ipfilter-cvs Mailing List for ipfilter (Page 5)
Brought to you by:
darren_r
You can subscribe to this list here.
2007 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
(121) |
Oct
(125) |
Nov
(15) |
Dec
(11) |
---|---|---|---|---|---|---|---|---|---|---|---|---|
2008 |
Jan
(6) |
Feb
(39) |
Mar
(27) |
Apr
(19) |
May
(12) |
Jun
(24) |
Jul
(58) |
Aug
(73) |
Sep
(18) |
Oct
(13) |
Nov
(28) |
Dec
(52) |
2009 |
Jan
(61) |
Feb
(20) |
Mar
(99) |
Apr
(4) |
May
(20) |
Jun
(16) |
Jul
(80) |
Aug
(16) |
Sep
|
Oct
|
Nov
(11) |
Dec
(33) |
2010 |
Jan
(21) |
Feb
(40) |
Mar
(6) |
Apr
(1) |
May
(5) |
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
2011 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
(22) |
Sep
|
Oct
(91) |
Nov
(85) |
Dec
(26) |
2012 |
Jan
(102) |
Feb
(15) |
Mar
|
Apr
|
May
(37) |
Jun
(72) |
Jul
(111) |
Aug
(17) |
Sep
|
Oct
|
Nov
|
Dec
|
2013 |
Jan
(4) |
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
2014 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
(48) |
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
From: Darren <dar...@us...> - 2012-07-20 08:14:08
|
Update of /cvsroot/ipfilter/ipfilter/tools In directory vz-cvs-4.sog:/tmp/cvs-serv29879/tools Modified Files: Tag: v5-1-RELEASE ipnat_y.y Log Message: 3544313 remove nat encap feature 3544318 ipnat.conf parsing ignores LHS address family Index: ipnat_y.y =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/tools/ipnat_y.y,v retrieving revision 1.19.2.12 retrieving revision 1.19.2.13 diff -C2 -d -r1.19.2.12 -r1.19.2.13 *** ipnat_y.y 13 Jul 2012 06:47:00 -0000 1.19.2.12 --- ipnat_y.y 20 Jul 2012 08:14:05 -0000 1.19.2.13 *************** *** 120,124 **** %token IPNY_TCP IPNY_UDP IPNY_TCPUDP IPNY_STICKY IPNY_MSSCLAMP IPNY_TAG %token IPNY_TLATE IPNY_POOL IPNY_HASH IPNY_NO IPNY_REWRITE IPNY_PROTO ! %token IPNY_ON IPNY_SRC IPNY_DST IPNY_IN IPNY_OUT IPNY_DIVERT IPNY_ENCAP %token IPNY_CONFIG IPNY_ALLOW IPNY_DENY IPNY_DNS IPNY_INET IPNY_INET6 %token IPNY_SEQUENTIAL IPNY_DSTLIST IPNY_PURGE --- 120,124 ---- %token IPNY_TCP IPNY_UDP IPNY_TCPUDP IPNY_STICKY IPNY_MSSCLAMP IPNY_TAG %token IPNY_TLATE IPNY_POOL IPNY_HASH IPNY_NO IPNY_REWRITE IPNY_PROTO ! %token IPNY_ON IPNY_SRC IPNY_DST IPNY_IN IPNY_OUT IPNY_DIVERT %token IPNY_CONFIG IPNY_ALLOW IPNY_DENY IPNY_DNS IPNY_INET IPNY_INET6 %token IPNY_SEQUENTIAL IPNY_DSTLIST IPNY_PURGE *************** *** 181,185 **** | rewrite ';' | divert ';' - | encap ';' ; --- 181,184 ---- *************** *** 195,200 **** --- 194,203 ---- if (nat->in_v[0] == 0 && $5.v != 0) nat->in_v[0] = $5.v; + else if (nat->in_v[0] == 0 && $3.v != 0) + nat->in_v[0] = $3.v; if (nat->in_v[1] == 0 && $5.v != 0) nat->in_v[1] = $5.v; + else if (nat->in_v[1] == 0 && $3.v != 0) + nat->in_v[1] = $3.v; nat->in_osrcatype = $3.t; bcopy(&$3.a, &nat->in_osrc.na_addr[0], *************** *** 216,221 **** --- 219,228 ---- if (nat->in_v[1] == 0 && $5.v != 0) nat->in_v[1] = $5.v; + else if (nat->in_v[0] == 0 && $3.v != 0) + nat->in_v[0] = $3.v; if (nat->in_v[0] == 0 && $5.v != 0) nat->in_v[0] = $5.v; + else if (nat->in_v[1] == 0 && $3.v != 0) + nat->in_v[1] = $3.v; nat->in_osrcatype = $3.t; bcopy(&$3.a, &nat->in_osrc.na_addr[0], *************** *** 248,253 **** --- 255,264 ---- if (nat->in_v[0] == 0 && $5.v != 0) nat->in_v[0] = $5.v; + else if (nat->in_v[0] == 0 && $3 != 0) + nat->in_v[0] = ftov($3); if (nat->in_v[1] == 0 && $5.v != 0) nat->in_v[1] = $5.v; + else if (nat->in_v[1] == 0 && $3 != 0) + nat->in_v[1] = ftov($3); nat->in_nsrcatype = $5.t; nat->in_nsrcafunc = $5.u; *************** *** 268,273 **** --- 279,288 ---- if (nat->in_v[0] == 0 && $5.v != 0) nat->in_v[0] = $5.v; + else if (nat->in_v[0] == 0 && $3 != 0) + nat->in_v[0] = ftov($3); if (nat->in_v[1] == 0 && $5.v != 0) nat->in_v[1] = $5.v; + else if (nat->in_v[1] == 0 && $3 != 0) + nat->in_v[1] = ftov($3); nat->in_nsrcatype = $5.t; nat->in_nsrcafunc = $5.u; *************** *** 287,292 **** --- 302,311 ---- if (nat->in_v[0] == 0 && $5.v != 0) nat->in_v[0] = $5.v; + else if (nat->in_v[0] == 0 && $3.v != 0) + nat->in_v[0] = $3.v; if (nat->in_v[1] == 0 && $5.v != 0) nat->in_v[1] = $5.v; + else if (nat->in_v[1] == 0 && $3.v != 0) + nat->in_v[1] = $3.v; nat->in_osrcatype = $3.t; bcopy(&$3.a, &nat->in_osrc.na_addr[0], *************** *** 390,407 **** ; - encap: IPNY_ENCAP oninout rwrproto mapfrom tlate encapdst newopts - { if (nat->in_v[0] == 0) - nat->in_v[0] = ftov($4); - if (nat->in_redir & NAT_MAP) { - setmapifnames(); - nat->in_pr[0] = IPPROTO_IPIP; - } else { - setrdrifnames(); - nat->in_pr[1] = IPPROTO_IPIP; - } - nat->in_flags &= ~IPN_TCPUDP; - } - ; - tlate: IPNY_TLATE { yyexpectaddr = 1; } ; --- 409,412 ---- *************** *** 483,495 **** ; - encapdst: - src addr dst addr { nat->in_nsrc.na_addr[0] = $2.a; - nat->in_nsrc.na_addr[1] = $2.m; - nat->in_ndst.na_addr[0] = $4.a; - nat->in_ndst.na_addr[1] = $4.m; - nat->in_redir |= NAT_ENCAP; - } - ; - src: IPNY_SRC { yyexpectaddr = 1; } ; --- 488,491 ---- *************** *** 1259,1263 **** { "dst", IPNY_DST }, { "dstlist", IPNY_DSTLIST }, - { "encap", IPNY_ENCAP }, { "frag", IPNY_FRAG }, { "from", IPNY_FROM }, --- 1255,1258 ---- |
From: Darren <dar...@us...> - 2012-07-20 08:13:43
|
Update of /cvsroot/ipfilter/ipfilter/tools In directory vz-cvs-4.sog:/tmp/cvs-serv29861/tools Modified Files: ipnat_y.y Log Message: 3544313 remove nat encap feature 3544318 ipnat.conf parsing ignores LHS address family Index: ipnat_y.y =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/tools/ipnat_y.y,v retrieving revision 1.31 retrieving revision 1.32 diff -C2 -d -r1.31 -r1.32 *** ipnat_y.y 13 Jul 2012 06:46:45 -0000 1.31 --- ipnat_y.y 20 Jul 2012 08:13:41 -0000 1.32 *************** *** 120,124 **** %token IPNY_TCP IPNY_UDP IPNY_TCPUDP IPNY_STICKY IPNY_MSSCLAMP IPNY_TAG %token IPNY_TLATE IPNY_POOL IPNY_HASH IPNY_NO IPNY_REWRITE IPNY_PROTO ! %token IPNY_ON IPNY_SRC IPNY_DST IPNY_IN IPNY_OUT IPNY_DIVERT IPNY_ENCAP %token IPNY_CONFIG IPNY_ALLOW IPNY_DENY IPNY_DNS IPNY_INET IPNY_INET6 %token IPNY_SEQUENTIAL IPNY_DSTLIST IPNY_PURGE --- 120,124 ---- %token IPNY_TCP IPNY_UDP IPNY_TCPUDP IPNY_STICKY IPNY_MSSCLAMP IPNY_TAG %token IPNY_TLATE IPNY_POOL IPNY_HASH IPNY_NO IPNY_REWRITE IPNY_PROTO ! %token IPNY_ON IPNY_SRC IPNY_DST IPNY_IN IPNY_OUT IPNY_DIVERT %token IPNY_CONFIG IPNY_ALLOW IPNY_DENY IPNY_DNS IPNY_INET IPNY_INET6 %token IPNY_SEQUENTIAL IPNY_DSTLIST IPNY_PURGE *************** *** 181,185 **** | rewrite ';' | divert ';' - | encap ';' ; --- 181,184 ---- *************** *** 195,200 **** --- 194,203 ---- if (nat->in_v[0] == 0 && $5.v != 0) nat->in_v[0] = $5.v; + else if (nat->in_v[0] == 0 && $3.v != 0) + nat->in_v[0] = $3.v; if (nat->in_v[1] == 0 && $5.v != 0) nat->in_v[1] = $5.v; + else if (nat->in_v[1] == 0 && $3.v != 0) + nat->in_v[1] = $3.v; nat->in_osrcatype = $3.t; bcopy(&$3.a, &nat->in_osrc.na_addr[0], *************** *** 216,221 **** --- 219,228 ---- if (nat->in_v[1] == 0 && $5.v != 0) nat->in_v[1] = $5.v; + else if (nat->in_v[0] == 0 && $3.v != 0) + nat->in_v[0] = $3.v; if (nat->in_v[0] == 0 && $5.v != 0) nat->in_v[0] = $5.v; + else if (nat->in_v[1] == 0 && $3.v != 0) + nat->in_v[1] = $3.v; nat->in_osrcatype = $3.t; bcopy(&$3.a, &nat->in_osrc.na_addr[0], *************** *** 248,253 **** --- 255,264 ---- if (nat->in_v[0] == 0 && $5.v != 0) nat->in_v[0] = $5.v; + else if (nat->in_v[0] == 0 && $3 != 0) + nat->in_v[0] = ftov($3); if (nat->in_v[1] == 0 && $5.v != 0) nat->in_v[1] = $5.v; + else if (nat->in_v[1] == 0 && $3 != 0) + nat->in_v[1] = ftov($3); nat->in_nsrcatype = $5.t; nat->in_nsrcafunc = $5.u; *************** *** 268,273 **** --- 279,288 ---- if (nat->in_v[0] == 0 && $5.v != 0) nat->in_v[0] = $5.v; + else if (nat->in_v[0] == 0 && $3 != 0) + nat->in_v[0] = ftov($3); if (nat->in_v[1] == 0 && $5.v != 0) nat->in_v[1] = $5.v; + else if (nat->in_v[1] == 0 && $3 != 0) + nat->in_v[1] = ftov($3); nat->in_nsrcatype = $5.t; nat->in_nsrcafunc = $5.u; *************** *** 287,292 **** --- 302,311 ---- if (nat->in_v[0] == 0 && $5.v != 0) nat->in_v[0] = $5.v; + else if (nat->in_v[0] == 0 && $3.v != 0) + nat->in_v[0] = $3.v; if (nat->in_v[1] == 0 && $5.v != 0) nat->in_v[1] = $5.v; + else if (nat->in_v[1] == 0 && $3.v != 0) + nat->in_v[1] = $3.v; nat->in_osrcatype = $3.t; bcopy(&$3.a, &nat->in_osrc.na_addr[0], *************** *** 390,407 **** ; - encap: IPNY_ENCAP oninout rwrproto mapfrom tlate encapdst newopts - { if (nat->in_v[0] == 0) - nat->in_v[0] = ftov($4); - if (nat->in_redir & NAT_MAP) { - setmapifnames(); - nat->in_pr[0] = IPPROTO_IPIP; - } else { - setrdrifnames(); - nat->in_pr[1] = IPPROTO_IPIP; - } - nat->in_flags &= ~IPN_TCPUDP; - } - ; - tlate: IPNY_TLATE { yyexpectaddr = 1; } ; --- 409,412 ---- *************** *** 483,495 **** ; - encapdst: - src addr dst addr { nat->in_nsrc.na_addr[0] = $2.a; - nat->in_nsrc.na_addr[1] = $2.m; - nat->in_ndst.na_addr[0] = $4.a; - nat->in_ndst.na_addr[1] = $4.m; - nat->in_redir |= NAT_ENCAP; - } - ; - src: IPNY_SRC { yyexpectaddr = 1; } ; --- 488,491 ---- *************** *** 1259,1263 **** { "dst", IPNY_DST }, { "dstlist", IPNY_DSTLIST }, - { "encap", IPNY_ENCAP }, { "frag", IPNY_FRAG }, { "from", IPNY_FROM }, --- 1255,1258 ---- |
From: Darren <dar...@us...> - 2012-07-20 08:12:13
|
Update of /cvsroot/ipfilter/ipfilter/lib In directory vz-cvs-4.sog:/tmp/cvs-serv29815/lib Modified Files: Tag: v5-1-RELEASE interror.c Log Message: 3544313 remove nat encap feature Index: interror.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/lib/interror.c,v retrieving revision 1.9.2.10 retrieving revision 1.9.2.11 diff -C2 -d -r1.9.2.10 -r1.9.2.11 *** interror.c 9 Jun 2012 06:20:41 -0000 1.9.2.10 --- interror.c 20 Jul 2012 08:12:10 -0000 1.9.2.11 *************** *** 301,305 **** { 60019, "error copying in NAT token data for deletion" }, { 60020, "unknown NAT ioctl" }, ! { 60021, "cannot add encapsulation rule for TCP/UDP" }, { 60022, "resolving proxy name in NAT rule failed" }, { 60023, "only reply age specified in NAT rule" }, --- 301,305 ---- { 60019, "error copying in NAT token data for deletion" }, { 60020, "unknown NAT ioctl" }, ! { 60021, "" }, { 60022, "resolving proxy name in NAT rule failed" }, { 60023, "only reply age specified in NAT rule" }, |
From: Darren <dar...@us...> - 2012-07-20 08:11:45
|
Update of /cvsroot/ipfilter/ipfilter/lib In directory vz-cvs-4.sog:/tmp/cvs-serv29795/lib Modified Files: interror.c Log Message: 3544313 remove nat encap feature Index: interror.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/lib/interror.c,v retrieving revision 1.18 retrieving revision 1.19 diff -C2 -d -r1.18 -r1.19 *** interror.c 9 Jun 2012 06:19:02 -0000 1.18 --- interror.c 20 Jul 2012 08:11:43 -0000 1.19 *************** *** 311,315 **** { 60019, "error copying in NAT token data for deletion" }, { 60020, "unknown NAT ioctl" }, ! { 60021, "cannot add encapsulation rule for TCP/UDP" }, { 60022, "resolving proxy name in NAT rule failed" }, { 60023, "only reply age specified in NAT rule" }, --- 311,315 ---- { 60019, "error copying in NAT token data for deletion" }, { 60020, "unknown NAT ioctl" }, ! { 60021, "" }, { 60022, "resolving proxy name in NAT rule failed" }, { 60023, "only reply age specified in NAT rule" }, |
From: Darren <dar...@us...> - 2012-07-20 08:10:53
|
Update of /cvsroot/ipfilter/ipfilter/test In directory vz-cvs-4.sog:/tmp/cvs-serv29760/test Modified Files: Tag: v5-1-RELEASE Makefile test.format Log Message: 3544313 remove nat encap feature Index: Makefile =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/test/Makefile,v retrieving revision 1.19.2.4 retrieving revision 1.19.2.5 diff -C2 -d -r1.19.2.4 -r1.19.2.5 *** Makefile 6 Jul 2012 14:35:37 -0000 1.19.2.4 --- Makefile 20 Jul 2012 08:10:50 -0000 1.19.2.5 *************** *** 34,38 **** i20 i21 i22 i23 ! ntests: n1 n2 n3 n4 n5 n6 n7 n8 n9 n10 n11 n12 n13 n14 n15 n16 n17 n18 n100 n101 n102 n103 n104 n105 n106 n200 n201 ntests6: n1_6 n2_6 n4_6 n5_6 n6_6 n7_6 n8_6 n9_6 n11_6 n12_6 n15_6 --- 34,38 ---- i20 i21 i22 i23 ! ntests: n1 n2 n3 n4 n5 n6 n7 n8 n9 n10 n11 n12 n13 n14 n15 n16 n17 n18 n100 n101 n102 n103 n104 n105 n106 n200 ntests6: n1_6 n2_6 n4_6 n5_6 n6_6 n7_6 n8_6 n9_6 n11_6 n12_6 n15_6 *************** *** 288,297 **** @/bin/sh ./nattest `awk "/^$@ / { print; } " test.format` - n201: expected/n201 regress/n201 input/n201 - @/bin/sh ./nattest `awk "/^$@ / { print; } " test.format` - - n202: expected/n202 regress/n202 input/n202 - @/bin/sh ./nattest `awk "/^$@ / { print; } " test.format` - n1_6: expected/n1_6 regress/n1_6 input/n1_6 @/bin/sh ./nattest `awk "/^$@ / { print; } " test.format` --- 288,291 ---- *************** *** 500,504 **** /bin/rm -f i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11 i12 i13 i14 i15 i16 i17 /bin/rm -f i18 i19 i20 i21 i22 i23 ! /bin/rm -f n1 n2 n3 n4 n5 n6 n7 n8 n9 n10 n11 n12 n13 n14 n15 n16 n17 n18 n100 n101 n102 n103 n104 n105 n106 n200 n201 n202 /bin/rm -f n1_6 n2_6 n4_6 n5_6 n6_6 n7_6 n8_6 n9_6 n11_6 n12_6 n15_6 /bin/rm -f ni1 ni2 ni3 ni4 ni5 ni6 ni7 ni8 ni9 --- 494,498 ---- /bin/rm -f i1 i2 i3 i4 i5 i6 i7 i8 i9 i10 i11 i12 i13 i14 i15 i16 i17 /bin/rm -f i18 i19 i20 i21 i22 i23 ! /bin/rm -f n1 n2 n3 n4 n5 n6 n7 n8 n9 n10 n11 n12 n13 n14 n15 n16 n17 n18 n100 n101 n102 n103 n104 n105 n106 n200 /bin/rm -f n1_6 n2_6 n4_6 n5_6 n6_6 n7_6 n8_6 n9_6 n11_6 n12_6 n15_6 /bin/rm -f ni1 ni2 ni3 ni4 ni5 ni6 ni7 ni8 ni9 Index: test.format =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/test/test.format,v retrieving revision 1.17.2.3 retrieving revision 1.17.2.4 diff -C2 -d -r1.17.2.3 -r1.17.2.4 *** test.format 16 Feb 2012 02:22:30 -0000 1.17.2.3 --- test.format 20 Jul 2012 08:10:50 -0000 1.17.2.4 *************** *** 88,93 **** n106 hex hex update_ipid=0 n200 hex hex update_ipid=0 - n201 hex hex update_ipid=0 - n202 hex hex update_ipid=0 ni1 hex hex update_ipid=1 ni2 hex hex update_ipid=1 --- 88,91 ---- |
From: Darren <dar...@us...> - 2012-07-20 08:09:35
|
Update of /cvsroot/ipfilter/ipfilter/test/expected In directory vz-cvs-4.sog:/tmp/cvs-serv29697/test/expected Removed Files: n201.dist n202.dist Log Message: 3544313 remove nat encap feature --- n202.dist DELETED --- --- n201.dist DELETED --- |
From: Darren <dar...@us...> - 2012-07-20 08:07:02
|
Update of /cvsroot/ipfilter/ipfilter/test/input In directory vz-cvs-4.sog:/tmp/cvs-serv28579/test/input Modified Files: n201.dist n202.dist Log Message: 3544313 remove nat encap feature Index: n202.dist =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/test/input/n202.dist,v retrieving revision 1.1 retrieving revision 1.2 diff -C2 -d -r1.1 -r1.2 *** n202.dist 17 Nov 2011 20:26:51 -0000 1.1 --- n202.dist 20 Jul 2012 08:07:00 -0000 1.2 *************** *** 1,7 **** - [in,NIC0] - 4500 0054 0000 4000 ff04 10fa c0a8 a801 0101 0101 - 4500 0040 7ee9 4000 4006 5879 c0a8 7101 - c0a8 7103 0017 ffdd 21dd ace0 0000 0000 - b012 8000 83e8 0000 0204 05b4 0103 0300 - 0402 0101 0101 080a 0000 0000 0000 0000 - --- 0 ---- Index: n201.dist =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/test/input/n201.dist,v retrieving revision 1.2 retrieving revision 1.3 diff -C2 -d -r1.2 -r1.3 *** n201.dist 9 Jun 2012 06:19:02 -0000 1.2 --- n201.dist 20 Jul 2012 08:07:00 -0000 1.3 *************** *** 1,36 **** - # - # TCP out... - # - [out,NIC0] - 4500 0040 7ee9 4000 4006 5879 c0a8 7103 c0a8 7101 - ffdd 0017 21dd ace0 0000 0000 b002 8000 - 83f8 0000 0204 05b4 0103 0300 0402 0101 - 0101 080a 0000 0000 0000 0000 - - # - # encap'd TCP in... - # - [in,NIC0] - 4500 0054 0000 4000 ff04 10fa c0a8 a801 0101 0101 - 4500 0040 7ee9 4000 4006 5879 c0a8 7101 c0a8 7103 - 0017 ffdd ace0 21dd 21dd ace1 b012 8000 b529 0000 - 0204 05b4 0103 0300 0402 0101 0101 080a 0000 0000 0000 0000 - - # - # TCP in... - # - [out,NIC0] - 4500 0040 7ee9 4000 4006 5879 c0a8 7103 c0a8 7101 - ffdd 0017 21dd ace0 0000 0000 b002 8000 - 83f8 0000 0204 05b4 0103 0300 0402 0101 - 0101 080a 0000 0000 0000 0000 - - # - # ICMP error - # - [in,NIC0] - 4500 0038 0000 4000 ff01 73bd 0303 0303 0101 0101 - 0304 f3bd 0000 0514 - 4500 0054 0001 4000 ff04 10f9 0101 0101 c0a8 a801 - 4500 0040 7ee9 4000 - --- 0 ---- |
From: Darren <dar...@us...> - 2012-07-20 08:04:16
|
Update of /cvsroot/ipfilter/ipfilter/man In directory vz-cvs-4.sog:/tmp/cvs-serv28509/man Modified Files: Tag: v5-1-RELEASE ipnat.5 Log Message: 3544313 remove nat encap feature Index: ipnat.5 =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/man/ipnat.5,v retrieving revision 1.7.2.2 retrieving revision 1.7.2.3 diff -C2 -d -r1.7.2.2 -r1.7.2.3 *** ipnat.5 29 May 2012 14:44:58 -0000 1.7.2.2 --- ipnat.5 20 Jul 2012 08:04:13 -0000 1.7.2.3 *************** *** 555,561 **** rule. .PP ! The syntax for these rules is much the same as ! .B encap ! rules, but instead the syntax must supply required information for UDP: .nf --- 555,565 ---- rule. .PP ! Divert rules can be be used with both inbound and outbound packet ! matching however the rule ! .B must ! specify host addresses for the outer packet, not ranges of addresses ! or netmasks, just single addresses. ! Additionally the syntax must supply required information for UDP. ! An example of what a divert rule looks ike is as follows: .nf *************** *** 578,604 **** not possible to cause Path MTU discovery to happen as this feature is intended to be transparent to both endpoints. - .SH ENCAPSULATING PACKETS - .PP - In addition to translating address fields of a packet, the NAT module in - IPFILter also supports wrapping them up in another IP packet and sending - them off to a new destination. Full compliance of this feature with - RFC 1853 and RFC 2003 is pending implementation of support for PMTU - discovery with it. - .PP - Encapsulation can be performed on both incoming and outgoing packets - but - .B must - specify host addresses for the outer packet, not ranges of addresses - or netmasks, just single addresses. - .PP - As with the - .B rewrite - rules, the LHS requires a from/to match and terminates with a - semi-colon (";"). An example of what these might look like are: - .nf - - encap out on le0 from any to any -> src 10.1.1.1 dst 192.168.1.1; - .fi - .TP .B Path MTU Discovery If Path MTU discovery is being used and the "do not fragment" flag --- 582,585 ---- |
From: Darren <dar...@us...> - 2012-07-20 08:04:01
|
Update of /cvsroot/ipfilter/ipfilter/man In directory vz-cvs-4.sog:/tmp/cvs-serv28497/man Modified Files: ipnat.5 Log Message: 3544313 remove nat encap feature Index: ipnat.5 =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/man/ipnat.5,v retrieving revision 1.9 retrieving revision 1.10 diff -C2 -d -r1.9 -r1.10 *** ipnat.5 29 May 2012 14:48:27 -0000 1.9 --- ipnat.5 20 Jul 2012 08:03:59 -0000 1.10 *************** *** 555,561 **** rule. .PP ! The syntax for these rules is much the same as ! .B encap ! rules, but instead the syntax must supply required information for UDP: .nf --- 555,565 ---- rule. .PP ! Divert rules can be be used with both inbound and outbound packet ! matching however the rule ! .B must ! specify host addresses for the outer packet, not ranges of addresses ! or netmasks, just single addresses. ! Additionally the syntax must supply required information for UDP. ! An example of what a divert rule looks ike is as follows: .nf *************** *** 578,604 **** not possible to cause Path MTU discovery to happen as this feature is intended to be transparent to both endpoints. - .SH ENCAPSULATING PACKETS - .PP - In addition to translating address fields of a packet, the NAT module in - IPFILter also supports wrapping them up in another IP packet and sending - them off to a new destination. Full compliance of this feature with - RFC 1853 and RFC 2003 is pending implementation of support for PMTU - discovery with it. - .PP - Encapsulation can be performed on both incoming and outgoing packets - but - .B must - specify host addresses for the outer packet, not ranges of addresses - or netmasks, just single addresses. - .PP - As with the - .B rewrite - rules, the LHS requires a from/to match and terminates with a - semi-colon (";"). An example of what these might look like are: - .nf - - encap out on le0 from any to any -> src 10.1.1.1 dst 192.168.1.1; - .fi - .TP .B Path MTU Discovery If Path MTU discovery is being used and the "do not fragment" flag --- 582,585 ---- |
From: Darren <dar...@us...> - 2012-07-20 08:03:44
|
Update of /cvsroot/ipfilter/ipfilter/lib In directory vz-cvs-4.sog:/tmp/cvs-serv28470/lib Modified Files: Tag: v5-1-RELEASE printnatside.c Log Message: 3544313 remove nat encap feature Index: printnatside.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/lib/printnatside.c,v retrieving revision 1.2.2.4 retrieving revision 1.2.2.5 diff -C2 -d -r1.2.2.4 -r1.2.2.5 *** printnatside.c 9 Jul 2012 16:37:06 -0000 1.2.2.4 --- printnatside.c 20 Jul 2012 08:03:41 -0000 1.2.2.5 *************** *** 26,31 **** PRINTF("%lu\tdivert exist %s\n", ns->ns_divert_exist, side); PRINTF("%lu\tdrop %s\n", ns->ns_drop, side); - PRINTF("%lu\tencap dup %s\n", ns->ns_encap_dup, side); - PRINTF("%lu\tencap pullup %s\n", ns->ns_encap_pullup, side); PRINTF("%lu\texhausted %s\n", ns->ns_exhausted, side); PRINTF("%lu\ticmp address %s\n", ns->ns_icmp_address, side); --- 26,29 ---- |
From: Darren <dar...@us...> - 2012-07-20 08:03:31
|
Update of /cvsroot/ipfilter/ipfilter/lib In directory vz-cvs-4.sog:/tmp/cvs-serv28443/lib Modified Files: printnatside.c Log Message: 3544313 remove nat encap feature Index: printnatside.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/lib/printnatside.c,v retrieving revision 1.5 retrieving revision 1.6 diff -C2 -d -r1.5 -r1.6 *** printnatside.c 9 Jul 2012 16:36:53 -0000 1.5 --- printnatside.c 20 Jul 2012 08:03:29 -0000 1.6 *************** *** 26,31 **** PRINTF("%lu\tdivert exist %s\n", ns->ns_divert_exist, side); PRINTF("%lu\tdrop %s\n", ns->ns_drop, side); - PRINTF("%lu\tencap dup %s\n", ns->ns_encap_dup, side); - PRINTF("%lu\tencap pullup %s\n", ns->ns_encap_pullup, side); PRINTF("%lu\texhausted %s\n", ns->ns_exhausted, side); PRINTF("%lu\ticmp address %s\n", ns->ns_icmp_address, side); --- 26,29 ---- |
From: Darren <dar...@us...> - 2012-07-20 07:58:24
|
Update of /cvsroot/ipfilter/ipfilter In directory vz-cvs-4.sog:/tmp/cvs-serv28113 Modified Files: Tag: v5-1-RELEASE ip_dns_pxy.c ip_ipsec_pxy.c ip_irc_pxy.c ip_pptp_pxy.c ip_raudio_pxy.c ip_rpcb_pxy.c Log Message: 3545309 non-ipv6 safe proxies do not fail with ipv6 Index: ip_ipsec_pxy.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_ipsec_pxy.c,v retrieving revision 1.14.2.6 retrieving revision 1.14.2.7 diff -C2 -d -r1.14.2.6 -r1.14.2.7 *** ip_ipsec_pxy.c 13 Jul 2012 12:25:34 -0000 1.14.2.6 --- ip_ipsec_pxy.c 20 Jul 2012 07:58:22 -0000 1.14.2.7 *************** *** 151,154 **** --- 151,157 ---- mb_t *m; + if (fin->fin_v != 4) + return -1; + off = fin->fin_plen - fin->fin_dlen + fin->fin_ipoff; bzero(softi->ipsec_buffer, sizeof(softi->ipsec_buffer)); Index: ip_pptp_pxy.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_pptp_pxy.c,v retrieving revision 1.13.2.6 retrieving revision 1.13.2.7 diff -C2 -d -r1.13.2.6 -r1.13.2.7 *** ip_pptp_pxy.c 13 Jul 2012 12:25:35 -0000 1.13.2.6 --- ip_pptp_pxy.c 20 Jul 2012 07:58:22 -0000 1.13.2.7 *************** *** 120,123 **** --- 120,126 ---- ip_t *ip; + if (fin->fin_v != 4) + return -1; + ip = fin->fin_ip; np = nat->nat_ptr; Index: ip_raudio_pxy.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_raudio_pxy.c,v retrieving revision 1.9.2.3 retrieving revision 1.9.2.4 diff -C2 -d -r1.9.2.3 -r1.9.2.4 *** ip_raudio_pxy.c 26 Jan 2012 05:44:25 -0000 1.9.2.3 --- ip_raudio_pxy.c 20 Jul 2012 07:58:22 -0000 1.9.2.4 *************** *** 57,67 **** raudio_t *rap; KMALLOCS(aps->aps_data, void *, sizeof(raudio_t)); if (aps->aps_data == NULL) return -1; - fin = fin; /* LINT */ - nat = nat; /* LINT */ - bzero(aps->aps_data, sizeof(raudio_t)); rap = aps->aps_data; --- 57,69 ---- raudio_t *rap; + nat = nat; /* LINT */ + + if (fin->fin_v != 4) + return -1; + KMALLOCS(aps->aps_data, void *, sizeof(raudio_t)); if (aps->aps_data == NULL) return -1; bzero(aps->aps_data, sizeof(raudio_t)); rap = aps->aps_data; Index: ip_irc_pxy.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_irc_pxy.c,v retrieving revision 1.9.2.4 retrieving revision 1.9.2.5 diff -C2 -d -r1.9.2.4 -r1.9.2.5 *** ip_irc_pxy.c 29 May 2012 12:22:38 -0000 1.9.2.4 --- ip_irc_pxy.c 20 Jul 2012 07:58:22 -0000 1.9.2.5 *************** *** 233,241 **** ircinfo_t *irc; KMALLOC(irc, ircinfo_t *); if (irc == NULL) return -1; - fin = fin; /* LINT */ nat = nat; /* LINT */ --- 233,243 ---- ircinfo_t *irc; + if (fin->fin_v != 4) + return -1; + KMALLOC(irc, ircinfo_t *); if (irc == NULL) return -1; nat = nat; /* LINT */ *************** *** 357,360 **** --- 359,363 ---- #endif COPYBACK(m, off, nlen, newbuf); + fin->fin_flx |= FI_DOCKSUM; if (inc != 0) { Index: ip_rpcb_pxy.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_rpcb_pxy.c,v retrieving revision 1.13.2.3 retrieving revision 1.13.2.4 diff -C2 -d -r1.13.2.3 -r1.13.2.4 *** ip_rpcb_pxy.c 13 Jul 2012 06:39:03 -0000 1.13.2.3 --- ip_rpcb_pxy.c 20 Jul 2012 07:58:22 -0000 1.13.2.4 *************** *** 151,157 **** rpcb_session_t *rs; - fin = fin; /* LINT */ nat = nat; /* LINT */ KMALLOC(rs, rpcb_session_t *); if (rs == NULL) --- 151,159 ---- rpcb_session_t *rs; nat = nat; /* LINT */ + if (fin->fin_v != 4) + return -1; + KMALLOC(rs, rpcb_session_t *); if (rs == NULL) Index: ip_dns_pxy.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_dns_pxy.c,v retrieving revision 1.1.2.8 retrieving revision 1.1.2.9 diff -C2 -d -r1.1.2.8 -r1.1.2.9 *** ip_dns_pxy.c 29 Jan 2012 05:30:35 -0000 1.1.2.8 --- ip_dns_pxy.c 20 Jul 2012 07:58:22 -0000 1.1.2.9 *************** *** 184,187 **** --- 184,190 ---- int dlen; + if (fin->fin_v != 4) + return -1; + dlen = fin->fin_dlen - sizeof(udphdr_t); if (dlen < sizeof(ipf_dns_hdr_t)) { |
From: Darren <dar...@us...> - 2012-07-20 07:58:08
|
Update of /cvsroot/ipfilter/ipfilter In directory vz-cvs-4.sog:/tmp/cvs-serv28088 Modified Files: ip_dns_pxy.c ip_ipsec_pxy.c ip_irc_pxy.c ip_pptp_pxy.c ip_raudio_pxy.c ip_rpcb_pxy.c Log Message: 3545309 non-ipv6 safe proxies do not fail with ipv6 Index: ip_ipsec_pxy.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_ipsec_pxy.c,v retrieving revision 1.18 retrieving revision 1.19 diff -C2 -d -r1.18 -r1.19 *** ip_ipsec_pxy.c 13 Jul 2012 11:56:51 -0000 1.18 --- ip_ipsec_pxy.c 20 Jul 2012 07:58:06 -0000 1.19 *************** *** 151,154 **** --- 151,157 ---- mb_t *m; + if (fin->fin_v != 4) + return -1; + off = fin->fin_plen - fin->fin_dlen + fin->fin_ipoff; bzero(softi->ipsec_buffer, sizeof(softi->ipsec_buffer)); Index: ip_pptp_pxy.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_pptp_pxy.c,v retrieving revision 1.17 retrieving revision 1.18 diff -C2 -d -r1.17 -r1.18 *** ip_pptp_pxy.c 13 Jul 2012 11:56:51 -0000 1.17 --- ip_pptp_pxy.c 20 Jul 2012 07:58:06 -0000 1.18 *************** *** 120,123 **** --- 120,126 ---- ip_t *ip; + if (fin->fin_v != 4) + return -1; + ip = fin->fin_ip; np = nat->nat_ptr; Index: ip_raudio_pxy.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_raudio_pxy.c,v retrieving revision 1.10 retrieving revision 1.11 diff -C2 -d -r1.10 -r1.11 *** ip_raudio_pxy.c 29 Jul 2009 06:13:00 -0000 1.10 --- ip_raudio_pxy.c 20 Jul 2012 07:58:06 -0000 1.11 *************** *** 57,67 **** raudio_t *rap; KMALLOCS(aps->aps_data, void *, sizeof(raudio_t)); if (aps->aps_data == NULL) return -1; - fin = fin; /* LINT */ - nat = nat; /* LINT */ - bzero(aps->aps_data, sizeof(raudio_t)); rap = aps->aps_data; --- 57,69 ---- raudio_t *rap; + nat = nat; /* LINT */ + + if (fin->fin_v != 4) + return -1; + KMALLOCS(aps->aps_data, void *, sizeof(raudio_t)); if (aps->aps_data == NULL) return -1; bzero(aps->aps_data, sizeof(raudio_t)); rap = aps->aps_data; Index: ip_irc_pxy.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_irc_pxy.c,v retrieving revision 1.11 retrieving revision 1.12 diff -C2 -d -r1.11 -r1.12 *** ip_irc_pxy.c 29 May 2012 12:47:41 -0000 1.11 --- ip_irc_pxy.c 20 Jul 2012 07:58:06 -0000 1.12 *************** *** 233,241 **** ircinfo_t *irc; KMALLOC(irc, ircinfo_t *); if (irc == NULL) return -1; - fin = fin; /* LINT */ nat = nat; /* LINT */ --- 233,243 ---- ircinfo_t *irc; + if (fin->fin_v != 4) + return -1; + KMALLOC(irc, ircinfo_t *); if (irc == NULL) return -1; nat = nat; /* LINT */ *************** *** 357,360 **** --- 359,363 ---- #endif COPYBACK(m, off, nlen, newbuf); + fin->fin_flx |= FI_DOCKSUM; if (inc != 0) { Index: ip_rpcb_pxy.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_rpcb_pxy.c,v retrieving revision 1.15 retrieving revision 1.16 diff -C2 -d -r1.15 -r1.16 *** ip_rpcb_pxy.c 13 Jul 2012 06:38:23 -0000 1.15 --- ip_rpcb_pxy.c 20 Jul 2012 07:58:06 -0000 1.16 *************** *** 149,155 **** rpcb_session_t *rs; - fin = fin; /* LINT */ nat = nat; /* LINT */ KMALLOC(rs, rpcb_session_t *); if (rs == NULL) --- 149,157 ---- rpcb_session_t *rs; nat = nat; /* LINT */ + if (fin->fin_v != 4) + return -1; + KMALLOC(rs, rpcb_session_t *); if (rs == NULL) Index: ip_dns_pxy.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_dns_pxy.c,v retrieving revision 1.5 retrieving revision 1.6 diff -C2 -d -r1.5 -r1.6 *** ip_dns_pxy.c 29 Jan 2012 05:31:05 -0000 1.5 --- ip_dns_pxy.c 20 Jul 2012 07:58:06 -0000 1.6 *************** *** 184,187 **** --- 184,190 ---- int dlen; + if (fin->fin_v != 4) + return -1; + dlen = fin->fin_dlen - sizeof(udphdr_t); if (dlen < sizeof(ipf_dns_hdr_t)) { |
From: Darren <dar...@us...> - 2012-07-20 07:54:13
|
Update of /cvsroot/ipfilter/ipfilter In directory vz-cvs-4.sog:/tmp/cvs-serv27959 Modified Files: Tag: v5-1-RELEASE ip_nat.c ip_nat6.c Log Message: 3545323 NAT updates the source port twice 3545322 ipv6 nat rules cannot start proxies 3544314 bucket copyout tries to copy too much data 3544313 remove nat encap feature Index: ip_nat6.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_nat6.c,v retrieving revision 1.22.2.18 retrieving revision 1.22.2.19 diff -C2 -d -r1.22.2.18 -r1.22.2.19 *** ip_nat6.c 13 Jul 2012 06:39:03 -0000 1.22.2.18 --- ip_nat6.c 20 Jul 2012 07:54:11 -0000 1.22.2.19 *************** *** 121,127 **** static int ipf_nat6_nextaddr __P((fr_info_t *, nat_addr_t *, i6addr_t *, i6addr_t *)); - static int ipf_nat6_encapok __P((fr_info_t *, nat_t *)); - static int ipf_nat6_matchencap __P((fr_info_t *, ipnat_t *)); - static nat_t *ipf_nat6_rebuildencapicmp __P((fr_info_t *, nat_t *)); static int ipf_nat6_icmpquerytype __P((int)); static int ipf_nat6_out __P((fr_info_t *, nat_t *, int, u_32_t)); --- 121,124 ---- *************** *** 201,205 **** return error; ! if (n->in_redir & (NAT_ENCAP|NAT_DIVERTUDP)) ipf_nat6_builddivertmp(softn, n); return 0; --- 198,202 ---- return error; ! if (n->in_redir & NAT_DIVERTUDP) ipf_nat6_builddivertmp(softn, n); return 0; *************** *** 365,437 **** /* ------------------------------------------------------------------------ */ - /* Function: ipf_nat6_addencap */ - /* Returns: Nil */ - /* Parameters: n(I) - pointer to NAT rule to add */ - /* */ - /* Here we add in a pointer in the NAT rules hash table to match reply */ - /* packets that are encapsulated. For encap rules that are "out", what we */ - /* will want to match upon will be the source address in the encap rule as */ - /* this is what will become the destination in packets coming back to us. */ - /* For encaps pointing in, it is still the same because it is still the */ - /* reply packet we want to match. */ - /* ------------------------------------------------------------------------ */ - void - ipf_nat6_addencap(softn, n) - ipf_nat_softc_t *softn; - ipnat_t *n; - { - ipnat_t **np; - u_32_t j; - u_int hv; - int k; - - k = -1; - - /* - * It is the new source address we're after... - */ - if (n->in_nsrcatype == FRI_NORMAL) { - k = count6bits(n->in_nsrcip6.i6); - IP6_AND(&n->in_nsrcip6, &n->in_nsrcip6, &j); - hv = NAT_HASH_FN6(&j, 0, softn->ipf_nat_maprules_sz); - } else { - k = 0; - j = 0; - hv = 0; - } - - /* - * And place the rules table entry in the reverse spot, so for out - * we use the rdr-links and for rdr, we use the map-links/ - */ - if (n->in_redir & NAT_MAP) { - ipf_inet6_mask_add(k, &n->in_nsrcip6, - &softn->ipf_nat6_rdr_mask); - np = softn->ipf_nat_rdr_rules + hv; - while (*np != NULL) - np = &(*np)->in_rnext; - n->in_rnext = NULL; - n->in_prnext = np; - n->in_hv[0] = hv; - n->in_use++; - *np = n; - } else if (n->in_redir & NAT_REDIRECT) { - ipf_inet6_mask_add(k, &n->in_nsrcip6, - &softn->ipf_nat6_map_mask); - np = softn->ipf_nat_map_rules + hv; - while (*np != NULL) - np = &(*np)->in_mnext; - n->in_mnext = NULL; - n->in_pmnext = np; - n->in_hv[1] = hv; - n->in_use++; - *np = n; - } - - /* TRACE(n, hv, k) */ - } - - - /* ------------------------------------------------------------------------ */ /* Function: ipf_nat6_hostmap */ /* Returns: struct hostmap* - NULL if no hostmap could be created, */ --- 362,365 ---- *************** *** 1039,1042 **** --- 967,971 ---- hostmap_t *hm = NULL; nat_t *nat, *natl; + natstat_t *nsp; u_int nflags; natinfo_t ni; *************** *** 1046,1055 **** #endif ! if ((softn->ipf_nat_stats.ns_active * 100 / softn->ipf_nat_table_max) > softn->ipf_nat_table_wm_high) { softn->ipf_nat_doflush = 1; } ! if (softn->ipf_nat_stats.ns_active >= softn->ipf_nat_table_max) { NBUMPSIDE6(fin->fin_out, ns_table_max); return NULL; --- 975,986 ---- #endif ! nsp = &softn->ipf_nat_stats; ! ! if ((nsp->ns_active * 100 / softn->ipf_nat_table_max) > softn->ipf_nat_table_wm_high) { softn->ipf_nat_doflush = 1; } ! if (nsp->ns_active >= softn->ipf_nat_table_max) { NBUMPSIDE6(fin->fin_out, ns_table_max); return NULL; *************** *** 1075,1081 **** */ if ((softn->ipf_nat_table_max > softn->ipf_nat_table_sz) && ! (softn->ipf_nat_stats.ns_active > 100)) { ! softn->ipf_nat_table_max = ! softn->ipf_nat_stats.ns_active - 100; printf("table_max reduced to %d\n", softn->ipf_nat_table_max); --- 1006,1011 ---- */ if ((softn->ipf_nat_table_max > softn->ipf_nat_table_sz) && ! (nsp->ns_active > 100)) { ! softn->ipf_nat_table_max = nsp->ns_active - 100; printf("table_max reduced to %d\n", softn->ipf_nat_table_max); *************** *** 1113,1117 **** * if there is none found. */ ! if (np->in_redir & (NAT_ENCAP|NAT_DIVERTUDP)) { move = ipf_nat6_newdivert(fin, nat, &ni); --- 1043,1047 ---- * if there is none found. */ ! if (np->in_redir & NAT_DIVERTUDP) { move = ipf_nat6_newdivert(fin, nat, &ni); *************** *** 1160,1169 **** nat->nat_rev = fin->fin_rev; nat->nat_ptr = np; ! #ifdef IPF_V6_PROXIES ! if ((np->in_apr != NULL) && ((nat->nat_flags & NAT_SLAVE) == 0)) ! if (appr_new(fin, nat) == -1) goto badnat; ! #endif nat->nat_ifps[0] = np->in_ifps[0]; --- 1090,1101 ---- nat->nat_rev = fin->fin_rev; nat->nat_ptr = np; + nat->nat_dlocal = np->in_dlocal; ! if ((np->in_apr != NULL) && ((nat->nat_flags & NAT_SLAVE) == 0)) { ! if (ipf_proxy_new(fin, nat) == -1) { ! NBUMPSIDE6D(fin->fin_out, ns_appr_fail); goto badnat; ! } ! } nat->nat_ifps[0] = np->in_ifps[0]; *************** *** 1194,1198 **** if (flags & SI_WILDP) ! softn->ipf_nat_stats.ns_wilds++; softn->ipf_nat_stats.ns_proto[nat->nat_pr[0]]++; --- 1126,1130 ---- if (flags & SI_WILDP) ! nsp->ns_wilds++; softn->ipf_nat_stats.ns_proto[nat->nat_pr[0]]++; *************** *** 1205,1208 **** --- 1137,1144 ---- nat = NULL; done: + if (nat != NULL && np != NULL) + np->in_hits++; + if (natsave != NULL) + *natsave = nat; return nat; } *************** *** 1324,1327 **** --- 1260,1265 ---- * nat6_insert failed, so cleanup time... */ + if (nat->nat_sync != NULL) + ipf_sync_del_nat(softc->ipf_sync_soft, nat->nat_sync); return -1; } *************** *** 1679,1694 **** } - if (nat->nat_dir == NAT_ENCAPIN || nat->nat_dir == NAT_ENCAPOUT) { - /* - * For ICMP replies to encapsulated packets, we need to - * rebuild the ICMP reply completely to match the original - * packet... - */ - if (ipf_nat6_rebuildencapicmp(fin, nat) == 0) - return nat; - NBUMPSIDE6D(fin->fin_out, ns_icmp_rebuild); - return NULL; - } - tcp = NULL; csump = NULL; --- 1617,1620 ---- *************** *** 2248,2253 **** softn->ipf_nat_table_sz); ! if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_ENCAPIN || ! nat->nat_dir == NAT_DIVERTIN) { u_int swap; --- 2174,2178 ---- softn->ipf_nat_table_sz); ! if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) { u_int swap; *************** *** 2624,2630 **** int match; - if ((fin->fin_p == IPPROTO_IPIP) && (np->in_redir & NAT_ENCAP)) - return ipf_nat6_matchencap(fin, np); - match = 0; switch (np->in_osrcatype) --- 2549,2552 ---- *************** *** 2897,2901 **** ipf_nat_softc_t *softn = softc->ipf_nat_soft; struct icmp6_hdr *icmp6; - u_short *csump; tcphdr_t *tcp; ipnat_t *np; --- 2819,2822 ---- *************** *** 2905,2909 **** tcp = NULL; icmp6 = NULL; - csump = NULL; np = nat->nat_ptr; --- 2826,2829 ---- *************** *** 2933,2938 **** break; - case NAT_ENCAPIN : - fin->fin_flx |= FI_ENCAP; case NAT_DIVERTIN : { --- 2853,2856 ---- *************** *** 2969,3003 **** } - case NAT_ENCAPOUT : - { - ip6_t *ip6; - mb_t *m; - - if (ipf_nat6_encapok(fin, nat) == -1) - return -1; - - m = M_DUP(np->in_divmp); - if (m == NULL) { - NBUMPSIDE6D(1, ns_encap_dup); - return -1; - } - - ip6 = MTOD(m, ip6_t *); - /* TRACE (fin,ip) */ - ip6->ip6_plen = htons(fin->fin_plen + sizeof(ip6_t)); - - /* TRACE (ip) */ - - PREP_MB_T(fin, m); - - fin->fin_ip6 = ip6; - fin->fin_plen += sizeof(ip6_t); /* UDP + new IPv6 hdr */ - fin->fin_dlen += sizeof(ip6_t); /* UDP + old IPv6 hdr */ - fin->fin_flx |= FI_ENCAP; - - nflags &= ~IPN_TCPUDPICMP; - - break; - } case NAT_DIVERTOUT : { --- 2887,2890 ---- *************** *** 3035,3038 **** --- 2922,2927 ---- if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { + u_short *csump; + if ((nat->nat_nsport != 0) && (nflags & IPN_TCPUDP)) { tcp = fin->fin_dp; *************** *** 3044,3048 **** fin->fin_data[0] = ntohs(nat->nat_nsport); tcp->th_dport = nat->nat_ndport; ! fin->fin_data[0] = ntohs(nat->nat_ndport); break; --- 2933,2937 ---- fin->fin_data[0] = ntohs(nat->nat_nsport); tcp->th_dport = nat->nat_ndport; ! fin->fin_data[1] = ntohs(nat->nat_ndport); break; *************** *** 3051,3055 **** fin->fin_data[0] = ntohs(nat->nat_odport); tcp->th_dport = nat->nat_osport; ! fin->fin_data[0] = ntohs(nat->nat_osport); break; } --- 2940,2944 ---- fin->fin_data[0] = ntohs(nat->nat_odport); tcp->th_dport = nat->nat_osport; ! fin->fin_data[1] = ntohs(nat->nat_osport); break; } *************** *** 3062,3102 **** csump = ipf_nat_proto(fin, nat, nflags); - } ! /* ! * The above comments do not hold for layer 4 (or higher) checksums... ! */ ! if (csump != NULL) { ! if (nat->nat_dir == NAT_OUTBOUND) ! ipf_fix_outcksum(fin->fin_cksum, csump, ! nat->nat_sumd[0], ! nat->nat_sumd[1] + fin->fin_dlen); ! else ! ipf_fix_incksum(fin->fin_cksum, csump, ! nat->nat_sumd[0], ! nat->nat_sumd[1] + fin->fin_dlen); } ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync); /* ------------------------------------------------------------- */ ! /* A few quick notes: */ ! /* Following are test conditions prior to calling the */ ! /* appr_check routine. */ ! /* */ ! /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ ! /* with a redirect rule, we attempt to match the packet's */ ! /* source port against in_dport, otherwise we'd compare the */ ! /* packet's destination. */ /* ------------------------------------------------------------- */ if ((np != NULL) && (np->in_apr != NULL)) { ! #ifdef IPF_V6_PROXIES ! i = appr_check(fin, nat); ! if (i == 0) i = 1; ! else if (i == -1) { NBUMPSIDE6D(1, ns_ipf_proxy_fail); } - #else - i = 1; - #endif } else { i = 1; --- 2951,2991 ---- csump = ipf_nat_proto(fin, nat, nflags); ! /* ! * The above comments do not hold for layer 4 (or higher) ! * checksums... ! */ ! if (csump != NULL) { ! if (nat->nat_dir == NAT_OUTBOUND) ! ipf_fix_outcksum(fin->fin_cksum, csump, ! nat->nat_sumd[0], ! nat->nat_sumd[1] + ! fin->fin_dlen); ! else ! ipf_fix_incksum(fin->fin_cksum, csump, ! nat->nat_sumd[0], ! nat->nat_sumd[1] + ! fin->fin_dlen); ! } } + ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync); /* ------------------------------------------------------------- */ ! /* A few quick notes: */ ! /* Following are test conditions prior to calling the */ ! /* ipf_proxy_check routine. */ ! /* */ ! /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ ! /* with a redirect rule, we attempt to match the packet's */ ! /* source port against in_dport, otherwise we'd compare the */ ! /* packet's destination. */ /* ------------------------------------------------------------- */ if ((np != NULL) && (np->in_apr != NULL)) { ! i = ipf_proxy_check(fin, nat); ! if (i == 0) { i = 1; ! } else if (i == -1) { NBUMPSIDE6D(1, ns_ipf_proxy_fail); } } else { i = 1; *************** *** 3335,3338 **** --- 3224,3228 ---- ipnat_t *np; int skip; + int i; tcp = NULL; *************** *** 3346,3366 **** /* ------------------------------------------------------------- */ ! /* A few quick notes: */ ! /* Following are test conditions prior to calling the */ ! /* appr_check routine. */ ! /* */ ! /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ ! /* with a map rule, we attempt to match the packet's */ ! /* source port against in_dport, otherwise we'd compare the */ ! /* packet's destination. */ /* ------------------------------------------------------------- */ if (np->in_apr != NULL) { ! #ifdef IPF_V6_PROXIES ! i = appr_check(fin, nat); if (i == -1) { NBUMPSIDE6D(0, ns_ipf_proxy_fail); return -1; } - #endif } } --- 3236,3254 ---- /* ------------------------------------------------------------- */ ! /* A few quick notes: */ ! /* Following are test conditions prior to calling the */ ! /* ipf_proxy_check routine. */ ! /* */ ! /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ ! /* with a map rule, we attempt to match the packet's */ ! /* source port against in_dport, otherwise we'd compare the */ ! /* packet's destination. */ /* ------------------------------------------------------------- */ if (np->in_apr != NULL) { ! i = ipf_proxy_check(fin, nat); if (i == -1) { NBUMPSIDE6D(0, ns_ipf_proxy_fail); return -1; } } } *************** *** 3399,3440 **** break; - case NAT_ENCAPIN : - { - ip6_t *ip6; - mb_t *m; - - /* - * XXX - * This is not necessarily true. What we need to know here - * is the MTU of the interface out which the packets will go - * and this won't be nat6_ifps[1] because that is where we - * send packets after stripping off stuff - what's needed - * here is the MTU of the interface for the route to the - * destination of the outer header. - */ - if (ipf_nat6_encapok(fin, nat) == -1) - return -1; - - m = M_DUP(np->in_divmp); - if (m == NULL) { - NBUMPSIDE6D(0, ns_encap_dup); - return -1; - } - - ip6 = MTOD(m, ip6_t *); - ip6->ip6_plen = htons(fin->fin_plen + 8); - - PREP_MB_T(fin, m); - - fin->fin_ip6 = ip6; - fin->fin_plen += sizeof(ip6_t) + 8; /* UDP + new IPv6 hdr */ - fin->fin_dlen += sizeof(ip6_t) + 8; /* UDP + old IPv6 hdr */ - fin->fin_flx |= FI_ENCAP; - - nflags &= ~IPN_TCPUDPICMP; - - break; - } - case NAT_DIVERTIN : { --- 3287,3290 ---- *************** *** 3466,3471 **** } - case NAT_ENCAPOUT : - fin->fin_flx |= FI_ENCAP; case NAT_DIVERTOUT : { --- 3316,3319 ---- *************** *** 3791,3796 **** /* Write Lock: ipf_nat */ /* */ ! /* Create a new NAT encap/divert session as defined by the NAT rule. This */ ! /* is somewhat different to other NAT session creation routines because we */ /* do not iterate through either port numbers or IP addresses, searching */ /* for a unique mapping, however, a complimentary duplicate check is made. */ --- 3639,3644 ---- /* Write Lock: ipf_nat */ /* */ ! /* Create a new NAT divert session as defined by the NAT rule. This is */ ! /* somewhat different to other NAT session creation routines because we */ /* do not iterate through either port numbers or IP addresses, searching */ /* for a unique mapping, however, a complimentary duplicate check is made. */ *************** *** 3853,3867 **** nat->nat_pr[1 - fin->fin_out] = p; ! if (np->in_redir & NAT_ENCAP) { ! if (np->in_redir & NAT_REDIRECT) ! nat->nat_dir = NAT_ENCAPIN; ! else ! nat->nat_dir = NAT_ENCAPOUT; ! } else { ! if (np->in_redir & NAT_REDIRECT) ! nat->nat_dir = NAT_DIVERTIN; ! else ! nat->nat_dir = NAT_DIVERTOUT; ! } return 0; --- 3701,3708 ---- nat->nat_pr[1 - fin->fin_out] = p; ! if (np->in_redir & NAT_REDIRECT) ! nat->nat_dir = NAT_DIVERTIN; ! else ! nat->nat_dir = NAT_DIVERTOUT; return 0; *************** *** 3874,3880 **** /* Parameters: np(I) - pointer to a NAT rule */ /* */ ! /* For encap/divert rules, a skeleton packet representing what will be */ ! /* prepended to the real packet is created. Even though we don't have the */ ! /* full packet here, a checksum is calculated that we update later when we */ /* fill in the final details. At present a 0 checksum for UDP is being set */ /* here because it is expected that divert will be used for localhost. */ --- 3715,3721 ---- /* Parameters: np(I) - pointer to a NAT rule */ /* */ ! /* For divert rules, a skeleton packet representing what will be prepended */ ! /* to the real packet is created. Even though we don't have the full */ ! /* packet here, a checksum is calculated that we update later when we */ /* fill in the final details. At present a 0 checksum for UDP is being set */ /* here because it is expected that divert will be used for localhost. */ *************** *** 4013,4147 **** /* ------------------------------------------------------------------------ */ - /* Function: nat6_matchencap */ - /* Returns: int - -1 == packet error, 1 == success, 0 = no match */ - /* Parameters: fin(I) - pointer to packet information */ - /* np(I) - pointer to a NAT rule */ - /* */ - /* To properly compare a packet travelling in the reverse direction to an */ - /* encap rule, it needs to be pseudo-decapsulated so we can check if a */ - /* reply to it would be encapsulated. In doing this, we have to be careful */ - /* so as not to actually do any decapsulation nor affect any of the current */ - /* stored parameters in "fin" so that we can continue processing it else- */ - /* where if it doesn't match. */ - /* ------------------------------------------------------------------------ */ - static int - ipf_nat6_matchencap(fin, np) - fr_info_t *fin; - ipnat_t *np; - { - ipf_main_softc_t *softc = fin->fin_main_soft; - ipf_nat_softc_t *softn = softc->ipf_nat_soft; - int match, skip; - u_short *ports; - frtuc_t *ft; - fr_ip_t fi; - ip6_t *ip6; - char *hdr; - mb_t *m; - - /* - * This function is only for matching packets that are appearing from - * the reverse direction against "encap" rules. - */ - if (fin->fin_out == 1) { - if ((np->in_redir & NAT_REDIRECT) == 0) - return 0; - } else { - if ((np->in_redir & NAT_MAP) == 0) - return 0; - } - if (np->in_pr[fin->fin_out] != fin->fin_p) - return 0; - - /* - * The aim here is to keep the original packet details in "fin" for - * as long as possible so that returning with an error is for the - * original packet and there is little undoing work to do. - */ - m = fin->fin_m; - skip = fin->fin_hlen; - if (M_LEN(m) < skip + sizeof(ip6_t)) { - if (ipf_pr_pullup(fin, sizeof(ip6_t)) == -1) { - NBUMPSIDE6D(fin->fin_out, ns_encap_pullup); - return -1; - } - } - - hdr = MTOD(fin->fin_m, char *); - ip6 = (ip6_t *)(hdr + skip); - - match = 1; - - /* - * Now we should have the entire innder header, so match up the - * address fields - easy enough. Reverse matching of source and - * destination because this is purportedly a "reply" to an encap rule. - */ - switch (np->in_osrcatype) - { - case FRI_NORMAL : - match = IP6_MASKNEQ(&ip6->ip6_dst, &np->in_osrcmsk6, - &np->in_osrcip6); - break; - case FRI_LOOKUP : - match = (*np->in_osrcfunc)(softc, np->in_osrcptr, np->in_v[0], - &ip6->ip6_dst, fin->fin_plen); - break; - } - if (match) - return 0; - - switch (np->in_odstatype) - { - case FRI_NORMAL : - match = IP6_MASKNEQ(&ip6->ip6_src, &np->in_odstmsk6, - &np->in_odstip6); - break; - case FRI_LOOKUP : - match = (*np->in_odstfunc)(softc, np->in_odstptr, np->in_v[0], - &ip6->ip6_src, fin->fin_plen); - break; - } - if (match) - return 0; - - ft = &np->in_tuc; - - switch (ip6->ip6_nxt) - { - case IPPROTO_TCP : - case IPPROTO_UDP : - /* - * Only need to fetch port numbers for NAT - */ - if (ipf_pr_pullup(fin, sizeof(ip6_t) + 4) == -1) { - NBUMPSIDE6(fin->fin_out, ns_encap_pullup); - return -1; - } - - ports = (u_short *)((char *)ip6 + sizeof(ip6_t)); - - fi.fi_tcpf = 0; - /* - * And again, because we're simulating a reply, put the port - * numbers in the revese place to where they are now. - */ - fi.fi_ports[0] = ntohs(ports[1]); - fi.fi_ports[1] = ntohs(ports[0]); - return ipf_tcpudpchk(&fi, ft); - - /* NOTREACHED */ - - default : - if (ft->ftu_scmp || ft->ftu_dcmp) - return 0; - break; - } - - return 1; - } - - - /* ------------------------------------------------------------------------ */ /* Function: nat6_nextaddr */ /* Returns: int - -1 == bad input (no new address), */ --- 3854,3857 ---- *************** *** 4345,4520 **** /* ------------------------------------------------------------------------ */ - /* Function: nat6_encapok */ - /* Returns: int - -1 == MTU not big enough, 0 == ok to send packet */ - /* Parameters: fin(I) - pointer to packet information */ - /* nat(I) - pointer to current NAT session */ - /* */ - /* The purpose of this function is to determine whether or not a packet can */ - /* be sent out of a network interface after it has been encapsulated, before*/ - /* the actual encapsulation happens. If it cannot - because the "Don't */ - /* fragment" bit has been set - then generate an ICMP error message back to */ - /* the origin of the packet, informing it that the packet is too big and */ - /* what the actual MTU out for the connection is. */ - /* */ - /* At present the only question this would leave for strange behaviour is */ - /* with local connections that will go out an encapsulation as sending of */ - /* ICMP messages to local destinations isn't considered robust. */ - /* ------------------------------------------------------------------------ */ - static int - ipf_nat6_encapok(fin, nat) - fr_info_t *fin; - nat_t *nat; - { - #ifdef INSTANCES - ipf_main_softc_t *softc = fin->fin_main_soft; /* For GETIFMTU_6 */ - #endif - void *sifp; - ipnat_t *n; - int extra; - int mtu; - - n = nat->nat_ptr; - - if (n->in_redir & NAT_ENCAP) { - extra = sizeof(ip6_t); - - } else { - return 0; - } - - mtu = GETIFMTU_6(nat->nat_ifps[1]); - - if (fin->fin_plen + extra < mtu) - return 0; - - sifp = fin->fin_ifp; - fin->fin_ifp = NULL; - fin->fin_icode = 0; - fin->fin_mtu = mtu - extra; - - (void) ipf_send_icmp_err(ICMP6_PACKET_TOO_BIG, fin, 1); - - fin->fin_mtu = 0; - - return -1; - } - - - /* ------------------------------------------------------------------------ */ - /* Function: ipf_nat6_rebuildencapicmp */ - /* Returns: int - -1 == error, 0 == success */ - /* Parameters: fin(I) - pointer to packet information */ - /* nat(I) - pointer to current NAT session */ - /* */ - /* For ICMP replies received in response to packets we've encapsulated on */ - /* the way out, we need to replace all of the addressing fields found in */ - /* the data section of the ICMP header. The ICMP packet is going to */ - /* contain the the IP packet we sent out (IPENCAP) plus at least 64 bits of */ - /* the original IP packet - not something that will be of use to the origin */ - /* of the offending packet. */ - /* ------------------------------------------------------------------------ */ - static nat_t * - ipf_nat6_rebuildencapicmp(fin, nat) - fr_info_t *fin; - nat_t *nat; - { - struct icmp6_hdr *icmp6; - udphdr_t *udp; - ip6_t *oip6; - int p; - - icmp6 = fin->fin_dp; - oip6 = (ip6_t *)((u_char *)icmp6 + sizeof(*icmp6)); - - if (fin->fin_out == 0) { - if (nat->nat_dir == NAT_ENCAPIN) { - oip6->ip6_src = nat->nat_odst6.in6; - oip6->ip6_dst = nat->nat_osrc6.in6; - } else { - oip6->ip6_src = nat->nat_osrc6.in6; - oip6->ip6_dst = nat->nat_odst6.in6; - } - } else { - if (nat->nat_dir == NAT_ENCAPIN) { - oip6->ip6_src = nat->nat_osrc6.in6; - oip6->ip6_dst = nat->nat_odst6.in6; - } else { - oip6->ip6_src = nat->nat_odst6.in6; - oip6->ip6_dst = nat->nat_osrc6.in6; - } - } - - udp = (udphdr_t *)(oip6 + 1); - - /* - * We use nat6_p here because the original UDP header is quite likely - * to have been lost - the error packet returned contains the outer - * encapsulation header plus 64 bits of the inner IP header, no room - * for a UDP or TCP header unless extra data is returned. - * - * XXX - If the entire original packet has been included (possible) - * then we should be just stripping off the outer encapsulation. - * This is a "todo" for the near future. - */ - p = nat->nat_pr[1 - fin->fin_out]; - - switch (p) - { - case IPPROTO_UDP : - udp->uh_sum = 0; - break; - case IPPROTO_TCP : - /* - * NAT doesn't track the sequence number so we can't pretend - * to know what value this field should carry. - */ - ((tcphdr_t *)udp)->th_seq = 0; - break; - default : - break; - } - - if (p == IPPROTO_TCP || p == IPPROTO_UDP) { - if (fin->fin_out == 0) { - if (nat->nat_dir == NAT_ENCAPIN) { - udp->uh_sport = nat->nat_odport; - udp->uh_dport = nat->nat_osport; - } else { - udp->uh_sport = nat->nat_osport; - udp->uh_dport = nat->nat_odport; - } - } else { - if (nat->nat_dir == NAT_ENCAPIN) { - udp->uh_sport = nat->nat_osport; - udp->uh_dport = nat->nat_odport; - } else { - udp->uh_sport = nat->nat_odport; - udp->uh_dport = nat->nat_osport; - } - } - } - - /* TRACE (fin,oip,udp,icmp6) */ - oip6->ip6_nxt = nat->nat_pr[1 - fin->fin_out]; - - /* - * Reduce the next MTU setting by the size of the encap header - */ - if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG) { - icmp6->icmp6_mtu = ntohs(icmp6->icmp6_mtu); - icmp6->icmp6_mtu -= sizeof(ip6_t); - icmp6->icmp6_mtu = htons(icmp6->icmp6_mtu); - } - - icmp6->icmp6_cksum = 0; - icmp6->icmp6_cksum = ipf_cksum((u_short *)icmp6, fin->fin_dlen); - - /* TRACE (fin,oip,udp,icmp6) */ - - return 0; - } - - - /* ------------------------------------------------------------------------ */ /* Function: ipf_nat6_icmpquerytype */ /* Returns: int - 1 == success, 0 == failure */ --- 4055,4058 ---- Index: ip_nat.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_nat.c,v retrieving revision 1.60.2.39 retrieving revision 1.60.2.40 diff -C2 -d -r1.60.2.39 -r1.60.2.40 *** ip_nat.c 13 Jul 2012 12:25:35 -0000 1.60.2.39 --- ip_nat.c 20 Jul 2012 07:54:11 -0000 1.60.2.40 *************** *** 6,12 **** #if defined(KERNEL) || defined(_KERNEL) # undef KERNEL ! # undef ipf_nat_KERNEL # define KERNEL 1 - # define ipf_nat_KERNEL 1 #endif #include <sys/errno.h> --- 6,12 ---- #if defined(KERNEL) || defined(_KERNEL) # undef KERNEL [...1019 lines suppressed...] --- 8272,8290 ---- continue; ! if (np->in_redir & NAT_REDIRECT) { ! np->in_rnext = NULL; ! hv = np->in_hv[0] % newsize; ! for (npp = newtab + hv; *npp != NULL; ) ! npp = &(*npp)->in_rnext; ! np->in_prnext = npp; ! *npp = np; ! } ! if (np->in_redir & NAT_MAP) { ! np->in_mnext = NULL; ! hv = np->in_hv[1] % newsize; ! for (npp = newtab + hv; *npp != NULL; ) ! npp = &(*npp)->in_mnext; ! np->in_pmnext = npp; ! *npp = np; } |
From: Darren <dar...@us...> - 2012-07-20 07:53:54
|
Update of /cvsroot/ipfilter/ipfilter In directory vz-cvs-4.sog:/tmp/cvs-serv27946 Modified Files: ip_nat.c ip_nat6.c Log Message: 3545323 NAT updates the source port twice 3545322 ipv6 nat rules cannot start proxies 3544314 bucket copyout tries to copy too much data 3544313 remove nat encap feature Index: ip_nat6.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_nat6.c,v retrieving revision 1.38 retrieving revision 1.39 diff -C2 -d -r1.38 -r1.39 *** ip_nat6.c 13 Jul 2012 11:54:41 -0000 1.38 --- ip_nat6.c 20 Jul 2012 07:53:52 -0000 1.39 *************** *** 121,127 **** static int ipf_nat6_nextaddr(fr_info_t *, nat_addr_t *, i6addr_t *, i6addr_t *); - static int ipf_nat6_encapok(fr_info_t *, nat_t *); - static int ipf_nat6_matchencap(fr_info_t *, ipnat_t *); - static nat_t *ipf_nat6_rebuildencapicmp(fr_info_t *, nat_t *); static int ipf_nat6_icmpquerytype(int); static int ipf_nat6_out(fr_info_t *, nat_t *, int, u_32_t); --- 121,124 ---- *************** *** 200,204 **** return error; ! if (n->in_redir & (NAT_ENCAP|NAT_DIVERTUDP)) ipf_nat6_builddivertmp(softn, n); return 0; --- 197,201 ---- return error; ! if (n->in_redir & NAT_DIVERTUDP) ipf_nat6_builddivertmp(softn, n); return 0; *************** *** 364,436 **** /* ------------------------------------------------------------------------ */ - /* Function: ipf_nat6_addencap */ - /* Returns: Nil */ - /* Parameters: n(I) - pointer to NAT rule to add */ - /* */ - /* Here we add in a pointer in the NAT rules hash table to match reply */ - /* packets that are encapsulated. For encap rules that are "out", what we */ - /* will want to match upon will be the source address in the encap rule as */ - /* this is what will become the destination in packets coming back to us. */ - /* For encaps pointing in, it is still the same because it is still the */ - /* reply packet we want to match. */ - /* ------------------------------------------------------------------------ */ - void - ipf_nat6_addencap(softn, n) - ipf_nat_softc_t *softn; - ipnat_t *n; - { - ipnat_t **np; - u_32_t j; - u_int hv; - int k; - - k = -1; - - /* - * It is the new source address we're after... - */ - if (n->in_nsrcatype == FRI_NORMAL) { - k = count6bits(n->in_nsrcip6.i6); - IP6_AND(&n->in_nsrcip6, &n->in_nsrcip6, &j); - hv = NAT_HASH_FN6(&j, 0, softn->ipf_nat_maprules_sz); - } else { - k = 0; - j = 0; - hv = 0; - } - - /* - * And place the rules table entry in the reverse spot, so for out - * we use the rdr-links and for rdr, we use the map-links/ - */ - if (n->in_redir & NAT_MAP) { - ipf_inet6_mask_add(k, &n->in_nsrcip6, - &softn->ipf_nat6_rdr_mask); - np = softn->ipf_nat_rdr_rules + hv; - while (*np != NULL) - np = &(*np)->in_rnext; - n->in_rnext = NULL; - n->in_prnext = np; - n->in_hv[0] = hv; - n->in_use++; - *np = n; - } else if (n->in_redir & NAT_REDIRECT) { - ipf_inet6_mask_add(k, &n->in_nsrcip6, - &softn->ipf_nat6_map_mask); - np = softn->ipf_nat_map_rules + hv; - while (*np != NULL) - np = &(*np)->in_mnext; - n->in_mnext = NULL; - n->in_pmnext = np; - n->in_hv[1] = hv; - n->in_use++; - *np = n; - } - - /* TRACE(n, hv, k) */ - } - - - /* ------------------------------------------------------------------------ */ /* Function: ipf_nat6_hostmap */ /* Returns: struct hostmap* - NULL if no hostmap could be created, */ --- 361,364 ---- *************** *** 1038,1041 **** --- 966,970 ---- hostmap_t *hm = NULL; nat_t *nat, *natl; + natstat_t *nsp; u_int nflags; natinfo_t ni; *************** *** 1045,1054 **** #endif ! if ((softn->ipf_nat_stats.ns_active * 100 / softn->ipf_nat_table_max) > softn->ipf_nat_table_wm_high) { softn->ipf_nat_doflush = 1; } ! if (softn->ipf_nat_stats.ns_active >= softn->ipf_nat_table_max) { NBUMPSIDE6(fin->fin_out, ns_table_max); return NULL; --- 974,985 ---- #endif ! nsp = &softn->ipf_nat_stats; ! ! if ((nsp->ns_active * 100 / softn->ipf_nat_table_max) > softn->ipf_nat_table_wm_high) { softn->ipf_nat_doflush = 1; } ! if (nsp->ns_active >= softn->ipf_nat_table_max) { NBUMPSIDE6(fin->fin_out, ns_table_max); return NULL; *************** *** 1074,1080 **** */ if ((softn->ipf_nat_table_max > softn->ipf_nat_table_sz) && ! (softn->ipf_nat_stats.ns_active > 100)) { ! softn->ipf_nat_table_max = ! softn->ipf_nat_stats.ns_active - 100; printf("table_max reduced to %d\n", softn->ipf_nat_table_max); --- 1005,1010 ---- */ if ((softn->ipf_nat_table_max > softn->ipf_nat_table_sz) && ! (nsp->ns_active > 100)) { ! softn->ipf_nat_table_max = nsp->ns_active - 100; printf("table_max reduced to %d\n", softn->ipf_nat_table_max); *************** *** 1112,1116 **** * if there is none found. */ ! if (np->in_redir & (NAT_ENCAP|NAT_DIVERTUDP)) { move = ipf_nat6_newdivert(fin, nat, &ni); --- 1042,1046 ---- * if there is none found. */ ! if (np->in_redir & NAT_DIVERTUDP) { move = ipf_nat6_newdivert(fin, nat, &ni); *************** *** 1159,1168 **** nat->nat_rev = fin->fin_rev; nat->nat_ptr = np; ! #ifdef IPF_V6_PROXIES ! if ((np->in_apr != NULL) && ((nat->nat_flags & NAT_SLAVE) == 0)) ! if (appr_new(fin, nat) == -1) goto badnat; ! #endif nat->nat_ifps[0] = np->in_ifps[0]; --- 1089,1100 ---- nat->nat_rev = fin->fin_rev; nat->nat_ptr = np; + nat->nat_dlocal = np->in_dlocal; ! if ((np->in_apr != NULL) && ((nat->nat_flags & NAT_SLAVE) == 0)) { ! if (ipf_proxy_new(fin, nat) == -1) { ! NBUMPSIDE6D(fin->fin_out, ns_appr_fail); goto badnat; ! } ! } nat->nat_ifps[0] = np->in_ifps[0]; *************** *** 1193,1197 **** if (flags & SI_WILDP) ! softn->ipf_nat_stats.ns_wilds++; softn->ipf_nat_stats.ns_proto[nat->nat_pr[0]]++; --- 1125,1129 ---- if (flags & SI_WILDP) ! nsp->ns_wilds++; softn->ipf_nat_stats.ns_proto[nat->nat_pr[0]]++; *************** *** 1204,1207 **** --- 1136,1143 ---- nat = NULL; done: + if (nat != NULL && np != NULL) + np->in_hits++; + if (natsave != NULL) + *natsave = nat; return nat; } *************** *** 1323,1326 **** --- 1259,1264 ---- * nat6_insert failed, so cleanup time... */ + if (nat->nat_sync != NULL) + ipf_sync_del_nat(softc->ipf_sync_soft, nat->nat_sync); return -1; } *************** *** 1678,1693 **** } - if (nat->nat_dir == NAT_ENCAPIN || nat->nat_dir == NAT_ENCAPOUT) { - /* - * For ICMP replies to encapsulated packets, we need to - * rebuild the ICMP reply completely to match the original - * packet... - */ - if (ipf_nat6_rebuildencapicmp(fin, nat) == 0) - return nat; - NBUMPSIDE6D(fin->fin_out, ns_icmp_rebuild); - return NULL; - } - tcp = NULL; csump = NULL; --- 1616,1619 ---- *************** *** 2247,2252 **** softn->ipf_nat_table_sz); ! if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_ENCAPIN || ! nat->nat_dir == NAT_DIVERTIN) { u_int swap; --- 2173,2177 ---- softn->ipf_nat_table_sz); ! if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) { u_int swap; *************** *** 2623,2629 **** int match; - if ((fin->fin_p == IPPROTO_IPIP) && (np->in_redir & NAT_ENCAP)) - return ipf_nat6_matchencap(fin, np); - match = 0; switch (np->in_osrcatype) --- 2548,2551 ---- *************** *** 2896,2900 **** ipf_nat_softc_t *softn = softc->ipf_nat_soft; struct icmp6_hdr *icmp6; - u_short *csump; tcphdr_t *tcp; ipnat_t *np; --- 2818,2821 ---- *************** *** 2904,2908 **** tcp = NULL; icmp6 = NULL; - csump = NULL; np = nat->nat_ptr; --- 2825,2828 ---- *************** *** 2932,2937 **** break; - case NAT_ENCAPIN : - fin->fin_flx |= FI_ENCAP; case NAT_DIVERTIN : { --- 2852,2855 ---- *************** *** 2968,3002 **** } - case NAT_ENCAPOUT : - { - ip6_t *ip6; - mb_t *m; - - if (ipf_nat6_encapok(fin, nat) == -1) - return -1; - - m = M_DUP(np->in_divmp); - if (m == NULL) { - NBUMPSIDE6D(1, ns_encap_dup); - return -1; - } - - ip6 = MTOD(m, ip6_t *); - /* TRACE (fin,ip) */ - ip6->ip6_plen = htons(fin->fin_plen + sizeof(ip6_t)); - - /* TRACE (ip) */ - - PREP_MB_T(fin, m); - - fin->fin_ip6 = ip6; - fin->fin_plen += sizeof(ip6_t); /* UDP + new IPv6 hdr */ - fin->fin_dlen += sizeof(ip6_t); /* UDP + old IPv6 hdr */ - fin->fin_flx |= FI_ENCAP; - - nflags &= ~IPN_TCPUDPICMP; - - break; - } case NAT_DIVERTOUT : { --- 2886,2889 ---- *************** *** 3034,3037 **** --- 2921,2926 ---- if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) { + u_short *csump; + if ((nat->nat_nsport != 0) && (nflags & IPN_TCPUDP)) { tcp = fin->fin_dp; *************** *** 3043,3047 **** fin->fin_data[0] = ntohs(nat->nat_nsport); tcp->th_dport = nat->nat_ndport; ! fin->fin_data[0] = ntohs(nat->nat_ndport); break; --- 2932,2936 ---- fin->fin_data[0] = ntohs(nat->nat_nsport); tcp->th_dport = nat->nat_ndport; ! fin->fin_data[1] = ntohs(nat->nat_ndport); break; *************** *** 3050,3054 **** fin->fin_data[0] = ntohs(nat->nat_odport); tcp->th_dport = nat->nat_osport; ! fin->fin_data[0] = ntohs(nat->nat_osport); break; } --- 2939,2943 ---- fin->fin_data[0] = ntohs(nat->nat_odport); tcp->th_dport = nat->nat_osport; ! fin->fin_data[1] = ntohs(nat->nat_osport); break; } *************** *** 3061,3101 **** csump = ipf_nat_proto(fin, nat, nflags); - } ! /* ! * The above comments do not hold for layer 4 (or higher) checksums... ! */ ! if (csump != NULL) { ! if (nat->nat_dir == NAT_OUTBOUND) ! ipf_fix_outcksum(fin->fin_cksum, csump, ! nat->nat_sumd[0], ! nat->nat_sumd[1] + fin->fin_dlen); ! else ! ipf_fix_incksum(fin->fin_cksum, csump, ! nat->nat_sumd[0], ! nat->nat_sumd[1] + fin->fin_dlen); } ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync); /* ------------------------------------------------------------- */ ! /* A few quick notes: */ ! /* Following are test conditions prior to calling the */ ! /* appr_check routine. */ ! /* */ ! /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ ! /* with a redirect rule, we attempt to match the packet's */ ! /* source port against in_dport, otherwise we'd compare the */ ! /* packet's destination. */ /* ------------------------------------------------------------- */ if ((np != NULL) && (np->in_apr != NULL)) { ! #ifdef IPF_V6_PROXIES ! i = appr_check(fin, nat); ! if (i == 0) i = 1; ! else if (i == -1) { NBUMPSIDE6D(1, ns_ipf_proxy_fail); } - #else - i = 1; - #endif } else { i = 1; --- 2950,2990 ---- csump = ipf_nat_proto(fin, nat, nflags); ! /* ! * The above comments do not hold for layer 4 (or higher) ! * checksums... ! */ ! if (csump != NULL) { ! if (nat->nat_dir == NAT_OUTBOUND) ! ipf_fix_outcksum(fin->fin_cksum, csump, ! nat->nat_sumd[0], ! nat->nat_sumd[1] + ! fin->fin_dlen); ! else ! ipf_fix_incksum(fin->fin_cksum, csump, ! nat->nat_sumd[0], ! nat->nat_sumd[1] + ! fin->fin_dlen); ! } } + ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync); /* ------------------------------------------------------------- */ ! /* A few quick notes: */ ! /* Following are test conditions prior to calling the */ ! /* ipf_proxy_check routine. */ ! /* */ ! /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ ! /* with a redirect rule, we attempt to match the packet's */ ! /* source port against in_dport, otherwise we'd compare the */ ! /* packet's destination. */ /* ------------------------------------------------------------- */ if ((np != NULL) && (np->in_apr != NULL)) { ! i = ipf_proxy_check(fin, nat); ! if (i == 0) { i = 1; ! } else if (i == -1) { NBUMPSIDE6D(1, ns_ipf_proxy_fail); } } else { i = 1; *************** *** 3334,3337 **** --- 3223,3227 ---- ipnat_t *np; int skip; + int i; tcp = NULL; *************** *** 3345,3365 **** /* ------------------------------------------------------------- */ ! /* A few quick notes: */ ! /* Following are test conditions prior to calling the */ ! /* appr_check routine. */ ! /* */ ! /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ ! /* with a map rule, we attempt to match the packet's */ ! /* source port against in_dport, otherwise we'd compare the */ ! /* packet's destination. */ /* ------------------------------------------------------------- */ if (np->in_apr != NULL) { ! #ifdef IPF_V6_PROXIES ! i = appr_check(fin, nat); if (i == -1) { NBUMPSIDE6D(0, ns_ipf_proxy_fail); return -1; } - #endif } } --- 3235,3253 ---- /* ------------------------------------------------------------- */ ! /* A few quick notes: */ ! /* Following are test conditions prior to calling the */ ! /* ipf_proxy_check routine. */ ! /* */ ! /* A NULL tcp indicates a non TCP/UDP packet. When dealing */ ! /* with a map rule, we attempt to match the packet's */ ! /* source port against in_dport, otherwise we'd compare the */ ! /* packet's destination. */ /* ------------------------------------------------------------- */ if (np->in_apr != NULL) { ! i = ipf_proxy_check(fin, nat); if (i == -1) { NBUMPSIDE6D(0, ns_ipf_proxy_fail); return -1; } } } *************** *** 3398,3439 **** break; - case NAT_ENCAPIN : - { - ip6_t *ip6; - mb_t *m; - - /* - * XXX - * This is not necessarily true. What we need to know here - * is the MTU of the interface out which the packets will go - * and this won't be nat6_ifps[1] because that is where we - * send packets after stripping off stuff - what's needed - * here is the MTU of the interface for the route to the - * destination of the outer header. - */ - if (ipf_nat6_encapok(fin, nat) == -1) - return -1; - - m = M_DUP(np->in_divmp); - if (m == NULL) { - NBUMPSIDE6D(0, ns_encap_dup); - return -1; - } - - ip6 = MTOD(m, ip6_t *); - ip6->ip6_plen = htons(fin->fin_plen + 8); - - PREP_MB_T(fin, m); - - fin->fin_ip6 = ip6; - fin->fin_plen += sizeof(ip6_t) + 8; /* UDP + new IPv6 hdr */ - fin->fin_dlen += sizeof(ip6_t) + 8; /* UDP + old IPv6 hdr */ - fin->fin_flx |= FI_ENCAP; - - nflags &= ~IPN_TCPUDPICMP; - - break; - } - case NAT_DIVERTIN : { --- 3286,3289 ---- *************** *** 3465,3470 **** } - case NAT_ENCAPOUT : - fin->fin_flx |= FI_ENCAP; case NAT_DIVERTOUT : { --- 3315,3318 ---- *************** *** 3790,3795 **** /* Write Lock: ipf_nat */ /* */ ! /* Create a new NAT encap/divert session as defined by the NAT rule. This */ ! /* is somewhat different to other NAT session creation routines because we */ /* do not iterate through either port numbers or IP addresses, searching */ /* for a unique mapping, however, a complimentary duplicate check is made. */ --- 3638,3643 ---- /* Write Lock: ipf_nat */ /* */ ! /* Create a new NAT divert session as defined by the NAT rule. This is */ ! /* somewhat different to other NAT session creation routines because we */ /* do not iterate through either port numbers or IP addresses, searching */ /* for a unique mapping, however, a complimentary duplicate check is made. */ *************** *** 3852,3866 **** nat->nat_pr[1 - fin->fin_out] = p; ! if (np->in_redir & NAT_ENCAP) { ! if (np->in_redir & NAT_REDIRECT) ! nat->nat_dir = NAT_ENCAPIN; ! else ! nat->nat_dir = NAT_ENCAPOUT; ! } else { ! if (np->in_redir & NAT_REDIRECT) ! nat->nat_dir = NAT_DIVERTIN; ! else ! nat->nat_dir = NAT_DIVERTOUT; ! } return 0; --- 3700,3707 ---- nat->nat_pr[1 - fin->fin_out] = p; ! if (np->in_redir & NAT_REDIRECT) ! nat->nat_dir = NAT_DIVERTIN; ! else ! nat->nat_dir = NAT_DIVERTOUT; return 0; *************** *** 3873,3879 **** /* Parameters: np(I) - pointer to a NAT rule */ /* */ ! /* For encap/divert rules, a skeleton packet representing what will be */ ! /* prepended to the real packet is created. Even though we don't have the */ ! /* full packet here, a checksum is calculated that we update later when we */ /* fill in the final details. At present a 0 checksum for UDP is being set */ /* here because it is expected that divert will be used for localhost. */ --- 3714,3720 ---- /* Parameters: np(I) - pointer to a NAT rule */ /* */ ! /* For divert rules, a skeleton packet representing what will be prepended */ ! /* to the real packet is created. Even though we don't have the full */ ! /* packet here, a checksum is calculated that we update later when we */ /* fill in the final details. At present a 0 checksum for UDP is being set */ /* here because it is expected that divert will be used for localhost. */ *************** *** 4012,4146 **** /* ------------------------------------------------------------------------ */ - /* Function: nat6_matchencap */ - /* Returns: int - -1 == packet error, 1 == success, 0 = no match */ - /* Parameters: fin(I) - pointer to packet information */ - /* np(I) - pointer to a NAT rule */ - /* */ - /* To properly compare a packet travelling in the reverse direction to an */ - /* encap rule, it needs to be pseudo-decapsulated so we can check if a */ - /* reply to it would be encapsulated. In doing this, we have to be careful */ - /* so as not to actually do any decapsulation nor affect any of the current */ - /* stored parameters in "fin" so that we can continue processing it else- */ - /* where if it doesn't match. */ - /* ------------------------------------------------------------------------ */ - static int - ipf_nat6_matchencap(fin, np) - fr_info_t *fin; - ipnat_t *np; - { - ipf_main_softc_t *softc = fin->fin_main_soft; - ipf_nat_softc_t *softn = softc->ipf_nat_soft; - int match, skip; - u_short *ports; - frtuc_t *ft; - fr_ip_t fi; - ip6_t *ip6; - char *hdr; - mb_t *m; - - /* - * This function is only for matching packets that are appearing from - * the reverse direction against "encap" rules. - */ - if (fin->fin_out == 1) { - if ((np->in_redir & NAT_REDIRECT) == 0) - return 0; - } else { - if ((np->in_redir & NAT_MAP) == 0) - return 0; - } - if (np->in_pr[fin->fin_out] != fin->fin_p) - return 0; - - /* - * The aim here is to keep the original packet details in "fin" for - * as long as possible so that returning with an error is for the - * original packet and there is little undoing work to do. - */ - m = fin->fin_m; - skip = fin->fin_hlen; - if (M_LEN(m) < skip + sizeof(ip6_t)) { - if (ipf_pr_pullup(fin, sizeof(ip6_t)) == -1) { - NBUMPSIDE6D(fin->fin_out, ns_encap_pullup); - return -1; - } - } - - hdr = MTOD(fin->fin_m, char *); - ip6 = (ip6_t *)(hdr + skip); - - match = 1; - - /* - * Now we should have the entire innder header, so match up the - * address fields - easy enough. Reverse matching of source and - * destination because this is purportedly a "reply" to an encap rule. - */ - switch (np->in_osrcatype) - { - case FRI_NORMAL : - match = IP6_MASKNEQ(&ip6->ip6_dst, &np->in_osrcmsk6, - &np->in_osrcip6); - break; - case FRI_LOOKUP : - match = (*np->in_osrcfunc)(softc, np->in_osrcptr, np->in_v[0], - &ip6->ip6_dst, fin->fin_plen); - break; - } - if (match) - return 0; - - switch (np->in_odstatype) - { - case FRI_NORMAL : - match = IP6_MASKNEQ(&ip6->ip6_src, &np->in_odstmsk6, - &np->in_odstip6); - break; - case FRI_LOOKUP : - match = (*np->in_odstfunc)(softc, np->in_odstptr, np->in_v[0], - &ip6->ip6_src, fin->fin_plen); - break; - } - if (match) - return 0; - - ft = &np->in_tuc; - - switch (ip6->ip6_nxt) - { - case IPPROTO_TCP : - case IPPROTO_UDP : - /* - * Only need to fetch port numbers for NAT - */ - if (ipf_pr_pullup(fin, sizeof(ip6_t) + 4) == -1) { - NBUMPSIDE6(fin->fin_out, ns_encap_pullup); - return -1; - } - - ports = (u_short *)((char *)ip6 + sizeof(ip6_t)); - - fi.fi_tcpf = 0; - /* - * And again, because we're simulating a reply, put the port - * numbers in the revese place to where they are now. - */ - fi.fi_ports[0] = ntohs(ports[1]); - fi.fi_ports[1] = ntohs(ports[0]); - return ipf_tcpudpchk(&fi, ft); - - /* NOTREACHED */ - - default : - if (ft->ftu_scmp || ft->ftu_dcmp) - return 0; - break; - } - - return 1; - } - - - /* ------------------------------------------------------------------------ */ /* Function: nat6_nextaddr */ /* Returns: int - -1 == bad input (no new address), */ --- 3853,3856 ---- *************** *** 4344,4519 **** /* ------------------------------------------------------------------------ */ - /* Function: nat6_encapok */ - /* Returns: int - -1 == MTU not big enough, 0 == ok to send packet */ - /* Parameters: fin(I) - pointer to packet information */ - /* nat(I) - pointer to current NAT session */ - /* */ - /* The purpose of this function is to determine whether or not a packet can */ - /* be sent out of a network interface after it has been encapsulated, before*/ - /* the actual encapsulation happens. If it cannot - because the "Don't */ - /* fragment" bit has been set - then generate an ICMP error message back to */ - /* the origin of the packet, informing it that the packet is too big and */ - /* what the actual MTU out for the connection is. */ - /* */ - /* At present the only question this would leave for strange behaviour is */ - /* with local connections that will go out an encapsulation as sending of */ - /* ICMP messages to local destinations isn't considered robust. */ - /* ------------------------------------------------------------------------ */ - static int - ipf_nat6_encapok(fin, nat) - fr_info_t *fin; - nat_t *nat; - { - #ifdef INSTANCES - ipf_main_softc_t *softc = fin->fin_main_soft; /* For GETIFMTU_6 */ - #endif - void *sifp; - ipnat_t *n; - int extra; - int mtu; - - n = nat->nat_ptr; - - if (n->in_redir & NAT_ENCAP) { - extra = sizeof(ip6_t); - - } else { - return 0; - } - - mtu = GETIFMTU_6(nat->nat_ifps[1]); - - if (fin->fin_plen + extra < mtu) - return 0; - - sifp = fin->fin_ifp; - fin->fin_ifp = NULL; - fin->fin_icode = 0; - fin->fin_mtu = mtu - extra; - - (void) ipf_send_icmp_err(ICMP6_PACKET_TOO_BIG, fin, 1); - - fin->fin_mtu = 0; - - return -1; - } - - - /* ------------------------------------------------------------------------ */ - /* Function: ipf_nat6_rebuildencapicmp */ - /* Returns: int - -1 == error, 0 == success */ - /* Parameters: fin(I) - pointer to packet information */ - /* nat(I) - pointer to current NAT session */ - /* */ - /* For ICMP replies received in response to packets we've encapsulated on */ - /* the way out, we need to replace all of the addressing fields found in */ - /* the data section of the ICMP header. The ICMP packet is going to */ - /* contain the the IP packet we sent out (IPENCAP) plus at least 64 bits of */ - /* the original IP packet - not something that will be of use to the origin */ - /* of the offending packet. */ - /* ------------------------------------------------------------------------ */ - static nat_t * - ipf_nat6_rebuildencapicmp(fin, nat) - fr_info_t *fin; - nat_t *nat; - { - struct icmp6_hdr *icmp6; - udphdr_t *udp; - ip6_t *oip6; - int p; - - icmp6 = fin->fin_dp; - oip6 = (ip6_t *)((u_char *)icmp6 + sizeof(*icmp6)); - - if (fin->fin_out == 0) { - if (nat->nat_dir == NAT_ENCAPIN) { - oip6->ip6_src = nat->nat_odst6.in6; - oip6->ip6_dst = nat->nat_osrc6.in6; - } else { - oip6->ip6_src = nat->nat_osrc6.in6; - oip6->ip6_dst = nat->nat_odst6.in6; - } - } else { - if (nat->nat_dir == NAT_ENCAPIN) { - oip6->ip6_src = nat->nat_osrc6.in6; - oip6->ip6_dst = nat->nat_odst6.in6; - } else { - oip6->ip6_src = nat->nat_odst6.in6; - oip6->ip6_dst = nat->nat_osrc6.in6; - } - } - - udp = (udphdr_t *)(oip6 + 1); - - /* - * We use nat6_p here because the original UDP header is quite likely - * to have been lost - the error packet returned contains the outer - * encapsulation header plus 64 bits of the inner IP header, no room - * for a UDP or TCP header unless extra data is returned. - * - * XXX - If the entire original packet has been included (possible) - * then we should be just stripping off the outer encapsulation. - * This is a "todo" for the near future. - */ - p = nat->nat_pr[1 - fin->fin_out]; - - switch (p) - { - case IPPROTO_UDP : - udp->uh_sum = 0; - break; - case IPPROTO_TCP : - /* - * NAT doesn't track the sequence number so we can't pretend - * to know what value this field should carry. - */ - ((tcphdr_t *)udp)->th_seq = 0; - break; - default : - break; - } - - if (p == IPPROTO_TCP || p == IPPROTO_UDP) { - if (fin->fin_out == 0) { - if (nat->nat_dir == NAT_ENCAPIN) { - udp->uh_sport = nat->nat_odport; - udp->uh_dport = nat->nat_osport; - } else { - udp->uh_sport = nat->nat_osport; - udp->uh_dport = nat->nat_odport; - } - } else { - if (nat->nat_dir == NAT_ENCAPIN) { - udp->uh_sport = nat->nat_osport; - udp->uh_dport = nat->nat_odport; - } else { - udp->uh_sport = nat->nat_odport; - udp->uh_dport = nat->nat_osport; - } - } - } - - /* TRACE (fin,oip,udp,icmp6) */ - oip6->ip6_nxt = nat->nat_pr[1 - fin->fin_out]; - - /* - * Reduce the next MTU setting by the size of the encap header - */ - if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG) { - icmp6->icmp6_mtu = ntohs(icmp6->icmp6_mtu); - icmp6->icmp6_mtu -= sizeof(ip6_t); - icmp6->icmp6_mtu = htons(icmp6->icmp6_mtu); - } - - icmp6->icmp6_cksum = 0; - icmp6->icmp6_cksum = ipf_cksum((u_short *)icmp6, fin->fin_dlen); - - /* TRACE (fin,oip,udp,icmp6) */ - - return 0; - } - - - /* ------------------------------------------------------------------------ */ /* Function: ipf_nat6_icmpquerytype */ /* Returns: int - 1 == success, 0 == failure */ --- 4054,4057 ---- Index: ip_nat.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_nat.c,v retrieving revision 1.95 retrieving revision 1.96 diff -C2 -d -r1.95 -r1.96 *** ip_nat.c 13 Jul 2012 11:56:51 -0000 1.95 --- ip_nat.c 20 Jul 2012 07:53:52 -0000 1.96 *************** *** 215,219 **** static int ipf_nat_getsz(ipf_main_softc_t *, caddr_t, int); static int ipf_nat_putent(ipf_main_softc_t *, caddr_t, int); - static void ipf_nat_addencap(ipf_nat_softc_t *, ipnat_t *); static void ipf_nat_addmap(ipf_nat_softc_t *, ipnat_t *); static void ipf_nat_addrdr(ipf_nat_softc_t *, ipnat_t *); --- 215,218 ---- *************** *** 224,228 **** static void ipf_nat_delrule(ipf_main_softc_t *, ipf_nat_softc_t *, ipnat_t *, int); - static int ipf_nat_encapok(fr_info_t *, nat_t *); static int ipf_nat_extraflush(ipf_main_softc_t *, ipf_nat_softc_t *, int); static int ipf_nat_finalise(fr_info_t *, nat_t *); --- 223,226 ---- *************** *** 239,243 **** static int ipf_nat_match(fr_info_t *, ipnat_t *); static int ipf_nat_matcharray(nat_t *, int *, u_long); - static int ipf_nat_matchencap(ipf_nat_softc_t *, fr_info_t *, ipnat_t *); static int ipf_nat_matchflush(ipf_main_softc_t *, ipf_nat_softc_t *, caddr_t); --- 237,240 ---- *************** *** 250,254 **** static int ipf_nat_nextaddrinit(ipf_main_softc_t *, char *, nat_addr_t *, int, void *); - static nat_t *ipf_nat_rebuildencapicmp(fr_info_t *, nat_t *); static int ipf_nat_resolverule(ipf_main_softc_t *, ipnat_t *); static int ipf_nat_ruleaddrinit(ipf_main_softc_t *, --- 247,250 ---- *************** *** 716,789 **** /* ------------------------------------------------------------------------ */ - /* Function: ipf_nat_addencap */ - /* Returns: Nil */ - /* Parameters: n(I) - pointer to NAT rule to add */ - /* */ - /* Here we add in a pointer in the NAT rules hash table to match reply */ - /* packets that are encapsulated. For encap rules that are "out", what we */ - /* will want to match upon will be the source address in the encap rule as */ - /* this is what will become the destination in packets coming back to us. */ - /* For encaps pointing in, it is still the same because it is still the */ - /* reply packet we want to match. */ - /* ------------------------------------------------------------------------ */ - static void - ipf_nat_addencap(softn, n) - ipf_nat_softc_t *softn; - ipnat_t *n; - { - ipnat_t **np; - u_32_t j; - u_int hv, rhv; - int k; - - k = -1; - - /* - * It is the new source address we're after... - */ - if (n->in_nsrcatype == FRI_NORMAL) { - k = count4bits(n->in_nsrcmsk); - j = (n->in_nsrcaddr & n->in_nsrcmsk); - rhv = NAT_HASH_FN(j, 0, 0xffffffff); - } else { - j = 0; - rhv = 0; - } - - /* - * And place the rules table entry in the reverse spot, so for out - * we use the rdr-links and for rdr, we use the map-links. This is - * the reverse of how it is used elsewhere... - */ - if (n->in_redir & NAT_MAP) { - ipf_inet_mask_add(k, &softn->ipf_nat_rdr_mask); - hv = rhv % softn->ipf_nat_maprules_sz; - np = softn->ipf_nat_rdr_rules + hv; - while (*np != NULL) - np = &(*np)->in_rnext; - n->in_rnext = NULL; - n->in_prnext = np; - n->in_hv[0] = rhv; - n->in_use++; - *np = n; - } - if (n->in_redir & NAT_REDIRECT) { - ipf_inet_mask_add(k, &softn->ipf_nat_map_mask); - hv = rhv % softn->ipf_nat_rdrrules_sz; - np = softn->ipf_nat_map_rules + hv; - while (*np != NULL) - np = &(*np)->in_mnext; - n->in_mnext = NULL; - n->in_pmnext = np; - n->in_hv[1] = rhv; - n->in_use++; - *np = n; - } - - /* TRACE(n, hv, k) */ - } - - - /* ------------------------------------------------------------------------ */ /* Function: ipf_nat_delrdr */ /* Returns: Nil */ --- 712,715 ---- *************** *** 861,869 **** u_int hv, rhv; - if (np == NULL) { - softn->ipf_nat_stats.ns_hm_nullnp++; - return NULL; - } - hv = (src.s_addr ^ dst.s_addr); hv += src.s_addr; --- 787,790 ---- *************** *** 881,884 **** --- 802,810 ---- } + if (np == NULL) { + softn->ipf_nat_stats.ns_hm_nullnp++; + return NULL; + } + KMALLOC(hm, hostmap_t *); if (hm) { *************** *** 1527,1539 **** int error = 0; - /* - * This combination of flags is incompatible because in_flags will - * be checked for packets coming back in too. - */ - if ((n->in_flags & IPN_TCPUDP) && (n->in_redir & NAT_ENCAP)) { - IPFERROR(60021); - return EINVAL; - } - if (ipf_nat_resolverule(softc, n) != 0) { IPFERROR(60022); --- 1453,1456 ---- *************** *** 1571,1582 **** case 4 : ipf_nat_addrdr(softn, n); - if (n->in_redir & NAT_ENCAP) - ipf_nat_addencap(softn, n); break; #ifdef USE_INET6 case 6 : ipf_nat6_addrdr(softn, n); - if (n->in_redir & NAT_ENCAP) - ipf_nat6_addencap(softn, n); break; #endif --- 1488,1495 ---- *************** *** 1593,1604 **** case 4 : ipf_nat_addmap(softn, n); - if (n->in_redir & NAT_ENCAP) - ipf_nat_addencap(softn, n); break; #ifdef USE_INET6 case 6 : ipf_nat6_addmap(softn, n); - if (n->in_redir & NAT_ENCAP) - ipf_nat6_addencap(softn, n); break; #endif --- 1506,1513 ---- *************** *** 1696,1700 **** return error; ! if (n->in_redir & (NAT_ENCAP|NAT_DIVERTUDP)) ipf_nat_builddivertmp(softn, n); --- 1605,1609 ---- return error; ! if (n->in_redir & NAT_DIVERTUDP) ipf_nat_builddivertmp(softn, n); *************** *** 2164,2168 **** { case NAT_OUTBOUND : - case NAT_ENCAPOUT : case NAT_DIVERTOUT : if (getlock) { --- 2073,2076 ---- *************** *** 2193,2197 **** case NAT_INBOUND : - case NAT_ENCAPIN : case NAT_DIVERTIN : if (getlock) { --- 2101,2104 ---- *************** *** 3271,3275 **** * if there is none found. */ ! if (np->in_redir & (NAT_ENCAP|NAT_DIVERTUDP)) { move = ipf_nat_newdivert(fin, nat, &ni); --- 3178,3182 ---- * if there is none found. */ ! if (np->in_redir & NAT_DIVERTUDP) { move = ipf_nat_newdivert(fin, nat, &ni); *************** *** 3313,3318 **** nat->nat_mssclamp = np->in_mssclamp; nat->nat_me = natsave; - if (natsave != NULL) - *natsave = nat; nat->nat_fr = fin->fin_fr; nat->nat_rev = fin->fin_rev; --- 3220,3223 ---- *************** *** 3368,3371 **** --- 3273,3278 ---- if (nat != NULL && np != NULL) np->in_hits++; + if (natsave != NULL) + *natsave = nat; return nat; } *************** *** 3614,3619 **** hv1 = nat->nat_hv[1] % softn->ipf_nat_table_sz; ! if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_ENCAPIN || ! nat->nat_dir == NAT_DIVERTIN) { u_int swap; --- 3521,3525 ---- hv1 = nat->nat_hv[1] % softn->ipf_nat_table_sz; ! if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) { u_int swap; *************** *** 3892,3907 **** } - if (nat->nat_dir == NAT_ENCAPIN || nat->nat_dir == NAT_ENCAPOUT) { - /* - * For ICMP replies to encapsulated packets, we need to - * rebuild the ICMP reply completely to match the original - * packet... - */ - if (ipf_nat_rebuildencapicmp(fin, nat) == 0) - return nat; - NBUMPSIDED(fin->fin_out, ns_icmp_rebuild); - return NULL; - } - tcp = NULL; csump = NULL; --- 3798,3801 ---- *************** *** 4247,4251 **** { case NAT_INBOUND : - case NAT_ENCAPIN : case NAT_DIVERTIN : if (nat->nat_v[0] != 4) --- 4141,4144 ---- *************** *** 4270,4274 **** continue; case NAT_OUTBOUND : - case NAT_ENCAPOUT : if (nat->nat_v[1] != 4) continue; --- 4163,4166 ---- *************** *** 4468,4473 **** hv1 = rhv1 % softn->ipf_nat_table_sz; ! if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_ENCAPIN || ! nat->nat_dir == NAT_DIVERTIN) { u_int swap; --- 4360,4364 ---- hv1 = rhv1 % softn->ipf_nat_table_sz; ! if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) { u_int swap; *************** *** 4581,4585 **** { case NAT_INBOUND : - case NAT_ENCAPIN : case NAT_DIVERTIN : if (nat->nat_v[1] != 4) --- 4472,4475 ---- *************** *** 4602,4606 **** break; case NAT_OUTBOUND : - case NAT_ENCAPOUT : case NAT_DIVERTOUT : if (nat->nat_v[0] != 4) --- 4492,4495 ---- *************** *** 4840,4850 **** { ipf_main_softc_t *softc = fin->fin_main_soft; - ipf_nat_softc_t *softn = softc->ipf_nat_soft; frtuc_t *ft; int match; - if ((fin->fin_p == IPPROTO_IPIP) && (np->in_redir & NAT_ENCAP)) - return ipf_nat_matchencap(softn, fin, np); - match = 0; switch (np->in_osrcatype) --- 4729,4735 ---- *************** *** 5284,5289 **** break; - case NAT_ENCAPIN : - fin->fin_flx |= FI_ENCAP; case NAT_DIVERTIN : { --- 5169,5172 ---- *************** *** 5320,5371 **** } - case NAT_ENCAPOUT : - { - u_32_t s1, s2, sumd; - ip_t *ip; - mb_t *m; - - if (ipf_nat_encapok(fin, nat) == -1) - return -1; - - m = M_DUP(np->in_divmp); - if (m == NULL) { - NBUMPSIDED(1, ns_encap_dup); - return -1; - } - - ip = MTOD(m, ip_t *); - /* TRACE (fin,ip) */ - ip->ip_off = (fin->fin_ip->ip_off & htons(IP_DF)); - ip->ip_id = htons(ipf_nextipid(fin)); - ip->ip_len = htons(fin->fin_plen + sizeof(ip_t)); - s1 = 0; - /* - * We subtract 40 here because ip_len has already been set - * to this value when the template checksum is created. - */ - s2 = ntohs(ip->ip_id) + ntohs(ip->ip_len) - sizeof(ip_t); - s2 += ntohs(ip->ip_off) & IP_DF; - /* TRACE (s1,s2,ip) */ - CALC_SUMD(s1, s2, sumd); - /* TRACE (sumd) */ - - #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ - defined(linux) || defined(BRIDGE_IPF) - ipf_fix_outcksum(0, &ip->ip_sum, sumd, 0); - #endif - /* TRACE (ip) */ - - PREP_MB_T(fin, m); - - fin->fin_ip = ip; - fin->fin_plen += sizeof(ip_t); /* UDP + new IPv4 hdr */ - fin->fin_dlen += sizeof(ip_t); /* UDP + old IPv4 hdr */ - fin->fin_flx |= FI_ENCAP; - - nflags &= ~IPN_TCPUDPICMP; - - break; - } case NAT_DIVERTOUT : { --- 5203,5206 ---- *************** *** 5429,5433 **** fin->fin_data[0] = ntohs(nat->nat_nsport); tcp->th_dport = nat->nat_ndport; ! fin->fin_data[0] = ntohs(nat->nat_ndport); break; --- 5264,5268 ---- fin->fin_data[0] = ntohs(nat->nat_nsport); tcp->th_dport = nat->nat_ndport; ! fin->fin_data[1] = ntohs(nat->nat_ndport); break; *************** *** 5436,5440 **** fin->fin_data[0] = ntohs(nat->nat_odport); tcp->th_dport = nat->nat_osport; ! fin->fin_data[0] = ntohs(nat->nat_osport); break; } --- 5271,5275 ---- fin->fin_data[0] = ntohs(nat->nat_odport); tcp->th_dport = nat->nat_osport; ! fin->fin_data[1] = ntohs(nat->nat_osport); break; } *************** *** 5663,5667 **** natfailed = -1; } - if ((np == NULL) && (rmsk < softn->ipf_nat_rdr_max)) { rmsk++; --- 5498,5501 ---- *************** *** 5669,5672 **** --- 5503,5507 ---- } } + if (nat != NULL) { rval = ipf_nat_in(fin, nat, natadd, nflags); *************** *** 5814,5864 **** break; - case NAT_ENCAPIN : - { - ip_t *ip; - mb_t *m; - - /* - * XXX - * This is not necessarily true. What we need to know here - * is the MTU of the interface out which the packets will go - * and this won't be nat_ifps[1] because that is where we - * send packets after stripping off stuff - what's needed - * here is the MTU of the interface for the route to the - * destination of the outer header. - */ - if (ipf_nat_encapok(fin, nat) == -1) - return -1; - - m = M_DUP(np->in_divmp); - if (m == NULL) { - NBUMPSIDED(0, ns_encap_dup); - return -1; - } - - ip = MTOD(m, ip_t *); - ip->ip_id = htons(ipf_nextipid(fin)); - sum1 = ntohs(ip->ip_len); - ip->ip_len = htons(fin->fin_plen + sizeof(ip_t)); - sum2 = ntohs(ip->ip_id) + ntohs(ip->ip_len); - CALC_SUMD(sum1, sum2, sumd); - - #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \ - defined(__osf__) || defined(linux) - ipf_fix_outcksum(0, &ip->ip_sum, sumd, 0); - #endif - - PREP_MB_T(fin, m); - - fin->fin_ip = ip; - fin->fin_plen += sizeof(ip_t); /* UDP + new IPv4 hdr */ - fin->fin_dlen += sizeof(ip_t); /* UDP + old IPv4 hdr */ - fin->fin_flx |= FI_ENCAP; - - nflags &= ~IPN_TCPUDPICMP; - - break; - } - case NAT_DIVERTIN : { --- 5649,5652 ---- *************** *** 5903,5908 **** } - case NAT_ENCAPOUT : - fin->fin_flx |= FI_ENCAP; case NAT_DIVERTOUT : { --- 5691,5694 ---- *************** *** 7466,7471 **** /* Write Lock: ipf_nat */ /* */ ! /* Create a new NAT encap/divert session as defined by the NAT rule. This */ ! /* is somewhat different to other NAT session creation routines because we */ /* do not iterate through either port numbers or IP addresses, searching */ /* for a unique mapping, however, a complimentary duplicate check is made. */ --- 7252,7257 ---- /* Write Lock: ipf_nat */ /* */ ! /* Create a new NAT divert session as defined by the NAT rule. This is */ ! /* somewhat different to other NAT session creation routines because we */ /* do not iterate through either port numbers or IP addresses, searching */ /* for a unique mapping, however, a complimentary duplicate check is made. */ *************** *** 7535,7549 **** nat->nat_pr[1 - fin->fin_out] = p; ! if (np->in_redir & NAT_ENCAP) { ! if (np->in_redir & NAT_REDIRECT) ! nat->nat_dir = NAT_ENCAPIN; ! else ! nat->nat_dir = NAT_ENCAPOUT; ! } else { ! if (np->in_redir & NAT_REDIRECT) ! nat->nat_dir = NAT_DIVERTIN; ! else ! nat->nat_dir = NAT_DIVERTOUT; ! } return 0; --- 7321,7328 ---- nat->nat_pr[1 - fin->fin_out] = p; ! if (np->in_redir & NAT_REDIRECT) ! nat->nat_dir = NAT_DIVERTIN; ! else ! nat->nat_dir = NAT_DIVERTOUT; return 0; *************** *** 7557,7563 **** /* np(I) - pointer to a NAT rule */ /* */ ! /* For encap/divert rules, a skeleton packet representing what will be */ ! /* prepended to the real packet is created. Even though we don't have the */ ! /* full packet here, a checksum is calculated that we update later when we */ /* fill in the final details. At present a 0 checksum for UDP is being set */ /* here because it is expected that divert will be used for localhost. */ --- 7336,7342 ---- /* np(I) - pointer to a NAT rule */ /* */ ! /* For divert rules, a skeleton packet representing what will be prepended */ ! /* to the real packet is created. Even though we don't have the full */ ! /* packet here, a checksum is calculated that we update later when we */ /* fill in the final details. At present a 0 checksum for UDP is being set */ /* here because it is expected that divert will be used for localhost. */ *************** *** 7727,7869 **** /* ------------------------------------------------------------------------ */ - /* Function: nat_matchencap */ - /* Returns: int - -1 == packet error, 1 == success, 0 = no match */ - /* Parameters: softn(I) - pointer to NAT context structure */ - /* fin(I) - pointer to packet information */ - /* np(I) - pointer to a NAT rule */ - /* */ - /* To properly compare a packet travelling in the reverse direction to an */ - /* encap rule, it needs to be pseudo-decapsulated so we can check if a */ - /* reply to it would be encapsulated. In doing this, we have to be careful */ - /* so as not to actually do any decapsulation nor affect any of the current */ - /* stored parameters in "fin" so that we can continue processing it else- */ - /* where if it doesn't match. */ - /* ------------------------------------------------------------------------ */ - static int - ipf_nat_matchencap(softn, fin, np) - ipf_nat_softc_t *softn; - fr_info_t *fin; - ipnat_t *np; - { - int hlen, match, skip; - u_short *ports; - frtuc_t *ft; - fr_ip_t fi; - char *hdr; - ip_t *ip; - mb_t *m; - - /* - * This function is only for matching packets that are appearing from - * the reverse direction against "encap" rules. - */ - if (fin->fin_out == 1) { - if ((np->in_redir & NAT_REDIRECT) == 0) - return 0; - } else { - if ((np->in_redir & NAT_MAP) == 0) - return 0; - } - if (np->in_pr[fin->fin_out] != fin->fin_p) - return 0; - - /* - * The aim here is to keep the original packet details in "fin" for - * as long as possible so that returning with an error is for the - * original packet and there is little undoing work to do. - */ - m = fin->fin_m; - skip = fin->fin_hlen; - if (M_LEN(m) < skip + sizeof(ip_t)) { - if (ipf_pr_pullup(fin, sizeof(ip_t)) == -1) { - NBUMPSIDED(fin->fin_out, ns_encap_pullup); - return -1; - } - } - - hdr = MTOD(fin->fin_m, char *); - ip = (ip_t *)(hdr + skip); - hlen = IP_HL(ip) << 2; - - if (ipf_pr_pullup(fin, hlen) == -1) { - NBUMPSIDED(fin->fin_out, ns_encap_pullup); - return -1; - } - - match = 1; - - /* - * Now we should have the entire innder header, so match up the - * address fields - easy enough. Reverse matching of source and - * destination because this is purportedly a "reply" to an encap rule. - */ - switch (np->in_osrcatype) - { - case FRI_NORMAL : - match = ((ip->ip_dst.s_addr & np->in_osrcmsk) - != np->in_osrcaddr); - break; - case FRI_LOOKUP : - match = (*np->in_nsrcfunc)(fin->fin_main_soft, np->in_osrcptr, - np->in_v[0], &ip->ip_dst.s_addr, - fin->fin_plen); - break; - } - if (match) - return 0; - - switch (np->in_odstatype) - { - case FRI_NORMAL : - match = ((ip->ip_src.s_addr & np->in_odstmsk) - != np->in_odstaddr); - break; - case FRI_LOOKUP : - match = (*np->in_ndstfunc)(fin->fin_main_soft, np->in_odstptr, - np->in_v[0], &ip->ip_src.s_addr, - fin->fin_plen); - break; - } - if (match) - return 0; - - ft = &np->in_tuc; - - switch (ip->ip_p) - { - case IPPROTO_TCP : - case IPPROTO_UDP : - /* - * Only need to fetch port numbers for NAT - */ - if (ipf_pr_pullup(fin, hlen + 4) == -1) { - NBUMPSIDED(fin->fin_out, ns_encap_pullup); - return -1; - } - - ports = (u_short *)((char *)ip + hlen); - - fi.fi_tcpf = 0; - /* - * And again, because we're simulating a reply, put the port - * numbers in the revese place to where they are now. - */ - fi.fi_ports[0] = ntohs(ports[1]); - fi.fi_ports[1] = ntohs(ports[0]); - return ipf_tcpudpchk(&fi, ft); - - /* NOTREACHED */ - - default : - if (ft->ftu_scmp || ft->ftu_dcmp) - return 0; - break; - } - - return 1; - } - - - /* ------------------------------------------------------------------------ */ /* Function: nat_nextaddr */ /* Returns: int - -1 == bad input (no new address), */ --- 7506,7509 ---- *************** *** 8066,8247 **** /* ------------------------------------------------------------------------ */ - /* Function: nat_encapok */ - /* Returns: int - -1 == MTU not big enough, 0 == ok to send packet */ - /* Parameters: fin(I) - pointer to packet information */ - /* nat(I) - pointer to current NAT session */ - /* */ - /* The purpose of this function is to determine whether or not a packet can */ - /* be sent out of a network interface after it has been encapsulated, before*/ - /* the actual encapsulation happens. If it cannot - because the "Don't */ - /* fragment" bit has been set - then generate an ICMP error message back to */ - /* the origin of the packet, informing it that the packet is too big and */ - /* what the actual MTU out for the connection is. */ - /* */ - /* At present the only question this would leave for strange behaviour is */ - /* with local connections that will go out an encapsulation as sending of */ - /* ICMP messages to local destinations isn't considered robust. */ - /* ------------------------------------------------------------------------ */ - static int - ipf_nat_encapok(fin, nat) - fr_info_t *fin; - nat_t *nat; - { - #ifdef INSTANCES - ipf_main_softc_t *softc = fin->fin_main_soft; /* For GETIFMTU_4 */ - #endif - void *sifp; - ipnat_t *n; - int extra; - int mtu; - - if (!(fin->fin_ip->ip_off & htons(IP_DF))) - return 0; - - n = nat->nat_ptr; - - if (n->in_redir & NAT_ENCAP) { - extra = sizeof(ip_t); - - } else { - return 0; - } - - mtu = GETIFMTU_4(nat->nat_ifps[1]); - - if (fin->fin_plen + extra < mtu) - return 0; - - sifp = fin->fin_ifp; - fin->fin_ifp = NULL; - fin->fin_icode = ICMP_UNREACH_NEEDFRAG; - fin->fin_mtu = mtu - extra; - - (void) ipf_send_icmp_err(ICMP_UNREACH, fin, 1); - - fin->fin_mtu = 0; - - return -1; - } - - - /* ------------------------------------------------------------------------ */ - /* Function: ipf_nat_rebuildencapicmp */ - /* Returns: int - -1 == error, 0 == success */ - /* Parameters: fin(I) - pointer to packet information */ - /* nat(I) - pointer to current NAT session */ - /* */ - /* For ICMP replies received in response to packets we've encapsulated on */ - /* the way out, we need to replace all of the addressing fields found in */ - /* the data section of the ICMP header. The ICMP packet is going to */ - /* contain the the IP packet we sent out (IPENCAP) plus at least 64 bits of */ - /* the original IP packet - not something that will be of use to the origin */ - /* of the offending packet. */ - /* ------------------------------------------------------------------------ */ - static nat_t * - ipf_nat_rebuildencapicmp(fin, nat) - fr_info_t *fin; - nat_t *nat; - { - icmphdr_t *icmp; - udphdr_t *udp; - ip_t *oip; - int p; - - icmp = fin->fin_dp; - oip = (ip_t *)&icmp->icmp_ip; - - if (fin->fin_out == 0) { - if (nat->nat_dir == NAT_ENCAPIN) { - oip->ip_src = nat->nat_odstip; - oip->ip_dst = nat->nat_osrcip; - } else { - oip->ip_src = nat->nat_osrcip; - oip->ip_dst = nat->nat_odstip; - } - } else { - if (nat->nat_dir == NAT_ENCAPIN) { - oip->ip_src = nat->nat_osrcip; - oip->ip_dst = nat->nat_odstip; - } else { - oip->ip_src = nat->nat_odstip; - oip->ip_dst = nat->nat_osrcip; - } - } - - udp = (udphdr_t *)(oip + 1); - - /* - * We use nat_p here because the original UDP header is quite likely - * to have been lost - the error packet returned contains the outer - * encapsulation header plus 64 bits of the inner IP header, no room - * for a UDP or TCP header unless extra data is returned. - * - * XXX - If the entire original packet has been included (possible) - * then we should be just stripping off the outer encapsulation. - * This is a "todo" for the near future. - */ - p = nat->nat_pr[1 - fin->fin_out]; - - switch (p) - { - case IPPROTO_UDP : - udp->uh_sum = 0; - break; - case IPPROTO_TCP : - /* - * NAT doesn't track the sequence number so we can't pretend - * to know what value this field should carry. - */ - ((tcphdr_t *)udp)->th_seq = 0; - break; - default : - break; - } - - if (p == IPPROTO_TCP || p == IPPROTO_UDP) { - if (fin->fin_out == 0) { - if (nat->nat_dir == NAT_ENCAPIN) { - udp->uh_sport = nat->nat_odport; - udp->uh_dport = nat->nat_osport; - } else { - udp->uh_sport = nat->nat_osport; - udp->uh_dport = nat->nat_odport; - } - } else { - if (nat->nat_dir == NAT_ENCAPIN) { - udp->uh_sport = nat->nat_osport; - udp->uh_dport = nat->nat_odport; - } else { - udp->uh_sport = nat->nat_odport; - udp->uh_dport = nat->nat_osport; - } - } - } - - /* TRACE (fin,oip,udp,icmp) */ - oip->ip_p = nat->nat_pr[1 - fin->fin_out]; - oip->ip_sum = 0; - oip->ip_sum = ipf_cksum((u_short *)oip, sizeof(*oip)); - - /* - * Reduce the next MTU setting by the size of the encap header - */ - if (icmp->icmp_type == ICMP_UNREACH && - icmp->icmp_code == ICMP_UNREACH_NEEDFRAG) { - icmp->icmp_nextmtu = ntohs(icmp->icmp_nextmtu); - icmp->icmp_nextmtu -= sizeof(ip_t); - icmp->icmp_nextmtu = htons(icmp->icmp_nextmtu); - } - - icmp->icmp_cksum = 0; - icmp->icmp_cksum = ipf_cksum((u_short *)icmp, fin->fin_dlen); - - /* TRACE (fin,oip,udp,icmp) */ - - return 0; - } - - - /* ------------------------------------------------------------------------ */ /* Function: ipf_nat_matchflush */ /* Returns: int - -1 == error, 0 == success */ --- 7706,7709 ---- *************** *** 8505,8509 **** error = COPYOUT(softn->ipf_nat_stats.ns_side[0].ns_bucketlen, table.ita_table, ! softn->ipf_nat_table_sz * sizeof(u_long)); break; --- 7967,7971 ---- error = COPYOUT(softn->ipf_nat_stats.ns_side[0].ns_bucketlen, table.ita_table, ! softn->ipf_nat_table_sz * sizeof(u_int)); break; *************** *** 8511,8515 **** error = COPYOUT(softn->ipf_nat_stats.ns_side[1].ns_bucketlen, table.ita_table, ! softn->ipf_nat_table_sz * sizeof(u_long)); break; --- 7973,7977 ---- error = COPYOUT(softn->ipf_nat_stats.ns_side[1].ns_bucketlen, table.ita_table, ! softn->ipf_nat_table_sz * sizeof(u_int)); break; *************** *** 8800,8837 **** continue; ! if ((np->in_redir & NAT_ENCAP) == 0) { ! if (np->in_redir & NAT_REDIRECT) { ! np->in_rnext = NULL; ! hv = np->in_hv[0] % newsize; ! for (npp = newtab + hv; *npp != NULL; ) ! npp = &(*npp)->in_rnext; ! np->in_prnext = npp; ! *npp = np; ! } ! if (np->in_redir & NAT_MAP) { ! np->in_mnext = NULL; ! hv = np->in_hv[1] % newsize; ! for (npp = newtab + hv; *npp != NULL; ) ! npp = &(*npp)->in_mnext; ! np->in_pmnext = npp; ! *npp = np; ! } ! } else { ! if (np->in_redir & NAT_MAP) { ! np->in_rnext = NULL; ! hv = np->in_hv[0] % newsize; ! for (npp = newtab + hv; *npp != NULL; ) ! npp = &(*npp)->in_rnext; ! np->in_prnext = npp; ! *npp = np; ! } ! if (np->in_redir & NAT_REDIRECT) { ! np->in_mnext = NULL; ! hv = np->in_hv[1] % newsize; ! for (npp = newtab + hv; *npp != NULL; ) ! npp = &(*npp)->in_mnext; ! np->in_pmnext = npp; ! *npp = np; ! } } --- 8262,8280 ---- continue; ! if (np->in_redir & NAT_REDIRECT) { ! np->in_rnext = NULL; ! hv = np->in_hv[0] % newsize; ! for (npp = newtab + hv; *npp != NULL; ) ! npp = &(*npp)->in_rnext; ! np->in_prnext = npp; ! *npp = np; ! } ! if (np->in_redir & NAT_MAP) { ! np->in_mnext = NULL; ! hv = np->in_hv[1] % newsize; ! for (npp = newtab + hv; *npp != NULL; ) ! npp = &(*npp)->in_mnext; ! np->in_pmnext = npp; ! *npp = np; } |
From: Darren <dar...@us...> - 2012-07-20 07:47:25
|
Update of /cvsroot/ipfilter/ipfilter In directory vz-cvs-4.sog:/tmp/cvs-serv26572 Modified Files: Tag: v5-1-RELEASE ip_fil_compat.c Log Message: 3546248 compat rule pointer type mismatch Index: ip_fil_compat.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_fil_compat.c,v retrieving revision 1.1.2.6 retrieving revision 1.1.2.7 diff -C2 -d -r1.1.2.6 -r1.1.2.7 *** ip_fil_compat.c 29 Jan 2012 17:43:50 -0000 1.1.2.6 --- ip_fil_compat.c 20 Jul 2012 07:47:22 -0000 1.1.2.7 *************** *** 3764,3768 **** old->fr_lock = fr->fr_lock; old->fr_next = fr->fr_next; ! old->fr_grp = fr->fr_grp; old->fr_isc = fr->fr_isc; old->fr_ifas[0] = fr->fr_ifas[0]; --- 3764,3768 ---- old->fr_lock = fr->fr_lock; old->fr_next = fr->fr_next; ! old->fr_grp = (void *)fr->fr_grp; old->fr_isc = fr->fr_isc; old->fr_ifas[0] = fr->fr_ifas[0]; *************** *** 3859,3863 **** old->fr_lock = fr->fr_lock; old->fr_next = fr->fr_next; ! old->fr_grp = fr->fr_grp; old->fr_isc = fr->fr_isc; old->fr_ifas[0] = fr->fr_ifas[0]; --- 3859,3863 ---- old->fr_lock = fr->fr_lock; old->fr_next = fr->fr_next; ! old->fr_grp = (void *)fr->fr_grp; old->fr_isc = fr->fr_isc; old->fr_ifas[0] = fr->fr_ifas[0]; *************** *** 3954,3958 **** old->fr_lock = fr->fr_lock; old->fr_next = fr->fr_next; ! old->fr_grp = fr->fr_grp; old->fr_isc = fr->fr_isc; old->fr_ifas[0] = fr->fr_ifas[0]; --- 3954,3958 ---- old->fr_lock = fr->fr_lock; old->fr_next = fr->fr_next; ! old->fr_grp = (void *)fr->fr_grp; old->fr_isc = fr->fr_isc; old->fr_ifas[0] = fr->fr_ifas[0]; |
From: Darren <dar...@us...> - 2012-07-20 07:47:12
|
Update of /cvsroot/ipfilter/ipfilter In directory vz-cvs-4.sog:/tmp/cvs-serv26555 Modified Files: ip_fil_compat.c Log Message: 3546248 compat rule pointer type mismatch Index: ip_fil_compat.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_fil_compat.c,v retrieving revision 1.5 retrieving revision 1.6 diff -C2 -d -r1.5 -r1.6 *** ip_fil_compat.c 29 Jan 2012 17:44:01 -0000 1.5 --- ip_fil_compat.c 20 Jul 2012 07:47:10 -0000 1.6 *************** *** 3764,3768 **** old->fr_lock = fr->fr_lock; old->fr_next = fr->fr_next; ! old->fr_grp = fr->fr_grp; old->fr_isc = fr->fr_isc; old->fr_ifas[0] = fr->fr_ifas[0]; --- 3764,3768 ---- old->fr_lock = fr->fr_lock; old->fr_next = fr->fr_next; ! old->fr_grp = (void *)fr->fr_grp; old->fr_isc = fr->fr_isc; old->fr_ifas[0] = fr->fr_ifas[0]; *************** *** 3859,3863 **** old->fr_lock = fr->fr_lock; old->fr_next = fr->fr_next; ! old->fr_grp = fr->fr_grp; old->fr_isc = fr->fr_isc; old->fr_ifas[0] = fr->fr_ifas[0]; --- 3859,3863 ---- old->fr_lock = fr->fr_lock; old->fr_next = fr->fr_next; ! old->fr_grp = (void *)fr->fr_grp; old->fr_isc = fr->fr_isc; old->fr_ifas[0] = fr->fr_ifas[0]; *************** *** 3954,3958 **** old->fr_lock = fr->fr_lock; old->fr_next = fr->fr_next; ! old->fr_grp = fr->fr_grp; old->fr_isc = fr->fr_isc; old->fr_ifas[0] = fr->fr_ifas[0]; --- 3954,3958 ---- old->fr_lock = fr->fr_lock; old->fr_next = fr->fr_next; ! old->fr_grp = (void *)fr->fr_grp; old->fr_isc = fr->fr_isc; old->fr_ifas[0] = fr->fr_ifas[0]; |
From: Darren <dar...@us...> - 2012-07-20 07:44:31
|
Update of /cvsroot/ipfilter/ipfilter In directory vz-cvs-4.sog:/tmp/cvs-serv26490 Modified Files: Tag: v5-1-RELEASE ip_fil_freebsd.c Log Message: 3546247 UDP hardware checksum offload not recognised Index: ip_fil_freebsd.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_fil_freebsd.c,v retrieving revision 1.25.2.17 retrieving revision 1.25.2.18 diff -C2 -d -r1.25.2.17 -r1.25.2.18 *** ip_fil_freebsd.c 9 Jul 2012 16:24:04 -0000 1.25.2.17 --- ip_fil_freebsd.c 20 Jul 2012 07:44:28 -0000 1.25.2.18 *************** *** 1260,1264 **** fin->fin_cksum = FI_CK_L4FULL; return 0; ! } else if (m->m_pkthdr.csum_flags == CSUM_TCP) { fin->fin_cksum = FI_CK_L4PART; return 0; --- 1260,1265 ---- fin->fin_cksum = FI_CK_L4FULL; return 0; ! } else if (m->m_pkthdr.csum_flags == CSUM_TCP || ! m->m_pkthdr.csum_flags == CSUM_UDP) { fin->fin_cksum = FI_CK_L4PART; return 0; |
From: Darren <dar...@us...> - 2012-07-20 07:44:18
|
Update of /cvsroot/ipfilter/ipfilter In directory vz-cvs-4.sog:/tmp/cvs-serv26480 Modified Files: ip_fil_freebsd.c Log Message: 3546247 UDP hardware checksum offload not recognised Index: ip_fil_freebsd.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_fil_freebsd.c,v retrieving revision 1.43 retrieving revision 1.44 diff -C2 -d -r1.43 -r1.44 *** ip_fil_freebsd.c 9 Jul 2012 16:23:49 -0000 1.43 --- ip_fil_freebsd.c 20 Jul 2012 07:44:16 -0000 1.44 *************** *** 1271,1275 **** fin->fin_cksum = FI_CK_L4FULL; return 0; ! } else if (m->m_pkthdr.csum_flags == CSUM_TCP) { fin->fin_cksum = FI_CK_L4PART; return 0; --- 1271,1276 ---- fin->fin_cksum = FI_CK_L4FULL; return 0; ! } else if (m->m_pkthdr.csum_flags == CSUM_TCP || ! m->m_pkthdr.csum_flags == CSUM_UDP) { fin->fin_cksum = FI_CK_L4PART; return 0; |
From: Darren <dar...@us...> - 2012-07-20 07:41:35
|
Update of /cvsroot/ipfilter/ipfilter In directory vz-cvs-4.sog:/tmp/cvs-serv26452 Modified Files: Tag: v5-1-RELEASE ip_fil_solaris.c Log Message: 3545311 ifp_ifaddr does not find the first set address Index: ip_fil_solaris.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_fil_solaris.c,v retrieving revision 1.27.2.20 retrieving revision 1.27.2.21 diff -C2 -d -r1.27.2.20 -r1.27.2.21 *** ip_fil_solaris.c 9 Jul 2012 16:22:33 -0000 1.27.2.20 --- ip_fil_solaris.c 20 Jul 2012 07:41:33 -0000 1.27.2.21 *************** *** 723,726 **** --- 723,727 ---- net_ifaddr_t types[2]; void *array; + int error; if ((qifptr == NULL) || (qifptr == (void *)-1)) *************** *** 742,748 **** if (v == 4) { array = sin; ! net_getlifaddr(softc->ipf_nd_v4, (phy_if_t)qifptr, 0, ! 2, types, sin); } else { array = sin6; --- 743,758 ---- if (v == 4) { + int logical = 0; + array = sin; ! do { ! error = net_getlifaddr(softc->ipf_nd_v4, ! (phy_if_t)qifptr, logical, ! 2, types, sin); ! logical++; ! } while (types[0] == NA_ADDRESS && error == 0 && ! sin[0].sin_addr.s_addr == 0); ! if (sin[0].sin_addr.s_addr == 0 && error != 0) ! return error; } else { array = sin6; |
From: Darren <dar...@us...> - 2012-07-20 07:41:23
|
Update of /cvsroot/ipfilter/ipfilter In directory vz-cvs-4.sog:/tmp/cvs-serv26443 Modified Files: ip_fil_solaris.c Log Message: 3545311 ifp_ifaddr does not find the first set address Index: ip_fil_solaris.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_fil_solaris.c,v retrieving revision 1.44 retrieving revision 1.45 diff -C2 -d -r1.44 -r1.45 *** ip_fil_solaris.c 9 Jul 2012 16:21:52 -0000 1.44 --- ip_fil_solaris.c 20 Jul 2012 07:41:21 -0000 1.45 *************** *** 722,725 **** --- 722,726 ---- net_ifaddr_t types[2]; void *array; + int error; if ((qifptr == NULL) || (qifptr == (void *)-1)) *************** *** 741,747 **** if (v == 4) { array = sin; ! net_getlifaddr(softc->ipf_nd_v4, (phy_if_t)qifptr, 0, ! 2, types, sin); } else { array = sin6; --- 742,757 ---- if (v == 4) { + int logical = 0; + array = sin; ! do { ! error = net_getlifaddr(softc->ipf_nd_v4, ! (phy_if_t)qifptr, logical, ! 2, types, sin); ! logical++; ! } while (types[0] == NA_ADDRESS && error == 0 && ! sin[0].sin_addr.s_addr == 0); ! if (sin[0].sin_addr.s_addr == 0 && error != 0) ! return error; } else { array = sin6; |
From: Darren <dar...@us...> - 2012-07-20 07:41:00
|
Update of /cvsroot/ipfilter/ipfilter/tools In directory vz-cvs-4.sog:/tmp/cvs-serv26423/tools Modified Files: Tag: v5-1-RELEASE ipmon.c Log Message: 3545310 ipmon needs ipl_sec on 64bit boundary Index: ipmon.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/tools/ipmon.c,v retrieving revision 1.20.2.5 retrieving revision 1.20.2.6 diff -C2 -d -r1.20.2.5 -r1.20.2.6 *** ipmon.c 29 May 2012 12:22:39 -0000 1.20.2.5 --- ipmon.c 20 Jul 2012 07:40:57 -0000 1.20.2.6 *************** *** 477,480 **** --- 477,483 ---- int nr; + if (bufsize > IPFILTER_LOGSIZE) + bufsize = IPFILTER_LOGSIZE; + nr = read(fd, buf, bufsize); if (!nr) *************** *** 1817,1821 **** static int read_loginfo(config_t *conf) { ! char buf[DEFAULT_IPFLOGSIZE]; int n, tr, nr, i; logsource_t *l; --- 1820,1824 ---- static int read_loginfo(config_t *conf) { ! iplog_t buf[DEFAULT_IPFLOGSIZE/sizeof(iplog_t)+1]; int n, tr, nr, i; logsource_t *l; *************** *** 1847,1851 **** n = 0; ! tr = read_log(l->fd, &n, buf, sizeof(buf)); if (donehup) { if (conf->file != NULL) { --- 1850,1854 ---- n = 0; ! tr = read_log(l->fd, &n, (char *)buf, sizeof(buf)); if (donehup) { if (conf->file != NULL) { *************** *** 1876,1881 **** if (ipmonopts & IPMON_SYSLOG) syslog(LOG_CRIT, "read: %m\n"); ! else ! perror("read"); return 0; case 1 : --- 1879,1885 ---- if (ipmonopts & IPMON_SYSLOG) syslog(LOG_CRIT, "read: %m\n"); ! else { ! ipferror(l->fd, "read"); ! } return 0; case 1 : *************** *** 1890,1894 **** nr += tr; if (n > 0) { ! print_log(conf, l, buf, n); if (!(ipmonopts & IPMON_SYSLOG)) fflush(conf->log); --- 1894,1898 ---- nr += tr; if (n > 0) { ! print_log(conf, l, (char *)buf, n); if (!(ipmonopts & IPMON_SYSLOG)) fflush(conf->log); |
From: Darren <dar...@us...> - 2012-07-20 07:40:38
|
Update of /cvsroot/ipfilter/ipfilter/tools In directory vz-cvs-4.sog:/tmp/cvs-serv26402/tools Modified Files: ipmon.c Log Message: 3545310 ipmon needs ipl_sec on 64bit boundary Index: ipmon.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/tools/ipmon.c,v retrieving revision 1.26 retrieving revision 1.27 diff -C2 -d -r1.26 -r1.27 *** ipmon.c 5 Jun 2012 11:14:59 -0000 1.26 --- ipmon.c 20 Jul 2012 07:40:36 -0000 1.27 *************** *** 477,480 **** --- 477,483 ---- int nr; + if (bufsize > IPFILTER_LOGSIZE) + bufsize = IPFILTER_LOGSIZE; + nr = read(fd, buf, bufsize); if (!nr) *************** *** 1817,1821 **** static int read_loginfo(config_t *conf) { ! char buf[DEFAULT_IPFLOGSIZE]; int n, tr, nr, i; logsource_t *l; --- 1820,1824 ---- static int read_loginfo(config_t *conf) { ! iplog_t buf[DEFAULT_IPFLOGSIZE/sizeof(iplog_t)+1]; int n, tr, nr, i; logsource_t *l; *************** *** 1847,1851 **** n = 0; ! tr = read_log(l->fd, &n, buf, sizeof(buf)); if (donehup) { if (conf->file != NULL) { --- 1850,1854 ---- n = 0; ! tr = read_log(l->fd, &n, (char *)buf, sizeof(buf)); if (donehup) { if (conf->file != NULL) { *************** *** 1876,1881 **** if (ipmonopts & IPMON_SYSLOG) syslog(LOG_CRIT, "read: %m\n"); ! else ! perror("read"); return 0; case 1 : --- 1879,1885 ---- if (ipmonopts & IPMON_SYSLOG) syslog(LOG_CRIT, "read: %m\n"); ! else { ! ipferror(l->fd, "read"); ! } return 0; case 1 : *************** *** 1890,1894 **** nr += tr; if (n > 0) { ! print_log(conf, l, buf, n); if (!(ipmonopts & IPMON_SYSLOG)) fflush(conf->log); --- 1894,1898 ---- nr += tr; if (n > 0) { ! print_log(conf, l, (char *)buf, n); if (!(ipmonopts & IPMON_SYSLOG)) fflush(conf->log); |
From: Darren <dar...@us...> - 2012-07-20 07:39:13
|
Update of /cvsroot/ipfilter/ipfilter In directory vz-cvs-4.sog:/tmp/cvs-serv26355 Modified Files: Tag: v5-1-RELEASE ip_state.c Log Message: 3545326 reference count changes made without lock 3544315 stateful matching does not use ipfexp_t Index: ip_state.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_state.c,v retrieving revision 1.48.2.23 retrieving revision 1.48.2.24 diff -C2 -d -r1.48.2.23 -r1.48.2.24 *** ip_state.c 13 Jul 2012 11:25:43 -0000 1.48.2.23 --- ip_state.c 20 Jul 2012 07:39:10 -0000 1.48.2.24 *************** *** 1453,1457 **** is->is_pass = pass; is->is_v = fin->fin_v; - is->is_me = stsave; is->is_sec = fin->fin_secmsk; is->is_secmsk = 0xffff; --- 1453,1456 ---- *************** *** 1653,1659 **** hv = DOUBLE_HASH(hv); is->is_hv = hv; - is->is_rule = fr; - is->is_flags = flags & IS_INHERITED; - is->is_rulen = fin->fin_rule; /* --- 1652,1655 ---- *************** *** 1681,1684 **** --- 1677,1684 ---- } bcopy((char *)&ips, (char *)is, sizeof(*is)); + is->is_flags = flags & IS_INHERITED; + is->is_rulen = fin->fin_rule; + is->is_rule = fr; + /* * Do not do the modulous here, it is done in ipf_state_insert(). *************** *** 1710,1716 **** * It may seem strange to set is_ref to 2, but if stsave is not NULL * then a copy of the pointer is being stored somewhere else and in ! * the end, it * will expect to be able to do osmething with it. */ ! is->is_ref = stsave ? 2 : 1; is->is_pkts[0] = 0, is->is_bytes[0] = 0; is->is_pkts[1] = 0, is->is_bytes[1] = 0; --- 1710,1722 ---- * It may seem strange to set is_ref to 2, but if stsave is not NULL * then a copy of the pointer is being stored somewhere else and in ! * the end, it will expect to be able to do osmething with it. */ ! is->is_me = stsave; ! if (stsave != NULL) { ! *stsave = is; ! is->is_ref = 2; ! } else { ! is->is_ref = 1; ! } is->is_pkts[0] = 0, is->is_bytes[0] = 0; is->is_pkts[1] = 0, is->is_bytes[1] = 0; *************** *** 1831,1836 **** RWLOCK_EXIT(&softc->ipf_state); - if (stsave != NULL) - *stsave = is; fin->fin_flx |= FI_STATE; if (fin->fin_flx & FI_FRAG) --- 1837,1840 ---- *************** *** 2080,2084 **** DT2(iss_tcp_oow, fr_info_t *, fin, ipstate_t *, is); SBUMP(ipf_state_stats.iss_tcp_oow); - fin->fin_flx |= FI_OOW; ret = 0; } --- 2084,2087 ---- *************** *** 2218,2221 **** --- 2221,2225 ---- DT2(iss_tcp_struct, tcpdata_t *, fdata, int, seq); SBUMP(ipf_state_stats.iss_tcp_strict); + fin->fin_flx |= FI_OOW; return 0; } *************** *** 3605,3614 **** } - if (is->is_me != NULL) { - *is->is_me = NULL; - is->is_me = NULL; - is->is_ref--; - } - /* * Because ipf_state_stats.iss_wild is a count of entries in the state --- 3609,3612 ---- *************** *** 3638,3647 **** */ MUTEX_ENTER(&is->is_lock); if (is->is_ref > 1) { is->is_ref--; MUTEX_EXIT(&is->is_lock); if (!orphan) softs->ipf_state_stats.iss_orphan++; ! return is->is_ref; } MUTEX_EXIT(&is->is_lock); --- 3636,3653 ---- */ MUTEX_ENTER(&is->is_lock); + if (is->is_me != NULL) { + *is->is_me = NULL; + is->is_me = NULL; + is->is_ref--; + } if (is->is_ref > 1) { + int refs; + is->is_ref--; + refs = is->is_ref; MUTEX_EXIT(&is->is_lock); if (!orphan) softs->ipf_state_stats.iss_orphan++; ! return refs; } MUTEX_EXIT(&is->is_lock); *************** *** 4955,4958 **** --- 4961,4965 ---- &softs->ipf_state_pending, is); + MUTEX_ENTER(&is->is_lock); if (is->is_me != NULL) { *is->is_me = NULL; *************** *** 4960,4963 **** --- 4967,4971 ---- is->is_ref--; } + MUTEX_EXIT(&is->is_lock); } *************** *** 5023,5055 **** u_long ticks; { ! int i, n, *x, e, p; ! e = 0; n = array[0]; x = array + 1; ! for (; n > 0; x += 3 + x[2]) { if (x[0] == IPF_EXP_END) break; - n -= x[2] + 3; - if (n < 0) - break; - - e = 0; - /* * If we need to match the protocol and that doesn't match, * don't even both with the instruction array. */ ! p = (x[0] >> 16) & 0xff; ! if (p != 0 && p != state->is_p) break; ! switch (x[0]) { case IPF_EXP_IP_PR : ! for (i = 0; !e && i < x[2]; i++) { ! e |= (state->is_p == x[i + 3]); } break; --- 5031,5060 ---- u_long ticks; { ! int i, n, *x, rv, p; ! ipfexp_t *e; ! rv = 0; n = array[0]; x = array + 1; ! for (; n > 0; x += 3 + x[3], rv = 0) { ! e = (ipfexp_t *)x; ! n -= e->ipfe_size; if (x[0] == IPF_EXP_END) break; /* * If we need to match the protocol and that doesn't match, * don't even both with the instruction array. */ ! p = e->ipfe_cmd >> 16; ! if ((p != 0) && (p != state->is_p)) break; ! switch (e->ipfe_cmd) { case IPF_EXP_IP_PR : ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= (state->is_p == e->ipfe_arg0[i]); } break; *************** *** 5058,5064 **** if (state->is_v != 4) break; ! for (i = 0; !e && i < x[2]; i++) { ! e |= ((state->is_saddr & x[i + 4]) == ! x[i + 3]); } break; --- 5063,5070 ---- if (state->is_v != 4) break; ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= ((state->is_saddr & ! e->ipfe_arg0[i * 2 + 1]) == ! e->ipfe_arg0[i * 2]); } break; *************** *** 5067,5073 **** if (state->is_v != 4) break; ! for (i = 0; !e && i < x[2]; i++) { ! e |= ((state->is_daddr & x[i + 4]) == ! x[i + 3]); } break; --- 5073,5080 ---- if (state->is_v != 4) break; ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= ((state->is_daddr & ! e->ipfe_arg0[i * 2 + 1]) == ! e->ipfe_arg0[i * 2]); } break; *************** *** 5076,5084 **** if (state->is_v != 4) break; ! for (i = 0; !e && i < x[2]; i++) { ! e |= ((state->is_saddr & x[i + 4]) == ! x[i + 3]) || ! ((state->is_daddr & x[i + 4]) == ! x[i + 3]); } break; --- 5083,5093 ---- if (state->is_v != 4) break; ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= ((state->is_saddr & ! e->ipfe_arg0[i * 2 + 1]) == ! e->ipfe_arg0[i * 2]) || ! ((state->is_daddr & ! e->ipfe_arg0[i * 2 + 1]) == ! e->ipfe_arg0[i * 2]); } break; *************** *** 5088,5094 **** if (state->is_v != 6) break; ! for (i = 0; !e && i < x[3]; i++) { ! e |= IP6_MASKEQ(&state->is_src.in6, x + i + 7, ! x + i + 3); } break; --- 5097,5104 ---- if (state->is_v != 6) break; ! for (i = 0; !rv && i < x[3]; i++) { ! rv |= IP6_MASKEQ(&state->is_src.in6, ! &e->ipfe_arg0[i * 8 + 4], ! &e->ipfe_arg0[i * 8]); } break; *************** *** 5097,5103 **** if (state->is_v != 6) break; ! for (i = 0; !e && i < x[3]; i++) { ! e |= IP6_MASKEQ(&state->is_dst.in6, x + i + 7, ! x + i + 3); } break; --- 5107,5114 ---- if (state->is_v != 6) break; ! for (i = 0; !rv && i < x[3]; i++) { ! rv |= IP6_MASKEQ(&state->is_dst.in6, ! &e->ipfe_arg0[i * 8 + 4], ! &e->ipfe_arg0[i * 8]); } break; *************** *** 5106,5114 **** if (state->is_v != 6) break; ! for (i = 0; !e && i < x[3]; i++) { ! e |= IP6_MASKEQ(&state->is_src.in6, x + i + 7, ! x + i + 3) || ! IP6_MASKEQ(&state->is_dst.in6, x + i + 7, ! x + i + 3); } break; --- 5117,5127 ---- if (state->is_v != 6) break; ! for (i = 0; !rv && i < x[3]; i++) { ! rv |= IP6_MASKEQ(&state->is_src.in6, ! &e->ipfe_arg0[i * 8 + 4], ! &e->ipfe_arg0[i * 8]) || ! IP6_MASKEQ(&state->is_dst.in6, ! &e->ipfe_arg0[i * 8 + 4], ! &e->ipfe_arg0[i * 8]); } break; *************** *** 5117,5123 **** case IPF_EXP_UDP_PORT : case IPF_EXP_TCP_PORT : ! for (i = 0; !e && i < x[2]; i++) { ! e |= (state->is_sport == x[i + 3]) || ! (state->is_dport == x[i + 3]); } break; --- 5130,5136 ---- case IPF_EXP_UDP_PORT : case IPF_EXP_TCP_PORT : ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= (state->is_sport == e->ipfe_arg0[i]) || ! (state->is_dport == e->ipfe_arg0[i]); } break; *************** *** 5125,5130 **** case IPF_EXP_UDP_SPORT : case IPF_EXP_TCP_SPORT : ! for (i = 0; !e && i < x[2]; i++) { ! e |= (state->is_sport == x[i + 3]); } break; --- 5138,5143 ---- case IPF_EXP_UDP_SPORT : case IPF_EXP_TCP_SPORT : ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= (state->is_sport == e->ipfe_arg0[i]); } break; *************** *** 5132,5149 **** case IPF_EXP_UDP_DPORT : case IPF_EXP_TCP_DPORT : ! for (i = 0; !e && i < x[2]; i++) { ! e |= (state->is_dport == x[i + 3]); } break; case IPF_EXP_TCP_STATE : ! for (i = 0; !e && i < x[2]; i++) { ! e |= (state->is_state[0] == x[i + 3]) || ! (state->is_state[1] == x[i + 3]); } break; case IPF_EXP_IDLE_GT : ! e |= (ticks - state->is_touched > x[3]); break; } --- 5145,5162 ---- case IPF_EXP_UDP_DPORT : case IPF_EXP_TCP_DPORT : ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= (state->is_dport == e->ipfe_arg0[i]); } break; case IPF_EXP_TCP_STATE : ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= (state->is_state[0] == e->ipfe_arg0[i]) || ! (state->is_state[1] == e->ipfe_arg0[i]); } break; case IPF_EXP_IDLE_GT : ! rv |= (ticks - state->is_touched > e->ipfe_arg0[0]); break; } *************** *** 5152,5162 **** * Factor in doing a negative match. */ ! e ^= x[1]; ! if (!e) break; } ! return e; } --- 5165,5175 ---- * Factor in doing a negative match. */ ! rv ^= e->ipfe_not; ! if (rv == 0) break; } ! return rv; } |
From: Darren <dar...@us...> - 2012-07-20 07:38:57
|
Update of /cvsroot/ipfilter/ipfilter In directory vz-cvs-4.sog:/tmp/cvs-serv26338 Modified Files: ip_state.c Log Message: 3545326 reference count changes made without lock 3544315 stateful matching does not use ipfexp_t Index: ip_state.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_state.c,v retrieving revision 1.69 retrieving revision 1.70 diff -C2 -d -r1.69 -r1.70 *** ip_state.c 13 Jul 2012 11:25:03 -0000 1.69 --- ip_state.c 20 Jul 2012 07:38:55 -0000 1.70 *************** *** 1591,1595 **** is->is_pass = pass; is->is_v = fin->fin_v; - is->is_me = stsave; is->is_sec = fin->fin_secmsk; is->is_secmsk = 0xffff; --- 1591,1594 ---- *************** *** 1801,1807 **** hv = DOUBLE_HASH(hv); is->is_hv = hv; - is->is_rule = fr; - is->is_flags = flags & IS_INHERITED; - is->is_rulen = fin->fin_rule; /* --- 1800,1803 ---- *************** *** 1829,1832 **** --- 1825,1832 ---- } bcopy((char *)&ips, (char *)is, sizeof(*is)); + is->is_flags = flags & IS_INHERITED; + is->is_rulen = fin->fin_rule; + is->is_rule = fr; + /* * Do not do the modulous here, it is done in ipf_state_insert(). *************** *** 1904,1910 **** * It may seem strange to set is_ref to 2, but if stsave is not NULL * then a copy of the pointer is being stored somewhere else and in ! * the end, it * will expect to be able to do osmething with it. */ ! is->is_ref = stsave ? 2 : 1; is->is_pkts[0] = 0, is->is_bytes[0] = 0; is->is_pkts[1] = 0, is->is_bytes[1] = 0; --- 1904,1916 ---- * It may seem strange to set is_ref to 2, but if stsave is not NULL * then a copy of the pointer is being stored somewhere else and in ! * the end, it will expect to be able to do osmething with it. */ ! is->is_me = stsave; ! if (stsave != NULL) { ! *stsave = is; ! is->is_ref = 2; ! } else { ! is->is_ref = 1; ! } is->is_pkts[0] = 0, is->is_bytes[0] = 0; is->is_pkts[1] = 0, is->is_bytes[1] = 0; *************** *** 1982,1987 **** RWLOCK_EXIT(&softc->ipf_state); - if (stsave != NULL) - *stsave = is; fin->fin_flx |= FI_STATE; if (fin->fin_flx & FI_FRAG) --- 1988,1991 ---- *************** *** 2231,2235 **** DT2(iss_tcp_oow, fr_info_t *, fin, ipstate_t *, is); SBUMP(ipf_state_stats.iss_tcp_oow); - fin->fin_flx |= FI_OOW; ret = 0; } --- 2235,2238 ---- *************** *** 2369,2372 **** --- 2372,2376 ---- DT2(iss_tcp_struct, tcpdata_t *, fdata, int, seq); SBUMP(ipf_state_stats.iss_tcp_strict); + fin->fin_flx |= FI_OOW; return 0; } *************** *** 3792,3801 **** } - if (is->is_me != NULL) { - *is->is_me = NULL; - is->is_me = NULL; - is->is_ref--; - } - /* * Because ipf_state_stats.iss_wild is a count of entries in the state --- 3796,3799 ---- *************** *** 3825,3834 **** */ MUTEX_ENTER(&is->is_lock); if (is->is_ref > 1) { is->is_ref--; MUTEX_EXIT(&is->is_lock); if (!orphan) softs->ipf_state_stats.iss_orphan++; ! return is->is_ref; } MUTEX_EXIT(&is->is_lock); --- 3823,3840 ---- */ MUTEX_ENTER(&is->is_lock); + if (is->is_me != NULL) { + *is->is_me = NULL; + is->is_me = NULL; + is->is_ref--; + } if (is->is_ref > 1) { + int refs; + is->is_ref--; + refs = is->is_ref; MUTEX_EXIT(&is->is_lock); if (!orphan) softs->ipf_state_stats.iss_orphan++; ! return refs; } MUTEX_EXIT(&is->is_lock); *************** *** 5137,5140 **** --- 5143,5147 ---- &softs->ipf_state_pending, is); + MUTEX_ENTER(&is->is_lock); if (is->is_me != NULL) { *is->is_me = NULL; *************** *** 5142,5145 **** --- 5149,5153 ---- is->is_ref--; } + MUTEX_EXIT(&is->is_lock); } *************** *** 5205,5237 **** u_long ticks; { ! int i, n, *x, e, p; ! e = 0; n = array[0]; x = array + 1; ! for (; n > 0; x += 3 + x[2]) { if (x[0] == IPF_EXP_END) break; - n -= x[2] + 3; - if (n < 0) - break; - - e = 0; - /* * If we need to match the protocol and that doesn't match, * don't even both with the instruction array. */ ! p = (x[0] >> 16) & 0xff; ! if (p != 0 && p != state->is_p) break; ! switch (x[0]) { case IPF_EXP_IP_PR : ! for (i = 0; !e && i < x[2]; i++) { ! e |= (state->is_p == x[i + 3]); } break; --- 5213,5242 ---- u_long ticks; { ! int i, n, *x, rv, p; ! ipfexp_t *e; ! rv = 0; n = array[0]; x = array + 1; ! for (; n > 0; x += 3 + x[3], rv = 0) { ! e = (ipfexp_t *)x; ! n -= e->ipfe_size; if (x[0] == IPF_EXP_END) break; /* * If we need to match the protocol and that doesn't match, * don't even both with the instruction array. */ ! p = e->ipfe_cmd >> 16; ! if ((p != 0) && (p != state->is_p)) break; ! switch (e->ipfe_cmd) { case IPF_EXP_IP_PR : ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= (state->is_p == e->ipfe_arg0[i]); } break; *************** *** 5240,5246 **** if (state->is_v != 4) break; ! for (i = 0; !e && i < x[2]; i++) { ! e |= ((state->is_saddr & x[i + 4]) == ! x[i + 3]); } break; --- 5245,5252 ---- if (state->is_v != 4) break; ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= ((state->is_saddr & ! e->ipfe_arg0[i * 2 + 1]) == ! e->ipfe_arg0[i * 2]); } break; *************** *** 5249,5255 **** if (state->is_v != 4) break; ! for (i = 0; !e && i < x[2]; i++) { ! e |= ((state->is_daddr & x[i + 4]) == ! x[i + 3]); } break; --- 5255,5262 ---- if (state->is_v != 4) break; ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= ((state->is_daddr & ! e->ipfe_arg0[i * 2 + 1]) == ! e->ipfe_arg0[i * 2]); } break; *************** *** 5258,5266 **** if (state->is_v != 4) break; ! for (i = 0; !e && i < x[2]; i++) { ! e |= ((state->is_saddr & x[i + 4]) == ! x[i + 3]) || ! ((state->is_daddr & x[i + 4]) == ! x[i + 3]); } break; --- 5265,5275 ---- if (state->is_v != 4) break; ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= ((state->is_saddr & ! e->ipfe_arg0[i * 2 + 1]) == ! e->ipfe_arg0[i * 2]) || ! ((state->is_daddr & ! e->ipfe_arg0[i * 2 + 1]) == ! e->ipfe_arg0[i * 2]); } break; *************** *** 5270,5276 **** if (state->is_v != 6) break; ! for (i = 0; !e && i < x[3]; i++) { ! e |= IP6_MASKEQ(&state->is_src.in6, x + i + 7, ! x + i + 3); } break; --- 5279,5286 ---- if (state->is_v != 6) break; ! for (i = 0; !rv && i < x[3]; i++) { ! rv |= IP6_MASKEQ(&state->is_src.in6, ! &e->ipfe_arg0[i * 8 + 4], ! &e->ipfe_arg0[i * 8]); } break; *************** *** 5279,5285 **** if (state->is_v != 6) break; ! for (i = 0; !e && i < x[3]; i++) { ! e |= IP6_MASKEQ(&state->is_dst.in6, x + i + 7, ! x + i + 3); } break; --- 5289,5296 ---- if (state->is_v != 6) break; ! for (i = 0; !rv && i < x[3]; i++) { ! rv |= IP6_MASKEQ(&state->is_dst.in6, ! &e->ipfe_arg0[i * 8 + 4], ! &e->ipfe_arg0[i * 8]); } break; *************** *** 5288,5296 **** if (state->is_v != 6) break; ! for (i = 0; !e && i < x[3]; i++) { ! e |= IP6_MASKEQ(&state->is_src.in6, x + i + 7, ! x + i + 3) || ! IP6_MASKEQ(&state->is_dst.in6, x + i + 7, ! x + i + 3); } break; --- 5299,5309 ---- if (state->is_v != 6) break; ! for (i = 0; !rv && i < x[3]; i++) { ! rv |= IP6_MASKEQ(&state->is_src.in6, ! &e->ipfe_arg0[i * 8 + 4], ! &e->ipfe_arg0[i * 8]) || ! IP6_MASKEQ(&state->is_dst.in6, ! &e->ipfe_arg0[i * 8 + 4], ! &e->ipfe_arg0[i * 8]); } break; *************** *** 5299,5305 **** case IPF_EXP_UDP_PORT : case IPF_EXP_TCP_PORT : ! for (i = 0; !e && i < x[2]; i++) { ! e |= (state->is_sport == x[i + 3]) || ! (state->is_dport == x[i + 3]); } break; --- 5312,5318 ---- case IPF_EXP_UDP_PORT : case IPF_EXP_TCP_PORT : ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= (state->is_sport == e->ipfe_arg0[i]) || ! (state->is_dport == e->ipfe_arg0[i]); } break; *************** *** 5307,5312 **** case IPF_EXP_UDP_SPORT : case IPF_EXP_TCP_SPORT : ! for (i = 0; !e && i < x[2]; i++) { ! e |= (state->is_sport == x[i + 3]); } break; --- 5320,5325 ---- case IPF_EXP_UDP_SPORT : case IPF_EXP_TCP_SPORT : ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= (state->is_sport == e->ipfe_arg0[i]); } break; *************** *** 5314,5331 **** case IPF_EXP_UDP_DPORT : case IPF_EXP_TCP_DPORT : ! for (i = 0; !e && i < x[2]; i++) { ! e |= (state->is_dport == x[i + 3]); } break; case IPF_EXP_TCP_STATE : ! for (i = 0; !e && i < x[2]; i++) { ! e |= (state->is_state[0] == x[i + 3]) || ! (state->is_state[1] == x[i + 3]); } break; case IPF_EXP_IDLE_GT : ! e |= (ticks - state->is_touched > x[3]); break; } --- 5327,5344 ---- case IPF_EXP_UDP_DPORT : case IPF_EXP_TCP_DPORT : ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= (state->is_dport == e->ipfe_arg0[i]); } break; case IPF_EXP_TCP_STATE : ! for (i = 0; !rv && i < e->ipfe_narg; i++) { ! rv |= (state->is_state[0] == e->ipfe_arg0[i]) || ! (state->is_state[1] == e->ipfe_arg0[i]); } break; case IPF_EXP_IDLE_GT : ! rv |= (ticks - state->is_touched > e->ipfe_arg0[0]); break; } *************** *** 5334,5344 **** * Factor in doing a negative match. */ ! e ^= x[1]; ! if (!e) break; } ! return e; } --- 5347,5357 ---- * Factor in doing a negative match. */ ! rv ^= e->ipfe_not; ! if (rv == 0) break; } ! return rv; } |