xref: /netbsd-src/sys/net/npf/npf_inet.c (revision ba65fde2d7fefa7d39838fa5fa855e62bd606b5e) 
1 /*	$NetBSD: npf_inet.c,v 1.21 2013/02/09 03:35:32 rmind Exp $	*/
2 
3 /*-
4  * Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This material is based upon work partially supported by The
8  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * Various procotol related helper routines.
34  *
35  * This layer manipulates npf_cache_t structure i.e. caches requested headers
36  * and stores which information was cached in the information bit field.
37  * It is also responsibility of this layer to update or invalidate the cache
38  * on rewrites (e.g. by translation routines).
39  */
40 
41 #include <sys/cdefs.h>
42 __KERNEL_RCSID(0, "$NetBSD: npf_inet.c,v 1.21 2013/02/09 03:35:32 rmind Exp $");
43 
44 #include <sys/param.h>
45 #include <sys/types.h>
46 
47 #include <net/pfil.h>
48 #include <net/if.h>
49 #include <net/ethertypes.h>
50 #include <net/if_ether.h>
51 
52 #include <netinet/in_systm.h>
53 #include <netinet/in.h>
54 #include <netinet/ip.h>
55 #include <netinet/ip6.h>
56 #include <netinet/tcp.h>
57 #include <netinet/udp.h>
58 #include <netinet/ip_icmp.h>
59 
60 #include "npf_impl.h"
61 
62 /*
63  * npf_fixup{16,32}_cksum: update IPv4 checksum.
64  */
65 
66 uint16_t
67 npf_fixup16_cksum(uint16_t cksum, uint16_t odatum, uint16_t ndatum)
68 {
69 	uint32_t sum;
70 
71 	/*
72 	 * RFC 1624:
73 	 *	HC' = ~(~HC + ~m + m')
74 	 */
75 	sum = ~ntohs(cksum) & 0xffff;
76 	sum += (~ntohs(odatum) & 0xffff) + ntohs(ndatum);
77 	sum = (sum >> 16) + (sum & 0xffff);
78 	sum += (sum >> 16);
79 
80 	return htons(~sum & 0xffff);
81 }
82 
83 uint16_t
84 npf_fixup32_cksum(uint16_t cksum, uint32_t odatum, uint32_t ndatum)
85 {
86 
87 	cksum = npf_fixup16_cksum(cksum, odatum & 0xffff, ndatum & 0xffff);
88 	cksum = npf_fixup16_cksum(cksum, odatum >> 16, ndatum >> 16);
89 	return cksum;
90 }
91 
92 /*
93  * npf_addr_cksum: calculate checksum of the address, either IPv4 or IPv6.
94  */
95 uint16_t
96 npf_addr_cksum(uint16_t cksum, int sz, const npf_addr_t *oaddr,
97     const npf_addr_t *naddr)
98 {
99 	const uint32_t *oip32 = (const uint32_t *)oaddr;
100 	const uint32_t *nip32 = (const uint32_t *)naddr;
101 
102 	KASSERT(sz % sizeof(uint32_t) == 0);
103 	do {
104 		cksum = npf_fixup32_cksum(cksum, *oip32++, *nip32++);
105 		sz -= sizeof(uint32_t);
106 	} while (sz);
107 
108 	return cksum;
109 }
110 
111 /*
112  * npf_addr_sum: provide IP address as a summed (if needed) 32-bit integer.
113  * Note: used for hash function.
114  */
115 uint32_t
116 npf_addr_sum(const int sz, const npf_addr_t *a1, const npf_addr_t *a2)
117 {
118 	uint32_t mix = 0;
119 	int i;
120 
121 	KASSERT(sz > 0 && a1 != NULL && a2 != NULL);
122 
123 	for (i = 0; i < (sz >> 2); i++) {
124 		mix += a1->s6_addr32[i];
125 		mix += a2->s6_addr32[i];
126 	}
127 	return mix;
128 }
129 
130 /*
131  * npf_addr_mask: apply the mask to a given address and store the result.
132  */
133 void
134 npf_addr_mask(const npf_addr_t *addr, const npf_netmask_t mask,
135     const int alen, npf_addr_t *out)
136 {
137 	const int nwords = alen >> 2;
138 	uint_fast8_t length = mask;
139 
140 	/* Note: maximum length is 32 for IPv4 and 128 for IPv6. */
141 	KASSERT(length <= NPF_MAX_NETMASK);
142 
143 	for (int i = 0; i < nwords; i++) {
144 		uint32_t wordmask;
145 
146 		if (length >= 32) {
147 			wordmask = htonl(0xffffffff);
148 			length -= 32;
149 		} else if (length) {
150 			wordmask = htonl(0xffffffff << (32 - length));
151 			length = 0;
152 		} else {
153 			wordmask = 0;
154 		}
155 		out->s6_addr32[i] = addr->s6_addr32[i] & wordmask;
156 	}
157 }
158 
159 /*
160  * npf_addr_cmp: compare two addresses, either IPv4 or IPv6.
161  *
162  * => Return 0 if equal and negative/positive if less/greater accordingly.
163  * => Ignore the mask, if NPF_NO_NETMASK is specified.
164  */
165 int
166 npf_addr_cmp(const npf_addr_t *addr1, const npf_netmask_t mask1,
167     const npf_addr_t *addr2, const npf_netmask_t mask2, const int alen)
168 {
169 	npf_addr_t realaddr1, realaddr2;
170 
171 	if (mask1 != NPF_NO_NETMASK) {
172 		npf_addr_mask(addr1, mask1, alen, &realaddr1);
173 		addr1 = &realaddr1;
174 	}
175 	if (mask2 != NPF_NO_NETMASK) {
176 		npf_addr_mask(addr2, mask2, alen, &realaddr2);
177 		addr2 = &realaddr2;
178 	}
179 	return memcmp(addr1, addr2, alen);
180 }
181 
182 /*
183  * npf_tcpsaw: helper to fetch SEQ, ACK, WIN and return TCP data length.
184  *
185  * => Returns all values in host byte-order.
186  */
187 int
188 npf_tcpsaw(const npf_cache_t *npc, tcp_seq *seq, tcp_seq *ack, uint32_t *win)
189 {
190 	const struct tcphdr *th = npc->npc_l4.tcp;
191 	u_int thlen;
192 
193 	KASSERT(npf_iscached(npc, NPC_TCP));
194 
195 	*seq = ntohl(th->th_seq);
196 	*ack = ntohl(th->th_ack);
197 	*win = (uint32_t)ntohs(th->th_win);
198 	thlen = th->th_off << 2;
199 
200 	if (npf_iscached(npc, NPC_IP4)) {
201 		const struct ip *ip = npc->npc_ip.v4;
202 		return ntohs(ip->ip_len) - npc->npc_hlen - thlen;
203 	} else if (npf_iscached(npc, NPC_IP6)) {
204 		const struct ip6_hdr *ip6 = npc->npc_ip.v6;
205 		return ntohs(ip6->ip6_plen) - thlen;
206 	}
207 	return 0;
208 }
209 
210 /*
211  * npf_fetch_tcpopts: parse and return TCP options.
212  */
213 bool
214 npf_fetch_tcpopts(npf_cache_t *npc, nbuf_t *nbuf, uint16_t *mss, int *wscale)
215 {
216 	const struct tcphdr *th = npc->npc_l4.tcp;
217 	int topts_len, step;
218 	void *nptr;
219 	uint8_t val;
220 	bool ok;
221 
222 	KASSERT(npf_iscached(npc, NPC_IP46));
223 	KASSERT(npf_iscached(npc, NPC_TCP));
224 
225 	/* Determine if there are any TCP options, get their length. */
226 	topts_len = (th->th_off << 2) - sizeof(struct tcphdr);
227 	if (topts_len <= 0) {
228 		/* No options. */
229 		return false;
230 	}
231 	KASSERT(topts_len <= MAX_TCPOPTLEN);
232 
233 	/* First step: IP and TCP header up to options. */
234 	step = npc->npc_hlen + sizeof(struct tcphdr);
235 	nbuf_reset(nbuf);
236 next:
237 	if ((nptr = nbuf_advance(nbuf, step, 1)) == NULL) {
238 		ok = false;
239 		goto done;
240 	}
241 	val = *(uint8_t *)nptr;
242 
243 	switch (val) {
244 	case TCPOPT_EOL:
245 		/* Done. */
246 		ok = true;
247 		goto done;
248 	case TCPOPT_NOP:
249 		topts_len--;
250 		step = 1;
251 		break;
252 	case TCPOPT_MAXSEG:
253 		if ((nptr = nbuf_advance(nbuf, 2, 2)) == NULL) {
254 			ok = false;
255 			goto done;
256 		}
257 		if (mss) {
258 			if (*mss) {
259 				memcpy(nptr, mss, sizeof(uint16_t));
260 			} else {
261 				memcpy(mss, nptr, sizeof(uint16_t));
262 			}
263 		}
264 		topts_len -= TCPOLEN_MAXSEG;
265 		step = 2;
266 		break;
267 	case TCPOPT_WINDOW:
268 		/* TCP Window Scaling (RFC 1323). */
269 		if ((nptr = nbuf_advance(nbuf, 2, 1)) == NULL) {
270 			ok = false;
271 			goto done;
272 		}
273 		val = *(uint8_t *)nptr;
274 		*wscale = (val > TCP_MAX_WINSHIFT) ? TCP_MAX_WINSHIFT : val;
275 		topts_len -= TCPOLEN_WINDOW;
276 		step = 1;
277 		break;
278 	default:
279 		if ((nptr = nbuf_advance(nbuf, 1, 1)) == NULL) {
280 			ok = false;
281 			goto done;
282 		}
283 		val = *(uint8_t *)nptr;
284 		if (val < 2 || val > topts_len) {
285 			ok = false;
286 			goto done;
287 		}
288 		topts_len -= val;
289 		step = val - 1;
290 	}
291 
292 	/* Any options left? */
293 	if (__predict_true(topts_len > 0)) {
294 		goto next;
295 	}
296 	ok = true;
297 done:
298 	if (nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)) {
299 		npf_recache(npc, nbuf);
300 	}
301 	return ok;
302 }
303 
304 static int
305 npf_cache_ip(npf_cache_t *npc, nbuf_t *nbuf)
306 {
307 	const void *nptr = nbuf_dataptr(nbuf);
308 	const uint8_t ver = *(const uint8_t *)nptr;
309 	int flags = 0;
310 
311 	switch (ver >> 4) {
312 	case IPVERSION: {
313 		struct ip *ip;
314 
315 		ip = nbuf_ensure_contig(nbuf, sizeof(struct ip));
316 		if (ip == NULL) {
317 			return 0;
318 		}
319 
320 		/* Check header length and fragment offset. */
321 		if ((u_int)(ip->ip_hl << 2) < sizeof(struct ip)) {
322 			return 0;
323 		}
324 		if (ip->ip_off & ~htons(IP_DF | IP_RF)) {
325 			/* Note fragmentation. */
326 			flags |= NPC_IPFRAG;
327 		}
328 
329 		/* Cache: layer 3 - IPv4. */
330 		npc->npc_alen = sizeof(struct in_addr);
331 		npc->npc_srcip = (npf_addr_t *)&ip->ip_src;
332 		npc->npc_dstip = (npf_addr_t *)&ip->ip_dst;
333 		npc->npc_hlen = ip->ip_hl << 2;
334 		npc->npc_proto = ip->ip_p;
335 
336 		npc->npc_ip.v4 = ip;
337 		flags |= NPC_IP4;
338 		break;
339 	}
340 
341 	case (IPV6_VERSION >> 4): {
342 		struct ip6_hdr *ip6;
343 		struct ip6_ext *ip6e;
344 		size_t off, hlen;
345 
346 		ip6 = nbuf_ensure_contig(nbuf, sizeof(struct ip6_hdr));
347 		if (ip6 == NULL) {
348 			return 0;
349 		}
350 
351 		/* Set initial next-protocol value. */
352 		hlen = sizeof(struct ip6_hdr);
353 		npc->npc_proto = ip6->ip6_nxt;
354 		npc->npc_hlen = hlen;
355 
356 		/*
357 		 * Advance by the length of the current header.
358 		 */
359 		off = nbuf_offset(nbuf);
360 		while (nbuf_advance(nbuf, hlen, 0) != NULL) {
361 			ip6e = nbuf_ensure_contig(nbuf, sizeof(*ip6e));
362 			if (ip6e == NULL) {
363 				return 0;
364 			}
365 
366 			/*
367 			 * Determine whether we are going to continue.
368 			 */
369 			switch (npc->npc_proto) {
370 			case IPPROTO_HOPOPTS:
371 			case IPPROTO_DSTOPTS:
372 			case IPPROTO_ROUTING:
373 				hlen = (ip6e->ip6e_len + 1) << 3;
374 				break;
375 			case IPPROTO_FRAGMENT:
376 				hlen = sizeof(struct ip6_frag);
377 				flags |= NPC_IPFRAG;
378 				break;
379 			case IPPROTO_AH:
380 				hlen = (ip6e->ip6e_len + 2) << 2;
381 				break;
382 			default:
383 				hlen = 0;
384 				break;
385 			}
386 
387 			if (!hlen) {
388 				break;
389 			}
390 			npc->npc_proto = ip6e->ip6e_nxt;
391 			npc->npc_hlen += hlen;
392 		}
393 
394 		/* Restore the offset. */
395 		nbuf_reset(nbuf);
396 		if (off) {
397 			nbuf_advance(nbuf, off, 0);
398 		}
399 
400 		/* Cache: layer 3 - IPv6. */
401 		npc->npc_alen = sizeof(struct in6_addr);
402 		npc->npc_srcip = (npf_addr_t *)&ip6->ip6_src;
403 		npc->npc_dstip = (npf_addr_t *)&ip6->ip6_dst;
404 
405 		npc->npc_ip.v6 = ip6;
406 		flags |= NPC_IP6;
407 		break;
408 	}
409 	default:
410 		break;
411 	}
412 	return flags;
413 }
414 
415 /*
416  * npf_cache_all: general routine to cache all relevant IP (v4 or v6)
417  * and TCP, UDP or ICMP headers.
418  *
419  * => nbuf offset shall be set accordingly.
420  */
421 int
422 npf_cache_all(npf_cache_t *npc, nbuf_t *nbuf)
423 {
424 	int flags, l4flags;
425 	u_int hlen;
426 
427 	/*
428 	 * This routine is a main point where the references are cached,
429 	 * therefore clear the flag as we reset.
430 	 */
431 again:
432 	nbuf_unset_flag(nbuf, NBUF_DATAREF_RESET);
433 
434 	/*
435 	 * First, cache the L3 header (IPv4 or IPv6).  If IP packet is
436 	 * fragmented, then we cannot look into L4.
437 	 */
438 	flags = npf_cache_ip(npc, nbuf);
439 	if ((flags & NPC_IP46) == 0 || (flags & NPC_IPFRAG) != 0) {
440 		npc->npc_info |= flags;
441 		return flags;
442 	}
443 	hlen = npc->npc_hlen;
444 
445 	switch (npc->npc_proto) {
446 	case IPPROTO_TCP:
447 		/* Cache: layer 4 - TCP. */
448 		npc->npc_l4.tcp = nbuf_advance(nbuf, hlen,
449 		    sizeof(struct tcphdr));
450 		l4flags = NPC_LAYER4 | NPC_TCP;
451 		break;
452 	case IPPROTO_UDP:
453 		/* Cache: layer 4 - UDP. */
454 		npc->npc_l4.udp = nbuf_advance(nbuf, hlen,
455 		    sizeof(struct udphdr));
456 		l4flags = NPC_LAYER4 | NPC_UDP;
457 		break;
458 	case IPPROTO_ICMP:
459 		/* Cache: layer 4 - ICMPv4. */
460 		npc->npc_l4.icmp = nbuf_advance(nbuf, hlen,
461 		    offsetof(struct icmp, icmp_void));
462 		l4flags = NPC_LAYER4 | NPC_ICMP;
463 		break;
464 	case IPPROTO_ICMPV6:
465 		/* Cache: layer 4 - ICMPv6. */
466 		npc->npc_l4.icmp6 = nbuf_advance(nbuf, hlen,
467 		    offsetof(struct icmp6_hdr, icmp6_data32));
468 		l4flags = NPC_LAYER4 | NPC_ICMP;
469 		break;
470 	default:
471 		l4flags = 0;
472 		break;
473 	}
474 
475 	if (nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)) {
476 		goto again;
477 	}
478 
479 	/* Add the L4 flags if nbuf_advance() succeeded. */
480 	if (l4flags && npc->npc_l4.hdr) {
481 		flags |= l4flags;
482 	}
483 	npc->npc_info |= flags;
484 	return flags;
485 }
486 
487 void
488 npf_recache(npf_cache_t *npc, nbuf_t *nbuf)
489 {
490 	const int mflags __unused = npc->npc_info & (NPC_IP46 | NPC_LAYER4);
491 	int flags;
492 
493 	nbuf_reset(nbuf);
494 	npc->npc_info = 0;
495 	flags = npf_cache_all(npc, nbuf);
496 	KASSERT((flags & mflags) == mflags);
497 	KASSERT(nbuf_flag_p(nbuf, NBUF_DATAREF_RESET) == 0);
498 }
499 
500 /*
501  * npf_rwrip: rewrite required IP address.
502  */
503 bool
504 npf_rwrip(const npf_cache_t *npc, int di, const npf_addr_t *addr)
505 {
506 	npf_addr_t *oaddr;
507 
508 	KASSERT(npf_iscached(npc, NPC_IP46));
509 
510 	/*
511 	 * Rewrite source address if outgoing and destination if incoming.
512 	 */
513 	oaddr = (di == PFIL_OUT) ? npc->npc_srcip : npc->npc_dstip;
514 	memcpy(oaddr, addr, npc->npc_alen);
515 	return true;
516 }
517 
518 /*
519  * npf_rwrport: rewrite required TCP/UDP port.
520  */
521 bool
522 npf_rwrport(const npf_cache_t *npc, int di, const in_port_t port)
523 {
524 	const int proto = npc->npc_proto;
525 	in_port_t *oport;
526 
527 	KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP));
528 	KASSERT(proto == IPPROTO_TCP || proto == IPPROTO_UDP);
529 
530 	/* Get the offset and store the port in it. */
531 	if (proto == IPPROTO_TCP) {
532 		struct tcphdr *th = npc->npc_l4.tcp;
533 		oport = (di == PFIL_OUT) ? &th->th_sport : &th->th_dport;
534 	} else {
535 		struct udphdr *uh = npc->npc_l4.udp;
536 		oport = (di == PFIL_OUT) ? &uh->uh_sport : &uh->uh_dport;
537 	}
538 	memcpy(oport, &port, sizeof(in_port_t));
539 	return true;
540 }
541 
542 /*
543  * npf_rwrcksum: rewrite IPv4 and/or TCP/UDP checksum.
544  */
545 bool
546 npf_rwrcksum(const npf_cache_t *npc, const int di,
547     const npf_addr_t *addr, const in_port_t port)
548 {
549 	const int proto = npc->npc_proto;
550 	const int alen = npc->npc_alen;
551 	npf_addr_t *oaddr;
552 	uint16_t *ocksum;
553 	in_port_t oport;
554 
555 	KASSERT(npf_iscached(npc, NPC_LAYER4));
556 	oaddr = (di == PFIL_OUT) ? npc->npc_srcip : npc->npc_dstip;
557 
558 	if (npf_iscached(npc, NPC_IP4)) {
559 		struct ip *ip = npc->npc_ip.v4;
560 		uint16_t ipsum = ip->ip_sum;
561 
562 		/* Recalculate IPv4 checksum and rewrite. */
563 		ip->ip_sum = npf_addr_cksum(ipsum, alen, oaddr, addr);
564 	} else {
565 		/* No checksum for IPv6. */
566 		KASSERT(npf_iscached(npc, NPC_IP6));
567 	}
568 
569 	/* Nothing else to do for ICMP. */
570 	if (proto == IPPROTO_ICMP) {
571 		return true;
572 	}
573 	KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP));
574 
575 	/*
576 	 * Calculate TCP/UDP checksum:
577 	 * - Skip if UDP and the current checksum is zero.
578 	 * - Fixup the IP address change.
579 	 * - Fixup the port change, if required (non-zero).
580 	 */
581 	if (proto == IPPROTO_TCP) {
582 		struct tcphdr *th = npc->npc_l4.tcp;
583 
584 		ocksum = &th->th_sum;
585 		oport = (di == PFIL_OUT) ? th->th_sport : th->th_dport;
586 	} else {
587 		struct udphdr *uh = npc->npc_l4.udp;
588 
589 		KASSERT(proto == IPPROTO_UDP);
590 		ocksum = &uh->uh_sum;
591 		if (*ocksum == 0) {
592 			/* No need to update. */
593 			return true;
594 		}
595 		oport = (di == PFIL_OUT) ? uh->uh_sport : uh->uh_dport;
596 	}
597 
598 	uint16_t cksum = npf_addr_cksum(*ocksum, alen, oaddr, addr);
599 	if (port) {
600 		cksum = npf_fixup16_cksum(cksum, oport, port);
601 	}
602 
603 	/* Rewrite TCP/UDP checksum. */
604 	memcpy(ocksum, &cksum, sizeof(uint16_t));
605 	return true;
606 }
607 
608 #if defined(DDB) || defined(_NPF_TESTING)
609 
610 void
611 npf_addr_dump(const npf_addr_t *addr)
612 {
613 	printf("IP[%x:%x:%x:%x]\n",
614 	    addr->s6_addr32[0], addr->s6_addr32[1],
615 	    addr->s6_addr32[2], addr->s6_addr32[3]);
616 }
617 
618 #endif
619