[ipfilter-cvs] ipfilter ip_nat.c, v5-1-RELEASE ip_nat6.c, v5-1-RELEASE ip_nat.h, v5-1-RELEASE ip_st
Brought to you by:
darren_r
From: Darren <dar...@us...> - 2013-01-12 02:34:20
|
Update of /cvsroot/ipfilter/ipfilter In directory sfp-cvs-1.v30.ch3.sourceforge.com:/tmp/cvs-serv25133 Modified Files: Tag: v5-1-RELEASE ip_nat.c ip_nat6.c ip_nat.h ip_state.c Log Message: 3600459 NAT bucket count wrong Index: ip_state.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_state.c,v retrieving revision 1.48.2.25 retrieving revision 1.48.2.26 diff -C2 -d -r1.48.2.25 -r1.48.2.26 *** ip_state.c 13 Aug 2012 11:44:15 -0000 1.48.2.25 --- ip_state.c 12 Jan 2013 02:34:17 -0000 1.48.2.26 *************** *** 3648,3655 **** is->is_ref--; } ! if (is->is_ref > 1) { int refs; - is->is_ref--; refs = is->is_ref; MUTEX_EXIT(&is->is_lock); --- 3648,3655 ---- is->is_ref--; } ! is->is_ref--; ! if (is->is_ref > 0) { int refs; refs = is->is_ref; MUTEX_EXIT(&is->is_lock); *************** *** 3669,3673 **** } ! is->is_ref = 0; if (is->is_tqehead[0] != NULL) { --- 3669,3673 ---- } ! ASSERT(is->is_ref == 0); if (is->is_tqehead[0] != NULL) { Index: ip_nat6.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_nat6.c,v retrieving revision 1.22.2.22 retrieving revision 1.22.2.23 diff -C2 -d -r1.22.2.22 -r1.22.2.23 *** ip_nat6.c 25 Aug 2012 14:53:46 -0000 1.22.2.22 --- ip_nat6.c 12 Jan 2013 02:34:17 -0000 1.22.2.23 *************** *** 1286,1290 **** nat_t *nat; { ! u_int hv1, hv2; u_32_t sp, dp; ipnat_t *in; --- 1286,1290 ---- nat_t *nat; { ! u_int hv0, hv1; u_32_t sp, dp; ipnat_t *in; *************** *** 1305,1315 **** dp = 0; } ! hv1 = NAT_HASH_FN6(&nat->nat_osrc6, sp, 0xffffffff); ! hv1 = NAT_HASH_FN6(&nat->nat_odst6, hv1 + dp, softn->ipf_nat_table_sz); /* * TRACE nat6_osrc6, nat6_osport, nat6_odst6, ! * nat6_odport, hv1 */ --- 1305,1315 ---- dp = 0; } ! hv0 = NAT_HASH_FN6(&nat->nat_osrc6, sp, 0xffffffff); ! hv0 = NAT_HASH_FN6(&nat->nat_odst6, hv0 + dp, softn->ipf_nat_table_sz); /* * TRACE nat6_osrc6, nat6_osport, nat6_odst6, ! * nat6_odport, hv0 */ *************** *** 1324,1348 **** dp = 0; } ! hv2 = NAT_HASH_FN6(&nat->nat_nsrc6, sp, 0xffffffff); ! hv2 = NAT_HASH_FN6(&nat->nat_ndst6, hv2 + dp, softn->ipf_nat_table_sz); /* * TRACE nat6_nsrcaddr, nat6_nsport, nat6_ndstaddr, ! * nat6_ndport, hv1 */ } else { ! hv1 = NAT_HASH_FN6(&nat->nat_osrc6, 0, 0xffffffff); ! hv1 = NAT_HASH_FN6(&nat->nat_odst6, hv1, softn->ipf_nat_table_sz); ! /* TRACE nat6_osrcip6, nat6_odstip6, hv1 */ ! hv2 = NAT_HASH_FN6(&nat->nat_nsrc6, 0, 0xffffffff); ! hv2 = NAT_HASH_FN6(&nat->nat_ndst6, hv2, softn->ipf_nat_table_sz); ! /* TRACE nat6_nsrcip6, nat6_ndstip6, hv2 */ } ! nat->nat_hv[0] = hv1; ! nat->nat_hv[1] = hv2; MUTEX_INIT(&nat->nat_lock, "nat entry lock"); --- 1324,1353 ---- dp = 0; } ! hv1 = NAT_HASH_FN6(&nat->nat_nsrc6, sp, 0xffffffff); ! hv1 = NAT_HASH_FN6(&nat->nat_ndst6, hv1 + dp, softn->ipf_nat_table_sz); /* * TRACE nat6_nsrcaddr, nat6_nsport, nat6_ndstaddr, ! * nat6_ndport, hv0 */ } else { ! hv0 = NAT_HASH_FN6(&nat->nat_osrc6, 0, 0xffffffff); ! hv0 = NAT_HASH_FN6(&nat->nat_odst6, hv0, softn->ipf_nat_table_sz); ! /* TRACE nat6_osrcip6, nat6_odstip6, hv0 */ ! hv1 = NAT_HASH_FN6(&nat->nat_nsrc6, 0, 0xffffffff); ! hv1 = NAT_HASH_FN6(&nat->nat_ndst6, hv1, softn->ipf_nat_table_sz); ! /* TRACE nat6_nsrcip6, nat6_ndstip6, hv1 */ } ! if ((nat->nat_dir & NAT_OUTBOUND) == NAT_OUTBOUND) { ! nat->nat_hv[0] = hv0; ! nat->nat_hv[1] = hv1; ! } else { ! nat->nat_hv[0] = hv1; ! nat->nat_hv[1] = hv0; ! } MUTEX_INIT(&nat->nat_lock, "nat entry lock"); *************** *** 2138,2143 **** nat_t *nat; { nat_t **natp; - u_int hv0, hv1; if (nat->nat_flags & SI_CLONE) --- 2143,2148 ---- nat_t *nat; { + u_int rhv0, rhv1, hv0, hv1; nat_t **natp; if (nat->nat_flags & SI_CLONE) *************** *** 2160,2182 **** * Add into the NAT table in the new position */ ! hv0 = NAT_HASH_FN6(&nat->nat_osrc6, nat->nat_osport, 0xffffffff); ! hv0 = NAT_HASH_FN6(&nat->nat_odst6, hv0 + nat->nat_odport, ! softn->ipf_nat_table_sz); ! hv1 = NAT_HASH_FN6(&nat->nat_nsrc6, nat->nat_nsport, 0xffffffff); ! hv1 = NAT_HASH_FN6(&nat->nat_ndst6, hv1 + nat->nat_ndport, ! softn->ipf_nat_table_sz); ! ! if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) { ! u_int swap; ! swap = hv0; ! hv0 = hv1; ! hv1 = swap; } /* TRACE nat_osrc6, nat_osport, nat_odst6, nat_odport, hv0 */ /* TRACE nat_nsrc6, nat_nsport, nat_ndst6, nat_ndport, hv1 */ - nat->nat_hv[0] = hv0; natp = &softn->ipf_nat_table[0][hv0]; if (*natp) --- 2165,2189 ---- * Add into the NAT table in the new position */ ! rhv0 = NAT_HASH_FN6(&nat->nat_osrc6, nat->nat_osport, 0xffffffff); ! rhv0 = NAT_HASH_FN6(&nat->nat_odst6, rhv0 + nat->nat_odport, ! softn->ipf_nat_table_sz); ! rhv1 = NAT_HASH_FN6(&nat->nat_nsrc6, nat->nat_nsport, 0xffffffff); ! rhv1 = NAT_HASH_FN6(&nat->nat_ndst6, rhv1 + nat->nat_ndport, ! softn->ipf_nat_table_sz); ! if ((nat->nat_dir & NAT_OUTBOUND) == NAT_OUTBOUND) { ! nat->nat_hv[0] = rhv0; ! nat->nat_hv[1] = rhv1; ! } else { ! nat->nat_hv[0] = rhv1; ! nat->nat_hv[1] = rhv0; } + hv0 = nat->nat_hv[0] % softn->ipf_nat_table_sz; + hv1 = nat->nat_hv[1] % softn->ipf_nat_table_sz; + /* TRACE nat_osrc6, nat_osport, nat_odst6, nat_odport, hv0 */ /* TRACE nat_nsrc6, nat_nsport, nat_ndst6, nat_ndport, hv1 */ natp = &softn->ipf_nat_table[0][hv0]; if (*natp) *************** *** 2187,2191 **** softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0]++; - nat->nat_hv[1] = hv1; natp = &softn->ipf_nat_table[1][hv1]; if (*natp) --- 2194,2197 ---- Index: ip_nat.h =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_nat.h,v retrieving revision 1.18.2.14 retrieving revision 1.18.2.15 diff -C2 -d -r1.18.2.14 -r1.18.2.15 *** ip_nat.h 25 Aug 2012 14:53:46 -0000 1.18.2.14 --- ip_nat.h 12 Jan 2013 02:34:17 -0000 1.18.2.15 *************** *** 89,92 **** --- 89,107 ---- * This structure is used in the active NAT table and represents an * active NAT session. + * + * Generally nat_t structures have references from at least two places. + * The first place gives them a position in a linked list of NAT sessions + * per instace of IPFilter. In this linked list, nat_next always points to + * the next entry in the list and nat_pnext points to the pointer that + * introduces the structure. That may be either the top of the list pointer + * or simply the nat_next of the previous link in the list. The second place + * that a nat_t structure is generally referenced from is the NAT hash table. + * Two references from this table are required, one for supporting the of + * matching packets being transmitted and one for supporting the matching of + * packets being received. The hash table is comprised of buckets, each one + * having its own chain of nat_t structures. To support these chains, + * nat_hnext is used to point to the next member of the chain and nat_phnext + * points back to the pointer that is pointing to the nat_t in the chain, + * be it the bucket at the top or simply the previous nat_t chain entry. */ typedef struct nat { Index: ip_nat.c =================================================================== RCS file: /cvsroot/ipfilter/ipfilter/ip_nat.c,v retrieving revision 1.60.2.42 retrieving revision 1.60.2.43 diff -C2 -d -r1.60.2.42 -r1.60.2.43 *** ip_nat.c 25 Aug 2012 14:53:46 -0000 1.60.2.42 --- ip_nat.c 12 Jan 2013 02:34:17 -0000 1.60.2.43 *************** *** 2323,2326 **** --- 2323,2327 ---- bkt = nat->nat_hv[0] % softn->ipf_nat_table_sz; nss = &softn->ipf_nat_stats.ns_side[0]; + ASSERT(nss->ns_bucketlen[bkt] > 0); nss->ns_bucketlen[bkt]--; if (nss->ns_bucketlen[bkt] == 0) { *************** *** 2330,2333 **** --- 2331,2335 ---- bkt = nat->nat_hv[1] % softn->ipf_nat_table_sz; nss = &softn->ipf_nat_stats.ns_side[1]; + ASSERT(nss->ns_bucketlen[bkt] > 0); nss->ns_bucketlen[bkt]--; if (nss->ns_bucketlen[bkt] == 0) { *************** *** 3472,3477 **** } ! nat->nat_hv[0] = hv0; ! nat->nat_hv[1] = hv1; MUTEX_INIT(&nat->nat_lock, "nat entry lock"); --- 3474,3484 ---- } ! if ((nat->nat_dir & NAT_OUTBOUND) == NAT_OUTBOUND) { ! nat->nat_hv[0] = hv0; ! nat->nat_hv[1] = hv1; ! } else { ! nat->nat_hv[0] = hv1; ! nat->nat_hv[1] = hv0; ! } MUTEX_INIT(&nat->nat_lock, "nat entry lock"); *************** *** 3511,3517 **** --- 3518,3526 ---- /* ------------------------------------------------------------------------ */ /* Function: ipf_nat_hashtab_add */ + /* Returns: int - 0 == sucess, -1 == failure */ /* Parameters: softc(I) - pointer to soft context main structure */ /* softn(I) - pointer to NAT context structure */ /* nat(I) - pointer to NAT structure */ + /* Write Lock: ipf_nat */ /* */ /* Handle the insertion of a NAT entry into the table/list. */ *************** *** 3530,3541 **** hv1 = nat->nat_hv[1] % softn->ipf_nat_table_sz; - if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) { - u_int swap; - - swap = hv0; - hv0 = hv1; - hv1 = swap; - } - if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen[hv0] >= softn->ipf_nat_maxbucket) { --- 3539,3542 ---- *************** *** 4342,4353 **** nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; *nat->nat_phnext[0] = nat->nat_hnext[0]; ! nsp->ns_side[0].ns_bucketlen[nat->nat_hv[0] % ! softn->ipf_nat_table_sz]--; if (nat->nat_hnext[1]) nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; *nat->nat_phnext[1] = nat->nat_hnext[1]; ! nsp->ns_side[1].ns_bucketlen[nat->nat_hv[1] % ! softn->ipf_nat_table_sz]--; /* --- 4343,4357 ---- nat->nat_hnext[0]->nat_phnext[0] = nat->nat_phnext[0]; *nat->nat_phnext[0] = nat->nat_hnext[0]; ! hv0 = nat->nat_hv[0] % softn->ipf_nat_table_sz; ! hv1 = nat->nat_hv[1] % softn->ipf_nat_table_sz; ! ! ASSERT(nsp->ns_side[0].ns_bucketlen[hv0] > 0); ! nsp->ns_side[0].ns_bucketlen[hv0]--; if (nat->nat_hnext[1]) nat->nat_hnext[1]->nat_phnext[1] = nat->nat_phnext[1]; *nat->nat_phnext[1] = nat->nat_hnext[1]; ! ASSERT(nsp->ns_side[1].ns_bucketlen[hv1] > 0); ! nsp->ns_side[1].ns_bucketlen[hv1]--; /* *************** *** 4361,4379 **** 0xffffffff); ! hv0 = rhv0 % softn->ipf_nat_table_sz; ! hv1 = rhv1 % softn->ipf_nat_table_sz; ! ! if (nat->nat_dir == NAT_INBOUND || nat->nat_dir == NAT_DIVERTIN) { ! u_int swap; ! ! swap = hv0; ! hv0 = hv1; ! hv1 = swap; } /* TRACE nat_osrcaddr, nat_osport, nat_odstaddr, nat_odport, hv0 */ /* TRACE nat_nsrcaddr, nat_nsport, nat_ndstaddr, nat_ndport, hv1 */ - nat->nat_hv[0] = rhv0; natp = &softn->ipf_nat_table[0][hv0]; if (*natp) --- 4365,4382 ---- 0xffffffff); ! if ((nat->nat_dir & NAT_OUTBOUND) == NAT_OUTBOUND) { ! nat->nat_hv[0] = rhv0; ! nat->nat_hv[1] = rhv1; ! } else { ! nat->nat_hv[0] = rhv1; ! nat->nat_hv[1] = rhv0; } + hv0 = nat->nat_hv[0] % softn->ipf_nat_table_sz; + hv1 = nat->nat_hv[1] % softn->ipf_nat_table_sz; + /* TRACE nat_osrcaddr, nat_osport, nat_odstaddr, nat_odport, hv0 */ /* TRACE nat_nsrcaddr, nat_nsport, nat_ndstaddr, nat_ndport, hv1 */ natp = &softn->ipf_nat_table[0][hv0]; if (*natp) *************** *** 4384,4388 **** nsp->ns_side[0].ns_bucketlen[hv0]++; - nat->nat_hv[1] = rhv1; natp = &softn->ipf_nat_table[1][hv1]; if (*natp) --- 4387,4390 ---- |