sys/net/ipfw3_nat/ip_fw3_nat.c

   1 /*
   2  * Copyright (c) 2014 - 2016 The DragonFly Project.  All rights reserved.
   3  *
   4  * This code is derived from software contributed to The DragonFly Project
   5  * by Bill Yuan <bycn82@dragonflybsd.org>
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in
  15  *    the documentation and/or other materials provided with the
  16  *    distribution.
  17  * 3. Neither the name of The DragonFly Project nor the names of its
  18  *    contributors may be used to endorse or promote products derived
  19  *    from this software without specific, prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
  25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
  27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
  29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
  30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
  31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  */
  34
  35 #include <sys/param.h>
  36 #include <sys/kernel.h>
  37 #include <sys/malloc.h>
  38 #include <sys/mbuf.h>
  39 #include <sys/socketvar.h>
  40 #include <sys/sysctl.h>
  41 #include <sys/systimer.h>
  42 #include <sys/thread2.h>
  43 #include <sys/in_cksum.h>
  44 #include <sys/systm.h>
  45 #include <sys/proc.h>
  46 #include <sys/socket.h>
  47 #include <sys/syslog.h>
  48 #include <sys/ucred.h>
  49 #include <sys/lock.h>
  50 #include <sys/mplock2.h>
  51
  52 #include <net/ethernet.h>
  53 #include <net/netmsg2.h>
  54 #include <net/netisr2.h>
  55 #include <net/route.h>
  56 #include <net/if.h>
  57
  58 #include <netinet/in.h>
  59 #include <netinet/ip.h>
  60 #include <netinet/ip_icmp.h>
  61 #include <netinet/tcp.h>
  62 #include <netinet/tcp_timer.h>
  63 #include <netinet/tcp_var.h>
  64 #include <netinet/tcpip.h>
  65 #include <netinet/udp.h>
  66 #include <netinet/udp_var.h>
  67 #include <netinet/in_systm.h>
  68 #include <netinet/in_var.h>
  69 #include <netinet/in_pcb.h>
  70 #include <netinet/ip_var.h>
  71 #include <netinet/ip_divert.h>
  72
  73 #include <net/libalias/alias.h>
  74 #include <net/libalias/alias_local.h>
  75
  76 #include <net/ipfw3/ip_fw.h>
  77
  78 #include "ip_fw3_nat.h"
  79
  80
  81 struct ipfw_nat_context *ipfw_nat_ctx[MAXCPU];
  82 extern struct ipfw_context *ipfw_ctx[MAXCPU];
  83 extern ip_fw_ctl_t *ipfw_ctl_nat_ptr;
  84
  85 void check_nat(int *cmd_ctl, int *cmd_val, struct ip_fw_args **args,
  86                 struct ip_fw **f, ipfw_insn *cmd, uint16_t ip_len);
  87 void add_alias_link_dispatch(netmsg_t nat_del_msg);
  88 int ipfw_nat(struct ip_fw_args *args, struct cfg_nat *t, struct mbuf *m);
  89 void nat_add_dispatch(netmsg_t msg);
  90 int ipfw_ctl_nat_add(struct sockopt *sopt);
  91 void nat_del_dispatch(netmsg_t msg);
  92 int ipfw_ctl_nat_del(struct sockopt *sopt);
  93 int ipfw_ctl_nat_flush(struct sockopt *sopt);
  94 int ipfw_ctl_nat_sockopt(struct sockopt *sopt);
  95 void nat_init_ctx_dispatch(netmsg_t msg);
  96 int ipfw_ctl_nat_get_cfg(struct sockopt *sopt);
  97 void del_redir_spool_cfg(struct cfg_nat *n, struct redir_chain *head);
  98 int add_redir_spool_cfg(char *buf, struct cfg_nat *ptr);
  99 int ipfw_ctl_nat_get_record(struct sockopt *sopt);
 100
 101
 102 void
 103 check_nat(int *cmd_ctl, int *cmd_val, struct ip_fw_args **args,
 104                 struct ip_fw **f, ipfw_insn *cmd, uint16_t ip_len)
 105 {
 106         if ((*args)->eh != NULL) {
 107                 *cmd_ctl = IP_FW_CTL_NO;
 108                 *cmd_val = IP_FW_NOT_MATCH;
 109                 return;
 110         }
 111
 112         struct ipfw_nat_context *nat_ctx;
 113         struct cfg_nat *t;
 114         int nat_id;
 115
 116         nat_ctx = ipfw_nat_ctx[mycpuid];
 117         (*args)->rule = *f;
 118         t = ((ipfw_insn_nat *)cmd)->nat;
 119         if (t == NULL) {
 120                 nat_id = cmd->arg1;
 121                 LOOKUP_NAT((*nat_ctx), nat_id, t);
 122                 if (t == NULL) {
 123                         *cmd_val = IP_FW_DENY;
 124                         *cmd_ctl = IP_FW_CTL_DONE;
 125                         return;
 126                 }
 127                 ((ipfw_insn_nat *)cmd)->nat = t;
 128         }
 129         *cmd_val = ipfw_nat(*args, t, (*args)->m);
 130         *cmd_ctl = IP_FW_CTL_NAT;
 131 }
 132
 133 /* Local prototypes */
 134 u_int StartPointIn(struct in_addr, u_short, int);
 135
 136 u_int StartPointOut(struct in_addr, struct in_addr,
 137                 u_short, u_short, int);
 138
 139 u_int
 140 StartPointIn(struct in_addr alias_addr,
 141         u_short alias_port,
 142         int link_type)
 143 {
 144         u_int n;
 145
 146         n = alias_addr.s_addr;
 147         if (link_type != LINK_PPTP)
 148                 n += alias_port;
 149         n += link_type;
 150         return (n % LINK_TABLE_IN_SIZE);
 151 }
 152
 153
 154 u_int
 155 StartPointOut(struct in_addr src_addr, struct in_addr dst_addr,
 156         u_short src_port, u_short dst_port, int link_type)
 157 {
 158         u_int n;
 159
 160         n = src_addr.s_addr;
 161         n += dst_addr.s_addr;
 162         if (link_type != LINK_PPTP) {
 163                 n += src_port;
 164                 n += dst_port;
 165         }
 166         n += link_type;
 167
 168         return (n % LINK_TABLE_OUT_SIZE);
 169 }
 170
 171
 172 void
 173 add_alias_link_dispatch(netmsg_t alias_link_add)
 174 {
 175         struct ipfw_nat_context *nat_ctx;
 176         struct netmsg_alias_link_add *msg;
 177         struct libalias *la;
 178         struct alias_link *lnk;
 179         struct cfg_nat *t;
 180         struct tcp_dat *aux_tcp;
 181         u_int start_point;
 182
 183         msg = (struct netmsg_alias_link_add *)alias_link_add;
 184         nat_ctx = ipfw_nat_ctx[mycpuid];
 185         LOOKUP_NAT((*nat_ctx), msg->id, t);
 186         la = t->lib;
 187         lnk = kmalloc(sizeof(struct alias_link), M_ALIAS, M_WAITOK | M_ZERO);
 188         memcpy(lnk, msg->lnk, sizeof(struct alias_link));
 189         lnk->la = la;
 190         if (msg->is_tcp) {
 191                 aux_tcp = kmalloc(sizeof(struct tcp_dat),
 192                                 M_ALIAS, M_WAITOK | M_ZERO);
 193                 memcpy(aux_tcp, msg->lnk->data.tcp, sizeof(struct tcp_dat));
 194                 lnk->data.tcp = aux_tcp;
 195         }
 196
 197         /* Set up pointers for output lookup table */
 198         start_point = StartPointOut(lnk->src_addr, lnk->dst_addr,
 199                         lnk->src_port, lnk->dst_port, lnk->link_type);
 200         LIST_INSERT_HEAD(&la->linkTableOut[start_point], lnk, list_out);
 201
 202         /* Set up pointers for input lookup table */
 203         start_point = StartPointIn(lnk->alias_addr,
 204                         lnk->alias_port, lnk->link_type);
 205         LIST_INSERT_HEAD(&la->linkTableIn[start_point], lnk, list_in);
 206         kfree(alias_link_add, M_LWKTMSG);
 207 }
 208
 209 int
 210 ipfw_nat(struct ip_fw_args *args, struct cfg_nat *t, struct mbuf *m)
 211 {
 212         struct alias_link *new = NULL;
 213         struct mbuf *mcl;
 214         struct ip *ip;
 215         int ldt, retval, nextcpu;
 216         char *c;
 217
 218         ldt = 0;
 219         retval = 0;
 220         if ((mcl = m_megapullup(m, m->m_pkthdr.len)) ==NULL)
 221                 goto badnat;
 222
 223         ip = mtod(mcl, struct ip *);
 224         if (args->eh == NULL) {
 225                 ip->ip_len = htons(ip->ip_len);
 226                 ip->ip_off = htons(ip->ip_off);
 227         }
 228
 229         if (mcl->m_pkthdr.rcvif == NULL &&
 230                         mcl->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
 231                 ldt = 1;
 232         }
 233
 234         c = mtod(mcl, char *);
 235         if (args->oif == NULL) {
 236                 retval = LibAliasIn(t->lib, c,
 237                                 mcl->m_len + M_TRAILINGSPACE(mcl), &new);
 238         } else {
 239                 retval = LibAliasOut(t->lib, c,
 240                                 mcl->m_len + M_TRAILINGSPACE(mcl), &new);
 241         }
 242         if (retval != PKT_ALIAS_OK &&
 243                         retval != PKT_ALIAS_FOUND_HEADER_FRAGMENT) {
 244                 /* XXX - should i add some logging? */
 245                 m_free(mcl);
 246 badnat:
 247                 args->m = NULL;
 248                 return IP_FW_DENY;
 249         }
 250         mcl->m_pkthdr.len = mcl->m_len = ntohs(ip->ip_len);
 251
 252         if ((ip->ip_off & htons(IP_OFFMASK)) == 0 &&
 253                         ip->ip_p == IPPROTO_TCP) {
 254                 struct tcphdr   *th;
 255
 256                 th = (struct tcphdr *)(ip + 1);
 257                 if (th->th_x2){
 258                         ldt = 1;
 259                 }
 260         }
 261         if (new != NULL &&
 262                         (ip->ip_p == IPPROTO_TCP || ip->ip_p == IPPROTO_UDP)) {
 263                 ip_hashfn(&mcl, 0);
 264                 nextcpu = netisr_hashcpu(m->m_pkthdr.hash);
 265                 if (nextcpu != mycpuid) {
 266                         struct netmsg_alias_link_add *msg;
 267                         msg = kmalloc(sizeof(struct netmsg_alias_link_add),
 268                                         M_LWKTMSG, M_NOWAIT | M_ZERO);
 269
 270                         netmsg_init(&msg->base, NULL,
 271                                         &curthread->td_msgport, 0,
 272                                         add_alias_link_dispatch);
 273                         msg->lnk = new;
 274                         msg->id = t->id;
 275                         if (ip->ip_p == IPPROTO_TCP) {
 276                                 msg->is_tcp = 1;
 277                         }
 278                         if (args->oif == NULL) {
 279                                 msg->is_outgoing = 0;
 280                         } else {
 281                                 msg->is_outgoing = 1;
 282                         }
 283                         netisr_sendmsg(&msg->base, nextcpu);
 284                 }
 285         }
 286         if (ldt) {
 287                 struct tcphdr   *th;
 288                 struct udphdr   *uh;
 289                 u_short cksum;
 290
 291                 ip->ip_len = ntohs(ip->ip_len);
 292                 cksum = in_pseudo(
 293                                 ip->ip_src.s_addr,
 294                                 ip->ip_dst.s_addr,
 295                                 htons(ip->ip_p + ip->ip_len - (ip->ip_hl << 2))
 296                                 );
 297
 298                 switch (ip->ip_p) {
 299                         case IPPROTO_TCP:
 300                                 th = (struct tcphdr *)(ip + 1);
 301                                 th->th_x2 = 0;
 302                                 th->th_sum = cksum;
 303                                 mcl->m_pkthdr.csum_data =
 304                                         offsetof(struct tcphdr, th_sum);
 305                                 break;
 306                         case IPPROTO_UDP:
 307                                 uh = (struct udphdr *)(ip + 1);
 308                                 uh->uh_sum = cksum;
 309                                 mcl->m_pkthdr.csum_data =
 310                                         offsetof(struct udphdr, uh_sum);
 311                                 break;
 312                 }
 313                 /*
 314                  * No hw checksum offloading: do it
 315                  * by ourself.
 316                  */
 317                 if ((mcl->m_pkthdr.csum_flags & CSUM_DELAY_DATA) == 0) {
 318                         in_delayed_cksum(mcl);
 319                         mcl->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
 320                 }
 321                 ip->ip_len = htons(ip->ip_len);
 322         }
 323
 324         if (args->eh == NULL) {
 325                 ip->ip_len = ntohs(ip->ip_len);
 326                 ip->ip_off = ntohs(ip->ip_off);
 327         }
 328
 329         args->m = mcl;
 330         return IP_FW_NAT;
 331 }
 332
 333 void
 334 del_redir_spool_cfg(struct cfg_nat *n, struct redir_chain *head)
 335 {
 336         struct cfg_redir *r, *tmp_r;
 337         struct cfg_spool *s, *tmp_s;
 338         int i, num;
 339
 340         LIST_FOREACH_MUTABLE(r, head, _next, tmp_r) {
 341                 num = 1; /* Number of alias_link to delete. */
 342                 switch (r->mode) {
 343                         case REDIR_PORT:
 344                                 num = r->pport_cnt;
 345                                 /* FALLTHROUGH */
 346                         case REDIR_ADDR:
 347                         case REDIR_PROTO:
 348                                 /* Delete all libalias redirect entry. */
 349                                 for (i = 0; i < num; i++)
 350                                         LibAliasRedirectDelete(n->lib,
 351                                                         r->alink[i]);
 352
 353                                 /* Del spool cfg if any. */
 354                                 LIST_FOREACH_MUTABLE(s, &r->spool_chain,
 355                                                 _next, tmp_s) {
 356                                         LIST_REMOVE(s, _next);
 357                                         kfree(s, M_IPFW_NAT);
 358                                 }
 359                                 kfree(r->alink, M_IPFW_NAT);
 360                                 LIST_REMOVE(r, _next);
 361                                 kfree(r, M_IPFW_NAT);
 362                                 break;
 363                         default:
 364                                 kprintf("unknown redirect mode: %u\n", r->mode);
 365                                 /* XXX - panic?!?!? */
 366                                 break;
 367                 }
 368         }
 369 }
 370
 371 int
 372 add_redir_spool_cfg(char *buf, struct cfg_nat *ptr)
 373 {
 374         struct cfg_redir *r, *ser_r;
 375         struct cfg_spool *s, *ser_s;
 376         int cnt, off, i;
 377         char *panic_err;
 378
 379         for (cnt = 0, off = 0; cnt < ptr->redir_cnt; cnt++) {
 380                 ser_r = (struct cfg_redir *)&buf[off];
 381                 r = kmalloc(SOF_REDIR, M_IPFW_NAT, M_WAITOK | M_ZERO);
 382                 memcpy(r, ser_r, SOF_REDIR);
 383                 LIST_INIT(&r->spool_chain);
 384                 off += SOF_REDIR;
 385                 r->alink = kmalloc(sizeof(struct alias_link *) * r->pport_cnt,
 386                                 M_IPFW_NAT, M_WAITOK | M_ZERO);
 387                 switch (r->mode) {
 388                         case REDIR_ADDR:
 389                                 r->alink[0] = LibAliasRedirectAddr(ptr->lib,
 390                                                         r->laddr, r->paddr);
 391                                 break;
 392                         case REDIR_PORT:
 393                                 for (i = 0 ; i < r->pport_cnt; i++) {
 394                                         /*
 395                                          * If remotePort is all ports
 396                                          * set it to 0.
 397                                          */
 398                                         u_short remotePortCopy = r->rport + i;
 399                                         if (r->rport_cnt == 1 && r->rport == 0)
 400                                                 remotePortCopy = 0;
 401                                                 r->alink[i] =
 402
 403                                                 LibAliasRedirectPort(ptr->lib,
 404                                                 r->laddr,htons(r->lport + i),
 405                                                 r->raddr,htons(remotePortCopy),
 406                                                 r->paddr,htons(r->pport + i),
 407                                                 r->proto);
 408
 409                                         if (r->alink[i] == NULL) {
 410                                                 r->alink[0] = NULL;
 411                                                 break;
 412                                         }
 413                                 }
 414                                 break;
 415                         case REDIR_PROTO:
 416                                 r->alink[0] = LibAliasRedirectProto(ptr->lib,
 417                                         r->laddr, r->raddr, r->paddr, r->proto);
 418                                 break;
 419                         default:
 420                                 kprintf("unknown redirect mode: %u\n", r->mode);
 421                                 break;
 422                 }
 423                 if (r->alink[0] == NULL) {
 424                         panic_err = "LibAliasRedirect* returned NULL";
 425                         goto bad;
 426                 } else /* LSNAT handling. */
 427                         for (i = 0; i < r->spool_cnt; i++) {
 428                                 ser_s = (struct cfg_spool *)&buf[off];
 429                                 s = kmalloc(SOF_REDIR, M_IPFW_NAT,
 430                                                 M_WAITOK | M_ZERO);
 431                                 memcpy(s, ser_s, SOF_SPOOL);
 432                                 LibAliasAddServer(ptr->lib, r->alink[0],
 433                                                 s->addr, htons(s->port));
 434                                 off += SOF_SPOOL;
 435                                 /* Hook spool entry. */
 436                                 HOOK_SPOOL(&r->spool_chain, s);
 437                         }
 438                 /* And finally hook this redir entry. */
 439                 HOOK_REDIR(&ptr->redir_chain, r);
 440         }
 441         return 1;
 442 bad:
 443         /* something really bad happened: panic! */
 444         panic("%s\n", panic_err);
 445 }
 446
 447 int
 448 ipfw_ctl_nat_get_cfg(struct sockopt *sopt)
 449 {
 450         struct ipfw_nat_context *nat_ctx;
 451         struct cfg_nat *n;
 452         struct cfg_redir *r;
 453         struct cfg_spool *s;
 454         int nat_cnt, off, nat_cfg_size;
 455         size_t size;
 456         uint8_t *data;
 457
 458         nat_cnt = 0;
 459         nat_cfg_size = 0;
 460         off = sizeof(nat_cnt);
 461
 462         nat_ctx = ipfw_nat_ctx[mycpuid];
 463         size = sopt->sopt_valsize;
 464
 465         data = sopt->sopt_val;
 466         /* count the size of nat cfg */
 467         LIST_FOREACH(n, &((*nat_ctx).nat), _next) {
 468                 nat_cfg_size += SOF_NAT;
 469         }
 470
 471         LIST_FOREACH(n, &((*nat_ctx).nat), _next) {
 472                 nat_cnt++;
 473                 if (off + SOF_NAT < size) {
 474                         bcopy(n, &data[off], SOF_NAT);
 475                         off += SOF_NAT;
 476                         LIST_FOREACH(r, &n->redir_chain, _next) {
 477                                 if (off + SOF_REDIR < size) {
 478                                         bcopy(r, &data[off], SOF_REDIR);
 479                                         off += SOF_REDIR;
 480                                         LIST_FOREACH(s, &r->spool_chain,
 481                                                 _next) {
 482                                                 if (off + SOF_SPOOL < size) {
 483                                                         bcopy(s, &data[off],
 484                                                                 SOF_SPOOL);
 485                                                         off += SOF_SPOOL;
 486                                                 } else
 487                                                         goto nospace;
 488                                         }
 489                                 } else
 490                                         goto nospace;
 491                         }
 492                 } else
 493                         goto nospace;
 494         }
 495         bcopy(&nat_cnt, data, sizeof(nat_cnt));
 496         sopt->sopt_valsize = nat_cfg_size;
 497         return 0;
 498 nospace:
 499         bzero(sopt->sopt_val, sopt->sopt_valsize);
 500         sopt->sopt_valsize = nat_cfg_size;
 501         return 0;
 502 }
 503
 504 int
 505 ipfw_ctl_nat_get_record(struct sockopt *sopt)
 506 {
 507         struct ipfw_nat_context *nat_ctx;
 508         struct cfg_nat *t;
 509         struct alias_link *lnk;
 510         struct libalias *la;
 511         size_t sopt_size, all_lnk_size = 0;
 512         int i, *nat_id, id, n;
 513         struct ipfw_ioc_nat_state *nat_state;
 514
 515         int cpu;
 516
 517         nat_id = (int *)(sopt->sopt_val);
 518         n = *nat_id;
 519         sopt_size = sopt->sopt_valsize;
 520         nat_state = (struct ipfw_ioc_nat_state *)sopt->sopt_val;
 521         for (cpu = 0; cpu < ncpus; cpu++) {
 522                 nat_ctx = ipfw_nat_ctx[cpu];
 523                 id = n;
 524                 LOOKUP_NAT((*nat_ctx), id, t);
 525                 if (t != NULL) {
 526                         la = t->lib;
 527                         LIBALIAS_LOCK_ASSERT(la);
 528                         for (i = 0; i < LINK_TABLE_OUT_SIZE; i++) {
 529                                 LIST_FOREACH(lnk, &la->linkTableOut[i],
 530                                                 list_out) {
 531                                         all_lnk_size += sizeof(*nat_state);
 532                                         if (all_lnk_size > sopt_size)
 533                                                 goto nospace;
 534                                         nat_state->src_addr = lnk->src_addr;
 535                                         nat_state->dst_addr = lnk->dst_addr;
 536                                         nat_state->alias_addr = lnk->alias_addr;
 537                                         nat_state->src_port = lnk->src_port;
 538                                         nat_state->dst_port = lnk->dst_port;
 539                                         nat_state->alias_port = lnk->alias_port;
 540                                         nat_state->link_type = lnk->link_type;
 541                                         nat_state->timestamp = lnk->timestamp;
 542                                         nat_state->cpuid = cpu;
 543                                         nat_state->is_outgoing = 1;
 544                                         nat_state++;
 545                                 }
 546                                 LIST_FOREACH(lnk, &la->linkTableIn[i],
 547                                                 list_out) {
 548                                         all_lnk_size += sizeof(*nat_state);
 549                                         if (all_lnk_size > sopt_size)
 550                                                 goto nospace;
 551                                         nat_state->src_addr = lnk->src_addr;
 552                                         nat_state->dst_addr = lnk->dst_addr;
 553                                         nat_state->alias_addr = lnk->alias_addr;
 554                                         nat_state->src_port = lnk->src_port;
 555                                         nat_state->dst_port = lnk->dst_port;
 556                                         nat_state->alias_port = lnk->alias_port;
 557                                         nat_state->link_type = lnk->link_type;
 558                                         nat_state->timestamp = lnk->timestamp;
 559                                         nat_state->cpuid = cpu;
 560                                         nat_state->is_outgoing = 0;
 561                                         nat_state++;
 562                                 }
 563                         }
 564                 }
 565         }
 566         sopt->sopt_valsize = all_lnk_size;
 567         return 0;
 568 nospace:
 569         return 0;
 570 }
 571
 572 void
 573 nat_add_dispatch(netmsg_t nat_add_msg)
 574 {
 575         struct ipfw_nat_context *nat_ctx;
 576         struct cfg_nat *ptr, *ser_n;
 577         struct netmsg_nat_add *msg;
 578
 579         msg = (struct netmsg_nat_add *)nat_add_msg;
 580
 581         ser_n = (struct cfg_nat *)(msg->buf);
 582
 583         /* New rule: allocate and init new instance. */
 584         ptr = kmalloc(sizeof(struct cfg_nat), M_IPFW_NAT, M_WAITOK | M_ZERO);
 585
 586         ptr->lib = LibAliasInit(NULL);
 587         if (ptr->lib == NULL) {
 588                 kfree(ptr, M_IPFW_NAT);
 589                 kfree(msg->buf, M_IPFW_NAT);
 590         }
 591
 592         LIST_INIT(&ptr->redir_chain);
 593         /*
 594          * Basic nat configuration.
 595          */
 596         ptr->id = ser_n->id;
 597         /*
 598          * XXX - what if this rule doesn't nat any ip and just
 599          * redirect?
 600          * do we set aliasaddress to 0.0.0.0?
 601          */
 602         ptr->ip = ser_n->ip;
 603         ptr->redir_cnt = ser_n->redir_cnt;
 604         ptr->mode = ser_n->mode;
 605
 606         LibAliasSetMode(ptr->lib, ser_n->mode, ser_n->mode);
 607         LibAliasSetAddress(ptr->lib, ptr->ip);
 608         memcpy(ptr->if_name, ser_n->if_name, IF_NAMESIZE);
 609
 610         /* Add new entries. */
 611         add_redir_spool_cfg(&msg->buf[(sizeof(struct cfg_nat))], ptr);
 612
 613         nat_ctx = ipfw_nat_ctx[mycpuid];
 614         HOOK_NAT(&(nat_ctx->nat), ptr);
 615         netisr_forwardmsg(&msg->base, mycpuid + 1);
 616 }
 617
 618 int
 619 ipfw_ctl_nat_add(struct sockopt *sopt)
 620 {
 621         struct ipfw_nat_context *nat_ctx;
 622         struct cfg_nat *ptr, *ser_n;
 623         ser_n = (struct cfg_nat *)(sopt->sopt_val);
 624
 625         nat_ctx = ipfw_nat_ctx[mycpuid];
 626         /*
 627          * Find/create nat rule.
 628          */
 629         LOOKUP_NAT((*nat_ctx), ser_n->id, ptr);
 630
 631         if (ptr == NULL) {
 632                 struct netmsg_nat_add nat_add_msg;
 633                 struct netmsg_nat_add *msg;
 634
 635                 msg = &nat_add_msg;
 636                 msg->buf = kmalloc(sopt->sopt_valsize,
 637                                 M_IPFW_NAT, M_WAITOK | M_ZERO);
 638
 639                 sooptcopyin(sopt, msg->buf, sopt->sopt_valsize,
 640                                 sizeof(struct cfg_nat));
 641
 642                 netmsg_init(&msg->base, NULL, &curthread->td_msgport,
 643                                 0, nat_add_dispatch);
 644
 645
 646                 netisr_domsg(&msg->base, 0);
 647                 kfree(msg->buf, M_IPFW_NAT);
 648         } else {
 649                 goto done;
 650         }
 651 done:
 652         return 0;
 653 }
 654
 655 void
 656 nat_del_dispatch(netmsg_t nat_del_msg)
 657 {
 658         struct ipfw_nat_context *nat_ctx;
 659         struct ipfw_context *ctx;
 660         struct cfg_nat *n, *tmp;
 661         struct netmsg_nat_del *msg;
 662         struct ip_fw *f;
 663         ipfw_insn *cmd;
 664         int id;
 665
 666         msg = (struct netmsg_nat_del *)nat_del_msg;
 667         id = msg->id;
 668
 669         nat_ctx = ipfw_nat_ctx[mycpuid];
 670         LOOKUP_NAT((*nat_ctx), id, n);
 671         if (n == NULL) {
 672         }
 673
 674         /*
 675          * stop deleting when this cfg_nat was in use in ipfw_ctx
 676          */
 677         ctx = ipfw_ctx[mycpuid];
 678         for (f = ctx->ipfw_rule_chain; f; f = f->next) {
 679                 cmd = ACTION_PTR(f);
 680                 if ((int)cmd->module == MODULE_NAT_ID &&
 681                                 (int)cmd->opcode == O_NAT_NAT) {
 682                         tmp = ((ipfw_insn_nat *)cmd)->nat;
 683                         if (tmp != NULL && tmp->id == n->id) {
 684                         }
 685                 }
 686         }
 687
 688         UNHOOK_NAT(n);
 689         del_redir_spool_cfg(n, &n->redir_chain);
 690         LibAliasUninit(n->lib);
 691         kfree(n, M_IPFW_NAT);
 692 }
 693
 694 int
 695 ipfw_ctl_nat_del(struct sockopt *sopt)
 696 {
 697         struct netmsg_nat_del nat_del_msg;
 698         struct netmsg_nat_del *msg;
 699         int *id;
 700
 701         msg = &nat_del_msg;
 702         id = sopt->sopt_val;
 703         msg->id = *id;
 704
 705         netmsg_init(&msg->base, NULL, &curthread->td_msgport,
 706                         0, nat_del_dispatch);
 707
 708         netisr_domsg(&msg->base, 0);
 709         return 0;
 710 }
 711
 712 int
 713 ipfw_ctl_nat_flush(struct sockopt *sopt)
 714 {
 715         struct ipfw_nat_context *nat_ctx;
 716         struct ipfw_context *ctx;
 717         struct cfg_nat *ptr, *tmp;
 718         struct ip_fw *f;
 719         ipfw_insn *cmd;
 720         int cpu;
 721
 722         /*
 723          * stop flushing when any cfg_nat was in use in ipfw_ctx
 724          */
 725         for (cpu = 0; cpu < ncpus; cpu++) {
 726                 ctx = ipfw_ctx[cpu];
 727                 for (f = ctx->ipfw_rule_chain; f; f = f->next) {
 728                         cmd = ACTION_PTR(f);
 729                         if ((int)cmd->module == MODULE_NAT_ID &&
 730                                 (int)cmd->opcode == O_NAT_NAT) {
 731                                 return EINVAL;
 732                         }
 733                 }
 734         }
 735
 736         nat_ctx = ipfw_nat_ctx[mycpuid];
 737
 738         LIST_FOREACH_MUTABLE(ptr, &(nat_ctx->nat), _next, tmp) {
 739                 LIST_REMOVE(ptr, _next);
 740                 del_redir_spool_cfg(ptr, &ptr->redir_chain);
 741                 LibAliasUninit(ptr->lib);
 742                 kfree(ptr, M_IPFW_NAT);
 743         }
 744         return 0;
 745 }
 746
 747 int
 748 ipfw_ctl_nat_sockopt(struct sockopt *sopt)
 749 {
 750         int error = 0;
 751         switch (sopt->sopt_name) {
 752                 case IP_FW_NAT_ADD:
 753                         error = ipfw_ctl_nat_add(sopt);
 754                         break;
 755                 case IP_FW_NAT_DEL:
 756                         error = ipfw_ctl_nat_del(sopt);
 757                         break;
 758                 case IP_FW_NAT_FLUSH:
 759                         error = ipfw_ctl_nat_flush(sopt);
 760                         break;
 761                 case IP_FW_NAT_GET:
 762                         error = ipfw_ctl_nat_get_cfg(sopt);
 763                         break;
 764                 case IP_FW_NAT_GET_RECORD:
 765                         error = ipfw_ctl_nat_get_record(sopt);
 766                         break;
 767                 default:
 768                         kprintf("ipfw3 nat invalid socket option %d\n",
 769                                         sopt->sopt_name);
 770         }
 771         return error;
 772 }
 773
 774 void
 775 nat_init_ctx_dispatch(netmsg_t msg)
 776 {
 777         struct ipfw_nat_context *tmp;
 778         tmp = kmalloc(sizeof(struct ipfw_nat_context),
 779                                 M_IPFW_NAT, M_WAITOK | M_ZERO);
 780         ipfw_nat_ctx[mycpuid] = tmp;
 781         netisr_forwardmsg(&msg->base, mycpuid + 1);
 782 }
 783
 784 static
 785 int ipfw_nat_init(void)
 786 {
 787         struct netmsg_base msg;
 788         register_ipfw_module(MODULE_NAT_ID, MODULE_NAT_NAME);
 789         register_ipfw_filter_funcs(MODULE_NAT_ID, O_NAT_NAT,
 790                         (filter_func)check_nat);
 791         ipfw_ctl_nat_ptr = ipfw_ctl_nat_sockopt;
 792         netmsg_init(&msg, NULL, &curthread->td_msgport,
 793                         0, nat_init_ctx_dispatch);
 794         netisr_domsg(&msg, 0);
 795         return 0;
 796 }
 797
 798 static int
 799 ipfw_nat_fini(void)
 800 {
 801         struct cfg_nat *ptr, *tmp;
 802         struct ipfw_nat_context *ctx;
 803         int cpu;
 804
 805         for (cpu = 0; cpu < ncpus; cpu++) {
 806                 ctx = ipfw_nat_ctx[cpu];
 807                 if(ctx != NULL) {
 808                         LIST_FOREACH_MUTABLE(ptr, &(ctx->nat), _next, tmp) {
 809                                 LIST_REMOVE(ptr, _next);
 810                                 del_redir_spool_cfg(ptr, &ptr->redir_chain);
 811                                 LibAliasUninit(ptr->lib);
 812                                 kfree(ptr, M_IPFW_NAT);
 813                         }
 814
 815                         kfree(ctx, M_IPFW_NAT);
 816                         ipfw_nat_ctx[cpu] = NULL;
 817                 }
 818         }
 819         ipfw_ctl_nat_ptr = NULL;
 820
 821         return unregister_ipfw_module(MODULE_NAT_ID);
 822 }
 823
 824 static int
 825 ipfw_nat_modevent(module_t mod, int type, void *data)
 826 {
 827         switch (type) {
 828                 case MOD_LOAD:
 829                         return ipfw_nat_init();
 830                 case MOD_UNLOAD:
 831                         return ipfw_nat_fini();
 832                 default:
 833                         break;
 834         }
 835         return 0;
 836 }
 837
 838 moduledata_t ipfw_nat_mod = {
 839         "ipfw3_nat",
 840         ipfw_nat_modevent,
 841         NULL
 842 };
 843
 844 DECLARE_MODULE(ipfw3_nat, ipfw_nat_mod,
 845                 SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
 846 MODULE_DEPEND(ipfw3_nat, libalias, 1, 1, 1);
 847 MODULE_DEPEND(ipfw3_nat, ipfw3_basic, 1, 1, 1);
 848 MODULE_VERSION(ipfw3_nat, 1);