1*f330e785Schristos /* $NetBSD: ip_rpcb_pxy.c,v 1.2 2012/03/23 20:39:50 christos Exp $ */ 2ecd7789bSchristos 3ecd7789bSchristos /* 4ecd7789bSchristos * Copyright (C) 2002-2003 by Ryan Beasley <ryanb@goddamnbastard.org> 5ecd7789bSchristos * 6ecd7789bSchristos * See the IPFILTER.LICENCE file for details on licencing. 7ecd7789bSchristos */ 8ecd7789bSchristos /* 9ecd7789bSchristos * Overview: 10ecd7789bSchristos * This is an in-kernel application proxy for Sun's RPCBIND (nee portmap) 11ecd7789bSchristos * protocol as defined in RFC1833. It is far from complete, mostly 12ecd7789bSchristos * lacking in less-likely corner cases, but it's definitely functional. 13ecd7789bSchristos * 14ecd7789bSchristos * Invocation: 15ecd7789bSchristos * rdr <int> <e_ip>/32 port <e_p> -> <i_ip> port <i_p> udp proxy rpcbu 16ecd7789bSchristos * 17ecd7789bSchristos * If the host running IP Filter is the same as the RPC server, it's 18ecd7789bSchristos * perfectly legal for both the internal and external addresses and ports 19ecd7789bSchristos * to match. 20ecd7789bSchristos * 21ecd7789bSchristos * When triggered by appropriate IP NAT rules, this proxy works by 22ecd7789bSchristos * examining data contained in received packets. Requests and replies are 23ecd7789bSchristos * modified, NAT and state table entries created, etc., as necessary. 24ecd7789bSchristos */ 25ecd7789bSchristos /* 26ecd7789bSchristos * TODO / NOTES 27ecd7789bSchristos * 28ecd7789bSchristos * o Must implement locking to protect proxy session data. 29ecd7789bSchristos * o Fragmentation isn't supported. 30ecd7789bSchristos * o Only supports UDP. 31ecd7789bSchristos * o Doesn't support multiple RPC records in a single request. 32ecd7789bSchristos * o Errors should be more fine-grained. (e.g., malloc failure vs. 33ecd7789bSchristos * illegal RPCB request / reply) 34ecd7789bSchristos * o Even with the limit on the total amount of recorded transactions, 35ecd7789bSchristos * should there be a timeout on transaction removal? 36ecd7789bSchristos * o There is a potential collision between cloning, wildcard NAT and 37ecd7789bSchristos * state entries. There should be an appr_getport routine for 38ecd7789bSchristos * to avoid this. 39ecd7789bSchristos * o The enclosed hack of STREAMS support is pretty sick and most likely 40ecd7789bSchristos * broken. 41ecd7789bSchristos * 42*f330e785Schristos * Id: ip_rpcb_pxy.c,v 2.47 2009/03/01 12:41:26 darrenr Exp 43ecd7789bSchristos */ 44*f330e785Schristos 45*f330e785Schristos #include <sys/cdefs.h> 46*f330e785Schristos __KERNEL_RCSID(1, "$NetBSD: ip_rpcb_pxy.c,v 1.2 2012/03/23 20:39:50 christos Exp $"); 47*f330e785Schristos 48ecd7789bSchristos #define IPF_RPCB_PROXY 49ecd7789bSchristos 50ecd7789bSchristos /* 51ecd7789bSchristos * Function prototypes 52ecd7789bSchristos */ 53*f330e785Schristos void ipf_p_rpcb_main_load(void); 54*f330e785Schristos void ipf_p_rpcb_main_unload(void); 55*f330e785Schristos int ipf_p_rpcb_new(void *, fr_info_t *, ap_session_t *, nat_t *); 56*f330e785Schristos void ipf_p_rpcb_del(ipf_main_softc_t *, ap_session_t *); 57*f330e785Schristos int ipf_p_rpcb_in(void *, fr_info_t *, ap_session_t *, nat_t *); 58*f330e785Schristos int ipf_p_rpcb_out(void *, fr_info_t *, ap_session_t *, nat_t *); 59ecd7789bSchristos 60*f330e785Schristos static void ipf_p_rpcb_flush(rpcb_session_t *); 61*f330e785Schristos static int ipf_p_rpcb_decodereq(fr_info_t *, nat_t *, 62*f330e785Schristos rpcb_session_t *, rpc_msg_t *); 63*f330e785Schristos static int ipf_p_rpcb_skipauth(rpc_msg_t *, xdr_auth_t *, u_32_t **); 64*f330e785Schristos static int ipf_p_rpcb_insert(rpcb_session_t *, rpcb_xact_t *); 65*f330e785Schristos static int ipf_p_rpcb_xdrrpcb(rpc_msg_t *, u_32_t *, rpcb_args_t *); 66*f330e785Schristos static int ipf_p_rpcb_getuaddr(rpc_msg_t *, xdr_uaddr_t *, 67*f330e785Schristos u_32_t **); 68*f330e785Schristos static u_int ipf_p_rpcb_atoi(char *); 69*f330e785Schristos static int ipf_p_rpcb_modreq(fr_info_t *, nat_t *, rpc_msg_t *, 70*f330e785Schristos mb_t *, u_int); 71*f330e785Schristos static int ipf_p_rpcb_decoderep(fr_info_t *, nat_t *, 72*f330e785Schristos rpcb_session_t *, rpc_msg_t *, rpcb_xact_t **); 73*f330e785Schristos static rpcb_xact_t * ipf_p_rpcb_lookup(rpcb_session_t *, u_32_t); 74*f330e785Schristos static void ipf_p_rpcb_deref(rpcb_session_t *, rpcb_xact_t *); 75*f330e785Schristos static int ipf_p_rpcb_getproto(rpc_msg_t *, xdr_proto_t *, 76*f330e785Schristos u_32_t **); 77*f330e785Schristos static int ipf_p_rpcb_getnat(fr_info_t *, nat_t *, u_int, u_int); 78*f330e785Schristos static int ipf_p_rpcb_modv3(fr_info_t *, nat_t *, rpc_msg_t *, 79*f330e785Schristos mb_t *, u_int); 80*f330e785Schristos static int ipf_p_rpcb_modv4(fr_info_t *, nat_t *, rpc_msg_t *, 81*f330e785Schristos mb_t *, u_int); 82*f330e785Schristos static void ipf_p_rpcb_fixlen(fr_info_t *, int); 83ecd7789bSchristos 84ecd7789bSchristos /* 85ecd7789bSchristos * Global variables 86ecd7789bSchristos */ 87ecd7789bSchristos static frentry_t rpcbfr; /* Skeleton rule for reference by entities 88ecd7789bSchristos this proxy creates. */ 89ecd7789bSchristos static int rpcbcnt; /* Upper bound of allocated RPCB sessions. */ 90ecd7789bSchristos /* XXX rpcbcnt still requires locking. */ 91ecd7789bSchristos 92ecd7789bSchristos static int rpcb_proxy_init = 0; 93ecd7789bSchristos 94ecd7789bSchristos 95ecd7789bSchristos /* 96ecd7789bSchristos * Since rpc_msg contains only pointers, one should use this macro as a 97ecd7789bSchristos * handy way to get to the goods. (In case you're wondering about the name, 98ecd7789bSchristos * this started as BYTEREF -> BREF -> B.) 99ecd7789bSchristos */ 100ecd7789bSchristos #define B(r) (u_32_t)ntohl(*(r)) 101ecd7789bSchristos 102ecd7789bSchristos /* 103ecd7789bSchristos * Public subroutines 104ecd7789bSchristos */ 105ecd7789bSchristos 106ecd7789bSchristos /* -------------------------------------------------------------------- */ 107ecd7789bSchristos /* Function: ipf_p_rpcb_main_load */ 108ecd7789bSchristos /* Returns: void */ 109ecd7789bSchristos /* Parameters: (void) */ 110ecd7789bSchristos /* */ 111ecd7789bSchristos /* Initialize the filter rule entry and session limiter. */ 112ecd7789bSchristos /* -------------------------------------------------------------------- */ 113ecd7789bSchristos void 114*f330e785Schristos ipf_p_rpcb_main_load(void) 115ecd7789bSchristos { 116ecd7789bSchristos rpcbcnt = 0; 117ecd7789bSchristos 118ecd7789bSchristos bzero((char *)&rpcbfr, sizeof(rpcbfr)); 119ecd7789bSchristos rpcbfr.fr_ref = 1; 120ecd7789bSchristos rpcbfr.fr_flags = FR_PASS|FR_QUICK|FR_KEEPSTATE; 121ecd7789bSchristos MUTEX_INIT(&rpcbfr.fr_lock, "ipf Sun RPCB proxy rule lock"); 122ecd7789bSchristos rpcb_proxy_init = 1; 123ecd7789bSchristos } 124ecd7789bSchristos 125ecd7789bSchristos /* -------------------------------------------------------------------- */ 126ecd7789bSchristos /* Function: ipf_p_rpcb_main_unload */ 127ecd7789bSchristos /* Returns: void */ 128ecd7789bSchristos /* Parameters: (void) */ 129ecd7789bSchristos /* */ 130ecd7789bSchristos /* Destroy rpcbfr's mutex to avoid a lock leak. */ 131ecd7789bSchristos /* -------------------------------------------------------------------- */ 132ecd7789bSchristos void 133*f330e785Schristos ipf_p_rpcb_main_unload(void) 134ecd7789bSchristos { 135ecd7789bSchristos if (rpcb_proxy_init == 1) { 136ecd7789bSchristos MUTEX_DESTROY(&rpcbfr.fr_lock); 137ecd7789bSchristos rpcb_proxy_init = 0; 138ecd7789bSchristos } 139ecd7789bSchristos } 140ecd7789bSchristos 141ecd7789bSchristos /* -------------------------------------------------------------------- */ 142ecd7789bSchristos /* Function: ipf_p_rpcb_new */ 143ecd7789bSchristos /* Returns: int - -1 == failure, 0 == success */ 144ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */ 145ecd7789bSchristos /* aps(I) - pointer to proxy session structure */ 146ecd7789bSchristos /* nat(I) - pointer to NAT session structure */ 147ecd7789bSchristos /* */ 148ecd7789bSchristos /* Allocate resources for per-session proxy structures. */ 149ecd7789bSchristos /* -------------------------------------------------------------------- */ 150ecd7789bSchristos int 151*f330e785Schristos ipf_p_rpcb_new(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 152ecd7789bSchristos { 153ecd7789bSchristos rpcb_session_t *rs; 154ecd7789bSchristos 155ecd7789bSchristos fin = fin; /* LINT */ 156ecd7789bSchristos nat = nat; /* LINT */ 157ecd7789bSchristos 158ecd7789bSchristos KMALLOC(rs, rpcb_session_t *); 159ecd7789bSchristos if (rs == NULL) 160ecd7789bSchristos return(-1); 161ecd7789bSchristos 162ecd7789bSchristos bzero((char *)rs, sizeof(*rs)); 163ecd7789bSchristos MUTEX_INIT(&rs->rs_rxlock, "ipf Sun RPCB proxy session lock"); 164ecd7789bSchristos 165ecd7789bSchristos aps->aps_data = rs; 166ecd7789bSchristos 167ecd7789bSchristos return(0); 168ecd7789bSchristos } 169ecd7789bSchristos 170ecd7789bSchristos /* -------------------------------------------------------------------- */ 171ecd7789bSchristos /* Function: ipf_p_rpcb_del */ 172ecd7789bSchristos /* Returns: void */ 173ecd7789bSchristos /* Parameters: aps(I) - pointer to proxy session structure */ 174ecd7789bSchristos /* */ 175ecd7789bSchristos /* Free up a session's list of RPCB requests. */ 176ecd7789bSchristos /* -------------------------------------------------------------------- */ 177ecd7789bSchristos void 178*f330e785Schristos ipf_p_rpcb_del(ipf_main_softc_t *softc, ap_session_t *aps) 179ecd7789bSchristos { 180ecd7789bSchristos rpcb_session_t *rs; 181ecd7789bSchristos rs = (rpcb_session_t *)aps->aps_data; 182ecd7789bSchristos 183ecd7789bSchristos MUTEX_ENTER(&rs->rs_rxlock); 184ecd7789bSchristos ipf_p_rpcb_flush(rs); 185ecd7789bSchristos MUTEX_EXIT(&rs->rs_rxlock); 186ecd7789bSchristos MUTEX_DESTROY(&rs->rs_rxlock); 187ecd7789bSchristos } 188ecd7789bSchristos 189ecd7789bSchristos /* -------------------------------------------------------------------- */ 190ecd7789bSchristos /* Function: ipf_p_rpcb_in */ 191ecd7789bSchristos /* Returns: int - APR_ERR(1) == drop the packet, */ 192ecd7789bSchristos /* APR_ERR(2) == kill the proxy session, */ 193ecd7789bSchristos /* else change in packet length (in bytes) */ 194ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */ 195ecd7789bSchristos /* ip(I) - pointer to packet header */ 196ecd7789bSchristos /* aps(I) - pointer to proxy session structure */ 197ecd7789bSchristos /* nat(I) - pointer to NAT session structure */ 198ecd7789bSchristos /* */ 199ecd7789bSchristos /* Given a presumed RPCB request, perform some minor tests and pass off */ 200ecd7789bSchristos /* for decoding. Also pass packet off for a rewrite if necessary. */ 201ecd7789bSchristos /* -------------------------------------------------------------------- */ 202ecd7789bSchristos int 203*f330e785Schristos ipf_p_rpcb_in(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 204ecd7789bSchristos { 205ecd7789bSchristos rpc_msg_t rpcmsg, *rm; 206ecd7789bSchristos rpcb_session_t *rs; 207ecd7789bSchristos u_int off, dlen; 208ecd7789bSchristos mb_t *m; 209ecd7789bSchristos int rv; 210ecd7789bSchristos 211ecd7789bSchristos /* Disallow fragmented or illegally short packets. */ 212ecd7789bSchristos if ((fin->fin_flx & (FI_FRAG|FI_SHORT)) != 0) 213ecd7789bSchristos return(APR_ERR(1)); 214ecd7789bSchristos 215ecd7789bSchristos /* Perform basic variable initialization. */ 216ecd7789bSchristos rs = (rpcb_session_t *)aps->aps_data; 217ecd7789bSchristos 218ecd7789bSchristos m = fin->fin_m; 219ecd7789bSchristos off = (char *)fin->fin_dp - (char *)fin->fin_ip; 220ecd7789bSchristos off += sizeof(udphdr_t) + fin->fin_ipoff; 221ecd7789bSchristos dlen = fin->fin_dlen - sizeof(udphdr_t); 222ecd7789bSchristos 223ecd7789bSchristos /* Disallow packets outside legal range for supported requests. */ 224ecd7789bSchristos if ((dlen < RPCB_REQMIN) || (dlen > RPCB_REQMAX)) 225ecd7789bSchristos return(APR_ERR(1)); 226ecd7789bSchristos 227ecd7789bSchristos /* Copy packet over to convenience buffer. */ 228ecd7789bSchristos rm = &rpcmsg; 229ecd7789bSchristos bzero((char *)rm, sizeof(*rm)); 230*f330e785Schristos COPYDATA(m, off, dlen, (void *)&rm->rm_msgbuf); 231ecd7789bSchristos rm->rm_buflen = dlen; 232ecd7789bSchristos 233ecd7789bSchristos /* Send off to decode request. */ 234ecd7789bSchristos rv = ipf_p_rpcb_decodereq(fin, nat, rs, rm); 235ecd7789bSchristos 236ecd7789bSchristos switch(rv) 237ecd7789bSchristos { 238ecd7789bSchristos case -1: 239ecd7789bSchristos return(APR_ERR(1)); 240ecd7789bSchristos /*NOTREACHED*/ 241ecd7789bSchristos break; 242ecd7789bSchristos case 0: 243ecd7789bSchristos break; 244ecd7789bSchristos case 1: 245ecd7789bSchristos rv = ipf_p_rpcb_modreq(fin, nat, rm, m, off); 246ecd7789bSchristos break; 247ecd7789bSchristos default: 248ecd7789bSchristos /*CONSTANTCONDITION*/ 249ecd7789bSchristos IPF_PANIC(1, ("illegal rv %d (ipf_p_rpcb_req)", rv)); 250ecd7789bSchristos } 251ecd7789bSchristos 252ecd7789bSchristos return(rv); 253ecd7789bSchristos } 254ecd7789bSchristos 255ecd7789bSchristos /* -------------------------------------------------------------------- */ 256ecd7789bSchristos /* Function: ipf_p_rpcb_out */ 257ecd7789bSchristos /* Returns: int - APR_ERR(1) == drop the packet, */ 258ecd7789bSchristos /* APR_ERR(2) == kill the proxy session, */ 259ecd7789bSchristos /* else change in packet length (in bytes) */ 260ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */ 261ecd7789bSchristos /* ip(I) - pointer to packet header */ 262ecd7789bSchristos /* aps(I) - pointer to proxy session structure */ 263ecd7789bSchristos /* nat(I) - pointer to NAT session structure */ 264ecd7789bSchristos /* */ 265ecd7789bSchristos /* Given a presumed RPCB reply, perform some minor tests and pass off */ 266ecd7789bSchristos /* for decoding. If the message indicates a successful request with */ 267ecd7789bSchristos /* valid addressing information, create NAT and state structures to */ 268ecd7789bSchristos /* allow direct communication between RPC client and server. */ 269ecd7789bSchristos /* -------------------------------------------------------------------- */ 270ecd7789bSchristos int 271*f330e785Schristos ipf_p_rpcb_out(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat) 272ecd7789bSchristos { 273ecd7789bSchristos rpc_msg_t rpcmsg, *rm; 274ecd7789bSchristos rpcb_session_t *rs; 275ecd7789bSchristos rpcb_xact_t *rx; 276ecd7789bSchristos u_int off, dlen; 277ecd7789bSchristos int rv, diff; 278ecd7789bSchristos mb_t *m; 279ecd7789bSchristos 280*f330e785Schristos rx = NULL; /* XXX gcc */ 281*f330e785Schristos 282ecd7789bSchristos /* Disallow fragmented or illegally short packets. */ 283ecd7789bSchristos if ((fin->fin_flx & (FI_FRAG|FI_SHORT)) != 0) 284ecd7789bSchristos return(APR_ERR(1)); 285ecd7789bSchristos 286ecd7789bSchristos /* Perform basic variable initialization. */ 287ecd7789bSchristos rs = (rpcb_session_t *)aps->aps_data; 288ecd7789bSchristos rx = NULL; 289ecd7789bSchristos 290ecd7789bSchristos m = fin->fin_m; 291ecd7789bSchristos off = (char *)fin->fin_dp - (char *)fin->fin_ip; 292ecd7789bSchristos off += sizeof(udphdr_t) + fin->fin_ipoff; 293ecd7789bSchristos dlen = fin->fin_dlen - sizeof(udphdr_t); 294ecd7789bSchristos diff = 0; 295ecd7789bSchristos 296ecd7789bSchristos /* Disallow packets outside legal range for supported requests. */ 297ecd7789bSchristos if ((dlen < RPCB_REPMIN) || (dlen > RPCB_REPMAX)) 298ecd7789bSchristos return(APR_ERR(1)); 299ecd7789bSchristos 300ecd7789bSchristos /* Copy packet over to convenience buffer. */ 301ecd7789bSchristos rm = &rpcmsg; 302ecd7789bSchristos bzero((char *)rm, sizeof(*rm)); 303*f330e785Schristos COPYDATA(m, off, dlen, (void *)&rm->rm_msgbuf); 304ecd7789bSchristos rm->rm_buflen = dlen; 305ecd7789bSchristos 306ecd7789bSchristos rx = NULL; /* XXX gcc */ 307ecd7789bSchristos 308ecd7789bSchristos /* Send off to decode reply. */ 309ecd7789bSchristos rv = ipf_p_rpcb_decoderep(fin, nat, rs, rm, &rx); 310ecd7789bSchristos 311ecd7789bSchristos switch(rv) 312ecd7789bSchristos { 313ecd7789bSchristos case -1: /* Bad packet */ 314ecd7789bSchristos if (rx != NULL) { 315ecd7789bSchristos MUTEX_ENTER(&rs->rs_rxlock); 316ecd7789bSchristos ipf_p_rpcb_deref(rs, rx); 317ecd7789bSchristos MUTEX_EXIT(&rs->rs_rxlock); 318ecd7789bSchristos } 319ecd7789bSchristos return(APR_ERR(1)); 320ecd7789bSchristos /*NOTREACHED*/ 321ecd7789bSchristos break; 322ecd7789bSchristos case 0: /* Negative reply / request rejected */ 323ecd7789bSchristos break; 324ecd7789bSchristos case 1: /* Positive reply */ 325ecd7789bSchristos /* 326ecd7789bSchristos * With the IP address embedded in a GETADDR(LIST) reply, 327ecd7789bSchristos * we'll need to rewrite the packet in the very possible 328ecd7789bSchristos * event that the internal & external addresses aren't the 329ecd7789bSchristos * same. (i.e., this box is either a router or rpcbind 330ecd7789bSchristos * only listens on loopback.) 331ecd7789bSchristos */ 332ecd7789bSchristos if (nat->nat_odstaddr != nat->nat_ndstaddr) { 333ecd7789bSchristos if (rx->rx_type == RPCB_RES_STRING) 334ecd7789bSchristos diff = ipf_p_rpcb_modv3(fin, nat, rm, m, off); 335ecd7789bSchristos else if (rx->rx_type == RPCB_RES_LIST) 336ecd7789bSchristos diff = ipf_p_rpcb_modv4(fin, nat, rm, m, off); 337ecd7789bSchristos } 338ecd7789bSchristos break; 339ecd7789bSchristos default: 340ecd7789bSchristos /*CONSTANTCONDITION*/ 341ecd7789bSchristos IPF_PANIC(1, ("illegal rv %d (ipf_p_rpcb_decoderep)", rv)); 342ecd7789bSchristos } 343ecd7789bSchristos 344ecd7789bSchristos if (rx != NULL) { 345ecd7789bSchristos MUTEX_ENTER(&rs->rs_rxlock); 346ecd7789bSchristos /* XXX Gross hack - I'm overloading the reference 347ecd7789bSchristos * counter to deal with both threads and retransmitted 348ecd7789bSchristos * requests. One deref signals that this thread is 349ecd7789bSchristos * finished with rx, and the other signals that we've 350ecd7789bSchristos * processed its reply. 351ecd7789bSchristos */ 352ecd7789bSchristos ipf_p_rpcb_deref(rs, rx); 353ecd7789bSchristos ipf_p_rpcb_deref(rs, rx); 354ecd7789bSchristos MUTEX_EXIT(&rs->rs_rxlock); 355ecd7789bSchristos } 356ecd7789bSchristos 357ecd7789bSchristos return(diff); 358ecd7789bSchristos } 359ecd7789bSchristos 360ecd7789bSchristos /* 361ecd7789bSchristos * Private support subroutines 362ecd7789bSchristos */ 363ecd7789bSchristos 364ecd7789bSchristos /* -------------------------------------------------------------------- */ 365ecd7789bSchristos /* Function: ipf_p_rpcb_flush */ 366ecd7789bSchristos /* Returns: void */ 367ecd7789bSchristos /* Parameters: rs(I) - pointer to RPCB session structure */ 368ecd7789bSchristos /* */ 369ecd7789bSchristos /* Simply flushes the list of outstanding transactions, if any. */ 370ecd7789bSchristos /* -------------------------------------------------------------------- */ 371ecd7789bSchristos static void 372*f330e785Schristos ipf_p_rpcb_flush(rpcb_session_t *rs) 373ecd7789bSchristos { 374ecd7789bSchristos rpcb_xact_t *r1, *r2; 375ecd7789bSchristos 376ecd7789bSchristos r1 = rs->rs_rxlist; 377ecd7789bSchristos if (r1 == NULL) 378ecd7789bSchristos return; 379ecd7789bSchristos 380ecd7789bSchristos while (r1 != NULL) { 381ecd7789bSchristos r2 = r1; 382ecd7789bSchristos r1 = r1->rx_next; 383ecd7789bSchristos KFREE(r2); 384ecd7789bSchristos } 385ecd7789bSchristos } 386ecd7789bSchristos 387ecd7789bSchristos /* -------------------------------------------------------------------- */ 388ecd7789bSchristos /* Function: ipf_p_rpcb_decodereq */ 389ecd7789bSchristos /* Returns: int - -1 == bad request or critical failure, */ 390ecd7789bSchristos /* 0 == request successfully decoded, */ 391ecd7789bSchristos /* 1 == request successfully decoded; requires */ 392ecd7789bSchristos /* address rewrite/modification */ 393ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */ 394ecd7789bSchristos /* nat(I) - pointer to NAT session structure */ 395ecd7789bSchristos /* rs(I) - pointer to RPCB session structure */ 396ecd7789bSchristos /* rm(I) - pointer to RPC message structure */ 397ecd7789bSchristos /* */ 398ecd7789bSchristos /* Take a presumed RPCB request, decode it, and store the results in */ 399ecd7789bSchristos /* the transaction list. If the internal target address needs to be */ 400ecd7789bSchristos /* modified, store its location in ptr. */ 401ecd7789bSchristos /* WARNING: It's the responsibility of the caller to make sure there */ 402ecd7789bSchristos /* is enough room in rs_buf for the basic RPC message "preamble". */ 403ecd7789bSchristos /* -------------------------------------------------------------------- */ 404ecd7789bSchristos static int 405*f330e785Schristos ipf_p_rpcb_decodereq(fr_info_t *fin, nat_t *nat, rpcb_session_t *rs, 406*f330e785Schristos rpc_msg_t *rm) 407ecd7789bSchristos { 408ecd7789bSchristos rpcb_args_t *ra; 409ecd7789bSchristos u_32_t xdr, *p; 410ecd7789bSchristos rpc_call_t *rc; 411ecd7789bSchristos rpcb_xact_t rx; 412ecd7789bSchristos int mod; 413ecd7789bSchristos 414ecd7789bSchristos p = (u_32_t *)rm->rm_msgbuf; 415ecd7789bSchristos mod = 0; 416ecd7789bSchristos 417ecd7789bSchristos bzero((char *)&rx, sizeof(rx)); 418ecd7789bSchristos rc = &rm->rm_call; 419ecd7789bSchristos 420ecd7789bSchristos rm->rm_xid = p; 421ecd7789bSchristos rx.rx_xid = B(p++); /* Record this message's XID. */ 422ecd7789bSchristos 423ecd7789bSchristos /* Parse out and test the RPC header. */ 424ecd7789bSchristos if ((B(p++) != RPCB_CALL) || 425ecd7789bSchristos (B(p++) != RPCB_MSG_VERSION) || 426ecd7789bSchristos (B(p++) != RPCB_PROG)) 427ecd7789bSchristos return(-1); 428ecd7789bSchristos 429ecd7789bSchristos /* Record the RPCB version and procedure. */ 430ecd7789bSchristos rc->rc_vers = p++; 431ecd7789bSchristos rc->rc_proc = p++; 432ecd7789bSchristos 433ecd7789bSchristos /* Bypass RPC authentication stuff. */ 434ecd7789bSchristos if (ipf_p_rpcb_skipauth(rm, &rc->rc_authcred, &p) != 0) 435ecd7789bSchristos return(-1); 436ecd7789bSchristos if (ipf_p_rpcb_skipauth(rm, &rc->rc_authverf, &p) != 0) 437ecd7789bSchristos return(-1); 438ecd7789bSchristos 439ecd7789bSchristos /* Compare RPCB version and procedure numbers. */ 440ecd7789bSchristos switch(B(rc->rc_vers)) 441ecd7789bSchristos { 442ecd7789bSchristos case 2: 443ecd7789bSchristos /* This proxy only supports PMAP_GETPORT. */ 444ecd7789bSchristos if (B(rc->rc_proc) != RPCB_GETPORT) 445ecd7789bSchristos return(-1); 446ecd7789bSchristos 447ecd7789bSchristos /* Portmap requests contain four 4 byte parameters. */ 448ecd7789bSchristos if (RPCB_BUF_EQ(rm, p, 16) == 0) 449ecd7789bSchristos return(-1); 450ecd7789bSchristos 451ecd7789bSchristos p += 2; /* Skip requested program and version numbers. */ 452ecd7789bSchristos 453ecd7789bSchristos /* Sanity check the requested protocol. */ 454ecd7789bSchristos xdr = B(p); 455ecd7789bSchristos if (!(xdr == IPPROTO_UDP || xdr == IPPROTO_TCP)) 456ecd7789bSchristos return(-1); 457ecd7789bSchristos 458ecd7789bSchristos rx.rx_type = RPCB_RES_PMAP; 459ecd7789bSchristos rx.rx_proto = xdr; 460ecd7789bSchristos break; 461ecd7789bSchristos case 3: 462ecd7789bSchristos case 4: 463ecd7789bSchristos /* GETADDRLIST is exclusive to v4; GETADDR for v3 & v4 */ 464ecd7789bSchristos switch(B(rc->rc_proc)) 465ecd7789bSchristos { 466ecd7789bSchristos case RPCB_GETADDR: 467ecd7789bSchristos rx.rx_type = RPCB_RES_STRING; 468ecd7789bSchristos rx.rx_proto = (u_int)fin->fin_p; 469ecd7789bSchristos break; 470ecd7789bSchristos case RPCB_GETADDRLIST: 471ecd7789bSchristos if (B(rc->rc_vers) != 4) 472ecd7789bSchristos return(-1); 473ecd7789bSchristos rx.rx_type = RPCB_RES_LIST; 474ecd7789bSchristos break; 475ecd7789bSchristos default: 476ecd7789bSchristos return(-1); 477ecd7789bSchristos } 478ecd7789bSchristos 479ecd7789bSchristos ra = &rc->rc_rpcbargs; 480ecd7789bSchristos 481ecd7789bSchristos /* Decode the 'struct rpcb' request. */ 482ecd7789bSchristos if (ipf_p_rpcb_xdrrpcb(rm, p, ra) != 0) 483ecd7789bSchristos return(-1); 484ecd7789bSchristos 485ecd7789bSchristos /* Are the target address & port valid? */ 486ecd7789bSchristos if ((ra->ra_maddr.xu_ip != nat->nat_ndstaddr) || 487ecd7789bSchristos (ra->ra_maddr.xu_port != nat->nat_ndport)) 488ecd7789bSchristos return(-1); 489ecd7789bSchristos 490ecd7789bSchristos /* Do we need to rewrite this packet? */ 491ecd7789bSchristos if ((nat->nat_ndstaddr != nat->nat_odstaddr) || 492ecd7789bSchristos (nat->nat_ndport != nat->nat_odport)) 493ecd7789bSchristos mod = 1; 494ecd7789bSchristos break; 495ecd7789bSchristos default: 496ecd7789bSchristos return(-1); 497ecd7789bSchristos } 498ecd7789bSchristos 499ecd7789bSchristos MUTEX_ENTER(&rs->rs_rxlock); 500ecd7789bSchristos if (ipf_p_rpcb_insert(rs, &rx) != 0) { 501ecd7789bSchristos MUTEX_EXIT(&rs->rs_rxlock); 502ecd7789bSchristos return(-1); 503ecd7789bSchristos } 504ecd7789bSchristos MUTEX_EXIT(&rs->rs_rxlock); 505ecd7789bSchristos 506ecd7789bSchristos return(mod); 507ecd7789bSchristos } 508ecd7789bSchristos 509ecd7789bSchristos /* -------------------------------------------------------------------- */ 510ecd7789bSchristos /* Function: ipf_p_rpcb_skipauth */ 511ecd7789bSchristos /* Returns: int -- -1 == illegal auth parameters (lengths) */ 512ecd7789bSchristos /* 0 == valid parameters, pointer advanced */ 513ecd7789bSchristos /* Parameters: rm(I) - pointer to RPC message structure */ 514ecd7789bSchristos /* auth(I) - pointer to RPC auth structure */ 515ecd7789bSchristos /* buf(IO) - pointer to location within convenience buffer */ 516ecd7789bSchristos /* */ 517ecd7789bSchristos /* Record auth data length & location of auth data, then advance past */ 518ecd7789bSchristos /* it. */ 519ecd7789bSchristos /* -------------------------------------------------------------------- */ 520ecd7789bSchristos static int 521*f330e785Schristos ipf_p_rpcb_skipauth(rpc_msg_t *rm, xdr_auth_t *auth, u_32_t **buf) 522ecd7789bSchristos { 523ecd7789bSchristos u_32_t *p, xdr; 524ecd7789bSchristos 525ecd7789bSchristos p = *buf; 526ecd7789bSchristos 527ecd7789bSchristos /* Make sure we have enough space for expected fixed auth parms. */ 528ecd7789bSchristos if (RPCB_BUF_GEQ(rm, p, 8) == 0) 529ecd7789bSchristos return(-1); 530ecd7789bSchristos 531ecd7789bSchristos p++; /* We don't care about auth_flavor. */ 532ecd7789bSchristos 533ecd7789bSchristos auth->xa_string.xs_len = p; 534ecd7789bSchristos xdr = B(p++); /* Length of auth_data */ 535ecd7789bSchristos 536ecd7789bSchristos /* Test for absurdity / illegality of auth_data length. */ 537ecd7789bSchristos if ((XDRALIGN(xdr) < xdr) || (RPCB_BUF_GEQ(rm, p, XDRALIGN(xdr)) == 0)) 538ecd7789bSchristos return(-1); 539ecd7789bSchristos 540ecd7789bSchristos auth->xa_string.xs_str = (char *)p; 541ecd7789bSchristos 542ecd7789bSchristos p += XDRALIGN(xdr); /* Advance our location. */ 543ecd7789bSchristos 544ecd7789bSchristos *buf = (u_32_t *)p; 545ecd7789bSchristos 546ecd7789bSchristos return(0); 547ecd7789bSchristos } 548ecd7789bSchristos 549ecd7789bSchristos /* -------------------------------------------------------------------- */ 550ecd7789bSchristos /* Function: ipf_p_rpcb_insert */ 551ecd7789bSchristos /* Returns: int -- -1 == list insertion failed, */ 552ecd7789bSchristos /* 0 == item successfully added */ 553ecd7789bSchristos /* Parameters: rs(I) - pointer to RPCB session structure */ 554ecd7789bSchristos /* rx(I) - pointer to RPCB transaction structure */ 555ecd7789bSchristos /* -------------------------------------------------------------------- */ 556ecd7789bSchristos static int 557*f330e785Schristos ipf_p_rpcb_insert(rpcb_session_t *rs, rpcb_xact_t *rx) 558ecd7789bSchristos { 559ecd7789bSchristos rpcb_xact_t *rxp; 560ecd7789bSchristos 561ecd7789bSchristos rxp = ipf_p_rpcb_lookup(rs, rx->rx_xid); 562ecd7789bSchristos if (rxp != NULL) { 563ecd7789bSchristos ++rxp->rx_ref; 564ecd7789bSchristos return(0); 565ecd7789bSchristos } 566ecd7789bSchristos 567ecd7789bSchristos if (rpcbcnt == RPCB_MAXREQS) 568ecd7789bSchristos return(-1); 569ecd7789bSchristos 570ecd7789bSchristos KMALLOC(rxp, rpcb_xact_t *); 571ecd7789bSchristos if (rxp == NULL) 572ecd7789bSchristos return(-1); 573ecd7789bSchristos 574ecd7789bSchristos bcopy((char *)rx, (char *)rxp, sizeof(*rx)); 575ecd7789bSchristos 576ecd7789bSchristos if (rs->rs_rxlist != NULL) 577ecd7789bSchristos rs->rs_rxlist->rx_pnext = &rxp->rx_next; 578ecd7789bSchristos 579ecd7789bSchristos rxp->rx_pnext = &rs->rs_rxlist; 580ecd7789bSchristos rxp->rx_next = rs->rs_rxlist; 581ecd7789bSchristos rs->rs_rxlist = rxp; 582ecd7789bSchristos 583ecd7789bSchristos rxp->rx_ref = 1; 584ecd7789bSchristos 585ecd7789bSchristos ++rpcbcnt; 586ecd7789bSchristos 587ecd7789bSchristos return(0); 588ecd7789bSchristos } 589ecd7789bSchristos 590ecd7789bSchristos /* -------------------------------------------------------------------- */ 591ecd7789bSchristos /* Function: ipf_p_rpcb_xdrrpcb */ 592ecd7789bSchristos /* Returns: int -- -1 == failure to properly decode the request */ 593ecd7789bSchristos /* 0 == rpcb successfully decoded */ 594ecd7789bSchristos /* Parameters: rs(I) - pointer to RPCB session structure */ 595ecd7789bSchristos /* p(I) - pointer to location within session buffer */ 596ecd7789bSchristos /* rpcb(O) - pointer to rpcb (xdr type) structure */ 597ecd7789bSchristos /* */ 598ecd7789bSchristos /* Decode a XDR encoded rpcb structure and record its contents in rpcb */ 599ecd7789bSchristos /* within only the context of TCP/UDP over IP networks. */ 600ecd7789bSchristos /* -------------------------------------------------------------------- */ 601ecd7789bSchristos static int 602*f330e785Schristos ipf_p_rpcb_xdrrpcb(rpc_msg_t *rm, u_32_t *p, rpcb_args_t *ra) 603ecd7789bSchristos { 604ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, p, 20)) 605ecd7789bSchristos return(-1); 606ecd7789bSchristos 607ecd7789bSchristos /* Bypass target program & version. */ 608ecd7789bSchristos p += 2; 609ecd7789bSchristos 610ecd7789bSchristos /* Decode r_netid. Must be "tcp" or "udp". */ 611ecd7789bSchristos if (ipf_p_rpcb_getproto(rm, &ra->ra_netid, &p) != 0) 612ecd7789bSchristos return(-1); 613ecd7789bSchristos 614ecd7789bSchristos /* Decode r_maddr. */ 615ecd7789bSchristos if (ipf_p_rpcb_getuaddr(rm, &ra->ra_maddr, &p) != 0) 616ecd7789bSchristos return(-1); 617ecd7789bSchristos 618ecd7789bSchristos /* Advance to r_owner and make sure it's empty. */ 619ecd7789bSchristos if (!RPCB_BUF_EQ(rm, p, 4) || (B(p) != 0)) 620ecd7789bSchristos return(-1); 621ecd7789bSchristos 622ecd7789bSchristos return(0); 623ecd7789bSchristos } 624ecd7789bSchristos 625ecd7789bSchristos /* -------------------------------------------------------------------- */ 626ecd7789bSchristos /* Function: ipf_p_rpcb_getuaddr */ 627ecd7789bSchristos /* Returns: int -- -1 == illegal string, */ 628ecd7789bSchristos /* 0 == string parsed; contents recorded */ 629ecd7789bSchristos /* Parameters: rm(I) - pointer to RPC message structure */ 630ecd7789bSchristos /* xu(I) - pointer to universal address structure */ 631ecd7789bSchristos /* p(IO) - pointer to location within message buffer */ 632ecd7789bSchristos /* */ 633ecd7789bSchristos /* Decode the IP address / port at p and record them in xu. */ 634ecd7789bSchristos /* -------------------------------------------------------------------- */ 635ecd7789bSchristos static int 636*f330e785Schristos ipf_p_rpcb_getuaddr(rpc_msg_t *rm, xdr_uaddr_t *xu, u_32_t **p) 637ecd7789bSchristos { 638ecd7789bSchristos char *c, *i, *b, *pp; 639ecd7789bSchristos u_int d, dd, l, t; 640ecd7789bSchristos char uastr[24]; 641ecd7789bSchristos 642ecd7789bSchristos /* Test for string length. */ 643ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, *p, 4)) 644ecd7789bSchristos return(-1); 645ecd7789bSchristos 646ecd7789bSchristos xu->xu_xslen = (*p)++; 647ecd7789bSchristos xu->xu_xsstr = (char *)*p; 648ecd7789bSchristos 649ecd7789bSchristos /* Length check */ 650ecd7789bSchristos l = B(xu->xu_xslen); 651ecd7789bSchristos if (l < 11 || l > 23 || !RPCB_BUF_GEQ(rm, *p, XDRALIGN(l))) 652ecd7789bSchristos return(-1); 653ecd7789bSchristos 654ecd7789bSchristos /* Advance p */ 655ecd7789bSchristos *(char **)p += XDRALIGN(l); 656ecd7789bSchristos 657ecd7789bSchristos /* Copy string to local buffer & terminate C style */ 658ecd7789bSchristos bcopy(xu->xu_xsstr, uastr, l); 659ecd7789bSchristos uastr[l] = '\0'; 660ecd7789bSchristos 661ecd7789bSchristos i = (char *)&xu->xu_ip; 662ecd7789bSchristos pp = (char *)&xu->xu_port; 663ecd7789bSchristos 664ecd7789bSchristos /* 665ecd7789bSchristos * Expected format: a.b.c.d.e.f where [a-d] correspond to bytes of 666ecd7789bSchristos * an IP address and [ef] are the bytes of a L4 port. 667ecd7789bSchristos */ 668ecd7789bSchristos if (!(ISDIGIT(uastr[0]) && ISDIGIT(uastr[l-1]))) 669ecd7789bSchristos return(-1); 670ecd7789bSchristos b = uastr; 671ecd7789bSchristos for (c = &uastr[1], d = 0, dd = 0; c < &uastr[l-1]; c++) { 672ecd7789bSchristos if (ISDIGIT(*c)) { 673ecd7789bSchristos dd = 0; 674ecd7789bSchristos continue; 675ecd7789bSchristos } 676ecd7789bSchristos if (*c == '.') { 677ecd7789bSchristos if (dd != 0) 678ecd7789bSchristos return(-1); 679ecd7789bSchristos 680ecd7789bSchristos /* Check for ASCII byte. */ 681ecd7789bSchristos *c = '\0'; 682ecd7789bSchristos t = ipf_p_rpcb_atoi(b); 683ecd7789bSchristos if (t > 255) 684ecd7789bSchristos return(-1); 685ecd7789bSchristos 686ecd7789bSchristos /* Aim b at beginning of the next byte. */ 687ecd7789bSchristos b = c + 1; 688ecd7789bSchristos 689ecd7789bSchristos /* Switch off IP addr vs port parsing. */ 690ecd7789bSchristos if (d < 4) 691ecd7789bSchristos i[d++] = t & 0xff; 692ecd7789bSchristos else 693ecd7789bSchristos pp[d++ - 4] = t & 0xff; 694ecd7789bSchristos 695ecd7789bSchristos dd = 1; 696ecd7789bSchristos continue; 697ecd7789bSchristos } 698ecd7789bSchristos return(-1); 699ecd7789bSchristos } 700ecd7789bSchristos if (d != 5) /* String must contain exactly 5 periods. */ 701ecd7789bSchristos return(-1); 702ecd7789bSchristos 703ecd7789bSchristos /* Handle the last byte (port low byte) */ 704ecd7789bSchristos t = ipf_p_rpcb_atoi(b); 705ecd7789bSchristos if (t > 255) 706ecd7789bSchristos return(-1); 707ecd7789bSchristos pp[d - 4] = t & 0xff; 708ecd7789bSchristos 709ecd7789bSchristos return(0); 710ecd7789bSchristos } 711ecd7789bSchristos 712ecd7789bSchristos /* -------------------------------------------------------------------- */ 713ecd7789bSchristos /* Function: ipf_p_rpcb_atoi (XXX should be generic for all proxies) */ 714ecd7789bSchristos /* Returns: int -- integer representation of supplied string */ 715ecd7789bSchristos /* Parameters: ptr(I) - input string */ 716ecd7789bSchristos /* */ 717ecd7789bSchristos /* Simple version of atoi(3) ripped from ip_rcmd_pxy.c. */ 718ecd7789bSchristos /* -------------------------------------------------------------------- */ 719ecd7789bSchristos static u_int 720*f330e785Schristos ipf_p_rpcb_atoi(char *ptr) 721ecd7789bSchristos { 722*f330e785Schristos char *s = ptr, c; 723*f330e785Schristos u_int i = 0; 724ecd7789bSchristos 725ecd7789bSchristos while (((c = *s++) != '\0') && ISDIGIT(c)) { 726ecd7789bSchristos i *= 10; 727ecd7789bSchristos i += c - '0'; 728ecd7789bSchristos } 729ecd7789bSchristos return i; 730ecd7789bSchristos } 731ecd7789bSchristos 732ecd7789bSchristos /* -------------------------------------------------------------------- */ 733ecd7789bSchristos /* Function: ipf_p_rpcb_modreq */ 734ecd7789bSchristos /* Returns: int -- change in datagram length */ 735ecd7789bSchristos /* APR_ERR(2) - critical failure */ 736ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */ 737ecd7789bSchristos /* nat(I) - pointer to NAT session */ 738ecd7789bSchristos /* rm(I) - pointer to RPC message structure */ 739ecd7789bSchristos /* m(I) - pointer to mbuf chain */ 740ecd7789bSchristos /* off(I) - current offset within mbuf chain */ 741ecd7789bSchristos /* */ 742ecd7789bSchristos /* When external and internal addresses differ, we rewrite the former */ 743ecd7789bSchristos /* with the latter. (This is exclusive to protocol versions 3 & 4). */ 744ecd7789bSchristos /* -------------------------------------------------------------------- */ 745ecd7789bSchristos static int 746*f330e785Schristos ipf_p_rpcb_modreq(fr_info_t *fin, nat_t *nat, rpc_msg_t *rm, mb_t *m, u_int off) 747ecd7789bSchristos { 748ecd7789bSchristos u_int len, xlen, pos, bogo; 749ecd7789bSchristos rpcb_args_t *ra; 750ecd7789bSchristos char uaddr[24]; 751ecd7789bSchristos udphdr_t *udp; 752ecd7789bSchristos char *i, *p; 753ecd7789bSchristos int diff; 754ecd7789bSchristos 755ecd7789bSchristos ra = &rm->rm_call.rc_rpcbargs; 756ecd7789bSchristos i = (char *)&nat->nat_odstaddr; 757ecd7789bSchristos p = (char *)&nat->nat_odport; 758ecd7789bSchristos 759ecd7789bSchristos /* Form new string. */ 760ecd7789bSchristos bzero(uaddr, sizeof(uaddr)); /* Just in case we need padding. */ 761ecd7789bSchristos #if defined(SNPRINTF) && defined(_KERNEL) 762ecd7789bSchristos SNPRINTF(uaddr, sizeof(uaddr), 763ecd7789bSchristos "%u.%u.%u.%u.%u.%u", i[0] & 0xff, i[1] & 0xff, 764ecd7789bSchristos i[2] & 0xff, i[3] & 0xff, p[0] & 0xff, p[1] & 0xff); 765*f330e785Schristos #else 766*f330e785Schristos (void) sprintf(uaddr, 767*f330e785Schristos "%u.%u.%u.%u.%u.%u", i[0] & 0xff, i[1] & 0xff, 768*f330e785Schristos i[2] & 0xff, i[3] & 0xff, p[0] & 0xff, p[1] & 0xff); 769*f330e785Schristos #endif 770ecd7789bSchristos len = strlen(uaddr); 771ecd7789bSchristos xlen = XDRALIGN(len); 772ecd7789bSchristos 773ecd7789bSchristos /* Determine mbuf offset to start writing to. */ 774ecd7789bSchristos pos = (char *)ra->ra_maddr.xu_xslen - rm->rm_msgbuf; 775ecd7789bSchristos off += pos; 776ecd7789bSchristos 777ecd7789bSchristos /* Write new string length. */ 778ecd7789bSchristos bogo = htonl(len); 779*f330e785Schristos COPYBACK(m, off, 4, (void *)&bogo); 780ecd7789bSchristos off += 4; 781ecd7789bSchristos 782ecd7789bSchristos /* Write new string. */ 783ecd7789bSchristos COPYBACK(m, off, xlen, uaddr); 784ecd7789bSchristos off += xlen; 785ecd7789bSchristos 786ecd7789bSchristos /* Write in zero r_owner. */ 787ecd7789bSchristos bogo = 0; 788*f330e785Schristos COPYBACK(m, off, 4, (void *)&bogo); 789ecd7789bSchristos 790ecd7789bSchristos /* Determine difference in data lengths. */ 791ecd7789bSchristos diff = xlen - XDRALIGN(B(ra->ra_maddr.xu_xslen)); 792ecd7789bSchristos 793ecd7789bSchristos /* 794ecd7789bSchristos * If our new string has a different length, make necessary 795ecd7789bSchristos * adjustments. 796ecd7789bSchristos */ 797ecd7789bSchristos if (diff != 0) { 798ecd7789bSchristos udp = fin->fin_dp; 799ecd7789bSchristos udp->uh_ulen = htons(ntohs(udp->uh_ulen) + diff); 800ecd7789bSchristos fin->fin_plen += diff; 801ecd7789bSchristos fin->fin_ip->ip_len = htons(fin->fin_plen); 802ecd7789bSchristos fin->fin_dlen += diff; 803ecd7789bSchristos /* XXX Storage lengths. */ 804ecd7789bSchristos } 805ecd7789bSchristos 806ecd7789bSchristos return(diff); 807ecd7789bSchristos } 808ecd7789bSchristos 809ecd7789bSchristos /* -------------------------------------------------------------------- */ 810ecd7789bSchristos /* Function: ipf_p_rpcb_decoderep */ 811ecd7789bSchristos /* Returns: int - -1 == bad request or critical failure, */ 812ecd7789bSchristos /* 0 == valid, negative reply */ 813ecd7789bSchristos /* 1 == vaddlid, positive reply; needs no changes */ 814ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */ 815ecd7789bSchristos /* nat(I) - pointer to NAT session structure */ 816ecd7789bSchristos /* rs(I) - pointer to RPCB session structure */ 817ecd7789bSchristos /* rm(I) - pointer to RPC message structure */ 818ecd7789bSchristos /* rxp(O) - pointer to RPCB transaction structure */ 819ecd7789bSchristos /* */ 820ecd7789bSchristos /* Take a presumed RPCB reply, extract the XID, search for the original */ 821ecd7789bSchristos /* request information, and determine whether the request was accepted */ 822ecd7789bSchristos /* or rejected. With a valid accepted reply, go ahead and create NAT */ 823ecd7789bSchristos /* and state entries, and finish up by rewriting the packet as */ 824ecd7789bSchristos /* required. */ 825ecd7789bSchristos /* */ 826ecd7789bSchristos /* WARNING: It's the responsibility of the caller to make sure there */ 827ecd7789bSchristos /* is enough room in rs_buf for the basic RPC message "preamble". */ 828ecd7789bSchristos /* -------------------------------------------------------------------- */ 829ecd7789bSchristos static int 830*f330e785Schristos ipf_p_rpcb_decoderep(fr_info_t *fin, nat_t *nat, rpcb_session_t *rs, 831*f330e785Schristos rpc_msg_t *rm, rpcb_xact_t **rxp) 832ecd7789bSchristos { 833ecd7789bSchristos rpcb_listp_t *rl; 834ecd7789bSchristos rpcb_entry_t *re; 835ecd7789bSchristos rpcb_xact_t *rx; 836ecd7789bSchristos u_32_t xdr, *p; 837ecd7789bSchristos rpc_resp_t *rr; 838ecd7789bSchristos int rv, cnt; 839ecd7789bSchristos 840ecd7789bSchristos p = (u_32_t *)rm->rm_msgbuf; 841ecd7789bSchristos 842ecd7789bSchristos bzero((char *)&rx, sizeof(rx)); 843ecd7789bSchristos rr = &rm->rm_resp; 844ecd7789bSchristos 845ecd7789bSchristos rm->rm_xid = p; 846ecd7789bSchristos xdr = B(p++); /* Record this message's XID. */ 847ecd7789bSchristos 848ecd7789bSchristos /* Lookup XID */ 849ecd7789bSchristos MUTEX_ENTER(&rs->rs_rxlock); 850ecd7789bSchristos if ((rx = ipf_p_rpcb_lookup(rs, xdr)) == NULL) { 851ecd7789bSchristos MUTEX_EXIT(&rs->rs_rxlock); 852ecd7789bSchristos return(-1); 853ecd7789bSchristos } 854ecd7789bSchristos ++rx->rx_ref; /* per thread reference */ 855ecd7789bSchristos MUTEX_EXIT(&rs->rs_rxlock); 856ecd7789bSchristos 857ecd7789bSchristos *rxp = rx; 858ecd7789bSchristos 859ecd7789bSchristos /* Test call vs reply */ 860ecd7789bSchristos if (B(p++) != RPCB_REPLY) 861ecd7789bSchristos return(-1); 862ecd7789bSchristos 863ecd7789bSchristos /* Test reply_stat */ 864ecd7789bSchristos switch(B(p++)) 865ecd7789bSchristos { 866ecd7789bSchristos case RPCB_MSG_DENIED: 867ecd7789bSchristos return(0); 868ecd7789bSchristos case RPCB_MSG_ACCEPTED: 869ecd7789bSchristos break; 870ecd7789bSchristos default: 871ecd7789bSchristos return(-1); 872ecd7789bSchristos } 873ecd7789bSchristos 874ecd7789bSchristos /* Bypass RPC authentication stuff. */ 875ecd7789bSchristos if (ipf_p_rpcb_skipauth(rm, &rr->rr_authverf, &p) != 0) 876ecd7789bSchristos return(-1); 877ecd7789bSchristos 878ecd7789bSchristos /* Test accept status */ 879ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, p, 4)) 880ecd7789bSchristos return(-1); 881ecd7789bSchristos if (B(p++) != 0) 882ecd7789bSchristos return(0); 883ecd7789bSchristos 884ecd7789bSchristos /* Parse out the expected reply */ 885ecd7789bSchristos switch(rx->rx_type) 886ecd7789bSchristos { 887ecd7789bSchristos case RPCB_RES_PMAP: 888ecd7789bSchristos /* There must be only one 4 byte argument. */ 889ecd7789bSchristos if (!RPCB_BUF_EQ(rm, p, 4)) 890ecd7789bSchristos return(-1); 891ecd7789bSchristos 892ecd7789bSchristos rr->rr_v2 = p; 893ecd7789bSchristos xdr = B(rr->rr_v2); 894ecd7789bSchristos 895ecd7789bSchristos /* Reply w/ a 0 port indicates service isn't registered */ 896ecd7789bSchristos if (xdr == 0) 897ecd7789bSchristos return(0); 898ecd7789bSchristos 899ecd7789bSchristos /* Is the value sane? */ 900ecd7789bSchristos if (xdr > 65535) 901ecd7789bSchristos return(-1); 902ecd7789bSchristos 903ecd7789bSchristos /* Create NAT & state table entries. */ 904ecd7789bSchristos if (ipf_p_rpcb_getnat(fin, nat, rx->rx_proto, (u_int)xdr) != 0) 905ecd7789bSchristos return(-1); 906ecd7789bSchristos break; 907ecd7789bSchristos case RPCB_RES_STRING: 908ecd7789bSchristos /* Expecting a XDR string; need 4 bytes for length */ 909ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, p, 4)) 910ecd7789bSchristos return(-1); 911ecd7789bSchristos 912ecd7789bSchristos rr->rr_v3.xu_str.xs_len = p++; 913ecd7789bSchristos rr->rr_v3.xu_str.xs_str = (char *)p; 914ecd7789bSchristos 915ecd7789bSchristos xdr = B(rr->rr_v3.xu_xslen); 916ecd7789bSchristos 917ecd7789bSchristos /* A null string indicates an unregistered service */ 918ecd7789bSchristos if ((xdr == 0) && RPCB_BUF_EQ(rm, p, 0)) 919ecd7789bSchristos return(0); 920ecd7789bSchristos 921ecd7789bSchristos /* Decode the target IP address / port. */ 922ecd7789bSchristos if (ipf_p_rpcb_getuaddr(rm, &rr->rr_v3, &p) != 0) 923ecd7789bSchristos return(-1); 924ecd7789bSchristos 925ecd7789bSchristos /* Validate the IP address and port contained. */ 926ecd7789bSchristos if (nat->nat_odstaddr != rr->rr_v3.xu_ip) 927ecd7789bSchristos return(-1); 928ecd7789bSchristos 929ecd7789bSchristos /* Create NAT & state table entries. */ 930ecd7789bSchristos if (ipf_p_rpcb_getnat(fin, nat, rx->rx_proto, 931ecd7789bSchristos (u_int)rr->rr_v3.xu_port) != 0) 932ecd7789bSchristos return(-1); 933ecd7789bSchristos break; 934ecd7789bSchristos case RPCB_RES_LIST: 935ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, p, 4)) 936ecd7789bSchristos return(-1); 937ecd7789bSchristos /* rpcb_entry_list_ptr */ 938ecd7789bSchristos switch(B(p)) 939ecd7789bSchristos { 940ecd7789bSchristos case 0: 941ecd7789bSchristos return(0); 942ecd7789bSchristos /*NOTREACHED*/ 943ecd7789bSchristos break; 944ecd7789bSchristos case 1: 945ecd7789bSchristos break; 946ecd7789bSchristos default: 947ecd7789bSchristos return(-1); 948ecd7789bSchristos } 949ecd7789bSchristos rl = &rr->rr_v4; 950ecd7789bSchristos rl->rl_list = p++; 951ecd7789bSchristos cnt = 0; 952ecd7789bSchristos 953ecd7789bSchristos for(;;) { 954ecd7789bSchristos re = &rl->rl_entries[rl->rl_cnt]; 955ecd7789bSchristos if (ipf_p_rpcb_getuaddr(rm, &re->re_maddr, &p) != 0) 956ecd7789bSchristos return(-1); 957ecd7789bSchristos if (ipf_p_rpcb_getproto(rm, &re->re_netid, &p) != 0) 958ecd7789bSchristos return(-1); 959ecd7789bSchristos /* re_semantics & re_pfamily length */ 960ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, p, 12)) 961ecd7789bSchristos return(-1); 962ecd7789bSchristos p++; /* Skipping re_semantics. */ 963ecd7789bSchristos xdr = B(p++); 964ecd7789bSchristos if ((xdr != 4) || strncmp((char *)p, "inet", 4)) 965ecd7789bSchristos return(-1); 966ecd7789bSchristos p++; 967ecd7789bSchristos if (ipf_p_rpcb_getproto(rm, &re->re_proto, &p) != 0) 968ecd7789bSchristos return(-1); 969ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, p, 4)) 970ecd7789bSchristos return(-1); 971ecd7789bSchristos re->re_more = p; 972ecd7789bSchristos if (B(re->re_more) > 1) /* 0,1 only legal values */ 973ecd7789bSchristos return(-1); 974ecd7789bSchristos ++rl->rl_cnt; 975ecd7789bSchristos ++cnt; 976ecd7789bSchristos if (B(re->re_more) == 0) 977ecd7789bSchristos break; 978ecd7789bSchristos /* Replies in max out at 2; TCP and/or UDP */ 979ecd7789bSchristos if (cnt > 2) 980ecd7789bSchristos return(-1); 981ecd7789bSchristos p++; 982ecd7789bSchristos } 983ecd7789bSchristos 984ecd7789bSchristos for(rl->rl_cnt = 0; rl->rl_cnt < cnt; rl->rl_cnt++) { 985ecd7789bSchristos re = &rl->rl_entries[rl->rl_cnt]; 986ecd7789bSchristos rv = ipf_p_rpcb_getnat(fin, nat, 987ecd7789bSchristos re->re_proto.xp_proto, 988ecd7789bSchristos (u_int)re->re_maddr.xu_port); 989ecd7789bSchristos if (rv != 0) 990ecd7789bSchristos return(-1); 991ecd7789bSchristos } 992ecd7789bSchristos break; 993ecd7789bSchristos default: 994ecd7789bSchristos /*CONSTANTCONDITION*/ 995ecd7789bSchristos IPF_PANIC(1, ("illegal rx_type %d", rx->rx_type)); 996ecd7789bSchristos } 997ecd7789bSchristos 998ecd7789bSchristos return(1); 999ecd7789bSchristos } 1000ecd7789bSchristos 1001ecd7789bSchristos /* -------------------------------------------------------------------- */ 1002ecd7789bSchristos /* Function: ipf_p_rpcb_lookup */ 1003ecd7789bSchristos /* Returns: rpcb_xact_t * - NULL == no matching record, */ 1004ecd7789bSchristos /* else pointer to relevant entry */ 1005ecd7789bSchristos /* Parameters: rs(I) - pointer to RPCB session */ 1006ecd7789bSchristos /* xid(I) - XID to look for */ 1007ecd7789bSchristos /* -------------------------------------------------------------------- */ 1008ecd7789bSchristos static rpcb_xact_t * 1009*f330e785Schristos ipf_p_rpcb_lookup(rpcb_session_t *rs, u_32_t xid) 1010ecd7789bSchristos { 1011ecd7789bSchristos rpcb_xact_t *rx; 1012ecd7789bSchristos 1013ecd7789bSchristos if (rs->rs_rxlist == NULL) 1014ecd7789bSchristos return(NULL); 1015ecd7789bSchristos 1016ecd7789bSchristos for (rx = rs->rs_rxlist; rx != NULL; rx = rx->rx_next) 1017ecd7789bSchristos if (rx->rx_xid == xid) 1018ecd7789bSchristos break; 1019ecd7789bSchristos 1020ecd7789bSchristos return(rx); 1021ecd7789bSchristos } 1022ecd7789bSchristos 1023ecd7789bSchristos /* -------------------------------------------------------------------- */ 1024ecd7789bSchristos /* Function: ipf_p_rpcb_deref */ 1025ecd7789bSchristos /* Returns: (void) */ 1026ecd7789bSchristos /* Parameters: rs(I) - pointer to RPCB session */ 1027ecd7789bSchristos /* rx(I) - pointer to RPC transaction struct to remove */ 1028ecd7789bSchristos /* force(I) - indicates to delete entry regardless of */ 1029ecd7789bSchristos /* reference count */ 1030ecd7789bSchristos /* Locking: rs->rs_rxlock must be held write only */ 1031ecd7789bSchristos /* */ 1032ecd7789bSchristos /* Free the RPCB transaction record rx from the chain of entries. */ 1033ecd7789bSchristos /* -------------------------------------------------------------------- */ 1034ecd7789bSchristos static void 1035*f330e785Schristos ipf_p_rpcb_deref(rpcb_session_t *rs, rpcb_xact_t *rx) 1036ecd7789bSchristos { 1037ecd7789bSchristos rs = rs; /* LINT */ 1038ecd7789bSchristos 1039ecd7789bSchristos if (rx == NULL) 1040ecd7789bSchristos return; 1041ecd7789bSchristos 1042ecd7789bSchristos if (--rx->rx_ref != 0) 1043ecd7789bSchristos return; 1044ecd7789bSchristos 1045ecd7789bSchristos if (rx->rx_next != NULL) 1046ecd7789bSchristos rx->rx_next->rx_pnext = rx->rx_pnext; 1047ecd7789bSchristos 1048ecd7789bSchristos *rx->rx_pnext = rx->rx_next; 1049ecd7789bSchristos 1050ecd7789bSchristos KFREE(rx); 1051ecd7789bSchristos 1052ecd7789bSchristos --rpcbcnt; 1053ecd7789bSchristos } 1054ecd7789bSchristos 1055ecd7789bSchristos /* -------------------------------------------------------------------- */ 1056ecd7789bSchristos /* Function: ipf_p_rpcb_getproto */ 1057ecd7789bSchristos /* Returns: int - -1 == illegal protocol/netid, */ 1058ecd7789bSchristos /* 0 == legal protocol/netid */ 1059ecd7789bSchristos /* Parameters: rm(I) - pointer to RPC message structure */ 1060ecd7789bSchristos /* xp(I) - pointer to netid structure */ 1061ecd7789bSchristos /* p(IO) - pointer to location within packet buffer */ 1062ecd7789bSchristos /* */ 1063ecd7789bSchristos /* Decode netid/proto stored at p and record its numeric value. */ 1064ecd7789bSchristos /* -------------------------------------------------------------------- */ 1065ecd7789bSchristos static int 1066*f330e785Schristos ipf_p_rpcb_getproto(rpc_msg_t *rm, xdr_proto_t *xp, u_32_t **p) 1067ecd7789bSchristos { 1068ecd7789bSchristos u_int len; 1069ecd7789bSchristos 1070ecd7789bSchristos /* Must have 4 bytes for length & 4 bytes for "tcp" or "udp". */ 1071ecd7789bSchristos if (!RPCB_BUF_GEQ(rm, p, 8)) 1072ecd7789bSchristos return(-1); 1073ecd7789bSchristos 1074ecd7789bSchristos xp->xp_xslen = (*p)++; 1075ecd7789bSchristos xp->xp_xsstr = (char *)*p; 1076ecd7789bSchristos 1077ecd7789bSchristos /* Test the string length. */ 1078ecd7789bSchristos len = B(xp->xp_xslen); 1079ecd7789bSchristos if (len != 3) 1080ecd7789bSchristos return(-1); 1081ecd7789bSchristos 1082ecd7789bSchristos /* Test the actual string & record the protocol accordingly. */ 1083ecd7789bSchristos if (!strncmp((char *)xp->xp_xsstr, "tcp\0", 4)) 1084ecd7789bSchristos xp->xp_proto = IPPROTO_TCP; 1085ecd7789bSchristos else if (!strncmp((char *)xp->xp_xsstr, "udp\0", 4)) 1086ecd7789bSchristos xp->xp_proto = IPPROTO_UDP; 1087ecd7789bSchristos else { 1088ecd7789bSchristos return(-1); 1089ecd7789bSchristos } 1090ecd7789bSchristos 1091ecd7789bSchristos /* Advance past the string. */ 1092ecd7789bSchristos (*p)++; 1093ecd7789bSchristos 1094ecd7789bSchristos return(0); 1095ecd7789bSchristos } 1096ecd7789bSchristos 1097ecd7789bSchristos /* -------------------------------------------------------------------- */ 1098ecd7789bSchristos /* Function: ipf_p_rpcb_getnat */ 1099ecd7789bSchristos /* Returns: int -- -1 == failed to create table entries, */ 1100ecd7789bSchristos /* 0 == success */ 1101ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */ 1102ecd7789bSchristos /* nat(I) - pointer to NAT table entry */ 1103ecd7789bSchristos /* proto(I) - transport protocol for new entries */ 1104ecd7789bSchristos /* port(I) - new port to use w/ wildcard table entries */ 1105ecd7789bSchristos /* */ 1106ecd7789bSchristos /* Create state and NAT entries to handle an anticipated connection */ 1107ecd7789bSchristos /* attempt between RPC client and server. */ 1108ecd7789bSchristos /* -------------------------------------------------------------------- */ 1109ecd7789bSchristos static int 1110*f330e785Schristos ipf_p_rpcb_getnat(fr_info_t *fin, nat_t *nat, u_int proto, u_int port) 1111ecd7789bSchristos { 1112ecd7789bSchristos ipf_main_softc_t *softc = fin->fin_main_soft; 1113ecd7789bSchristos ipnat_t *ipn, ipnat; 1114ecd7789bSchristos tcphdr_t tcp; 1115ecd7789bSchristos ipstate_t *is; 1116ecd7789bSchristos fr_info_t fi; 1117ecd7789bSchristos nat_t *natl; 1118ecd7789bSchristos int nflags; 1119ecd7789bSchristos 1120ecd7789bSchristos ipn = nat->nat_ptr; 1121ecd7789bSchristos 1122ecd7789bSchristos /* Generate dummy fr_info */ 1123ecd7789bSchristos bcopy((char *)fin, (char *)&fi, sizeof(fi)); 1124ecd7789bSchristos fi.fin_out = 0; 1125ecd7789bSchristos fi.fin_p = proto; 1126ecd7789bSchristos fi.fin_sport = 0; 1127ecd7789bSchristos fi.fin_dport = port & 0xffff; 1128ecd7789bSchristos fi.fin_flx |= FI_IGNORE; 1129ecd7789bSchristos fi.fin_saddr = nat->nat_osrcaddr; 1130ecd7789bSchristos fi.fin_daddr = nat->nat_odstaddr; 1131ecd7789bSchristos 1132ecd7789bSchristos bzero((char *)&tcp, sizeof(tcp)); 1133ecd7789bSchristos tcp.th_dport = htons(port); 1134ecd7789bSchristos 1135ecd7789bSchristos if (proto == IPPROTO_TCP) { 1136ecd7789bSchristos tcp.th_win = htons(8192); 1137ecd7789bSchristos TCP_OFF_A(&tcp, sizeof(tcphdr_t) >> 2); 1138ecd7789bSchristos fi.fin_dlen = sizeof(tcphdr_t); 1139ecd7789bSchristos tcp.th_flags = TH_SYN; 1140ecd7789bSchristos nflags = NAT_TCP; 1141ecd7789bSchristos } else { 1142ecd7789bSchristos fi.fin_dlen = sizeof(udphdr_t); 1143ecd7789bSchristos nflags = NAT_UDP; 1144ecd7789bSchristos } 1145ecd7789bSchristos 1146ecd7789bSchristos nflags |= SI_W_SPORT|NAT_SEARCH; 1147ecd7789bSchristos fi.fin_dp = &tcp; 1148ecd7789bSchristos fi.fin_plen = fi.fin_hlen + fi.fin_dlen; 1149ecd7789bSchristos 1150ecd7789bSchristos /* 1151ecd7789bSchristos * Search for existing NAT & state entries. Pay close attention to 1152ecd7789bSchristos * mutexes / locks grabbed from lookup routines, as not doing so could 1153ecd7789bSchristos * lead to bad things. 1154ecd7789bSchristos * 1155ecd7789bSchristos * If successful, fr_stlookup returns with ipf_state locked. We have 1156ecd7789bSchristos * no use for this lock, so simply unlock it if necessary. 1157ecd7789bSchristos */ 1158ecd7789bSchristos is = ipf_state_lookup(&fi, &tcp, NULL); 1159ecd7789bSchristos if (is != NULL) { 1160ecd7789bSchristos RWLOCK_EXIT(&softc->ipf_state); 1161ecd7789bSchristos } 1162ecd7789bSchristos 1163ecd7789bSchristos RWLOCK_EXIT(&softc->ipf_nat); 1164ecd7789bSchristos 1165ecd7789bSchristos WRITE_ENTER(&softc->ipf_nat); 1166ecd7789bSchristos natl = ipf_nat_inlookup(&fi, nflags, proto, fi.fin_src, fi.fin_dst); 1167ecd7789bSchristos 1168ecd7789bSchristos if ((natl != NULL) && (is != NULL)) { 1169ecd7789bSchristos MUTEX_DOWNGRADE(&softc->ipf_nat); 1170ecd7789bSchristos return(0); 1171ecd7789bSchristos } 1172ecd7789bSchristos 1173ecd7789bSchristos /* Slightly modify the following structures for actual use in creating 1174ecd7789bSchristos * NAT and/or state entries. We're primarily concerned with stripping 1175ecd7789bSchristos * flags that may be detrimental to the creation process or simply 1176ecd7789bSchristos * shouldn't be associated with a table entry. 1177ecd7789bSchristos */ 1178ecd7789bSchristos fi.fin_fr = &rpcbfr; 1179ecd7789bSchristos fi.fin_flx &= ~FI_IGNORE; 1180ecd7789bSchristos nflags &= ~NAT_SEARCH; 1181ecd7789bSchristos 1182ecd7789bSchristos if (natl == NULL) { 1183ecd7789bSchristos #ifdef USE_MUTEXES 1184ecd7789bSchristos ipf_nat_softc_t *softn = softc->ipf_nat_soft; 1185ecd7789bSchristos #endif 1186ecd7789bSchristos 1187ecd7789bSchristos /* XXX Since we're just copying the original ipn contents 1188ecd7789bSchristos * back, would we be better off just sending a pointer to 1189ecd7789bSchristos * the 'temp' copy off to nat_new instead? 1190ecd7789bSchristos */ 1191ecd7789bSchristos /* Generate template/bogus NAT rule. */ 1192ecd7789bSchristos bcopy((char *)ipn, (char *)&ipnat, sizeof(ipnat)); 1193ecd7789bSchristos ipn->in_flags = nflags & IPN_TCPUDP; 1194ecd7789bSchristos ipn->in_apr = NULL; 1195ecd7789bSchristos ipn->in_pr[0] = proto; 1196ecd7789bSchristos ipn->in_pr[1] = proto; 1197ecd7789bSchristos ipn->in_dpmin = fi.fin_dport; 1198ecd7789bSchristos ipn->in_dpmax = fi.fin_dport; 1199ecd7789bSchristos ipn->in_dpnext = fi.fin_dport; 1200ecd7789bSchristos ipn->in_space = 1; 1201ecd7789bSchristos ipn->in_ippip = 1; 1202ecd7789bSchristos if (ipn->in_flags & IPN_FILTER) { 1203ecd7789bSchristos ipn->in_scmp = 0; 1204ecd7789bSchristos ipn->in_dcmp = 0; 1205ecd7789bSchristos } 1206ecd7789bSchristos ipn->in_plabel = -1; 1207ecd7789bSchristos 1208ecd7789bSchristos /* Create NAT entry. return NULL if this fails. */ 1209ecd7789bSchristos MUTEX_ENTER(&softn->ipf_nat_new); 1210ecd7789bSchristos natl = ipf_nat_add(&fi, ipn, NULL, nflags|SI_CLONE|NAT_SLAVE, 1211ecd7789bSchristos NAT_INBOUND); 1212ecd7789bSchristos MUTEX_EXIT(&softn->ipf_nat_new); 1213ecd7789bSchristos 1214ecd7789bSchristos bcopy((char *)&ipnat, (char *)ipn, sizeof(ipnat)); 1215ecd7789bSchristos 1216ecd7789bSchristos if (natl == NULL) { 1217ecd7789bSchristos MUTEX_DOWNGRADE(&softc->ipf_nat); 1218ecd7789bSchristos return(-1); 1219ecd7789bSchristos } 1220ecd7789bSchristos 1221ecd7789bSchristos fi.fin_saddr = natl->nat_nsrcaddr; 1222ecd7789bSchristos fi.fin_daddr = natl->nat_ndstaddr; 1223ecd7789bSchristos ipn->in_use++; 1224ecd7789bSchristos (void) ipf_nat_proto(&fi, natl, nflags); 1225ecd7789bSchristos MUTEX_ENTER(&natl->nat_lock); 1226ecd7789bSchristos ipf_nat_update(&fi, natl); 1227ecd7789bSchristos MUTEX_EXIT(&natl->nat_lock); 1228ecd7789bSchristos } 1229ecd7789bSchristos MUTEX_DOWNGRADE(&softc->ipf_nat); 1230ecd7789bSchristos 1231ecd7789bSchristos if (is == NULL) { 1232ecd7789bSchristos /* Create state entry. Return NULL if this fails. */ 1233ecd7789bSchristos fi.fin_flx |= FI_NATED; 1234ecd7789bSchristos fi.fin_flx &= ~FI_STATE; 1235ecd7789bSchristos nflags &= NAT_TCPUDP; 1236ecd7789bSchristos nflags |= SI_W_SPORT|SI_CLONE; 1237ecd7789bSchristos 1238ecd7789bSchristos if (ipf_state_add(softc, &fi, NULL, nflags) != 0) { 1239ecd7789bSchristos /* 1240ecd7789bSchristos * XXX nat_delete is private to ip_nat.c. Should 1241ecd7789bSchristos * check w/ Darren about this one. 1242ecd7789bSchristos * 1243ecd7789bSchristos * nat_delete(natl, NL_EXPIRE); 1244ecd7789bSchristos */ 1245ecd7789bSchristos return(-1); 1246ecd7789bSchristos } 1247ecd7789bSchristos } 1248ecd7789bSchristos 1249ecd7789bSchristos return(0); 1250ecd7789bSchristos } 1251ecd7789bSchristos 1252ecd7789bSchristos /* -------------------------------------------------------------------- */ 1253ecd7789bSchristos /* Function: ipf_p_rpcb_modv3 */ 1254ecd7789bSchristos /* Returns: int -- change in packet length */ 1255ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */ 1256ecd7789bSchristos /* nat(I) - pointer to NAT session */ 1257ecd7789bSchristos /* rm(I) - pointer to RPC message structure */ 1258ecd7789bSchristos /* m(I) - pointer to mbuf chain */ 1259ecd7789bSchristos /* off(I) - offset within mbuf chain */ 1260ecd7789bSchristos /* */ 1261ecd7789bSchristos /* Write a new universal address string to this packet, adjusting */ 1262ecd7789bSchristos /* lengths as necessary. */ 1263ecd7789bSchristos /* -------------------------------------------------------------------- */ 1264ecd7789bSchristos static int 1265*f330e785Schristos ipf_p_rpcb_modv3(fr_info_t *fin, nat_t *nat, rpc_msg_t *rm, mb_t *m, u_int off) 1266ecd7789bSchristos { 1267ecd7789bSchristos u_int len, xlen, pos, bogo; 1268ecd7789bSchristos rpc_resp_t *rr; 1269ecd7789bSchristos char uaddr[24]; 1270ecd7789bSchristos char *i, *p; 1271ecd7789bSchristos int diff; 1272ecd7789bSchristos 1273ecd7789bSchristos rr = &rm->rm_resp; 1274ecd7789bSchristos i = (char *)&nat->nat_ndstaddr; 1275ecd7789bSchristos p = (char *)&rr->rr_v3.xu_port; 1276ecd7789bSchristos 1277ecd7789bSchristos /* Form new string. */ 1278ecd7789bSchristos bzero(uaddr, sizeof(uaddr)); /* Just in case we need padding. */ 1279ecd7789bSchristos #if defined(SNPRINTF) && defined(_KERNEL) 1280ecd7789bSchristos SNPRINTF(uaddr, sizeof(uaddr), 1281ecd7789bSchristos "%u.%u.%u.%u.%u.%u", i[0] & 0xff, i[1] & 0xff, 1282ecd7789bSchristos i[2] & 0xff, i[3] & 0xff, p[0] & 0xff, p[1] & 0xff); 1283*f330e785Schristos #else 1284*f330e785Schristos (void) sprintf(uaddr, 1285*f330e785Schristos "%u.%u.%u.%u.%u.%u", i[0] & 0xff, i[1] & 0xff, 1286*f330e785Schristos i[2] & 0xff, i[3] & 0xff, p[0] & 0xff, p[1] & 0xff); 1287*f330e785Schristos #endif 1288ecd7789bSchristos len = strlen(uaddr); 1289ecd7789bSchristos xlen = XDRALIGN(len); 1290ecd7789bSchristos 1291ecd7789bSchristos /* Determine mbuf offset to write to. */ 1292ecd7789bSchristos pos = (char *)rr->rr_v3.xu_xslen - rm->rm_msgbuf; 1293ecd7789bSchristos off += pos; 1294ecd7789bSchristos 1295ecd7789bSchristos /* Write new string length. */ 1296ecd7789bSchristos bogo = htonl(len); 1297*f330e785Schristos COPYBACK(m, off, 4, (void *)&bogo); 1298ecd7789bSchristos off += 4; 1299ecd7789bSchristos 1300ecd7789bSchristos /* Write new string. */ 1301ecd7789bSchristos COPYBACK(m, off, xlen, uaddr); 1302ecd7789bSchristos 1303ecd7789bSchristos /* Determine difference in data lengths. */ 1304ecd7789bSchristos diff = xlen - XDRALIGN(B(rr->rr_v3.xu_xslen)); 1305ecd7789bSchristos 1306ecd7789bSchristos /* 1307ecd7789bSchristos * If our new string has a different length, make necessary 1308ecd7789bSchristos * adjustments. 1309ecd7789bSchristos */ 1310ecd7789bSchristos if (diff != 0) 1311ecd7789bSchristos ipf_p_rpcb_fixlen(fin, diff); 1312ecd7789bSchristos 1313ecd7789bSchristos return(diff); 1314ecd7789bSchristos } 1315ecd7789bSchristos 1316ecd7789bSchristos /* -------------------------------------------------------------------- */ 1317ecd7789bSchristos /* Function: ipf_p_rpcb_modv4 */ 1318ecd7789bSchristos /* Returns: int -- change in packet length */ 1319ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */ 1320ecd7789bSchristos /* nat(I) - pointer to NAT session */ 1321ecd7789bSchristos /* rm(I) - pointer to RPC message structure */ 1322ecd7789bSchristos /* m(I) - pointer to mbuf chain */ 1323ecd7789bSchristos /* off(I) - offset within mbuf chain */ 1324ecd7789bSchristos /* */ 1325ecd7789bSchristos /* Write new rpcb_entry list, adjusting lengths as necessary. */ 1326ecd7789bSchristos /* -------------------------------------------------------------------- */ 1327ecd7789bSchristos static int 1328*f330e785Schristos ipf_p_rpcb_modv4(fr_info_t *fin, nat_t *nat, rpc_msg_t *rm, mb_t *m, u_int off) 1329ecd7789bSchristos { 1330ecd7789bSchristos u_int len, xlen, pos, bogo; 1331ecd7789bSchristos rpcb_listp_t *rl; 1332ecd7789bSchristos rpcb_entry_t *re; 1333ecd7789bSchristos rpc_resp_t *rr; 1334ecd7789bSchristos char uaddr[24]; 1335ecd7789bSchristos int diff, cnt; 1336ecd7789bSchristos char *i, *p; 1337ecd7789bSchristos 1338ecd7789bSchristos diff = 0; 1339ecd7789bSchristos rr = &rm->rm_resp; 1340ecd7789bSchristos rl = &rr->rr_v4; 1341ecd7789bSchristos 1342ecd7789bSchristos i = (char *)&nat->nat_ndstaddr; 1343ecd7789bSchristos 1344ecd7789bSchristos /* Determine mbuf offset to write to. */ 1345ecd7789bSchristos re = &rl->rl_entries[0]; 1346ecd7789bSchristos pos = (char *)re->re_maddr.xu_xslen - rm->rm_msgbuf; 1347ecd7789bSchristos off += pos; 1348ecd7789bSchristos 1349ecd7789bSchristos for (cnt = 0; cnt < rl->rl_cnt; cnt++) { 1350ecd7789bSchristos re = &rl->rl_entries[cnt]; 1351ecd7789bSchristos p = (char *)&re->re_maddr.xu_port; 1352ecd7789bSchristos 1353ecd7789bSchristos /* Form new string. */ 1354ecd7789bSchristos bzero(uaddr, sizeof(uaddr)); /* Just in case we need 1355ecd7789bSchristos padding. */ 1356ecd7789bSchristos #if defined(SNPRINTF) && defined(_KERNEL) 1357ecd7789bSchristos SNPRINTF(uaddr, sizeof(uaddr), 1358ecd7789bSchristos "%u.%u.%u.%u.%u.%u", i[0] & 0xff, 1359ecd7789bSchristos i[1] & 0xff, i[2] & 0xff, i[3] & 0xff, 1360ecd7789bSchristos p[0] & 0xff, p[1] & 0xff); 1361*f330e785Schristos #else 1362*f330e785Schristos (void) sprintf(uaddr, 1363*f330e785Schristos "%u.%u.%u.%u.%u.%u", i[0] & 0xff, 1364*f330e785Schristos i[1] & 0xff, i[2] & 0xff, i[3] & 0xff, 1365*f330e785Schristos p[0] & 0xff, p[1] & 0xff); 1366*f330e785Schristos #endif 1367ecd7789bSchristos len = strlen(uaddr); 1368ecd7789bSchristos xlen = XDRALIGN(len); 1369ecd7789bSchristos 1370ecd7789bSchristos /* Write new string length. */ 1371ecd7789bSchristos bogo = htonl(len); 1372*f330e785Schristos COPYBACK(m, off, 4, (void *)&bogo); 1373ecd7789bSchristos off += 4; 1374ecd7789bSchristos 1375ecd7789bSchristos /* Write new string. */ 1376ecd7789bSchristos COPYBACK(m, off, xlen, uaddr); 1377ecd7789bSchristos off += xlen; 1378ecd7789bSchristos 1379ecd7789bSchristos /* Record any change in length. */ 1380ecd7789bSchristos diff += xlen - XDRALIGN(B(re->re_maddr.xu_xslen)); 1381ecd7789bSchristos 1382ecd7789bSchristos /* If the length changed, copy back the rest of this entry. */ 1383ecd7789bSchristos len = ((char *)re->re_more + 4) - 1384ecd7789bSchristos (char *)re->re_netid.xp_xslen; 1385ecd7789bSchristos if (diff != 0) { 1386*f330e785Schristos COPYBACK(m, off, len, (void *)re->re_netid.xp_xslen); 1387ecd7789bSchristos } 1388ecd7789bSchristos off += len; 1389ecd7789bSchristos } 1390ecd7789bSchristos 1391ecd7789bSchristos /* 1392ecd7789bSchristos * If our new string has a different length, make necessary 1393ecd7789bSchristos * adjustments. 1394ecd7789bSchristos */ 1395ecd7789bSchristos if (diff != 0) 1396ecd7789bSchristos ipf_p_rpcb_fixlen(fin, diff); 1397ecd7789bSchristos 1398ecd7789bSchristos return(diff); 1399ecd7789bSchristos } 1400ecd7789bSchristos 1401ecd7789bSchristos 1402ecd7789bSchristos /* -------------------------------------------------------------------- */ 1403ecd7789bSchristos /* Function: ipf_p_rpcb_fixlen */ 1404ecd7789bSchristos /* Returns: (void) */ 1405ecd7789bSchristos /* Parameters: fin(I) - pointer to packet information */ 1406ecd7789bSchristos /* len(I) - change in packet length */ 1407ecd7789bSchristos /* */ 1408ecd7789bSchristos /* Adjust various packet related lengths held in structure and packet */ 1409ecd7789bSchristos /* header fields. */ 1410ecd7789bSchristos /* -------------------------------------------------------------------- */ 1411ecd7789bSchristos static void 1412*f330e785Schristos ipf_p_rpcb_fixlen(fr_info_t *fin, int len) 1413ecd7789bSchristos { 1414ecd7789bSchristos udphdr_t *udp; 1415ecd7789bSchristos 1416ecd7789bSchristos udp = fin->fin_dp; 1417ecd7789bSchristos udp->uh_ulen = htons(ntohs(udp->uh_ulen) + len); 1418ecd7789bSchristos fin->fin_plen += len; 1419ecd7789bSchristos fin->fin_ip->ip_len = htons(fin->fin_plen); 1420ecd7789bSchristos fin->fin_dlen += len; 1421ecd7789bSchristos } 1422ecd7789bSchristos 1423ecd7789bSchristos #undef B 1424