xref: /netbsd-src/sys/net/npf/npf_inet.c (revision f3cfa6f6ce31685c6c4a758bc430e69eb99f50a4)
1 /*-
2  * Copyright (c) 2009-2014 The NetBSD Foundation, Inc.
3  * All rights reserved.
4  *
5  * This material is based upon work partially supported by The
6  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
19  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
20  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
21  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
22  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
23  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
24  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
25  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
26  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
27  * POSSIBILITY OF SUCH DAMAGE.
28  */
29 
30 /*
31  * Various protocol related helper routines.
32  *
33  * This layer manipulates npf_cache_t structure i.e. caches requested headers
34  * and stores which information was cached in the information bit field.
35  * It is also responsibility of this layer to update or invalidate the cache
36  * on rewrites (e.g. by translation routines).
37  */
38 
39 #ifdef _KERNEL
40 #include <sys/cdefs.h>
41 __KERNEL_RCSID(0, "$NetBSD: npf_inet.c,v 1.53 2019/01/19 21:19:32 rmind Exp $");
42 
43 #include <sys/param.h>
44 #include <sys/types.h>
45 
46 #include <net/pfil.h>
47 #include <net/if.h>
48 #include <net/ethertypes.h>
49 #include <net/if_ether.h>
50 
51 #include <netinet/in_systm.h>
52 #include <netinet/in.h>
53 #include <netinet6/in6_var.h>
54 #include <netinet/ip.h>
55 #include <netinet/ip6.h>
56 #include <netinet/tcp.h>
57 #include <netinet/udp.h>
58 #include <netinet/ip_icmp.h>
59 #endif
60 
61 #include "npf_impl.h"
62 
63 /*
64  * npf_fixup{16,32}_cksum: incremental update of the Internet checksum.
65  */
66 
67 uint16_t
68 npf_fixup16_cksum(uint16_t cksum, uint16_t odatum, uint16_t ndatum)
69 {
70 	uint32_t sum;
71 
72 	/*
73 	 * RFC 1624:
74 	 *	HC' = ~(~HC + ~m + m')
75 	 *
76 	 * Note: 1's complement sum is endian-independent (RFC 1071, page 2).
77 	 */
78 	sum = ~cksum & 0xffff;
79 	sum += (~odatum & 0xffff) + ndatum;
80 	sum = (sum >> 16) + (sum & 0xffff);
81 	sum += (sum >> 16);
82 
83 	return ~sum & 0xffff;
84 }
85 
86 uint16_t
87 npf_fixup32_cksum(uint16_t cksum, uint32_t odatum, uint32_t ndatum)
88 {
89 	uint32_t sum;
90 
91 	/*
92 	 * Checksum 32-bit datum as as two 16-bit.  Note, the first
93 	 * 32->16 bit reduction is not necessary.
94 	 */
95 	sum = ~cksum & 0xffff;
96 	sum += (~odatum & 0xffff) + (ndatum & 0xffff);
97 
98 	sum += (~odatum >> 16) + (ndatum >> 16);
99 	sum = (sum >> 16) + (sum & 0xffff);
100 	sum += (sum >> 16);
101 	return ~sum & 0xffff;
102 }
103 
104 /*
105  * npf_addr_cksum: calculate checksum of the address, either IPv4 or IPv6.
106  */
107 uint16_t
108 npf_addr_cksum(uint16_t cksum, int sz, const npf_addr_t *oaddr,
109     const npf_addr_t *naddr)
110 {
111 	const uint32_t *oip32 = (const uint32_t *)oaddr;
112 	const uint32_t *nip32 = (const uint32_t *)naddr;
113 
114 	KASSERT(sz % sizeof(uint32_t) == 0);
115 	do {
116 		cksum = npf_fixup32_cksum(cksum, *oip32++, *nip32++);
117 		sz -= sizeof(uint32_t);
118 	} while (sz);
119 
120 	return cksum;
121 }
122 
123 /*
124  * npf_addr_sum: provide IP addresses as a XORed 32-bit integer.
125  * Note: used for hash function.
126  */
127 uint32_t
128 npf_addr_mix(const int alen, const npf_addr_t *a1, const npf_addr_t *a2)
129 {
130 	const int nwords = alen >> 2;
131 	uint32_t mix = 0;
132 
133 	KASSERT(alen > 0 && a1 != NULL && a2 != NULL);
134 
135 	for (int i = 0; i < nwords; i++) {
136 		mix ^= a1->word32[i];
137 		mix ^= a2->word32[i];
138 	}
139 	return mix;
140 }
141 
142 /*
143  * npf_addr_mask: apply the mask to a given address and store the result.
144  */
145 void
146 npf_addr_mask(const npf_addr_t *addr, const npf_netmask_t mask,
147     const int alen, npf_addr_t *out)
148 {
149 	const int nwords = alen >> 2;
150 	uint_fast8_t length = mask;
151 
152 	/* Note: maximum length is 32 for IPv4 and 128 for IPv6. */
153 	KASSERT(length <= NPF_MAX_NETMASK);
154 
155 	for (int i = 0; i < nwords; i++) {
156 		uint32_t wordmask;
157 
158 		if (length >= 32) {
159 			wordmask = htonl(0xffffffff);
160 			length -= 32;
161 		} else if (length) {
162 			wordmask = htonl(0xffffffff << (32 - length));
163 			length = 0;
164 		} else {
165 			wordmask = 0;
166 		}
167 		out->word32[i] = addr->word32[i] & wordmask;
168 	}
169 }
170 
171 /*
172  * npf_addr_bitor: bitwise OR the host part (given the netmask).
173  * Zero mask can be used to OR the entire address.
174  */
175 void
176 npf_addr_bitor(const npf_addr_t *addr, const npf_netmask_t mask,
177     const int alen, npf_addr_t *out)
178 {
179 	const int nwords = alen >> 2;
180 	uint_fast8_t length = mask;
181 
182 	/* Note: maximum length is 32 for IPv4 and 128 for IPv6. */
183 	KASSERT(length <= NPF_MAX_NETMASK);
184 
185 	for (int i = 0; i < nwords; i++) {
186 		uint32_t wordmask;
187 
188 		if (length >= 32) {
189 			wordmask = htonl(0xffffffff);
190 			length -= 32;
191 		} else if (length) {
192 			wordmask = htonl(0xffffffff << (32 - length));
193 			length = 0;
194 		} else {
195 			wordmask = 0;
196 		}
197 		out->word32[i] |= addr->word32[i] & ~wordmask;
198 	}
199 }
200 
201 /*
202  * npf_addr_cmp: compare two addresses, either IPv4 or IPv6.
203  *
204  * => Return 0 if equal and negative/positive if less/greater accordingly.
205  * => Ignore the mask, if NPF_NO_NETMASK is specified.
206  */
207 int
208 npf_addr_cmp(const npf_addr_t *addr1, const npf_netmask_t mask1,
209     const npf_addr_t *addr2, const npf_netmask_t mask2, const int alen)
210 {
211 	npf_addr_t realaddr1, realaddr2;
212 
213 	if (mask1 != NPF_NO_NETMASK) {
214 		npf_addr_mask(addr1, mask1, alen, &realaddr1);
215 		addr1 = &realaddr1;
216 	}
217 	if (mask2 != NPF_NO_NETMASK) {
218 		npf_addr_mask(addr2, mask2, alen, &realaddr2);
219 		addr2 = &realaddr2;
220 	}
221 	return memcmp(addr1, addr2, alen);
222 }
223 
224 /*
225  * npf_tcpsaw: helper to fetch SEQ, ACK, WIN and return TCP data length.
226  *
227  * => Returns all values in host byte-order.
228  */
229 int
230 npf_tcpsaw(const npf_cache_t *npc, tcp_seq *seq, tcp_seq *ack, uint32_t *win)
231 {
232 	const struct tcphdr *th = npc->npc_l4.tcp;
233 	u_int thlen;
234 
235 	KASSERT(npf_iscached(npc, NPC_TCP));
236 
237 	*seq = ntohl(th->th_seq);
238 	*ack = ntohl(th->th_ack);
239 	*win = (uint32_t)ntohs(th->th_win);
240 	thlen = th->th_off << 2;
241 
242 	if (npf_iscached(npc, NPC_IP4)) {
243 		const struct ip *ip = npc->npc_ip.v4;
244 		return ntohs(ip->ip_len) - npc->npc_hlen - thlen;
245 	} else if (npf_iscached(npc, NPC_IP6)) {
246 		const struct ip6_hdr *ip6 = npc->npc_ip.v6;
247 		return ntohs(ip6->ip6_plen) -
248 		    (npc->npc_hlen - sizeof(*ip6)) - thlen;
249 	}
250 	return 0;
251 }
252 
253 /*
254  * npf_fetch_tcpopts: parse and return TCP options.
255  */
256 bool
257 npf_fetch_tcpopts(npf_cache_t *npc, uint16_t *mss, int *wscale)
258 {
259 	nbuf_t *nbuf = npc->npc_nbuf;
260 	const struct tcphdr *th = npc->npc_l4.tcp;
261 	int cnt, optlen = 0;
262 	uint8_t *cp, opt;
263 	uint8_t val;
264 	bool ok;
265 
266 	KASSERT(npf_iscached(npc, NPC_IP46));
267 	KASSERT(npf_iscached(npc, NPC_TCP));
268 
269 	/* Determine if there are any TCP options, get their length. */
270 	cnt = (th->th_off << 2) - sizeof(struct tcphdr);
271 	if (cnt <= 0) {
272 		/* No options. */
273 		return false;
274 	}
275 	KASSERT(cnt <= MAX_TCPOPTLEN);
276 
277 	/* Fetch all the options at once. */
278 	nbuf_reset(nbuf);
279 	const int step = npc->npc_hlen + sizeof(struct tcphdr);
280 	if ((cp = nbuf_advance(nbuf, step, cnt)) == NULL) {
281 		ok = false;
282 		goto done;
283 	}
284 
285 	/* Scan the options. */
286 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
287 		opt = cp[0];
288 		if (opt == TCPOPT_EOL)
289 			break;
290 		if (opt == TCPOPT_NOP)
291 			optlen = 1;
292 		else {
293 			if (cnt < 2)
294 				break;
295 			optlen = cp[1];
296 			if (optlen < 2 || optlen > cnt)
297 				break;
298 		}
299 
300 		switch (opt) {
301 		case TCPOPT_MAXSEG:
302 			if (optlen != TCPOLEN_MAXSEG)
303 				continue;
304 			if (mss) {
305 				memcpy(mss, cp + 2, sizeof(uint16_t));
306 			}
307 			break;
308 		case TCPOPT_WINDOW:
309 			if (optlen != TCPOLEN_WINDOW)
310 				continue;
311 			val = *(cp + 2);
312 			*wscale = (val > TCP_MAX_WINSHIFT) ? TCP_MAX_WINSHIFT : val;
313 			break;
314 		default:
315 			break;
316 		}
317 	}
318 
319 	ok = true;
320 done:
321 	if (nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)) {
322 		npf_recache(npc);
323 	}
324 	return ok;
325 }
326 
327 /*
328  * npf_set_mss: set the MSS.
329  */
330 bool
331 npf_set_mss(npf_cache_t *npc, uint16_t mss, uint16_t *old, uint16_t *new,
332     bool *mid)
333 {
334 	nbuf_t *nbuf = npc->npc_nbuf;
335 	const struct tcphdr *th = npc->npc_l4.tcp;
336 	int cnt, optlen = 0;
337 	uint8_t *cp, *base, opt;
338 	bool ok;
339 
340 	KASSERT(npf_iscached(npc, NPC_IP46));
341 	KASSERT(npf_iscached(npc, NPC_TCP));
342 
343 	/* Determine if there are any TCP options, get their length. */
344 	cnt = (th->th_off << 2) - sizeof(struct tcphdr);
345 	if (cnt <= 0) {
346 		/* No options. */
347 		return false;
348 	}
349 	KASSERT(cnt <= MAX_TCPOPTLEN);
350 
351 	/* Fetch all the options at once. */
352 	nbuf_reset(nbuf);
353 	const int step = npc->npc_hlen + sizeof(struct tcphdr);
354 	if ((base = nbuf_advance(nbuf, step, cnt)) == NULL) {
355 		ok = false;
356 		goto done;
357 	}
358 
359 	/* Scan the options. */
360 	for (cp = base; cnt > 0; cnt -= optlen, cp += optlen) {
361 		opt = cp[0];
362 		if (opt == TCPOPT_EOL)
363 			break;
364 		if (opt == TCPOPT_NOP)
365 			optlen = 1;
366 		else {
367 			if (cnt < 2)
368 				break;
369 			optlen = cp[1];
370 			if (optlen < 2 || optlen > cnt)
371 				break;
372 		}
373 
374 		switch (opt) {
375 		case TCPOPT_MAXSEG:
376 			if (optlen != TCPOLEN_MAXSEG)
377 				continue;
378 			if (((cp + 2) - base) % sizeof(uint16_t) != 0) {
379 				*mid = true;
380 				memcpy(&old[0], cp + 1, sizeof(uint16_t));
381 				memcpy(&old[1], cp + 3, sizeof(uint16_t));
382 				memcpy(cp + 2, &mss, sizeof(uint16_t));
383 				memcpy(&new[0], cp + 1, sizeof(uint16_t));
384 				memcpy(&new[1], cp + 3, sizeof(uint16_t));
385 			} else {
386 				*mid = false;
387 				memcpy(cp + 2, &mss, sizeof(uint16_t));
388 			}
389 			break;
390 		default:
391 			break;
392 		}
393 	}
394 
395 	ok = true;
396 done:
397 	if (nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)) {
398 		npf_recache(npc);
399 	}
400 	return ok;
401 }
402 
403 static int
404 npf_cache_ip(npf_cache_t *npc, nbuf_t *nbuf)
405 {
406 	const void *nptr = nbuf_dataptr(nbuf);
407 	const uint8_t ver = *(const uint8_t *)nptr;
408 	int flags = 0;
409 
410 	/*
411 	 * We intentionally don't read the L4 payload after IPPROTO_AH.
412 	 */
413 
414 	switch (ver >> 4) {
415 	case IPVERSION: {
416 		struct ip *ip;
417 
418 		ip = nbuf_ensure_contig(nbuf, sizeof(struct ip));
419 		if (ip == NULL) {
420 			return NPC_FMTERR;
421 		}
422 
423 		/* Retrieve the complete header. */
424 		if ((u_int)(ip->ip_hl << 2) < sizeof(struct ip)) {
425 			return NPC_FMTERR;
426 		}
427 		ip = nbuf_ensure_contig(nbuf, (u_int)(ip->ip_hl << 2));
428 		if (ip == NULL) {
429 			return NPC_FMTERR;
430 		}
431 
432 		if (ip->ip_off & ~htons(IP_DF | IP_RF)) {
433 			/* Note fragmentation. */
434 			flags |= NPC_IPFRAG;
435 		}
436 
437 		/* Cache: layer 3 - IPv4. */
438 		npc->npc_alen = sizeof(struct in_addr);
439 		npc->npc_ips[NPF_SRC] = (npf_addr_t *)&ip->ip_src;
440 		npc->npc_ips[NPF_DST] = (npf_addr_t *)&ip->ip_dst;
441 		npc->npc_hlen = ip->ip_hl << 2;
442 		npc->npc_proto = ip->ip_p;
443 
444 		npc->npc_ip.v4 = ip;
445 		flags |= NPC_IP4;
446 		break;
447 	}
448 
449 	case (IPV6_VERSION >> 4): {
450 		struct ip6_hdr *ip6;
451 		struct ip6_ext *ip6e;
452 		struct ip6_frag *ip6f;
453 		size_t off, hlen;
454 		int frag_present;
455 
456 		ip6 = nbuf_ensure_contig(nbuf, sizeof(struct ip6_hdr));
457 		if (ip6 == NULL) {
458 			return NPC_FMTERR;
459 		}
460 
461 		/*
462 		 * XXX: We don't handle IPv6 Jumbograms.
463 		 */
464 
465 		/* Set initial next-protocol value. */
466 		hlen = sizeof(struct ip6_hdr);
467 		npc->npc_proto = ip6->ip6_nxt;
468 		npc->npc_hlen = hlen;
469 
470 		frag_present = 0;
471 
472 		/*
473 		 * Advance by the length of the current header.
474 		 */
475 		off = nbuf_offset(nbuf);
476 		while ((ip6e = nbuf_advance(nbuf, hlen, sizeof(*ip6e))) != NULL) {
477 			/*
478 			 * Determine whether we are going to continue.
479 			 */
480 			switch (npc->npc_proto) {
481 			case IPPROTO_HOPOPTS:
482 			case IPPROTO_DSTOPTS:
483 			case IPPROTO_ROUTING:
484 				hlen = (ip6e->ip6e_len + 1) << 3;
485 				break;
486 			case IPPROTO_FRAGMENT:
487 				if (frag_present++)
488 					return NPC_FMTERR;
489 				ip6f = nbuf_ensure_contig(nbuf, sizeof(*ip6f));
490 				if (ip6f == NULL)
491 					return NPC_FMTERR;
492 
493 				/* RFC6946: Skip dummy fragments. */
494 				if (!ntohs(ip6f->ip6f_offlg & IP6F_OFF_MASK) &&
495 				    !(ip6f->ip6f_offlg & IP6F_MORE_FRAG)) {
496 					hlen = sizeof(struct ip6_frag);
497 					break;
498 				}
499 
500 				hlen = 0;
501 				flags |= NPC_IPFRAG;
502 
503 				break;
504 			default:
505 				hlen = 0;
506 				break;
507 			}
508 
509 			if (!hlen) {
510 				break;
511 			}
512 			npc->npc_proto = ip6e->ip6e_nxt;
513 			npc->npc_hlen += hlen;
514 		}
515 
516 		if (ip6e == NULL) {
517 			return NPC_FMTERR;
518 		}
519 
520 		/*
521 		 * Re-fetch the header pointers (nbufs might have been
522 		 * reallocated).  Restore the original offset (if any).
523 		 */
524 		nbuf_reset(nbuf);
525 		ip6 = nbuf_dataptr(nbuf);
526 		if (off) {
527 			nbuf_advance(nbuf, off, 0);
528 		}
529 
530 		/* Cache: layer 3 - IPv6. */
531 		npc->npc_alen = sizeof(struct in6_addr);
532 		npc->npc_ips[NPF_SRC] = (npf_addr_t *)&ip6->ip6_src;
533 		npc->npc_ips[NPF_DST] = (npf_addr_t *)&ip6->ip6_dst;
534 
535 		npc->npc_ip.v6 = ip6;
536 		flags |= NPC_IP6;
537 		break;
538 	}
539 	default:
540 		break;
541 	}
542 	return flags;
543 }
544 
545 /*
546  * npf_cache_all: general routine to cache all relevant IP (v4 or v6)
547  * and TCP, UDP or ICMP headers.
548  *
549  * => nbuf offset shall be set accordingly.
550  */
551 int
552 npf_cache_all(npf_cache_t *npc)
553 {
554 	nbuf_t *nbuf = npc->npc_nbuf;
555 	int flags, l4flags;
556 	u_int hlen;
557 
558 	/*
559 	 * This routine is a main point where the references are cached,
560 	 * therefore clear the flag as we reset.
561 	 */
562 again:
563 	nbuf_unset_flag(nbuf, NBUF_DATAREF_RESET);
564 
565 	/*
566 	 * First, cache the L3 header (IPv4 or IPv6).  If IP packet is
567 	 * fragmented, then we cannot look into L4.
568 	 */
569 	flags = npf_cache_ip(npc, nbuf);
570 	if ((flags & NPC_IP46) == 0 || (flags & NPC_IPFRAG) != 0 ||
571 	    (flags & NPC_FMTERR) != 0) {
572 		goto out;
573 	}
574 	hlen = npc->npc_hlen;
575 
576 	/*
577 	 * Note: we guarantee that the potential "Query Id" field of the
578 	 * ICMPv4/ICMPv6 packets is in the nbuf. This field is used in the
579 	 * ICMP ALG.
580 	 */
581 	switch (npc->npc_proto) {
582 	case IPPROTO_TCP:
583 		/* Cache: layer 4 - TCP. */
584 		npc->npc_l4.tcp = nbuf_advance(nbuf, hlen,
585 		    sizeof(struct tcphdr));
586 		l4flags = NPC_LAYER4 | NPC_TCP;
587 		break;
588 	case IPPROTO_UDP:
589 		/* Cache: layer 4 - UDP. */
590 		npc->npc_l4.udp = nbuf_advance(nbuf, hlen,
591 		    sizeof(struct udphdr));
592 		l4flags = NPC_LAYER4 | NPC_UDP;
593 		break;
594 	case IPPROTO_ICMP:
595 		/* Cache: layer 4 - ICMPv4. */
596 		npc->npc_l4.icmp = nbuf_advance(nbuf, hlen,
597 		    ICMP_MINLEN);
598 		l4flags = NPC_LAYER4 | NPC_ICMP;
599 		break;
600 	case IPPROTO_ICMPV6:
601 		/* Cache: layer 4 - ICMPv6. */
602 		npc->npc_l4.icmp6 = nbuf_advance(nbuf, hlen,
603 		    sizeof(struct icmp6_hdr));
604 		l4flags = NPC_LAYER4 | NPC_ICMP;
605 		break;
606 	default:
607 		l4flags = 0;
608 		break;
609 	}
610 
611 	/* Error out if nbuf_advance failed. */
612 	if (l4flags && npc->npc_l4.hdr == NULL) {
613 		goto err;
614 	}
615 
616 	if (nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)) {
617 		goto again;
618 	}
619 
620 	flags |= l4flags;
621 	npc->npc_info |= flags;
622 	return flags;
623 
624 err:
625 	flags = NPC_FMTERR;
626 out:
627 	nbuf_unset_flag(nbuf, NBUF_DATAREF_RESET);
628 	npc->npc_info |= flags;
629 	return flags;
630 }
631 
632 void
633 npf_recache(npf_cache_t *npc)
634 {
635 	nbuf_t *nbuf = npc->npc_nbuf;
636 	const int mflags __diagused = npc->npc_info & (NPC_IP46 | NPC_LAYER4);
637 	int flags __diagused;
638 
639 	nbuf_reset(nbuf);
640 	npc->npc_info = 0;
641 	flags = npf_cache_all(npc);
642 
643 	KASSERT((flags & mflags) == mflags);
644 	KASSERT(nbuf_flag_p(nbuf, NBUF_DATAREF_RESET) == 0);
645 }
646 
647 /*
648  * npf_rwrip: rewrite required IP address.
649  */
650 bool
651 npf_rwrip(const npf_cache_t *npc, u_int which, const npf_addr_t *addr)
652 {
653 	KASSERT(npf_iscached(npc, NPC_IP46));
654 	KASSERT(which == NPF_SRC || which == NPF_DST);
655 
656 	memcpy(npc->npc_ips[which], addr, npc->npc_alen);
657 	return true;
658 }
659 
660 /*
661  * npf_rwrport: rewrite required TCP/UDP port.
662  */
663 bool
664 npf_rwrport(const npf_cache_t *npc, u_int which, const in_port_t port)
665 {
666 	const int proto = npc->npc_proto;
667 	in_port_t *oport;
668 
669 	KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP));
670 	KASSERT(proto == IPPROTO_TCP || proto == IPPROTO_UDP);
671 	KASSERT(which == NPF_SRC || which == NPF_DST);
672 
673 	/* Get the offset and store the port in it. */
674 	if (proto == IPPROTO_TCP) {
675 		struct tcphdr *th = npc->npc_l4.tcp;
676 		oport = (which == NPF_SRC) ? &th->th_sport : &th->th_dport;
677 	} else {
678 		struct udphdr *uh = npc->npc_l4.udp;
679 		oport = (which == NPF_SRC) ? &uh->uh_sport : &uh->uh_dport;
680 	}
681 	memcpy(oport, &port, sizeof(in_port_t));
682 	return true;
683 }
684 
685 /*
686  * npf_rwrcksum: rewrite IPv4 and/or TCP/UDP checksum.
687  */
688 bool
689 npf_rwrcksum(const npf_cache_t *npc, u_int which,
690     const npf_addr_t *addr, const in_port_t port)
691 {
692 	const npf_addr_t *oaddr = npc->npc_ips[which];
693 	const int proto = npc->npc_proto;
694 	const int alen = npc->npc_alen;
695 	uint16_t *ocksum;
696 	in_port_t oport;
697 
698 	KASSERT(npf_iscached(npc, NPC_LAYER4));
699 	KASSERT(which == NPF_SRC || which == NPF_DST);
700 
701 	if (npf_iscached(npc, NPC_IP4)) {
702 		struct ip *ip = npc->npc_ip.v4;
703 		uint16_t ipsum = ip->ip_sum;
704 
705 		/* Recalculate IPv4 checksum and rewrite. */
706 		ip->ip_sum = npf_addr_cksum(ipsum, alen, oaddr, addr);
707 	} else {
708 		/* No checksum for IPv6. */
709 		KASSERT(npf_iscached(npc, NPC_IP6));
710 	}
711 
712 	/* Nothing else to do for ICMP. */
713 	if (proto == IPPROTO_ICMP || proto == IPPROTO_ICMPV6) {
714 		return true;
715 	}
716 	KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP));
717 
718 	/*
719 	 * Calculate TCP/UDP checksum:
720 	 * - Skip if UDP and the current checksum is zero.
721 	 * - Fixup the IP address change.
722 	 * - Fixup the port change, if required (non-zero).
723 	 */
724 	if (proto == IPPROTO_TCP) {
725 		struct tcphdr *th = npc->npc_l4.tcp;
726 
727 		ocksum = &th->th_sum;
728 		oport = (which == NPF_SRC) ? th->th_sport : th->th_dport;
729 	} else {
730 		struct udphdr *uh = npc->npc_l4.udp;
731 
732 		KASSERT(proto == IPPROTO_UDP);
733 		ocksum = &uh->uh_sum;
734 		if (*ocksum == 0) {
735 			/* No need to update. */
736 			return true;
737 		}
738 		oport = (which == NPF_SRC) ? uh->uh_sport : uh->uh_dport;
739 	}
740 
741 	uint16_t cksum = npf_addr_cksum(*ocksum, alen, oaddr, addr);
742 	if (port) {
743 		cksum = npf_fixup16_cksum(cksum, oport, port);
744 	}
745 
746 	/* Rewrite TCP/UDP checksum. */
747 	memcpy(ocksum, &cksum, sizeof(uint16_t));
748 	return true;
749 }
750 
751 /*
752  * npf_napt_rwr: perform address and/or port translation.
753  */
754 int
755 npf_napt_rwr(const npf_cache_t *npc, u_int which,
756     const npf_addr_t *addr, const in_addr_t port)
757 {
758 	const unsigned proto = npc->npc_proto;
759 
760 	/*
761 	 * Rewrite IP and/or TCP/UDP checksums first, since we need the
762 	 * current (old) address/port for the calculations.  Then perform
763 	 * the address translation i.e. rewrite source or destination.
764 	 */
765 	if (!npf_rwrcksum(npc, which, addr, port)) {
766 		return EINVAL;
767 	}
768 	if (!npf_rwrip(npc, which, addr)) {
769 		return EINVAL;
770 	}
771 	if (port == 0) {
772 		/* Done. */
773 		return 0;
774 	}
775 
776 	switch (proto) {
777 	case IPPROTO_TCP:
778 	case IPPROTO_UDP:
779 		/* Rewrite source/destination port. */
780 		if (!npf_rwrport(npc, which, port)) {
781 			return EINVAL;
782 		}
783 		break;
784 	case IPPROTO_ICMP:
785 	case IPPROTO_ICMPV6:
786 		KASSERT(npf_iscached(npc, NPC_ICMP));
787 		/* Nothing. */
788 		break;
789 	default:
790 		return ENOTSUP;
791 	}
792 	return 0;
793 }
794 
795 /*
796  * IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296.
797  */
798 int
799 npf_npt66_rwr(const npf_cache_t *npc, u_int which, const npf_addr_t *pref,
800     npf_netmask_t len, uint16_t adj)
801 {
802 	npf_addr_t *addr = npc->npc_ips[which];
803 	unsigned remnant, word, preflen = len >> 4;
804 	uint32_t sum;
805 
806 	KASSERT(which == NPF_SRC || which == NPF_DST);
807 
808 	if (!npf_iscached(npc, NPC_IP6)) {
809 		return EINVAL;
810 	}
811 	if (len <= 48) {
812 		/*
813 		 * The word to adjust.  Cannot translate the 0xffff
814 		 * subnet if /48 or shorter.
815 		 */
816 		word = 3;
817 		if (addr->word16[word] == 0xffff) {
818 			return EINVAL;
819 		}
820 	} else {
821 		/*
822 		 * Also, all 0s or 1s in the host part are disallowed for
823 		 * longer than /48 prefixes.
824 		 */
825 		if ((addr->word32[2] == 0 && addr->word32[3] == 0) ||
826 		    (addr->word32[2] == ~0U && addr->word32[3] == ~0U))
827 			return EINVAL;
828 
829 		/* Determine the 16-bit word to adjust. */
830 		for (word = 4; word < 8; word++)
831 			if (addr->word16[word] != 0xffff)
832 				break;
833 	}
834 
835 	/* Rewrite the prefix. */
836 	for (unsigned i = 0; i < preflen; i++) {
837 		addr->word16[i] = pref->word16[i];
838 	}
839 
840 	/*
841 	 * If prefix length is within a 16-bit word (not dividable by 16),
842 	 * then prepare a mask, determine the word and adjust it.
843 	 */
844 	if ((remnant = len - (preflen << 4)) != 0) {
845 		const uint16_t wordmask = (1U << remnant) - 1;
846 		const unsigned i = preflen;
847 
848 		addr->word16[i] = (pref->word16[i] & wordmask) |
849 		    (addr->word16[i] & ~wordmask);
850 	}
851 
852 	/*
853 	 * Performing 1's complement sum/difference.
854 	 */
855 	sum = addr->word16[word] + adj;
856 	while (sum >> 16) {
857 		sum = (sum >> 16) + (sum & 0xffff);
858 	}
859 	if (sum == 0xffff) {
860 		/* RFC 1071. */
861 		sum = 0x0000;
862 	}
863 	addr->word16[word] = sum;
864 	return 0;
865 }
866 
867 #if defined(DDB) || defined(_NPF_TESTING)
868 
869 const char *
870 npf_addr_dump(const npf_addr_t *addr, int alen)
871 {
872 	if (alen == sizeof(struct in_addr)) {
873 		struct in_addr ip;
874 		memcpy(&ip, addr, alen);
875 		return inet_ntoa(ip);
876 	}
877 	return "[IPv6]";
878 }
879 
880 #endif
881