1 /*- 2 * Copyright (c) 2009-2014 The NetBSD Foundation, Inc. 3 * All rights reserved. 4 * 5 * This material is based upon work partially supported by The 6 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 18 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 19 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 20 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 21 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 22 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 23 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 24 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 25 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 26 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 27 * POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 /* 31 * Various protocol related helper routines. 32 * 33 * This layer manipulates npf_cache_t structure i.e. caches requested headers 34 * and stores which information was cached in the information bit field. 35 * It is also responsibility of this layer to update or invalidate the cache 36 * on rewrites (e.g. by translation routines). 37 */ 38 39 #ifdef _KERNEL 40 #include <sys/cdefs.h> 41 __KERNEL_RCSID(0, "$NetBSD: npf_inet.c,v 1.53 2019/01/19 21:19:32 rmind Exp $"); 42 43 #include <sys/param.h> 44 #include <sys/types.h> 45 46 #include <net/pfil.h> 47 #include <net/if.h> 48 #include <net/ethertypes.h> 49 #include <net/if_ether.h> 50 51 #include <netinet/in_systm.h> 52 #include <netinet/in.h> 53 #include <netinet6/in6_var.h> 54 #include <netinet/ip.h> 55 #include <netinet/ip6.h> 56 #include <netinet/tcp.h> 57 #include <netinet/udp.h> 58 #include <netinet/ip_icmp.h> 59 #endif 60 61 #include "npf_impl.h" 62 63 /* 64 * npf_fixup{16,32}_cksum: incremental update of the Internet checksum. 65 */ 66 67 uint16_t 68 npf_fixup16_cksum(uint16_t cksum, uint16_t odatum, uint16_t ndatum) 69 { 70 uint32_t sum; 71 72 /* 73 * RFC 1624: 74 * HC' = ~(~HC + ~m + m') 75 * 76 * Note: 1's complement sum is endian-independent (RFC 1071, page 2). 77 */ 78 sum = ~cksum & 0xffff; 79 sum += (~odatum & 0xffff) + ndatum; 80 sum = (sum >> 16) + (sum & 0xffff); 81 sum += (sum >> 16); 82 83 return ~sum & 0xffff; 84 } 85 86 uint16_t 87 npf_fixup32_cksum(uint16_t cksum, uint32_t odatum, uint32_t ndatum) 88 { 89 uint32_t sum; 90 91 /* 92 * Checksum 32-bit datum as as two 16-bit. Note, the first 93 * 32->16 bit reduction is not necessary. 94 */ 95 sum = ~cksum & 0xffff; 96 sum += (~odatum & 0xffff) + (ndatum & 0xffff); 97 98 sum += (~odatum >> 16) + (ndatum >> 16); 99 sum = (sum >> 16) + (sum & 0xffff); 100 sum += (sum >> 16); 101 return ~sum & 0xffff; 102 } 103 104 /* 105 * npf_addr_cksum: calculate checksum of the address, either IPv4 or IPv6. 106 */ 107 uint16_t 108 npf_addr_cksum(uint16_t cksum, int sz, const npf_addr_t *oaddr, 109 const npf_addr_t *naddr) 110 { 111 const uint32_t *oip32 = (const uint32_t *)oaddr; 112 const uint32_t *nip32 = (const uint32_t *)naddr; 113 114 KASSERT(sz % sizeof(uint32_t) == 0); 115 do { 116 cksum = npf_fixup32_cksum(cksum, *oip32++, *nip32++); 117 sz -= sizeof(uint32_t); 118 } while (sz); 119 120 return cksum; 121 } 122 123 /* 124 * npf_addr_sum: provide IP addresses as a XORed 32-bit integer. 125 * Note: used for hash function. 126 */ 127 uint32_t 128 npf_addr_mix(const int alen, const npf_addr_t *a1, const npf_addr_t *a2) 129 { 130 const int nwords = alen >> 2; 131 uint32_t mix = 0; 132 133 KASSERT(alen > 0 && a1 != NULL && a2 != NULL); 134 135 for (int i = 0; i < nwords; i++) { 136 mix ^= a1->word32[i]; 137 mix ^= a2->word32[i]; 138 } 139 return mix; 140 } 141 142 /* 143 * npf_addr_mask: apply the mask to a given address and store the result. 144 */ 145 void 146 npf_addr_mask(const npf_addr_t *addr, const npf_netmask_t mask, 147 const int alen, npf_addr_t *out) 148 { 149 const int nwords = alen >> 2; 150 uint_fast8_t length = mask; 151 152 /* Note: maximum length is 32 for IPv4 and 128 for IPv6. */ 153 KASSERT(length <= NPF_MAX_NETMASK); 154 155 for (int i = 0; i < nwords; i++) { 156 uint32_t wordmask; 157 158 if (length >= 32) { 159 wordmask = htonl(0xffffffff); 160 length -= 32; 161 } else if (length) { 162 wordmask = htonl(0xffffffff << (32 - length)); 163 length = 0; 164 } else { 165 wordmask = 0; 166 } 167 out->word32[i] = addr->word32[i] & wordmask; 168 } 169 } 170 171 /* 172 * npf_addr_bitor: bitwise OR the host part (given the netmask). 173 * Zero mask can be used to OR the entire address. 174 */ 175 void 176 npf_addr_bitor(const npf_addr_t *addr, const npf_netmask_t mask, 177 const int alen, npf_addr_t *out) 178 { 179 const int nwords = alen >> 2; 180 uint_fast8_t length = mask; 181 182 /* Note: maximum length is 32 for IPv4 and 128 for IPv6. */ 183 KASSERT(length <= NPF_MAX_NETMASK); 184 185 for (int i = 0; i < nwords; i++) { 186 uint32_t wordmask; 187 188 if (length >= 32) { 189 wordmask = htonl(0xffffffff); 190 length -= 32; 191 } else if (length) { 192 wordmask = htonl(0xffffffff << (32 - length)); 193 length = 0; 194 } else { 195 wordmask = 0; 196 } 197 out->word32[i] |= addr->word32[i] & ~wordmask; 198 } 199 } 200 201 /* 202 * npf_addr_cmp: compare two addresses, either IPv4 or IPv6. 203 * 204 * => Return 0 if equal and negative/positive if less/greater accordingly. 205 * => Ignore the mask, if NPF_NO_NETMASK is specified. 206 */ 207 int 208 npf_addr_cmp(const npf_addr_t *addr1, const npf_netmask_t mask1, 209 const npf_addr_t *addr2, const npf_netmask_t mask2, const int alen) 210 { 211 npf_addr_t realaddr1, realaddr2; 212 213 if (mask1 != NPF_NO_NETMASK) { 214 npf_addr_mask(addr1, mask1, alen, &realaddr1); 215 addr1 = &realaddr1; 216 } 217 if (mask2 != NPF_NO_NETMASK) { 218 npf_addr_mask(addr2, mask2, alen, &realaddr2); 219 addr2 = &realaddr2; 220 } 221 return memcmp(addr1, addr2, alen); 222 } 223 224 /* 225 * npf_tcpsaw: helper to fetch SEQ, ACK, WIN and return TCP data length. 226 * 227 * => Returns all values in host byte-order. 228 */ 229 int 230 npf_tcpsaw(const npf_cache_t *npc, tcp_seq *seq, tcp_seq *ack, uint32_t *win) 231 { 232 const struct tcphdr *th = npc->npc_l4.tcp; 233 u_int thlen; 234 235 KASSERT(npf_iscached(npc, NPC_TCP)); 236 237 *seq = ntohl(th->th_seq); 238 *ack = ntohl(th->th_ack); 239 *win = (uint32_t)ntohs(th->th_win); 240 thlen = th->th_off << 2; 241 242 if (npf_iscached(npc, NPC_IP4)) { 243 const struct ip *ip = npc->npc_ip.v4; 244 return ntohs(ip->ip_len) - npc->npc_hlen - thlen; 245 } else if (npf_iscached(npc, NPC_IP6)) { 246 const struct ip6_hdr *ip6 = npc->npc_ip.v6; 247 return ntohs(ip6->ip6_plen) - 248 (npc->npc_hlen - sizeof(*ip6)) - thlen; 249 } 250 return 0; 251 } 252 253 /* 254 * npf_fetch_tcpopts: parse and return TCP options. 255 */ 256 bool 257 npf_fetch_tcpopts(npf_cache_t *npc, uint16_t *mss, int *wscale) 258 { 259 nbuf_t *nbuf = npc->npc_nbuf; 260 const struct tcphdr *th = npc->npc_l4.tcp; 261 int cnt, optlen = 0; 262 uint8_t *cp, opt; 263 uint8_t val; 264 bool ok; 265 266 KASSERT(npf_iscached(npc, NPC_IP46)); 267 KASSERT(npf_iscached(npc, NPC_TCP)); 268 269 /* Determine if there are any TCP options, get their length. */ 270 cnt = (th->th_off << 2) - sizeof(struct tcphdr); 271 if (cnt <= 0) { 272 /* No options. */ 273 return false; 274 } 275 KASSERT(cnt <= MAX_TCPOPTLEN); 276 277 /* Fetch all the options at once. */ 278 nbuf_reset(nbuf); 279 const int step = npc->npc_hlen + sizeof(struct tcphdr); 280 if ((cp = nbuf_advance(nbuf, step, cnt)) == NULL) { 281 ok = false; 282 goto done; 283 } 284 285 /* Scan the options. */ 286 for (; cnt > 0; cnt -= optlen, cp += optlen) { 287 opt = cp[0]; 288 if (opt == TCPOPT_EOL) 289 break; 290 if (opt == TCPOPT_NOP) 291 optlen = 1; 292 else { 293 if (cnt < 2) 294 break; 295 optlen = cp[1]; 296 if (optlen < 2 || optlen > cnt) 297 break; 298 } 299 300 switch (opt) { 301 case TCPOPT_MAXSEG: 302 if (optlen != TCPOLEN_MAXSEG) 303 continue; 304 if (mss) { 305 memcpy(mss, cp + 2, sizeof(uint16_t)); 306 } 307 break; 308 case TCPOPT_WINDOW: 309 if (optlen != TCPOLEN_WINDOW) 310 continue; 311 val = *(cp + 2); 312 *wscale = (val > TCP_MAX_WINSHIFT) ? TCP_MAX_WINSHIFT : val; 313 break; 314 default: 315 break; 316 } 317 } 318 319 ok = true; 320 done: 321 if (nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)) { 322 npf_recache(npc); 323 } 324 return ok; 325 } 326 327 /* 328 * npf_set_mss: set the MSS. 329 */ 330 bool 331 npf_set_mss(npf_cache_t *npc, uint16_t mss, uint16_t *old, uint16_t *new, 332 bool *mid) 333 { 334 nbuf_t *nbuf = npc->npc_nbuf; 335 const struct tcphdr *th = npc->npc_l4.tcp; 336 int cnt, optlen = 0; 337 uint8_t *cp, *base, opt; 338 bool ok; 339 340 KASSERT(npf_iscached(npc, NPC_IP46)); 341 KASSERT(npf_iscached(npc, NPC_TCP)); 342 343 /* Determine if there are any TCP options, get their length. */ 344 cnt = (th->th_off << 2) - sizeof(struct tcphdr); 345 if (cnt <= 0) { 346 /* No options. */ 347 return false; 348 } 349 KASSERT(cnt <= MAX_TCPOPTLEN); 350 351 /* Fetch all the options at once. */ 352 nbuf_reset(nbuf); 353 const int step = npc->npc_hlen + sizeof(struct tcphdr); 354 if ((base = nbuf_advance(nbuf, step, cnt)) == NULL) { 355 ok = false; 356 goto done; 357 } 358 359 /* Scan the options. */ 360 for (cp = base; cnt > 0; cnt -= optlen, cp += optlen) { 361 opt = cp[0]; 362 if (opt == TCPOPT_EOL) 363 break; 364 if (opt == TCPOPT_NOP) 365 optlen = 1; 366 else { 367 if (cnt < 2) 368 break; 369 optlen = cp[1]; 370 if (optlen < 2 || optlen > cnt) 371 break; 372 } 373 374 switch (opt) { 375 case TCPOPT_MAXSEG: 376 if (optlen != TCPOLEN_MAXSEG) 377 continue; 378 if (((cp + 2) - base) % sizeof(uint16_t) != 0) { 379 *mid = true; 380 memcpy(&old[0], cp + 1, sizeof(uint16_t)); 381 memcpy(&old[1], cp + 3, sizeof(uint16_t)); 382 memcpy(cp + 2, &mss, sizeof(uint16_t)); 383 memcpy(&new[0], cp + 1, sizeof(uint16_t)); 384 memcpy(&new[1], cp + 3, sizeof(uint16_t)); 385 } else { 386 *mid = false; 387 memcpy(cp + 2, &mss, sizeof(uint16_t)); 388 } 389 break; 390 default: 391 break; 392 } 393 } 394 395 ok = true; 396 done: 397 if (nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)) { 398 npf_recache(npc); 399 } 400 return ok; 401 } 402 403 static int 404 npf_cache_ip(npf_cache_t *npc, nbuf_t *nbuf) 405 { 406 const void *nptr = nbuf_dataptr(nbuf); 407 const uint8_t ver = *(const uint8_t *)nptr; 408 int flags = 0; 409 410 /* 411 * We intentionally don't read the L4 payload after IPPROTO_AH. 412 */ 413 414 switch (ver >> 4) { 415 case IPVERSION: { 416 struct ip *ip; 417 418 ip = nbuf_ensure_contig(nbuf, sizeof(struct ip)); 419 if (ip == NULL) { 420 return NPC_FMTERR; 421 } 422 423 /* Retrieve the complete header. */ 424 if ((u_int)(ip->ip_hl << 2) < sizeof(struct ip)) { 425 return NPC_FMTERR; 426 } 427 ip = nbuf_ensure_contig(nbuf, (u_int)(ip->ip_hl << 2)); 428 if (ip == NULL) { 429 return NPC_FMTERR; 430 } 431 432 if (ip->ip_off & ~htons(IP_DF | IP_RF)) { 433 /* Note fragmentation. */ 434 flags |= NPC_IPFRAG; 435 } 436 437 /* Cache: layer 3 - IPv4. */ 438 npc->npc_alen = sizeof(struct in_addr); 439 npc->npc_ips[NPF_SRC] = (npf_addr_t *)&ip->ip_src; 440 npc->npc_ips[NPF_DST] = (npf_addr_t *)&ip->ip_dst; 441 npc->npc_hlen = ip->ip_hl << 2; 442 npc->npc_proto = ip->ip_p; 443 444 npc->npc_ip.v4 = ip; 445 flags |= NPC_IP4; 446 break; 447 } 448 449 case (IPV6_VERSION >> 4): { 450 struct ip6_hdr *ip6; 451 struct ip6_ext *ip6e; 452 struct ip6_frag *ip6f; 453 size_t off, hlen; 454 int frag_present; 455 456 ip6 = nbuf_ensure_contig(nbuf, sizeof(struct ip6_hdr)); 457 if (ip6 == NULL) { 458 return NPC_FMTERR; 459 } 460 461 /* 462 * XXX: We don't handle IPv6 Jumbograms. 463 */ 464 465 /* Set initial next-protocol value. */ 466 hlen = sizeof(struct ip6_hdr); 467 npc->npc_proto = ip6->ip6_nxt; 468 npc->npc_hlen = hlen; 469 470 frag_present = 0; 471 472 /* 473 * Advance by the length of the current header. 474 */ 475 off = nbuf_offset(nbuf); 476 while ((ip6e = nbuf_advance(nbuf, hlen, sizeof(*ip6e))) != NULL) { 477 /* 478 * Determine whether we are going to continue. 479 */ 480 switch (npc->npc_proto) { 481 case IPPROTO_HOPOPTS: 482 case IPPROTO_DSTOPTS: 483 case IPPROTO_ROUTING: 484 hlen = (ip6e->ip6e_len + 1) << 3; 485 break; 486 case IPPROTO_FRAGMENT: 487 if (frag_present++) 488 return NPC_FMTERR; 489 ip6f = nbuf_ensure_contig(nbuf, sizeof(*ip6f)); 490 if (ip6f == NULL) 491 return NPC_FMTERR; 492 493 /* RFC6946: Skip dummy fragments. */ 494 if (!ntohs(ip6f->ip6f_offlg & IP6F_OFF_MASK) && 495 !(ip6f->ip6f_offlg & IP6F_MORE_FRAG)) { 496 hlen = sizeof(struct ip6_frag); 497 break; 498 } 499 500 hlen = 0; 501 flags |= NPC_IPFRAG; 502 503 break; 504 default: 505 hlen = 0; 506 break; 507 } 508 509 if (!hlen) { 510 break; 511 } 512 npc->npc_proto = ip6e->ip6e_nxt; 513 npc->npc_hlen += hlen; 514 } 515 516 if (ip6e == NULL) { 517 return NPC_FMTERR; 518 } 519 520 /* 521 * Re-fetch the header pointers (nbufs might have been 522 * reallocated). Restore the original offset (if any). 523 */ 524 nbuf_reset(nbuf); 525 ip6 = nbuf_dataptr(nbuf); 526 if (off) { 527 nbuf_advance(nbuf, off, 0); 528 } 529 530 /* Cache: layer 3 - IPv6. */ 531 npc->npc_alen = sizeof(struct in6_addr); 532 npc->npc_ips[NPF_SRC] = (npf_addr_t *)&ip6->ip6_src; 533 npc->npc_ips[NPF_DST] = (npf_addr_t *)&ip6->ip6_dst; 534 535 npc->npc_ip.v6 = ip6; 536 flags |= NPC_IP6; 537 break; 538 } 539 default: 540 break; 541 } 542 return flags; 543 } 544 545 /* 546 * npf_cache_all: general routine to cache all relevant IP (v4 or v6) 547 * and TCP, UDP or ICMP headers. 548 * 549 * => nbuf offset shall be set accordingly. 550 */ 551 int 552 npf_cache_all(npf_cache_t *npc) 553 { 554 nbuf_t *nbuf = npc->npc_nbuf; 555 int flags, l4flags; 556 u_int hlen; 557 558 /* 559 * This routine is a main point where the references are cached, 560 * therefore clear the flag as we reset. 561 */ 562 again: 563 nbuf_unset_flag(nbuf, NBUF_DATAREF_RESET); 564 565 /* 566 * First, cache the L3 header (IPv4 or IPv6). If IP packet is 567 * fragmented, then we cannot look into L4. 568 */ 569 flags = npf_cache_ip(npc, nbuf); 570 if ((flags & NPC_IP46) == 0 || (flags & NPC_IPFRAG) != 0 || 571 (flags & NPC_FMTERR) != 0) { 572 goto out; 573 } 574 hlen = npc->npc_hlen; 575 576 /* 577 * Note: we guarantee that the potential "Query Id" field of the 578 * ICMPv4/ICMPv6 packets is in the nbuf. This field is used in the 579 * ICMP ALG. 580 */ 581 switch (npc->npc_proto) { 582 case IPPROTO_TCP: 583 /* Cache: layer 4 - TCP. */ 584 npc->npc_l4.tcp = nbuf_advance(nbuf, hlen, 585 sizeof(struct tcphdr)); 586 l4flags = NPC_LAYER4 | NPC_TCP; 587 break; 588 case IPPROTO_UDP: 589 /* Cache: layer 4 - UDP. */ 590 npc->npc_l4.udp = nbuf_advance(nbuf, hlen, 591 sizeof(struct udphdr)); 592 l4flags = NPC_LAYER4 | NPC_UDP; 593 break; 594 case IPPROTO_ICMP: 595 /* Cache: layer 4 - ICMPv4. */ 596 npc->npc_l4.icmp = nbuf_advance(nbuf, hlen, 597 ICMP_MINLEN); 598 l4flags = NPC_LAYER4 | NPC_ICMP; 599 break; 600 case IPPROTO_ICMPV6: 601 /* Cache: layer 4 - ICMPv6. */ 602 npc->npc_l4.icmp6 = nbuf_advance(nbuf, hlen, 603 sizeof(struct icmp6_hdr)); 604 l4flags = NPC_LAYER4 | NPC_ICMP; 605 break; 606 default: 607 l4flags = 0; 608 break; 609 } 610 611 /* Error out if nbuf_advance failed. */ 612 if (l4flags && npc->npc_l4.hdr == NULL) { 613 goto err; 614 } 615 616 if (nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)) { 617 goto again; 618 } 619 620 flags |= l4flags; 621 npc->npc_info |= flags; 622 return flags; 623 624 err: 625 flags = NPC_FMTERR; 626 out: 627 nbuf_unset_flag(nbuf, NBUF_DATAREF_RESET); 628 npc->npc_info |= flags; 629 return flags; 630 } 631 632 void 633 npf_recache(npf_cache_t *npc) 634 { 635 nbuf_t *nbuf = npc->npc_nbuf; 636 const int mflags __diagused = npc->npc_info & (NPC_IP46 | NPC_LAYER4); 637 int flags __diagused; 638 639 nbuf_reset(nbuf); 640 npc->npc_info = 0; 641 flags = npf_cache_all(npc); 642 643 KASSERT((flags & mflags) == mflags); 644 KASSERT(nbuf_flag_p(nbuf, NBUF_DATAREF_RESET) == 0); 645 } 646 647 /* 648 * npf_rwrip: rewrite required IP address. 649 */ 650 bool 651 npf_rwrip(const npf_cache_t *npc, u_int which, const npf_addr_t *addr) 652 { 653 KASSERT(npf_iscached(npc, NPC_IP46)); 654 KASSERT(which == NPF_SRC || which == NPF_DST); 655 656 memcpy(npc->npc_ips[which], addr, npc->npc_alen); 657 return true; 658 } 659 660 /* 661 * npf_rwrport: rewrite required TCP/UDP port. 662 */ 663 bool 664 npf_rwrport(const npf_cache_t *npc, u_int which, const in_port_t port) 665 { 666 const int proto = npc->npc_proto; 667 in_port_t *oport; 668 669 KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP)); 670 KASSERT(proto == IPPROTO_TCP || proto == IPPROTO_UDP); 671 KASSERT(which == NPF_SRC || which == NPF_DST); 672 673 /* Get the offset and store the port in it. */ 674 if (proto == IPPROTO_TCP) { 675 struct tcphdr *th = npc->npc_l4.tcp; 676 oport = (which == NPF_SRC) ? &th->th_sport : &th->th_dport; 677 } else { 678 struct udphdr *uh = npc->npc_l4.udp; 679 oport = (which == NPF_SRC) ? &uh->uh_sport : &uh->uh_dport; 680 } 681 memcpy(oport, &port, sizeof(in_port_t)); 682 return true; 683 } 684 685 /* 686 * npf_rwrcksum: rewrite IPv4 and/or TCP/UDP checksum. 687 */ 688 bool 689 npf_rwrcksum(const npf_cache_t *npc, u_int which, 690 const npf_addr_t *addr, const in_port_t port) 691 { 692 const npf_addr_t *oaddr = npc->npc_ips[which]; 693 const int proto = npc->npc_proto; 694 const int alen = npc->npc_alen; 695 uint16_t *ocksum; 696 in_port_t oport; 697 698 KASSERT(npf_iscached(npc, NPC_LAYER4)); 699 KASSERT(which == NPF_SRC || which == NPF_DST); 700 701 if (npf_iscached(npc, NPC_IP4)) { 702 struct ip *ip = npc->npc_ip.v4; 703 uint16_t ipsum = ip->ip_sum; 704 705 /* Recalculate IPv4 checksum and rewrite. */ 706 ip->ip_sum = npf_addr_cksum(ipsum, alen, oaddr, addr); 707 } else { 708 /* No checksum for IPv6. */ 709 KASSERT(npf_iscached(npc, NPC_IP6)); 710 } 711 712 /* Nothing else to do for ICMP. */ 713 if (proto == IPPROTO_ICMP || proto == IPPROTO_ICMPV6) { 714 return true; 715 } 716 KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP)); 717 718 /* 719 * Calculate TCP/UDP checksum: 720 * - Skip if UDP and the current checksum is zero. 721 * - Fixup the IP address change. 722 * - Fixup the port change, if required (non-zero). 723 */ 724 if (proto == IPPROTO_TCP) { 725 struct tcphdr *th = npc->npc_l4.tcp; 726 727 ocksum = &th->th_sum; 728 oport = (which == NPF_SRC) ? th->th_sport : th->th_dport; 729 } else { 730 struct udphdr *uh = npc->npc_l4.udp; 731 732 KASSERT(proto == IPPROTO_UDP); 733 ocksum = &uh->uh_sum; 734 if (*ocksum == 0) { 735 /* No need to update. */ 736 return true; 737 } 738 oport = (which == NPF_SRC) ? uh->uh_sport : uh->uh_dport; 739 } 740 741 uint16_t cksum = npf_addr_cksum(*ocksum, alen, oaddr, addr); 742 if (port) { 743 cksum = npf_fixup16_cksum(cksum, oport, port); 744 } 745 746 /* Rewrite TCP/UDP checksum. */ 747 memcpy(ocksum, &cksum, sizeof(uint16_t)); 748 return true; 749 } 750 751 /* 752 * npf_napt_rwr: perform address and/or port translation. 753 */ 754 int 755 npf_napt_rwr(const npf_cache_t *npc, u_int which, 756 const npf_addr_t *addr, const in_addr_t port) 757 { 758 const unsigned proto = npc->npc_proto; 759 760 /* 761 * Rewrite IP and/or TCP/UDP checksums first, since we need the 762 * current (old) address/port for the calculations. Then perform 763 * the address translation i.e. rewrite source or destination. 764 */ 765 if (!npf_rwrcksum(npc, which, addr, port)) { 766 return EINVAL; 767 } 768 if (!npf_rwrip(npc, which, addr)) { 769 return EINVAL; 770 } 771 if (port == 0) { 772 /* Done. */ 773 return 0; 774 } 775 776 switch (proto) { 777 case IPPROTO_TCP: 778 case IPPROTO_UDP: 779 /* Rewrite source/destination port. */ 780 if (!npf_rwrport(npc, which, port)) { 781 return EINVAL; 782 } 783 break; 784 case IPPROTO_ICMP: 785 case IPPROTO_ICMPV6: 786 KASSERT(npf_iscached(npc, NPC_ICMP)); 787 /* Nothing. */ 788 break; 789 default: 790 return ENOTSUP; 791 } 792 return 0; 793 } 794 795 /* 796 * IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296. 797 */ 798 int 799 npf_npt66_rwr(const npf_cache_t *npc, u_int which, const npf_addr_t *pref, 800 npf_netmask_t len, uint16_t adj) 801 { 802 npf_addr_t *addr = npc->npc_ips[which]; 803 unsigned remnant, word, preflen = len >> 4; 804 uint32_t sum; 805 806 KASSERT(which == NPF_SRC || which == NPF_DST); 807 808 if (!npf_iscached(npc, NPC_IP6)) { 809 return EINVAL; 810 } 811 if (len <= 48) { 812 /* 813 * The word to adjust. Cannot translate the 0xffff 814 * subnet if /48 or shorter. 815 */ 816 word = 3; 817 if (addr->word16[word] == 0xffff) { 818 return EINVAL; 819 } 820 } else { 821 /* 822 * Also, all 0s or 1s in the host part are disallowed for 823 * longer than /48 prefixes. 824 */ 825 if ((addr->word32[2] == 0 && addr->word32[3] == 0) || 826 (addr->word32[2] == ~0U && addr->word32[3] == ~0U)) 827 return EINVAL; 828 829 /* Determine the 16-bit word to adjust. */ 830 for (word = 4; word < 8; word++) 831 if (addr->word16[word] != 0xffff) 832 break; 833 } 834 835 /* Rewrite the prefix. */ 836 for (unsigned i = 0; i < preflen; i++) { 837 addr->word16[i] = pref->word16[i]; 838 } 839 840 /* 841 * If prefix length is within a 16-bit word (not dividable by 16), 842 * then prepare a mask, determine the word and adjust it. 843 */ 844 if ((remnant = len - (preflen << 4)) != 0) { 845 const uint16_t wordmask = (1U << remnant) - 1; 846 const unsigned i = preflen; 847 848 addr->word16[i] = (pref->word16[i] & wordmask) | 849 (addr->word16[i] & ~wordmask); 850 } 851 852 /* 853 * Performing 1's complement sum/difference. 854 */ 855 sum = addr->word16[word] + adj; 856 while (sum >> 16) { 857 sum = (sum >> 16) + (sum & 0xffff); 858 } 859 if (sum == 0xffff) { 860 /* RFC 1071. */ 861 sum = 0x0000; 862 } 863 addr->word16[word] = sum; 864 return 0; 865 } 866 867 #if defined(DDB) || defined(_NPF_TESTING) 868 869 const char * 870 npf_addr_dump(const npf_addr_t *addr, int alen) 871 { 872 if (alen == sizeof(struct in_addr)) { 873 struct in_addr ip; 874 memcpy(&ip, addr, alen); 875 return inet_ntoa(ip); 876 } 877 return "[IPv6]"; 878 } 879 880 #endif 881