1 /* $NetBSD: npf_nat.c,v 1.19 2013/02/09 03:35:32 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2010-2013 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF network address port translation (NAPT) and other forms of NAT. 34 * Described in RFC 2663, RFC 3022, etc. 35 * 36 * Overview 37 * 38 * There are few mechanisms: NAT policy, port map and translation. 39 * NAT module has a separate ruleset, where rules contain associated 40 * NAT policy, thus flexible filter criteria can be used. 41 * 42 * Translation types 43 * 44 * There are two types of translation: outbound (NPF_NATOUT) and 45 * inbound (NPF_NATIN). It should not be confused with connection 46 * direction. 47 * 48 * Outbound NAT rewrites: 49 * - Source on "forwards" stream. 50 * - Destination on "backwards" stream. 51 * Inbound NAT rewrites: 52 * - Destination on "forwards" stream. 53 * - Source on "backwards" stream. 54 * 55 * It should be noted that bi-directional NAT is a combined outbound 56 * and inbound translation, therefore constructed as two policies. 57 * 58 * NAT policies and port maps 59 * 60 * NAT (translation) policy is applied when a packet matches the rule. 61 * Apart from filter criteria, NAT policy has a translation IP address 62 * and associated port map. Port map is a bitmap used to reserve and 63 * use unique TCP/UDP ports for translation. Port maps are unique to 64 * the IP addresses, therefore multiple NAT policies with the same IP 65 * will share the same port map. 66 * 67 * Sessions, translation entries and their life-cycle 68 * 69 * NAT module relies on session management module. Each translated 70 * session has an associated translation entry (npf_nat_t), which 71 * contains information used for backwards stream translation, i.e. 72 * original IP address with port and translation port, allocated from 73 * the port map. Each NAT entry is associated with the policy, which 74 * contains translation IP address. Allocated port is returned to the 75 * port map and NAT entry is destroyed when session expires. 76 */ 77 78 #include <sys/cdefs.h> 79 __KERNEL_RCSID(0, "$NetBSD: npf_nat.c,v 1.19 2013/02/09 03:35:32 rmind Exp $"); 80 81 #include <sys/param.h> 82 #include <sys/types.h> 83 84 #include <sys/atomic.h> 85 #include <sys/bitops.h> 86 #include <sys/condvar.h> 87 #include <sys/kmem.h> 88 #include <sys/mutex.h> 89 #include <sys/pool.h> 90 #include <sys/proc.h> 91 #include <sys/cprng.h> 92 93 #include <net/pfil.h> 94 #include <netinet/in.h> 95 96 #include "npf_impl.h" 97 98 /* 99 * NPF portmap structure. 100 */ 101 typedef struct { 102 u_int p_refcnt; 103 uint32_t p_bitmap[0]; 104 } npf_portmap_t; 105 106 /* Portmap range: [ 1024 .. 65535 ] */ 107 #define PORTMAP_FIRST (1024) 108 #define PORTMAP_SIZE ((65536 - PORTMAP_FIRST) / 32) 109 #define PORTMAP_FILLED ((uint32_t)~0) 110 #define PORTMAP_MASK (31) 111 #define PORTMAP_SHIFT (5) 112 113 #define PORTMAP_MEM_SIZE \ 114 (sizeof(npf_portmap_t) + (PORTMAP_SIZE * sizeof(uint32_t))) 115 116 /* 117 * NAT policy structure. 118 */ 119 struct npf_natpolicy { 120 LIST_HEAD(, npf_nat) n_nat_list; 121 volatile u_int n_refcnt; 122 kmutex_t n_lock; 123 kcondvar_t n_cv; 124 npf_portmap_t * n_portmap; 125 /* NPF_NP_CMP_START */ 126 int n_type; 127 u_int n_flags; 128 size_t n_addr_sz; 129 npf_addr_t n_taddr; 130 in_port_t n_tport; 131 }; 132 133 #define NPF_NP_CMP_START offsetof(npf_natpolicy_t, n_type) 134 #define NPF_NP_CMP_SIZE (sizeof(npf_natpolicy_t) - NPF_NP_CMP_START) 135 136 /* 137 * NAT translation entry for a session. 138 */ 139 struct npf_nat { 140 /* Association (list entry and a link pointer) with NAT policy. */ 141 LIST_ENTRY(npf_nat) nt_entry; 142 npf_natpolicy_t * nt_natpolicy; 143 npf_session_t * nt_session; 144 /* Original address and port (for backwards translation). */ 145 npf_addr_t nt_oaddr; 146 in_port_t nt_oport; 147 /* Translation port (for redirects). */ 148 in_port_t nt_tport; 149 /* ALG (if any) associated with this NAT entry. */ 150 npf_alg_t * nt_alg; 151 uintptr_t nt_alg_arg; 152 }; 153 154 static pool_cache_t nat_cache __read_mostly; 155 156 /* 157 * npf_nat_sys{init,fini}: initialise/destroy NAT subsystem structures. 158 */ 159 160 void 161 npf_nat_sysinit(void) 162 { 163 164 nat_cache = pool_cache_init(sizeof(npf_nat_t), coherency_unit, 165 0, 0, "npfnatpl", NULL, IPL_NET, NULL, NULL, NULL); 166 KASSERT(nat_cache != NULL); 167 } 168 169 void 170 npf_nat_sysfini(void) 171 { 172 173 /* NAT policies should already be destroyed. */ 174 pool_cache_destroy(nat_cache); 175 } 176 177 /* 178 * npf_nat_newpolicy: create a new NAT policy. 179 * 180 * => Shares portmap if policy is on existing translation address. 181 * => XXX: serialise at upper layer. 182 */ 183 npf_natpolicy_t * 184 npf_nat_newpolicy(prop_dictionary_t natdict, npf_ruleset_t *nrlset) 185 { 186 npf_natpolicy_t *np; 187 prop_object_t obj; 188 npf_portmap_t *pm; 189 190 np = kmem_zalloc(sizeof(npf_natpolicy_t), KM_SLEEP); 191 192 /* Translation type and flags. */ 193 prop_dictionary_get_int32(natdict, "type", &np->n_type); 194 prop_dictionary_get_uint32(natdict, "flags", &np->n_flags); 195 196 /* Should be exclusively either inbound or outbound NAT. */ 197 if (((np->n_type == NPF_NATIN) ^ (np->n_type == NPF_NATOUT)) == 0) { 198 kmem_free(np, sizeof(npf_natpolicy_t)); 199 return NULL; 200 } 201 mutex_init(&np->n_lock, MUTEX_DEFAULT, IPL_SOFTNET); 202 cv_init(&np->n_cv, "npfnatcv"); 203 LIST_INIT(&np->n_nat_list); 204 205 /* Translation IP. */ 206 obj = prop_dictionary_get(natdict, "translation-ip"); 207 np->n_addr_sz = prop_data_size(obj); 208 KASSERT(np->n_addr_sz > 0 && np->n_addr_sz <= sizeof(npf_addr_t)); 209 memcpy(&np->n_taddr, prop_data_data_nocopy(obj), np->n_addr_sz); 210 211 /* Translation port (for redirect case). */ 212 prop_dictionary_get_uint16(natdict, "translation-port", &np->n_tport); 213 214 /* Determine if port map is needed. */ 215 np->n_portmap = NULL; 216 if ((np->n_flags & NPF_NAT_PORTMAP) == 0) { 217 /* No port map. */ 218 return np; 219 } 220 221 /* 222 * Inspect NAT policies in the ruleset for port map sharing. 223 * Note that npf_ruleset_sharepm() will increase the reference count. 224 */ 225 if (!npf_ruleset_sharepm(nrlset, np)) { 226 /* Allocate a new port map for the NAT policy. */ 227 pm = kmem_zalloc(PORTMAP_MEM_SIZE, KM_SLEEP); 228 pm->p_refcnt = 1; 229 KASSERT((uintptr_t)pm->p_bitmap == (uintptr_t)pm + sizeof(*pm)); 230 np->n_portmap = pm; 231 } else { 232 KASSERT(np->n_portmap != NULL); 233 } 234 return np; 235 } 236 237 /* 238 * npf_nat_freepolicy: free NAT policy and, on last reference, free portmap. 239 * 240 * => Called from npf_rule_free() during the reload via npf_ruleset_destroy(). 241 */ 242 void 243 npf_nat_freepolicy(npf_natpolicy_t *np) 244 { 245 npf_portmap_t *pm = np->n_portmap; 246 npf_session_t *se; 247 npf_nat_t *nt; 248 249 /* De-associate all entries from the policy. */ 250 mutex_enter(&np->n_lock); 251 LIST_FOREACH(nt, &np->n_nat_list, nt_entry) { 252 se = nt->nt_session; /* XXXSMP */ 253 if (se == NULL) { 254 continue; 255 } 256 npf_session_expire(se); 257 } 258 while (!LIST_EMPTY(&np->n_nat_list)) { 259 cv_wait(&np->n_cv, &np->n_lock); 260 } 261 mutex_exit(&np->n_lock); 262 263 /* All references should be going away. */ 264 while (np->n_refcnt) { 265 kpause("npfgcnat", false, 1, NULL); 266 } 267 268 /* Destroy the port map, on last reference. */ 269 if (pm && --pm->p_refcnt == 0) { 270 KASSERT((np->n_flags & NPF_NAT_PORTMAP) != 0); 271 kmem_free(pm, PORTMAP_MEM_SIZE); 272 } 273 cv_destroy(&np->n_cv); 274 mutex_destroy(&np->n_lock); 275 kmem_free(np, sizeof(npf_natpolicy_t)); 276 } 277 278 void 279 npf_nat_freealg(npf_natpolicy_t *np, npf_alg_t *alg) 280 { 281 npf_nat_t *nt; 282 283 mutex_enter(&np->n_lock); 284 LIST_FOREACH(nt, &np->n_nat_list, nt_entry) { 285 if (nt->nt_alg != alg) { 286 continue; 287 } 288 nt->nt_alg = NULL; 289 } 290 mutex_exit(&np->n_lock); 291 } 292 293 /* 294 * npf_nat_matchpolicy: compare two NAT policies. 295 * 296 * => Return 0 on match, and non-zero otherwise. 297 */ 298 bool 299 npf_nat_matchpolicy(npf_natpolicy_t *np, npf_natpolicy_t *mnp) 300 { 301 void *np_raw, *mnp_raw; 302 /* 303 * Compare the relevant NAT policy information (in raw form), 304 * which is enough for matching criterion. 305 */ 306 KASSERT(np && mnp && np != mnp); 307 np_raw = (uint8_t *)np + NPF_NP_CMP_START; 308 mnp_raw = (uint8_t *)mnp + NPF_NP_CMP_START; 309 return (memcmp(np_raw, mnp_raw, NPF_NP_CMP_SIZE) == 0); 310 } 311 312 bool 313 npf_nat_sharepm(npf_natpolicy_t *np, npf_natpolicy_t *mnp) 314 { 315 npf_portmap_t *pm, *mpm; 316 317 KASSERT(np && mnp && np != mnp); 318 319 /* Using port map and having equal translation address? */ 320 if ((np->n_flags & mnp->n_flags & NPF_NAT_PORTMAP) == 0) { 321 return false; 322 } 323 if (np->n_addr_sz != mnp->n_addr_sz) { 324 return false; 325 } 326 if (memcmp(&np->n_taddr, &mnp->n_taddr, np->n_addr_sz) != 0) { 327 return false; 328 } 329 /* If NAT policy has an old port map - drop the reference. */ 330 mpm = mnp->n_portmap; 331 if (mpm) { 332 /* Note: at this point we cannot hold a last reference. */ 333 KASSERT(mpm->p_refcnt > 1); 334 mpm->p_refcnt--; 335 } 336 /* Share the port map. */ 337 pm = np->n_portmap; 338 mnp->n_portmap = pm; 339 pm->p_refcnt++; 340 return true; 341 } 342 343 /* 344 * npf_nat_getport: allocate and return a port in the NAT policy portmap. 345 * 346 * => Returns in network byte-order. 347 * => Zero indicates failure. 348 */ 349 static in_port_t 350 npf_nat_getport(npf_natpolicy_t *np) 351 { 352 npf_portmap_t *pm = np->n_portmap; 353 u_int n = PORTMAP_SIZE, idx, bit; 354 uint32_t map, nmap; 355 356 idx = cprng_fast32() % PORTMAP_SIZE; 357 for (;;) { 358 KASSERT(idx < PORTMAP_SIZE); 359 map = pm->p_bitmap[idx]; 360 if (__predict_false(map == PORTMAP_FILLED)) { 361 if (n-- == 0) { 362 /* No space. */ 363 return 0; 364 } 365 /* This bitmap is filled, next. */ 366 idx = (idx ? idx : PORTMAP_SIZE) - 1; 367 continue; 368 } 369 bit = ffs32(~map) - 1; 370 nmap = map | (1 << bit); 371 if (atomic_cas_32(&pm->p_bitmap[idx], map, nmap) == map) { 372 /* Success. */ 373 break; 374 } 375 } 376 return htons(PORTMAP_FIRST + (idx << PORTMAP_SHIFT) + bit); 377 } 378 379 /* 380 * npf_nat_takeport: allocate specific port in the NAT policy portmap. 381 */ 382 static bool 383 npf_nat_takeport(npf_natpolicy_t *np, in_port_t port) 384 { 385 npf_portmap_t *pm = np->n_portmap; 386 uint32_t map, nmap; 387 u_int idx, bit; 388 389 port = ntohs(port) - PORTMAP_FIRST; 390 idx = port >> PORTMAP_SHIFT; 391 bit = port & PORTMAP_MASK; 392 map = pm->p_bitmap[idx]; 393 nmap = map | (1 << bit); 394 if (map == nmap) { 395 /* Already taken. */ 396 return false; 397 } 398 return atomic_cas_32(&pm->p_bitmap[idx], map, nmap) == map; 399 } 400 401 /* 402 * npf_nat_putport: return port as available in the NAT policy portmap. 403 * 404 * => Port should be in network byte-order. 405 */ 406 static void 407 npf_nat_putport(npf_natpolicy_t *np, in_port_t port) 408 { 409 npf_portmap_t *pm = np->n_portmap; 410 uint32_t map, nmap; 411 u_int idx, bit; 412 413 port = ntohs(port) - PORTMAP_FIRST; 414 idx = port >> PORTMAP_SHIFT; 415 bit = port & PORTMAP_MASK; 416 do { 417 map = pm->p_bitmap[idx]; 418 KASSERT(map | (1 << bit)); 419 nmap = map & ~(1 << bit); 420 } while (atomic_cas_32(&pm->p_bitmap[idx], map, nmap) != map); 421 } 422 423 /* 424 * npf_nat_inspect: inspect packet against NAT ruleset and return a policy. 425 * 426 * => Acquire a reference on the policy, if found. 427 */ 428 static npf_natpolicy_t * 429 npf_nat_inspect(npf_cache_t *npc, nbuf_t *nbuf, const int di) 430 { 431 int slock = npf_config_read_enter(); 432 npf_ruleset_t *rlset = npf_config_natset(); 433 npf_natpolicy_t *np; 434 npf_rule_t *rl; 435 436 rl = npf_ruleset_inspect(npc, nbuf, rlset, di, NPF_LAYER_3); 437 if (rl == NULL) { 438 npf_config_read_exit(slock); 439 return NULL; 440 } 441 np = npf_rule_getnat(rl); 442 atomic_inc_uint(&np->n_refcnt); 443 npf_config_read_exit(slock); 444 return np; 445 } 446 447 /* 448 * npf_nat_create: create a new NAT translation entry. 449 */ 450 static npf_nat_t * 451 npf_nat_create(npf_cache_t *npc, npf_natpolicy_t *np) 452 { 453 const int proto = npc->npc_proto; 454 npf_nat_t *nt; 455 456 KASSERT(npf_iscached(npc, NPC_IP46)); 457 KASSERT(npf_iscached(npc, NPC_LAYER4)); 458 459 /* New NAT association. */ 460 nt = pool_cache_get(nat_cache, PR_NOWAIT); 461 if (nt == NULL){ 462 return NULL; 463 } 464 npf_stats_inc(NPF_STAT_NAT_CREATE); 465 nt->nt_natpolicy = np; 466 nt->nt_session = NULL; 467 nt->nt_alg = NULL; 468 469 /* Save the original address which may be rewritten. */ 470 if (np->n_type == NPF_NATOUT) { 471 /* Source (local) for Outbound NAT. */ 472 memcpy(&nt->nt_oaddr, npc->npc_srcip, npc->npc_alen); 473 } else { 474 /* Destination (external) for Inbound NAT. */ 475 KASSERT(np->n_type == NPF_NATIN); 476 memcpy(&nt->nt_oaddr, npc->npc_dstip, npc->npc_alen); 477 } 478 479 /* 480 * Port translation, if required, and if it is TCP/UDP. 481 */ 482 if ((np->n_flags & NPF_NAT_PORTS) == 0 || 483 (proto != IPPROTO_TCP && proto != IPPROTO_UDP)) { 484 nt->nt_oport = 0; 485 nt->nt_tport = 0; 486 goto out; 487 } 488 489 /* Save the relevant TCP/UDP port. */ 490 if (proto == IPPROTO_TCP) { 491 const struct tcphdr *th = npc->npc_l4.tcp; 492 nt->nt_oport = (np->n_type == NPF_NATOUT) ? 493 th->th_sport : th->th_dport; 494 } else { 495 const struct udphdr *uh = npc->npc_l4.udp; 496 nt->nt_oport = (np->n_type == NPF_NATOUT) ? 497 uh->uh_sport : uh->uh_dport; 498 } 499 500 /* Get a new port for translation. */ 501 if ((np->n_flags & NPF_NAT_PORTMAP) != 0) { 502 nt->nt_tport = npf_nat_getport(np); 503 } else { 504 nt->nt_tport = np->n_tport; 505 } 506 out: 507 mutex_enter(&np->n_lock); 508 LIST_INSERT_HEAD(&np->n_nat_list, nt, nt_entry); 509 mutex_exit(&np->n_lock); 510 return nt; 511 } 512 513 /* 514 * npf_nat_translate: perform address and/or port translation. 515 */ 516 int 517 npf_nat_translate(npf_cache_t *npc, nbuf_t *nbuf, npf_nat_t *nt, 518 const bool forw, const int di) 519 { 520 const int proto = npc->npc_proto; 521 const npf_natpolicy_t *np = nt->nt_natpolicy; 522 const npf_addr_t *addr; 523 in_port_t port; 524 525 KASSERT(npf_iscached(npc, NPC_IP46)); 526 KASSERT(npf_iscached(npc, NPC_LAYER4)); 527 528 if (forw) { 529 /* "Forwards" stream: use translation address/port. */ 530 addr = &np->n_taddr; 531 port = nt->nt_tport; 532 } else { 533 /* "Backwards" stream: use original address/port. */ 534 addr = &nt->nt_oaddr; 535 port = nt->nt_oport; 536 } 537 KASSERT((np->n_flags & NPF_NAT_PORTS) != 0 || port == 0); 538 539 /* Process delayed checksums (XXX: NetBSD). */ 540 if (nbuf_cksum_barrier(nbuf, di)) { 541 npf_recache(npc, nbuf); 542 } 543 KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)); 544 545 /* Execute ALG hook first. */ 546 if ((npc->npc_info & NPC_ALG_EXEC) == 0) { 547 npc->npc_info |= NPC_ALG_EXEC; 548 npf_alg_exec(npc, nbuf, nt, di); 549 } 550 551 /* 552 * Rewrite IP and/or TCP/UDP checksums first, since it will use 553 * the cache containing original values for checksum calculation. 554 */ 555 if (!npf_rwrcksum(npc, di, addr, port)) { 556 return EINVAL; 557 } 558 559 /* 560 * Address translation: rewrite source/destination address, depending 561 * on direction (PFIL_OUT - for source, PFIL_IN - for destination). 562 */ 563 if (!npf_rwrip(npc, di, addr)) { 564 return EINVAL; 565 } 566 if ((np->n_flags & NPF_NAT_PORTS) == 0) { 567 /* Done. */ 568 return 0; 569 } 570 571 switch (proto) { 572 case IPPROTO_TCP: 573 case IPPROTO_UDP: 574 KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP)); 575 /* Rewrite source/destination port. */ 576 if (!npf_rwrport(npc, di, port)) { 577 return EINVAL; 578 } 579 break; 580 case IPPROTO_ICMP: 581 KASSERT(npf_iscached(npc, NPC_ICMP)); 582 /* Nothing. */ 583 break; 584 default: 585 return ENOTSUP; 586 } 587 return 0; 588 } 589 590 /* 591 * npf_do_nat: 592 * - Inspect packet for a NAT policy, unless a session with a NAT 593 * association already exists. In such case, determine whether it 594 * is a "forwards" or "backwards" stream. 595 * - Perform translation: rewrite source or destination fields, 596 * depending on translation type and direction. 597 * - Associate a NAT policy with a session (may establish a new). 598 */ 599 int 600 npf_do_nat(npf_cache_t *npc, npf_session_t *se, nbuf_t *nbuf, const int di) 601 { 602 npf_session_t *nse = NULL; 603 npf_natpolicy_t *np; 604 npf_nat_t *nt; 605 int error; 606 bool forw, new; 607 608 /* All relevant IPv4 data should be already cached. */ 609 if (!npf_iscached(npc, NPC_IP46) || !npf_iscached(npc, NPC_LAYER4)) { 610 return 0; 611 } 612 KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)); 613 614 /* 615 * Return the NAT entry associated with the session, if any. 616 * Determines whether the stream is "forwards" or "backwards". 617 * Note: no need to lock, since reference on session is held. 618 */ 619 if (se && (nt = npf_session_retnat(se, di, &forw)) != NULL) { 620 np = nt->nt_natpolicy; 621 new = false; 622 goto translate; 623 } 624 625 /* 626 * Inspect the packet for a NAT policy, if there is no session. 627 * Note: acquires a reference if found. 628 */ 629 np = npf_nat_inspect(npc, nbuf, di); 630 if (np == NULL) { 631 /* If packet does not match - done. */ 632 return 0; 633 } 634 forw = true; 635 636 /* 637 * Create a new NAT entry (not yet associated with any session). 638 * We will consume the reference on success (release on error). 639 */ 640 nt = npf_nat_create(npc, np); 641 if (nt == NULL) { 642 atomic_dec_uint(&np->n_refcnt); 643 return ENOMEM; 644 } 645 new = true; 646 647 /* Determine whether any ALG matches. */ 648 if (npf_alg_match(npc, nbuf, nt, di)) { 649 KASSERT(nt->nt_alg != NULL); 650 } 651 652 /* 653 * If there is no local session (no "stateful" rule - unusual, but 654 * possible configuration), establish one before translation. Note 655 * that it is not a "pass" session, therefore passing of "backwards" 656 * stream depends on other, stateless filtering rules. 657 */ 658 if (se == NULL) { 659 nse = npf_session_establish(npc, nbuf, di); 660 if (nse == NULL) { 661 error = ENOMEM; 662 goto out; 663 } 664 se = nse; 665 } 666 translate: 667 /* Perform the translation. */ 668 error = npf_nat_translate(npc, nbuf, nt, forw, di); 669 if (error) { 670 goto out; 671 } 672 673 if (__predict_false(new)) { 674 /* 675 * Associate NAT translation entry with the session. 676 * Note: packet now has a translated address in the cache. 677 */ 678 nt->nt_session = se; 679 error = npf_session_setnat(se, nt, di); 680 out: 681 if (error) { 682 /* If session was for NAT only - expire it. */ 683 if (nse) { 684 npf_session_expire(nse); 685 } 686 /* Will free the structure and return the port. */ 687 npf_nat_expire(nt); 688 } 689 if (nse) { 690 npf_session_release(nse); 691 } 692 } 693 return error; 694 } 695 696 /* 697 * npf_nat_gettrans: return translation IP address and port. 698 */ 699 void 700 npf_nat_gettrans(npf_nat_t *nt, npf_addr_t **addr, in_port_t *port) 701 { 702 npf_natpolicy_t *np = nt->nt_natpolicy; 703 704 *addr = &np->n_taddr; 705 *port = nt->nt_tport; 706 } 707 708 /* 709 * npf_nat_getorig: return original IP address and port from translation entry. 710 */ 711 void 712 npf_nat_getorig(npf_nat_t *nt, npf_addr_t **addr, in_port_t *port) 713 { 714 715 *addr = &nt->nt_oaddr; 716 *port = nt->nt_oport; 717 } 718 719 /* 720 * npf_nat_setalg: associate an ALG with the NAT entry. 721 */ 722 void 723 npf_nat_setalg(npf_nat_t *nt, npf_alg_t *alg, uintptr_t arg) 724 { 725 726 nt->nt_alg = alg; 727 nt->nt_alg_arg = arg; 728 } 729 730 /* 731 * npf_nat_expire: free NAT-related data structures on session expiration. 732 */ 733 void 734 npf_nat_expire(npf_nat_t *nt) 735 { 736 npf_natpolicy_t *np = nt->nt_natpolicy; 737 738 /* Return any taken port to the portmap. */ 739 if ((np->n_flags & NPF_NAT_PORTMAP) != 0 && nt->nt_tport) { 740 npf_nat_putport(np, nt->nt_tport); 741 } 742 743 /* Remove NAT entry from the list, notify any waiters if last entry. */ 744 mutex_enter(&np->n_lock); 745 LIST_REMOVE(nt, nt_entry); 746 if (LIST_EMPTY(&np->n_nat_list)) { 747 cv_broadcast(&np->n_cv); 748 } 749 atomic_dec_uint(&np->n_refcnt); 750 mutex_exit(&np->n_lock); 751 752 /* Free structure, increase the counter. */ 753 pool_cache_put(nat_cache, nt); 754 npf_stats_inc(NPF_STAT_NAT_DESTROY); 755 } 756 757 /* 758 * npf_nat_save: construct NAT entry and reference to the NAT policy. 759 */ 760 int 761 npf_nat_save(prop_dictionary_t sedict, prop_array_t natlist, npf_nat_t *nt) 762 { 763 npf_natpolicy_t *np = nt->nt_natpolicy; 764 prop_object_iterator_t it; 765 prop_dictionary_t npdict; 766 prop_data_t nd, npd; 767 uint64_t itnp; 768 769 /* Set NAT entry data. */ 770 nd = prop_data_create_data(nt, sizeof(npf_nat_t)); 771 prop_dictionary_set(sedict, "nat-data", nd); 772 prop_object_release(nd); 773 774 /* Find or create a NAT policy. */ 775 it = prop_array_iterator(natlist); 776 while ((npdict = prop_object_iterator_next(it)) != NULL) { 777 CTASSERT(sizeof(uintptr_t) <= sizeof(uint64_t)); 778 prop_dictionary_get_uint64(npdict, "id-ptr", &itnp); 779 if ((uintptr_t)itnp == (uintptr_t)np) { 780 break; 781 } 782 } 783 if (npdict == NULL) { 784 /* Create NAT policy dictionary and copy the data. */ 785 npdict = prop_dictionary_create(); 786 npd = prop_data_create_data(np, sizeof(npf_natpolicy_t)); 787 prop_dictionary_set(npdict, "nat-policy-data", npd); 788 prop_object_release(npd); 789 790 CTASSERT(sizeof(uintptr_t) <= sizeof(uint64_t)); 791 prop_dictionary_set_uint64(npdict, "id-ptr", (uintptr_t)np); 792 prop_array_add(natlist, npdict); 793 prop_object_release(npdict); 794 } 795 prop_dictionary_set(sedict, "nat-policy", npdict); 796 prop_object_release(npdict); 797 return 0; 798 } 799 800 /* 801 * npf_nat_restore: find a matching NAT policy and restore NAT entry. 802 * 803 * => Caller should lock the active NAT ruleset. 804 */ 805 npf_nat_t * 806 npf_nat_restore(prop_dictionary_t sedict, npf_session_t *se) 807 { 808 const npf_natpolicy_t *onp; 809 const npf_nat_t *ntraw; 810 prop_object_t obj; 811 npf_natpolicy_t *np; 812 npf_rule_t *rl; 813 npf_nat_t *nt; 814 815 /* Get raw NAT entry. */ 816 obj = prop_dictionary_get(sedict, "nat-data"); 817 ntraw = prop_data_data_nocopy(obj); 818 if (ntraw == NULL || prop_data_size(obj) != sizeof(npf_nat_t)) { 819 return NULL; 820 } 821 822 /* Find a stored NAT policy information. */ 823 obj = prop_dictionary_get( 824 prop_dictionary_get(sedict, "nat-policy"), "nat-policy-data"); 825 onp = prop_data_data_nocopy(obj); 826 if (onp == NULL || prop_data_size(obj) != sizeof(npf_natpolicy_t)) { 827 return NULL; 828 } 829 830 /* Match if there is an existing NAT policy. */ 831 KASSERT(npf_config_locked_p()); 832 rl = npf_ruleset_matchnat(npf_config_natset(), __UNCONST(onp)); 833 if (rl == NULL) { 834 return NULL; 835 } 836 np = npf_rule_getnat(rl); 837 KASSERT(np != NULL); 838 839 /* Take a specific port from port-map. */ 840 if (!npf_nat_takeport(np, ntraw->nt_tport)) { 841 return NULL; 842 } 843 844 /* Create and return NAT entry for association. */ 845 nt = pool_cache_get(nat_cache, PR_WAITOK); 846 memcpy(nt, ntraw, sizeof(npf_nat_t)); 847 LIST_INSERT_HEAD(&np->n_nat_list, nt, nt_entry); 848 nt->nt_natpolicy = np; 849 nt->nt_session = se; 850 nt->nt_alg = NULL; 851 return nt; 852 } 853 854 #if defined(DDB) || defined(_NPF_TESTING) 855 856 void 857 npf_nat_dump(const npf_nat_t *nt) 858 { 859 const npf_natpolicy_t *np; 860 struct in_addr ip; 861 862 np = nt->nt_natpolicy; 863 memcpy(&ip, &np->n_taddr, sizeof(ip)); 864 printf("\tNATP(%p): type %d flags 0x%x taddr %s tport %d\n", 865 np, np->n_type, np->n_flags, inet_ntoa(ip), np->n_tport); 866 memcpy(&ip, &nt->nt_oaddr, sizeof(ip)); 867 printf("\tNAT: original address %s oport %d tport %d\n", 868 inet_ntoa(ip), ntohs(nt->nt_oport), ntohs(nt->nt_tport)); 869 if (nt->nt_alg) { 870 printf("\tNAT ALG = %p, ARG = %p\n", 871 nt->nt_alg, (void *)nt->nt_alg_arg); 872 } 873 } 874 875 #endif 876