diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h --- a/sys/net/pfvar.h +++ b/sys/net/pfvar.h @@ -2563,11 +2563,12 @@ struct pf_addr *, struct pf_addr *, struct pfi_kkif **nkif, struct pf_addr *, struct pf_ksrc_node **); -struct pf_krule *pf_get_translation(struct pf_pdesc *, struct mbuf *, +u_short pf_get_translation(struct pf_pdesc *, struct mbuf *, int, struct pfi_kkif *, struct pf_ksrc_node **, struct pf_state_key **, struct pf_state_key **, struct pf_addr *, struct pf_addr *, - uint16_t, uint16_t, struct pf_kanchor_stackframe *); + uint16_t, uint16_t, struct pf_kanchor_stackframe *, + struct pf_krule **); struct pf_state_key *pf_state_key_setup(struct pf_pdesc *, struct pf_addr *, struct pf_addr *, u_int16_t, u_int16_t); diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -4429,7 +4429,7 @@ struct pf_ksrc_node *nsn = NULL; struct tcphdr *th = &pd->hdr.tcp; struct pf_state_key *sk = NULL, *nk = NULL; - u_short reason; + u_short reason, transerror; int rewrite = 0, hdrlen = 0; int tag = -1; int asd = 0; @@ -4442,6 +4442,8 @@ PF_RULES_RASSERT(); + SLIST_INIT(&match_rules); + if (inp != NULL) { INP_LOCK_ASSERT(inp); pd->lookup.uid = inp->inp_cred->cr_uid; @@ -4506,8 +4508,17 @@ r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr); /* check packet for BINAT/NAT/RDR */ - if ((nr = pf_get_translation(pd, m, off, kif, &nsn, &sk, - &nk, saddr, daddr, sport, dport, anchor_stack)) != NULL) { + transerror = pf_get_translation(pd, m, off, kif, &nsn, &sk, + &nk, saddr, daddr, sport, dport, anchor_stack, &nr); + switch (transerror) { + default: + /* A translation error occurred. */ + REASON_SET(&reason, transerror); + goto cleanup; + case PFRES_MAX: + /* No match. */ + break; + case PFRES_MATCH: KASSERT(sk != NULL, ("%s: null sk", __func__)); KASSERT(nk != NULL, ("%s: null nk", __func__)); @@ -4657,7 +4668,6 @@ pd->nat_rule = nr; } - SLIST_INIT(&match_rules); while (r != NULL) { pf_counter_u64_add(&r->evaluations, 1); if (pfi_kkif_match(r->kif, kif) == r->ifnot) diff --git a/sys/netpfil/pf/pf_lb.c b/sys/netpfil/pf/pf_lb.c --- a/sys/netpfil/pf/pf_lb.c +++ b/sys/netpfil/pf/pf_lb.c @@ -574,22 +574,26 @@ return (reason); } -struct pf_krule * +u_short pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off, struct pfi_kkif *kif, struct pf_ksrc_node **sn, struct pf_state_key **skp, struct pf_state_key **nkp, struct pf_addr *saddr, struct pf_addr *daddr, - uint16_t sport, uint16_t dport, struct pf_kanchor_stackframe *anchor_stack) + uint16_t sport, uint16_t dport, struct pf_kanchor_stackframe *anchor_stack, + struct pf_krule **rp) { struct pf_krule *r = NULL; struct pf_addr *naddr; uint16_t *nportp; uint16_t low, high; + u_short reason; PF_RULES_RASSERT(); KASSERT(*skp == NULL, ("*skp not NULL")); KASSERT(*nkp == NULL, ("*nkp not NULL")); + *rp = NULL; + if (pd->dir == PF_OUT) { r = pf_match_translation(pd, m, off, kif, saddr, sport, daddr, dport, PF_RULESET_BINAT, anchor_stack); @@ -607,23 +611,23 @@ } if (r == NULL) - return (NULL); + return (PFRES_MAX); switch (r->action) { case PF_NONAT: case PF_NOBINAT: case PF_NORDR: - return (NULL); + return (PFRES_MAX); } *skp = pf_state_key_setup(pd, saddr, daddr, sport, dport); if (*skp == NULL) - return (NULL); + return (PFRES_MEMORY); *nkp = pf_state_key_clone(*skp); if (*nkp == NULL) { uma_zfree(V_pf_state_key_z, *skp); *skp = NULL; - return (NULL); + return (PFRES_MEMORY); } naddr = &(*nkp)->addr[1]; @@ -647,6 +651,7 @@ r->rpool.mape.offset, r->rpool.mape.psidlen, r->rpool.mape.psid)); + reason = PFRES_MAPFAILED; goto notrans; } } else if (pf_get_sport(pd->af, pd->proto, r, saddr, sport, @@ -654,6 +659,7 @@ DPFPRINTF(PF_DEBUG_MISC, ("pf: NAT proxy port allocation (%u-%u) failed\n", r->rpool.proxy_port[0], r->rpool.proxy_port[1])); + reason = PFRES_MAPFAILED; goto notrans; } break; @@ -665,8 +671,10 @@ #ifdef INET case AF_INET: if (r->rpool.cur->addr.p.dyn-> - pfid_acnt4 < 1) + pfid_acnt4 < 1) { + reason = PFRES_MAPFAILED; goto notrans; + } PF_POOLMASK(naddr, &r->rpool.cur->addr.p.dyn-> pfid_addr4, @@ -677,8 +685,10 @@ #ifdef INET6 case AF_INET6: if (r->rpool.cur->addr.p.dyn-> - pfid_acnt6 < 1) + pfid_acnt6 < 1) { + reason = PFRES_MAPFAILED; goto notrans; + } PF_POOLMASK(naddr, &r->rpool.cur->addr.p.dyn-> pfid_addr6, @@ -698,8 +708,10 @@ switch (pd->af) { #ifdef INET case AF_INET: - if (r->src.addr.p.dyn-> pfid_acnt4 < 1) + if (r->src.addr.p.dyn->pfid_acnt4 < 1) { + reason = PFRES_MAPFAILED; goto notrans; + } PF_POOLMASK(naddr, &r->src.addr.p.dyn->pfid_addr4, &r->src.addr.p.dyn->pfid_mask4, @@ -708,8 +720,10 @@ #endif /* INET */ #ifdef INET6 case AF_INET6: - if (r->src.addr.p.dyn->pfid_acnt6 < 1) + if (r->src.addr.p.dyn->pfid_acnt6 < 1) { + reason = PFRES_MAPFAILED; goto notrans; + } PF_POOLMASK(naddr, &r->src.addr.p.dyn->pfid_addr6, &r->src.addr.p.dyn->pfid_mask6, @@ -727,7 +741,8 @@ struct pf_state_key_cmp key; uint16_t cut, low, high, nport; - if (pf_map_addr(pd->af, r, saddr, naddr, NULL, NULL, sn)) + reason = pf_map_addr(pd->af, r, saddr, naddr, NULL, NULL, sn); + if (reason != 0) goto notrans; if ((r->rpool.opts & PF_POOL_TYPEMASK) == PF_POOL_BITMASK) PF_POOLMASK(naddr, naddr, &r->rpool.cur->addr.v.a.mask, @@ -791,12 +806,13 @@ DPFPRINTF(PF_DEBUG_MISC, ("pf: RDR source port allocation failed\n")); - if (0) { + reason = PFRES_MAPFAILED; + goto notrans; + out: - DPFPRINTF(PF_DEBUG_MISC, - ("pf: RDR source port allocation %u->%u\n", - ntohs(sport), ntohs((*nkp)->port[0]))); - } + DPFPRINTF(PF_DEBUG_MISC, + ("pf: RDR source port allocation %u->%u\n", + ntohs(sport), ntohs((*nkp)->port[0]))); break; } default: @@ -804,14 +820,17 @@ } /* Return success only if translation really happened. */ - if (bcmp(*skp, *nkp, sizeof(struct pf_state_key_cmp))) - return (r); + if (bcmp(*skp, *nkp, sizeof(struct pf_state_key_cmp))) { + *rp = r; + return (PFRES_MATCH); + } + reason = PFRES_MAX; notrans: uma_zfree(V_pf_state_key_z, *nkp); uma_zfree(V_pf_state_key_z, *skp); *skp = *nkp = NULL; *sn = NULL; - return (NULL); + return (reason); }