1*ae8e75c8Schristos /* $NetBSD: ip_rpcb_pxy.c,v 1.4 2014/03/20 20:43:12 christos Exp $ */
2ecd7789bSchristos
3ecd7789bSchristos /*
4f52ace7aSdarrenr * Copyright (C) 2002-2012 by Ryan Beasley <ryanb@goddamnbastard.org>
5ecd7789bSchristos *
6ecd7789bSchristos * See the IPFILTER.LICENCE file for details on licencing.
7ecd7789bSchristos */
8ecd7789bSchristos /*
9ecd7789bSchristos * Overview:
10ecd7789bSchristos * This is an in-kernel application proxy for Sun's RPCBIND (nee portmap)
11ecd7789bSchristos * protocol as defined in RFC1833. It is far from complete, mostly
12ecd7789bSchristos * lacking in less-likely corner cases, but it's definitely functional.
13ecd7789bSchristos *
14ecd7789bSchristos * Invocation:
15ecd7789bSchristos * rdr <int> <e_ip>/32 port <e_p> -> <i_ip> port <i_p> udp proxy rpcbu
16ecd7789bSchristos *
17ecd7789bSchristos * If the host running IP Filter is the same as the RPC server, it's
18ecd7789bSchristos * perfectly legal for both the internal and external addresses and ports
19ecd7789bSchristos * to match.
20ecd7789bSchristos *
21ecd7789bSchristos * When triggered by appropriate IP NAT rules, this proxy works by
22ecd7789bSchristos * examining data contained in received packets. Requests and replies are
23ecd7789bSchristos * modified, NAT and state table entries created, etc., as necessary.
24ecd7789bSchristos */
25ecd7789bSchristos /*
26ecd7789bSchristos * TODO / NOTES
27ecd7789bSchristos *
28ecd7789bSchristos * o Must implement locking to protect proxy session data.
29ecd7789bSchristos * o Fragmentation isn't supported.
30ecd7789bSchristos * o Only supports UDP.
31ecd7789bSchristos * o Doesn't support multiple RPC records in a single request.
32ecd7789bSchristos * o Errors should be more fine-grained. (e.g., malloc failure vs.
33ecd7789bSchristos * illegal RPCB request / reply)
34ecd7789bSchristos * o Even with the limit on the total amount of recorded transactions,
35ecd7789bSchristos * should there be a timeout on transaction removal?
36ecd7789bSchristos * o There is a potential collision between cloning, wildcard NAT and
37ecd7789bSchristos * state entries. There should be an appr_getport routine for
38ecd7789bSchristos * to avoid this.
39ecd7789bSchristos * o The enclosed hack of STREAMS support is pretty sick and most likely
40ecd7789bSchristos * broken.
41ecd7789bSchristos *
42f52ace7aSdarrenr * Id: ip_rpcb_pxy.c,v 1.1.1.2 2012/07/22 13:45:34 darrenr Exp
43ecd7789bSchristos */
44f330e785Schristos
45f330e785Schristos #include <sys/cdefs.h>
46*ae8e75c8Schristos __KERNEL_RCSID(1, "$NetBSD: ip_rpcb_pxy.c,v 1.4 2014/03/20 20:43:12 christos Exp $");
47f330e785Schristos
48ecd7789bSchristos #define IPF_RPCB_PROXY
49ecd7789bSchristos
50ecd7789bSchristos /*
51ecd7789bSchristos * Function prototypes
52ecd7789bSchristos */
53f330e785Schristos void ipf_p_rpcb_main_load(void);
54f330e785Schristos void ipf_p_rpcb_main_unload(void);
55f330e785Schristos int ipf_p_rpcb_new(void *, fr_info_t *, ap_session_t *, nat_t *);
56f330e785Schristos void ipf_p_rpcb_del(ipf_main_softc_t *, ap_session_t *);
57f330e785Schristos int ipf_p_rpcb_in(void *, fr_info_t *, ap_session_t *, nat_t *);
58f330e785Schristos int ipf_p_rpcb_out(void *, fr_info_t *, ap_session_t *, nat_t *);
59ecd7789bSchristos
60f330e785Schristos static void ipf_p_rpcb_flush(rpcb_session_t *);
61f330e785Schristos static int ipf_p_rpcb_decodereq(fr_info_t *, nat_t *,
62f330e785Schristos rpcb_session_t *, rpc_msg_t *);
63f330e785Schristos static int ipf_p_rpcb_skipauth(rpc_msg_t *, xdr_auth_t *, u_32_t **);
64f330e785Schristos static int ipf_p_rpcb_insert(rpcb_session_t *, rpcb_xact_t *);
65f330e785Schristos static int ipf_p_rpcb_xdrrpcb(rpc_msg_t *, u_32_t *, rpcb_args_t *);
66f330e785Schristos static int ipf_p_rpcb_getuaddr(rpc_msg_t *, xdr_uaddr_t *,
67f330e785Schristos u_32_t **);
68f330e785Schristos static u_int ipf_p_rpcb_atoi(char *);
69f330e785Schristos static int ipf_p_rpcb_modreq(fr_info_t *, nat_t *, rpc_msg_t *,
70f330e785Schristos mb_t *, u_int);
71f330e785Schristos static int ipf_p_rpcb_decoderep(fr_info_t *, nat_t *,
72f330e785Schristos rpcb_session_t *, rpc_msg_t *, rpcb_xact_t **);
73f330e785Schristos static rpcb_xact_t * ipf_p_rpcb_lookup(rpcb_session_t *, u_32_t);
74f330e785Schristos static void ipf_p_rpcb_deref(rpcb_session_t *, rpcb_xact_t *);
75f330e785Schristos static int ipf_p_rpcb_getproto(rpc_msg_t *, xdr_proto_t *,
76f330e785Schristos u_32_t **);
77f330e785Schristos static int ipf_p_rpcb_getnat(fr_info_t *, nat_t *, u_int, u_int);
78f330e785Schristos static int ipf_p_rpcb_modv3(fr_info_t *, nat_t *, rpc_msg_t *,
79f330e785Schristos mb_t *, u_int);
80f330e785Schristos static int ipf_p_rpcb_modv4(fr_info_t *, nat_t *, rpc_msg_t *,
81f330e785Schristos mb_t *, u_int);
82f330e785Schristos static void ipf_p_rpcb_fixlen(fr_info_t *, int);
83ecd7789bSchristos
84ecd7789bSchristos /*
85ecd7789bSchristos * Global variables
86ecd7789bSchristos */
87ecd7789bSchristos static frentry_t rpcbfr; /* Skeleton rule for reference by entities
88ecd7789bSchristos this proxy creates. */
89ecd7789bSchristos static int rpcbcnt; /* Upper bound of allocated RPCB sessions. */
90ecd7789bSchristos /* XXX rpcbcnt still requires locking. */
91ecd7789bSchristos
92ecd7789bSchristos static int rpcb_proxy_init = 0;
93ecd7789bSchristos
94ecd7789bSchristos
95ecd7789bSchristos /*
96ecd7789bSchristos * Since rpc_msg contains only pointers, one should use this macro as a
97ecd7789bSchristos * handy way to get to the goods. (In case you're wondering about the name,
98ecd7789bSchristos * this started as BYTEREF -> BREF -> B.)
99ecd7789bSchristos */
100ecd7789bSchristos #define B(r) (u_32_t)ntohl(*(r))
101ecd7789bSchristos
102ecd7789bSchristos /*
103ecd7789bSchristos * Public subroutines
104ecd7789bSchristos */
105ecd7789bSchristos
106ecd7789bSchristos /* -------------------------------------------------------------------- */
107ecd7789bSchristos /* Function: ipf_p_rpcb_main_load */
108ecd7789bSchristos /* Returns: void */
109ecd7789bSchristos /* Parameters: (void) */
110ecd7789bSchristos /* */
111ecd7789bSchristos /* Initialize the filter rule entry and session limiter. */
112ecd7789bSchristos /* -------------------------------------------------------------------- */
113ecd7789bSchristos void
ipf_p_rpcb_main_load(void)114f330e785Schristos ipf_p_rpcb_main_load(void)
115ecd7789bSchristos {
116ecd7789bSchristos rpcbcnt = 0;
117ecd7789bSchristos
118ecd7789bSchristos bzero((char *)&rpcbfr, sizeof(rpcbfr));
119ecd7789bSchristos rpcbfr.fr_ref = 1;
120ecd7789bSchristos rpcbfr.fr_flags = FR_PASS|FR_QUICK|FR_KEEPSTATE;
121ecd7789bSchristos MUTEX_INIT(&rpcbfr.fr_lock, "ipf Sun RPCB proxy rule lock");
122ecd7789bSchristos rpcb_proxy_init = 1;
123ecd7789bSchristos }
124ecd7789bSchristos
125ecd7789bSchristos /* -------------------------------------------------------------------- */
126ecd7789bSchristos /* Function: ipf_p_rpcb_main_unload */
127ecd7789bSchristos /* Returns: void */
128ecd7789bSchristos /* Parameters: (void) */
129ecd7789bSchristos /* */
130ecd7789bSchristos /* Destroy rpcbfr's mutex to avoid a lock leak. */
131ecd7789bSchristos /* -------------------------------------------------------------------- */
132ecd7789bSchristos void
ipf_p_rpcb_main_unload(void)133f330e785Schristos ipf_p_rpcb_main_unload(void)
134ecd7789bSchristos {
135ecd7789bSchristos if (rpcb_proxy_init == 1) {
136ecd7789bSchristos MUTEX_DESTROY(&rpcbfr.fr_lock);
137ecd7789bSchristos rpcb_proxy_init = 0;
138ecd7789bSchristos }
139ecd7789bSchristos }
140ecd7789bSchristos
141ecd7789bSchristos /* -------------------------------------------------------------------- */
142ecd7789bSchristos /* Function: ipf_p_rpcb_new */
143ecd7789bSchristos /* Returns: int - -1 == failure, 0 == success */
144ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */
145ecd7789bSchristos /* aps(I) - pointer to proxy session structure */
146ecd7789bSchristos /* nat(I) - pointer to NAT session structure */
147ecd7789bSchristos /* */
148ecd7789bSchristos /* Allocate resources for per-session proxy structures. */
149ecd7789bSchristos /* -------------------------------------------------------------------- */
150ecd7789bSchristos int
ipf_p_rpcb_new(void * arg,fr_info_t * fin,ap_session_t * aps,nat_t * nat)151f330e785Schristos ipf_p_rpcb_new(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
152ecd7789bSchristos {
153ecd7789bSchristos rpcb_session_t *rs;
154ecd7789bSchristos
155ecd7789bSchristos nat = nat; /* LINT */
156ecd7789bSchristos
157f52ace7aSdarrenr if (fin->fin_v != 4)
158f52ace7aSdarrenr return -1;
159f52ace7aSdarrenr
160ecd7789bSchristos KMALLOC(rs, rpcb_session_t *);
161ecd7789bSchristos if (rs == NULL)
162ecd7789bSchristos return(-1);
163ecd7789bSchristos
164ecd7789bSchristos bzero((char *)rs, sizeof(*rs));
165ecd7789bSchristos MUTEX_INIT(&rs->rs_rxlock, "ipf Sun RPCB proxy session lock");
166ecd7789bSchristos
167ecd7789bSchristos aps->aps_data = rs;
168ecd7789bSchristos
169ecd7789bSchristos return(0);
170ecd7789bSchristos }
171ecd7789bSchristos
172ecd7789bSchristos /* -------------------------------------------------------------------- */
173ecd7789bSchristos /* Function: ipf_p_rpcb_del */
174ecd7789bSchristos /* Returns: void */
175ecd7789bSchristos /* Parameters: aps(I) - pointer to proxy session structure */
176ecd7789bSchristos /* */
177ecd7789bSchristos /* Free up a session's list of RPCB requests. */
178ecd7789bSchristos /* -------------------------------------------------------------------- */
179ecd7789bSchristos void
ipf_p_rpcb_del(ipf_main_softc_t * softc,ap_session_t * aps)180f330e785Schristos ipf_p_rpcb_del(ipf_main_softc_t *softc, ap_session_t *aps)
181ecd7789bSchristos {
182ecd7789bSchristos rpcb_session_t *rs;
183ecd7789bSchristos rs = (rpcb_session_t *)aps->aps_data;
184ecd7789bSchristos
185ecd7789bSchristos MUTEX_ENTER(&rs->rs_rxlock);
186ecd7789bSchristos ipf_p_rpcb_flush(rs);
187ecd7789bSchristos MUTEX_EXIT(&rs->rs_rxlock);
188ecd7789bSchristos MUTEX_DESTROY(&rs->rs_rxlock);
189ecd7789bSchristos }
190ecd7789bSchristos
191ecd7789bSchristos /* -------------------------------------------------------------------- */
192ecd7789bSchristos /* Function: ipf_p_rpcb_in */
193ecd7789bSchristos /* Returns: int - APR_ERR(1) == drop the packet, */
194ecd7789bSchristos /* APR_ERR(2) == kill the proxy session, */
195ecd7789bSchristos /* else change in packet length (in bytes) */
196ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */
197ecd7789bSchristos /* ip(I) - pointer to packet header */
198ecd7789bSchristos /* aps(I) - pointer to proxy session structure */
199ecd7789bSchristos /* nat(I) - pointer to NAT session structure */
200ecd7789bSchristos /* */
201ecd7789bSchristos /* Given a presumed RPCB request, perform some minor tests and pass off */
202ecd7789bSchristos /* for decoding. Also pass packet off for a rewrite if necessary. */
203ecd7789bSchristos /* -------------------------------------------------------------------- */
204ecd7789bSchristos int
ipf_p_rpcb_in(void * arg,fr_info_t * fin,ap_session_t * aps,nat_t * nat)205f330e785Schristos ipf_p_rpcb_in(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
206ecd7789bSchristos {
207ecd7789bSchristos rpc_msg_t rpcmsg, *rm;
208ecd7789bSchristos rpcb_session_t *rs;
209ecd7789bSchristos u_int off, dlen;
210ecd7789bSchristos mb_t *m;
211ecd7789bSchristos int rv;
212ecd7789bSchristos
213ecd7789bSchristos /* Disallow fragmented or illegally short packets. */
214ecd7789bSchristos if ((fin->fin_flx & (FI_FRAG|FI_SHORT)) != 0)
215ecd7789bSchristos return(APR_ERR(1));
216ecd7789bSchristos
217ecd7789bSchristos /* Perform basic variable initialization. */
218ecd7789bSchristos rs = (rpcb_session_t *)aps->aps_data;
219ecd7789bSchristos
220ecd7789bSchristos m = fin->fin_m;
221ecd7789bSchristos off = (char *)fin->fin_dp - (char *)fin->fin_ip;
222ecd7789bSchristos off += sizeof(udphdr_t) + fin->fin_ipoff;
223ecd7789bSchristos dlen = fin->fin_dlen - sizeof(udphdr_t);
224ecd7789bSchristos
225ecd7789bSchristos /* Disallow packets outside legal range for supported requests. */
226ecd7789bSchristos if ((dlen < RPCB_REQMIN) || (dlen > RPCB_REQMAX))
227ecd7789bSchristos return(APR_ERR(1));
228ecd7789bSchristos
229ecd7789bSchristos /* Copy packet over to convenience buffer. */
230ecd7789bSchristos rm = &rpcmsg;
231ecd7789bSchristos bzero((char *)rm, sizeof(*rm));
232f330e785Schristos COPYDATA(m, off, dlen, (void *)&rm->rm_msgbuf);
233ecd7789bSchristos rm->rm_buflen = dlen;
234ecd7789bSchristos
235ecd7789bSchristos /* Send off to decode request. */
236ecd7789bSchristos rv = ipf_p_rpcb_decodereq(fin, nat, rs, rm);
237ecd7789bSchristos
238ecd7789bSchristos switch(rv)
239ecd7789bSchristos {
240ecd7789bSchristos case -1:
241ecd7789bSchristos return(APR_ERR(1));
242ecd7789bSchristos /*NOTREACHED*/
243ecd7789bSchristos break;
244ecd7789bSchristos case 0:
245ecd7789bSchristos break;
246ecd7789bSchristos case 1:
247ecd7789bSchristos rv = ipf_p_rpcb_modreq(fin, nat, rm, m, off);
248ecd7789bSchristos break;
249ecd7789bSchristos default:
250ecd7789bSchristos /*CONSTANTCONDITION*/
251ecd7789bSchristos IPF_PANIC(1, ("illegal rv %d (ipf_p_rpcb_req)", rv));
252ecd7789bSchristos }
253ecd7789bSchristos
254ecd7789bSchristos return(rv);
255ecd7789bSchristos }
256ecd7789bSchristos
257ecd7789bSchristos /* -------------------------------------------------------------------- */
258ecd7789bSchristos /* Function: ipf_p_rpcb_out */
259ecd7789bSchristos /* Returns: int - APR_ERR(1) == drop the packet, */
260ecd7789bSchristos /* APR_ERR(2) == kill the proxy session, */
261ecd7789bSchristos /* else change in packet length (in bytes) */
262ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */
263ecd7789bSchristos /* ip(I) - pointer to packet header */
264ecd7789bSchristos /* aps(I) - pointer to proxy session structure */
265ecd7789bSchristos /* nat(I) - pointer to NAT session structure */
266ecd7789bSchristos /* */
267ecd7789bSchristos /* Given a presumed RPCB reply, perform some minor tests and pass off */
268ecd7789bSchristos /* for decoding. If the message indicates a successful request with */
269ecd7789bSchristos /* valid addressing information, create NAT and state structures to */
270ecd7789bSchristos /* allow direct communication between RPC client and server. */
271ecd7789bSchristos /* -------------------------------------------------------------------- */
272ecd7789bSchristos int
ipf_p_rpcb_out(void * arg,fr_info_t * fin,ap_session_t * aps,nat_t * nat)273f330e785Schristos ipf_p_rpcb_out(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
274ecd7789bSchristos {
275ecd7789bSchristos rpc_msg_t rpcmsg, *rm;
276ecd7789bSchristos rpcb_session_t *rs;
277ecd7789bSchristos rpcb_xact_t *rx;
278ecd7789bSchristos u_int off, dlen;
279ecd7789bSchristos int rv, diff;
280ecd7789bSchristos mb_t *m;
281ecd7789bSchristos
282f330e785Schristos rx = NULL; /* XXX gcc */
283f330e785Schristos
284ecd7789bSchristos /* Disallow fragmented or illegally short packets. */
285ecd7789bSchristos if ((fin->fin_flx & (FI_FRAG|FI_SHORT)) != 0)
286ecd7789bSchristos return(APR_ERR(1));
287ecd7789bSchristos
288ecd7789bSchristos /* Perform basic variable initialization. */
289ecd7789bSchristos rs = (rpcb_session_t *)aps->aps_data;
290ecd7789bSchristos rx = NULL;
291ecd7789bSchristos
292ecd7789bSchristos m = fin->fin_m;
293ecd7789bSchristos off = (char *)fin->fin_dp - (char *)fin->fin_ip;
294ecd7789bSchristos off += sizeof(udphdr_t) + fin->fin_ipoff;
295ecd7789bSchristos dlen = fin->fin_dlen - sizeof(udphdr_t);
296ecd7789bSchristos diff = 0;
297ecd7789bSchristos
298ecd7789bSchristos /* Disallow packets outside legal range for supported requests. */
299ecd7789bSchristos if ((dlen < RPCB_REPMIN) || (dlen > RPCB_REPMAX))
300ecd7789bSchristos return(APR_ERR(1));
301ecd7789bSchristos
302ecd7789bSchristos /* Copy packet over to convenience buffer. */
303ecd7789bSchristos rm = &rpcmsg;
304ecd7789bSchristos bzero((char *)rm, sizeof(*rm));
305f330e785Schristos COPYDATA(m, off, dlen, (void *)&rm->rm_msgbuf);
306ecd7789bSchristos rm->rm_buflen = dlen;
307ecd7789bSchristos
308ecd7789bSchristos rx = NULL; /* XXX gcc */
309ecd7789bSchristos
310ecd7789bSchristos /* Send off to decode reply. */
311ecd7789bSchristos rv = ipf_p_rpcb_decoderep(fin, nat, rs, rm, &rx);
312ecd7789bSchristos
313ecd7789bSchristos switch(rv)
314ecd7789bSchristos {
315ecd7789bSchristos case -1: /* Bad packet */
316ecd7789bSchristos if (rx != NULL) {
317ecd7789bSchristos MUTEX_ENTER(&rs->rs_rxlock);
318ecd7789bSchristos ipf_p_rpcb_deref(rs, rx);
319ecd7789bSchristos MUTEX_EXIT(&rs->rs_rxlock);
320ecd7789bSchristos }
321ecd7789bSchristos return(APR_ERR(1));
322ecd7789bSchristos /*NOTREACHED*/
323ecd7789bSchristos break;
324ecd7789bSchristos case 0: /* Negative reply / request rejected */
325ecd7789bSchristos break;
326ecd7789bSchristos case 1: /* Positive reply */
327ecd7789bSchristos /*
328ecd7789bSchristos * With the IP address embedded in a GETADDR(LIST) reply,
329ecd7789bSchristos * we'll need to rewrite the packet in the very possible
330ecd7789bSchristos * event that the internal & external addresses aren't the
331ecd7789bSchristos * same. (i.e., this box is either a router or rpcbind
332ecd7789bSchristos * only listens on loopback.)
333ecd7789bSchristos */
334ecd7789bSchristos if (nat->nat_odstaddr != nat->nat_ndstaddr) {
335ecd7789bSchristos if (rx->rx_type == RPCB_RES_STRING)
336ecd7789bSchristos diff = ipf_p_rpcb_modv3(fin, nat, rm, m, off);
337ecd7789bSchristos else if (rx->rx_type == RPCB_RES_LIST)
338ecd7789bSchristos diff = ipf_p_rpcb_modv4(fin, nat, rm, m, off);
339ecd7789bSchristos }
340ecd7789bSchristos break;
341ecd7789bSchristos default:
342ecd7789bSchristos /*CONSTANTCONDITION*/
343ecd7789bSchristos IPF_PANIC(1, ("illegal rv %d (ipf_p_rpcb_decoderep)", rv));
344ecd7789bSchristos }
345ecd7789bSchristos
346ecd7789bSchristos if (rx != NULL) {
347ecd7789bSchristos MUTEX_ENTER(&rs->rs_rxlock);
348ecd7789bSchristos /* XXX Gross hack - I'm overloading the reference
349ecd7789bSchristos * counter to deal with both threads and retransmitted
350ecd7789bSchristos * requests. One deref signals that this thread is
351ecd7789bSchristos * finished with rx, and the other signals that we've
352ecd7789bSchristos * processed its reply.
353ecd7789bSchristos */
354ecd7789bSchristos ipf_p_rpcb_deref(rs, rx);
355ecd7789bSchristos ipf_p_rpcb_deref(rs, rx);
356ecd7789bSchristos MUTEX_EXIT(&rs->rs_rxlock);
357ecd7789bSchristos }
358ecd7789bSchristos
359ecd7789bSchristos return(diff);
360ecd7789bSchristos }
361ecd7789bSchristos
362ecd7789bSchristos /*
363ecd7789bSchristos * Private support subroutines
364ecd7789bSchristos */
365ecd7789bSchristos
366ecd7789bSchristos /* -------------------------------------------------------------------- */
367ecd7789bSchristos /* Function: ipf_p_rpcb_flush */
368ecd7789bSchristos /* Returns: void */
369ecd7789bSchristos /* Parameters: rs(I) - pointer to RPCB session structure */
370ecd7789bSchristos /* */
371ecd7789bSchristos /* Simply flushes the list of outstanding transactions, if any. */
372ecd7789bSchristos /* -------------------------------------------------------------------- */
373ecd7789bSchristos static void
ipf_p_rpcb_flush(rpcb_session_t * rs)374f330e785Schristos ipf_p_rpcb_flush(rpcb_session_t *rs)
375ecd7789bSchristos {
376ecd7789bSchristos rpcb_xact_t *r1, *r2;
377ecd7789bSchristos
378ecd7789bSchristos r1 = rs->rs_rxlist;
379ecd7789bSchristos if (r1 == NULL)
380ecd7789bSchristos return;
381ecd7789bSchristos
382ecd7789bSchristos while (r1 != NULL) {
383ecd7789bSchristos r2 = r1;
384ecd7789bSchristos r1 = r1->rx_next;
385ecd7789bSchristos KFREE(r2);
386ecd7789bSchristos }
387ecd7789bSchristos }
388ecd7789bSchristos
389ecd7789bSchristos /* -------------------------------------------------------------------- */
390ecd7789bSchristos /* Function: ipf_p_rpcb_decodereq */
391ecd7789bSchristos /* Returns: int - -1 == bad request or critical failure, */
392ecd7789bSchristos /* 0 == request successfully decoded, */
393ecd7789bSchristos /* 1 == request successfully decoded; requires */
394ecd7789bSchristos /* address rewrite/modification */
395ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */
396ecd7789bSchristos /* nat(I) - pointer to NAT session structure */
397ecd7789bSchristos /* rs(I) - pointer to RPCB session structure */
398ecd7789bSchristos /* rm(I) - pointer to RPC message structure */
399ecd7789bSchristos /* */
400ecd7789bSchristos /* Take a presumed RPCB request, decode it, and store the results in */
401ecd7789bSchristos /* the transaction list. If the internal target address needs to be */
402ecd7789bSchristos /* modified, store its location in ptr. */
403ecd7789bSchristos /* WARNING: It's the responsibility of the caller to make sure there */
404ecd7789bSchristos /* is enough room in rs_buf for the basic RPC message "preamble". */
405ecd7789bSchristos /* -------------------------------------------------------------------- */
406ecd7789bSchristos static int
ipf_p_rpcb_decodereq(fr_info_t * fin,nat_t * nat,rpcb_session_t * rs,rpc_msg_t * rm)407f330e785Schristos ipf_p_rpcb_decodereq(fr_info_t *fin, nat_t *nat, rpcb_session_t *rs,
408f330e785Schristos rpc_msg_t *rm)
409ecd7789bSchristos {
410ecd7789bSchristos rpcb_args_t *ra;
411ecd7789bSchristos u_32_t xdr, *p;
412ecd7789bSchristos rpc_call_t *rc;
413ecd7789bSchristos rpcb_xact_t rx;
414ecd7789bSchristos int mod;
415ecd7789bSchristos
416ecd7789bSchristos p = (u_32_t *)rm->rm_msgbuf;
417ecd7789bSchristos mod = 0;
418ecd7789bSchristos
419ecd7789bSchristos bzero((char *)&rx, sizeof(rx));
420ecd7789bSchristos rc = &rm->rm_call;
421ecd7789bSchristos
422ecd7789bSchristos rm->rm_xid = p;
423ecd7789bSchristos rx.rx_xid = B(p++); /* Record this message's XID. */
424ecd7789bSchristos
425ecd7789bSchristos /* Parse out and test the RPC header. */
426ecd7789bSchristos if ((B(p++) != RPCB_CALL) ||
427ecd7789bSchristos (B(p++) != RPCB_MSG_VERSION) ||
428ecd7789bSchristos (B(p++) != RPCB_PROG))
429ecd7789bSchristos return(-1);
430ecd7789bSchristos
431ecd7789bSchristos /* Record the RPCB version and procedure. */
432ecd7789bSchristos rc->rc_vers = p++;
433ecd7789bSchristos rc->rc_proc = p++;
434ecd7789bSchristos
435ecd7789bSchristos /* Bypass RPC authentication stuff. */
436ecd7789bSchristos if (ipf_p_rpcb_skipauth(rm, &rc->rc_authcred, &p) != 0)
437ecd7789bSchristos return(-1);
438ecd7789bSchristos if (ipf_p_rpcb_skipauth(rm, &rc->rc_authverf, &p) != 0)
439ecd7789bSchristos return(-1);
440ecd7789bSchristos
441ecd7789bSchristos /* Compare RPCB version and procedure numbers. */
442ecd7789bSchristos switch(B(rc->rc_vers))
443ecd7789bSchristos {
444ecd7789bSchristos case 2:
445ecd7789bSchristos /* This proxy only supports PMAP_GETPORT. */
446ecd7789bSchristos if (B(rc->rc_proc) != RPCB_GETPORT)
447ecd7789bSchristos return(-1);
448ecd7789bSchristos
449ecd7789bSchristos /* Portmap requests contain four 4 byte parameters. */
450ecd7789bSchristos if (RPCB_BUF_EQ(rm, p, 16) == 0)
451ecd7789bSchristos return(-1);
452ecd7789bSchristos
453ecd7789bSchristos p += 2; /* Skip requested program and version numbers. */
454ecd7789bSchristos
455ecd7789bSchristos /* Sanity check the requested protocol. */
456ecd7789bSchristos xdr = B(p);
457ecd7789bSchristos if (!(xdr == IPPROTO_UDP || xdr == IPPROTO_TCP))
458ecd7789bSchristos return(-1);
459ecd7789bSchristos
460ecd7789bSchristos rx.rx_type = RPCB_RES_PMAP;
461ecd7789bSchristos rx.rx_proto = xdr;
462ecd7789bSchristos break;
463ecd7789bSchristos case 3:
464ecd7789bSchristos case 4:
465ecd7789bSchristos /* GETADDRLIST is exclusive to v4; GETADDR for v3 & v4 */
466ecd7789bSchristos switch(B(rc->rc_proc))
467ecd7789bSchristos {
468ecd7789bSchristos case RPCB_GETADDR:
469ecd7789bSchristos rx.rx_type = RPCB_RES_STRING;
470ecd7789bSchristos rx.rx_proto = (u_int)fin->fin_p;
471ecd7789bSchristos break;
472ecd7789bSchristos case RPCB_GETADDRLIST:
473ecd7789bSchristos if (B(rc->rc_vers) != 4)
474ecd7789bSchristos return(-1);
475ecd7789bSchristos rx.rx_type = RPCB_RES_LIST;
476ecd7789bSchristos break;
477ecd7789bSchristos default:
478ecd7789bSchristos return(-1);
479ecd7789bSchristos }
480ecd7789bSchristos
481ecd7789bSchristos ra = &rc->rc_rpcbargs;
482ecd7789bSchristos
483ecd7789bSchristos /* Decode the 'struct rpcb' request. */
484ecd7789bSchristos if (ipf_p_rpcb_xdrrpcb(rm, p, ra) != 0)
485ecd7789bSchristos return(-1);
486ecd7789bSchristos
487ecd7789bSchristos /* Are the target address & port valid? */
488ecd7789bSchristos if ((ra->ra_maddr.xu_ip != nat->nat_ndstaddr) ||
489ecd7789bSchristos (ra->ra_maddr.xu_port != nat->nat_ndport))
490ecd7789bSchristos return(-1);
491ecd7789bSchristos
492ecd7789bSchristos /* Do we need to rewrite this packet? */
493ecd7789bSchristos if ((nat->nat_ndstaddr != nat->nat_odstaddr) ||
494ecd7789bSchristos (nat->nat_ndport != nat->nat_odport))
495ecd7789bSchristos mod = 1;
496ecd7789bSchristos break;
497ecd7789bSchristos default:
498ecd7789bSchristos return(-1);
499ecd7789bSchristos }
500ecd7789bSchristos
501ecd7789bSchristos MUTEX_ENTER(&rs->rs_rxlock);
502ecd7789bSchristos if (ipf_p_rpcb_insert(rs, &rx) != 0) {
503ecd7789bSchristos MUTEX_EXIT(&rs->rs_rxlock);
504ecd7789bSchristos return(-1);
505ecd7789bSchristos }
506ecd7789bSchristos MUTEX_EXIT(&rs->rs_rxlock);
507ecd7789bSchristos
508ecd7789bSchristos return(mod);
509ecd7789bSchristos }
510ecd7789bSchristos
511ecd7789bSchristos /* -------------------------------------------------------------------- */
512ecd7789bSchristos /* Function: ipf_p_rpcb_skipauth */
513ecd7789bSchristos /* Returns: int -- -1 == illegal auth parameters (lengths) */
514ecd7789bSchristos /* 0 == valid parameters, pointer advanced */
515ecd7789bSchristos /* Parameters: rm(I) - pointer to RPC message structure */
516ecd7789bSchristos /* auth(I) - pointer to RPC auth structure */
517ecd7789bSchristos /* buf(IO) - pointer to location within convenience buffer */
518ecd7789bSchristos /* */
519ecd7789bSchristos /* Record auth data length & location of auth data, then advance past */
520ecd7789bSchristos /* it. */
521ecd7789bSchristos /* -------------------------------------------------------------------- */
522ecd7789bSchristos static int
ipf_p_rpcb_skipauth(rpc_msg_t * rm,xdr_auth_t * auth,u_32_t ** buf)523f330e785Schristos ipf_p_rpcb_skipauth(rpc_msg_t *rm, xdr_auth_t *auth, u_32_t **buf)
524ecd7789bSchristos {
525ecd7789bSchristos u_32_t *p, xdr;
526ecd7789bSchristos
527ecd7789bSchristos p = *buf;
528ecd7789bSchristos
529ecd7789bSchristos /* Make sure we have enough space for expected fixed auth parms. */
530ecd7789bSchristos if (RPCB_BUF_GEQ(rm, p, 8) == 0)
531ecd7789bSchristos return(-1);
532ecd7789bSchristos
533ecd7789bSchristos p++; /* We don't care about auth_flavor. */
534ecd7789bSchristos
535ecd7789bSchristos auth->xa_string.xs_len = p;
536ecd7789bSchristos xdr = B(p++); /* Length of auth_data */
537ecd7789bSchristos
538ecd7789bSchristos /* Test for absurdity / illegality of auth_data length. */
539ecd7789bSchristos if ((XDRALIGN(xdr) < xdr) || (RPCB_BUF_GEQ(rm, p, XDRALIGN(xdr)) == 0))
540ecd7789bSchristos return(-1);
541ecd7789bSchristos
542ecd7789bSchristos auth->xa_string.xs_str = (char *)p;
543ecd7789bSchristos
544ecd7789bSchristos p += XDRALIGN(xdr); /* Advance our location. */
545ecd7789bSchristos
546ecd7789bSchristos *buf = (u_32_t *)p;
547ecd7789bSchristos
548ecd7789bSchristos return(0);
549ecd7789bSchristos }
550ecd7789bSchristos
551ecd7789bSchristos /* -------------------------------------------------------------------- */
552ecd7789bSchristos /* Function: ipf_p_rpcb_insert */
553ecd7789bSchristos /* Returns: int -- -1 == list insertion failed, */
554ecd7789bSchristos /* 0 == item successfully added */
555ecd7789bSchristos /* Parameters: rs(I) - pointer to RPCB session structure */
556ecd7789bSchristos /* rx(I) - pointer to RPCB transaction structure */
557ecd7789bSchristos /* -------------------------------------------------------------------- */
558ecd7789bSchristos static int
ipf_p_rpcb_insert(rpcb_session_t * rs,rpcb_xact_t * rx)559f330e785Schristos ipf_p_rpcb_insert(rpcb_session_t *rs, rpcb_xact_t *rx)
560ecd7789bSchristos {
561ecd7789bSchristos rpcb_xact_t *rxp;
562ecd7789bSchristos
563ecd7789bSchristos rxp = ipf_p_rpcb_lookup(rs, rx->rx_xid);
564ecd7789bSchristos if (rxp != NULL) {
565ecd7789bSchristos ++rxp->rx_ref;
566ecd7789bSchristos return(0);
567ecd7789bSchristos }
568ecd7789bSchristos
569ecd7789bSchristos if (rpcbcnt == RPCB_MAXREQS)
570ecd7789bSchristos return(-1);
571ecd7789bSchristos
572ecd7789bSchristos KMALLOC(rxp, rpcb_xact_t *);
573ecd7789bSchristos if (rxp == NULL)
574ecd7789bSchristos return(-1);
575ecd7789bSchristos
576ecd7789bSchristos bcopy((char *)rx, (char *)rxp, sizeof(*rx));
577ecd7789bSchristos
578ecd7789bSchristos if (rs->rs_rxlist != NULL)
579ecd7789bSchristos rs->rs_rxlist->rx_pnext = &rxp->rx_next;
580ecd7789bSchristos
581ecd7789bSchristos rxp->rx_pnext = &rs->rs_rxlist;
582ecd7789bSchristos rxp->rx_next = rs->rs_rxlist;
583ecd7789bSchristos rs->rs_rxlist = rxp;
584ecd7789bSchristos
585ecd7789bSchristos rxp->rx_ref = 1;
586ecd7789bSchristos
587ecd7789bSchristos ++rpcbcnt;
588ecd7789bSchristos
589ecd7789bSchristos return(0);
590ecd7789bSchristos }
591ecd7789bSchristos
592ecd7789bSchristos /* -------------------------------------------------------------------- */
593ecd7789bSchristos /* Function: ipf_p_rpcb_xdrrpcb */
594ecd7789bSchristos /* Returns: int -- -1 == failure to properly decode the request */
595ecd7789bSchristos /* 0 == rpcb successfully decoded */
596ecd7789bSchristos /* Parameters: rs(I) - pointer to RPCB session structure */
597ecd7789bSchristos /* p(I) - pointer to location within session buffer */
598ecd7789bSchristos /* rpcb(O) - pointer to rpcb (xdr type) structure */
599ecd7789bSchristos /* */
600ecd7789bSchristos /* Decode a XDR encoded rpcb structure and record its contents in rpcb */
601ecd7789bSchristos /* within only the context of TCP/UDP over IP networks. */
602ecd7789bSchristos /* -------------------------------------------------------------------- */
603ecd7789bSchristos static int
ipf_p_rpcb_xdrrpcb(rpc_msg_t * rm,u_32_t * p,rpcb_args_t * ra)604f330e785Schristos ipf_p_rpcb_xdrrpcb(rpc_msg_t *rm, u_32_t *p, rpcb_args_t *ra)
605ecd7789bSchristos {
606ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, p, 20))
607ecd7789bSchristos return(-1);
608ecd7789bSchristos
609ecd7789bSchristos /* Bypass target program & version. */
610ecd7789bSchristos p += 2;
611ecd7789bSchristos
612ecd7789bSchristos /* Decode r_netid. Must be "tcp" or "udp". */
613ecd7789bSchristos if (ipf_p_rpcb_getproto(rm, &ra->ra_netid, &p) != 0)
614ecd7789bSchristos return(-1);
615ecd7789bSchristos
616ecd7789bSchristos /* Decode r_maddr. */
617ecd7789bSchristos if (ipf_p_rpcb_getuaddr(rm, &ra->ra_maddr, &p) != 0)
618ecd7789bSchristos return(-1);
619ecd7789bSchristos
620ecd7789bSchristos /* Advance to r_owner and make sure it's empty. */
621ecd7789bSchristos if (!RPCB_BUF_EQ(rm, p, 4) || (B(p) != 0))
622ecd7789bSchristos return(-1);
623ecd7789bSchristos
624ecd7789bSchristos return(0);
625ecd7789bSchristos }
626ecd7789bSchristos
627ecd7789bSchristos /* -------------------------------------------------------------------- */
628ecd7789bSchristos /* Function: ipf_p_rpcb_getuaddr */
629ecd7789bSchristos /* Returns: int -- -1 == illegal string, */
630ecd7789bSchristos /* 0 == string parsed; contents recorded */
631ecd7789bSchristos /* Parameters: rm(I) - pointer to RPC message structure */
632ecd7789bSchristos /* xu(I) - pointer to universal address structure */
633ecd7789bSchristos /* p(IO) - pointer to location within message buffer */
634ecd7789bSchristos /* */
635ecd7789bSchristos /* Decode the IP address / port at p and record them in xu. */
636ecd7789bSchristos /* -------------------------------------------------------------------- */
637ecd7789bSchristos static int
ipf_p_rpcb_getuaddr(rpc_msg_t * rm,xdr_uaddr_t * xu,u_32_t ** p)638f330e785Schristos ipf_p_rpcb_getuaddr(rpc_msg_t *rm, xdr_uaddr_t *xu, u_32_t **p)
639ecd7789bSchristos {
640ecd7789bSchristos char *c, *i, *b, *pp;
641ecd7789bSchristos u_int d, dd, l, t;
642ecd7789bSchristos char uastr[24];
643ecd7789bSchristos
644ecd7789bSchristos /* Test for string length. */
645ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, *p, 4))
646ecd7789bSchristos return(-1);
647ecd7789bSchristos
648ecd7789bSchristos xu->xu_xslen = (*p)++;
649ecd7789bSchristos xu->xu_xsstr = (char *)*p;
650ecd7789bSchristos
651ecd7789bSchristos /* Length check */
652ecd7789bSchristos l = B(xu->xu_xslen);
653ecd7789bSchristos if (l < 11 || l > 23 || !RPCB_BUF_GEQ(rm, *p, XDRALIGN(l)))
654ecd7789bSchristos return(-1);
655ecd7789bSchristos
656ecd7789bSchristos /* Advance p */
657ecd7789bSchristos *(char **)p += XDRALIGN(l);
658ecd7789bSchristos
659ecd7789bSchristos /* Copy string to local buffer & terminate C style */
660ecd7789bSchristos bcopy(xu->xu_xsstr, uastr, l);
661ecd7789bSchristos uastr[l] = '\0';
662ecd7789bSchristos
663ecd7789bSchristos i = (char *)&xu->xu_ip;
664ecd7789bSchristos pp = (char *)&xu->xu_port;
665ecd7789bSchristos
666ecd7789bSchristos /*
667ecd7789bSchristos * Expected format: a.b.c.d.e.f where [a-d] correspond to bytes of
668ecd7789bSchristos * an IP address and [ef] are the bytes of a L4 port.
669ecd7789bSchristos */
670ecd7789bSchristos if (!(ISDIGIT(uastr[0]) && ISDIGIT(uastr[l-1])))
671ecd7789bSchristos return(-1);
672ecd7789bSchristos b = uastr;
673ecd7789bSchristos for (c = &uastr[1], d = 0, dd = 0; c < &uastr[l-1]; c++) {
674ecd7789bSchristos if (ISDIGIT(*c)) {
675ecd7789bSchristos dd = 0;
676ecd7789bSchristos continue;
677ecd7789bSchristos }
678ecd7789bSchristos if (*c == '.') {
679ecd7789bSchristos if (dd != 0)
680ecd7789bSchristos return(-1);
681ecd7789bSchristos
682ecd7789bSchristos /* Check for ASCII byte. */
683ecd7789bSchristos *c = '\0';
684ecd7789bSchristos t = ipf_p_rpcb_atoi(b);
685ecd7789bSchristos if (t > 255)
686ecd7789bSchristos return(-1);
687ecd7789bSchristos
688ecd7789bSchristos /* Aim b at beginning of the next byte. */
689ecd7789bSchristos b = c + 1;
690ecd7789bSchristos
691ecd7789bSchristos /* Switch off IP addr vs port parsing. */
692ecd7789bSchristos if (d < 4)
693ecd7789bSchristos i[d++] = t & 0xff;
694ecd7789bSchristos else
695ecd7789bSchristos pp[d++ - 4] = t & 0xff;
696ecd7789bSchristos
697ecd7789bSchristos dd = 1;
698ecd7789bSchristos continue;
699ecd7789bSchristos }
700ecd7789bSchristos return(-1);
701ecd7789bSchristos }
702ecd7789bSchristos if (d != 5) /* String must contain exactly 5 periods. */
703ecd7789bSchristos return(-1);
704ecd7789bSchristos
705ecd7789bSchristos /* Handle the last byte (port low byte) */
706ecd7789bSchristos t = ipf_p_rpcb_atoi(b);
707ecd7789bSchristos if (t > 255)
708ecd7789bSchristos return(-1);
709ecd7789bSchristos pp[d - 4] = t & 0xff;
710ecd7789bSchristos
711ecd7789bSchristos return(0);
712ecd7789bSchristos }
713ecd7789bSchristos
714ecd7789bSchristos /* -------------------------------------------------------------------- */
715ecd7789bSchristos /* Function: ipf_p_rpcb_atoi (XXX should be generic for all proxies) */
716ecd7789bSchristos /* Returns: int -- integer representation of supplied string */
717ecd7789bSchristos /* Parameters: ptr(I) - input string */
718ecd7789bSchristos /* */
719ecd7789bSchristos /* Simple version of atoi(3) ripped from ip_rcmd_pxy.c. */
720ecd7789bSchristos /* -------------------------------------------------------------------- */
721ecd7789bSchristos static u_int
ipf_p_rpcb_atoi(char * ptr)722f330e785Schristos ipf_p_rpcb_atoi(char *ptr)
723ecd7789bSchristos {
724f330e785Schristos char *s = ptr, c;
725f330e785Schristos u_int i = 0;
726ecd7789bSchristos
727ecd7789bSchristos while (((c = *s++) != '\0') && ISDIGIT(c)) {
728ecd7789bSchristos i *= 10;
729ecd7789bSchristos i += c - '0';
730ecd7789bSchristos }
731ecd7789bSchristos return i;
732ecd7789bSchristos }
733ecd7789bSchristos
734ecd7789bSchristos /* -------------------------------------------------------------------- */
735ecd7789bSchristos /* Function: ipf_p_rpcb_modreq */
736ecd7789bSchristos /* Returns: int -- change in datagram length */
737ecd7789bSchristos /* APR_ERR(2) - critical failure */
738ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */
739ecd7789bSchristos /* nat(I) - pointer to NAT session */
740ecd7789bSchristos /* rm(I) - pointer to RPC message structure */
741ecd7789bSchristos /* m(I) - pointer to mbuf chain */
742ecd7789bSchristos /* off(I) - current offset within mbuf chain */
743ecd7789bSchristos /* */
744ecd7789bSchristos /* When external and internal addresses differ, we rewrite the former */
745ecd7789bSchristos /* with the latter. (This is exclusive to protocol versions 3 & 4). */
746ecd7789bSchristos /* -------------------------------------------------------------------- */
747ecd7789bSchristos static int
ipf_p_rpcb_modreq(fr_info_t * fin,nat_t * nat,rpc_msg_t * rm,mb_t * m,u_int off)748f330e785Schristos ipf_p_rpcb_modreq(fr_info_t *fin, nat_t *nat, rpc_msg_t *rm, mb_t *m, u_int off)
749ecd7789bSchristos {
750ecd7789bSchristos u_int len, xlen, pos, bogo;
751ecd7789bSchristos rpcb_args_t *ra;
752ecd7789bSchristos char uaddr[24];
753ecd7789bSchristos udphdr_t *udp;
754ecd7789bSchristos char *i, *p;
755ecd7789bSchristos int diff;
756ecd7789bSchristos
757ecd7789bSchristos ra = &rm->rm_call.rc_rpcbargs;
758ecd7789bSchristos i = (char *)&nat->nat_odstaddr;
759ecd7789bSchristos p = (char *)&nat->nat_odport;
760ecd7789bSchristos
761ecd7789bSchristos /* Form new string. */
762ecd7789bSchristos bzero(uaddr, sizeof(uaddr)); /* Just in case we need padding. */
763*ae8e75c8Schristos snprintf(uaddr, sizeof(uaddr),
764ecd7789bSchristos "%u.%u.%u.%u.%u.%u", i[0] & 0xff, i[1] & 0xff,
765ecd7789bSchristos i[2] & 0xff, i[3] & 0xff, p[0] & 0xff, p[1] & 0xff);
766ecd7789bSchristos len = strlen(uaddr);
767ecd7789bSchristos xlen = XDRALIGN(len);
768ecd7789bSchristos
769ecd7789bSchristos /* Determine mbuf offset to start writing to. */
770ecd7789bSchristos pos = (char *)ra->ra_maddr.xu_xslen - rm->rm_msgbuf;
771ecd7789bSchristos off += pos;
772ecd7789bSchristos
773ecd7789bSchristos /* Write new string length. */
774ecd7789bSchristos bogo = htonl(len);
775f330e785Schristos COPYBACK(m, off, 4, (void *)&bogo);
776ecd7789bSchristos off += 4;
777ecd7789bSchristos
778ecd7789bSchristos /* Write new string. */
779ecd7789bSchristos COPYBACK(m, off, xlen, uaddr);
780ecd7789bSchristos off += xlen;
781ecd7789bSchristos
782ecd7789bSchristos /* Write in zero r_owner. */
783ecd7789bSchristos bogo = 0;
784f330e785Schristos COPYBACK(m, off, 4, (void *)&bogo);
785ecd7789bSchristos
786ecd7789bSchristos /* Determine difference in data lengths. */
787ecd7789bSchristos diff = xlen - XDRALIGN(B(ra->ra_maddr.xu_xslen));
788ecd7789bSchristos
789ecd7789bSchristos /*
790ecd7789bSchristos * If our new string has a different length, make necessary
791ecd7789bSchristos * adjustments.
792ecd7789bSchristos */
793ecd7789bSchristos if (diff != 0) {
794ecd7789bSchristos udp = fin->fin_dp;
795ecd7789bSchristos udp->uh_ulen = htons(ntohs(udp->uh_ulen) + diff);
796ecd7789bSchristos fin->fin_plen += diff;
797ecd7789bSchristos fin->fin_ip->ip_len = htons(fin->fin_plen);
798ecd7789bSchristos fin->fin_dlen += diff;
799ecd7789bSchristos /* XXX Storage lengths. */
800ecd7789bSchristos }
801ecd7789bSchristos
802ecd7789bSchristos return(diff);
803ecd7789bSchristos }
804ecd7789bSchristos
805ecd7789bSchristos /* -------------------------------------------------------------------- */
806ecd7789bSchristos /* Function: ipf_p_rpcb_decoderep */
807ecd7789bSchristos /* Returns: int - -1 == bad request or critical failure, */
808ecd7789bSchristos /* 0 == valid, negative reply */
809ecd7789bSchristos /* 1 == vaddlid, positive reply; needs no changes */
810ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */
811ecd7789bSchristos /* nat(I) - pointer to NAT session structure */
812ecd7789bSchristos /* rs(I) - pointer to RPCB session structure */
813ecd7789bSchristos /* rm(I) - pointer to RPC message structure */
814ecd7789bSchristos /* rxp(O) - pointer to RPCB transaction structure */
815ecd7789bSchristos /* */
816ecd7789bSchristos /* Take a presumed RPCB reply, extract the XID, search for the original */
817ecd7789bSchristos /* request information, and determine whether the request was accepted */
818ecd7789bSchristos /* or rejected. With a valid accepted reply, go ahead and create NAT */
819ecd7789bSchristos /* and state entries, and finish up by rewriting the packet as */
820ecd7789bSchristos /* required. */
821ecd7789bSchristos /* */
822ecd7789bSchristos /* WARNING: It's the responsibility of the caller to make sure there */
823ecd7789bSchristos /* is enough room in rs_buf for the basic RPC message "preamble". */
824ecd7789bSchristos /* -------------------------------------------------------------------- */
825ecd7789bSchristos static int
ipf_p_rpcb_decoderep(fr_info_t * fin,nat_t * nat,rpcb_session_t * rs,rpc_msg_t * rm,rpcb_xact_t ** rxp)826f330e785Schristos ipf_p_rpcb_decoderep(fr_info_t *fin, nat_t *nat, rpcb_session_t *rs,
827f330e785Schristos rpc_msg_t *rm, rpcb_xact_t **rxp)
828ecd7789bSchristos {
829ecd7789bSchristos rpcb_listp_t *rl;
830ecd7789bSchristos rpcb_entry_t *re;
831ecd7789bSchristos rpcb_xact_t *rx;
832ecd7789bSchristos u_32_t xdr, *p;
833ecd7789bSchristos rpc_resp_t *rr;
834ecd7789bSchristos int rv, cnt;
835ecd7789bSchristos
836ecd7789bSchristos p = (u_32_t *)rm->rm_msgbuf;
837ecd7789bSchristos
838ecd7789bSchristos bzero((char *)&rx, sizeof(rx));
839ecd7789bSchristos rr = &rm->rm_resp;
840ecd7789bSchristos
841ecd7789bSchristos rm->rm_xid = p;
842ecd7789bSchristos xdr = B(p++); /* Record this message's XID. */
843ecd7789bSchristos
844ecd7789bSchristos /* Lookup XID */
845ecd7789bSchristos MUTEX_ENTER(&rs->rs_rxlock);
846ecd7789bSchristos if ((rx = ipf_p_rpcb_lookup(rs, xdr)) == NULL) {
847ecd7789bSchristos MUTEX_EXIT(&rs->rs_rxlock);
848ecd7789bSchristos return(-1);
849ecd7789bSchristos }
850ecd7789bSchristos ++rx->rx_ref; /* per thread reference */
851ecd7789bSchristos MUTEX_EXIT(&rs->rs_rxlock);
852ecd7789bSchristos
853ecd7789bSchristos *rxp = rx;
854ecd7789bSchristos
855ecd7789bSchristos /* Test call vs reply */
856ecd7789bSchristos if (B(p++) != RPCB_REPLY)
857ecd7789bSchristos return(-1);
858ecd7789bSchristos
859ecd7789bSchristos /* Test reply_stat */
860ecd7789bSchristos switch(B(p++))
861ecd7789bSchristos {
862ecd7789bSchristos case RPCB_MSG_DENIED:
863ecd7789bSchristos return(0);
864ecd7789bSchristos case RPCB_MSG_ACCEPTED:
865ecd7789bSchristos break;
866ecd7789bSchristos default:
867ecd7789bSchristos return(-1);
868ecd7789bSchristos }
869ecd7789bSchristos
870ecd7789bSchristos /* Bypass RPC authentication stuff. */
871ecd7789bSchristos if (ipf_p_rpcb_skipauth(rm, &rr->rr_authverf, &p) != 0)
872ecd7789bSchristos return(-1);
873ecd7789bSchristos
874ecd7789bSchristos /* Test accept status */
875ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, p, 4))
876ecd7789bSchristos return(-1);
877ecd7789bSchristos if (B(p++) != 0)
878ecd7789bSchristos return(0);
879ecd7789bSchristos
880ecd7789bSchristos /* Parse out the expected reply */
881ecd7789bSchristos switch(rx->rx_type)
882ecd7789bSchristos {
883ecd7789bSchristos case RPCB_RES_PMAP:
884ecd7789bSchristos /* There must be only one 4 byte argument. */
885ecd7789bSchristos if (!RPCB_BUF_EQ(rm, p, 4))
886ecd7789bSchristos return(-1);
887ecd7789bSchristos
888ecd7789bSchristos rr->rr_v2 = p;
889ecd7789bSchristos xdr = B(rr->rr_v2);
890ecd7789bSchristos
891ecd7789bSchristos /* Reply w/ a 0 port indicates service isn't registered */
892ecd7789bSchristos if (xdr == 0)
893ecd7789bSchristos return(0);
894ecd7789bSchristos
895ecd7789bSchristos /* Is the value sane? */
896ecd7789bSchristos if (xdr > 65535)
897ecd7789bSchristos return(-1);
898ecd7789bSchristos
899ecd7789bSchristos /* Create NAT & state table entries. */
900ecd7789bSchristos if (ipf_p_rpcb_getnat(fin, nat, rx->rx_proto, (u_int)xdr) != 0)
901ecd7789bSchristos return(-1);
902ecd7789bSchristos break;
903ecd7789bSchristos case RPCB_RES_STRING:
904ecd7789bSchristos /* Expecting a XDR string; need 4 bytes for length */
905ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, p, 4))
906ecd7789bSchristos return(-1);
907ecd7789bSchristos
908ecd7789bSchristos rr->rr_v3.xu_str.xs_len = p++;
909ecd7789bSchristos rr->rr_v3.xu_str.xs_str = (char *)p;
910ecd7789bSchristos
911ecd7789bSchristos xdr = B(rr->rr_v3.xu_xslen);
912ecd7789bSchristos
913ecd7789bSchristos /* A null string indicates an unregistered service */
914ecd7789bSchristos if ((xdr == 0) && RPCB_BUF_EQ(rm, p, 0))
915ecd7789bSchristos return(0);
916ecd7789bSchristos
917ecd7789bSchristos /* Decode the target IP address / port. */
918ecd7789bSchristos if (ipf_p_rpcb_getuaddr(rm, &rr->rr_v3, &p) != 0)
919ecd7789bSchristos return(-1);
920ecd7789bSchristos
921ecd7789bSchristos /* Validate the IP address and port contained. */
922ecd7789bSchristos if (nat->nat_odstaddr != rr->rr_v3.xu_ip)
923ecd7789bSchristos return(-1);
924ecd7789bSchristos
925ecd7789bSchristos /* Create NAT & state table entries. */
926ecd7789bSchristos if (ipf_p_rpcb_getnat(fin, nat, rx->rx_proto,
927ecd7789bSchristos (u_int)rr->rr_v3.xu_port) != 0)
928ecd7789bSchristos return(-1);
929ecd7789bSchristos break;
930ecd7789bSchristos case RPCB_RES_LIST:
931ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, p, 4))
932ecd7789bSchristos return(-1);
933ecd7789bSchristos /* rpcb_entry_list_ptr */
934ecd7789bSchristos switch(B(p))
935ecd7789bSchristos {
936ecd7789bSchristos case 0:
937ecd7789bSchristos return(0);
938ecd7789bSchristos /*NOTREACHED*/
939ecd7789bSchristos break;
940ecd7789bSchristos case 1:
941ecd7789bSchristos break;
942ecd7789bSchristos default:
943ecd7789bSchristos return(-1);
944ecd7789bSchristos }
945ecd7789bSchristos rl = &rr->rr_v4;
946ecd7789bSchristos rl->rl_list = p++;
947ecd7789bSchristos cnt = 0;
948ecd7789bSchristos
949ecd7789bSchristos for(;;) {
950ecd7789bSchristos re = &rl->rl_entries[rl->rl_cnt];
951ecd7789bSchristos if (ipf_p_rpcb_getuaddr(rm, &re->re_maddr, &p) != 0)
952ecd7789bSchristos return(-1);
953ecd7789bSchristos if (ipf_p_rpcb_getproto(rm, &re->re_netid, &p) != 0)
954ecd7789bSchristos return(-1);
955ecd7789bSchristos /* re_semantics & re_pfamily length */
956ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, p, 12))
957ecd7789bSchristos return(-1);
958ecd7789bSchristos p++; /* Skipping re_semantics. */
959ecd7789bSchristos xdr = B(p++);
960ecd7789bSchristos if ((xdr != 4) || strncmp((char *)p, "inet", 4))
961ecd7789bSchristos return(-1);
962ecd7789bSchristos p++;
963ecd7789bSchristos if (ipf_p_rpcb_getproto(rm, &re->re_proto, &p) != 0)
964ecd7789bSchristos return(-1);
965ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, p, 4))
966ecd7789bSchristos return(-1);
967ecd7789bSchristos re->re_more = p;
968ecd7789bSchristos if (B(re->re_more) > 1) /* 0,1 only legal values */
969ecd7789bSchristos return(-1);
970ecd7789bSchristos ++rl->rl_cnt;
971ecd7789bSchristos ++cnt;
972ecd7789bSchristos if (B(re->re_more) == 0)
973ecd7789bSchristos break;
974ecd7789bSchristos /* Replies in max out at 2; TCP and/or UDP */
975ecd7789bSchristos if (cnt > 2)
976ecd7789bSchristos return(-1);
977ecd7789bSchristos p++;
978ecd7789bSchristos }
979ecd7789bSchristos
980ecd7789bSchristos for(rl->rl_cnt = 0; rl->rl_cnt < cnt; rl->rl_cnt++) {
981ecd7789bSchristos re = &rl->rl_entries[rl->rl_cnt];
982ecd7789bSchristos rv = ipf_p_rpcb_getnat(fin, nat,
983ecd7789bSchristos re->re_proto.xp_proto,
984ecd7789bSchristos (u_int)re->re_maddr.xu_port);
985ecd7789bSchristos if (rv != 0)
986ecd7789bSchristos return(-1);
987ecd7789bSchristos }
988ecd7789bSchristos break;
989ecd7789bSchristos default:
990ecd7789bSchristos /*CONSTANTCONDITION*/
991ecd7789bSchristos IPF_PANIC(1, ("illegal rx_type %d", rx->rx_type));
992ecd7789bSchristos }
993ecd7789bSchristos
994ecd7789bSchristos return(1);
995ecd7789bSchristos }
996ecd7789bSchristos
997ecd7789bSchristos /* -------------------------------------------------------------------- */
998ecd7789bSchristos /* Function: ipf_p_rpcb_lookup */
999ecd7789bSchristos /* Returns: rpcb_xact_t * - NULL == no matching record, */
1000ecd7789bSchristos /* else pointer to relevant entry */
1001ecd7789bSchristos /* Parameters: rs(I) - pointer to RPCB session */
1002ecd7789bSchristos /* xid(I) - XID to look for */
1003ecd7789bSchristos /* -------------------------------------------------------------------- */
1004ecd7789bSchristos static rpcb_xact_t *
ipf_p_rpcb_lookup(rpcb_session_t * rs,u_32_t xid)1005f330e785Schristos ipf_p_rpcb_lookup(rpcb_session_t *rs, u_32_t xid)
1006ecd7789bSchristos {
1007ecd7789bSchristos rpcb_xact_t *rx;
1008ecd7789bSchristos
1009ecd7789bSchristos if (rs->rs_rxlist == NULL)
1010ecd7789bSchristos return(NULL);
1011ecd7789bSchristos
1012ecd7789bSchristos for (rx = rs->rs_rxlist; rx != NULL; rx = rx->rx_next)
1013ecd7789bSchristos if (rx->rx_xid == xid)
1014ecd7789bSchristos break;
1015ecd7789bSchristos
1016ecd7789bSchristos return(rx);
1017ecd7789bSchristos }
1018ecd7789bSchristos
1019ecd7789bSchristos /* -------------------------------------------------------------------- */
1020ecd7789bSchristos /* Function: ipf_p_rpcb_deref */
1021ecd7789bSchristos /* Returns: (void) */
1022ecd7789bSchristos /* Parameters: rs(I) - pointer to RPCB session */
1023ecd7789bSchristos /* rx(I) - pointer to RPC transaction struct to remove */
1024ecd7789bSchristos /* force(I) - indicates to delete entry regardless of */
1025ecd7789bSchristos /* reference count */
1026ecd7789bSchristos /* Locking: rs->rs_rxlock must be held write only */
1027ecd7789bSchristos /* */
1028ecd7789bSchristos /* Free the RPCB transaction record rx from the chain of entries. */
1029ecd7789bSchristos /* -------------------------------------------------------------------- */
1030ecd7789bSchristos static void
ipf_p_rpcb_deref(rpcb_session_t * rs,rpcb_xact_t * rx)1031f330e785Schristos ipf_p_rpcb_deref(rpcb_session_t *rs, rpcb_xact_t *rx)
1032ecd7789bSchristos {
1033ecd7789bSchristos rs = rs; /* LINT */
1034ecd7789bSchristos
1035ecd7789bSchristos if (rx == NULL)
1036ecd7789bSchristos return;
1037ecd7789bSchristos
1038ecd7789bSchristos if (--rx->rx_ref != 0)
1039ecd7789bSchristos return;
1040ecd7789bSchristos
1041ecd7789bSchristos if (rx->rx_next != NULL)
1042ecd7789bSchristos rx->rx_next->rx_pnext = rx->rx_pnext;
1043ecd7789bSchristos
1044ecd7789bSchristos *rx->rx_pnext = rx->rx_next;
1045ecd7789bSchristos
1046ecd7789bSchristos KFREE(rx);
1047ecd7789bSchristos
1048ecd7789bSchristos --rpcbcnt;
1049ecd7789bSchristos }
1050ecd7789bSchristos
1051ecd7789bSchristos /* -------------------------------------------------------------------- */
1052ecd7789bSchristos /* Function: ipf_p_rpcb_getproto */
1053ecd7789bSchristos /* Returns: int - -1 == illegal protocol/netid, */
1054ecd7789bSchristos /* 0 == legal protocol/netid */
1055ecd7789bSchristos /* Parameters: rm(I) - pointer to RPC message structure */
1056ecd7789bSchristos /* xp(I) - pointer to netid structure */
1057ecd7789bSchristos /* p(IO) - pointer to location within packet buffer */
1058ecd7789bSchristos /* */
1059ecd7789bSchristos /* Decode netid/proto stored at p and record its numeric value. */
1060ecd7789bSchristos /* -------------------------------------------------------------------- */
1061ecd7789bSchristos static int
ipf_p_rpcb_getproto(rpc_msg_t * rm,xdr_proto_t * xp,u_32_t ** p)1062f330e785Schristos ipf_p_rpcb_getproto(rpc_msg_t *rm, xdr_proto_t *xp, u_32_t **p)
1063ecd7789bSchristos {
1064ecd7789bSchristos u_int len;
1065ecd7789bSchristos
1066ecd7789bSchristos /* Must have 4 bytes for length & 4 bytes for "tcp" or "udp". */
1067ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, p, 8))
1068ecd7789bSchristos return(-1);
1069ecd7789bSchristos
1070ecd7789bSchristos xp->xp_xslen = (*p)++;
1071ecd7789bSchristos xp->xp_xsstr = (char *)*p;
1072ecd7789bSchristos
1073ecd7789bSchristos /* Test the string length. */
1074ecd7789bSchristos len = B(xp->xp_xslen);
1075ecd7789bSchristos if (len != 3)
1076ecd7789bSchristos return(-1);
1077ecd7789bSchristos
1078ecd7789bSchristos /* Test the actual string & record the protocol accordingly. */
1079ecd7789bSchristos if (!strncmp((char *)xp->xp_xsstr, "tcp\0", 4))
1080ecd7789bSchristos xp->xp_proto = IPPROTO_TCP;
1081ecd7789bSchristos else if (!strncmp((char *)xp->xp_xsstr, "udp\0", 4))
1082ecd7789bSchristos xp->xp_proto = IPPROTO_UDP;
1083ecd7789bSchristos else {
1084ecd7789bSchristos return(-1);
1085ecd7789bSchristos }
1086ecd7789bSchristos
1087ecd7789bSchristos /* Advance past the string. */
1088ecd7789bSchristos (*p)++;
1089ecd7789bSchristos
1090ecd7789bSchristos return(0);
1091ecd7789bSchristos }
1092ecd7789bSchristos
1093ecd7789bSchristos /* -------------------------------------------------------------------- */
1094ecd7789bSchristos /* Function: ipf_p_rpcb_getnat */
1095ecd7789bSchristos /* Returns: int -- -1 == failed to create table entries, */
1096ecd7789bSchristos /* 0 == success */
1097ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */
1098ecd7789bSchristos /* nat(I) - pointer to NAT table entry */
1099ecd7789bSchristos /* proto(I) - transport protocol for new entries */
1100ecd7789bSchristos /* port(I) - new port to use w/ wildcard table entries */
1101ecd7789bSchristos /* */
1102ecd7789bSchristos /* Create state and NAT entries to handle an anticipated connection */
1103ecd7789bSchristos /* attempt between RPC client and server. */
1104ecd7789bSchristos /* -------------------------------------------------------------------- */
1105ecd7789bSchristos static int
ipf_p_rpcb_getnat(fr_info_t * fin,nat_t * nat,u_int proto,u_int port)1106f330e785Schristos ipf_p_rpcb_getnat(fr_info_t *fin, nat_t *nat, u_int proto, u_int port)
1107ecd7789bSchristos {
1108ecd7789bSchristos ipf_main_softc_t *softc = fin->fin_main_soft;
1109ecd7789bSchristos ipnat_t *ipn, ipnat;
1110ecd7789bSchristos tcphdr_t tcp;
1111ecd7789bSchristos ipstate_t *is;
1112ecd7789bSchristos fr_info_t fi;
1113ecd7789bSchristos nat_t *natl;
1114ecd7789bSchristos int nflags;
1115ecd7789bSchristos
1116ecd7789bSchristos ipn = nat->nat_ptr;
1117ecd7789bSchristos
1118ecd7789bSchristos /* Generate dummy fr_info */
1119ecd7789bSchristos bcopy((char *)fin, (char *)&fi, sizeof(fi));
1120ecd7789bSchristos fi.fin_out = 0;
1121ecd7789bSchristos fi.fin_p = proto;
1122ecd7789bSchristos fi.fin_sport = 0;
1123ecd7789bSchristos fi.fin_dport = port & 0xffff;
1124ecd7789bSchristos fi.fin_flx |= FI_IGNORE;
1125ecd7789bSchristos fi.fin_saddr = nat->nat_osrcaddr;
1126ecd7789bSchristos fi.fin_daddr = nat->nat_odstaddr;
1127ecd7789bSchristos
1128ecd7789bSchristos bzero((char *)&tcp, sizeof(tcp));
1129ecd7789bSchristos tcp.th_dport = htons(port);
1130ecd7789bSchristos
1131ecd7789bSchristos if (proto == IPPROTO_TCP) {
1132ecd7789bSchristos tcp.th_win = htons(8192);
1133ecd7789bSchristos TCP_OFF_A(&tcp, sizeof(tcphdr_t) >> 2);
1134ecd7789bSchristos fi.fin_dlen = sizeof(tcphdr_t);
1135ecd7789bSchristos tcp.th_flags = TH_SYN;
1136ecd7789bSchristos nflags = NAT_TCP;
1137ecd7789bSchristos } else {
1138ecd7789bSchristos fi.fin_dlen = sizeof(udphdr_t);
1139ecd7789bSchristos nflags = NAT_UDP;
1140ecd7789bSchristos }
1141ecd7789bSchristos
1142ecd7789bSchristos nflags |= SI_W_SPORT|NAT_SEARCH;
1143ecd7789bSchristos fi.fin_dp = &tcp;
1144ecd7789bSchristos fi.fin_plen = fi.fin_hlen + fi.fin_dlen;
1145ecd7789bSchristos
1146ecd7789bSchristos /*
1147ecd7789bSchristos * Search for existing NAT & state entries. Pay close attention to
1148ecd7789bSchristos * mutexes / locks grabbed from lookup routines, as not doing so could
1149ecd7789bSchristos * lead to bad things.
1150ecd7789bSchristos *
1151ecd7789bSchristos * If successful, fr_stlookup returns with ipf_state locked. We have
1152ecd7789bSchristos * no use for this lock, so simply unlock it if necessary.
1153ecd7789bSchristos */
1154ecd7789bSchristos is = ipf_state_lookup(&fi, &tcp, NULL);
1155ecd7789bSchristos if (is != NULL) {
1156ecd7789bSchristos RWLOCK_EXIT(&softc->ipf_state);
1157ecd7789bSchristos }
1158ecd7789bSchristos
1159ecd7789bSchristos RWLOCK_EXIT(&softc->ipf_nat);
1160ecd7789bSchristos
1161ecd7789bSchristos WRITE_ENTER(&softc->ipf_nat);
1162ecd7789bSchristos natl = ipf_nat_inlookup(&fi, nflags, proto, fi.fin_src, fi.fin_dst);
1163ecd7789bSchristos
1164ecd7789bSchristos if ((natl != NULL) && (is != NULL)) {
1165ecd7789bSchristos MUTEX_DOWNGRADE(&softc->ipf_nat);
1166ecd7789bSchristos return(0);
1167ecd7789bSchristos }
1168ecd7789bSchristos
1169ecd7789bSchristos /* Slightly modify the following structures for actual use in creating
1170ecd7789bSchristos * NAT and/or state entries. We're primarily concerned with stripping
1171ecd7789bSchristos * flags that may be detrimental to the creation process or simply
1172ecd7789bSchristos * shouldn't be associated with a table entry.
1173ecd7789bSchristos */
1174ecd7789bSchristos fi.fin_fr = &rpcbfr;
1175ecd7789bSchristos fi.fin_flx &= ~FI_IGNORE;
1176ecd7789bSchristos nflags &= ~NAT_SEARCH;
1177ecd7789bSchristos
1178ecd7789bSchristos if (natl == NULL) {
1179ecd7789bSchristos #ifdef USE_MUTEXES
1180ecd7789bSchristos ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1181ecd7789bSchristos #endif
1182ecd7789bSchristos
1183ecd7789bSchristos /* XXX Since we're just copying the original ipn contents
1184ecd7789bSchristos * back, would we be better off just sending a pointer to
1185ecd7789bSchristos * the 'temp' copy off to nat_new instead?
1186ecd7789bSchristos */
1187ecd7789bSchristos /* Generate template/bogus NAT rule. */
1188ecd7789bSchristos bcopy((char *)ipn, (char *)&ipnat, sizeof(ipnat));
1189ecd7789bSchristos ipn->in_flags = nflags & IPN_TCPUDP;
1190ecd7789bSchristos ipn->in_apr = NULL;
1191ecd7789bSchristos ipn->in_pr[0] = proto;
1192ecd7789bSchristos ipn->in_pr[1] = proto;
1193ecd7789bSchristos ipn->in_dpmin = fi.fin_dport;
1194ecd7789bSchristos ipn->in_dpmax = fi.fin_dport;
1195ecd7789bSchristos ipn->in_dpnext = fi.fin_dport;
1196ecd7789bSchristos ipn->in_space = 1;
1197ecd7789bSchristos ipn->in_ippip = 1;
1198ecd7789bSchristos if (ipn->in_flags & IPN_FILTER) {
1199ecd7789bSchristos ipn->in_scmp = 0;
1200ecd7789bSchristos ipn->in_dcmp = 0;
1201ecd7789bSchristos }
1202ecd7789bSchristos ipn->in_plabel = -1;
1203ecd7789bSchristos
1204ecd7789bSchristos /* Create NAT entry. return NULL if this fails. */
1205ecd7789bSchristos MUTEX_ENTER(&softn->ipf_nat_new);
1206ecd7789bSchristos natl = ipf_nat_add(&fi, ipn, NULL, nflags|SI_CLONE|NAT_SLAVE,
1207ecd7789bSchristos NAT_INBOUND);
1208ecd7789bSchristos MUTEX_EXIT(&softn->ipf_nat_new);
1209ecd7789bSchristos
1210ecd7789bSchristos bcopy((char *)&ipnat, (char *)ipn, sizeof(ipnat));
1211ecd7789bSchristos
1212ecd7789bSchristos if (natl == NULL) {
1213ecd7789bSchristos MUTEX_DOWNGRADE(&softc->ipf_nat);
1214ecd7789bSchristos return(-1);
1215ecd7789bSchristos }
1216ecd7789bSchristos
1217f52ace7aSdarrenr natl->nat_ptr = ipn;
1218ecd7789bSchristos fi.fin_saddr = natl->nat_nsrcaddr;
1219ecd7789bSchristos fi.fin_daddr = natl->nat_ndstaddr;
1220ecd7789bSchristos ipn->in_use++;
1221ecd7789bSchristos (void) ipf_nat_proto(&fi, natl, nflags);
1222ecd7789bSchristos MUTEX_ENTER(&natl->nat_lock);
1223ecd7789bSchristos ipf_nat_update(&fi, natl);
1224ecd7789bSchristos MUTEX_EXIT(&natl->nat_lock);
1225ecd7789bSchristos }
1226ecd7789bSchristos MUTEX_DOWNGRADE(&softc->ipf_nat);
1227ecd7789bSchristos
1228ecd7789bSchristos if (is == NULL) {
1229ecd7789bSchristos /* Create state entry. Return NULL if this fails. */
1230ecd7789bSchristos fi.fin_flx |= FI_NATED;
1231ecd7789bSchristos fi.fin_flx &= ~FI_STATE;
1232ecd7789bSchristos nflags &= NAT_TCPUDP;
1233ecd7789bSchristos nflags |= SI_W_SPORT|SI_CLONE;
1234ecd7789bSchristos
1235ecd7789bSchristos if (ipf_state_add(softc, &fi, NULL, nflags) != 0) {
1236ecd7789bSchristos /*
1237ecd7789bSchristos * XXX nat_delete is private to ip_nat.c. Should
1238ecd7789bSchristos * check w/ Darren about this one.
1239ecd7789bSchristos *
1240ecd7789bSchristos * nat_delete(natl, NL_EXPIRE);
1241ecd7789bSchristos */
1242ecd7789bSchristos return(-1);
1243ecd7789bSchristos }
1244ecd7789bSchristos }
1245ecd7789bSchristos
1246ecd7789bSchristos return(0);
1247ecd7789bSchristos }
1248ecd7789bSchristos
1249ecd7789bSchristos /* -------------------------------------------------------------------- */
1250ecd7789bSchristos /* Function: ipf_p_rpcb_modv3 */
1251ecd7789bSchristos /* Returns: int -- change in packet length */
1252ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */
1253ecd7789bSchristos /* nat(I) - pointer to NAT session */
1254ecd7789bSchristos /* rm(I) - pointer to RPC message structure */
1255ecd7789bSchristos /* m(I) - pointer to mbuf chain */
1256ecd7789bSchristos /* off(I) - offset within mbuf chain */
1257ecd7789bSchristos /* */
1258ecd7789bSchristos /* Write a new universal address string to this packet, adjusting */
1259ecd7789bSchristos /* lengths as necessary. */
1260ecd7789bSchristos /* -------------------------------------------------------------------- */
1261ecd7789bSchristos static int
ipf_p_rpcb_modv3(fr_info_t * fin,nat_t * nat,rpc_msg_t * rm,mb_t * m,u_int off)1262f330e785Schristos ipf_p_rpcb_modv3(fr_info_t *fin, nat_t *nat, rpc_msg_t *rm, mb_t *m, u_int off)
1263ecd7789bSchristos {
1264ecd7789bSchristos u_int len, xlen, pos, bogo;
1265ecd7789bSchristos rpc_resp_t *rr;
1266ecd7789bSchristos char uaddr[24];
1267ecd7789bSchristos char *i, *p;
1268ecd7789bSchristos int diff;
1269ecd7789bSchristos
1270ecd7789bSchristos rr = &rm->rm_resp;
1271ecd7789bSchristos i = (char *)&nat->nat_ndstaddr;
1272ecd7789bSchristos p = (char *)&rr->rr_v3.xu_port;
1273ecd7789bSchristos
1274ecd7789bSchristos /* Form new string. */
1275ecd7789bSchristos bzero(uaddr, sizeof(uaddr)); /* Just in case we need padding. */
1276*ae8e75c8Schristos snprintf(uaddr, sizeof(uaddr),
1277ecd7789bSchristos "%u.%u.%u.%u.%u.%u", i[0] & 0xff, i[1] & 0xff,
1278ecd7789bSchristos i[2] & 0xff, i[3] & 0xff, p[0] & 0xff, p[1] & 0xff);
1279ecd7789bSchristos len = strlen(uaddr);
1280ecd7789bSchristos xlen = XDRALIGN(len);
1281ecd7789bSchristos
1282ecd7789bSchristos /* Determine mbuf offset to write to. */
1283ecd7789bSchristos pos = (char *)rr->rr_v3.xu_xslen - rm->rm_msgbuf;
1284ecd7789bSchristos off += pos;
1285ecd7789bSchristos
1286ecd7789bSchristos /* Write new string length. */
1287ecd7789bSchristos bogo = htonl(len);
1288f330e785Schristos COPYBACK(m, off, 4, (void *)&bogo);
1289ecd7789bSchristos off += 4;
1290ecd7789bSchristos
1291ecd7789bSchristos /* Write new string. */
1292ecd7789bSchristos COPYBACK(m, off, xlen, uaddr);
1293ecd7789bSchristos
1294ecd7789bSchristos /* Determine difference in data lengths. */
1295ecd7789bSchristos diff = xlen - XDRALIGN(B(rr->rr_v3.xu_xslen));
1296ecd7789bSchristos
1297ecd7789bSchristos /*
1298ecd7789bSchristos * If our new string has a different length, make necessary
1299ecd7789bSchristos * adjustments.
1300ecd7789bSchristos */
1301ecd7789bSchristos if (diff != 0)
1302ecd7789bSchristos ipf_p_rpcb_fixlen(fin, diff);
1303ecd7789bSchristos
1304ecd7789bSchristos return(diff);
1305ecd7789bSchristos }
1306ecd7789bSchristos
1307ecd7789bSchristos /* -------------------------------------------------------------------- */
1308ecd7789bSchristos /* Function: ipf_p_rpcb_modv4 */
1309ecd7789bSchristos /* Returns: int -- change in packet length */
1310ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */
1311ecd7789bSchristos /* nat(I) - pointer to NAT session */
1312ecd7789bSchristos /* rm(I) - pointer to RPC message structure */
1313ecd7789bSchristos /* m(I) - pointer to mbuf chain */
1314ecd7789bSchristos /* off(I) - offset within mbuf chain */
1315ecd7789bSchristos /* */
1316ecd7789bSchristos /* Write new rpcb_entry list, adjusting lengths as necessary. */
1317ecd7789bSchristos /* -------------------------------------------------------------------- */
1318ecd7789bSchristos static int
ipf_p_rpcb_modv4(fr_info_t * fin,nat_t * nat,rpc_msg_t * rm,mb_t * m,u_int off)1319f330e785Schristos ipf_p_rpcb_modv4(fr_info_t *fin, nat_t *nat, rpc_msg_t *rm, mb_t *m, u_int off)
1320ecd7789bSchristos {
1321ecd7789bSchristos u_int len, xlen, pos, bogo;
1322ecd7789bSchristos rpcb_listp_t *rl;
1323ecd7789bSchristos rpcb_entry_t *re;
1324ecd7789bSchristos rpc_resp_t *rr;
1325ecd7789bSchristos char uaddr[24];
1326ecd7789bSchristos int diff, cnt;
1327ecd7789bSchristos char *i, *p;
1328ecd7789bSchristos
1329ecd7789bSchristos diff = 0;
1330ecd7789bSchristos rr = &rm->rm_resp;
1331ecd7789bSchristos rl = &rr->rr_v4;
1332ecd7789bSchristos
1333ecd7789bSchristos i = (char *)&nat->nat_ndstaddr;
1334ecd7789bSchristos
1335ecd7789bSchristos /* Determine mbuf offset to write to. */
1336ecd7789bSchristos re = &rl->rl_entries[0];
1337ecd7789bSchristos pos = (char *)re->re_maddr.xu_xslen - rm->rm_msgbuf;
1338ecd7789bSchristos off += pos;
1339ecd7789bSchristos
1340ecd7789bSchristos for (cnt = 0; cnt < rl->rl_cnt; cnt++) {
1341ecd7789bSchristos re = &rl->rl_entries[cnt];
1342ecd7789bSchristos p = (char *)&re->re_maddr.xu_port;
1343ecd7789bSchristos
1344ecd7789bSchristos /* Form new string. */
1345ecd7789bSchristos bzero(uaddr, sizeof(uaddr)); /* Just in case we need
1346ecd7789bSchristos padding. */
1347*ae8e75c8Schristos snprintf(uaddr, sizeof(uaddr),
1348ecd7789bSchristos "%u.%u.%u.%u.%u.%u", i[0] & 0xff,
1349ecd7789bSchristos i[1] & 0xff, i[2] & 0xff, i[3] & 0xff,
1350ecd7789bSchristos p[0] & 0xff, p[1] & 0xff);
1351ecd7789bSchristos len = strlen(uaddr);
1352ecd7789bSchristos xlen = XDRALIGN(len);
1353ecd7789bSchristos
1354ecd7789bSchristos /* Write new string length. */
1355ecd7789bSchristos bogo = htonl(len);
1356f330e785Schristos COPYBACK(m, off, 4, (void *)&bogo);
1357ecd7789bSchristos off += 4;
1358ecd7789bSchristos
1359ecd7789bSchristos /* Write new string. */
1360ecd7789bSchristos COPYBACK(m, off, xlen, uaddr);
1361ecd7789bSchristos off += xlen;
1362ecd7789bSchristos
1363ecd7789bSchristos /* Record any change in length. */
1364ecd7789bSchristos diff += xlen - XDRALIGN(B(re->re_maddr.xu_xslen));
1365ecd7789bSchristos
1366ecd7789bSchristos /* If the length changed, copy back the rest of this entry. */
1367ecd7789bSchristos len = ((char *)re->re_more + 4) -
1368ecd7789bSchristos (char *)re->re_netid.xp_xslen;
1369ecd7789bSchristos if (diff != 0) {
1370f330e785Schristos COPYBACK(m, off, len, (void *)re->re_netid.xp_xslen);
1371ecd7789bSchristos }
1372ecd7789bSchristos off += len;
1373ecd7789bSchristos }
1374ecd7789bSchristos
1375ecd7789bSchristos /*
1376ecd7789bSchristos * If our new string has a different length, make necessary
1377ecd7789bSchristos * adjustments.
1378ecd7789bSchristos */
1379ecd7789bSchristos if (diff != 0)
1380ecd7789bSchristos ipf_p_rpcb_fixlen(fin, diff);
1381ecd7789bSchristos
1382ecd7789bSchristos return(diff);
1383ecd7789bSchristos }
1384ecd7789bSchristos
1385ecd7789bSchristos
1386ecd7789bSchristos /* -------------------------------------------------------------------- */
1387ecd7789bSchristos /* Function: ipf_p_rpcb_fixlen */
1388ecd7789bSchristos /* Returns: (void) */
1389ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */
1390ecd7789bSchristos /* len(I) - change in packet length */
1391ecd7789bSchristos /* */
1392ecd7789bSchristos /* Adjust various packet related lengths held in structure and packet */
1393ecd7789bSchristos /* header fields. */
1394ecd7789bSchristos /* -------------------------------------------------------------------- */
1395ecd7789bSchristos static void
ipf_p_rpcb_fixlen(fr_info_t * fin,int len)1396f330e785Schristos ipf_p_rpcb_fixlen(fr_info_t *fin, int len)
1397ecd7789bSchristos {
1398ecd7789bSchristos udphdr_t *udp;
1399ecd7789bSchristos
1400ecd7789bSchristos udp = fin->fin_dp;
1401ecd7789bSchristos udp->uh_ulen = htons(ntohs(udp->uh_ulen) + len);
1402ecd7789bSchristos fin->fin_plen += len;
1403ecd7789bSchristos fin->fin_ip->ip_len = htons(fin->fin_plen);
1404ecd7789bSchristos fin->fin_dlen += len;
1405ecd7789bSchristos }
1406ecd7789bSchristos
1407ecd7789bSchristos #undef B
1408