net, &lnk->sockfd, lnk->link_type)) {
|
|
|
|
lnk->alias_port = port_net;
|
2004-03-16 21:30:41 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
} else {
|
2005-05-05 20:25:12 +00:00
|
|
|
#endif
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->alias_port = port_net;
|
2004-03-16 21:30:41 +00:00
|
|
|
return (0);
|
2005-05-05 20:25:12 +00:00
|
|
|
#ifndef NO_USE_SOCKETS
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
2005-05-05 20:25:12 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
2008-08-30 20:58:34 +00:00
|
|
|
port_sys = arc4random() & ALIAS_PORT_MASK;
|
2004-03-16 21:30:41 +00:00
|
|
|
port_sys += ALIAS_PORT_BASE;
|
|
|
|
port_net = htons(port_sys);
|
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2005-05-06 11:07:49 +00:00
|
|
|
#ifdef LIBALIAS_DEBUG
|
2004-03-16 21:30:41 +00:00
|
|
|
fprintf(stderr, "PacketAlias/GetnewPort(): ");
|
|
|
|
fprintf(stderr, "could not find free port\n");
|
1999-03-09 23:44:00 +00:00
|
|
|
#endif
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
return (-1);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
2005-05-05 20:25:12 +00:00
|
|
|
#ifndef NO_USE_SOCKETS
|
2004-03-16 21:30:41 +00:00
|
|
|
static u_short
|
2004-01-17 10:52:21 +00:00
|
|
|
GetSocket(struct libalias *la, u_short port_net, int *sockfd, int link_type)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
int err;
|
|
|
|
int sock;
|
|
|
|
struct sockaddr_in sock_addr;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
if (link_type == LINK_TCP)
|
|
|
|
sock = socket(AF_INET, SOCK_STREAM, 0);
|
|
|
|
else if (link_type == LINK_UDP)
|
|
|
|
sock = socket(AF_INET, SOCK_DGRAM, 0);
|
|
|
|
else {
|
2005-05-06 11:07:49 +00:00
|
|
|
#ifdef LIBALIAS_DEBUG
|
2004-03-16 21:30:41 +00:00
|
|
|
fprintf(stderr, "PacketAlias/GetSocket(): ");
|
|
|
|
fprintf(stderr, "incorrect link type\n");
|
1999-03-09 23:44:00 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
return (0);
|
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
if (sock < 0) {
|
2005-05-06 11:07:49 +00:00
|
|
|
#ifdef LIBALIAS_DEBUG
|
2004-03-16 21:30:41 +00:00
|
|
|
fprintf(stderr, "PacketAlias/GetSocket(): ");
|
|
|
|
fprintf(stderr, "socket() error %d\n", *sockfd);
|
1999-03-09 23:44:00 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
sock_addr.sin_family = AF_INET;
|
|
|
|
sock_addr.sin_addr.s_addr = htonl(INADDR_ANY);
|
|
|
|
sock_addr.sin_port = port_net;
|
|
|
|
|
|
|
|
err = bind(sock,
|
|
|
|
(struct sockaddr *)&sock_addr,
|
|
|
|
sizeof(sock_addr));
|
|
|
|
if (err == 0) {
|
|
|
|
la->sockCount++;
|
|
|
|
*sockfd = sock;
|
|
|
|
return (1);
|
|
|
|
} else {
|
|
|
|
close(sock);
|
|
|
|
return (0);
|
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
2005-05-05 20:25:12 +00:00
|
|
|
#endif
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2002-07-01 11:19:40 +00:00
|
|
|
/* FindNewPortGroup() returns a base port number for an available
|
2000-07-26 23:15:46 +00:00
|
|
|
range of contiguous port numbers. Note that if a port number
|
|
|
|
is already in use, that does not mean that it cannot be used by
|
|
|
|
another link concurrently. This is because FindNewPortGroup()
|
|
|
|
looks for unused triplets: (dest addr, dest port, alias port). */
|
|
|
|
|
|
|
|
int
|
2004-01-17 10:52:21 +00:00
|
|
|
FindNewPortGroup(struct libalias *la,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr dst_addr,
|
|
|
|
struct in_addr alias_addr,
|
|
|
|
u_short src_port,
|
|
|
|
u_short dst_port,
|
|
|
|
u_short port_count,
|
|
|
|
u_char proto,
|
|
|
|
u_char align)
|
|
|
|
{
|
|
|
|
int i, j;
|
|
|
|
int max_trials;
|
|
|
|
u_short port_sys;
|
|
|
|
int link_type;
|
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
/*
|
|
|
|
* Get link_type from protocol
|
|
|
|
*/
|
|
|
|
|
|
|
|
switch (proto) {
|
|
|
|
case IPPROTO_UDP:
|
|
|
|
link_type = LINK_UDP;
|
|
|
|
break;
|
|
|
|
case IPPROTO_TCP:
|
|
|
|
link_type = LINK_TCP;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
return (0);
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* The aliasing port is automatically selected by one of two
|
|
|
|
* methods below:
|
|
|
|
*/
|
|
|
|
max_trials = GET_NEW_PORT_MAX_ATTEMPTS;
|
|
|
|
|
|
|
|
if (la->packetAliasMode & PKT_ALIAS_SAME_PORTS) {
|
|
|
|
/*
|
|
|
|
* When the ALIAS_SAME_PORTS option is chosen, the first
|
|
|
|
* try will be the actual source port. If this is already
|
|
|
|
* in use, the remainder of the trials will be random.
|
|
|
|
*/
|
|
|
|
port_sys = ntohs(src_port);
|
|
|
|
|
|
|
|
} else {
|
|
|
|
|
|
|
|
/* First trial and all subsequent are random. */
|
|
|
|
if (align == FIND_EVEN_ALIAS_BASE)
|
2008-08-30 20:58:34 +00:00
|
|
|
port_sys = arc4random() & ALIAS_PORT_MASK_EVEN;
|
2004-03-16 21:30:41 +00:00
|
|
|
else
|
2008-08-30 20:58:34 +00:00
|
|
|
port_sys = arc4random() & ALIAS_PORT_MASK;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
|
|
|
port_sys += ALIAS_PORT_BASE;
|
|
|
|
}
|
2000-07-26 23:15:46 +00:00
|
|
|
|
|
|
|
/* Port number search */
|
2004-03-16 21:30:41 +00:00
|
|
|
for (i = 0; i < max_trials; i++) {
|
2000-07-26 23:15:46 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
struct alias_link *search_result;
|
2000-07-26 23:15:46 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
for (j = 0; j < port_count; j++)
|
2016-04-15 15:46:41 +00:00
|
|
|
if ((search_result = FindLinkIn(la, dst_addr,
|
|
|
|
alias_addr, dst_port, htons(port_sys + j),
|
|
|
|
link_type, 0)) != NULL)
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
2000-07-26 23:15:46 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
/* Found a good range, return base */
|
|
|
|
if (j == port_count)
|
|
|
|
return (htons(port_sys));
|
2000-07-26 23:15:46 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
/* Find a new base to try */
|
|
|
|
if (align == FIND_EVEN_ALIAS_BASE)
|
2008-08-30 20:58:34 +00:00
|
|
|
port_sys = arc4random() & ALIAS_PORT_MASK_EVEN;
|
2004-03-16 21:30:41 +00:00
|
|
|
else
|
2008-08-30 20:58:34 +00:00
|
|
|
port_sys = arc4random() & ALIAS_PORT_MASK;
|
2000-07-26 23:15:46 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
port_sys += ALIAS_PORT_BASE;
|
|
|
|
}
|
2000-07-26 23:15:46 +00:00
|
|
|
|
2005-05-06 11:07:49 +00:00
|
|
|
#ifdef LIBALIAS_DEBUG
|
2004-03-16 21:30:41 +00:00
|
|
|
fprintf(stderr, "PacketAlias/FindNewPortGroup(): ");
|
|
|
|
fprintf(stderr, "could not find free port(s)\n");
|
2000-07-26 23:15:46 +00:00
|
|
|
#endif
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
return (0);
|
2000-07-26 23:15:46 +00:00
|
|
|
}
|
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
static void
|
2004-01-17 10:52:21 +00:00
|
|
|
CleanupAliasData(struct libalias *la)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2008-06-01 18:34:58 +00:00
|
|
|
int i;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
for (i = 0; i < LINK_TABLE_OUT_SIZE; i++) {
|
2008-06-22 11:39:42 +00:00
|
|
|
lnk = LIST_FIRST(&la->linkTableOut[i]);
|
|
|
|
while (lnk != NULL) {
|
|
|
|
struct alias_link *link_next = LIST_NEXT(lnk, list_out);
|
2004-07-05 11:10:57 +00:00
|
|
|
DeleteLink(lnk);
|
2008-06-22 11:39:42 +00:00
|
|
|
lnk = link_next;
|
|
|
|
}
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
la->cleanupIndex = 0;
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static void
|
2004-01-17 10:52:21 +00:00
|
|
|
IncrementalCleanup(struct libalias *la)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2008-06-01 18:34:58 +00:00
|
|
|
struct alias_link *lnk, *lnk_tmp;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2008-06-01 18:34:58 +00:00
|
|
|
LIST_FOREACH_SAFE(lnk, &la->linkTableOut[la->cleanupIndex++],
|
|
|
|
list_out, lnk_tmp) {
|
|
|
|
if (la->timeStamp - lnk->timestamp > lnk->expire_time)
|
|
|
|
DeleteLink(lnk);
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if (la->cleanupIndex == LINK_TABLE_OUT_SIZE)
|
|
|
|
la->cleanupIndex = 0;
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
2000-08-14 14:18:16 +00:00
|
|
|
static void
|
2004-07-05 11:10:57 +00:00
|
|
|
DeleteLink(struct alias_link *lnk)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct libalias *la = lnk->la;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
1997-05-23 04:41:31 +00:00
|
|
|
/* Don't do anything if the link is marked permanent */
|
2004-07-05 11:10:57 +00:00
|
|
|
if (la->deleteAllLinks == 0 && lnk->flags & LINK_PERMANENT)
|
2004-03-16 21:30:41 +00:00
|
|
|
return;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
1998-04-19 21:42:07 +00:00
|
|
|
#ifndef NO_FW_PUNCH
|
2000-04-18 10:18:21 +00:00
|
|
|
/* Delete associated firewall hole, if any */
|
2004-07-05 11:10:57 +00:00
|
|
|
ClearFWHole(lnk);
|
1998-04-19 21:42:07 +00:00
|
|
|
#endif
|
1998-01-09 21:13:35 +00:00
|
|
|
|
2000-04-27 17:37:03 +00:00
|
|
|
/* Free memory allocated for LSNAT server pool */
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->server != NULL) {
|
2004-03-16 21:30:41 +00:00
|
|
|
struct server *head, *curr, *next;
|
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
head = curr = lnk->server;
|
2004-03-16 21:30:41 +00:00
|
|
|
do {
|
|
|
|
next = curr->next;
|
|
|
|
free(curr);
|
|
|
|
} while ((curr = next) != head);
|
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
/* Adjust output table pointers */
|
2004-07-05 11:10:57 +00:00
|
|
|
LIST_REMOVE(lnk, list_out);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
/* Adjust input table pointers */
|
2004-07-05 11:10:57 +00:00
|
|
|
LIST_REMOVE(lnk, list_in);
|
2005-05-05 20:25:12 +00:00
|
|
|
#ifndef NO_USE_SOCKETS
|
1997-05-23 04:41:31 +00:00
|
|
|
/* Close socket, if one has been allocated */
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->sockfd != -1) {
|
2004-03-16 21:30:41 +00:00
|
|
|
la->sockCount--;
|
2004-07-05 11:10:57 +00:00
|
|
|
close(lnk->sockfd);
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
2005-05-05 20:25:12 +00:00
|
|
|
#endif
|
1997-05-23 04:41:31 +00:00
|
|
|
/* Link-type dependent cleanup */
|
2004-07-05 11:10:57 +00:00
|
|
|
switch (lnk->link_type) {
|
2004-03-16 21:30:41 +00:00
|
|
|
case LINK_ICMP:
|
|
|
|
la->icmpLinkCount--;
|
|
|
|
break;
|
|
|
|
case LINK_UDP:
|
|
|
|
la->udpLinkCount--;
|
|
|
|
break;
|
|
|
|
case LINK_TCP:
|
|
|
|
la->tcpLinkCount--;
|
2004-07-05 11:10:57 +00:00
|
|
|
free(lnk->data.tcp);
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
case LINK_PPTP:
|
|
|
|
la->pptpLinkCount--;
|
|
|
|
break;
|
|
|
|
case LINK_FRAGMENT_ID:
|
|
|
|
la->fragmentIdLinkCount--;
|
|
|
|
break;
|
|
|
|
case LINK_FRAGMENT_PTR:
|
|
|
|
la->fragmentPtrLinkCount--;
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->data.frag_ptr != NULL)
|
|
|
|
free(lnk->data.frag_ptr);
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
2000-04-28 13:44:49 +00:00
|
|
|
case LINK_ADDR:
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
default:
|
|
|
|
la->protoLinkCount--;
|
|
|
|
break;
|
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
/* Free memory */
|
2004-07-05 11:10:57 +00:00
|
|
|
free(lnk);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
/* Write statistics, if logging enabled */
|
2004-03-16 21:30:41 +00:00
|
|
|
if (la->packetAliasMode & PKT_ALIAS_LOG) {
|
|
|
|
ShowAliasStats(la);
|
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2011-06-22 20:00:27 +00:00
|
|
|
struct alias_link *
|
|
|
|
AddLink(struct libalias *la, struct in_addr src_addr, struct in_addr dst_addr,
|
|
|
|
struct in_addr alias_addr, u_short src_port, u_short dst_port,
|
|
|
|
int alias_port_param, int link_type)
|
|
|
|
{
|
|
|
|
u_int start_point;
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = malloc(sizeof(struct alias_link));
|
|
|
|
if (lnk != NULL) {
|
2004-03-16 21:30:41 +00:00
|
|
|
/* Basic initialization */
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->la = la;
|
|
|
|
lnk->src_addr = src_addr;
|
|
|
|
lnk->dst_addr = dst_addr;
|
|
|
|
lnk->alias_addr = alias_addr;
|
|
|
|
lnk->proxy_addr.s_addr = INADDR_ANY;
|
|
|
|
lnk->src_port = src_port;
|
|
|
|
lnk->dst_port = dst_port;
|
|
|
|
lnk->proxy_port = 0;
|
|
|
|
lnk->server = NULL;
|
|
|
|
lnk->link_type = link_type;
|
2005-05-05 20:25:12 +00:00
|
|
|
#ifndef NO_USE_SOCKETS
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->sockfd = -1;
|
2005-05-05 20:25:12 +00:00
|
|
|
#endif
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->flags = 0;
|
|
|
|
lnk->pflags = 0;
|
|
|
|
lnk->timestamp = la->timeStamp;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
|
|
|
/* Expiration time */
|
|
|
|
switch (link_type) {
|
|
|
|
case LINK_ICMP:
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->expire_time = ICMP_EXPIRE_TIME;
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
case LINK_UDP:
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->expire_time = UDP_EXPIRE_TIME;
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
case LINK_TCP:
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->expire_time = TCP_EXPIRE_INITIAL;
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
case LINK_PPTP:
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->flags |= LINK_PERMANENT; /* no timeout. */
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
case LINK_FRAGMENT_ID:
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->expire_time = FRAGMENT_ID_EXPIRE_TIME;
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
case LINK_FRAGMENT_PTR:
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->expire_time = FRAGMENT_PTR_EXPIRE_TIME;
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
case LINK_ADDR:
|
|
|
|
break;
|
|
|
|
default:
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->expire_time = PROTO_EXPIRE_TIME;
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Determine alias flags */
|
|
|
|
if (dst_addr.s_addr == INADDR_ANY)
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->flags |= LINK_UNKNOWN_DEST_ADDR;
|
2004-03-16 21:30:41 +00:00
|
|
|
if (dst_port == 0)
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->flags |= LINK_UNKNOWN_DEST_PORT;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
|
|
|
/* Determine alias port */
|
2004-07-05 11:10:57 +00:00
|
|
|
if (GetNewPort(la, lnk, alias_port_param) != 0) {
|
|
|
|
free(lnk);
|
2004-03-16 21:30:41 +00:00
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
/* Link-type dependent initialization */
|
|
|
|
switch (link_type) {
|
|
|
|
struct tcp_dat *aux_tcp;
|
|
|
|
|
|
|
|
case LINK_ICMP:
|
|
|
|
la->icmpLinkCount++;
|
|
|
|
break;
|
|
|
|
case LINK_UDP:
|
|
|
|
la->udpLinkCount++;
|
|
|
|
break;
|
|
|
|
case LINK_TCP:
|
|
|
|
aux_tcp = malloc(sizeof(struct tcp_dat));
|
|
|
|
if (aux_tcp != NULL) {
|
|
|
|
int i;
|
|
|
|
|
|
|
|
la->tcpLinkCount++;
|
|
|
|
aux_tcp->state.in = ALIAS_TCP_STATE_NOT_CONNECTED;
|
|
|
|
aux_tcp->state.out = ALIAS_TCP_STATE_NOT_CONNECTED;
|
|
|
|
aux_tcp->state.index = 0;
|
|
|
|
aux_tcp->state.ack_modified = 0;
|
|
|
|
for (i = 0; i < N_LINK_TCP_DATA; i++)
|
|
|
|
aux_tcp->ack[i].active = 0;
|
|
|
|
aux_tcp->fwhole = -1;
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->data.tcp = aux_tcp;
|
2004-03-16 21:30:41 +00:00
|
|
|
} else {
|
2005-05-06 11:07:49 +00:00
|
|
|
#ifdef LIBALIAS_DEBUG
|
2004-03-16 21:30:41 +00:00
|
|
|
fprintf(stderr, "PacketAlias/AddLink: ");
|
|
|
|
fprintf(stderr, " cannot allocate auxiliary TCP data\n");
|
1999-03-09 23:44:00 +00:00
|
|
|
#endif
|
2004-07-05 11:10:57 +00:00
|
|
|
free(lnk);
|
2004-03-16 21:30:41 +00:00
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case LINK_PPTP:
|
|
|
|
la->pptpLinkCount++;
|
|
|
|
break;
|
|
|
|
case LINK_FRAGMENT_ID:
|
|
|
|
la->fragmentIdLinkCount++;
|
|
|
|
break;
|
|
|
|
case LINK_FRAGMENT_PTR:
|
|
|
|
la->fragmentPtrLinkCount++;
|
|
|
|
break;
|
|
|
|
case LINK_ADDR:
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
la->protoLinkCount++;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Set up pointers for output lookup table */
|
|
|
|
start_point = StartPointOut(src_addr, dst_addr,
|
|
|
|
src_port, dst_port, link_type);
|
2004-07-05 11:10:57 +00:00
|
|
|
LIST_INSERT_HEAD(&la->linkTableOut[start_point], lnk, list_out);
|
2004-03-16 21:30:41 +00:00
|
|
|
|
|
|
|
/* Set up pointers for input lookup table */
|
2004-07-05 11:10:57 +00:00
|
|
|
start_point = StartPointIn(alias_addr, lnk->alias_port, link_type);
|
|
|
|
LIST_INSERT_HEAD(&la->linkTableIn[start_point], lnk, list_in);
|
2004-03-16 21:30:41 +00:00
|
|
|
} else {
|
2005-05-06 11:07:49 +00:00
|
|
|
#ifdef LIBALIAS_DEBUG
|
2004-03-16 21:30:41 +00:00
|
|
|
fprintf(stderr, "PacketAlias/AddLink(): ");
|
|
|
|
fprintf(stderr, "malloc() call failed.\n");
|
1999-03-09 23:44:00 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
|
|
|
if (la->packetAliasMode & PKT_ALIAS_LOG) {
|
|
|
|
ShowAliasStats(la);
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
1998-01-09 21:13:35 +00:00
|
|
|
static struct alias_link *
|
2004-07-05 11:10:57 +00:00
|
|
|
ReLink(struct alias_link *old_lnk,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr src_addr,
|
|
|
|
struct in_addr dst_addr,
|
|
|
|
struct in_addr alias_addr,
|
|
|
|
u_short src_port,
|
|
|
|
u_short dst_port,
|
|
|
|
int alias_port_param, /* if less than zero, alias */
|
|
|
|
int link_type)
|
|
|
|
{ /* port will be automatically *//* chosen.
|
|
|
|
* If greater than */
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *new_lnk; /* zero, equal to alias port */
|
|
|
|
struct libalias *la = old_lnk->la;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
new_lnk = AddLink(la, src_addr, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
src_port, dst_port, alias_port_param,
|
|
|
|
link_type);
|
1998-04-19 21:42:07 +00:00
|
|
|
#ifndef NO_FW_PUNCH
|
2004-07-05 11:10:57 +00:00
|
|
|
if (new_lnk != NULL &&
|
|
|
|
old_lnk->link_type == LINK_TCP &&
|
|
|
|
old_lnk->data.tcp->fwhole > 0) {
|
|
|
|
PunchFWHole(new_lnk);
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
1998-04-19 21:42:07 +00:00
|
|
|
#endif
|
2004-07-05 11:10:57 +00:00
|
|
|
DeleteLink(old_lnk);
|
|
|
|
return (new_lnk);
|
1998-01-09 21:13:35 +00:00
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
static struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
_FindLinkOut(struct libalias *la, struct in_addr src_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr dst_addr,
|
|
|
|
u_short src_port,
|
|
|
|
u_short dst_port,
|
|
|
|
int link_type,
|
|
|
|
int replace_partial_links)
|
|
|
|
{
|
|
|
|
u_int i;
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
i = StartPointOut(src_addr, dst_addr, src_port, dst_port, link_type);
|
2004-07-05 11:10:57 +00:00
|
|
|
LIST_FOREACH(lnk, &la->linkTableOut[i], list_out) {
|
2008-06-01 18:34:58 +00:00
|
|
|
if (lnk->dst_addr.s_addr == dst_addr.s_addr &&
|
|
|
|
lnk->src_addr.s_addr == src_addr.s_addr &&
|
|
|
|
lnk->src_port == src_port &&
|
|
|
|
lnk->dst_port == dst_port &&
|
|
|
|
lnk->link_type == link_type &&
|
|
|
|
lnk->server == NULL) {
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->timestamp = la->timeStamp;
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
|
1999-09-21 08:40:20 +00:00
|
|
|
/* Search for partially specified links. */
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL && replace_partial_links) {
|
2004-03-16 21:30:41 +00:00
|
|
|
if (dst_port != 0 && dst_addr.s_addr != INADDR_ANY) {
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = _FindLinkOut(la, src_addr, dst_addr, src_port, 0,
|
2004-03-16 21:30:41 +00:00
|
|
|
link_type, 0);
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL)
|
|
|
|
lnk = _FindLinkOut(la, src_addr, la->nullAddress, src_port,
|
2004-03-16 21:30:41 +00:00
|
|
|
dst_port, link_type, 0);
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL &&
|
2004-03-16 21:30:41 +00:00
|
|
|
(dst_port != 0 || dst_addr.s_addr != INADDR_ANY)) {
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = _FindLinkOut(la, src_addr, la->nullAddress, src_port, 0,
|
2004-03-16 21:30:41 +00:00
|
|
|
link_type, 0);
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk != NULL) {
|
|
|
|
lnk = ReLink(lnk,
|
|
|
|
src_addr, dst_addr, lnk->alias_addr,
|
|
|
|
src_port, dst_port, lnk->alias_port,
|
2004-03-16 21:30:41 +00:00
|
|
|
link_type);
|
|
|
|
}
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
1999-09-27 08:40:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
FindLinkOut(struct libalias *la, struct in_addr src_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr dst_addr,
|
|
|
|
u_short src_port,
|
|
|
|
u_short dst_port,
|
|
|
|
int link_type,
|
|
|
|
int replace_partial_links)
|
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = _FindLinkOut(la, src_addr, dst_addr, src_port, dst_port,
|
2004-03-16 21:30:41 +00:00
|
|
|
link_type, replace_partial_links);
|
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL) {
|
2004-03-16 21:30:41 +00:00
|
|
|
/*
|
|
|
|
* The following allows permanent links to be specified as
|
|
|
|
* using the default source address (i.e. device interface
|
|
|
|
* address) without knowing in advance what that address
|
|
|
|
* is.
|
|
|
|
*/
|
|
|
|
if (la->aliasAddress.s_addr != INADDR_ANY &&
|
|
|
|
src_addr.s_addr == la->aliasAddress.s_addr) {
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = _FindLinkOut(la, la->nullAddress, dst_addr, src_port, dst_port,
|
2004-03-16 21:30:41 +00:00
|
|
|
link_type, replace_partial_links);
|
|
|
|
}
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2000-03-19 09:11:05 +00:00
|
|
|
static struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
_FindLinkIn(struct libalias *la, struct in_addr dst_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr alias_addr,
|
|
|
|
u_short dst_port,
|
|
|
|
u_short alias_port,
|
|
|
|
int link_type,
|
|
|
|
int replace_partial_links)
|
|
|
|
{
|
|
|
|
int flags_in;
|
|
|
|
u_int start_point;
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
|
|
|
struct alias_link *lnk_fully_specified;
|
|
|
|
struct alias_link *lnk_unknown_all;
|
|
|
|
struct alias_link *lnk_unknown_dst_addr;
|
|
|
|
struct alias_link *lnk_unknown_dst_port;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
1997-05-23 04:41:31 +00:00
|
|
|
/* Initialize pointers */
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk_fully_specified = NULL;
|
|
|
|
lnk_unknown_all = NULL;
|
|
|
|
lnk_unknown_dst_addr = NULL;
|
|
|
|
lnk_unknown_dst_port = NULL;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
/* If either the dest addr or port is unknown, the search
|
|
|
|
loop will have to know about this. */
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
flags_in = 0;
|
|
|
|
if (dst_addr.s_addr == INADDR_ANY)
|
|
|
|
flags_in |= LINK_UNKNOWN_DEST_ADDR;
|
|
|
|
if (dst_port == 0)
|
|
|
|
flags_in |= LINK_UNKNOWN_DEST_PORT;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
/* Search loop */
|
2004-03-16 21:30:41 +00:00
|
|
|
start_point = StartPointIn(alias_addr, alias_port, link_type);
|
2004-07-05 11:10:57 +00:00
|
|
|
LIST_FOREACH(lnk, &la->linkTableIn[start_point], list_in) {
|
2004-03-16 21:30:41 +00:00
|
|
|
int flags;
|
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
flags = flags_in | lnk->flags;
|
2004-03-16 21:30:41 +00:00
|
|
|
if (!(flags & LINK_PARTIALLY_SPECIFIED)) {
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->alias_addr.s_addr == alias_addr.s_addr
|
|
|
|
&& lnk->alias_port == alias_port
|
|
|
|
&& lnk->dst_addr.s_addr == dst_addr.s_addr
|
|
|
|
&& lnk->dst_port == dst_port
|
|
|
|
&& lnk->link_type == link_type) {
|
|
|
|
lnk_fully_specified = lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
} else if ((flags & LINK_UNKNOWN_DEST_ADDR)
|
|
|
|
&& (flags & LINK_UNKNOWN_DEST_PORT)) {
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->alias_addr.s_addr == alias_addr.s_addr
|
|
|
|
&& lnk->alias_port == alias_port
|
|
|
|
&& lnk->link_type == link_type) {
|
|
|
|
if (lnk_unknown_all == NULL)
|
|
|
|
lnk_unknown_all = lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
|
|
|
} else if (flags & LINK_UNKNOWN_DEST_ADDR) {
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->alias_addr.s_addr == alias_addr.s_addr
|
|
|
|
&& lnk->alias_port == alias_port
|
|
|
|
&& lnk->link_type == link_type
|
|
|
|
&& lnk->dst_port == dst_port) {
|
|
|
|
if (lnk_unknown_dst_addr == NULL)
|
|
|
|
lnk_unknown_dst_addr = lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
|
|
|
} else if (flags & LINK_UNKNOWN_DEST_PORT) {
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->alias_addr.s_addr == alias_addr.s_addr
|
|
|
|
&& lnk->alias_port == alias_port
|
|
|
|
&& lnk->link_type == link_type
|
|
|
|
&& lnk->dst_addr.s_addr == dst_addr.s_addr) {
|
|
|
|
if (lnk_unknown_dst_port == NULL)
|
|
|
|
lnk_unknown_dst_port = lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
|
|
|
}
|
2000-04-27 17:37:03 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk_fully_specified != NULL) {
|
|
|
|
lnk_fully_specified->timestamp = la->timeStamp;
|
|
|
|
lnk = lnk_fully_specified;
|
|
|
|
} else if (lnk_unknown_dst_port != NULL)
|
|
|
|
lnk = lnk_unknown_dst_port;
|
|
|
|
else if (lnk_unknown_dst_addr != NULL)
|
|
|
|
lnk = lnk_unknown_dst_addr;
|
|
|
|
else if (lnk_unknown_all != NULL)
|
|
|
|
lnk = lnk_unknown_all;
|
2004-03-16 21:30:41 +00:00
|
|
|
else
|
|
|
|
return (NULL);
|
|
|
|
|
|
|
|
if (replace_partial_links &&
|
2004-07-05 11:10:57 +00:00
|
|
|
(lnk->flags & LINK_PARTIALLY_SPECIFIED || lnk->server != NULL)) {
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr src_addr;
|
|
|
|
u_short src_port;
|
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->server != NULL) { /* LSNAT link */
|
|
|
|
src_addr = lnk->server->addr;
|
|
|
|
src_port = lnk->server->port;
|
|
|
|
lnk->server = lnk->server->next;
|
2004-03-16 21:30:41 +00:00
|
|
|
} else {
|
2004-07-05 11:10:57 +00:00
|
|
|
src_addr = lnk->src_addr;
|
|
|
|
src_port = lnk->src_port;
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
|
|
|
|
2009-02-07 18:49:42 +00:00
|
|
|
if (link_type == LINK_SCTP) {
|
|
|
|
lnk->src_addr = src_addr;
|
|
|
|
lnk->src_port = src_port;
|
|
|
|
return(lnk);
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = ReLink(lnk,
|
2004-03-16 21:30:41 +00:00
|
|
|
src_addr, dst_addr, alias_addr,
|
|
|
|
src_port, dst_port, alias_port,
|
|
|
|
link_type);
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
2000-04-12 18:44:50 +00:00
|
|
|
static struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
FindLinkIn(struct libalias *la, struct in_addr dst_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr alias_addr,
|
|
|
|
u_short dst_port,
|
|
|
|
u_short alias_port,
|
|
|
|
int link_type,
|
|
|
|
int replace_partial_links)
|
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = _FindLinkIn(la, dst_addr, alias_addr, dst_port, alias_port,
|
2004-03-16 21:30:41 +00:00
|
|
|
link_type, replace_partial_links);
|
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL) {
|
2004-03-16 21:30:41 +00:00
|
|
|
/*
|
|
|
|
* The following allows permanent links to be specified as
|
|
|
|
* using the default aliasing address (i.e. device
|
|
|
|
* interface address) without knowing in advance what that
|
|
|
|
* address is.
|
|
|
|
*/
|
|
|
|
if (la->aliasAddress.s_addr != INADDR_ANY &&
|
|
|
|
alias_addr.s_addr == la->aliasAddress.s_addr) {
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = _FindLinkIn(la, dst_addr, la->nullAddress, dst_port, alias_port,
|
2004-03-16 21:30:41 +00:00
|
|
|
link_type, replace_partial_links);
|
|
|
|
}
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
1999-09-27 08:40:36 +00:00
|
|
|
}
|
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/* External routines for finding/adding links
|
|
|
|
|
|
|
|
-- "external" means outside alias_db.c, but within alias*.c --
|
|
|
|
|
|
|
|
FindIcmpIn(), FindIcmpOut()
|
|
|
|
FindFragmentIn1(), FindFragmentIn2()
|
|
|
|
AddFragmentPtrLink(), FindFragmentPtr()
|
2000-04-28 13:44:49 +00:00
|
|
|
FindProtoIn(), FindProtoOut()
|
1997-05-23 04:41:31 +00:00
|
|
|
FindUdpTcpIn(), FindUdpTcpOut()
|
2000-10-30 12:39:41 +00:00
|
|
|
AddPptp(), FindPptpOutByCallId(), FindPptpInByCallId(),
|
|
|
|
FindPptpOutByPeerCallId(), FindPptpInByPeerCallId()
|
1997-05-23 04:41:31 +00:00
|
|
|
FindOriginalAddress(), FindAliasAddress()
|
|
|
|
|
|
|
|
(prototypes in alias_local.h)
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
FindIcmpIn(struct libalias *la, struct in_addr dst_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr alias_addr,
|
|
|
|
u_short id_alias,
|
|
|
|
int create)
|
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = FindLinkIn(la, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
NO_DEST_PORT, id_alias,
|
|
|
|
LINK_ICMP, 0);
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL && create && !(la->packetAliasMode & PKT_ALIAS_DENY_INCOMING)) {
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr target_addr;
|
|
|
|
|
|
|
|
target_addr = FindOriginalAddress(la, alias_addr);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = AddLink(la, target_addr, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
id_alias, NO_DEST_PORT, id_alias,
|
|
|
|
LINK_ICMP);
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
FindIcmpOut(struct libalias *la, struct in_addr src_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr dst_addr,
|
|
|
|
u_short id,
|
|
|
|
int create)
|
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = FindLinkOut(la, src_addr, dst_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
id, NO_DEST_PORT,
|
|
|
|
LINK_ICMP, 0);
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL && create) {
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr alias_addr;
|
|
|
|
|
|
|
|
alias_addr = FindAliasAddress(la, src_addr);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = AddLink(la, src_addr, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
id, NO_DEST_PORT, GET_ALIAS_ID,
|
|
|
|
LINK_ICMP);
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
FindFragmentIn1(struct libalias *la, struct in_addr dst_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr alias_addr,
|
|
|
|
u_short ip_id)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = FindLinkIn(la, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
NO_DEST_PORT, ip_id,
|
|
|
|
LINK_FRAGMENT_ID, 0);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL) {
|
|
|
|
lnk = AddLink(la, la->nullAddress, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
NO_SRC_PORT, NO_DEST_PORT, ip_id,
|
|
|
|
LINK_FRAGMENT_ID);
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct alias_link *
|
2004-03-16 21:30:41 +00:00
|
|
|
FindFragmentIn2(struct libalias *la, struct in_addr dst_addr, /* Doesn't add a link if
|
|
|
|
* one */
|
|
|
|
struct in_addr alias_addr, /* is not found. */
|
|
|
|
u_short ip_id)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
return FindLinkIn(la, dst_addr, alias_addr,
|
|
|
|
NO_DEST_PORT, ip_id,
|
|
|
|
LINK_FRAGMENT_ID, 0);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
AddFragmentPtrLink(struct libalias *la, struct in_addr dst_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
u_short ip_id)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
return AddLink(la, la->nullAddress, dst_addr, la->nullAddress,
|
|
|
|
NO_SRC_PORT, NO_DEST_PORT, ip_id,
|
|
|
|
LINK_FRAGMENT_PTR);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
FindFragmentPtr(struct libalias *la, struct in_addr dst_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
u_short ip_id)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
return FindLinkIn(la, dst_addr, la->nullAddress,
|
|
|
|
NO_DEST_PORT, ip_id,
|
|
|
|
LINK_FRAGMENT_PTR, 0);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2000-04-18 10:18:21 +00:00
|
|
|
struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
FindProtoIn(struct libalias *la, struct in_addr dst_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr alias_addr,
|
|
|
|
u_char proto)
|
2000-04-18 10:18:21 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2000-04-18 10:18:21 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = FindLinkIn(la, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
NO_DEST_PORT, 0,
|
|
|
|
proto, 1);
|
2000-04-18 10:18:21 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL && !(la->packetAliasMode & PKT_ALIAS_DENY_INCOMING)) {
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr target_addr;
|
2000-04-18 10:18:21 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
target_addr = FindOriginalAddress(la, alias_addr);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = AddLink(la, target_addr, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
NO_SRC_PORT, NO_DEST_PORT, 0,
|
|
|
|
proto);
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
2000-04-18 10:18:21 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
FindProtoOut(struct libalias *la, struct in_addr src_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr dst_addr,
|
|
|
|
u_char proto)
|
2000-04-18 10:18:21 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2000-04-18 10:18:21 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = FindLinkOut(la, src_addr, dst_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
NO_SRC_PORT, NO_DEST_PORT,
|
|
|
|
proto, 1);
|
2000-04-18 10:18:21 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL) {
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr alias_addr;
|
2000-04-18 10:18:21 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
alias_addr = FindAliasAddress(la, src_addr);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = AddLink(la, src_addr, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
NO_SRC_PORT, NO_DEST_PORT, 0,
|
|
|
|
proto);
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
2000-04-18 10:18:21 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
FindUdpTcpIn(struct libalias *la, struct in_addr dst_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr alias_addr,
|
|
|
|
u_short dst_port,
|
|
|
|
u_short alias_port,
|
|
|
|
u_char proto,
|
|
|
|
int create)
|
|
|
|
{
|
|
|
|
int link_type;
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
switch (proto) {
|
|
|
|
case IPPROTO_UDP:
|
|
|
|
link_type = LINK_UDP;
|
|
|
|
break;
|
|
|
|
case IPPROTO_TCP:
|
|
|
|
link_type = LINK_TCP;
|
|
|
|
break;
|
|
|
|
default:
|
2004-07-05 10:55:23 +00:00
|
|
|
return (NULL);
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = FindLinkIn(la, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
dst_port, alias_port,
|
|
|
|
link_type, create);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL && create && !(la->packetAliasMode & PKT_ALIAS_DENY_INCOMING)) {
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr target_addr;
|
|
|
|
|
|
|
|
target_addr = FindOriginalAddress(la, alias_addr);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = AddLink(la, target_addr, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
alias_port, dst_port, alias_port,
|
|
|
|
link_type);
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
struct alias_link *
|
|
|
|
FindUdpTcpOut(struct libalias *la, struct in_addr src_addr,
|
|
|
|
struct in_addr dst_addr,
|
|
|
|
u_short src_port,
|
|
|
|
u_short dst_port,
|
|
|
|
u_char proto,
|
|
|
|
int create)
|
|
|
|
{
|
|
|
|
int link_type;
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
switch (proto) {
|
|
|
|
case IPPROTO_UDP:
|
|
|
|
link_type = LINK_UDP;
|
|
|
|
break;
|
|
|
|
case IPPROTO_TCP:
|
|
|
|
link_type = LINK_TCP;
|
|
|
|
break;
|
|
|
|
default:
|
2004-07-05 10:55:23 +00:00
|
|
|
return (NULL);
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = FindLinkOut(la, src_addr, dst_addr, src_port, dst_port, link_type, create);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL && create) {
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr alias_addr;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
alias_addr = FindAliasAddress(la, src_addr);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = AddLink(la, src_addr, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
src_port, dst_port, GET_ALIAS_PORT,
|
|
|
|
link_type);
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2000-10-30 12:39:41 +00:00
|
|
|
struct alias_link *
|
2004-03-16 21:30:41 +00:00
|
|
|
AddPptp(struct libalias *la, struct in_addr src_addr,
|
|
|
|
struct in_addr dst_addr,
|
|
|
|
struct in_addr alias_addr,
|
|
|
|
u_int16_t src_call_id)
|
2000-10-30 12:39:41 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2000-10-30 12:39:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = AddLink(la, src_addr, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
src_call_id, 0, GET_ALIAS_PORT,
|
|
|
|
LINK_PPTP);
|
2000-10-30 12:39:41 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
2000-10-30 12:39:41 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
FindPptpOutByCallId(struct libalias *la, struct in_addr src_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr dst_addr,
|
|
|
|
u_int16_t src_call_id)
|
2000-10-30 12:39:41 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
u_int i;
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2000-10-30 12:39:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
i = StartPointOut(src_addr, dst_addr, 0, 0, LINK_PPTP);
|
2004-07-05 11:10:57 +00:00
|
|
|
LIST_FOREACH(lnk, &la->linkTableOut[i], list_out)
|
|
|
|
if (lnk->link_type == LINK_PPTP &&
|
|
|
|
lnk->src_addr.s_addr == src_addr.s_addr &&
|
|
|
|
lnk->dst_addr.s_addr == dst_addr.s_addr &&
|
|
|
|
lnk->src_port == src_call_id)
|
2000-10-30 12:39:41 +00:00
|
|
|
break;
|
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
2000-10-30 12:39:41 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
FindPptpOutByPeerCallId(struct libalias *la, struct in_addr src_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr dst_addr,
|
|
|
|
u_int16_t dst_call_id)
|
2000-10-30 12:39:41 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
u_int i;
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2000-10-30 12:39:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
i = StartPointOut(src_addr, dst_addr, 0, 0, LINK_PPTP);
|
2004-07-05 11:10:57 +00:00
|
|
|
LIST_FOREACH(lnk, &la->linkTableOut[i], list_out)
|
|
|
|
if (lnk->link_type == LINK_PPTP &&
|
|
|
|
lnk->src_addr.s_addr == src_addr.s_addr &&
|
|
|
|
lnk->dst_addr.s_addr == dst_addr.s_addr &&
|
|
|
|
lnk->dst_port == dst_call_id)
|
2000-10-30 12:39:41 +00:00
|
|
|
break;
|
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
2000-10-30 12:39:41 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
FindPptpInByCallId(struct libalias *la, struct in_addr dst_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr alias_addr,
|
|
|
|
u_int16_t dst_call_id)
|
2000-10-30 12:39:41 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
u_int i;
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2000-10-30 12:39:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
i = StartPointIn(alias_addr, 0, LINK_PPTP);
|
2004-07-05 11:10:57 +00:00
|
|
|
LIST_FOREACH(lnk, &la->linkTableIn[i], list_in)
|
|
|
|
if (lnk->link_type == LINK_PPTP &&
|
|
|
|
lnk->dst_addr.s_addr == dst_addr.s_addr &&
|
|
|
|
lnk->alias_addr.s_addr == alias_addr.s_addr &&
|
|
|
|
lnk->dst_port == dst_call_id)
|
2000-10-30 12:39:41 +00:00
|
|
|
break;
|
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
2000-10-30 12:39:41 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
FindPptpInByPeerCallId(struct libalias *la, struct in_addr dst_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr alias_addr,
|
|
|
|
u_int16_t alias_call_id)
|
2000-10-30 12:39:41 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2000-10-30 12:39:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = FindLinkIn(la, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
0 /* any */ , alias_call_id,
|
|
|
|
LINK_PPTP, 0);
|
2000-10-30 12:39:41 +00:00
|
|
|
|
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
2000-10-30 12:39:41 +00:00
|
|
|
}
|
|
|
|
|
2000-07-26 23:15:46 +00:00
|
|
|
|
2002-07-01 11:19:40 +00:00
|
|
|
struct alias_link *
|
2004-03-16 21:30:41 +00:00
|
|
|
FindRtspOut(struct libalias *la, struct in_addr src_addr,
|
|
|
|
struct in_addr dst_addr,
|
|
|
|
u_short src_port,
|
|
|
|
u_short alias_port,
|
|
|
|
u_char proto)
|
|
|
|
{
|
|
|
|
int link_type;
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
switch (proto) {
|
|
|
|
case IPPROTO_UDP:
|
|
|
|
link_type = LINK_UDP;
|
|
|
|
break;
|
|
|
|
case IPPROTO_TCP:
|
|
|
|
link_type = LINK_TCP;
|
|
|
|
break;
|
|
|
|
default:
|
2004-07-05 10:55:23 +00:00
|
|
|
return (NULL);
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
}
|
2000-07-26 23:15:46 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = FindLinkOut(la, src_addr, dst_addr, src_port, 0, link_type, 1);
|
2000-07-26 23:15:46 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL) {
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr alias_addr;
|
2000-07-26 23:15:46 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
alias_addr = FindAliasAddress(la, src_addr);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = AddLink(la, src_addr, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
src_port, 0, alias_port,
|
|
|
|
link_type);
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
2000-07-26 23:15:46 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
struct in_addr
|
2004-01-17 10:52:21 +00:00
|
|
|
FindOriginalAddress(struct libalias *la, struct in_addr alias_addr)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = FindLinkIn(la, la->nullAddress, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
0, 0, LINK_ADDR, 0);
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL) {
|
2004-03-16 21:30:41 +00:00
|
|
|
la->newDefaultLink = 1;
|
|
|
|
if (la->targetAddress.s_addr == INADDR_ANY)
|
2004-07-05 10:55:23 +00:00
|
|
|
return (alias_addr);
|
2004-03-16 21:30:41 +00:00
|
|
|
else if (la->targetAddress.s_addr == INADDR_NONE)
|
|
|
|
return (la->aliasAddress.s_addr != INADDR_ANY) ?
|
|
|
|
la->aliasAddress : alias_addr;
|
|
|
|
else
|
2004-07-05 10:55:23 +00:00
|
|
|
return (la->targetAddress);
|
2004-03-16 21:30:41 +00:00
|
|
|
} else {
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->server != NULL) { /* LSNAT link */
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr src_addr;
|
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
src_addr = lnk->server->addr;
|
|
|
|
lnk->server = lnk->server->next;
|
2004-03-16 21:30:41 +00:00
|
|
|
return (src_addr);
|
2004-07-05 11:10:57 +00:00
|
|
|
} else if (lnk->src_addr.s_addr == INADDR_ANY)
|
2004-03-16 21:30:41 +00:00
|
|
|
return (la->aliasAddress.s_addr != INADDR_ANY) ?
|
|
|
|
la->aliasAddress : alias_addr;
|
|
|
|
else
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk->src_addr);
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct in_addr
|
2004-01-17 10:52:21 +00:00
|
|
|
FindAliasAddress(struct libalias *la, struct in_addr original_addr)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2002-07-01 11:19:40 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = FindLinkOut(la, original_addr, la->nullAddress,
|
2004-03-16 21:30:41 +00:00
|
|
|
0, 0, LINK_ADDR, 0);
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk == NULL) {
|
2004-03-16 21:30:41 +00:00
|
|
|
return (la->aliasAddress.s_addr != INADDR_ANY) ?
|
|
|
|
la->aliasAddress : original_addr;
|
|
|
|
} else {
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->alias_addr.s_addr == INADDR_ANY)
|
2004-03-16 21:30:41 +00:00
|
|
|
return (la->aliasAddress.s_addr != INADDR_ANY) ?
|
|
|
|
la->aliasAddress : original_addr;
|
|
|
|
else
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk->alias_addr);
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/* External routines for getting or changing link data
|
|
|
|
(external to alias_db.c, but internal to alias*.c)
|
|
|
|
|
|
|
|
SetFragmentData(), GetFragmentData()
|
|
|
|
SetFragmentPtr(), GetFragmentPtr()
|
|
|
|
SetStateIn(), SetStateOut(), GetStateIn(), GetStateOut()
|
|
|
|
GetOriginalAddress(), GetDestAddress(), GetAliasAddress()
|
|
|
|
GetOriginalPort(), GetAliasPort()
|
|
|
|
SetAckModified(), GetAckModified()
|
|
|
|
GetDeltaAckIn(), GetDeltaSeqOut(), AddSeq()
|
2001-05-30 14:24:35 +00:00
|
|
|
SetProtocolFlags(), GetProtocolFlags()
|
2000-10-30 12:39:41 +00:00
|
|
|
SetDestCallId()
|
1997-05-23 04:41:31 +00:00
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
void
|
2004-07-05 11:10:57 +00:00
|
|
|
SetFragmentAddr(struct alias_link *lnk, struct in_addr src_addr)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->data.frag_addr = src_addr;
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void
|
2004-07-05 11:10:57 +00:00
|
|
|
GetFragmentAddr(struct alias_link *lnk, struct in_addr *src_addr)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
*src_addr = lnk->data.frag_addr;
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void
|
2004-07-05 11:10:57 +00:00
|
|
|
SetFragmentPtr(struct alias_link *lnk, char *fptr)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->data.frag_ptr = fptr;
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void
|
2004-07-05 11:10:57 +00:00
|
|
|
GetFragmentPtr(struct alias_link *lnk, char **fptr)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
*fptr = lnk->data.frag_ptr;
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void
|
2004-07-05 11:10:57 +00:00
|
|
|
SetStateIn(struct alias_link *lnk, int state)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
/* TCP input state */
|
|
|
|
switch (state) {
|
|
|
|
case ALIAS_TCP_STATE_DISCONNECTED:
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->data.tcp->state.out != ALIAS_TCP_STATE_CONNECTED)
|
|
|
|
lnk->expire_time = TCP_EXPIRE_DEAD;
|
2004-03-16 21:30:41 +00:00
|
|
|
else
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->expire_time = TCP_EXPIRE_SINGLEDEAD;
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
case ALIAS_TCP_STATE_CONNECTED:
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->data.tcp->state.out == ALIAS_TCP_STATE_CONNECTED)
|
|
|
|
lnk->expire_time = TCP_EXPIRE_CONNECTED;
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
default:
|
2005-05-05 21:05:38 +00:00
|
|
|
#ifdef _KERNEL
|
|
|
|
panic("libalias:SetStateIn() unknown state");
|
|
|
|
#else
|
2004-03-16 21:30:41 +00:00
|
|
|
abort();
|
2005-05-05 21:05:38 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->data.tcp->state.in = state;
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void
|
2004-07-05 11:10:57 +00:00
|
|
|
SetStateOut(struct alias_link *lnk, int state)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
/* TCP output state */
|
|
|
|
switch (state) {
|
|
|
|
case ALIAS_TCP_STATE_DISCONNECTED:
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->data.tcp->state.in != ALIAS_TCP_STATE_CONNECTED)
|
|
|
|
lnk->expire_time = TCP_EXPIRE_DEAD;
|
2004-03-16 21:30:41 +00:00
|
|
|
else
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->expire_time = TCP_EXPIRE_SINGLEDEAD;
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
case ALIAS_TCP_STATE_CONNECTED:
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->data.tcp->state.in == ALIAS_TCP_STATE_CONNECTED)
|
|
|
|
lnk->expire_time = TCP_EXPIRE_CONNECTED;
|
2004-03-16 21:30:41 +00:00
|
|
|
break;
|
|
|
|
default:
|
2005-05-05 21:05:38 +00:00
|
|
|
#ifdef _KERNEL
|
|
|
|
panic("libalias:SetStateOut() unknown state");
|
|
|
|
#else
|
2004-03-16 21:30:41 +00:00
|
|
|
abort();
|
2005-05-05 21:05:38 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->data.tcp->state.out = state;
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
int
|
2004-07-05 11:10:57 +00:00
|
|
|
GetStateIn(struct alias_link *lnk)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
/* TCP input state */
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk->data.tcp->state.in);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
int
|
2004-07-05 11:10:57 +00:00
|
|
|
GetStateOut(struct alias_link *lnk)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
/* TCP output state */
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk->data.tcp->state.out);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct in_addr
|
2004-07-05 11:10:57 +00:00
|
|
|
GetOriginalAddress(struct alias_link *lnk)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->src_addr.s_addr == INADDR_ANY)
|
|
|
|
return (lnk->la->aliasAddress);
|
2004-03-16 21:30:41 +00:00
|
|
|
else
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk->src_addr);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct in_addr
|
2004-07-05 11:10:57 +00:00
|
|
|
GetDestAddress(struct alias_link *lnk)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk->dst_addr);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct in_addr
|
2004-07-05 11:10:57 +00:00
|
|
|
GetAliasAddress(struct alias_link *lnk)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk->alias_addr.s_addr == INADDR_ANY)
|
|
|
|
return (lnk->la->aliasAddress);
|
2004-03-16 21:30:41 +00:00
|
|
|
else
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk->alias_addr);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
struct in_addr
|
2004-01-17 10:52:21 +00:00
|
|
|
GetDefaultAliasAddress(struct libalias *la)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-07-05 10:55:23 +00:00
|
|
|
return (la->aliasAddress);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void
|
2004-01-17 10:52:21 +00:00
|
|
|
SetDefaultAliasAddress(struct libalias *la, struct in_addr alias_addr)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
la->aliasAddress = alias_addr;
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
u_short
|
2004-07-05 11:10:57 +00:00
|
|
|
GetOriginalPort(struct alias_link *lnk)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk->src_port);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
u_short
|
2004-07-05 11:10:57 +00:00
|
|
|
GetAliasPort(struct alias_link *lnk)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk->alias_port);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
2000-03-19 09:11:05 +00:00
|
|
|
#ifndef NO_FW_PUNCH
|
2004-03-16 21:30:41 +00:00
|
|
|
static u_short
|
2004-07-05 11:10:57 +00:00
|
|
|
GetDestPort(struct alias_link *lnk)
|
1998-01-09 21:13:35 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk->dst_port);
|
1998-01-09 21:13:35 +00:00
|
|
|
}
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2000-03-19 09:11:05 +00:00
|
|
|
#endif
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
void
|
2004-07-05 11:10:57 +00:00
|
|
|
SetAckModified(struct alias_link *lnk)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2000-04-18 10:18:21 +00:00
|
|
|
/* Indicate that ACK numbers have been modified in a TCP connection */
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->data.tcp->state.ack_modified = 1;
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
1999-02-27 02:16:01 +00:00
|
|
|
struct in_addr
|
2004-07-05 11:10:57 +00:00
|
|
|
GetProxyAddress(struct alias_link *lnk)
|
1999-02-27 02:16:01 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk->proxy_addr);
|
1999-02-27 02:16:01 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void
|
2004-07-05 11:10:57 +00:00
|
|
|
SetProxyAddress(struct alias_link *lnk, struct in_addr addr)
|
1999-02-27 02:16:01 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->proxy_addr = addr;
|
1999-02-27 02:16:01 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
u_short
|
2004-07-05 11:10:57 +00:00
|
|
|
GetProxyPort(struct alias_link *lnk)
|
1999-02-27 02:16:01 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk->proxy_port);
|
1999-02-27 02:16:01 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void
|
2004-07-05 11:10:57 +00:00
|
|
|
SetProxyPort(struct alias_link *lnk, u_short port)
|
1999-02-27 02:16:01 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->proxy_port = port;
|
1999-02-27 02:16:01 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
int
|
2004-07-05 11:10:57 +00:00
|
|
|
GetAckModified(struct alias_link *lnk)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2000-04-18 10:18:21 +00:00
|
|
|
/* See if ACK numbers have been modified */
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk->data.tcp->state.ack_modified);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
2008-03-06 21:50:41 +00:00
|
|
|
// XXX ip free
|
1997-05-23 04:41:31 +00:00
|
|
|
int
|
2008-03-06 21:50:41 +00:00
|
|
|
GetDeltaAckIn(u_long ack, struct alias_link *lnk)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
|
|
|
/*
|
2000-04-18 10:18:21 +00:00
|
|
|
Find out how much the ACK number has been altered for an incoming
|
|
|
|
TCP packet. To do this, a circular list of ACK numbers where the TCP
|
2002-07-01 11:19:40 +00:00
|
|
|
packet size was altered is searched.
|
1997-05-23 04:41:31 +00:00
|
|
|
*/
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
int i;
|
|
|
|
int delta, ack_diff_min;
|
|
|
|
|
|
|
|
delta = 0;
|
|
|
|
ack_diff_min = -1;
|
|
|
|
for (i = 0; i < N_LINK_TCP_DATA; i++) {
|
|
|
|
struct ack_data_record x;
|
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
x = lnk->data.tcp->ack[i];
|
2004-03-16 21:30:41 +00:00
|
|
|
if (x.active == 1) {
|
|
|
|
int ack_diff;
|
|
|
|
|
|
|
|
ack_diff = SeqDiff(x.ack_new, ack);
|
|
|
|
if (ack_diff >= 0) {
|
|
|
|
if (ack_diff_min >= 0) {
|
|
|
|
if (ack_diff < ack_diff_min) {
|
|
|
|
delta = x.delta;
|
|
|
|
ack_diff_min = ack_diff;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
delta = x.delta;
|
|
|
|
ack_diff_min = ack_diff;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return (delta);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
2008-03-06 21:50:41 +00:00
|
|
|
// XXX ip free
|
1997-05-23 04:41:31 +00:00
|
|
|
int
|
2008-03-06 21:50:41 +00:00
|
|
|
GetDeltaSeqOut(u_long seq, struct alias_link *lnk)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
|
|
|
/*
|
2000-04-18 10:18:21 +00:00
|
|
|
Find out how much the sequence number has been altered for an outgoing
|
|
|
|
TCP packet. To do this, a circular list of ACK numbers where the TCP
|
2002-07-01 11:19:40 +00:00
|
|
|
packet size was altered is searched.
|
1997-05-23 04:41:31 +00:00
|
|
|
*/
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
int i;
|
|
|
|
int delta, seq_diff_min;
|
|
|
|
|
|
|
|
delta = 0;
|
|
|
|
seq_diff_min = -1;
|
|
|
|
for (i = 0; i < N_LINK_TCP_DATA; i++) {
|
|
|
|
struct ack_data_record x;
|
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
x = lnk->data.tcp->ack[i];
|
2004-03-16 21:30:41 +00:00
|
|
|
if (x.active == 1) {
|
|
|
|
int seq_diff;
|
|
|
|
|
|
|
|
seq_diff = SeqDiff(x.ack_old, seq);
|
|
|
|
if (seq_diff >= 0) {
|
|
|
|
if (seq_diff_min >= 0) {
|
|
|
|
if (seq_diff < seq_diff_min) {
|
|
|
|
delta = x.delta;
|
|
|
|
seq_diff_min = seq_diff;
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
delta = x.delta;
|
|
|
|
seq_diff_min = seq_diff;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return (delta);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
2008-03-06 21:50:41 +00:00
|
|
|
// XXX ip free
|
1997-05-23 04:41:31 +00:00
|
|
|
void
|
2008-03-06 21:50:41 +00:00
|
|
|
AddSeq(struct alias_link *lnk, int delta, u_int ip_hl, u_short ip_len,
|
|
|
|
u_long th_seq, u_int th_off)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
|
|
|
/*
|
|
|
|
When a TCP packet has been altered in length, save this
|
|
|
|
information in a circular list. If enough packets have
|
|
|
|
been altered, then this list will begin to overwrite itself.
|
|
|
|
*/
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
struct ack_data_record x;
|
|
|
|
int hlen, tlen, dlen;
|
|
|
|
int i;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2008-03-06 21:50:41 +00:00
|
|
|
hlen = (ip_hl + th_off) << 2;
|
|
|
|
tlen = ntohs(ip_len);
|
2004-03-16 21:30:41 +00:00
|
|
|
dlen = tlen - hlen;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2008-03-06 21:50:41 +00:00
|
|
|
x.ack_old = htonl(ntohl(th_seq) + dlen);
|
|
|
|
x.ack_new = htonl(ntohl(th_seq) + dlen + delta);
|
2004-03-16 21:30:41 +00:00
|
|
|
x.delta = delta;
|
|
|
|
x.active = 1;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
i = lnk->data.tcp->state.index;
|
|
|
|
lnk->data.tcp->ack[i] = x;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
i++;
|
|
|
|
if (i == N_LINK_TCP_DATA)
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->data.tcp->state.index = 0;
|
2004-03-16 21:30:41 +00:00
|
|
|
else
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->data.tcp->state.index = i;
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2004-07-05 11:10:57 +00:00
|
|
|
SetExpire(struct alias_link *lnk, int expire)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
if (expire == 0) {
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->flags &= ~LINK_PERMANENT;
|
|
|
|
DeleteLink(lnk);
|
2004-03-16 21:30:41 +00:00
|
|
|
} else if (expire == -1) {
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->flags |= LINK_PERMANENT;
|
2004-03-16 21:30:41 +00:00
|
|
|
} else if (expire > 0) {
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->expire_time = expire;
|
2004-03-16 21:30:41 +00:00
|
|
|
} else {
|
2005-05-06 11:07:49 +00:00
|
|
|
#ifdef LIBALIAS_DEBUG
|
2004-03-16 21:30:41 +00:00
|
|
|
fprintf(stderr, "PacketAlias/SetExpire(): ");
|
|
|
|
fprintf(stderr, "error in expire parameter\n");
|
1999-03-09 23:44:00 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2004-01-17 10:52:21 +00:00
|
|
|
ClearCheckNewLink(struct libalias *la)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
la->newDefaultLink = 0;
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
2000-06-14 16:09:35 +00:00
|
|
|
void
|
2004-07-05 11:10:57 +00:00
|
|
|
SetProtocolFlags(struct alias_link *lnk, int pflags)
|
2000-06-14 16:09:35 +00:00
|
|
|
{
|
|
|
|
|
2010-01-07 21:01:37 +00:00
|
|
|
lnk->pflags = pflags;
|
2000-06-14 16:09:35 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
int
|
2004-07-05 11:10:57 +00:00
|
|
|
GetProtocolFlags(struct alias_link *lnk)
|
2000-06-14 16:09:35 +00:00
|
|
|
{
|
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk->pflags);
|
2000-06-14 16:09:35 +00:00
|
|
|
}
|
|
|
|
|
2000-10-30 12:39:41 +00:00
|
|
|
void
|
2004-07-05 11:10:57 +00:00
|
|
|
SetDestCallId(struct alias_link *lnk, u_int16_t cid)
|
2000-10-30 12:39:41 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct libalias *la = lnk->la;
|
2000-10-30 12:39:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
la->deleteAllLinks = 1;
|
2007-04-07 09:47:39 +00:00
|
|
|
ReLink(lnk, lnk->src_addr, lnk->dst_addr, lnk->alias_addr,
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->src_port, cid, lnk->alias_port, lnk->link_type);
|
2004-03-16 21:30:41 +00:00
|
|
|
la->deleteAllLinks = 0;
|
2000-10-30 12:39:41 +00:00
|
|
|
}
|
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
|
1997-08-03 18:20:03 +00:00
|
|
|
/* Miscellaneous Functions
|
1997-05-23 04:41:31 +00:00
|
|
|
|
1997-08-03 18:20:03 +00:00
|
|
|
HouseKeeping()
|
|
|
|
InitPacketAliasLog()
|
|
|
|
UninitPacketAliasLog()
|
|
|
|
*/
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
Whenever an outgoing or incoming packet is handled, HouseKeeping()
|
|
|
|
is called to find and remove timed-out aliasing links. Logic exists
|
|
|
|
to sweep through the entire table and linked list structure
|
|
|
|
every 60 seconds.
|
|
|
|
|
|
|
|
(prototype in alias_local.h)
|
|
|
|
*/
|
|
|
|
|
|
|
|
void
|
2004-01-17 10:52:21 +00:00
|
|
|
HouseKeeping(struct libalias *la)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2008-06-01 18:34:58 +00:00
|
|
|
int i, n;
|
2005-05-05 21:05:38 +00:00
|
|
|
#ifndef _KERNEL
|
2004-03-16 21:30:41 +00:00
|
|
|
struct timeval tv;
|
2005-05-05 21:05:38 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
/*
|
|
|
|
* Save system time (seconds) in global variable timeStamp for use
|
|
|
|
* by other functions. This is done so as not to unnecessarily
|
|
|
|
* waste timeline by making system calls.
|
|
|
|
*/
|
2005-05-05 21:05:38 +00:00
|
|
|
#ifdef _KERNEL
|
2005-09-19 22:31:45 +00:00
|
|
|
la->timeStamp = time_uptime;
|
2005-05-05 21:05:38 +00:00
|
|
|
#else
|
2010-08-08 02:51:32 +00:00
|
|
|
gettimeofday(&tv, NULL);
|
2004-03-16 21:30:41 +00:00
|
|
|
la->timeStamp = tv.tv_sec;
|
2005-05-05 21:05:38 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
|
|
|
|
/* Compute number of spokes (output table link chains) to cover */
|
2008-06-01 18:34:58 +00:00
|
|
|
n = LINK_TABLE_OUT_SIZE * (la->timeStamp - la->lastCleanupTime);
|
|
|
|
n /= ALIAS_CLEANUP_INTERVAL_SECS;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
|
|
|
/* Handle different cases */
|
2008-06-01 18:34:58 +00:00
|
|
|
if (n > 0) {
|
|
|
|
if (n > ALIAS_CLEANUP_MAX_SPOKES)
|
|
|
|
n = ALIAS_CLEANUP_MAX_SPOKES;
|
2004-03-16 21:30:41 +00:00
|
|
|
la->lastCleanupTime = la->timeStamp;
|
|
|
|
for (i = 0; i < n; i++)
|
|
|
|
IncrementalCleanup(la);
|
|
|
|
} else if (n < 0) {
|
2005-05-06 11:07:49 +00:00
|
|
|
#ifdef LIBALIAS_DEBUG
|
2004-03-16 21:30:41 +00:00
|
|
|
fprintf(stderr, "PacketAlias/HouseKeeping(): ");
|
|
|
|
fprintf(stderr, "something unexpected in time values\n");
|
1999-03-09 23:44:00 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
la->lastCleanupTime = la->timeStamp;
|
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
1997-08-03 18:20:03 +00:00
|
|
|
/* Init the log file and enable logging */
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
static int
|
2004-01-17 10:52:21 +00:00
|
|
|
InitPacketAliasLog(struct libalias *la)
|
1997-08-03 18:20:03 +00:00
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
if (~la->packetAliasMode & PKT_ALIAS_LOG) {
|
|
|
|
#ifdef _KERNEL
|
|
|
|
if ((la->logDesc = malloc(LIBALIAS_BUF_SIZE)))
|
|
|
|
;
|
|
|
|
#else
|
|
|
|
if ((la->logDesc = fopen("/var/log/alias.log", "w")))
|
|
|
|
fprintf(la->logDesc, "PacketAlias/InitPacketAliasLog: Packet alias logging enabled.\n");
|
|
|
|
#endif
|
|
|
|
else
|
|
|
|
return (ENOMEM); /* log initialization failed */
|
2004-03-16 21:30:41 +00:00
|
|
|
la->packetAliasMode |= PKT_ALIAS_LOG;
|
|
|
|
}
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
|
|
|
|
return (1);
|
1997-08-03 18:20:03 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Close the log-file and disable logging. */
|
1998-01-09 21:13:35 +00:00
|
|
|
static void
|
2004-01-17 10:52:21 +00:00
|
|
|
UninitPacketAliasLog(struct libalias *la)
|
1997-08-03 18:20:03 +00:00
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
|
|
|
if (la->logDesc) {
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
#ifdef _KERNEL
|
2006-12-15 12:50:06 +00:00
|
|
|
free(la->logDesc);
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
#else
|
2006-12-15 12:50:06 +00:00
|
|
|
fclose(la->logDesc);
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
#endif
|
2006-12-15 12:50:06 +00:00
|
|
|
la->logDesc = NULL;
|
|
|
|
}
|
2004-03-16 21:30:41 +00:00
|
|
|
la->packetAliasMode &= ~PKT_ALIAS_LOG;
|
1997-08-03 18:20:03 +00:00
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
/* Outside world interfaces
|
|
|
|
|
|
|
|
-- "outside world" means other than alias*.c routines --
|
|
|
|
|
|
|
|
PacketAliasRedirectPort()
|
2000-04-27 17:37:03 +00:00
|
|
|
PacketAliasAddServer()
|
2000-04-28 13:44:49 +00:00
|
|
|
PacketAliasRedirectProto()
|
1997-05-23 04:41:31 +00:00
|
|
|
PacketAliasRedirectAddr()
|
2003-06-01 23:15:00 +00:00
|
|
|
PacketAliasRedirectDynamic()
|
1997-08-03 18:20:03 +00:00
|
|
|
PacketAliasRedirectDelete()
|
|
|
|
PacketAliasSetAddress()
|
|
|
|
PacketAliasInit()
|
1998-01-09 21:13:35 +00:00
|
|
|
PacketAliasUninit()
|
1997-08-03 18:20:03 +00:00
|
|
|
PacketAliasSetMode()
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
(prototypes in alias.h)
|
|
|
|
*/
|
|
|
|
|
|
|
|
/* Redirection from a specific public addr:port to a
|
2000-04-18 10:18:21 +00:00
|
|
|
private addr:port */
|
1997-05-23 04:41:31 +00:00
|
|
|
struct alias_link *
|
2004-03-16 21:30:41 +00:00
|
|
|
LibAliasRedirectPort(struct libalias *la, struct in_addr src_addr, u_short src_port,
|
|
|
|
struct in_addr dst_addr, u_short dst_port,
|
|
|
|
struct in_addr alias_addr, u_short alias_port,
|
|
|
|
u_char proto)
|
|
|
|
{
|
|
|
|
int link_type;
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
switch (proto) {
|
|
|
|
case IPPROTO_UDP:
|
|
|
|
link_type = LINK_UDP;
|
|
|
|
break;
|
|
|
|
case IPPROTO_TCP:
|
|
|
|
link_type = LINK_TCP;
|
|
|
|
break;
|
2009-02-07 18:49:42 +00:00
|
|
|
case IPPROTO_SCTP:
|
|
|
|
link_type = LINK_SCTP;
|
|
|
|
break;
|
2004-03-16 21:30:41 +00:00
|
|
|
default:
|
2005-05-06 11:07:49 +00:00
|
|
|
#ifdef LIBALIAS_DEBUG
|
2004-03-16 21:30:41 +00:00
|
|
|
fprintf(stderr, "PacketAliasRedirectPort(): ");
|
2009-02-07 18:49:42 +00:00
|
|
|
fprintf(stderr, "only SCTP, TCP and UDP protocols allowed\n");
|
1999-03-09 23:44:00 +00:00
|
|
|
#endif
|
2006-12-15 12:50:06 +00:00
|
|
|
lnk = NULL;
|
|
|
|
goto getout;
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = AddLink(la, src_addr, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
src_port, dst_port, alias_port,
|
|
|
|
link_type);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk != NULL) {
|
|
|
|
lnk->flags |= LINK_PERMANENT;
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
2005-05-06 11:07:49 +00:00
|
|
|
#ifdef LIBALIAS_DEBUG
|
2004-03-16 21:30:41 +00:00
|
|
|
else {
|
|
|
|
fprintf(stderr, "PacketAliasRedirectPort(): "
|
|
|
|
"call to AddLink() failed\n");
|
|
|
|
}
|
1999-03-09 23:44:00 +00:00
|
|
|
#endif
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
getout:
|
|
|
|
LIBALIAS_UNLOCK(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
2000-04-27 17:37:03 +00:00
|
|
|
/* Add server to the pool of servers */
|
|
|
|
int
|
2004-07-05 11:10:57 +00:00
|
|
|
LibAliasAddServer(struct libalias *la, struct alias_link *lnk, struct in_addr addr, u_short port)
|
2000-04-27 17:37:03 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
struct server *server;
|
2006-12-15 12:50:06 +00:00
|
|
|
int res;
|
2000-04-27 17:37:03 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
(void)la;
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
server = malloc(sizeof(struct server));
|
2000-04-27 17:37:03 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
if (server != NULL) {
|
|
|
|
struct server *head;
|
2000-04-27 17:37:03 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
server->addr = addr;
|
|
|
|
server->port = port;
|
2000-04-27 17:37:03 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
head = lnk->server;
|
2004-03-16 21:30:41 +00:00
|
|
|
if (head == NULL)
|
|
|
|
server->next = server;
|
|
|
|
else {
|
|
|
|
struct server *s;
|
2000-04-27 17:37:03 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
for (s = head; s->next != head; s = s->next);
|
|
|
|
s->next = server;
|
|
|
|
server->next = head;
|
|
|
|
}
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->server = server;
|
2006-12-15 12:50:06 +00:00
|
|
|
res = 0;
|
2004-03-16 21:30:41 +00:00
|
|
|
} else
|
2006-12-15 12:50:06 +00:00
|
|
|
res = -1;
|
|
|
|
|
|
|
|
LIBALIAS_UNLOCK(la);
|
|
|
|
return (res);
|
2000-04-27 17:37:03 +00:00
|
|
|
}
|
|
|
|
|
2000-04-28 13:44:49 +00:00
|
|
|
/* Redirect packets of a given IP protocol from a specific
|
2000-04-18 10:18:21 +00:00
|
|
|
public address to a private address */
|
|
|
|
struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
LibAliasRedirectProto(struct libalias *la, struct in_addr src_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr dst_addr,
|
|
|
|
struct in_addr alias_addr,
|
|
|
|
u_char proto)
|
1999-02-27 02:16:01 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
2000-04-18 10:18:21 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = AddLink(la, src_addr, dst_addr, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
NO_SRC_PORT, NO_DEST_PORT, 0,
|
|
|
|
proto);
|
2000-04-18 10:18:21 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk != NULL) {
|
|
|
|
lnk->flags |= LINK_PERMANENT;
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
2005-05-06 11:07:49 +00:00
|
|
|
#ifdef LIBALIAS_DEBUG
|
2004-03-16 21:30:41 +00:00
|
|
|
else {
|
|
|
|
fprintf(stderr, "PacketAliasRedirectProto(): "
|
|
|
|
"call to AddLink() failed\n");
|
|
|
|
}
|
2000-04-18 10:18:21 +00:00
|
|
|
#endif
|
1999-02-27 02:16:01 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_UNLOCK(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
1999-02-27 02:16:01 +00:00
|
|
|
}
|
1997-05-23 04:41:31 +00:00
|
|
|
|
|
|
|
/* Static address translation */
|
|
|
|
struct alias_link *
|
2004-01-17 10:52:21 +00:00
|
|
|
LibAliasRedirectAddr(struct libalias *la, struct in_addr src_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
struct in_addr alias_addr)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-07-05 11:10:57 +00:00
|
|
|
struct alias_link *lnk;
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk = AddLink(la, src_addr, la->nullAddress, alias_addr,
|
2004-03-16 21:30:41 +00:00
|
|
|
0, 0, 0,
|
|
|
|
LINK_ADDR);
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
if (lnk != NULL) {
|
|
|
|
lnk->flags |= LINK_PERMANENT;
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
2005-05-06 11:07:49 +00:00
|
|
|
#ifdef LIBALIAS_DEBUG
|
2004-03-16 21:30:41 +00:00
|
|
|
else {
|
|
|
|
fprintf(stderr, "PacketAliasRedirectAddr(): "
|
|
|
|
"call to AddLink() failed\n");
|
|
|
|
}
|
1999-03-09 23:44:00 +00:00
|
|
|
#endif
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_UNLOCK(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
return (lnk);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
2003-06-01 23:15:00 +00:00
|
|
|
/* Mark the aliasing link dynamic */
|
|
|
|
int
|
2004-07-05 11:10:57 +00:00
|
|
|
LibAliasRedirectDynamic(struct libalias *la, struct alias_link *lnk)
|
2003-06-01 23:15:00 +00:00
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
int res;
|
2003-06-01 23:15:00 +00:00
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK(la);
|
2004-07-05 11:10:57 +00:00
|
|
|
(void)la;
|
|
|
|
|
|
|
|
if (lnk->flags & LINK_PARTIALLY_SPECIFIED)
|
2006-12-15 12:50:06 +00:00
|
|
|
res = -1;
|
2004-03-16 21:30:41 +00:00
|
|
|
else {
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->flags &= ~LINK_PERMANENT;
|
2006-12-15 12:50:06 +00:00
|
|
|
res = 0;
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_UNLOCK(la);
|
|
|
|
return (res);
|
2003-06-01 23:15:00 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
void
|
2004-07-05 11:10:57 +00:00
|
|
|
LibAliasRedirectDelete(struct libalias *la, struct alias_link *lnk)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
1997-08-03 18:20:03 +00:00
|
|
|
/* This is a dangerous function to put in the API,
|
1997-05-23 04:41:31 +00:00
|
|
|
because an invalid pointer can crash the program. */
|
|
|
|
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
la->deleteAllLinks = 1;
|
2004-07-05 11:10:57 +00:00
|
|
|
DeleteLink(lnk);
|
2004-03-16 21:30:41 +00:00
|
|
|
la->deleteAllLinks = 0;
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_UNLOCK(la);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void
|
2004-01-17 10:52:21 +00:00
|
|
|
LibAliasSetAddress(struct libalias *la, struct in_addr addr)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
|
|
|
LIBALIAS_LOCK(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
if (la->packetAliasMode & PKT_ALIAS_RESET_ON_ADDR_CHANGE
|
|
|
|
&& la->aliasAddress.s_addr != addr.s_addr)
|
|
|
|
CleanupAliasData(la);
|
1998-02-27 23:07:07 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
la->aliasAddress = addr;
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_UNLOCK(la);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
void
|
2004-01-17 10:52:21 +00:00
|
|
|
LibAliasSetTarget(struct libalias *la, struct in_addr target_addr)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
|
|
|
LIBALIAS_LOCK(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
la->targetAddress = target_addr;
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_UNLOCK(la);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
2004-01-17 10:52:21 +00:00
|
|
|
static void
|
|
|
|
finishoff(void)
|
|
|
|
{
|
1997-05-23 04:41:31 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
while (!LIST_EMPTY(&instancehead))
|
2004-01-17 10:52:21 +00:00
|
|
|
LibAliasUninit(LIST_FIRST(&instancehead));
|
|
|
|
}
|
|
|
|
|
|
|
|
struct libalias *
|
|
|
|
LibAliasInit(struct libalias *la)
|
1997-05-23 04:41:31 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
int i;
|
2005-05-05 21:05:38 +00:00
|
|
|
#ifndef _KERNEL
|
2004-03-16 21:30:41 +00:00
|
|
|
struct timeval tv;
|
2005-05-05 21:05:38 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
|
|
|
|
if (la == NULL) {
|
2011-04-18 20:07:08 +00:00
|
|
|
#ifdef _KERNEL
|
|
|
|
#undef malloc /* XXX: ugly */
|
|
|
|
la = malloc(sizeof *la, M_ALIAS, M_WAITOK | M_ZERO);
|
|
|
|
#else
|
2004-03-16 21:30:41 +00:00
|
|
|
la = calloc(sizeof *la, 1);
|
|
|
|
if (la == NULL)
|
|
|
|
return (la);
|
2011-04-18 20:07:08 +00:00
|
|
|
#endif
|
2005-05-05 21:05:38 +00:00
|
|
|
|
|
|
|
#ifndef _KERNEL /* kernel cleans up on module unload */
|
2004-03-16 21:30:41 +00:00
|
|
|
if (LIST_EMPTY(&instancehead))
|
|
|
|
atexit(finishoff);
|
2005-05-05 21:05:38 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
LIST_INSERT_HEAD(&instancehead, la, instancelist);
|
|
|
|
|
2005-05-05 21:05:38 +00:00
|
|
|
#ifdef _KERNEL
|
2005-09-19 22:31:45 +00:00
|
|
|
la->timeStamp = time_uptime;
|
|
|
|
la->lastCleanupTime = time_uptime;
|
2005-05-05 21:05:38 +00:00
|
|
|
#else
|
2010-08-08 02:51:32 +00:00
|
|
|
gettimeofday(&tv, NULL);
|
2004-03-16 21:30:41 +00:00
|
|
|
la->timeStamp = tv.tv_sec;
|
|
|
|
la->lastCleanupTime = tv.tv_sec;
|
2005-05-05 21:05:38 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
|
|
|
|
for (i = 0; i < LINK_TABLE_OUT_SIZE; i++)
|
|
|
|
LIST_INIT(&la->linkTableOut[i]);
|
|
|
|
for (i = 0; i < LINK_TABLE_IN_SIZE; i++)
|
|
|
|
LIST_INIT(&la->linkTableIn[i]);
|
2009-02-07 18:49:42 +00:00
|
|
|
#ifdef _KERNEL
|
|
|
|
AliasSctpInit(la);
|
|
|
|
#endif
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK_INIT(la);
|
|
|
|
LIBALIAS_LOCK(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
} else {
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_LOCK(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
la->deleteAllLinks = 1;
|
|
|
|
CleanupAliasData(la);
|
|
|
|
la->deleteAllLinks = 0;
|
2009-02-07 18:49:42 +00:00
|
|
|
#ifdef _KERNEL
|
|
|
|
AliasSctpTerm(la);
|
|
|
|
AliasSctpInit(la);
|
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
la->aliasAddress.s_addr = INADDR_ANY;
|
|
|
|
la->targetAddress.s_addr = INADDR_ANY;
|
|
|
|
|
|
|
|
la->icmpLinkCount = 0;
|
|
|
|
la->udpLinkCount = 0;
|
|
|
|
la->tcpLinkCount = 0;
|
2009-02-07 18:49:42 +00:00
|
|
|
la->sctpLinkCount = 0;
|
2004-03-16 21:30:41 +00:00
|
|
|
la->pptpLinkCount = 0;
|
|
|
|
la->protoLinkCount = 0;
|
|
|
|
la->fragmentIdLinkCount = 0;
|
|
|
|
la->fragmentPtrLinkCount = 0;
|
|
|
|
la->sockCount = 0;
|
|
|
|
|
|
|
|
la->cleanupIndex = 0;
|
|
|
|
|
|
|
|
la->packetAliasMode = PKT_ALIAS_SAME_PORTS
|
2005-05-05 20:25:12 +00:00
|
|
|
#ifndef NO_USE_SOCKETS
|
2004-03-16 21:30:41 +00:00
|
|
|
| PKT_ALIAS_USE_SOCKETS
|
2005-05-05 20:25:12 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
| PKT_ALIAS_RESET_ON_ADDR_CHANGE;
|
2004-01-17 10:52:21 +00:00
|
|
|
#ifndef NO_FW_PUNCH
|
2004-03-16 21:30:41 +00:00
|
|
|
la->fireWallFD = -1;
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
#endif
|
|
|
|
#ifndef _KERNEL
|
|
|
|
LibAliasRefreshModules();
|
2004-01-17 10:52:21 +00:00
|
|
|
#endif
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_UNLOCK(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
return (la);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
1998-01-09 21:13:35 +00:00
|
|
|
void
|
2004-03-16 21:30:41 +00:00
|
|
|
LibAliasUninit(struct libalias *la)
|
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
|
|
|
LIBALIAS_LOCK(la);
|
2009-02-07 18:49:42 +00:00
|
|
|
#ifdef _KERNEL
|
|
|
|
AliasSctpTerm(la);
|
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
la->deleteAllLinks = 1;
|
|
|
|
CleanupAliasData(la);
|
|
|
|
la->deleteAllLinks = 0;
|
|
|
|
UninitPacketAliasLog(la);
|
1998-04-19 21:42:07 +00:00
|
|
|
#ifndef NO_FW_PUNCH
|
2004-03-16 21:30:41 +00:00
|
|
|
UninitPunchFW(la);
|
1998-04-19 21:42:07 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
LIST_REMOVE(la, instancelist);
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_UNLOCK(la);
|
|
|
|
LIBALIAS_LOCK_DESTROY(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
free(la);
|
1998-01-09 21:13:35 +00:00
|
|
|
}
|
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
/* Change mode for some operations */
|
|
|
|
unsigned int
|
2004-01-17 10:52:21 +00:00
|
|
|
LibAliasSetMode(
|
|
|
|
struct libalias *la,
|
2004-03-16 21:30:41 +00:00
|
|
|
unsigned int flags, /* Which state to bring flags to */
|
|
|
|
unsigned int mask /* Mask of which flags to affect (use 0 to
|
|
|
|
* do a probe for flag values) */
|
1997-05-23 04:41:31 +00:00
|
|
|
)
|
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
int res = -1;
|
|
|
|
|
|
|
|
LIBALIAS_LOCK(la);
|
1997-05-23 04:41:31 +00:00
|
|
|
/* Enable logging? */
|
2004-03-16 21:30:41 +00:00
|
|
|
if (flags & mask & PKT_ALIAS_LOG) {
|
Summer of Code 2005: improve libalias - part 1 of 2
With the first part of my previous Summer of Code work, we get:
-made libalias modular:
-support for 'particular' protocols (like ftp/irc/etcetc) is no more
hardcoded inside libalias, but it's available through external
modules loadable at runtime
-modules are available both in kernel (/boot/kernel/alias_*.ko) and
user land (/lib/libalias_*)
-protocols/applications modularized are: cuseeme, ftp, irc, nbt, pptp,
skinny and smedia
-added logging support for kernel side
-cleanup
After a buildworld, do a 'mergemaster -i' to install the file libalias.conf
in /etc or manually copy it.
During startup (and after every HUP signal) user land applications running
the new libalias will try to read a file in /etc called libalias.conf:
that file contains the list of modules to load.
User land applications affected by this commit are ppp and natd:
if libalias.conf is present in /etc you won't notice any difference.
The only kernel land bit affected by this commit is ng_nat:
if you are using ng_nat, and it doesn't correctly handle
ftp/irc/etcetc sessions anymore, remember to kldload
the correspondent module (i.e. kldload alias_ftp).
General information and details about the inner working are available
in the libalias man page under the section 'MODULAR ARCHITECTURE
(AND ipfw(4) SUPPORT)'.
NOTA BENE: this commit affects _ONLY_ libalias, ipfw in-kernel nat
support will be part of the next libalias-related commit.
Approved by: glebius
Reviewed by: glebius, ru
2006-09-26 23:26:53 +00:00
|
|
|
/* Do the enable */
|
|
|
|
if (InitPacketAliasLog(la) == ENOMEM)
|
2006-12-15 12:50:06 +00:00
|
|
|
goto getout;
|
2004-03-16 21:30:41 +00:00
|
|
|
} else
|
1997-05-23 04:41:31 +00:00
|
|
|
/* _Disable_ logging? */
|
2004-03-16 21:30:41 +00:00
|
|
|
if (~flags & mask & PKT_ALIAS_LOG) {
|
|
|
|
UninitPacketAliasLog(la);
|
|
|
|
}
|
1998-04-19 21:42:07 +00:00
|
|
|
#ifndef NO_FW_PUNCH
|
1998-01-09 21:13:35 +00:00
|
|
|
/* Start punching holes in the firewall? */
|
2004-03-16 21:30:41 +00:00
|
|
|
if (flags & mask & PKT_ALIAS_PUNCH_FW) {
|
|
|
|
InitPunchFW(la);
|
|
|
|
} else
|
1998-01-09 21:13:35 +00:00
|
|
|
/* Stop punching holes in the firewall? */
|
2004-03-16 21:30:41 +00:00
|
|
|
if (~flags & mask & PKT_ALIAS_PUNCH_FW) {
|
|
|
|
UninitPunchFW(la);
|
|
|
|
}
|
1998-04-19 21:42:07 +00:00
|
|
|
#endif
|
1998-01-09 21:13:35 +00:00
|
|
|
|
1997-05-23 04:41:31 +00:00
|
|
|
/* Other flags can be set/cleared without special action */
|
2004-03-16 21:30:41 +00:00
|
|
|
la->packetAliasMode = (flags & mask) | (la->packetAliasMode & ~mask);
|
2006-12-15 12:50:06 +00:00
|
|
|
res = la->packetAliasMode;
|
|
|
|
getout:
|
|
|
|
LIBALIAS_UNLOCK(la);
|
|
|
|
return (res);
|
1997-05-23 04:41:31 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
1997-08-03 18:20:03 +00:00
|
|
|
int
|
2004-01-17 10:52:21 +00:00
|
|
|
LibAliasCheckNewLink(struct libalias *la)
|
1997-08-03 18:20:03 +00:00
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
int res;
|
|
|
|
|
|
|
|
LIBALIAS_LOCK(la);
|
|
|
|
res = la->newDefaultLink;
|
|
|
|
LIBALIAS_UNLOCK(la);
|
|
|
|
return (res);
|
1997-08-03 18:20:03 +00:00
|
|
|
}
|
1998-01-09 21:13:35 +00:00
|
|
|
|
|
|
|
|
1998-04-19 21:42:07 +00:00
|
|
|
#ifndef NO_FW_PUNCH
|
|
|
|
|
1998-01-09 21:13:35 +00:00
|
|
|
/*****************
|
|
|
|
Code to support firewall punching. This shouldn't really be in this
|
|
|
|
file, but making variables global is evil too.
|
|
|
|
****************/
|
|
|
|
|
|
|
|
/* Firewall include files */
|
1998-01-10 15:04:06 +00:00
|
|
|
#include <net/if.h>
|
1998-01-09 21:13:35 +00:00
|
|
|
#include <netinet/ip_fw.h>
|
|
|
|
#include <string.h>
|
|
|
|
#include <err.h>
|
|
|
|
|
The new ipfw code.
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.
The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).
The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.
I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.
In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.
On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like
ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any
This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.
Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:
10.20.30.0/26{18,44,33,22,9}
which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).
Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.
The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
2002-06-27 23:02:18 +00:00
|
|
|
/*
|
|
|
|
* helper function, updates the pointer to cmd with the length
|
|
|
|
* of the current command, and also cleans up the first word of
|
|
|
|
* the new command in case it has been clobbered before.
|
|
|
|
*/
|
|
|
|
static ipfw_insn *
|
2004-03-16 21:30:41 +00:00
|
|
|
next_cmd(ipfw_insn * cmd)
|
The new ipfw code.
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.
The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).
The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.
I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.
In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.
On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like
ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any
This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.
Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:
10.20.30.0/26{18,44,33,22,9}
which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).
Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.
The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
2002-06-27 23:02:18 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
cmd += F_LEN(cmd);
|
|
|
|
bzero(cmd, sizeof(*cmd));
|
2004-07-05 10:55:23 +00:00
|
|
|
return (cmd);
|
The new ipfw code.
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.
The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).
The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.
I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.
In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.
On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like
ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any
This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.
Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:
10.20.30.0/26{18,44,33,22,9}
which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).
Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.
The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
2002-06-27 23:02:18 +00:00
|
|
|
}
|
|
|
|
|
2002-07-08 22:57:35 +00:00
|
|
|
/*
|
|
|
|
* A function to fill simple commands of size 1.
|
|
|
|
* Existing flags are preserved.
|
|
|
|
*/
|
|
|
|
static ipfw_insn *
|
2004-03-16 21:30:41 +00:00
|
|
|
fill_cmd(ipfw_insn * cmd, enum ipfw_opcodes opcode, int size,
|
|
|
|
int flags, u_int16_t arg)
|
The new ipfw code.
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.
The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).
The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.
I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.
In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.
On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like
ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any
This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.
Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:
10.20.30.0/26{18,44,33,22,9}
which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).
Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.
The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
2002-06-27 23:02:18 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
cmd->opcode = opcode;
|
|
|
|
cmd->len = ((cmd->len | flags) & (F_NOT | F_OR)) | (size & F_LEN_MASK);
|
|
|
|
cmd->arg1 = arg;
|
|
|
|
return next_cmd(cmd);
|
2002-07-08 22:57:35 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static ipfw_insn *
|
2004-03-16 21:30:41 +00:00
|
|
|
fill_ip(ipfw_insn * cmd1, enum ipfw_opcodes opcode, u_int32_t addr)
|
2002-07-08 22:57:35 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
ipfw_insn_ip *cmd = (ipfw_insn_ip *) cmd1;
|
2002-07-08 22:57:35 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
cmd->addr.s_addr = addr;
|
|
|
|
return fill_cmd(cmd1, opcode, F_INSN_SIZE(ipfw_insn_u32), 0, 0);
|
The new ipfw code.
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.
The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).
The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.
I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.
In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.
On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like
ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any
This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.
Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:
10.20.30.0/26{18,44,33,22,9}
which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).
Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.
The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
2002-06-27 23:02:18 +00:00
|
|
|
}
|
|
|
|
|
2002-07-08 22:57:35 +00:00
|
|
|
static ipfw_insn *
|
2004-03-16 21:30:41 +00:00
|
|
|
fill_one_port(ipfw_insn * cmd1, enum ipfw_opcodes opcode, u_int16_t port)
|
The new ipfw code.
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.
The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).
The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.
I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.
In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.
On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like
ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any
This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.
Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:
10.20.30.0/26{18,44,33,22,9}
which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).
Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.
The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
2002-06-27 23:02:18 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
ipfw_insn_u16 *cmd = (ipfw_insn_u16 *) cmd1;
|
2002-07-08 22:57:35 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
cmd->ports[0] = cmd->ports[1] = port;
|
|
|
|
return fill_cmd(cmd1, opcode, F_INSN_SIZE(ipfw_insn_u16), 0, 0);
|
The new ipfw code.
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.
The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).
The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.
I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.
In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.
On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like
ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any
This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.
Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:
10.20.30.0/26{18,44,33,22,9}
which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).
Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.
The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
2002-06-27 23:02:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
fill_rule(void *buf, int bufsize, int rulenum,
|
2004-03-16 21:30:41 +00:00
|
|
|
enum ipfw_opcodes action, int proto,
|
|
|
|
struct in_addr sa, u_int16_t sp, struct in_addr da, u_int16_t dp)
|
The new ipfw code.
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.
The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).
The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.
I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.
In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.
On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like
ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any
This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.
Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:
10.20.30.0/26{18,44,33,22,9}
which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).
Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.
The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
2002-06-27 23:02:18 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
struct ip_fw *rule = (struct ip_fw *)buf;
|
|
|
|
ipfw_insn *cmd = (ipfw_insn *) rule->cmd;
|
The new ipfw code.
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.
The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).
The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.
I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.
In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.
On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like
ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any
This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.
Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:
10.20.30.0/26{18,44,33,22,9}
which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).
Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.
The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
2002-06-27 23:02:18 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
bzero(buf, bufsize);
|
|
|
|
rule->rulenum = rulenum;
|
The new ipfw code.
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.
The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).
The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.
I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.
In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.
On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like
ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any
This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.
Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:
10.20.30.0/26{18,44,33,22,9}
which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).
Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.
The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
2002-06-27 23:02:18 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
cmd = fill_cmd(cmd, O_PROTO, F_INSN_SIZE(ipfw_insn), 0, proto);
|
|
|
|
cmd = fill_ip(cmd, O_IP_SRC, sa.s_addr);
|
|
|
|
cmd = fill_one_port(cmd, O_IP_SRCPORT, sp);
|
|
|
|
cmd = fill_ip(cmd, O_IP_DST, da.s_addr);
|
|
|
|
cmd = fill_one_port(cmd, O_IP_DSTPORT, dp);
|
The new ipfw code.
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.
The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).
The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.
I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.
In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.
On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like
ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any
This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.
Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:
10.20.30.0/26{18,44,33,22,9}
which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).
Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.
The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
2002-06-27 23:02:18 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
rule->act_ofs = (u_int32_t *) cmd - (u_int32_t *) rule->cmd;
|
|
|
|
cmd = fill_cmd(cmd, action, F_INSN_SIZE(ipfw_insn), 0, 0);
|
2002-07-01 11:19:40 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
rule->cmd_len = (u_int32_t *) cmd - (u_int32_t *) rule->cmd;
|
The new ipfw code.
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.
The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).
The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.
I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.
In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.
On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like
ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any
This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.
Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:
10.20.30.0/26{18,44,33,22,9}
which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).
Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.
The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
2002-06-27 23:02:18 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
return ((char *)cmd - (char *)buf);
|
The new ipfw code.
This code makes use of variable-size kernel representation of rules
(exactly the same concept of BPF instructions, as used in the BSDI's
firewall), which makes firewall operation a lot faster, and the
code more readable and easier to extend and debug.
The interface with the rest of the system is unchanged, as witnessed
by this commit. The only extra kernel files that I am touching
are if_fw.h and ip_dummynet.c, which is quite tied to ipfw. In
userland I only had to touch those programs which manipulate the
internal representation of firewall rules).
The code is almost entirely new (and I believe I have written the
vast majority of those sections which were taken from the former
ip_fw.c), so rather than modifying the old ip_fw.c I decided to
create a new file, sys/netinet/ip_fw2.c . Same for the user
interface, which is in sbin/ipfw/ipfw2.c (it still compiles to
/sbin/ipfw). The old files are still there, and will be removed
in due time.
I have not renamed the header file because it would have required
touching a one-line change to a number of kernel files.
In terms of user interface, the new "ipfw" is supposed to accepts
the old syntax for ipfw rules (and produce the same output with
"ipfw show". Only a couple of the old options (out of some 30 of
them) has not been implemented, but they will be soon.
On the other hand, the new code has some very powerful extensions.
First, you can put "or" connectives between match fields (and soon
also between options), and write things like
ipfw add allow ip from { 1.2.3.4/27 or 5.6.7.8/30 } 10-23,25,1024-3000 to any
This should make rulesets slightly more compact (and lines longer!),
by condensing 2 or more of the old rules into single ones.
Also, as an example of how easy the rules can be extended, I have
implemented an 'address set' match pattern, where you can specify
an IP address in a format like this:
10.20.30.0/26{18,44,33,22,9}
which will match the set of hosts listed in braces belonging to the
subnet 10.20.30.0/26 . The match is done using a bitmap, so it is
essentially a constant time operation requiring a handful of CPU
instructions (and a very small amount of memmory -- for a full /24
subnet, the instruction only consumes 40 bytes).
Again, in this commit I have focused on functionality and tried
to minimize changes to the other parts of the system. Some performance
improvement can be achieved with minor changes to the interface of
ip_fw_chk_t. This will be done later when this code is settled.
The code is meant to compile unmodified on RELENG_4 (once the
PACKET_TAG_* changes have been merged), for this reason
you will see #ifdef __FreeBSD_version in a couple of places.
This should minimize errors when (hopefully soon) it will be time
to do the MFC.
2002-06-27 23:02:18 +00:00
|
|
|
}
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
static void ClearAllFWHoles(struct libalias *la);
|
1998-01-09 21:13:35 +00:00
|
|
|
|
|
|
|
|
2004-01-17 10:52:21 +00:00
|
|
|
#define fw_setfield(la, field, num) \
|
1998-01-09 21:13:35 +00:00
|
|
|
do { \
|
2004-01-17 10:52:21 +00:00
|
|
|
(field)[(num) - la->fireWallBaseNum] = 1; \
|
2004-03-16 21:30:41 +00:00
|
|
|
} /*lint -save -e717 */ while(0)/* lint -restore */
|
2004-01-17 10:52:21 +00:00
|
|
|
|
|
|
|
#define fw_clrfield(la, field, num) \
|
1998-01-09 21:13:35 +00:00
|
|
|
do { \
|
2004-01-17 10:52:21 +00:00
|
|
|
(field)[(num) - la->fireWallBaseNum] = 0; \
|
2004-03-16 21:30:41 +00:00
|
|
|
} /*lint -save -e717 */ while(0)/* lint -restore */
|
2004-01-17 10:52:21 +00:00
|
|
|
|
|
|
|
#define fw_tstfield(la, field, num) ((field)[(num) - la->fireWallBaseNum])
|
1998-01-09 21:13:35 +00:00
|
|
|
|
|
|
|
static void
|
2004-01-17 10:52:21 +00:00
|
|
|
InitPunchFW(struct libalias *la)
|
|
|
|
{
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
la->fireWallField = malloc(la->fireWallNumNums);
|
|
|
|
if (la->fireWallField) {
|
|
|
|
memset(la->fireWallField, 0, la->fireWallNumNums);
|
|
|
|
if (la->fireWallFD < 0) {
|
|
|
|
la->fireWallFD = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
|
|
|
|
}
|
|
|
|
ClearAllFWHoles(la);
|
|
|
|
la->fireWallActiveNum = la->fireWallBaseNum;
|
|
|
|
}
|
1998-01-09 21:13:35 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
2004-01-17 10:52:21 +00:00
|
|
|
UninitPunchFW(struct libalias *la)
|
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
ClearAllFWHoles(la);
|
|
|
|
if (la->fireWallFD >= 0)
|
|
|
|
close(la->fireWallFD);
|
|
|
|
la->fireWallFD = -1;
|
|
|
|
if (la->fireWallField)
|
|
|
|
free(la->fireWallField);
|
|
|
|
la->fireWallField = NULL;
|
|
|
|
la->packetAliasMode &= ~PKT_ALIAS_PUNCH_FW;
|
1998-01-09 21:13:35 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Make a certain link go through the firewall */
|
|
|
|
void
|
2004-07-05 11:10:57 +00:00
|
|
|
PunchFWHole(struct alias_link *lnk)
|
2004-01-17 10:52:21 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
struct libalias *la;
|
|
|
|
int r; /* Result code */
|
|
|
|
struct ip_fw rule; /* On-the-fly built rule */
|
|
|
|
int fwhole; /* Where to punch hole */
|
1998-01-09 21:13:35 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
la = lnk->la;
|
2004-01-17 10:52:21 +00:00
|
|
|
|
1998-01-09 21:13:35 +00:00
|
|
|
/* Don't do anything unless we are asked to */
|
2004-03-16 21:30:41 +00:00
|
|
|
if (!(la->packetAliasMode & PKT_ALIAS_PUNCH_FW) ||
|
|
|
|
la->fireWallFD < 0 ||
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->link_type != LINK_TCP)
|
2004-03-16 21:30:41 +00:00
|
|
|
return;
|
1998-01-09 21:13:35 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
memset(&rule, 0, sizeof rule);
|
1998-01-09 21:13:35 +00:00
|
|
|
|
|
|
|
/** Build rule **/
|
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
/* Find empty slot */
|
|
|
|
for (fwhole = la->fireWallActiveNum;
|
|
|
|
fwhole < la->fireWallBaseNum + la->fireWallNumNums &&
|
|
|
|
fw_tstfield(la, la->fireWallField, fwhole);
|
|
|
|
fwhole++);
|
|
|
|
if (fwhole == la->fireWallBaseNum + la->fireWallNumNums) {
|
|
|
|
for (fwhole = la->fireWallBaseNum;
|
|
|
|
fwhole < la->fireWallActiveNum &&
|
|
|
|
fw_tstfield(la, la->fireWallField, fwhole);
|
|
|
|
fwhole++);
|
|
|
|
if (fwhole == la->fireWallActiveNum) {
|
|
|
|
/* No rule point empty - we can't punch more holes. */
|
|
|
|
la->fireWallActiveNum = la->fireWallBaseNum;
|
2005-05-06 11:07:49 +00:00
|
|
|
#ifdef LIBALIAS_DEBUG
|
2004-03-16 21:30:41 +00:00
|
|
|
fprintf(stderr, "libalias: Unable to create firewall hole!\n");
|
1999-03-09 23:44:00 +00:00
|
|
|
#endif
|
2004-03-16 21:30:41 +00:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
/* Start next search at next position */
|
|
|
|
la->fireWallActiveNum = fwhole + 1;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* generate two rules of the form
|
2004-07-05 10:53:28 +00:00
|
|
|
*
|
2004-03-16 21:30:41 +00:00
|
|
|
* add fwhole accept tcp from OAddr OPort to DAddr DPort add fwhole
|
|
|
|
* accept tcp from DAddr DPort to OAddr OPort
|
|
|
|
*/
|
2004-07-05 11:10:57 +00:00
|
|
|
if (GetOriginalPort(lnk) != 0 && GetDestPort(lnk) != 0) {
|
2004-03-16 21:30:41 +00:00
|
|
|
u_int32_t rulebuf[255];
|
|
|
|
int i;
|
|
|
|
|
|
|
|
i = fill_rule(rulebuf, sizeof(rulebuf), fwhole,
|
|
|
|
O_ACCEPT, IPPROTO_TCP,
|
2004-07-05 11:10:57 +00:00
|
|
|
GetOriginalAddress(lnk), ntohs(GetOriginalPort(lnk)),
|
|
|
|
GetDestAddress(lnk), ntohs(GetDestPort(lnk)));
|
2004-03-16 21:30:41 +00:00
|
|
|
r = setsockopt(la->fireWallFD, IPPROTO_IP, IP_FW_ADD, rulebuf, i);
|
|
|
|
if (r)
|
|
|
|
err(1, "alias punch inbound(1) setsockopt(IP_FW_ADD)");
|
|
|
|
|
|
|
|
i = fill_rule(rulebuf, sizeof(rulebuf), fwhole,
|
|
|
|
O_ACCEPT, IPPROTO_TCP,
|
2004-07-05 11:10:57 +00:00
|
|
|
GetDestAddress(lnk), ntohs(GetDestPort(lnk)),
|
|
|
|
GetOriginalAddress(lnk), ntohs(GetOriginalPort(lnk)));
|
2004-03-16 21:30:41 +00:00
|
|
|
r = setsockopt(la->fireWallFD, IPPROTO_IP, IP_FW_ADD, rulebuf, i);
|
|
|
|
if (r)
|
|
|
|
err(1, "alias punch inbound(2) setsockopt(IP_FW_ADD)");
|
|
|
|
}
|
|
|
|
|
1998-01-09 21:13:35 +00:00
|
|
|
/* Indicate hole applied */
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->data.tcp->fwhole = fwhole;
|
2004-03-16 21:30:41 +00:00
|
|
|
fw_setfield(la, la->fireWallField, fwhole);
|
1998-01-09 21:13:35 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Remove a hole in a firewall associated with a particular alias
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk. Calling this too often is harmless. */
|
1998-01-09 21:13:35 +00:00
|
|
|
static void
|
2004-07-05 11:10:57 +00:00
|
|
|
ClearFWHole(struct alias_link *lnk)
|
2004-01-17 10:52:21 +00:00
|
|
|
{
|
2004-03-16 21:30:41 +00:00
|
|
|
struct libalias *la;
|
2004-01-17 10:52:21 +00:00
|
|
|
|
2004-07-05 11:10:57 +00:00
|
|
|
la = lnk->la;
|
|
|
|
if (lnk->link_type == LINK_TCP) {
|
|
|
|
int fwhole = lnk->data.tcp->fwhole; /* Where is the firewall
|
2004-03-16 21:30:41 +00:00
|
|
|
* hole? */
|
|
|
|
struct ip_fw rule;
|
1998-01-09 21:13:35 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
if (fwhole < 0)
|
|
|
|
return;
|
1998-01-09 21:13:35 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
memset(&rule, 0, sizeof rule); /* useless for ipfw2 */
|
|
|
|
while (!setsockopt(la->fireWallFD, IPPROTO_IP, IP_FW_DEL,
|
|
|
|
&fwhole, sizeof fwhole));
|
|
|
|
fw_clrfield(la, la->fireWallField, fwhole);
|
2004-07-05 11:10:57 +00:00
|
|
|
lnk->data.tcp->fwhole = -1;
|
2004-03-16 21:30:41 +00:00
|
|
|
}
|
1998-01-09 21:13:35 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Clear out the entire range dedicated to firewall holes. */
|
|
|
|
static void
|
2004-03-16 21:30:41 +00:00
|
|
|
ClearAllFWHoles(struct libalias *la)
|
|
|
|
{
|
|
|
|
struct ip_fw rule; /* On-the-fly built rule */
|
|
|
|
int i;
|
2002-07-01 11:19:40 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
if (la->fireWallFD < 0)
|
|
|
|
return;
|
1998-01-09 21:13:35 +00:00
|
|
|
|
2004-03-16 21:30:41 +00:00
|
|
|
memset(&rule, 0, sizeof rule);
|
|
|
|
for (i = la->fireWallBaseNum; i < la->fireWallBaseNum + la->fireWallNumNums; i++) {
|
|
|
|
int r = i;
|
|
|
|
|
|
|
|
while (!setsockopt(la->fireWallFD, IPPROTO_IP, IP_FW_DEL, &r, sizeof r));
|
|
|
|
}
|
|
|
|
/* XXX: third arg correct here ? /phk */
|
|
|
|
memset(la->fireWallField, 0, la->fireWallNumNums);
|
1998-01-09 21:13:35 +00:00
|
|
|
}
|
2004-03-16 21:30:41 +00:00
|
|
|
|
2013-03-11 12:22:44 +00:00
|
|
|
#endif /* !NO_FW_PUNCH */
|
2001-03-25 12:05:10 +00:00
|
|
|
|
|
|
|
void
|
2004-03-16 21:30:41 +00:00
|
|
|
LibAliasSetFWBase(struct libalias *la, unsigned int base, unsigned int num)
|
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
|
|
|
LIBALIAS_LOCK(la);
|
2001-03-25 12:05:10 +00:00
|
|
|
#ifndef NO_FW_PUNCH
|
2004-03-16 21:30:41 +00:00
|
|
|
la->fireWallBaseNum = base;
|
|
|
|
la->fireWallNumNums = num;
|
2001-03-25 12:05:10 +00:00
|
|
|
#endif
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_UNLOCK(la);
|
2001-03-25 12:05:10 +00:00
|
|
|
}
|
2003-09-23 07:41:55 +00:00
|
|
|
|
|
|
|
void
|
2004-03-16 21:30:41 +00:00
|
|
|
LibAliasSetSkinnyPort(struct libalias *la, unsigned int port)
|
|
|
|
{
|
2006-12-15 12:50:06 +00:00
|
|
|
|
|
|
|
LIBALIAS_LOCK(la);
|
2004-03-16 21:30:41 +00:00
|
|
|
la->skinnyPort = port;
|
2006-12-15 12:50:06 +00:00
|
|
|
LIBALIAS_UNLOCK(la);
|
2003-09-23 07:41:55 +00:00
|
|
|
}
|
2009-02-07 18:49:42 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Find the address to redirect incoming packets
|
|
|
|
*/
|
|
|
|
struct in_addr
|
|
|
|
FindSctpRedirectAddress(struct libalias *la, struct sctp_nat_msg *sm)
|
|
|
|
{
|
|
|
|
struct alias_link *lnk;
|
|
|
|
struct in_addr redir;
|
|
|
|
|
|
|
|
LIBALIAS_LOCK_ASSERT(la);
|
|
|
|
lnk = FindLinkIn(la, sm->ip_hdr->ip_src, sm->ip_hdr->ip_dst,
|
|
|
|
sm->sctp_hdr->dest_port,sm->sctp_hdr->dest_port, LINK_SCTP, 1);
|
|
|
|
if (lnk != NULL) {
|
|
|
|
return(lnk->src_addr); /* port redirect */
|
|
|
|
} else {
|
|
|
|
redir = FindOriginalAddress(la,sm->ip_hdr->ip_dst);
|
|
|
|
if (redir.s_addr == la->aliasAddress.s_addr ||
|
|
|
|
redir.s_addr == la->targetAddress.s_addr) { /* No address found */
|
|
|
|
lnk = FindLinkIn(la, sm->ip_hdr->ip_src, sm->ip_hdr->ip_dst,
|
|
|
|
NO_DEST_PORT, 0, LINK_SCTP, 1);
|
|
|
|
if (lnk != NULL)
|
|
|
|
return(lnk->src_addr); /* redirect proto */
|
|
|
|
}
|
|
|
|
return(redir); /* address redirect */
|
|
|
|
}
|
|
|
|
}
|