1*f330e785Schristos /*	$NetBSD: ip_rpcb_pxy.c,v 1.2 2012/03/23 20:39:50 christos Exp $	*/
2ecd7789bSchristos 
3ecd7789bSchristos /*
4ecd7789bSchristos  * Copyright (C) 2002-2003 by Ryan Beasley <ryanb@goddamnbastard.org>
5ecd7789bSchristos  *
6ecd7789bSchristos  * See the IPFILTER.LICENCE file for details on licencing.
7ecd7789bSchristos  */
8ecd7789bSchristos /*
9ecd7789bSchristos  * Overview:
10ecd7789bSchristos  *   This is an in-kernel application proxy for Sun's RPCBIND (nee portmap)
11ecd7789bSchristos  *   protocol as defined in RFC1833.  It is far from complete, mostly
12ecd7789bSchristos  *   lacking in less-likely corner cases, but it's definitely functional.
13ecd7789bSchristos  *
14ecd7789bSchristos  *   Invocation:
15ecd7789bSchristos  *     rdr <int> <e_ip>/32 port <e_p> -> <i_ip> port <i_p> udp proxy rpcbu
16ecd7789bSchristos  *
17ecd7789bSchristos  *   If the host running IP Filter is the same as the RPC server, it's
18ecd7789bSchristos  *   perfectly legal for both the internal and external addresses and ports
19ecd7789bSchristos  *   to match.
20ecd7789bSchristos  *
21ecd7789bSchristos  *   When triggered by appropriate IP NAT rules, this proxy works by
22ecd7789bSchristos  *   examining data contained in received packets.  Requests and replies are
23ecd7789bSchristos  *   modified, NAT and state table entries created, etc., as necessary.
24ecd7789bSchristos  */
25ecd7789bSchristos /*
26ecd7789bSchristos  * TODO / NOTES
27ecd7789bSchristos  *
28ecd7789bSchristos  *   o Must implement locking to protect proxy session data.
29ecd7789bSchristos  *   o Fragmentation isn't supported.
30ecd7789bSchristos  *   o Only supports UDP.
31ecd7789bSchristos  *   o Doesn't support multiple RPC records in a single request.
32ecd7789bSchristos  *   o Errors should be more fine-grained.  (e.g., malloc failure vs.
33ecd7789bSchristos  *     illegal RPCB request / reply)
34ecd7789bSchristos  *   o Even with the limit on the total amount of recorded transactions,
35ecd7789bSchristos  *     should there be a timeout on transaction removal?
36ecd7789bSchristos  *   o There is a potential collision between cloning, wildcard NAT and
37ecd7789bSchristos  *     state entries.  There should be an appr_getport routine for
38ecd7789bSchristos  *     to avoid this.
39ecd7789bSchristos  *   o The enclosed hack of STREAMS support is pretty sick and most likely
40ecd7789bSchristos  *     broken.
41ecd7789bSchristos  *
42*f330e785Schristos  *	Id: ip_rpcb_pxy.c,v 2.47 2009/03/01 12:41:26 darrenr Exp
43ecd7789bSchristos  */
44*f330e785Schristos 
45*f330e785Schristos #include <sys/cdefs.h>
46*f330e785Schristos __KERNEL_RCSID(1, "$NetBSD: ip_rpcb_pxy.c,v 1.2 2012/03/23 20:39:50 christos Exp $");
47*f330e785Schristos 
48ecd7789bSchristos #define	IPF_RPCB_PROXY
49ecd7789bSchristos 
50ecd7789bSchristos /*
51ecd7789bSchristos  * Function prototypes
52ecd7789bSchristos  */
53*f330e785Schristos void	ipf_p_rpcb_main_load(void);
54*f330e785Schristos void	ipf_p_rpcb_main_unload(void);
55*f330e785Schristos int	ipf_p_rpcb_new(void *, fr_info_t *, ap_session_t *, nat_t *);
56*f330e785Schristos void	ipf_p_rpcb_del(ipf_main_softc_t *, ap_session_t *);
57*f330e785Schristos int	ipf_p_rpcb_in(void *, fr_info_t *, ap_session_t *, nat_t *);
58*f330e785Schristos int	ipf_p_rpcb_out(void *, fr_info_t *, ap_session_t *, nat_t *);
59ecd7789bSchristos 
60*f330e785Schristos static void	ipf_p_rpcb_flush(rpcb_session_t *);
61*f330e785Schristos static int	ipf_p_rpcb_decodereq(fr_info_t *, nat_t *,
62*f330e785Schristos 	rpcb_session_t *, rpc_msg_t *);
63*f330e785Schristos static int	ipf_p_rpcb_skipauth(rpc_msg_t *, xdr_auth_t *, u_32_t **);
64*f330e785Schristos static int	ipf_p_rpcb_insert(rpcb_session_t *, rpcb_xact_t *);
65*f330e785Schristos static int	ipf_p_rpcb_xdrrpcb(rpc_msg_t *, u_32_t *, rpcb_args_t *);
66*f330e785Schristos static int	ipf_p_rpcb_getuaddr(rpc_msg_t *, xdr_uaddr_t *,
67*f330e785Schristos 	u_32_t **);
68*f330e785Schristos static u_int	ipf_p_rpcb_atoi(char *);
69*f330e785Schristos static int	ipf_p_rpcb_modreq(fr_info_t *, nat_t *, rpc_msg_t *,
70*f330e785Schristos 	mb_t *, u_int);
71*f330e785Schristos static int	ipf_p_rpcb_decoderep(fr_info_t *, nat_t *,
72*f330e785Schristos 	rpcb_session_t *, rpc_msg_t *, rpcb_xact_t **);
73*f330e785Schristos static rpcb_xact_t *	ipf_p_rpcb_lookup(rpcb_session_t *, u_32_t);
74*f330e785Schristos static void	ipf_p_rpcb_deref(rpcb_session_t *, rpcb_xact_t *);
75*f330e785Schristos static int	ipf_p_rpcb_getproto(rpc_msg_t *, xdr_proto_t *,
76*f330e785Schristos 	u_32_t **);
77*f330e785Schristos static int	ipf_p_rpcb_getnat(fr_info_t *, nat_t *, u_int, u_int);
78*f330e785Schristos static int	ipf_p_rpcb_modv3(fr_info_t *, nat_t *, rpc_msg_t *,
79*f330e785Schristos 	mb_t *, u_int);
80*f330e785Schristos static int	ipf_p_rpcb_modv4(fr_info_t *, nat_t *, rpc_msg_t *,
81*f330e785Schristos 	mb_t *, u_int);
82*f330e785Schristos static void     ipf_p_rpcb_fixlen(fr_info_t *, int);
83ecd7789bSchristos 
84ecd7789bSchristos /*
85ecd7789bSchristos  * Global variables
86ecd7789bSchristos  */
87ecd7789bSchristos static	frentry_t	rpcbfr;	/* Skeleton rule for reference by entities
88ecd7789bSchristos 				   this proxy creates. */
89ecd7789bSchristos static	int	rpcbcnt;	/* Upper bound of allocated RPCB sessions. */
90ecd7789bSchristos 				/* XXX rpcbcnt still requires locking. */
91ecd7789bSchristos 
92ecd7789bSchristos static	int	rpcb_proxy_init = 0;
93ecd7789bSchristos 
94ecd7789bSchristos 
95ecd7789bSchristos /*
96ecd7789bSchristos  * Since rpc_msg contains only pointers, one should use this macro as a
97ecd7789bSchristos  * handy way to get to the goods.  (In case you're wondering about the name,
98ecd7789bSchristos  * this started as BYTEREF -> BREF -> B.)
99ecd7789bSchristos  */
100ecd7789bSchristos #define	B(r)	(u_32_t)ntohl(*(r))
101ecd7789bSchristos 
102ecd7789bSchristos /*
103ecd7789bSchristos  * Public subroutines
104ecd7789bSchristos  */
105ecd7789bSchristos 
106ecd7789bSchristos /* -------------------------------------------------------------------- */
107ecd7789bSchristos /* Function:    ipf_p_rpcb_main_load                                    */
108ecd7789bSchristos /* Returns:     void                                                    */
109ecd7789bSchristos /* Parameters:  (void)                                                  */
110ecd7789bSchristos /*                                                                      */
111ecd7789bSchristos /* Initialize the filter rule entry and session limiter.                */
112ecd7789bSchristos /* -------------------------------------------------------------------- */
113ecd7789bSchristos void
114*f330e785Schristos ipf_p_rpcb_main_load(void)
115ecd7789bSchristos {
116ecd7789bSchristos 	rpcbcnt = 0;
117ecd7789bSchristos 
118ecd7789bSchristos 	bzero((char *)&rpcbfr, sizeof(rpcbfr));
119ecd7789bSchristos 	rpcbfr.fr_ref = 1;
120ecd7789bSchristos 	rpcbfr.fr_flags = FR_PASS|FR_QUICK|FR_KEEPSTATE;
121ecd7789bSchristos 	MUTEX_INIT(&rpcbfr.fr_lock, "ipf Sun RPCB proxy rule lock");
122ecd7789bSchristos 	rpcb_proxy_init = 1;
123ecd7789bSchristos }
124ecd7789bSchristos 
125ecd7789bSchristos /* -------------------------------------------------------------------- */
126ecd7789bSchristos /* Function:    ipf_p_rpcb_main_unload                                  */
127ecd7789bSchristos /* Returns:     void                                                    */
128ecd7789bSchristos /* Parameters:  (void)                                                  */
129ecd7789bSchristos /*                                                                      */
130ecd7789bSchristos /* Destroy rpcbfr's mutex to avoid a lock leak.                         */
131ecd7789bSchristos /* -------------------------------------------------------------------- */
132ecd7789bSchristos void
133*f330e785Schristos ipf_p_rpcb_main_unload(void)
134ecd7789bSchristos {
135ecd7789bSchristos 	if (rpcb_proxy_init == 1) {
136ecd7789bSchristos 		MUTEX_DESTROY(&rpcbfr.fr_lock);
137ecd7789bSchristos 		rpcb_proxy_init = 0;
138ecd7789bSchristos 	}
139ecd7789bSchristos }
140ecd7789bSchristos 
141ecd7789bSchristos /* --------------------------------------------------------------------	*/
142ecd7789bSchristos /* Function:	ipf_p_rpcb_new						*/
143ecd7789bSchristos /* Returns:	int - -1 == failure, 0 == success			*/
144ecd7789bSchristos /* Parameters:	fin(I)	- pointer to packet information			*/
145ecd7789bSchristos /*		aps(I)	- pointer to proxy session structure		*/
146ecd7789bSchristos /*		nat(I)	- pointer to NAT session structure		*/
147ecd7789bSchristos /*									*/
148ecd7789bSchristos /* Allocate resources for per-session proxy structures.			*/
149ecd7789bSchristos /* --------------------------------------------------------------------	*/
150ecd7789bSchristos int
151*f330e785Schristos ipf_p_rpcb_new(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
152ecd7789bSchristos {
153ecd7789bSchristos 	rpcb_session_t *rs;
154ecd7789bSchristos 
155ecd7789bSchristos 	fin = fin;	/* LINT */
156ecd7789bSchristos 	nat = nat;	/* LINT */
157ecd7789bSchristos 
158ecd7789bSchristos 	KMALLOC(rs, rpcb_session_t *);
159ecd7789bSchristos 	if (rs == NULL)
160ecd7789bSchristos 		return(-1);
161ecd7789bSchristos 
162ecd7789bSchristos 	bzero((char *)rs, sizeof(*rs));
163ecd7789bSchristos 	MUTEX_INIT(&rs->rs_rxlock, "ipf Sun RPCB proxy session lock");
164ecd7789bSchristos 
165ecd7789bSchristos 	aps->aps_data = rs;
166ecd7789bSchristos 
167ecd7789bSchristos 	return(0);
168ecd7789bSchristos }
169ecd7789bSchristos 
170ecd7789bSchristos /* --------------------------------------------------------------------	*/
171ecd7789bSchristos /* Function:	ipf_p_rpcb_del						*/
172ecd7789bSchristos /* Returns:	void							*/
173ecd7789bSchristos /* Parameters:	aps(I)	- pointer to proxy session structure		*/
174ecd7789bSchristos /*									*/
175ecd7789bSchristos /* Free up a session's list of RPCB requests.				*/
176ecd7789bSchristos /* --------------------------------------------------------------------	*/
177ecd7789bSchristos void
178*f330e785Schristos ipf_p_rpcb_del(ipf_main_softc_t *softc, ap_session_t *aps)
179ecd7789bSchristos {
180ecd7789bSchristos 	rpcb_session_t *rs;
181ecd7789bSchristos 	rs = (rpcb_session_t *)aps->aps_data;
182ecd7789bSchristos 
183ecd7789bSchristos 	MUTEX_ENTER(&rs->rs_rxlock);
184ecd7789bSchristos 	ipf_p_rpcb_flush(rs);
185ecd7789bSchristos 	MUTEX_EXIT(&rs->rs_rxlock);
186ecd7789bSchristos 	MUTEX_DESTROY(&rs->rs_rxlock);
187ecd7789bSchristos }
188ecd7789bSchristos 
189ecd7789bSchristos /* --------------------------------------------------------------------	*/
190ecd7789bSchristos /* Function:	ipf_p_rpcb_in						*/
191ecd7789bSchristos /* Returns:	int - APR_ERR(1) == drop the packet, 			*/
192ecd7789bSchristos /*		      APR_ERR(2) == kill the proxy session,		*/
193ecd7789bSchristos /*		      else change in packet length (in bytes)		*/
194ecd7789bSchristos /* Parameters:	fin(I)	- pointer to packet information			*/
195ecd7789bSchristos /*		ip(I)	- pointer to packet header			*/
196ecd7789bSchristos /*		aps(I)	- pointer to proxy session structure		*/
197ecd7789bSchristos /*		nat(I)	- pointer to NAT session structure		*/
198ecd7789bSchristos /*									*/
199ecd7789bSchristos /* Given a presumed RPCB request, perform some minor tests and pass off */
200ecd7789bSchristos /* for decoding.  Also pass packet off for a rewrite if necessary.	*/
201ecd7789bSchristos /* --------------------------------------------------------------------	*/
202ecd7789bSchristos int
203*f330e785Schristos ipf_p_rpcb_in(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
204ecd7789bSchristos {
205ecd7789bSchristos 	rpc_msg_t rpcmsg, *rm;
206ecd7789bSchristos 	rpcb_session_t *rs;
207ecd7789bSchristos 	u_int off, dlen;
208ecd7789bSchristos 	mb_t *m;
209ecd7789bSchristos 	int rv;
210ecd7789bSchristos 
211ecd7789bSchristos 	/* Disallow fragmented or illegally short packets. */
212ecd7789bSchristos 	if ((fin->fin_flx & (FI_FRAG|FI_SHORT)) != 0)
213ecd7789bSchristos 		return(APR_ERR(1));
214ecd7789bSchristos 
215ecd7789bSchristos 	/* Perform basic variable initialization. */
216ecd7789bSchristos 	rs = (rpcb_session_t *)aps->aps_data;
217ecd7789bSchristos 
218ecd7789bSchristos 	m = fin->fin_m;
219ecd7789bSchristos 	off = (char *)fin->fin_dp - (char *)fin->fin_ip;
220ecd7789bSchristos 	off += sizeof(udphdr_t) + fin->fin_ipoff;
221ecd7789bSchristos 	dlen = fin->fin_dlen - sizeof(udphdr_t);
222ecd7789bSchristos 
223ecd7789bSchristos 	/* Disallow packets outside legal range for supported requests. */
224ecd7789bSchristos 	if ((dlen < RPCB_REQMIN) || (dlen > RPCB_REQMAX))
225ecd7789bSchristos 		return(APR_ERR(1));
226ecd7789bSchristos 
227ecd7789bSchristos 	/* Copy packet over to convenience buffer. */
228ecd7789bSchristos 	rm = &rpcmsg;
229ecd7789bSchristos 	bzero((char *)rm, sizeof(*rm));
230*f330e785Schristos 	COPYDATA(m, off, dlen, (void *)&rm->rm_msgbuf);
231ecd7789bSchristos 	rm->rm_buflen = dlen;
232ecd7789bSchristos 
233ecd7789bSchristos 	/* Send off to decode request. */
234ecd7789bSchristos 	rv = ipf_p_rpcb_decodereq(fin, nat, rs, rm);
235ecd7789bSchristos 
236ecd7789bSchristos 	switch(rv)
237ecd7789bSchristos 	{
238ecd7789bSchristos 	case -1:
239ecd7789bSchristos 		return(APR_ERR(1));
240ecd7789bSchristos 		/*NOTREACHED*/
241ecd7789bSchristos 		break;
242ecd7789bSchristos 	case 0:
243ecd7789bSchristos 		break;
244ecd7789bSchristos 	case 1:
245ecd7789bSchristos 		rv = ipf_p_rpcb_modreq(fin, nat, rm, m, off);
246ecd7789bSchristos 		break;
247ecd7789bSchristos 	default:
248ecd7789bSchristos 		/*CONSTANTCONDITION*/
249ecd7789bSchristos 		IPF_PANIC(1, ("illegal rv %d (ipf_p_rpcb_req)", rv));
250ecd7789bSchristos 	}
251ecd7789bSchristos 
252ecd7789bSchristos 	return(rv);
253ecd7789bSchristos }
254ecd7789bSchristos 
255ecd7789bSchristos /* --------------------------------------------------------------------	*/
256ecd7789bSchristos /* Function:	ipf_p_rpcb_out						*/
257ecd7789bSchristos /* Returns:	int - APR_ERR(1) == drop the packet, 			*/
258ecd7789bSchristos /*		      APR_ERR(2) == kill the proxy session,		*/
259ecd7789bSchristos /*		      else change in packet length (in bytes)		*/
260ecd7789bSchristos /* Parameters:	fin(I)	- pointer to packet information			*/
261ecd7789bSchristos /*		ip(I)	- pointer to packet header			*/
262ecd7789bSchristos /*		aps(I)	- pointer to proxy session structure		*/
263ecd7789bSchristos /*		nat(I)	- pointer to NAT session structure		*/
264ecd7789bSchristos /*									*/
265ecd7789bSchristos /* Given a presumed RPCB reply, perform some minor tests and pass off	*/
266ecd7789bSchristos /* for decoding.  If the message indicates a successful request with	*/
267ecd7789bSchristos /* valid addressing information, create NAT and state structures to	*/
268ecd7789bSchristos /* allow direct communication between RPC client and server.		*/
269ecd7789bSchristos /* --------------------------------------------------------------------	*/
270ecd7789bSchristos int
271*f330e785Schristos ipf_p_rpcb_out(void *arg, fr_info_t *fin, ap_session_t *aps, nat_t *nat)
272ecd7789bSchristos {
273ecd7789bSchristos 	rpc_msg_t rpcmsg, *rm;
274ecd7789bSchristos 	rpcb_session_t *rs;
275ecd7789bSchristos 	rpcb_xact_t *rx;
276ecd7789bSchristos 	u_int off, dlen;
277ecd7789bSchristos 	int rv, diff;
278ecd7789bSchristos 	mb_t *m;
279ecd7789bSchristos 
280*f330e785Schristos 	rx = NULL;	/* XXX gcc */
281*f330e785Schristos 
282ecd7789bSchristos 	/* Disallow fragmented or illegally short packets. */
283ecd7789bSchristos 	if ((fin->fin_flx & (FI_FRAG|FI_SHORT)) != 0)
284ecd7789bSchristos 		return(APR_ERR(1));
285ecd7789bSchristos 
286ecd7789bSchristos 	/* Perform basic variable initialization. */
287ecd7789bSchristos 	rs = (rpcb_session_t *)aps->aps_data;
288ecd7789bSchristos 	rx = NULL;
289ecd7789bSchristos 
290ecd7789bSchristos 	m = fin->fin_m;
291ecd7789bSchristos 	off = (char *)fin->fin_dp - (char *)fin->fin_ip;
292ecd7789bSchristos 	off += sizeof(udphdr_t) + fin->fin_ipoff;
293ecd7789bSchristos 	dlen = fin->fin_dlen - sizeof(udphdr_t);
294ecd7789bSchristos 	diff = 0;
295ecd7789bSchristos 
296ecd7789bSchristos 	/* Disallow packets outside legal range for supported requests. */
297ecd7789bSchristos 	if ((dlen < RPCB_REPMIN) || (dlen > RPCB_REPMAX))
298ecd7789bSchristos 		return(APR_ERR(1));
299ecd7789bSchristos 
300ecd7789bSchristos 	/* Copy packet over to convenience buffer. */
301ecd7789bSchristos 	rm = &rpcmsg;
302ecd7789bSchristos 	bzero((char *)rm, sizeof(*rm));
303*f330e785Schristos 	COPYDATA(m, off, dlen, (void *)&rm->rm_msgbuf);
304ecd7789bSchristos 	rm->rm_buflen = dlen;
305ecd7789bSchristos 
306ecd7789bSchristos 	rx = NULL;		/* XXX gcc */
307ecd7789bSchristos 
308ecd7789bSchristos 	/* Send off to decode reply. */
309ecd7789bSchristos 	rv = ipf_p_rpcb_decoderep(fin, nat, rs, rm, &rx);
310ecd7789bSchristos 
311ecd7789bSchristos 	switch(rv)
312ecd7789bSchristos 	{
313ecd7789bSchristos 	case -1: /* Bad packet */
314ecd7789bSchristos                 if (rx != NULL) {
315ecd7789bSchristos                         MUTEX_ENTER(&rs->rs_rxlock);
316ecd7789bSchristos                         ipf_p_rpcb_deref(rs, rx);
317ecd7789bSchristos                         MUTEX_EXIT(&rs->rs_rxlock);
318ecd7789bSchristos                 }
319ecd7789bSchristos 		return(APR_ERR(1));
320ecd7789bSchristos 		/*NOTREACHED*/
321ecd7789bSchristos 		break;
322ecd7789bSchristos 	case  0: /* Negative reply / request rejected */
323ecd7789bSchristos 		break;
324ecd7789bSchristos 	case  1: /* Positive reply */
325ecd7789bSchristos 		/*
326ecd7789bSchristos 		 * With the IP address embedded in a GETADDR(LIST) reply,
327ecd7789bSchristos 		 * we'll need to rewrite the packet in the very possible
328ecd7789bSchristos 		 * event that the internal & external addresses aren't the
329ecd7789bSchristos 		 * same.  (i.e., this box is either a router or rpcbind
330ecd7789bSchristos 		 * only listens on loopback.)
331ecd7789bSchristos 		 */
332ecd7789bSchristos 		if (nat->nat_odstaddr != nat->nat_ndstaddr) {
333ecd7789bSchristos 			if (rx->rx_type == RPCB_RES_STRING)
334ecd7789bSchristos 				diff = ipf_p_rpcb_modv3(fin, nat, rm, m, off);
335ecd7789bSchristos 			else if (rx->rx_type == RPCB_RES_LIST)
336ecd7789bSchristos 				diff = ipf_p_rpcb_modv4(fin, nat, rm, m, off);
337ecd7789bSchristos 		}
338ecd7789bSchristos 		break;
339ecd7789bSchristos 	default:
340ecd7789bSchristos 		/*CONSTANTCONDITION*/
341ecd7789bSchristos 		IPF_PANIC(1, ("illegal rv %d (ipf_p_rpcb_decoderep)", rv));
342ecd7789bSchristos 	}
343ecd7789bSchristos 
344ecd7789bSchristos 	if (rx != NULL) {
345ecd7789bSchristos                 MUTEX_ENTER(&rs->rs_rxlock);
346ecd7789bSchristos                 /* XXX Gross hack - I'm overloading the reference
347ecd7789bSchristos                  * counter to deal with both threads and retransmitted
348ecd7789bSchristos                  * requests.  One deref signals that this thread is
349ecd7789bSchristos                  * finished with rx, and the other signals that we've
350ecd7789bSchristos                  * processed its reply.
351ecd7789bSchristos                  */
352ecd7789bSchristos                 ipf_p_rpcb_deref(rs, rx);
353ecd7789bSchristos                 ipf_p_rpcb_deref(rs, rx);
354ecd7789bSchristos                 MUTEX_EXIT(&rs->rs_rxlock);
355ecd7789bSchristos 	}
356ecd7789bSchristos 
357ecd7789bSchristos 	return(diff);
358ecd7789bSchristos }
359ecd7789bSchristos 
360ecd7789bSchristos /*
361ecd7789bSchristos  * Private support subroutines
362ecd7789bSchristos  */
363ecd7789bSchristos 
364ecd7789bSchristos /* --------------------------------------------------------------------	*/
365ecd7789bSchristos /* Function:	ipf_p_rpcb_flush						*/
366ecd7789bSchristos /* Returns:	void							*/
367ecd7789bSchristos /* Parameters:	rs(I)	- pointer to RPCB session structure		*/
368ecd7789bSchristos /*									*/
369ecd7789bSchristos /* Simply flushes the list of outstanding transactions, if any.		*/
370ecd7789bSchristos /* --------------------------------------------------------------------	*/
371ecd7789bSchristos static void
372*f330e785Schristos ipf_p_rpcb_flush(rpcb_session_t *rs)
373ecd7789bSchristos {
374ecd7789bSchristos 	rpcb_xact_t *r1, *r2;
375ecd7789bSchristos 
376ecd7789bSchristos 	r1 = rs->rs_rxlist;
377ecd7789bSchristos 	if (r1 == NULL)
378ecd7789bSchristos 		return;
379ecd7789bSchristos 
380ecd7789bSchristos 	while (r1 != NULL) {
381ecd7789bSchristos 		r2 = r1;
382ecd7789bSchristos 		r1 = r1->rx_next;
383ecd7789bSchristos 		KFREE(r2);
384ecd7789bSchristos 	}
385ecd7789bSchristos }
386ecd7789bSchristos 
387ecd7789bSchristos /* --------------------------------------------------------------------	*/
388ecd7789bSchristos /* Function:	ipf_p_rpcb_decodereq					*/
389ecd7789bSchristos /* Returns:	int - -1 == bad request or critical failure,		*/
390ecd7789bSchristos /*		       0 == request successfully decoded,		*/
391ecd7789bSchristos /*		       1 == request successfully decoded; requires	*/
392ecd7789bSchristos /*			    address rewrite/modification		*/
393ecd7789bSchristos /* Parameters:	fin(I)	- pointer to packet information			*/
394ecd7789bSchristos /*		nat(I)	- pointer to NAT session structure		*/
395ecd7789bSchristos /*		rs(I)	- pointer to RPCB session structure		*/
396ecd7789bSchristos /*		rm(I)	- pointer to RPC message structure		*/
397ecd7789bSchristos /*									*/
398ecd7789bSchristos /* Take a presumed RPCB request, decode it, and store the results in	*/
399ecd7789bSchristos /* the transaction list.  If the internal target address needs to be	*/
400ecd7789bSchristos /* modified, store its location in ptr.					*/
401ecd7789bSchristos /* WARNING:  It's the responsibility of the caller to make sure there	*/
402ecd7789bSchristos /* is enough room in rs_buf for the basic RPC message "preamble".	*/
403ecd7789bSchristos /* --------------------------------------------------------------------	*/
404ecd7789bSchristos static int
405*f330e785Schristos ipf_p_rpcb_decodereq(fr_info_t *fin, nat_t *nat, rpcb_session_t *rs,
406*f330e785Schristos     rpc_msg_t *rm)
407ecd7789bSchristos {
408ecd7789bSchristos 	rpcb_args_t *ra;
409ecd7789bSchristos 	u_32_t xdr, *p;
410ecd7789bSchristos 	rpc_call_t *rc;
411ecd7789bSchristos 	rpcb_xact_t rx;
412ecd7789bSchristos 	int mod;
413ecd7789bSchristos 
414ecd7789bSchristos 	p = (u_32_t *)rm->rm_msgbuf;
415ecd7789bSchristos 	mod = 0;
416ecd7789bSchristos 
417ecd7789bSchristos 	bzero((char *)&rx, sizeof(rx));
418ecd7789bSchristos 	rc = &rm->rm_call;
419ecd7789bSchristos 
420ecd7789bSchristos 	rm->rm_xid = p;
421ecd7789bSchristos 	rx.rx_xid = B(p++);	/* Record this message's XID. */
422ecd7789bSchristos 
423ecd7789bSchristos 	/* Parse out and test the RPC header. */
424ecd7789bSchristos 	if ((B(p++) != RPCB_CALL) ||
425ecd7789bSchristos 	    (B(p++) != RPCB_MSG_VERSION) ||
426ecd7789bSchristos 	    (B(p++) != RPCB_PROG))
427ecd7789bSchristos 		return(-1);
428ecd7789bSchristos 
429ecd7789bSchristos 	/* Record the RPCB version and procedure. */
430ecd7789bSchristos 	rc->rc_vers = p++;
431ecd7789bSchristos 	rc->rc_proc = p++;
432ecd7789bSchristos 
433ecd7789bSchristos 	/* Bypass RPC authentication stuff. */
434ecd7789bSchristos 	if (ipf_p_rpcb_skipauth(rm, &rc->rc_authcred, &p) != 0)
435ecd7789bSchristos 		return(-1);
436ecd7789bSchristos 	if (ipf_p_rpcb_skipauth(rm, &rc->rc_authverf, &p) != 0)
437ecd7789bSchristos 		return(-1);
438ecd7789bSchristos 
439ecd7789bSchristos 	/* Compare RPCB version and procedure numbers. */
440ecd7789bSchristos 	switch(B(rc->rc_vers))
441ecd7789bSchristos 	{
442ecd7789bSchristos 	case 2:
443ecd7789bSchristos 		/* This proxy only supports PMAP_GETPORT. */
444ecd7789bSchristos 		if (B(rc->rc_proc) != RPCB_GETPORT)
445ecd7789bSchristos 			return(-1);
446ecd7789bSchristos 
447ecd7789bSchristos 		/* Portmap requests contain four 4 byte parameters. */
448ecd7789bSchristos 		if (RPCB_BUF_EQ(rm, p, 16) == 0)
449ecd7789bSchristos 			return(-1);
450ecd7789bSchristos 
451ecd7789bSchristos 		p += 2; /* Skip requested program and version numbers. */
452ecd7789bSchristos 
453ecd7789bSchristos 		/* Sanity check the requested protocol. */
454ecd7789bSchristos 		xdr = B(p);
455ecd7789bSchristos 		if (!(xdr == IPPROTO_UDP || xdr == IPPROTO_TCP))
456ecd7789bSchristos 			return(-1);
457ecd7789bSchristos 
458ecd7789bSchristos 		rx.rx_type = RPCB_RES_PMAP;
459ecd7789bSchristos 		rx.rx_proto = xdr;
460ecd7789bSchristos 		break;
461ecd7789bSchristos 	case 3:
462ecd7789bSchristos 	case 4:
463ecd7789bSchristos 		/* GETADDRLIST is exclusive to v4; GETADDR for v3 & v4 */
464ecd7789bSchristos 		switch(B(rc->rc_proc))
465ecd7789bSchristos 		{
466ecd7789bSchristos 		case RPCB_GETADDR:
467ecd7789bSchristos 			rx.rx_type = RPCB_RES_STRING;
468ecd7789bSchristos 			rx.rx_proto = (u_int)fin->fin_p;
469ecd7789bSchristos 			break;
470ecd7789bSchristos 		case RPCB_GETADDRLIST:
471ecd7789bSchristos 			if (B(rc->rc_vers) != 4)
472ecd7789bSchristos 				return(-1);
473ecd7789bSchristos 			rx.rx_type = RPCB_RES_LIST;
474ecd7789bSchristos 			break;
475ecd7789bSchristos 		default:
476ecd7789bSchristos 			return(-1);
477ecd7789bSchristos 		}
478ecd7789bSchristos 
479ecd7789bSchristos 		ra = &rc->rc_rpcbargs;
480ecd7789bSchristos 
481ecd7789bSchristos 		/* Decode the 'struct rpcb' request. */
482ecd7789bSchristos 		if (ipf_p_rpcb_xdrrpcb(rm, p, ra) != 0)
483ecd7789bSchristos 			return(-1);
484ecd7789bSchristos 
485ecd7789bSchristos 		/* Are the target address & port valid? */
486ecd7789bSchristos 		if ((ra->ra_maddr.xu_ip != nat->nat_ndstaddr) ||
487ecd7789bSchristos 		    (ra->ra_maddr.xu_port != nat->nat_ndport))
488ecd7789bSchristos 		    	return(-1);
489ecd7789bSchristos 
490ecd7789bSchristos 		/* Do we need to rewrite this packet? */
491ecd7789bSchristos 		if ((nat->nat_ndstaddr != nat->nat_odstaddr) ||
492ecd7789bSchristos 		    (nat->nat_ndport != nat->nat_odport))
493ecd7789bSchristos 		    	mod = 1;
494ecd7789bSchristos 		break;
495ecd7789bSchristos 	default:
496ecd7789bSchristos 		return(-1);
497ecd7789bSchristos 	}
498ecd7789bSchristos 
499ecd7789bSchristos         MUTEX_ENTER(&rs->rs_rxlock);
500ecd7789bSchristos 	if (ipf_p_rpcb_insert(rs, &rx) != 0) {
501ecd7789bSchristos                 MUTEX_EXIT(&rs->rs_rxlock);
502ecd7789bSchristos 		return(-1);
503ecd7789bSchristos 	}
504ecd7789bSchristos         MUTEX_EXIT(&rs->rs_rxlock);
505ecd7789bSchristos 
506ecd7789bSchristos 	return(mod);
507ecd7789bSchristos }
508ecd7789bSchristos 
509ecd7789bSchristos /* --------------------------------------------------------------------	*/
510ecd7789bSchristos /* Function:	ipf_p_rpcb_skipauth					*/
511ecd7789bSchristos /* Returns:	int -- -1 == illegal auth parameters (lengths)		*/
512ecd7789bSchristos /*			0 == valid parameters, pointer advanced		*/
513ecd7789bSchristos /* Parameters:	rm(I)	- pointer to RPC message structure		*/
514ecd7789bSchristos /*		auth(I)	- pointer to RPC auth structure			*/
515ecd7789bSchristos /*		buf(IO)	- pointer to location within convenience buffer	*/
516ecd7789bSchristos /*									*/
517ecd7789bSchristos /* Record auth data length & location of auth data, then advance past	*/
518ecd7789bSchristos /* it.									*/
519ecd7789bSchristos /* --------------------------------------------------------------------	*/
520ecd7789bSchristos static int
521*f330e785Schristos ipf_p_rpcb_skipauth(rpc_msg_t *rm, xdr_auth_t *auth, u_32_t **buf)
522ecd7789bSchristos {
523ecd7789bSchristos 	u_32_t *p, xdr;
524ecd7789bSchristos 
525ecd7789bSchristos 	p = *buf;
526ecd7789bSchristos 
527ecd7789bSchristos 	/* Make sure we have enough space for expected fixed auth parms. */
528ecd7789bSchristos 	if (RPCB_BUF_GEQ(rm, p, 8) == 0)
529ecd7789bSchristos 		return(-1);
530ecd7789bSchristos 
531ecd7789bSchristos 	p++; /* We don't care about auth_flavor. */
532ecd7789bSchristos 
533ecd7789bSchristos 	auth->xa_string.xs_len = p;
534ecd7789bSchristos 	xdr = B(p++);		/* Length of auth_data */
535ecd7789bSchristos 
536ecd7789bSchristos 	/* Test for absurdity / illegality of auth_data length. */
537ecd7789bSchristos 	if ((XDRALIGN(xdr) < xdr) || (RPCB_BUF_GEQ(rm, p, XDRALIGN(xdr)) == 0))
538ecd7789bSchristos 		return(-1);
539ecd7789bSchristos 
540ecd7789bSchristos 	auth->xa_string.xs_str = (char *)p;
541ecd7789bSchristos 
542ecd7789bSchristos 	p += XDRALIGN(xdr);	/* Advance our location. */
543ecd7789bSchristos 
544ecd7789bSchristos 	*buf = (u_32_t *)p;
545ecd7789bSchristos 
546ecd7789bSchristos 	return(0);
547ecd7789bSchristos }
548ecd7789bSchristos 
549ecd7789bSchristos /* --------------------------------------------------------------------	*/
550ecd7789bSchristos /* Function:	ipf_p_rpcb_insert					*/
551ecd7789bSchristos /* Returns:	int -- -1 == list insertion failed,			*/
552ecd7789bSchristos /*			0 == item successfully added			*/
553ecd7789bSchristos /* Parameters:	rs(I)	- pointer to RPCB session structure		*/
554ecd7789bSchristos /*		rx(I)	- pointer to RPCB transaction structure		*/
555ecd7789bSchristos /* --------------------------------------------------------------------	*/
556ecd7789bSchristos static int
557*f330e785Schristos ipf_p_rpcb_insert(rpcb_session_t *rs, rpcb_xact_t *rx)
558ecd7789bSchristos {
559ecd7789bSchristos 	rpcb_xact_t *rxp;
560ecd7789bSchristos 
561ecd7789bSchristos 	rxp = ipf_p_rpcb_lookup(rs, rx->rx_xid);
562ecd7789bSchristos 	if (rxp != NULL) {
563ecd7789bSchristos                 ++rxp->rx_ref;
564ecd7789bSchristos 		return(0);
565ecd7789bSchristos         }
566ecd7789bSchristos 
567ecd7789bSchristos 	if (rpcbcnt == RPCB_MAXREQS)
568ecd7789bSchristos 		return(-1);
569ecd7789bSchristos 
570ecd7789bSchristos 	KMALLOC(rxp, rpcb_xact_t *);
571ecd7789bSchristos 	if (rxp == NULL)
572ecd7789bSchristos 		return(-1);
573ecd7789bSchristos 
574ecd7789bSchristos 	bcopy((char *)rx, (char *)rxp, sizeof(*rx));
575ecd7789bSchristos 
576ecd7789bSchristos 	if (rs->rs_rxlist != NULL)
577ecd7789bSchristos 		rs->rs_rxlist->rx_pnext = &rxp->rx_next;
578ecd7789bSchristos 
579ecd7789bSchristos 	rxp->rx_pnext = &rs->rs_rxlist;
580ecd7789bSchristos 	rxp->rx_next = rs->rs_rxlist;
581ecd7789bSchristos 	rs->rs_rxlist = rxp;
582ecd7789bSchristos 
583ecd7789bSchristos 	rxp->rx_ref = 1;
584ecd7789bSchristos 
585ecd7789bSchristos 	++rpcbcnt;
586ecd7789bSchristos 
587ecd7789bSchristos 	return(0);
588ecd7789bSchristos }
589ecd7789bSchristos 
590ecd7789bSchristos /* --------------------------------------------------------------------	*/
591ecd7789bSchristos /* Function:	ipf_p_rpcb_xdrrpcb					*/
592ecd7789bSchristos /* Returns:	int -- -1 == failure to properly decode the request	*/
593ecd7789bSchristos /*			0 == rpcb successfully decoded			*/
594ecd7789bSchristos /* Parameters:	rs(I)	- pointer to RPCB session structure		*/
595ecd7789bSchristos /*		p(I)	- pointer to location within session buffer	*/
596ecd7789bSchristos /*		rpcb(O)	- pointer to rpcb (xdr type) structure		*/
597ecd7789bSchristos /*									*/
598ecd7789bSchristos /* Decode a XDR encoded rpcb structure and record its contents in rpcb  */
599ecd7789bSchristos /* within only the context of TCP/UDP over IP networks.			*/
600ecd7789bSchristos /* --------------------------------------------------------------------	*/
601ecd7789bSchristos static int
602*f330e785Schristos ipf_p_rpcb_xdrrpcb(rpc_msg_t *rm, u_32_t *p, rpcb_args_t *ra)
603ecd7789bSchristos {
604ecd7789bSchristos 	if (!RPCB_BUF_GEQ(rm, p, 20))
605ecd7789bSchristos 		return(-1);
606ecd7789bSchristos 
607ecd7789bSchristos 	/* Bypass target program & version. */
608ecd7789bSchristos 	p += 2;
609ecd7789bSchristos 
610ecd7789bSchristos 	/* Decode r_netid.  Must be "tcp" or "udp". */
611ecd7789bSchristos 	if (ipf_p_rpcb_getproto(rm, &ra->ra_netid, &p) != 0)
612ecd7789bSchristos 		return(-1);
613ecd7789bSchristos 
614ecd7789bSchristos 	/* Decode r_maddr. */
615ecd7789bSchristos 	if (ipf_p_rpcb_getuaddr(rm, &ra->ra_maddr, &p) != 0)
616ecd7789bSchristos 		return(-1);
617ecd7789bSchristos 
618ecd7789bSchristos 	/* Advance to r_owner and make sure it's empty. */
619ecd7789bSchristos 	if (!RPCB_BUF_EQ(rm, p, 4) || (B(p) != 0))
620ecd7789bSchristos 		return(-1);
621ecd7789bSchristos 
622ecd7789bSchristos 	return(0);
623ecd7789bSchristos }
624ecd7789bSchristos 
625ecd7789bSchristos /* --------------------------------------------------------------------	*/
626ecd7789bSchristos /* Function:	ipf_p_rpcb_getuaddr					*/
627ecd7789bSchristos /* Returns:	int -- -1 == illegal string,				*/
628ecd7789bSchristos /*			0 == string parsed; contents recorded		*/
629ecd7789bSchristos /* Parameters:	rm(I)	- pointer to RPC message structure		*/
630ecd7789bSchristos /*		xu(I)	- pointer to universal address structure	*/
631ecd7789bSchristos /*		p(IO)	- pointer to location within message buffer	*/
632ecd7789bSchristos /*									*/
633ecd7789bSchristos /* Decode the IP address / port at p and record them in xu.		*/
634ecd7789bSchristos /* --------------------------------------------------------------------	*/
635ecd7789bSchristos static int
636*f330e785Schristos ipf_p_rpcb_getuaddr(rpc_msg_t *rm, xdr_uaddr_t *xu, u_32_t **p)
637ecd7789bSchristos {
638ecd7789bSchristos 	char *c, *i, *b, *pp;
639ecd7789bSchristos 	u_int d, dd, l, t;
640ecd7789bSchristos 	char uastr[24];
641ecd7789bSchristos 
642ecd7789bSchristos 	/* Test for string length. */
643ecd7789bSchristos 	if (!RPCB_BUF_GEQ(rm, *p, 4))
644ecd7789bSchristos 		return(-1);
645ecd7789bSchristos 
646ecd7789bSchristos 	xu->xu_xslen = (*p)++;
647ecd7789bSchristos 	xu->xu_xsstr = (char *)*p;
648ecd7789bSchristos 
649ecd7789bSchristos 	/* Length check */
650ecd7789bSchristos 	l = B(xu->xu_xslen);
651ecd7789bSchristos 	if (l < 11 || l > 23 || !RPCB_BUF_GEQ(rm, *p, XDRALIGN(l)))
652ecd7789bSchristos 		return(-1);
653ecd7789bSchristos 
654ecd7789bSchristos 	/* Advance p */
655ecd7789bSchristos 	*(char **)p += XDRALIGN(l);
656ecd7789bSchristos 
657ecd7789bSchristos 	/* Copy string to local buffer & terminate C style */
658ecd7789bSchristos 	bcopy(xu->xu_xsstr, uastr, l);
659ecd7789bSchristos 	uastr[l] = '\0';
660ecd7789bSchristos 
661ecd7789bSchristos 	i = (char *)&xu->xu_ip;
662ecd7789bSchristos 	pp = (char *)&xu->xu_port;
663ecd7789bSchristos 
664ecd7789bSchristos 	/*
665ecd7789bSchristos 	 * Expected format: a.b.c.d.e.f where [a-d] correspond to bytes of
666ecd7789bSchristos 	 * an IP address and [ef] are the bytes of a L4 port.
667ecd7789bSchristos 	 */
668ecd7789bSchristos 	if (!(ISDIGIT(uastr[0]) && ISDIGIT(uastr[l-1])))
669ecd7789bSchristos 		return(-1);
670ecd7789bSchristos 	b = uastr;
671ecd7789bSchristos 	for (c = &uastr[1], d = 0, dd = 0; c < &uastr[l-1]; c++) {
672ecd7789bSchristos 		if (ISDIGIT(*c)) {
673ecd7789bSchristos 			dd = 0;
674ecd7789bSchristos 			continue;
675ecd7789bSchristos 		}
676ecd7789bSchristos 		if (*c == '.') {
677ecd7789bSchristos 			if (dd != 0)
678ecd7789bSchristos 				return(-1);
679ecd7789bSchristos 
680ecd7789bSchristos 			/* Check for ASCII byte. */
681ecd7789bSchristos 			*c = '\0';
682ecd7789bSchristos 			t = ipf_p_rpcb_atoi(b);
683ecd7789bSchristos 			if (t > 255)
684ecd7789bSchristos 				return(-1);
685ecd7789bSchristos 
686ecd7789bSchristos 			/* Aim b at beginning of the next byte. */
687ecd7789bSchristos 			b = c + 1;
688ecd7789bSchristos 
689ecd7789bSchristos 			/* Switch off IP addr vs port parsing. */
690ecd7789bSchristos 			if (d < 4)
691ecd7789bSchristos 				i[d++] = t & 0xff;
692ecd7789bSchristos 			else
693ecd7789bSchristos 				pp[d++ - 4] = t & 0xff;
694ecd7789bSchristos 
695ecd7789bSchristos 			dd = 1;
696ecd7789bSchristos 			continue;
697ecd7789bSchristos 		}
698ecd7789bSchristos 		return(-1);
699ecd7789bSchristos 	}
700ecd7789bSchristos 	if (d != 5) /* String must contain exactly 5 periods. */
701ecd7789bSchristos 		return(-1);
702ecd7789bSchristos 
703ecd7789bSchristos 	/* Handle the last byte (port low byte) */
704ecd7789bSchristos 	t = ipf_p_rpcb_atoi(b);
705ecd7789bSchristos 	if (t > 255)
706ecd7789bSchristos 		return(-1);
707ecd7789bSchristos 	pp[d - 4] = t & 0xff;
708ecd7789bSchristos 
709ecd7789bSchristos 	return(0);
710ecd7789bSchristos }
711ecd7789bSchristos 
712ecd7789bSchristos /* --------------------------------------------------------------------	*/
713ecd7789bSchristos /* Function:	ipf_p_rpcb_atoi (XXX should be generic for all proxies)	*/
714ecd7789bSchristos /* Returns:	int -- integer representation of supplied string	*/
715ecd7789bSchristos /* Parameters:	ptr(I)	- input string					*/
716ecd7789bSchristos /*									*/
717ecd7789bSchristos /* Simple version of atoi(3) ripped from ip_rcmd_pxy.c.			*/
718ecd7789bSchristos /* --------------------------------------------------------------------	*/
719ecd7789bSchristos static u_int
720*f330e785Schristos ipf_p_rpcb_atoi(char *ptr)
721ecd7789bSchristos {
722*f330e785Schristos 	char *s = ptr, c;
723*f330e785Schristos 	u_int i = 0;
724ecd7789bSchristos 
725ecd7789bSchristos 	while (((c = *s++) != '\0') && ISDIGIT(c)) {
726ecd7789bSchristos 		i *= 10;
727ecd7789bSchristos 		i += c - '0';
728ecd7789bSchristos 	}
729ecd7789bSchristos 	return i;
730ecd7789bSchristos }
731ecd7789bSchristos 
732ecd7789bSchristos /* --------------------------------------------------------------------	*/
733ecd7789bSchristos /* Function:	ipf_p_rpcb_modreq					*/
734ecd7789bSchristos /* Returns:	int -- change in datagram length			*/
735ecd7789bSchristos /*			APR_ERR(2) - critical failure			*/
736ecd7789bSchristos /* Parameters:	fin(I)	- pointer to packet information			*/
737ecd7789bSchristos /*		nat(I)	- pointer to NAT session			*/
738ecd7789bSchristos /*		rm(I)	- pointer to RPC message structure		*/
739ecd7789bSchristos /*		m(I)	- pointer to mbuf chain				*/
740ecd7789bSchristos /*		off(I)	- current offset within mbuf chain		*/
741ecd7789bSchristos /*									*/
742ecd7789bSchristos /* When external and internal addresses differ, we rewrite the former	*/
743ecd7789bSchristos /* with the latter.  (This is exclusive to protocol versions 3 & 4).	*/
744ecd7789bSchristos /* --------------------------------------------------------------------	*/
745ecd7789bSchristos static int
746*f330e785Schristos ipf_p_rpcb_modreq(fr_info_t *fin, nat_t *nat, rpc_msg_t *rm, mb_t *m, u_int off)
747ecd7789bSchristos {
748ecd7789bSchristos 	u_int len, xlen, pos, bogo;
749ecd7789bSchristos 	rpcb_args_t *ra;
750ecd7789bSchristos 	char uaddr[24];
751ecd7789bSchristos 	udphdr_t *udp;
752ecd7789bSchristos 	char *i, *p;
753ecd7789bSchristos 	int diff;
754ecd7789bSchristos 
755ecd7789bSchristos 	ra = &rm->rm_call.rc_rpcbargs;
756ecd7789bSchristos 	i = (char *)&nat->nat_odstaddr;
757ecd7789bSchristos 	p = (char *)&nat->nat_odport;
758ecd7789bSchristos 
759ecd7789bSchristos 	/* Form new string. */
760ecd7789bSchristos 	bzero(uaddr, sizeof(uaddr)); /* Just in case we need padding. */
761ecd7789bSchristos #if defined(SNPRINTF) && defined(_KERNEL)
762ecd7789bSchristos 	SNPRINTF(uaddr, sizeof(uaddr),
763ecd7789bSchristos 		       "%u.%u.%u.%u.%u.%u", i[0] & 0xff, i[1] & 0xff,
764ecd7789bSchristos 		       i[2] & 0xff, i[3] & 0xff, p[0] & 0xff, p[1] & 0xff);
765*f330e785Schristos #else
766*f330e785Schristos 	(void) sprintf(uaddr,
767*f330e785Schristos 		       "%u.%u.%u.%u.%u.%u", i[0] & 0xff, i[1] & 0xff,
768*f330e785Schristos 		       i[2] & 0xff, i[3] & 0xff, p[0] & 0xff, p[1] & 0xff);
769*f330e785Schristos #endif
770ecd7789bSchristos 	len = strlen(uaddr);
771ecd7789bSchristos 	xlen = XDRALIGN(len);
772ecd7789bSchristos 
773ecd7789bSchristos 	/* Determine mbuf offset to start writing to. */
774ecd7789bSchristos 	pos = (char *)ra->ra_maddr.xu_xslen - rm->rm_msgbuf;
775ecd7789bSchristos 	off += pos;
776ecd7789bSchristos 
777ecd7789bSchristos 	/* Write new string length. */
778ecd7789bSchristos 	bogo = htonl(len);
779*f330e785Schristos 	COPYBACK(m, off, 4, (void *)&bogo);
780ecd7789bSchristos 	off += 4;
781ecd7789bSchristos 
782ecd7789bSchristos 	/* Write new string. */
783ecd7789bSchristos 	COPYBACK(m, off, xlen, uaddr);
784ecd7789bSchristos 	off += xlen;
785ecd7789bSchristos 
786ecd7789bSchristos 	/* Write in zero r_owner. */
787ecd7789bSchristos 	bogo = 0;
788*f330e785Schristos 	COPYBACK(m, off, 4, (void *)&bogo);
789ecd7789bSchristos 
790ecd7789bSchristos 	/* Determine difference in data lengths. */
791ecd7789bSchristos 	diff = xlen - XDRALIGN(B(ra->ra_maddr.xu_xslen));
792ecd7789bSchristos 
793ecd7789bSchristos 	/*
794ecd7789bSchristos 	 * If our new string has a different length, make necessary
795ecd7789bSchristos 	 * adjustments.
796ecd7789bSchristos 	 */
797ecd7789bSchristos 	if (diff != 0) {
798ecd7789bSchristos 		udp = fin->fin_dp;
799ecd7789bSchristos 		udp->uh_ulen = htons(ntohs(udp->uh_ulen) + diff);
800ecd7789bSchristos 		fin->fin_plen += diff;
801ecd7789bSchristos 		fin->fin_ip->ip_len = htons(fin->fin_plen);
802ecd7789bSchristos 		fin->fin_dlen += diff;
803ecd7789bSchristos 		/* XXX Storage lengths. */
804ecd7789bSchristos 	}
805ecd7789bSchristos 
806ecd7789bSchristos 	return(diff);
807ecd7789bSchristos }
808ecd7789bSchristos 
809ecd7789bSchristos /* --------------------------------------------------------------------	*/
810ecd7789bSchristos /* Function:	ipf_p_rpcb_decoderep					*/
811ecd7789bSchristos /* Returns:	int - -1 == bad request or critical failure,		*/
812ecd7789bSchristos /*		       0 == valid, negative reply			*/
813ecd7789bSchristos /*		       1 == vaddlid, positive reply; needs no changes	*/
814ecd7789bSchristos /* Parameters:	fin(I)	- pointer to packet information			*/
815ecd7789bSchristos /*		nat(I)	- pointer to NAT session structure		*/
816ecd7789bSchristos /*		rs(I)	- pointer to RPCB session structure		*/
817ecd7789bSchristos /*		rm(I)	- pointer to RPC message structure		*/
818ecd7789bSchristos /*		rxp(O)	- pointer to RPCB transaction structure		*/
819ecd7789bSchristos /*									*/
820ecd7789bSchristos /* Take a presumed RPCB reply, extract the XID, search for the original */
821ecd7789bSchristos /* request information, and determine whether the request was accepted	*/
822ecd7789bSchristos /* or rejected.  With a valid accepted reply, go ahead and create NAT	*/
823ecd7789bSchristos /* and state entries, and finish up by rewriting the packet as 		*/
824ecd7789bSchristos /* required.								*/
825ecd7789bSchristos /*									*/
826ecd7789bSchristos /* WARNING:  It's the responsibility of the caller to make sure there	*/
827ecd7789bSchristos /* is enough room in rs_buf for the basic RPC message "preamble".	*/
828ecd7789bSchristos /* --------------------------------------------------------------------	*/
829ecd7789bSchristos static int
830*f330e785Schristos ipf_p_rpcb_decoderep(fr_info_t *fin, nat_t *nat, rpcb_session_t *rs,
831*f330e785Schristos     rpc_msg_t *rm, rpcb_xact_t **rxp)
832ecd7789bSchristos {
833ecd7789bSchristos 	rpcb_listp_t *rl;
834ecd7789bSchristos 	rpcb_entry_t *re;
835ecd7789bSchristos 	rpcb_xact_t *rx;
836ecd7789bSchristos 	u_32_t xdr, *p;
837ecd7789bSchristos 	rpc_resp_t *rr;
838ecd7789bSchristos 	int rv, cnt;
839ecd7789bSchristos 
840ecd7789bSchristos 	p = (u_32_t *)rm->rm_msgbuf;
841ecd7789bSchristos 
842ecd7789bSchristos 	bzero((char *)&rx, sizeof(rx));
843ecd7789bSchristos 	rr = &rm->rm_resp;
844ecd7789bSchristos 
845ecd7789bSchristos 	rm->rm_xid = p;
846ecd7789bSchristos 	xdr = B(p++);		/* Record this message's XID. */
847ecd7789bSchristos 
848ecd7789bSchristos 	/* Lookup XID */
849ecd7789bSchristos         MUTEX_ENTER(&rs->rs_rxlock);
850ecd7789bSchristos 	if ((rx = ipf_p_rpcb_lookup(rs, xdr)) == NULL) {
851ecd7789bSchristos                 MUTEX_EXIT(&rs->rs_rxlock);
852ecd7789bSchristos 		return(-1);
853ecd7789bSchristos         }
854ecd7789bSchristos         ++rx->rx_ref;        /* per thread reference */
855ecd7789bSchristos         MUTEX_EXIT(&rs->rs_rxlock);
856ecd7789bSchristos 
857ecd7789bSchristos 	*rxp = rx;
858ecd7789bSchristos 
859ecd7789bSchristos 	/* Test call vs reply */
860ecd7789bSchristos 	if (B(p++) != RPCB_REPLY)
861ecd7789bSchristos 		return(-1);
862ecd7789bSchristos 
863ecd7789bSchristos 	/* Test reply_stat */
864ecd7789bSchristos 	switch(B(p++))
865ecd7789bSchristos 	{
866ecd7789bSchristos 	case RPCB_MSG_DENIED:
867ecd7789bSchristos 		return(0);
868ecd7789bSchristos 	case RPCB_MSG_ACCEPTED:
869ecd7789bSchristos 		break;
870ecd7789bSchristos 	default:
871ecd7789bSchristos 		return(-1);
872ecd7789bSchristos 	}
873ecd7789bSchristos 
874ecd7789bSchristos 	/* Bypass RPC authentication stuff. */
875ecd7789bSchristos 	if (ipf_p_rpcb_skipauth(rm, &rr->rr_authverf, &p) != 0)
876ecd7789bSchristos 		return(-1);
877ecd7789bSchristos 
878ecd7789bSchristos 	/* Test accept status */
879ecd7789bSchristos 	if (!RPCB_BUF_GEQ(rm, p, 4))
880ecd7789bSchristos 		return(-1);
881ecd7789bSchristos 	if (B(p++) != 0)
882ecd7789bSchristos 		return(0);
883ecd7789bSchristos 
884ecd7789bSchristos 	/* Parse out the expected reply */
885ecd7789bSchristos 	switch(rx->rx_type)
886ecd7789bSchristos 	{
887ecd7789bSchristos 	case RPCB_RES_PMAP:
888ecd7789bSchristos 		/* There must be only one 4 byte argument. */
889ecd7789bSchristos 		if (!RPCB_BUF_EQ(rm, p, 4))
890ecd7789bSchristos 			return(-1);
891ecd7789bSchristos 
892ecd7789bSchristos 		rr->rr_v2 = p;
893ecd7789bSchristos 		xdr = B(rr->rr_v2);
894ecd7789bSchristos 
895ecd7789bSchristos 		/* Reply w/ a 0 port indicates service isn't registered */
896ecd7789bSchristos 		if (xdr == 0)
897ecd7789bSchristos 			return(0);
898ecd7789bSchristos 
899ecd7789bSchristos 		/* Is the value sane? */
900ecd7789bSchristos 		if (xdr > 65535)
901ecd7789bSchristos 			return(-1);
902ecd7789bSchristos 
903ecd7789bSchristos 		/* Create NAT & state table entries. */
904ecd7789bSchristos 		if (ipf_p_rpcb_getnat(fin, nat, rx->rx_proto, (u_int)xdr) != 0)
905ecd7789bSchristos 			return(-1);
906ecd7789bSchristos 		break;
907ecd7789bSchristos 	case RPCB_RES_STRING:
908ecd7789bSchristos 		/* Expecting a XDR string; need 4 bytes for length */
909ecd7789bSchristos 		if (!RPCB_BUF_GEQ(rm, p, 4))
910ecd7789bSchristos 			return(-1);
911ecd7789bSchristos 
912ecd7789bSchristos 		rr->rr_v3.xu_str.xs_len = p++;
913ecd7789bSchristos 		rr->rr_v3.xu_str.xs_str = (char *)p;
914ecd7789bSchristos 
915ecd7789bSchristos 		xdr = B(rr->rr_v3.xu_xslen);
916ecd7789bSchristos 
917ecd7789bSchristos 		/* A null string indicates an unregistered service */
918ecd7789bSchristos 		if ((xdr == 0) && RPCB_BUF_EQ(rm, p, 0))
919ecd7789bSchristos 			return(0);
920ecd7789bSchristos 
921ecd7789bSchristos 		/* Decode the target IP address / port. */
922ecd7789bSchristos 		if (ipf_p_rpcb_getuaddr(rm, &rr->rr_v3, &p) != 0)
923ecd7789bSchristos 			return(-1);
924ecd7789bSchristos 
925ecd7789bSchristos 		/* Validate the IP address and port contained. */
926ecd7789bSchristos 		if (nat->nat_odstaddr != rr->rr_v3.xu_ip)
927ecd7789bSchristos 			return(-1);
928ecd7789bSchristos 
929ecd7789bSchristos 		/* Create NAT & state table entries. */
930ecd7789bSchristos 		if (ipf_p_rpcb_getnat(fin, nat, rx->rx_proto,
931ecd7789bSchristos 				     (u_int)rr->rr_v3.xu_port) != 0)
932ecd7789bSchristos 			return(-1);
933ecd7789bSchristos 		break;
934ecd7789bSchristos 	case RPCB_RES_LIST:
935ecd7789bSchristos 		if (!RPCB_BUF_GEQ(rm, p, 4))
936ecd7789bSchristos 			return(-1);
937ecd7789bSchristos 		/* rpcb_entry_list_ptr */
938ecd7789bSchristos 		switch(B(p))
939ecd7789bSchristos 		{
940ecd7789bSchristos 		case 0:
941ecd7789bSchristos 			return(0);
942ecd7789bSchristos 			/*NOTREACHED*/
943ecd7789bSchristos 			break;
944ecd7789bSchristos 		case 1:
945ecd7789bSchristos 			break;
946ecd7789bSchristos 		default:
947ecd7789bSchristos 			return(-1);
948ecd7789bSchristos 		}
949ecd7789bSchristos 		rl = &rr->rr_v4;
950ecd7789bSchristos 		rl->rl_list = p++;
951ecd7789bSchristos 		cnt = 0;
952ecd7789bSchristos 
953ecd7789bSchristos 		for(;;) {
954ecd7789bSchristos 			re = &rl->rl_entries[rl->rl_cnt];
955ecd7789bSchristos 			if (ipf_p_rpcb_getuaddr(rm, &re->re_maddr, &p) != 0)
956ecd7789bSchristos 				return(-1);
957ecd7789bSchristos 			if (ipf_p_rpcb_getproto(rm, &re->re_netid, &p) != 0)
958ecd7789bSchristos 				return(-1);
959ecd7789bSchristos 			/* re_semantics & re_pfamily length */
960ecd7789bSchristos 			if (!RPCB_BUF_GEQ(rm, p, 12))
961ecd7789bSchristos 				return(-1);
962ecd7789bSchristos 			p++; /* Skipping re_semantics. */
963ecd7789bSchristos 			xdr = B(p++);
964ecd7789bSchristos 			if ((xdr != 4) || strncmp((char *)p, "inet", 4))
965ecd7789bSchristos 				return(-1);
966ecd7789bSchristos 			p++;
967ecd7789bSchristos 			if (ipf_p_rpcb_getproto(rm, &re->re_proto, &p) != 0)
968ecd7789bSchristos 				return(-1);
969ecd7789bSchristos 			if (!RPCB_BUF_GEQ(rm, p, 4))
970ecd7789bSchristos 				return(-1);
971ecd7789bSchristos 			re->re_more = p;
972ecd7789bSchristos 			if (B(re->re_more) > 1) /* 0,1 only legal values */
973ecd7789bSchristos 				return(-1);
974ecd7789bSchristos 			++rl->rl_cnt;
975ecd7789bSchristos 			++cnt;
976ecd7789bSchristos 			if (B(re->re_more) == 0)
977ecd7789bSchristos 				break;
978ecd7789bSchristos 			/* Replies in  max out at 2; TCP and/or UDP */
979ecd7789bSchristos 			if (cnt > 2)
980ecd7789bSchristos 				return(-1);
981ecd7789bSchristos 			p++;
982ecd7789bSchristos 		}
983ecd7789bSchristos 
984ecd7789bSchristos 		for(rl->rl_cnt = 0; rl->rl_cnt < cnt; rl->rl_cnt++) {
985ecd7789bSchristos 			re = &rl->rl_entries[rl->rl_cnt];
986ecd7789bSchristos 			rv = ipf_p_rpcb_getnat(fin, nat,
987ecd7789bSchristos 			                      re->re_proto.xp_proto,
988ecd7789bSchristos 				              (u_int)re->re_maddr.xu_port);
989ecd7789bSchristos 			if (rv != 0)
990ecd7789bSchristos 				return(-1);
991ecd7789bSchristos 		}
992ecd7789bSchristos 		break;
993ecd7789bSchristos 	default:
994ecd7789bSchristos 		/*CONSTANTCONDITION*/
995ecd7789bSchristos 		IPF_PANIC(1, ("illegal rx_type %d", rx->rx_type));
996ecd7789bSchristos 	}
997ecd7789bSchristos 
998ecd7789bSchristos 	return(1);
999ecd7789bSchristos }
1000ecd7789bSchristos 
1001ecd7789bSchristos /* --------------------------------------------------------------------	*/
1002ecd7789bSchristos /* Function:	ipf_p_rpcb_lookup					*/
1003ecd7789bSchristos /* Returns:	rpcb_xact_t * 	- NULL == no matching record,		*/
1004ecd7789bSchristos /*				  else pointer to relevant entry	*/
1005ecd7789bSchristos /* Parameters:	rs(I)	- pointer to RPCB session			*/
1006ecd7789bSchristos /*		xid(I)	- XID to look for				*/
1007ecd7789bSchristos /* --------------------------------------------------------------------	*/
1008ecd7789bSchristos static rpcb_xact_t *
1009*f330e785Schristos ipf_p_rpcb_lookup(rpcb_session_t *rs, u_32_t xid)
1010ecd7789bSchristos {
1011ecd7789bSchristos 	rpcb_xact_t *rx;
1012ecd7789bSchristos 
1013ecd7789bSchristos 	if (rs->rs_rxlist == NULL)
1014ecd7789bSchristos 		return(NULL);
1015ecd7789bSchristos 
1016ecd7789bSchristos 	for (rx = rs->rs_rxlist; rx != NULL; rx = rx->rx_next)
1017ecd7789bSchristos 		if (rx->rx_xid == xid)
1018ecd7789bSchristos 			break;
1019ecd7789bSchristos 
1020ecd7789bSchristos 	return(rx);
1021ecd7789bSchristos }
1022ecd7789bSchristos 
1023ecd7789bSchristos /* --------------------------------------------------------------------	*/
1024ecd7789bSchristos /* Function:	ipf_p_rpcb_deref					        */
1025ecd7789bSchristos /* Returns:	(void)							*/
1026ecd7789bSchristos /* Parameters:	rs(I)	- pointer to RPCB session			*/
1027ecd7789bSchristos /*		rx(I)	- pointer to RPC transaction struct to remove	*/
1028ecd7789bSchristos /*              force(I) - indicates to delete entry regardless of      */
1029ecd7789bSchristos /*                         reference count                              */
1030ecd7789bSchristos /* Locking:	rs->rs_rxlock must be held write only			*/
1031ecd7789bSchristos /*									*/
1032ecd7789bSchristos /* Free the RPCB transaction record rx from the chain of entries.	*/
1033ecd7789bSchristos /* --------------------------------------------------------------------	*/
1034ecd7789bSchristos static void
1035*f330e785Schristos ipf_p_rpcb_deref(rpcb_session_t *rs, rpcb_xact_t *rx)
1036ecd7789bSchristos {
1037ecd7789bSchristos 	rs = rs;	/* LINT */
1038ecd7789bSchristos 
1039ecd7789bSchristos 	if (rx == NULL)
1040ecd7789bSchristos 		return;
1041ecd7789bSchristos 
1042ecd7789bSchristos 	if (--rx->rx_ref != 0)
1043ecd7789bSchristos 		return;
1044ecd7789bSchristos 
1045ecd7789bSchristos 	if (rx->rx_next != NULL)
1046ecd7789bSchristos 		rx->rx_next->rx_pnext = rx->rx_pnext;
1047ecd7789bSchristos 
1048ecd7789bSchristos 	*rx->rx_pnext = rx->rx_next;
1049ecd7789bSchristos 
1050ecd7789bSchristos 	KFREE(rx);
1051ecd7789bSchristos 
1052ecd7789bSchristos 	--rpcbcnt;
1053ecd7789bSchristos }
1054ecd7789bSchristos 
1055ecd7789bSchristos /* --------------------------------------------------------------------	*/
1056ecd7789bSchristos /* Function:	ipf_p_rpcb_getproto					*/
1057ecd7789bSchristos /* Returns:	int - -1 == illegal protocol/netid,			*/
1058ecd7789bSchristos /*		       0 == legal protocol/netid			*/
1059ecd7789bSchristos /* Parameters:	rm(I)	- pointer to RPC message structure		*/
1060ecd7789bSchristos /*		xp(I)	- pointer to netid structure			*/
1061ecd7789bSchristos /*		p(IO)	- pointer to location within packet buffer	*/
1062ecd7789bSchristos /* 									*/
1063ecd7789bSchristos /* Decode netid/proto stored at p and record its numeric value.	 	*/
1064ecd7789bSchristos /* --------------------------------------------------------------------	*/
1065ecd7789bSchristos static int
1066*f330e785Schristos ipf_p_rpcb_getproto(rpc_msg_t *rm, xdr_proto_t *xp, u_32_t **p)
1067ecd7789bSchristos {
1068ecd7789bSchristos 	u_int len;
1069ecd7789bSchristos 
1070ecd7789bSchristos 	/* Must have 4 bytes for length & 4 bytes for "tcp" or "udp". */
1071ecd7789bSchristos 	if (!RPCB_BUF_GEQ(rm, p, 8))
1072ecd7789bSchristos 		return(-1);
1073ecd7789bSchristos 
1074ecd7789bSchristos 	xp->xp_xslen = (*p)++;
1075ecd7789bSchristos 	xp->xp_xsstr = (char *)*p;
1076ecd7789bSchristos 
1077ecd7789bSchristos 	/* Test the string length. */
1078ecd7789bSchristos 	len = B(xp->xp_xslen);
1079ecd7789bSchristos 	if (len != 3)
1080ecd7789bSchristos 	 	return(-1);
1081ecd7789bSchristos 
1082ecd7789bSchristos 	/* Test the actual string & record the protocol accordingly. */
1083ecd7789bSchristos 	if (!strncmp((char *)xp->xp_xsstr, "tcp\0", 4))
1084ecd7789bSchristos 		xp->xp_proto = IPPROTO_TCP;
1085ecd7789bSchristos 	else if (!strncmp((char *)xp->xp_xsstr, "udp\0", 4))
1086ecd7789bSchristos 		xp->xp_proto = IPPROTO_UDP;
1087ecd7789bSchristos 	else {
1088ecd7789bSchristos 		return(-1);
1089ecd7789bSchristos 	}
1090ecd7789bSchristos 
1091ecd7789bSchristos 	/* Advance past the string. */
1092ecd7789bSchristos 	(*p)++;
1093ecd7789bSchristos 
1094ecd7789bSchristos 	return(0);
1095ecd7789bSchristos }
1096ecd7789bSchristos 
1097ecd7789bSchristos /* --------------------------------------------------------------------	*/
1098ecd7789bSchristos /* Function:	ipf_p_rpcb_getnat					*/
1099ecd7789bSchristos /* Returns:	int -- -1 == failed to create table entries,		*/
1100ecd7789bSchristos /*			0 == success					*/
1101ecd7789bSchristos /* Parameters:	fin(I)	- pointer to packet information			*/
1102ecd7789bSchristos /*		nat(I)	- pointer to NAT table entry			*/
1103ecd7789bSchristos /*		proto(I) - transport protocol for new entries		*/
1104ecd7789bSchristos /*		port(I)	- new port to use w/ wildcard table entries	*/
1105ecd7789bSchristos /*									*/
1106ecd7789bSchristos /* Create state and NAT entries to handle an anticipated connection	*/
1107ecd7789bSchristos /* attempt between RPC client and server.				*/
1108ecd7789bSchristos /* --------------------------------------------------------------------	*/
1109ecd7789bSchristos static int
1110*f330e785Schristos ipf_p_rpcb_getnat(fr_info_t *fin, nat_t *nat, u_int proto, u_int port)
1111ecd7789bSchristos {
1112ecd7789bSchristos 	ipf_main_softc_t *softc = fin->fin_main_soft;
1113ecd7789bSchristos 	ipnat_t *ipn, ipnat;
1114ecd7789bSchristos 	tcphdr_t tcp;
1115ecd7789bSchristos 	ipstate_t *is;
1116ecd7789bSchristos 	fr_info_t fi;
1117ecd7789bSchristos 	nat_t *natl;
1118ecd7789bSchristos 	int nflags;
1119ecd7789bSchristos 
1120ecd7789bSchristos 	ipn = nat->nat_ptr;
1121ecd7789bSchristos 
1122ecd7789bSchristos 	/* Generate dummy fr_info */
1123ecd7789bSchristos 	bcopy((char *)fin, (char *)&fi, sizeof(fi));
1124ecd7789bSchristos 	fi.fin_out = 0;
1125ecd7789bSchristos 	fi.fin_p = proto;
1126ecd7789bSchristos 	fi.fin_sport = 0;
1127ecd7789bSchristos 	fi.fin_dport = port & 0xffff;
1128ecd7789bSchristos 	fi.fin_flx |= FI_IGNORE;
1129ecd7789bSchristos 	fi.fin_saddr = nat->nat_osrcaddr;
1130ecd7789bSchristos 	fi.fin_daddr = nat->nat_odstaddr;
1131ecd7789bSchristos 
1132ecd7789bSchristos 	bzero((char *)&tcp, sizeof(tcp));
1133ecd7789bSchristos 	tcp.th_dport = htons(port);
1134ecd7789bSchristos 
1135ecd7789bSchristos 	if (proto == IPPROTO_TCP) {
1136ecd7789bSchristos 		tcp.th_win = htons(8192);
1137ecd7789bSchristos 		TCP_OFF_A(&tcp, sizeof(tcphdr_t) >> 2);
1138ecd7789bSchristos 		fi.fin_dlen = sizeof(tcphdr_t);
1139ecd7789bSchristos 		tcp.th_flags = TH_SYN;
1140ecd7789bSchristos 		nflags = NAT_TCP;
1141ecd7789bSchristos 	} else {
1142ecd7789bSchristos 		fi.fin_dlen = sizeof(udphdr_t);
1143ecd7789bSchristos 		nflags = NAT_UDP;
1144ecd7789bSchristos 	}
1145ecd7789bSchristos 
1146ecd7789bSchristos 	nflags |= SI_W_SPORT|NAT_SEARCH;
1147ecd7789bSchristos 	fi.fin_dp = &tcp;
1148ecd7789bSchristos 	fi.fin_plen = fi.fin_hlen + fi.fin_dlen;
1149ecd7789bSchristos 
1150ecd7789bSchristos 	/*
1151ecd7789bSchristos 	 * Search for existing NAT & state entries.  Pay close attention to
1152ecd7789bSchristos 	 * mutexes / locks grabbed from lookup routines, as not doing so could
1153ecd7789bSchristos 	 * lead to bad things.
1154ecd7789bSchristos 	 *
1155ecd7789bSchristos 	 * If successful, fr_stlookup returns with ipf_state locked.  We have
1156ecd7789bSchristos 	 * no use for this lock, so simply unlock it if necessary.
1157ecd7789bSchristos 	 */
1158ecd7789bSchristos 	is = ipf_state_lookup(&fi, &tcp, NULL);
1159ecd7789bSchristos 	if (is != NULL) {
1160ecd7789bSchristos 		RWLOCK_EXIT(&softc->ipf_state);
1161ecd7789bSchristos 	}
1162ecd7789bSchristos 
1163ecd7789bSchristos 	RWLOCK_EXIT(&softc->ipf_nat);
1164ecd7789bSchristos 
1165ecd7789bSchristos 	WRITE_ENTER(&softc->ipf_nat);
1166ecd7789bSchristos 	natl = ipf_nat_inlookup(&fi, nflags, proto, fi.fin_src, fi.fin_dst);
1167ecd7789bSchristos 
1168ecd7789bSchristos 	if ((natl != NULL) && (is != NULL)) {
1169ecd7789bSchristos 		MUTEX_DOWNGRADE(&softc->ipf_nat);
1170ecd7789bSchristos 		return(0);
1171ecd7789bSchristos 	}
1172ecd7789bSchristos 
1173ecd7789bSchristos 	/* Slightly modify the following structures for actual use in creating
1174ecd7789bSchristos 	 * NAT and/or state entries.  We're primarily concerned with stripping
1175ecd7789bSchristos 	 * flags that may be detrimental to the creation process or simply
1176ecd7789bSchristos 	 * shouldn't be associated with a table entry.
1177ecd7789bSchristos 	 */
1178ecd7789bSchristos 	fi.fin_fr = &rpcbfr;
1179ecd7789bSchristos 	fi.fin_flx &= ~FI_IGNORE;
1180ecd7789bSchristos 	nflags &= ~NAT_SEARCH;
1181ecd7789bSchristos 
1182ecd7789bSchristos 	if (natl == NULL) {
1183ecd7789bSchristos #ifdef USE_MUTEXES
1184ecd7789bSchristos 		ipf_nat_softc_t *softn = softc->ipf_nat_soft;
1185ecd7789bSchristos #endif
1186ecd7789bSchristos 
1187ecd7789bSchristos 		/* XXX Since we're just copying the original ipn contents
1188ecd7789bSchristos 		 * back, would we be better off just sending a pointer to
1189ecd7789bSchristos 		 * the 'temp' copy off to nat_new instead?
1190ecd7789bSchristos 		 */
1191ecd7789bSchristos 		/* Generate template/bogus NAT rule. */
1192ecd7789bSchristos 		bcopy((char *)ipn, (char *)&ipnat, sizeof(ipnat));
1193ecd7789bSchristos 		ipn->in_flags = nflags & IPN_TCPUDP;
1194ecd7789bSchristos 		ipn->in_apr = NULL;
1195ecd7789bSchristos 		ipn->in_pr[0] = proto;
1196ecd7789bSchristos 		ipn->in_pr[1] = proto;
1197ecd7789bSchristos 		ipn->in_dpmin = fi.fin_dport;
1198ecd7789bSchristos 		ipn->in_dpmax = fi.fin_dport;
1199ecd7789bSchristos 		ipn->in_dpnext = fi.fin_dport;
1200ecd7789bSchristos 		ipn->in_space = 1;
1201ecd7789bSchristos 		ipn->in_ippip = 1;
1202ecd7789bSchristos 		if (ipn->in_flags & IPN_FILTER) {
1203ecd7789bSchristos 			ipn->in_scmp = 0;
1204ecd7789bSchristos 			ipn->in_dcmp = 0;
1205ecd7789bSchristos 		}
1206ecd7789bSchristos 		ipn->in_plabel = -1;
1207ecd7789bSchristos 
1208ecd7789bSchristos 		/* Create NAT entry.  return NULL if this fails. */
1209ecd7789bSchristos 		MUTEX_ENTER(&softn->ipf_nat_new);
1210ecd7789bSchristos 		natl = ipf_nat_add(&fi, ipn, NULL, nflags|SI_CLONE|NAT_SLAVE,
1211ecd7789bSchristos 			       NAT_INBOUND);
1212ecd7789bSchristos 		MUTEX_EXIT(&softn->ipf_nat_new);
1213ecd7789bSchristos 
1214ecd7789bSchristos 		bcopy((char *)&ipnat, (char *)ipn, sizeof(ipnat));
1215ecd7789bSchristos 
1216ecd7789bSchristos 		if (natl == NULL) {
1217ecd7789bSchristos 			MUTEX_DOWNGRADE(&softc->ipf_nat);
1218ecd7789bSchristos 			return(-1);
1219ecd7789bSchristos 		}
1220ecd7789bSchristos 
1221ecd7789bSchristos 		fi.fin_saddr = natl->nat_nsrcaddr;
1222ecd7789bSchristos 		fi.fin_daddr = natl->nat_ndstaddr;
1223ecd7789bSchristos 		ipn->in_use++;
1224ecd7789bSchristos 		(void) ipf_nat_proto(&fi, natl, nflags);
1225ecd7789bSchristos 		MUTEX_ENTER(&natl->nat_lock);
1226ecd7789bSchristos 		ipf_nat_update(&fi, natl);
1227ecd7789bSchristos 		MUTEX_EXIT(&natl->nat_lock);
1228ecd7789bSchristos 	}
1229ecd7789bSchristos 	MUTEX_DOWNGRADE(&softc->ipf_nat);
1230ecd7789bSchristos 
1231ecd7789bSchristos 	if (is == NULL) {
1232ecd7789bSchristos 		/* Create state entry.  Return NULL if this fails. */
1233ecd7789bSchristos 		fi.fin_flx |= FI_NATED;
1234ecd7789bSchristos 		fi.fin_flx &= ~FI_STATE;
1235ecd7789bSchristos 		nflags &= NAT_TCPUDP;
1236ecd7789bSchristos 		nflags |= SI_W_SPORT|SI_CLONE;
1237ecd7789bSchristos 
1238ecd7789bSchristos 		if (ipf_state_add(softc, &fi, NULL, nflags) != 0) {
1239ecd7789bSchristos 			/*
1240ecd7789bSchristos 			 * XXX nat_delete is private to ip_nat.c.  Should
1241ecd7789bSchristos 			 * check w/ Darren about this one.
1242ecd7789bSchristos 			 *
1243ecd7789bSchristos 			 * nat_delete(natl, NL_EXPIRE);
1244ecd7789bSchristos 			 */
1245ecd7789bSchristos 			return(-1);
1246ecd7789bSchristos 		}
1247ecd7789bSchristos 	}
1248ecd7789bSchristos 
1249ecd7789bSchristos 	return(0);
1250ecd7789bSchristos }
1251ecd7789bSchristos 
1252ecd7789bSchristos /* --------------------------------------------------------------------	*/
1253ecd7789bSchristos /* Function:	ipf_p_rpcb_modv3						*/
1254ecd7789bSchristos /* Returns:	int -- change in packet length				*/
1255ecd7789bSchristos /* Parameters:	fin(I)	- pointer to packet information			*/
1256ecd7789bSchristos /*		nat(I)	- pointer to NAT session			*/
1257ecd7789bSchristos /*		rm(I)	- pointer to RPC message structure		*/
1258ecd7789bSchristos /*		m(I)	- pointer to mbuf chain				*/
1259ecd7789bSchristos /*		off(I)	- offset within mbuf chain			*/
1260ecd7789bSchristos /*									*/
1261ecd7789bSchristos /* Write a new universal address string to this packet, adjusting	*/
1262ecd7789bSchristos /* lengths as necessary.						*/
1263ecd7789bSchristos /* --------------------------------------------------------------------	*/
1264ecd7789bSchristos static int
1265*f330e785Schristos ipf_p_rpcb_modv3(fr_info_t *fin, nat_t *nat, rpc_msg_t *rm, mb_t *m, u_int off)
1266ecd7789bSchristos {
1267ecd7789bSchristos 	u_int len, xlen, pos, bogo;
1268ecd7789bSchristos 	rpc_resp_t *rr;
1269ecd7789bSchristos 	char uaddr[24];
1270ecd7789bSchristos 	char *i, *p;
1271ecd7789bSchristos 	int diff;
1272ecd7789bSchristos 
1273ecd7789bSchristos 	rr = &rm->rm_resp;
1274ecd7789bSchristos 	i = (char *)&nat->nat_ndstaddr;
1275ecd7789bSchristos 	p = (char *)&rr->rr_v3.xu_port;
1276ecd7789bSchristos 
1277ecd7789bSchristos 	/* Form new string. */
1278ecd7789bSchristos 	bzero(uaddr, sizeof(uaddr)); /* Just in case we need padding. */
1279ecd7789bSchristos #if defined(SNPRINTF) && defined(_KERNEL)
1280ecd7789bSchristos 	SNPRINTF(uaddr, sizeof(uaddr),
1281ecd7789bSchristos 		       "%u.%u.%u.%u.%u.%u", i[0] & 0xff, i[1] & 0xff,
1282ecd7789bSchristos 		       i[2] & 0xff, i[3] & 0xff, p[0] & 0xff, p[1] & 0xff);
1283*f330e785Schristos #else
1284*f330e785Schristos 	(void) sprintf(uaddr,
1285*f330e785Schristos 		       "%u.%u.%u.%u.%u.%u", i[0] & 0xff, i[1] & 0xff,
1286*f330e785Schristos 		       i[2] & 0xff, i[3] & 0xff, p[0] & 0xff, p[1] & 0xff);
1287*f330e785Schristos #endif
1288ecd7789bSchristos 	len = strlen(uaddr);
1289ecd7789bSchristos 	xlen = XDRALIGN(len);
1290ecd7789bSchristos 
1291ecd7789bSchristos 	/* Determine mbuf offset to write to. */
1292ecd7789bSchristos 	pos = (char *)rr->rr_v3.xu_xslen - rm->rm_msgbuf;
1293ecd7789bSchristos 	off += pos;
1294ecd7789bSchristos 
1295ecd7789bSchristos 	/* Write new string length. */
1296ecd7789bSchristos 	bogo = htonl(len);
1297*f330e785Schristos 	COPYBACK(m, off, 4, (void *)&bogo);
1298ecd7789bSchristos 	off += 4;
1299ecd7789bSchristos 
1300ecd7789bSchristos 	/* Write new string. */
1301ecd7789bSchristos 	COPYBACK(m, off, xlen, uaddr);
1302ecd7789bSchristos 
1303ecd7789bSchristos 	/* Determine difference in data lengths. */
1304ecd7789bSchristos 	diff = xlen - XDRALIGN(B(rr->rr_v3.xu_xslen));
1305ecd7789bSchristos 
1306ecd7789bSchristos 	/*
1307ecd7789bSchristos 	 * If our new string has a different length, make necessary
1308ecd7789bSchristos 	 * adjustments.
1309ecd7789bSchristos 	 */
1310ecd7789bSchristos 	if (diff != 0)
1311ecd7789bSchristos 		ipf_p_rpcb_fixlen(fin, diff);
1312ecd7789bSchristos 
1313ecd7789bSchristos 	return(diff);
1314ecd7789bSchristos }
1315ecd7789bSchristos 
1316ecd7789bSchristos /* --------------------------------------------------------------------	*/
1317ecd7789bSchristos /* Function:	ipf_p_rpcb_modv4						*/
1318ecd7789bSchristos /* Returns:	int -- change in packet length				*/
1319ecd7789bSchristos /* Parameters:	fin(I)	- pointer to packet information			*/
1320ecd7789bSchristos /*		nat(I)	- pointer to NAT session			*/
1321ecd7789bSchristos /*		rm(I)	- pointer to RPC message structure		*/
1322ecd7789bSchristos /*		m(I)	- pointer to mbuf chain				*/
1323ecd7789bSchristos /*		off(I)	- offset within mbuf chain			*/
1324ecd7789bSchristos /*									*/
1325ecd7789bSchristos /* Write new rpcb_entry list, adjusting	lengths as necessary.		*/
1326ecd7789bSchristos /* --------------------------------------------------------------------	*/
1327ecd7789bSchristos static int
1328*f330e785Schristos ipf_p_rpcb_modv4(fr_info_t *fin, nat_t *nat, rpc_msg_t *rm, mb_t *m, u_int off)
1329ecd7789bSchristos {
1330ecd7789bSchristos 	u_int len, xlen, pos, bogo;
1331ecd7789bSchristos 	rpcb_listp_t *rl;
1332ecd7789bSchristos 	rpcb_entry_t *re;
1333ecd7789bSchristos 	rpc_resp_t *rr;
1334ecd7789bSchristos 	char uaddr[24];
1335ecd7789bSchristos 	int diff, cnt;
1336ecd7789bSchristos 	char *i, *p;
1337ecd7789bSchristos 
1338ecd7789bSchristos 	diff = 0;
1339ecd7789bSchristos 	rr = &rm->rm_resp;
1340ecd7789bSchristos 	rl = &rr->rr_v4;
1341ecd7789bSchristos 
1342ecd7789bSchristos 	i = (char *)&nat->nat_ndstaddr;
1343ecd7789bSchristos 
1344ecd7789bSchristos 	/* Determine mbuf offset to write to. */
1345ecd7789bSchristos 	re = &rl->rl_entries[0];
1346ecd7789bSchristos 	pos = (char *)re->re_maddr.xu_xslen - rm->rm_msgbuf;
1347ecd7789bSchristos 	off += pos;
1348ecd7789bSchristos 
1349ecd7789bSchristos 	for (cnt = 0; cnt < rl->rl_cnt; cnt++) {
1350ecd7789bSchristos 		re = &rl->rl_entries[cnt];
1351ecd7789bSchristos 		p = (char *)&re->re_maddr.xu_port;
1352ecd7789bSchristos 
1353ecd7789bSchristos 		/* Form new string. */
1354ecd7789bSchristos 		bzero(uaddr, sizeof(uaddr)); /* Just in case we need
1355ecd7789bSchristos 						padding. */
1356ecd7789bSchristos #if defined(SNPRINTF) && defined(_KERNEL)
1357ecd7789bSchristos 		SNPRINTF(uaddr, sizeof(uaddr),
1358ecd7789bSchristos 			       "%u.%u.%u.%u.%u.%u", i[0] & 0xff,
1359ecd7789bSchristos 			       i[1] & 0xff, i[2] & 0xff, i[3] & 0xff,
1360ecd7789bSchristos 			       p[0] & 0xff, p[1] & 0xff);
1361*f330e785Schristos #else
1362*f330e785Schristos 		(void) sprintf(uaddr,
1363*f330e785Schristos 			       "%u.%u.%u.%u.%u.%u", i[0] & 0xff,
1364*f330e785Schristos 			       i[1] & 0xff, i[2] & 0xff, i[3] & 0xff,
1365*f330e785Schristos 			       p[0] & 0xff, p[1] & 0xff);
1366*f330e785Schristos #endif
1367ecd7789bSchristos 		len = strlen(uaddr);
1368ecd7789bSchristos 		xlen = XDRALIGN(len);
1369ecd7789bSchristos 
1370ecd7789bSchristos 		/* Write new string length. */
1371ecd7789bSchristos 		bogo = htonl(len);
1372*f330e785Schristos 		COPYBACK(m, off, 4, (void *)&bogo);
1373ecd7789bSchristos 		off += 4;
1374ecd7789bSchristos 
1375ecd7789bSchristos 		/* Write new string. */
1376ecd7789bSchristos 		COPYBACK(m, off, xlen, uaddr);
1377ecd7789bSchristos 		off += xlen;
1378ecd7789bSchristos 
1379ecd7789bSchristos 		/* Record any change in length. */
1380ecd7789bSchristos 		diff += xlen - XDRALIGN(B(re->re_maddr.xu_xslen));
1381ecd7789bSchristos 
1382ecd7789bSchristos 		/* If the length changed, copy back the rest of this entry. */
1383ecd7789bSchristos 		len = ((char *)re->re_more + 4) -
1384ecd7789bSchristos 		       (char *)re->re_netid.xp_xslen;
1385ecd7789bSchristos 		if (diff != 0) {
1386*f330e785Schristos 			COPYBACK(m, off, len, (void *)re->re_netid.xp_xslen);
1387ecd7789bSchristos 		}
1388ecd7789bSchristos 		off += len;
1389ecd7789bSchristos 	}
1390ecd7789bSchristos 
1391ecd7789bSchristos 	/*
1392ecd7789bSchristos 	 * If our new string has a different length, make necessary
1393ecd7789bSchristos 	 * adjustments.
1394ecd7789bSchristos 	 */
1395ecd7789bSchristos 	if (diff != 0)
1396ecd7789bSchristos 		ipf_p_rpcb_fixlen(fin, diff);
1397ecd7789bSchristos 
1398ecd7789bSchristos 	return(diff);
1399ecd7789bSchristos }
1400ecd7789bSchristos 
1401ecd7789bSchristos 
1402ecd7789bSchristos /* --------------------------------------------------------------------	*/
1403ecd7789bSchristos /* Function:    ipf_p_rpcb_fixlen                                        */
1404ecd7789bSchristos /* Returns:     (void)                                                  */
1405ecd7789bSchristos /* Parameters:  fin(I)  - pointer to packet information                 */
1406ecd7789bSchristos /*              len(I)  - change in packet length                       */
1407ecd7789bSchristos /*                                                                      */
1408ecd7789bSchristos /* Adjust various packet related lengths held in structure and packet   */
1409ecd7789bSchristos /* header fields.                                                       */
1410ecd7789bSchristos /* --------------------------------------------------------------------	*/
1411ecd7789bSchristos static void
1412*f330e785Schristos ipf_p_rpcb_fixlen(fr_info_t *fin, int len)
1413ecd7789bSchristos {
1414ecd7789bSchristos         udphdr_t *udp;
1415ecd7789bSchristos 
1416ecd7789bSchristos         udp = fin->fin_dp;
1417ecd7789bSchristos         udp->uh_ulen = htons(ntohs(udp->uh_ulen) + len);
1418ecd7789bSchristos         fin->fin_plen += len;
1419ecd7789bSchristos         fin->fin_ip->ip_len = htons(fin->fin_plen);
1420ecd7789bSchristos         fin->fin_dlen += len;
1421ecd7789bSchristos }
1422ecd7789bSchristos 
1423ecd7789bSchristos #undef B
1424