xref: /netbsd-src/sys/net/npf/npf_inet.c (revision e89934bbf778a6d6d6894877c4da59d0c7835b0f) 
1 /*	$NetBSD: npf_inet.c,v 1.36 2016/12/26 23:05:06 christos Exp $	*/
2 
3 /*-
4  * Copyright (c) 2009-2014 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This material is based upon work partially supported by The
8  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * Various protocol related helper routines.
34  *
35  * This layer manipulates npf_cache_t structure i.e. caches requested headers
36  * and stores which information was cached in the information bit field.
37  * It is also responsibility of this layer to update or invalidate the cache
38  * on rewrites (e.g. by translation routines).
39  */
40 
41 #ifdef _KERNEL
42 #include <sys/cdefs.h>
43 __KERNEL_RCSID(0, "$NetBSD: npf_inet.c,v 1.36 2016/12/26 23:05:06 christos Exp $");
44 
45 #include <sys/param.h>
46 #include <sys/types.h>
47 
48 #include <net/pfil.h>
49 #include <net/if.h>
50 #include <net/ethertypes.h>
51 #include <net/if_ether.h>
52 
53 #include <netinet/in_systm.h>
54 #include <netinet/in.h>
55 #include <netinet6/in6_var.h>
56 #include <netinet/ip.h>
57 #include <netinet/ip6.h>
58 #include <netinet/tcp.h>
59 #include <netinet/udp.h>
60 #include <netinet/ip_icmp.h>
61 #endif
62 
63 #include "npf_impl.h"
64 
65 /*
66  * npf_fixup{16,32}_cksum: incremental update of the Internet checksum.
67  */
68 
69 uint16_t
70 npf_fixup16_cksum(uint16_t cksum, uint16_t odatum, uint16_t ndatum)
71 {
72 	uint32_t sum;
73 
74 	/*
75 	 * RFC 1624:
76 	 *	HC' = ~(~HC + ~m + m')
77 	 *
78 	 * Note: 1's complement sum is endian-independent (RFC 1071, page 2).
79 	 */
80 	sum = ~cksum & 0xffff;
81 	sum += (~odatum & 0xffff) + ndatum;
82 	sum = (sum >> 16) + (sum & 0xffff);
83 	sum += (sum >> 16);
84 
85 	return ~sum & 0xffff;
86 }
87 
88 uint16_t
89 npf_fixup32_cksum(uint16_t cksum, uint32_t odatum, uint32_t ndatum)
90 {
91 	uint32_t sum;
92 
93 	/*
94 	 * Checksum 32-bit datum as as two 16-bit.  Note, the first
95 	 * 32->16 bit reduction is not necessary.
96 	 */
97 	sum = ~cksum & 0xffff;
98 	sum += (~odatum & 0xffff) + (ndatum & 0xffff);
99 
100 	sum += (~odatum >> 16) + (ndatum >> 16);
101 	sum = (sum >> 16) + (sum & 0xffff);
102 	sum += (sum >> 16);
103 	return ~sum & 0xffff;
104 }
105 
106 /*
107  * npf_addr_cksum: calculate checksum of the address, either IPv4 or IPv6.
108  */
109 uint16_t
110 npf_addr_cksum(uint16_t cksum, int sz, const npf_addr_t *oaddr,
111     const npf_addr_t *naddr)
112 {
113 	const uint32_t *oip32 = (const uint32_t *)oaddr;
114 	const uint32_t *nip32 = (const uint32_t *)naddr;
115 
116 	KASSERT(sz % sizeof(uint32_t) == 0);
117 	do {
118 		cksum = npf_fixup32_cksum(cksum, *oip32++, *nip32++);
119 		sz -= sizeof(uint32_t);
120 	} while (sz);
121 
122 	return cksum;
123 }
124 
125 /*
126  * npf_addr_sum: provide IP addresses as a XORed 32-bit integer.
127  * Note: used for hash function.
128  */
129 uint32_t
130 npf_addr_mix(const int sz, const npf_addr_t *a1, const npf_addr_t *a2)
131 {
132 	uint32_t mix = 0;
133 
134 	KASSERT(sz > 0 && a1 != NULL && a2 != NULL);
135 
136 	for (int i = 0; i < (sz >> 2); i++) {
137 		mix ^= a1->word32[i];
138 		mix ^= a2->word32[i];
139 	}
140 	return mix;
141 }
142 
143 /*
144  * npf_addr_mask: apply the mask to a given address and store the result.
145  */
146 void
147 npf_addr_mask(const npf_addr_t *addr, const npf_netmask_t mask,
148     const int alen, npf_addr_t *out)
149 {
150 	const int nwords = alen >> 2;
151 	uint_fast8_t length = mask;
152 
153 	/* Note: maximum length is 32 for IPv4 and 128 for IPv6. */
154 	KASSERT(length <= NPF_MAX_NETMASK);
155 
156 	for (int i = 0; i < nwords; i++) {
157 		uint32_t wordmask;
158 
159 		if (length >= 32) {
160 			wordmask = htonl(0xffffffff);
161 			length -= 32;
162 		} else if (length) {
163 			wordmask = htonl(0xffffffff << (32 - length));
164 			length = 0;
165 		} else {
166 			wordmask = 0;
167 		}
168 		out->word32[i] = addr->word32[i] & wordmask;
169 	}
170 }
171 
172 /*
173  * npf_addr_cmp: compare two addresses, either IPv4 or IPv6.
174  *
175  * => Return 0 if equal and negative/positive if less/greater accordingly.
176  * => Ignore the mask, if NPF_NO_NETMASK is specified.
177  */
178 int
179 npf_addr_cmp(const npf_addr_t *addr1, const npf_netmask_t mask1,
180     const npf_addr_t *addr2, const npf_netmask_t mask2, const int alen)
181 {
182 	npf_addr_t realaddr1, realaddr2;
183 
184 	if (mask1 != NPF_NO_NETMASK) {
185 		npf_addr_mask(addr1, mask1, alen, &realaddr1);
186 		addr1 = &realaddr1;
187 	}
188 	if (mask2 != NPF_NO_NETMASK) {
189 		npf_addr_mask(addr2, mask2, alen, &realaddr2);
190 		addr2 = &realaddr2;
191 	}
192 	return memcmp(addr1, addr2, alen);
193 }
194 
195 /*
196  * npf_tcpsaw: helper to fetch SEQ, ACK, WIN and return TCP data length.
197  *
198  * => Returns all values in host byte-order.
199  */
200 int
201 npf_tcpsaw(const npf_cache_t *npc, tcp_seq *seq, tcp_seq *ack, uint32_t *win)
202 {
203 	const struct tcphdr *th = npc->npc_l4.tcp;
204 	u_int thlen;
205 
206 	KASSERT(npf_iscached(npc, NPC_TCP));
207 
208 	*seq = ntohl(th->th_seq);
209 	*ack = ntohl(th->th_ack);
210 	*win = (uint32_t)ntohs(th->th_win);
211 	thlen = th->th_off << 2;
212 
213 	if (npf_iscached(npc, NPC_IP4)) {
214 		const struct ip *ip = npc->npc_ip.v4;
215 		return ntohs(ip->ip_len) - npc->npc_hlen - thlen;
216 	} else if (npf_iscached(npc, NPC_IP6)) {
217 		const struct ip6_hdr *ip6 = npc->npc_ip.v6;
218 		return ntohs(ip6->ip6_plen) - thlen;
219 	}
220 	return 0;
221 }
222 
223 /*
224  * npf_fetch_tcpopts: parse and return TCP options.
225  */
226 bool
227 npf_fetch_tcpopts(npf_cache_t *npc, uint16_t *mss, int *wscale)
228 {
229 	nbuf_t *nbuf = npc->npc_nbuf;
230 	const struct tcphdr *th = npc->npc_l4.tcp;
231 	int topts_len, step;
232 	void *nptr;
233 	uint8_t val;
234 	bool ok;
235 
236 	KASSERT(npf_iscached(npc, NPC_IP46));
237 	KASSERT(npf_iscached(npc, NPC_TCP));
238 
239 	/* Determine if there are any TCP options, get their length. */
240 	topts_len = (th->th_off << 2) - sizeof(struct tcphdr);
241 	if (topts_len <= 0) {
242 		/* No options. */
243 		return false;
244 	}
245 	KASSERT(topts_len <= MAX_TCPOPTLEN);
246 
247 	/* First step: IP and TCP header up to options. */
248 	step = npc->npc_hlen + sizeof(struct tcphdr);
249 	nbuf_reset(nbuf);
250 next:
251 	if ((nptr = nbuf_advance(nbuf, step, 1)) == NULL) {
252 		ok = false;
253 		goto done;
254 	}
255 	val = *(uint8_t *)nptr;
256 
257 	switch (val) {
258 	case TCPOPT_EOL:
259 		/* Done. */
260 		ok = true;
261 		goto done;
262 	case TCPOPT_NOP:
263 		topts_len--;
264 		step = 1;
265 		break;
266 	case TCPOPT_MAXSEG:
267 		if ((nptr = nbuf_advance(nbuf, 2, 2)) == NULL) {
268 			ok = false;
269 			goto done;
270 		}
271 		if (mss) {
272 			if (*mss) {
273 				memcpy(nptr, mss, sizeof(uint16_t));
274 			} else {
275 				memcpy(mss, nptr, sizeof(uint16_t));
276 			}
277 		}
278 		topts_len -= TCPOLEN_MAXSEG;
279 		step = 2;
280 		break;
281 	case TCPOPT_WINDOW:
282 		/* TCP Window Scaling (RFC 1323). */
283 		if ((nptr = nbuf_advance(nbuf, 2, 1)) == NULL) {
284 			ok = false;
285 			goto done;
286 		}
287 		val = *(uint8_t *)nptr;
288 		*wscale = (val > TCP_MAX_WINSHIFT) ? TCP_MAX_WINSHIFT : val;
289 		topts_len -= TCPOLEN_WINDOW;
290 		step = 1;
291 		break;
292 	default:
293 		if ((nptr = nbuf_advance(nbuf, 1, 1)) == NULL) {
294 			ok = false;
295 			goto done;
296 		}
297 		val = *(uint8_t *)nptr;
298 		if (val < 2 || val > topts_len) {
299 			ok = false;
300 			goto done;
301 		}
302 		topts_len -= val;
303 		step = val - 1;
304 	}
305 
306 	/* Any options left? */
307 	if (__predict_true(topts_len > 0)) {
308 		goto next;
309 	}
310 	ok = true;
311 done:
312 	if (nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)) {
313 		npf_recache(npc);
314 	}
315 	return ok;
316 }
317 
318 static int
319 npf_cache_ip(npf_cache_t *npc, nbuf_t *nbuf)
320 {
321 	const void *nptr = nbuf_dataptr(nbuf);
322 	const uint8_t ver = *(const uint8_t *)nptr;
323 	int flags = 0;
324 
325 	switch (ver >> 4) {
326 	case IPVERSION: {
327 		struct ip *ip;
328 
329 		ip = nbuf_ensure_contig(nbuf, sizeof(struct ip));
330 		if (ip == NULL) {
331 			return 0;
332 		}
333 
334 		/* Check header length and fragment offset. */
335 		if ((u_int)(ip->ip_hl << 2) < sizeof(struct ip)) {
336 			return 0;
337 		}
338 		if (ip->ip_off & ~htons(IP_DF | IP_RF)) {
339 			/* Note fragmentation. */
340 			flags |= NPC_IPFRAG;
341 		}
342 
343 		/* Cache: layer 3 - IPv4. */
344 		npc->npc_alen = sizeof(struct in_addr);
345 		npc->npc_ips[NPF_SRC] = (npf_addr_t *)&ip->ip_src;
346 		npc->npc_ips[NPF_DST] = (npf_addr_t *)&ip->ip_dst;
347 		npc->npc_hlen = ip->ip_hl << 2;
348 		npc->npc_proto = ip->ip_p;
349 
350 		npc->npc_ip.v4 = ip;
351 		flags |= NPC_IP4;
352 		break;
353 	}
354 
355 	case (IPV6_VERSION >> 4): {
356 		struct ip6_hdr *ip6;
357 		struct ip6_ext *ip6e;
358 		size_t off, hlen;
359 
360 		ip6 = nbuf_ensure_contig(nbuf, sizeof(struct ip6_hdr));
361 		if (ip6 == NULL) {
362 			return 0;
363 		}
364 
365 		/* Set initial next-protocol value. */
366 		hlen = sizeof(struct ip6_hdr);
367 		npc->npc_proto = ip6->ip6_nxt;
368 		npc->npc_hlen = hlen;
369 
370 		/*
371 		 * Advance by the length of the current header.
372 		 */
373 		off = nbuf_offset(nbuf);
374 		while (nbuf_advance(nbuf, hlen, 0) != NULL) {
375 			ip6e = nbuf_ensure_contig(nbuf, sizeof(*ip6e));
376 			if (ip6e == NULL) {
377 				return 0;
378 			}
379 
380 			/*
381 			 * Determine whether we are going to continue.
382 			 */
383 			switch (npc->npc_proto) {
384 			case IPPROTO_HOPOPTS:
385 			case IPPROTO_DSTOPTS:
386 			case IPPROTO_ROUTING:
387 				hlen = (ip6e->ip6e_len + 1) << 3;
388 				break;
389 			case IPPROTO_FRAGMENT:
390 				hlen = sizeof(struct ip6_frag);
391 				flags |= NPC_IPFRAG;
392 				break;
393 			case IPPROTO_AH:
394 				hlen = (ip6e->ip6e_len + 2) << 2;
395 				break;
396 			default:
397 				hlen = 0;
398 				break;
399 			}
400 
401 			if (!hlen) {
402 				break;
403 			}
404 			npc->npc_proto = ip6e->ip6e_nxt;
405 			npc->npc_hlen += hlen;
406 		}
407 
408 		/*
409 		 * Re-fetch the header pointers (nbufs might have been
410 		 * reallocated).  Restore the original offset (if any).
411 		 */
412 		nbuf_reset(nbuf);
413 		ip6 = nbuf_dataptr(nbuf);
414 		if (off) {
415 			nbuf_advance(nbuf, off, 0);
416 		}
417 
418 		/* Cache: layer 3 - IPv6. */
419 		npc->npc_alen = sizeof(struct in6_addr);
420 		npc->npc_ips[NPF_SRC] = (npf_addr_t *)&ip6->ip6_src;
421 		npc->npc_ips[NPF_DST]= (npf_addr_t *)&ip6->ip6_dst;
422 
423 		npc->npc_ip.v6 = ip6;
424 		flags |= NPC_IP6;
425 		break;
426 	}
427 	default:
428 		break;
429 	}
430 	return flags;
431 }
432 
433 /*
434  * npf_cache_all: general routine to cache all relevant IP (v4 or v6)
435  * and TCP, UDP or ICMP headers.
436  *
437  * => nbuf offset shall be set accordingly.
438  */
439 int
440 npf_cache_all(npf_cache_t *npc)
441 {
442 	nbuf_t *nbuf = npc->npc_nbuf;
443 	int flags, l4flags;
444 	u_int hlen;
445 
446 	/*
447 	 * This routine is a main point where the references are cached,
448 	 * therefore clear the flag as we reset.
449 	 */
450 again:
451 	nbuf_unset_flag(nbuf, NBUF_DATAREF_RESET);
452 
453 	/*
454 	 * First, cache the L3 header (IPv4 or IPv6).  If IP packet is
455 	 * fragmented, then we cannot look into L4.
456 	 */
457 	flags = npf_cache_ip(npc, nbuf);
458 	if ((flags & NPC_IP46) == 0 || (flags & NPC_IPFRAG) != 0) {
459 		nbuf_unset_flag(nbuf, NBUF_DATAREF_RESET);
460 		npc->npc_info |= flags;
461 		return flags;
462 	}
463 	hlen = npc->npc_hlen;
464 
465 	switch (npc->npc_proto) {
466 	case IPPROTO_TCP:
467 		/* Cache: layer 4 - TCP. */
468 		npc->npc_l4.tcp = nbuf_advance(nbuf, hlen,
469 		    sizeof(struct tcphdr));
470 		l4flags = NPC_LAYER4 | NPC_TCP;
471 		break;
472 	case IPPROTO_UDP:
473 		/* Cache: layer 4 - UDP. */
474 		npc->npc_l4.udp = nbuf_advance(nbuf, hlen,
475 		    sizeof(struct udphdr));
476 		l4flags = NPC_LAYER4 | NPC_UDP;
477 		break;
478 	case IPPROTO_ICMP:
479 		/* Cache: layer 4 - ICMPv4. */
480 		npc->npc_l4.icmp = nbuf_advance(nbuf, hlen,
481 		    offsetof(struct icmp, icmp_void));
482 		l4flags = NPC_LAYER4 | NPC_ICMP;
483 		break;
484 	case IPPROTO_ICMPV6:
485 		/* Cache: layer 4 - ICMPv6. */
486 		npc->npc_l4.icmp6 = nbuf_advance(nbuf, hlen,
487 		    offsetof(struct icmp6_hdr, icmp6_data32));
488 		l4flags = NPC_LAYER4 | NPC_ICMP;
489 		break;
490 	default:
491 		l4flags = 0;
492 		break;
493 	}
494 
495 	if (nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)) {
496 		goto again;
497 	}
498 
499 	/* Add the L4 flags if nbuf_advance() succeeded. */
500 	if (l4flags && npc->npc_l4.hdr) {
501 		flags |= l4flags;
502 	}
503 	npc->npc_info |= flags;
504 	return flags;
505 }
506 
507 void
508 npf_recache(npf_cache_t *npc)
509 {
510 	nbuf_t *nbuf = npc->npc_nbuf;
511 	const int mflags __diagused = npc->npc_info & (NPC_IP46 | NPC_LAYER4);
512 	int flags __diagused;
513 
514 	nbuf_reset(nbuf);
515 	npc->npc_info = 0;
516 	flags = npf_cache_all(npc);
517 
518 	KASSERT((flags & mflags) == mflags);
519 	KASSERT(nbuf_flag_p(nbuf, NBUF_DATAREF_RESET) == 0);
520 }
521 
522 /*
523  * npf_rwrip: rewrite required IP address.
524  */
525 bool
526 npf_rwrip(const npf_cache_t *npc, u_int which, const npf_addr_t *addr)
527 {
528 	KASSERT(npf_iscached(npc, NPC_IP46));
529 	KASSERT(which == NPF_SRC || which == NPF_DST);
530 
531 	memcpy(npc->npc_ips[which], addr, npc->npc_alen);
532 	return true;
533 }
534 
535 /*
536  * npf_rwrport: rewrite required TCP/UDP port.
537  */
538 bool
539 npf_rwrport(const npf_cache_t *npc, u_int which, const in_port_t port)
540 {
541 	const int proto = npc->npc_proto;
542 	in_port_t *oport;
543 
544 	KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP));
545 	KASSERT(proto == IPPROTO_TCP || proto == IPPROTO_UDP);
546 	KASSERT(which == NPF_SRC || which == NPF_DST);
547 
548 	/* Get the offset and store the port in it. */
549 	if (proto == IPPROTO_TCP) {
550 		struct tcphdr *th = npc->npc_l4.tcp;
551 		oport = (which == NPF_SRC) ? &th->th_sport : &th->th_dport;
552 	} else {
553 		struct udphdr *uh = npc->npc_l4.udp;
554 		oport = (which == NPF_SRC) ? &uh->uh_sport : &uh->uh_dport;
555 	}
556 	memcpy(oport, &port, sizeof(in_port_t));
557 	return true;
558 }
559 
560 /*
561  * npf_rwrcksum: rewrite IPv4 and/or TCP/UDP checksum.
562  */
563 bool
564 npf_rwrcksum(const npf_cache_t *npc, u_int which,
565     const npf_addr_t *addr, const in_port_t port)
566 {
567 	const npf_addr_t *oaddr = npc->npc_ips[which];
568 	const int proto = npc->npc_proto;
569 	const int alen = npc->npc_alen;
570 	uint16_t *ocksum;
571 	in_port_t oport;
572 
573 	KASSERT(npf_iscached(npc, NPC_LAYER4));
574 	KASSERT(which == NPF_SRC || which == NPF_DST);
575 
576 	if (npf_iscached(npc, NPC_IP4)) {
577 		struct ip *ip = npc->npc_ip.v4;
578 		uint16_t ipsum = ip->ip_sum;
579 
580 		/* Recalculate IPv4 checksum and rewrite. */
581 		ip->ip_sum = npf_addr_cksum(ipsum, alen, oaddr, addr);
582 	} else {
583 		/* No checksum for IPv6. */
584 		KASSERT(npf_iscached(npc, NPC_IP6));
585 	}
586 
587 	/* Nothing else to do for ICMP. */
588 	if (proto == IPPROTO_ICMP || proto == IPPROTO_ICMPV6) {
589 		return true;
590 	}
591 	KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP));
592 
593 	/*
594 	 * Calculate TCP/UDP checksum:
595 	 * - Skip if UDP and the current checksum is zero.
596 	 * - Fixup the IP address change.
597 	 * - Fixup the port change, if required (non-zero).
598 	 */
599 	if (proto == IPPROTO_TCP) {
600 		struct tcphdr *th = npc->npc_l4.tcp;
601 
602 		ocksum = &th->th_sum;
603 		oport = (which == NPF_SRC) ? th->th_sport : th->th_dport;
604 	} else {
605 		struct udphdr *uh = npc->npc_l4.udp;
606 
607 		KASSERT(proto == IPPROTO_UDP);
608 		ocksum = &uh->uh_sum;
609 		if (*ocksum == 0) {
610 			/* No need to update. */
611 			return true;
612 		}
613 		oport = (which == NPF_SRC) ? uh->uh_sport : uh->uh_dport;
614 	}
615 
616 	uint16_t cksum = npf_addr_cksum(*ocksum, alen, oaddr, addr);
617 	if (port) {
618 		cksum = npf_fixup16_cksum(cksum, oport, port);
619 	}
620 
621 	/* Rewrite TCP/UDP checksum. */
622 	memcpy(ocksum, &cksum, sizeof(uint16_t));
623 	return true;
624 }
625 
626 /*
627  * npf_napt_rwr: perform address and/or port translation.
628  */
629 int
630 npf_napt_rwr(const npf_cache_t *npc, u_int which,
631     const npf_addr_t *addr, const in_addr_t port)
632 {
633 	const unsigned proto = npc->npc_proto;
634 
635 	/*
636 	 * Rewrite IP and/or TCP/UDP checksums first, since we need the
637 	 * current (old) address/port for the calculations.  Then perform
638 	 * the address translation i.e. rewrite source or destination.
639 	 */
640 	if (!npf_rwrcksum(npc, which, addr, port)) {
641 		return EINVAL;
642 	}
643 	if (!npf_rwrip(npc, which, addr)) {
644 		return EINVAL;
645 	}
646 	if (port == 0) {
647 		/* Done. */
648 		return 0;
649 	}
650 
651 	switch (proto) {
652 	case IPPROTO_TCP:
653 	case IPPROTO_UDP:
654 		/* Rewrite source/destination port. */
655 		if (!npf_rwrport(npc, which, port)) {
656 			return EINVAL;
657 		}
658 		break;
659 	case IPPROTO_ICMP:
660 	case IPPROTO_ICMPV6:
661 		KASSERT(npf_iscached(npc, NPC_ICMP));
662 		/* Nothing. */
663 		break;
664 	default:
665 		return ENOTSUP;
666 	}
667 	return 0;
668 }
669 
670 /*
671  * IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296.
672  */
673 
674 int
675 npf_npt66_rwr(const npf_cache_t *npc, u_int which, const npf_addr_t *pref,
676     npf_netmask_t len, uint16_t adj)
677 {
678 	npf_addr_t *addr = npc->npc_ips[which];
679 	unsigned remnant, word, preflen = len >> 4;
680 	uint32_t sum;
681 
682 	KASSERT(which == NPF_SRC || which == NPF_DST);
683 
684 	if (!npf_iscached(npc, NPC_IP6)) {
685 		return EINVAL;
686 	}
687 	if (len <= 48) {
688 		/*
689 		 * The word to adjust.  Cannot translate the 0xffff
690 		 * subnet if /48 or shorter.
691 		 */
692 		word = 3;
693 		if (addr->word16[word] == 0xffff) {
694 			return EINVAL;
695 		}
696 	} else {
697 		/*
698 		 * Also, all 0s or 1s in the host part are disallowed for
699 		 * longer than /48 prefixes.
700 		 */
701 		if ((addr->word32[2] == 0 && addr->word32[3] == 0) ||
702 		    (addr->word32[2] == ~0U && addr->word32[3] == ~0U))
703 			return EINVAL;
704 
705 		/* Determine the 16-bit word to adjust. */
706 		for (word = 4; word < 8; word++)
707 			if (addr->word16[word] != 0xffff)
708 				break;
709 	}
710 
711 	/* Rewrite the prefix. */
712 	for (unsigned i = 0; i < preflen; i++) {
713 		addr->word16[i] = pref->word16[i];
714 	}
715 
716 	/*
717 	 * If prefix length is within a 16-bit word (not dividable by 16),
718 	 * then prepare a mask, determine the word and adjust it.
719 	 */
720 	if ((remnant = len - (preflen << 4)) != 0) {
721 		const uint16_t wordmask = (1U << remnant) - 1;
722 		const unsigned i = preflen;
723 
724 		addr->word16[i] = (pref->word16[i] & wordmask) |
725 		    (addr->word16[i] & ~wordmask);
726 	}
727 
728 	/*
729 	 * Performing 1's complement sum/difference.
730 	 */
731 	sum = addr->word16[word] + adj;
732 	while (sum >> 16) {
733 		sum = (sum >> 16) + (sum & 0xffff);
734 	}
735 	if (sum == 0xffff) {
736 		/* RFC 1071. */
737 		sum = 0x0000;
738 	}
739 	addr->word16[word] = sum;
740 	return 0;
741 }
742 
743 #if defined(DDB) || defined(_NPF_TESTING)
744 
745 const char *
746 npf_addr_dump(const npf_addr_t *addr, int alen)
747 {
748 	if (alen == sizeof(struct in_addr)) {
749 		struct in_addr ip;
750 		memcpy(&ip, addr, alen);
751 		return inet_ntoa(ip);
752 	}
753 	return "[IPv6]";
754 }
755 
756 #endif
757