2008-02-29 22:27:19 +00:00
|
|
|
/*-
|
|
|
|
* Copyright (c) 2008 Paolo Pisati
|
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <sys/cdefs.h>
|
|
|
|
__FBSDID("$FreeBSD$");
|
|
|
|
|
|
|
|
#include <sys/param.h>
|
|
|
|
#include <sys/systm.h>
|
|
|
|
#include <sys/condvar.h>
|
|
|
|
#include <sys/eventhandler.h>
|
|
|
|
#include <sys/malloc.h>
|
|
|
|
#include <sys/kernel.h>
|
|
|
|
#include <sys/lock.h>
|
|
|
|
#include <sys/module.h>
|
|
|
|
#include <sys/priv.h>
|
|
|
|
#include <sys/proc.h>
|
|
|
|
#include <sys/rwlock.h>
|
|
|
|
|
2009-12-15 16:15:14 +00:00
|
|
|
#define IPFW_INTERNAL /* Access to protected data structures in ip_fw.h. */
|
|
|
|
|
2008-02-29 22:27:19 +00:00
|
|
|
#include <netinet/libalias/alias.h>
|
|
|
|
#include <netinet/libalias/alias_local.h>
|
|
|
|
|
|
|
|
#include <net/if.h>
|
|
|
|
#include <netinet/in.h>
|
|
|
|
#include <netinet/ip.h>
|
|
|
|
#include <netinet/ip_var.h>
|
|
|
|
#include <netinet/ip_fw.h>
|
2009-12-15 16:15:14 +00:00
|
|
|
#include <netinet/ipfw/ip_fw_private.h>
|
2008-02-29 22:27:19 +00:00
|
|
|
#include <netinet/tcp.h>
|
|
|
|
#include <netinet/udp.h>
|
|
|
|
|
|
|
|
#include <machine/in_cksum.h> /* XXX for in_cksum */
|
|
|
|
|
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
2009-07-14 22:48:30 +00:00
|
|
|
static VNET_DEFINE(eventhandler_tag, ifaddr_event_tag);
|
2009-07-16 21:13:04 +00:00
|
|
|
#define V_ifaddr_event_tag VNET(ifaddr_event_tag)
|
2008-02-29 22:27:19 +00:00
|
|
|
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
static void
|
2008-02-29 22:27:19 +00:00
|
|
|
ifaddr_change(void *arg __unused, struct ifnet *ifp)
|
|
|
|
{
|
|
|
|
struct cfg_nat *ptr;
|
|
|
|
struct ifaddr *ifa;
|
2009-12-23 12:15:21 +00:00
|
|
|
struct ip_fw_chain *chain;
|
2008-02-29 22:27:19 +00:00
|
|
|
|
2009-12-23 12:15:21 +00:00
|
|
|
chain = &V_layer3_chain;
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
IPFW_WLOCK(chain);
|
2008-02-29 22:27:19 +00:00
|
|
|
/* Check every nat entry... */
|
2009-12-23 12:15:21 +00:00
|
|
|
LIST_FOREACH(ptr, &chain->nat, _next) {
|
2008-02-29 22:27:19 +00:00
|
|
|
/* ...using nic 'ifp->if_xname' as dynamic alias address. */
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
if (strncmp(ptr->if_name, ifp->if_xname, IF_NAMESIZE) != 0)
|
|
|
|
continue;
|
|
|
|
if_addr_rlock(ifp);
|
|
|
|
TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
|
|
|
|
if (ifa->ifa_addr == NULL)
|
|
|
|
continue;
|
|
|
|
if (ifa->ifa_addr->sa_family != AF_INET)
|
|
|
|
continue;
|
|
|
|
ptr->ip = ((struct sockaddr_in *)
|
|
|
|
(ifa->ifa_addr))->sin_addr;
|
|
|
|
LibAliasSetAddress(ptr->lib, ptr->ip);
|
2008-02-29 22:27:19 +00:00
|
|
|
}
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
if_addr_runlock(ifp);
|
2008-02-29 22:27:19 +00:00
|
|
|
}
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
IPFW_WUNLOCK(chain);
|
2008-02-29 22:27:19 +00:00
|
|
|
}
|
|
|
|
|
2009-12-23 12:15:21 +00:00
|
|
|
/*
|
|
|
|
* delete the pointers for nat entry ix, or all of them if ix < 0
|
|
|
|
*/
|
2008-02-29 22:27:19 +00:00
|
|
|
static void
|
2009-12-23 12:15:21 +00:00
|
|
|
flush_nat_ptrs(struct ip_fw_chain *chain, const int ix)
|
2008-02-29 22:27:19 +00:00
|
|
|
{
|
2009-12-23 12:15:21 +00:00
|
|
|
int i;
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
ipfw_insn_nat *cmd;
|
2008-02-29 22:27:19 +00:00
|
|
|
|
2009-12-23 12:15:21 +00:00
|
|
|
IPFW_WLOCK_ASSERT(chain);
|
|
|
|
for (i = 0; i < chain->n_rules; i++) {
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
cmd = (ipfw_insn_nat *)ACTION_PTR(chain->map[i]);
|
|
|
|
/* XXX skip log and the like ? */
|
2009-12-23 12:15:21 +00:00
|
|
|
if (cmd->o.opcode == O_NAT && cmd->nat != NULL &&
|
|
|
|
(ix < 0 || cmd->nat->id == ix))
|
2008-02-29 22:27:19 +00:00
|
|
|
cmd->nat = NULL;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
del_redir_spool_cfg(struct cfg_nat *n, struct redir_chain *head)
|
|
|
|
{
|
|
|
|
struct cfg_redir *r, *tmp_r;
|
|
|
|
struct cfg_spool *s, *tmp_s;
|
|
|
|
int i, num;
|
|
|
|
|
|
|
|
LIST_FOREACH_SAFE(r, head, _next, tmp_r) {
|
|
|
|
num = 1; /* Number of alias_link to delete. */
|
|
|
|
switch (r->mode) {
|
|
|
|
case REDIR_PORT:
|
|
|
|
num = r->pport_cnt;
|
|
|
|
/* FALLTHROUGH */
|
|
|
|
case REDIR_ADDR:
|
|
|
|
case REDIR_PROTO:
|
|
|
|
/* Delete all libalias redirect entry. */
|
|
|
|
for (i = 0; i < num; i++)
|
|
|
|
LibAliasRedirectDelete(n->lib, r->alink[i]);
|
|
|
|
/* Del spool cfg if any. */
|
|
|
|
LIST_FOREACH_SAFE(s, &r->spool_chain, _next, tmp_s) {
|
|
|
|
LIST_REMOVE(s, _next);
|
|
|
|
free(s, M_IPFW);
|
|
|
|
}
|
|
|
|
free(r->alink, M_IPFW);
|
|
|
|
LIST_REMOVE(r, _next);
|
|
|
|
free(r, M_IPFW);
|
|
|
|
break;
|
|
|
|
default:
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
printf("unknown redirect mode: %u\n", r->mode);
|
2008-02-29 22:27:19 +00:00
|
|
|
/* XXX - panic?!?!? */
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
break;
|
2008-02-29 22:27:19 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
add_redir_spool_cfg(char *buf, struct cfg_nat *ptr)
|
|
|
|
{
|
|
|
|
struct cfg_redir *r, *ser_r;
|
|
|
|
struct cfg_spool *s, *ser_s;
|
|
|
|
int cnt, off, i;
|
|
|
|
|
|
|
|
for (cnt = 0, off = 0; cnt < ptr->redir_cnt; cnt++) {
|
|
|
|
ser_r = (struct cfg_redir *)&buf[off];
|
|
|
|
r = malloc(SOF_REDIR, M_IPFW, M_WAITOK | M_ZERO);
|
|
|
|
memcpy(r, ser_r, SOF_REDIR);
|
|
|
|
LIST_INIT(&r->spool_chain);
|
|
|
|
off += SOF_REDIR;
|
|
|
|
r->alink = malloc(sizeof(struct alias_link *) * r->pport_cnt,
|
|
|
|
M_IPFW, M_WAITOK | M_ZERO);
|
|
|
|
switch (r->mode) {
|
|
|
|
case REDIR_ADDR:
|
|
|
|
r->alink[0] = LibAliasRedirectAddr(ptr->lib, r->laddr,
|
|
|
|
r->paddr);
|
|
|
|
break;
|
|
|
|
case REDIR_PORT:
|
|
|
|
for (i = 0 ; i < r->pport_cnt; i++) {
|
|
|
|
/* If remotePort is all ports, set it to 0. */
|
|
|
|
u_short remotePortCopy = r->rport + i;
|
|
|
|
if (r->rport_cnt == 1 && r->rport == 0)
|
|
|
|
remotePortCopy = 0;
|
|
|
|
r->alink[i] = LibAliasRedirectPort(ptr->lib,
|
|
|
|
r->laddr, htons(r->lport + i), r->raddr,
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
htons(remotePortCopy), r->paddr,
|
2008-02-29 22:27:19 +00:00
|
|
|
htons(r->pport + i), r->proto);
|
|
|
|
if (r->alink[i] == NULL) {
|
|
|
|
r->alink[0] = NULL;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
case REDIR_PROTO:
|
|
|
|
r->alink[0] = LibAliasRedirectProto(ptr->lib ,r->laddr,
|
|
|
|
r->raddr, r->paddr, r->proto);
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
printf("unknown redirect mode: %u\n", r->mode);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
/* XXX perhaps return an error instead of panic ? */
|
|
|
|
if (r->alink[0] == NULL)
|
|
|
|
panic("LibAliasRedirect* returned NULL");
|
|
|
|
/* LSNAT handling. */
|
|
|
|
for (i = 0; i < r->spool_cnt; i++) {
|
|
|
|
ser_s = (struct cfg_spool *)&buf[off];
|
|
|
|
s = malloc(SOF_REDIR, M_IPFW, M_WAITOK | M_ZERO);
|
|
|
|
memcpy(s, ser_s, SOF_SPOOL);
|
|
|
|
LibAliasAddServer(ptr->lib, r->alink[0],
|
|
|
|
s->addr, htons(s->port));
|
|
|
|
off += SOF_SPOOL;
|
|
|
|
/* Hook spool entry. */
|
|
|
|
LIST_INSERT_HEAD(&r->spool_chain, s, _next);
|
2008-02-29 22:27:19 +00:00
|
|
|
}
|
|
|
|
/* And finally hook this redir entry. */
|
2009-12-23 12:15:21 +00:00
|
|
|
LIST_INSERT_HEAD(&ptr->redir_chain, r, _next);
|
2008-02-29 22:27:19 +00:00
|
|
|
}
|
|
|
|
return (1);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
ipfw_nat(struct ip_fw_args *args, struct cfg_nat *t, struct mbuf *m)
|
|
|
|
{
|
|
|
|
struct mbuf *mcl;
|
|
|
|
struct ip *ip;
|
|
|
|
/* XXX - libalias duct tape */
|
|
|
|
int ldt, retval;
|
|
|
|
char *c;
|
|
|
|
|
|
|
|
ldt = 0;
|
|
|
|
retval = 0;
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
mcl = m_megapullup(m, m->m_pkthdr.len);
|
|
|
|
if (mcl == NULL) {
|
|
|
|
args->m = NULL;
|
|
|
|
return (IP_FW_DENY);
|
|
|
|
}
|
2008-02-29 22:27:19 +00:00
|
|
|
ip = mtod(mcl, struct ip *);
|
|
|
|
if (args->eh == NULL) {
|
|
|
|
ip->ip_len = htons(ip->ip_len);
|
|
|
|
ip->ip_off = htons(ip->ip_off);
|
|
|
|
}
|
|
|
|
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
/*
|
2008-02-29 22:27:19 +00:00
|
|
|
* XXX - Libalias checksum offload 'duct tape':
|
|
|
|
*
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
* locally generated packets have only pseudo-header checksum
|
|
|
|
* calculated and libalias will break it[1], so mark them for
|
|
|
|
* later fix. Moreover there are cases when libalias modifies
|
|
|
|
* tcp packet data[2], mark them for later fix too.
|
|
|
|
*
|
|
|
|
* [1] libalias was never meant to run in kernel, so it does
|
|
|
|
* not have any knowledge about checksum offloading, and
|
|
|
|
* expects a packet with a full internet checksum.
|
|
|
|
* Unfortunately, packets generated locally will have just the
|
|
|
|
* pseudo header calculated, and when libalias tries to adjust
|
|
|
|
* the checksum it will actually compute a wrong value.
|
2008-02-29 22:27:19 +00:00
|
|
|
*
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
* [2] when libalias modifies tcp's data content, full TCP
|
|
|
|
* checksum has to be recomputed: the problem is that
|
|
|
|
* libalias does not have any idea about checksum offloading.
|
|
|
|
* To work around this, we do not do checksumming in LibAlias,
|
|
|
|
* but only mark the packets in th_x2 field. If we receive a
|
|
|
|
* marked packet, we calculate correct checksum for it
|
|
|
|
* aware of offloading. Why such a terrible hack instead of
|
|
|
|
* recalculating checksum for each packet?
|
|
|
|
* Because the previous checksum was not checked!
|
|
|
|
* Recalculating checksums for EVERY packet will hide ALL
|
|
|
|
* transmission errors. Yes, marked packets still suffer from
|
|
|
|
* this problem. But, sigh, natd(8) has this problem, too.
|
2008-02-29 22:27:19 +00:00
|
|
|
*
|
|
|
|
* TODO: -make libalias mbuf aware (so
|
|
|
|
* it can handle delayed checksum and tso)
|
|
|
|
*/
|
|
|
|
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
if (mcl->m_pkthdr.rcvif == NULL &&
|
|
|
|
mcl->m_pkthdr.csum_flags & CSUM_DELAY_DATA)
|
2008-02-29 22:27:19 +00:00
|
|
|
ldt = 1;
|
|
|
|
|
|
|
|
c = mtod(mcl, char *);
|
|
|
|
if (args->oif == NULL)
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
retval = LibAliasIn(t->lib, c,
|
2008-06-01 12:29:23 +00:00
|
|
|
mcl->m_len + M_TRAILINGSPACE(mcl));
|
2008-02-29 22:27:19 +00:00
|
|
|
else
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
retval = LibAliasOut(t->lib, c,
|
2008-06-01 12:29:23 +00:00
|
|
|
mcl->m_len + M_TRAILINGSPACE(mcl));
|
2009-02-07 18:49:42 +00:00
|
|
|
if (retval == PKT_ALIAS_RESPOND) {
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
m->m_flags |= M_SKIP_FIREWALL;
|
|
|
|
retval = PKT_ALIAS_OK;
|
2009-02-07 18:49:42 +00:00
|
|
|
}
|
2008-06-01 12:29:23 +00:00
|
|
|
if (retval != PKT_ALIAS_OK &&
|
|
|
|
retval != PKT_ALIAS_FOUND_HEADER_FRAGMENT) {
|
2008-02-29 22:27:19 +00:00
|
|
|
/* XXX - should i add some logging? */
|
|
|
|
m_free(mcl);
|
|
|
|
args->m = NULL;
|
|
|
|
return (IP_FW_DENY);
|
|
|
|
}
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
mcl->m_pkthdr.len = mcl->m_len = ntohs(ip->ip_len);
|
2008-02-29 22:27:19 +00:00
|
|
|
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
/*
|
|
|
|
* XXX - libalias checksum offload
|
|
|
|
* 'duct tape' (see above)
|
2008-02-29 22:27:19 +00:00
|
|
|
*/
|
|
|
|
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
if ((ip->ip_off & htons(IP_OFFMASK)) == 0 &&
|
2008-02-29 22:27:19 +00:00
|
|
|
ip->ip_p == IPPROTO_TCP) {
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
struct tcphdr *th;
|
2008-02-29 22:27:19 +00:00
|
|
|
|
|
|
|
th = (struct tcphdr *)(ip + 1);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
if (th->th_x2)
|
2008-02-29 22:27:19 +00:00
|
|
|
ldt = 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (ldt) {
|
|
|
|
struct tcphdr *th;
|
|
|
|
struct udphdr *uh;
|
|
|
|
u_short cksum;
|
|
|
|
|
|
|
|
ip->ip_len = ntohs(ip->ip_len);
|
|
|
|
cksum = in_pseudo(
|
|
|
|
ip->ip_src.s_addr,
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
ip->ip_dst.s_addr,
|
2008-02-29 22:27:19 +00:00
|
|
|
htons(ip->ip_p + ip->ip_len - (ip->ip_hl << 2))
|
|
|
|
);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
|
2008-02-29 22:27:19 +00:00
|
|
|
switch (ip->ip_p) {
|
|
|
|
case IPPROTO_TCP:
|
|
|
|
th = (struct tcphdr *)(ip + 1);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
/*
|
|
|
|
* Maybe it was set in
|
|
|
|
* libalias...
|
2008-02-29 22:27:19 +00:00
|
|
|
*/
|
|
|
|
th->th_x2 = 0;
|
|
|
|
th->th_sum = cksum;
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
mcl->m_pkthdr.csum_data =
|
2008-02-29 22:27:19 +00:00
|
|
|
offsetof(struct tcphdr, th_sum);
|
|
|
|
break;
|
|
|
|
case IPPROTO_UDP:
|
|
|
|
uh = (struct udphdr *)(ip + 1);
|
|
|
|
uh->uh_sum = cksum;
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
mcl->m_pkthdr.csum_data =
|
2008-02-29 22:27:19 +00:00
|
|
|
offsetof(struct udphdr, uh_sum);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
break;
|
2008-02-29 22:27:19 +00:00
|
|
|
}
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
/* No hw checksum offloading: do it ourselves */
|
|
|
|
if ((mcl->m_pkthdr.csum_flags & CSUM_DELAY_DATA) == 0) {
|
2008-02-29 22:27:19 +00:00
|
|
|
in_delayed_cksum(mcl);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
mcl->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
|
2008-02-29 22:27:19 +00:00
|
|
|
}
|
|
|
|
ip->ip_len = htons(ip->ip_len);
|
|
|
|
}
|
|
|
|
|
|
|
|
if (args->eh == NULL) {
|
|
|
|
ip->ip_len = ntohs(ip->ip_len);
|
|
|
|
ip->ip_off = ntohs(ip->ip_off);
|
|
|
|
}
|
|
|
|
|
|
|
|
args->m = mcl;
|
|
|
|
return (IP_FW_NAT);
|
|
|
|
}
|
|
|
|
|
2009-12-15 16:15:14 +00:00
|
|
|
static struct cfg_nat *
|
|
|
|
lookup_nat(struct nat_list *l, int nat_id)
|
|
|
|
{
|
|
|
|
struct cfg_nat *res;
|
|
|
|
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
LIST_FOREACH(res, l, _next) {
|
|
|
|
if (res->id == nat_id)
|
|
|
|
break;
|
|
|
|
}
|
2009-12-15 16:15:14 +00:00
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
static int
|
2008-02-29 22:27:19 +00:00
|
|
|
ipfw_nat_cfg(struct sockopt *sopt)
|
|
|
|
{
|
|
|
|
struct cfg_nat *ptr, *ser_n;
|
|
|
|
char *buf;
|
2009-12-23 12:15:21 +00:00
|
|
|
struct ip_fw_chain *chain = &V_layer3_chain;
|
2008-02-29 22:27:19 +00:00
|
|
|
|
|
|
|
buf = malloc(NAT_BUF_LEN, M_IPFW, M_WAITOK | M_ZERO);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
sooptcopyin(sopt, buf, NAT_BUF_LEN, sizeof(struct cfg_nat));
|
2008-02-29 22:27:19 +00:00
|
|
|
ser_n = (struct cfg_nat *)buf;
|
|
|
|
|
2009-12-23 12:15:21 +00:00
|
|
|
/* check valid parameter ser_n->id > 0 ? */
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
/*
|
2008-02-29 22:27:19 +00:00
|
|
|
* Find/create nat rule.
|
|
|
|
*/
|
2009-12-23 12:15:21 +00:00
|
|
|
IPFW_WLOCK(chain);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
ptr = lookup_nat(&chain->nat, ser_n->id);
|
2008-02-29 22:27:19 +00:00
|
|
|
if (ptr == NULL) {
|
|
|
|
/* New rule: allocate and init new instance. */
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
ptr = malloc(sizeof(struct cfg_nat),
|
2008-02-29 22:27:19 +00:00
|
|
|
M_IPFW, M_NOWAIT | M_ZERO);
|
|
|
|
if (ptr == NULL) {
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
IPFW_WUNLOCK(chain);
|
2008-02-29 22:27:19 +00:00
|
|
|
free(buf, M_IPFW);
|
|
|
|
return (ENOSPC);
|
|
|
|
}
|
|
|
|
ptr->lib = LibAliasInit(NULL);
|
|
|
|
if (ptr->lib == NULL) {
|
2009-12-23 12:15:21 +00:00
|
|
|
IPFW_WUNLOCK(chain);
|
2008-02-29 22:27:19 +00:00
|
|
|
free(ptr, M_IPFW);
|
|
|
|
free(buf, M_IPFW);
|
|
|
|
return (EINVAL);
|
|
|
|
}
|
|
|
|
LIST_INIT(&ptr->redir_chain);
|
|
|
|
} else {
|
|
|
|
/* Entry already present: temporarly unhook it. */
|
2009-12-23 12:15:21 +00:00
|
|
|
LIST_REMOVE(ptr, _next);
|
|
|
|
flush_nat_ptrs(chain, ser_n->id);
|
2008-02-29 22:27:19 +00:00
|
|
|
}
|
2009-12-23 12:15:21 +00:00
|
|
|
IPFW_WUNLOCK(chain);
|
2008-02-29 22:27:19 +00:00
|
|
|
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
/*
|
2008-02-29 22:27:19 +00:00
|
|
|
* Basic nat configuration.
|
|
|
|
*/
|
|
|
|
ptr->id = ser_n->id;
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
/*
|
|
|
|
* XXX - what if this rule doesn't nat any ip and just
|
|
|
|
* redirect?
|
2008-02-29 22:27:19 +00:00
|
|
|
* do we set aliasaddress to 0.0.0.0?
|
|
|
|
*/
|
|
|
|
ptr->ip = ser_n->ip;
|
|
|
|
ptr->redir_cnt = ser_n->redir_cnt;
|
|
|
|
ptr->mode = ser_n->mode;
|
|
|
|
LibAliasSetMode(ptr->lib, ser_n->mode, ser_n->mode);
|
|
|
|
LibAliasSetAddress(ptr->lib, ptr->ip);
|
|
|
|
memcpy(ptr->if_name, ser_n->if_name, IF_NAMESIZE);
|
|
|
|
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
/*
|
2008-02-29 22:27:19 +00:00
|
|
|
* Redir and LSNAT configuration.
|
|
|
|
*/
|
|
|
|
/* Delete old cfgs. */
|
|
|
|
del_redir_spool_cfg(ptr, &ptr->redir_chain);
|
|
|
|
/* Add new entries. */
|
|
|
|
add_redir_spool_cfg(&buf[(sizeof(struct cfg_nat))], ptr);
|
|
|
|
free(buf, M_IPFW);
|
2009-12-23 12:15:21 +00:00
|
|
|
IPFW_WLOCK(chain);
|
|
|
|
LIST_INSERT_HEAD(&chain->nat, ptr, _next);
|
|
|
|
IPFW_WUNLOCK(chain);
|
2008-02-29 22:27:19 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
ipfw_nat_del(struct sockopt *sopt)
|
|
|
|
{
|
|
|
|
struct cfg_nat *ptr;
|
2009-12-23 12:15:21 +00:00
|
|
|
struct ip_fw_chain *chain = &V_layer3_chain;
|
2008-02-29 22:27:19 +00:00
|
|
|
int i;
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
|
2008-02-29 22:27:19 +00:00
|
|
|
sooptcopyin(sopt, &i, sizeof i, sizeof i);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
/* XXX validate i */
|
2009-12-23 12:15:21 +00:00
|
|
|
IPFW_WLOCK(chain);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
ptr = lookup_nat(&chain->nat, i);
|
2008-02-29 22:27:19 +00:00
|
|
|
if (ptr == NULL) {
|
2009-12-23 12:15:21 +00:00
|
|
|
IPFW_WUNLOCK(chain);
|
2008-02-29 22:27:19 +00:00
|
|
|
return (EINVAL);
|
|
|
|
}
|
2009-12-23 12:15:21 +00:00
|
|
|
LIST_REMOVE(ptr, _next);
|
|
|
|
flush_nat_ptrs(chain, i);
|
|
|
|
IPFW_WUNLOCK(chain);
|
2008-02-29 22:27:19 +00:00
|
|
|
del_redir_spool_cfg(ptr, &ptr->redir_chain);
|
|
|
|
LibAliasUninit(ptr->lib);
|
|
|
|
free(ptr, M_IPFW);
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
ipfw_nat_get_cfg(struct sockopt *sopt)
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
{
|
2008-02-29 22:27:19 +00:00
|
|
|
uint8_t *data;
|
|
|
|
struct cfg_nat *n;
|
|
|
|
struct cfg_redir *r;
|
|
|
|
struct cfg_spool *s;
|
|
|
|
int nat_cnt, off;
|
2009-12-23 12:15:21 +00:00
|
|
|
struct ip_fw_chain *chain;
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
int err = ENOSPC;
|
2009-12-23 12:15:21 +00:00
|
|
|
|
|
|
|
chain = &V_layer3_chain;
|
2008-02-29 22:27:19 +00:00
|
|
|
nat_cnt = 0;
|
|
|
|
off = sizeof(nat_cnt);
|
|
|
|
|
|
|
|
data = malloc(NAT_BUF_LEN, M_IPFW, M_WAITOK | M_ZERO);
|
2009-12-23 12:15:21 +00:00
|
|
|
IPFW_RLOCK(chain);
|
2008-02-29 22:27:19 +00:00
|
|
|
/* Serialize all the data. */
|
2009-12-23 12:15:21 +00:00
|
|
|
LIST_FOREACH(n, &chain->nat, _next) {
|
2008-02-29 22:27:19 +00:00
|
|
|
nat_cnt++;
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
if (off + SOF_NAT >= NAT_BUF_LEN)
|
|
|
|
goto nospace;
|
|
|
|
bcopy(n, &data[off], SOF_NAT);
|
|
|
|
off += SOF_NAT;
|
|
|
|
LIST_FOREACH(r, &n->redir_chain, _next) {
|
|
|
|
if (off + SOF_REDIR >= NAT_BUF_LEN)
|
|
|
|
goto nospace;
|
|
|
|
bcopy(r, &data[off], SOF_REDIR);
|
|
|
|
off += SOF_REDIR;
|
|
|
|
LIST_FOREACH(s, &r->spool_chain, _next) {
|
|
|
|
if (off + SOF_SPOOL >= NAT_BUF_LEN)
|
2008-02-29 22:27:19 +00:00
|
|
|
goto nospace;
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
bcopy(s, &data[off], SOF_SPOOL);
|
|
|
|
off += SOF_SPOOL;
|
2008-02-29 22:27:19 +00:00
|
|
|
}
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
}
|
2008-02-29 22:27:19 +00:00
|
|
|
}
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
err = 0; /* all good */
|
2008-02-29 22:27:19 +00:00
|
|
|
nospace:
|
2009-12-23 12:15:21 +00:00
|
|
|
IPFW_RUNLOCK(chain);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
if (err == 0) {
|
|
|
|
bcopy(&nat_cnt, data, sizeof(nat_cnt));
|
|
|
|
sooptcopyout(sopt, data, NAT_BUF_LEN);
|
|
|
|
} else {
|
|
|
|
printf("serialized data buffer not big enough:"
|
|
|
|
"please increase NAT_BUF_LEN\n");
|
|
|
|
}
|
2008-02-29 22:27:19 +00:00
|
|
|
free(data, M_IPFW);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
return (err);
|
2008-02-29 22:27:19 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
ipfw_nat_get_log(struct sockopt *sopt)
|
|
|
|
{
|
|
|
|
uint8_t *data;
|
|
|
|
struct cfg_nat *ptr;
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
int i, size;
|
2009-12-23 12:15:21 +00:00
|
|
|
struct ip_fw_chain *chain;
|
2008-02-29 22:27:19 +00:00
|
|
|
|
2009-12-23 12:15:21 +00:00
|
|
|
chain = &V_layer3_chain;
|
2008-02-29 22:27:19 +00:00
|
|
|
|
2009-12-23 12:15:21 +00:00
|
|
|
IPFW_RLOCK(chain);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
/* one pass to count, one to copy the data */
|
|
|
|
i = 0;
|
2009-12-23 12:15:21 +00:00
|
|
|
LIST_FOREACH(ptr, &chain->nat, _next) {
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
if (ptr->lib->logDesc == NULL)
|
|
|
|
continue;
|
|
|
|
i++;
|
|
|
|
}
|
|
|
|
size = i * (LIBALIAS_BUF_SIZE + sizeof(int));
|
|
|
|
data = malloc(size, M_IPFW, M_NOWAIT | M_ZERO);
|
|
|
|
if (data == NULL) {
|
|
|
|
IPFW_RUNLOCK(chain);
|
|
|
|
return (ENOSPC);
|
|
|
|
}
|
|
|
|
i = 0;
|
|
|
|
LIST_FOREACH(ptr, &chain->nat, _next) {
|
|
|
|
if (ptr->lib->logDesc == NULL)
|
2008-02-29 22:27:19 +00:00
|
|
|
continue;
|
|
|
|
bcopy(&ptr->id, &data[i], sizeof(int));
|
|
|
|
i += sizeof(int);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
bcopy(ptr->lib->logDesc, &data[i], LIBALIAS_BUF_SIZE);
|
|
|
|
i += LIBALIAS_BUF_SIZE;
|
2008-02-29 22:27:19 +00:00
|
|
|
}
|
2009-12-23 12:15:21 +00:00
|
|
|
IPFW_RUNLOCK(chain);
|
2008-02-29 22:27:19 +00:00
|
|
|
sooptcopyout(sopt, data, size);
|
|
|
|
free(data, M_IPFW);
|
|
|
|
return(0);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
ipfw_nat_init(void)
|
|
|
|
{
|
|
|
|
|
Commit step 1 of the vimage project, (network stack)
virtualization work done by Marko Zec (zec@).
This is the first in a series of commits over the course
of the next few weeks.
Mark all uses of global variables to be virtualized
with a V_ prefix.
Use macros to map them back to their global names for
now, so this is a NOP change only.
We hope to have caught at least 85-90% of what is needed
so we do not invalidate a lot of outstanding patches again.
Obtained from: //depot/projects/vimage-commit2/...
Reviewed by: brooks, des, ed, mav, julian,
jamie, kris, rwatson, zec, ...
(various people I forgot, different versions)
md5 (with a bit of help)
Sponsored by: NLnet Foundation, The FreeBSD Foundation
X-MFC after: never
V_Commit_Message_Reviewed_By: more people than the patch
2008-08-17 23:27:27 +00:00
|
|
|
IPFW_WLOCK(&V_layer3_chain);
|
2008-02-29 22:27:19 +00:00
|
|
|
/* init ipfw hooks */
|
|
|
|
ipfw_nat_ptr = ipfw_nat;
|
2009-12-15 16:15:14 +00:00
|
|
|
lookup_nat_ptr = lookup_nat;
|
2008-02-29 22:27:19 +00:00
|
|
|
ipfw_nat_cfg_ptr = ipfw_nat_cfg;
|
|
|
|
ipfw_nat_del_ptr = ipfw_nat_del;
|
|
|
|
ipfw_nat_get_cfg_ptr = ipfw_nat_get_cfg;
|
|
|
|
ipfw_nat_get_log_ptr = ipfw_nat_get_log;
|
Commit step 1 of the vimage project, (network stack)
virtualization work done by Marko Zec (zec@).
This is the first in a series of commits over the course
of the next few weeks.
Mark all uses of global variables to be virtualized
with a V_ prefix.
Use macros to map them back to their global names for
now, so this is a NOP change only.
We hope to have caught at least 85-90% of what is needed
so we do not invalidate a lot of outstanding patches again.
Obtained from: //depot/projects/vimage-commit2/...
Reviewed by: brooks, des, ed, mav, julian,
jamie, kris, rwatson, zec, ...
(various people I forgot, different versions)
md5 (with a bit of help)
Sponsored by: NLnet Foundation, The FreeBSD Foundation
X-MFC after: never
V_Commit_Message_Reviewed_By: more people than the patch
2008-08-17 23:27:27 +00:00
|
|
|
IPFW_WUNLOCK(&V_layer3_chain);
|
mostly style changes, such as removal of trailing whitespace,
reformatting to avoid unnecessary line breaks, small block
restructuring to avoid unnecessary nesting, replace macros
with function calls, etc.
As a side effect of code restructuring, this commit fixes one bug:
previously, if a realloc() failed, memory was leaked. Now, the
realloc is not there anymore, as we first count how much memory
we need and then do a single malloc.
2009-12-23 18:53:11 +00:00
|
|
|
V_ifaddr_event_tag = EVENTHANDLER_REGISTER(
|
|
|
|
ifaddr_event, ifaddr_change,
|
2008-02-29 22:27:19 +00:00
|
|
|
NULL, EVENTHANDLER_PRI_ANY);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
|
|
|
ipfw_nat_destroy(void)
|
|
|
|
{
|
|
|
|
struct cfg_nat *ptr, *ptr_temp;
|
2009-12-23 12:15:21 +00:00
|
|
|
struct ip_fw_chain *chain;
|
|
|
|
|
|
|
|
chain = &V_layer3_chain;
|
|
|
|
IPFW_WLOCK(chain);
|
|
|
|
LIST_FOREACH_SAFE(ptr, &chain->nat, _next, ptr_temp) {
|
2008-02-29 22:27:19 +00:00
|
|
|
LIST_REMOVE(ptr, _next);
|
|
|
|
del_redir_spool_cfg(ptr, &ptr->redir_chain);
|
|
|
|
LibAliasUninit(ptr->lib);
|
|
|
|
free(ptr, M_IPFW);
|
|
|
|
}
|
Commit step 1 of the vimage project, (network stack)
virtualization work done by Marko Zec (zec@).
This is the first in a series of commits over the course
of the next few weeks.
Mark all uses of global variables to be virtualized
with a V_ prefix.
Use macros to map them back to their global names for
now, so this is a NOP change only.
We hope to have caught at least 85-90% of what is needed
so we do not invalidate a lot of outstanding patches again.
Obtained from: //depot/projects/vimage-commit2/...
Reviewed by: brooks, des, ed, mav, julian,
jamie, kris, rwatson, zec, ...
(various people I forgot, different versions)
md5 (with a bit of help)
Sponsored by: NLnet Foundation, The FreeBSD Foundation
X-MFC after: never
V_Commit_Message_Reviewed_By: more people than the patch
2008-08-17 23:27:27 +00:00
|
|
|
EVENTHANDLER_DEREGISTER(ifaddr_event, V_ifaddr_event_tag);
|
2009-12-23 12:15:21 +00:00
|
|
|
flush_nat_ptrs(chain, -1 /* flush all */);
|
2008-02-29 22:27:19 +00:00
|
|
|
/* deregister ipfw_nat */
|
|
|
|
ipfw_nat_ptr = NULL;
|
2009-12-15 16:15:14 +00:00
|
|
|
lookup_nat_ptr = NULL;
|
|
|
|
ipfw_nat_cfg_ptr = NULL;
|
|
|
|
ipfw_nat_del_ptr = NULL;
|
|
|
|
ipfw_nat_get_cfg_ptr = NULL;
|
|
|
|
ipfw_nat_get_log_ptr = NULL;
|
2009-12-23 12:15:21 +00:00
|
|
|
IPFW_WUNLOCK(chain);
|
2008-02-29 22:27:19 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
ipfw_nat_modevent(module_t mod, int type, void *unused)
|
|
|
|
{
|
|
|
|
int err = 0;
|
|
|
|
|
|
|
|
switch (type) {
|
|
|
|
case MOD_LOAD:
|
|
|
|
ipfw_nat_init();
|
|
|
|
break;
|
|
|
|
|
|
|
|
case MOD_UNLOAD:
|
|
|
|
ipfw_nat_destroy();
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
return EOPNOTSUPP;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static moduledata_t ipfw_nat_mod = {
|
|
|
|
"ipfw_nat",
|
|
|
|
ipfw_nat_modevent,
|
|
|
|
0
|
|
|
|
};
|
|
|
|
|
|
|
|
DECLARE_MODULE(ipfw_nat, ipfw_nat_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
|
|
|
|
MODULE_DEPEND(ipfw_nat, libalias, 1, 1, 1);
|
|
|
|
MODULE_DEPEND(ipfw_nat, ipfw, 2, 2, 2);
|
|
|
|
MODULE_VERSION(ipfw_nat, 1);
|
2009-12-16 10:48:40 +00:00
|
|
|
/* end of file */
|