1 /* $NetBSD: npf_nat.c,v 1.28 2014/05/30 23:26:06 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2014 Mindaugas Rasiukevicius <rmind at netbsd org> 5 * Copyright (c) 2010-2013 The NetBSD Foundation, Inc. 6 * All rights reserved. 7 * 8 * This material is based upon work partially supported by The 9 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 /* 34 * NPF network address port translation (NAPT) and other forms of NAT. 35 * Described in RFC 2663, RFC 3022, etc. 36 * 37 * Overview 38 * 39 * There are few mechanisms: NAT policy, port map and translation. 40 * NAT module has a separate ruleset, where rules contain associated 41 * NAT policy, thus flexible filter criteria can be used. 42 * 43 * Translation types 44 * 45 * There are two types of translation: outbound (NPF_NATOUT) and 46 * inbound (NPF_NATIN). It should not be confused with connection 47 * direction. See npf_nat_which() for the description of how the 48 * addresses are rewritten. 49 * 50 * It should be noted that bi-directional NAT is a combined outbound 51 * and inbound translation, therefore constructed as two policies. 52 * 53 * NAT policies and port maps 54 * 55 * NAT (translation) policy is applied when a packet matches the rule. 56 * Apart from filter criteria, NAT policy has a translation IP address 57 * and associated port map. Port map is a bitmap used to reserve and 58 * use unique TCP/UDP ports for translation. Port maps are unique to 59 * the IP addresses, therefore multiple NAT policies with the same IP 60 * will share the same port map. 61 * 62 * Sessions, translation entries and their life-cycle 63 * 64 * NAT module relies on session management module. Each translated 65 * session has an associated translation entry (npf_nat_t), which 66 * contains information used for backwards stream translation, i.e. 67 * original IP address with port and translation port, allocated from 68 * the port map. Each NAT entry is associated with the policy, which 69 * contains translation IP address. Allocated port is returned to the 70 * port map and NAT entry is destroyed when session expires. 71 */ 72 73 #include <sys/cdefs.h> 74 __KERNEL_RCSID(0, "$NetBSD: npf_nat.c,v 1.28 2014/05/30 23:26:06 rmind Exp $"); 75 76 #include <sys/param.h> 77 #include <sys/types.h> 78 79 #include <sys/atomic.h> 80 #include <sys/bitops.h> 81 #include <sys/condvar.h> 82 #include <sys/kmem.h> 83 #include <sys/mutex.h> 84 #include <sys/pool.h> 85 #include <sys/proc.h> 86 #include <sys/cprng.h> 87 88 #include <net/pfil.h> 89 #include <netinet/in.h> 90 91 #include "npf_impl.h" 92 93 /* 94 * NPF portmap structure. 95 */ 96 typedef struct { 97 u_int p_refcnt; 98 uint32_t p_bitmap[0]; 99 } npf_portmap_t; 100 101 /* Portmap range: [ 1024 .. 65535 ] */ 102 #define PORTMAP_FIRST (1024) 103 #define PORTMAP_SIZE ((65536 - PORTMAP_FIRST) / 32) 104 #define PORTMAP_FILLED ((uint32_t)~0U) 105 #define PORTMAP_MASK (31) 106 #define PORTMAP_SHIFT (5) 107 108 #define PORTMAP_MEM_SIZE \ 109 (sizeof(npf_portmap_t) + (PORTMAP_SIZE * sizeof(uint32_t))) 110 111 /* 112 * NAT policy structure. 113 */ 114 struct npf_natpolicy { 115 LIST_HEAD(, npf_nat) n_nat_list; 116 volatile u_int n_refcnt; 117 kmutex_t n_lock; 118 npf_portmap_t * n_portmap; 119 /* NPF_NP_CMP_START */ 120 int n_type; 121 u_int n_flags; 122 size_t n_addr_sz; 123 npf_addr_t n_taddr; 124 npf_netmask_t n_tmask; 125 in_port_t n_tport; 126 u_int n_algo; 127 union { 128 uint16_t n_npt66_adj; 129 }; 130 }; 131 132 #define NPF_NP_CMP_START offsetof(npf_natpolicy_t, n_type) 133 #define NPF_NP_CMP_SIZE (sizeof(npf_natpolicy_t) - NPF_NP_CMP_START) 134 135 /* 136 * NAT translation entry for a session. 137 */ 138 struct npf_nat { 139 /* Associated NAT policy. */ 140 npf_natpolicy_t * nt_natpolicy; 141 142 /* 143 * Original address and port (for backwards translation). 144 * Translation port (for redirects). 145 */ 146 npf_addr_t nt_oaddr; 147 in_port_t nt_oport; 148 in_port_t nt_tport; 149 150 /* ALG (if any) associated with this NAT entry. */ 151 npf_alg_t * nt_alg; 152 uintptr_t nt_alg_arg; 153 154 LIST_ENTRY(npf_nat) nt_entry; 155 npf_session_t * nt_session; 156 }; 157 158 static pool_cache_t nat_cache __read_mostly; 159 160 /* 161 * npf_nat_sys{init,fini}: initialise/destroy NAT subsystem structures. 162 */ 163 164 void 165 npf_nat_sysinit(void) 166 { 167 nat_cache = pool_cache_init(sizeof(npf_nat_t), coherency_unit, 168 0, 0, "npfnatpl", NULL, IPL_NET, NULL, NULL, NULL); 169 KASSERT(nat_cache != NULL); 170 } 171 172 void 173 npf_nat_sysfini(void) 174 { 175 /* All NAT policies should already be destroyed. */ 176 pool_cache_destroy(nat_cache); 177 } 178 179 /* 180 * npf_nat_newpolicy: create a new NAT policy. 181 * 182 * => Shares portmap if policy is on existing translation address. 183 */ 184 npf_natpolicy_t * 185 npf_nat_newpolicy(prop_dictionary_t natdict, npf_ruleset_t *nrlset) 186 { 187 npf_natpolicy_t *np; 188 prop_object_t obj; 189 npf_portmap_t *pm; 190 191 np = kmem_zalloc(sizeof(npf_natpolicy_t), KM_SLEEP); 192 193 /* Translation type and flags. */ 194 prop_dictionary_get_int32(natdict, "type", &np->n_type); 195 prop_dictionary_get_uint32(natdict, "flags", &np->n_flags); 196 197 /* Should be exclusively either inbound or outbound NAT. */ 198 if (((np->n_type == NPF_NATIN) ^ (np->n_type == NPF_NATOUT)) == 0) { 199 goto err; 200 } 201 mutex_init(&np->n_lock, MUTEX_DEFAULT, IPL_SOFTNET); 202 LIST_INIT(&np->n_nat_list); 203 204 /* Translation IP, mask and port (if applicable). */ 205 obj = prop_dictionary_get(natdict, "translation-ip"); 206 np->n_addr_sz = prop_data_size(obj); 207 if (np->n_addr_sz == 0 || np->n_addr_sz > sizeof(npf_addr_t)) { 208 goto err; 209 } 210 memcpy(&np->n_taddr, prop_data_data_nocopy(obj), np->n_addr_sz); 211 prop_dictionary_get_uint8(natdict, "translation-mask", &np->n_tmask); 212 prop_dictionary_get_uint16(natdict, "translation-port", &np->n_tport); 213 214 prop_dictionary_get_uint32(natdict, "translation-algo", &np->n_algo); 215 switch (np->n_algo) { 216 case NPF_ALGO_NPT66: 217 prop_dictionary_get_uint16(natdict, "npt66-adjustment", 218 &np->n_npt66_adj); 219 break; 220 default: 221 if (np->n_tmask != NPF_NO_NETMASK) 222 goto err; 223 break; 224 } 225 226 /* Determine if port map is needed. */ 227 np->n_portmap = NULL; 228 if ((np->n_flags & NPF_NAT_PORTMAP) == 0) { 229 /* No port map. */ 230 return np; 231 } 232 233 /* 234 * Inspect NAT policies in the ruleset for port map sharing. 235 * Note that npf_ruleset_sharepm() will increase the reference count. 236 */ 237 if (!npf_ruleset_sharepm(nrlset, np)) { 238 /* Allocate a new port map for the NAT policy. */ 239 pm = kmem_zalloc(PORTMAP_MEM_SIZE, KM_SLEEP); 240 pm->p_refcnt = 1; 241 KASSERT((uintptr_t)pm->p_bitmap == (uintptr_t)pm + sizeof(*pm)); 242 np->n_portmap = pm; 243 } else { 244 KASSERT(np->n_portmap != NULL); 245 } 246 return np; 247 err: 248 kmem_free(np, sizeof(npf_natpolicy_t)); 249 return NULL; 250 } 251 252 /* 253 * npf_nat_freepolicy: free NAT policy and, on last reference, free portmap. 254 * 255 * => Called from npf_rule_free() during the reload via npf_ruleset_destroy(). 256 */ 257 void 258 npf_nat_freepolicy(npf_natpolicy_t *np) 259 { 260 npf_portmap_t *pm = np->n_portmap; 261 npf_session_t *se; 262 npf_nat_t *nt; 263 264 /* 265 * Disassociate all entries from the policy. At this point, 266 * new entries can no longer be created for this policy. 267 */ 268 while (np->n_refcnt) { 269 mutex_enter(&np->n_lock); 270 LIST_FOREACH(nt, &np->n_nat_list, nt_entry) { 271 se = nt->nt_session; 272 KASSERT(se != NULL); 273 npf_session_expire(se); 274 } 275 mutex_exit(&np->n_lock); 276 277 /* Kick the worker - all references should be going away. */ 278 npf_worker_signal(); 279 kpause("npfgcnat", false, 1, NULL); 280 } 281 KASSERT(LIST_EMPTY(&np->n_nat_list)); 282 283 /* Destroy the port map, on last reference. */ 284 if (pm && --pm->p_refcnt == 0) { 285 KASSERT((np->n_flags & NPF_NAT_PORTMAP) != 0); 286 kmem_free(pm, PORTMAP_MEM_SIZE); 287 } 288 mutex_destroy(&np->n_lock); 289 kmem_free(np, sizeof(npf_natpolicy_t)); 290 } 291 292 void 293 npf_nat_freealg(npf_natpolicy_t *np, npf_alg_t *alg) 294 { 295 npf_nat_t *nt; 296 297 mutex_enter(&np->n_lock); 298 LIST_FOREACH(nt, &np->n_nat_list, nt_entry) { 299 if (nt->nt_alg != alg) { 300 continue; 301 } 302 nt->nt_alg = NULL; 303 } 304 mutex_exit(&np->n_lock); 305 } 306 307 /* 308 * npf_nat_matchpolicy: compare two NAT policies. 309 * 310 * => Return 0 on match, and non-zero otherwise. 311 */ 312 bool 313 npf_nat_matchpolicy(npf_natpolicy_t *np, npf_natpolicy_t *mnp) 314 { 315 void *np_raw, *mnp_raw; 316 /* 317 * Compare the relevant NAT policy information (in raw form), 318 * which is enough for matching criterion. 319 */ 320 KASSERT(np && mnp && np != mnp); 321 np_raw = (uint8_t *)np + NPF_NP_CMP_START; 322 mnp_raw = (uint8_t *)mnp + NPF_NP_CMP_START; 323 return (memcmp(np_raw, mnp_raw, NPF_NP_CMP_SIZE) == 0); 324 } 325 326 bool 327 npf_nat_sharepm(npf_natpolicy_t *np, npf_natpolicy_t *mnp) 328 { 329 npf_portmap_t *pm, *mpm; 330 331 KASSERT(np && mnp && np != mnp); 332 333 /* Using port map and having equal translation address? */ 334 if ((np->n_flags & mnp->n_flags & NPF_NAT_PORTMAP) == 0) { 335 return false; 336 } 337 if (np->n_addr_sz != mnp->n_addr_sz) { 338 return false; 339 } 340 if (memcmp(&np->n_taddr, &mnp->n_taddr, np->n_addr_sz) != 0) { 341 return false; 342 } 343 /* If NAT policy has an old port map - drop the reference. */ 344 mpm = mnp->n_portmap; 345 if (mpm) { 346 /* Note: at this point we cannot hold a last reference. */ 347 KASSERT(mpm->p_refcnt > 1); 348 mpm->p_refcnt--; 349 } 350 /* Share the port map. */ 351 pm = np->n_portmap; 352 mnp->n_portmap = pm; 353 pm->p_refcnt++; 354 return true; 355 } 356 357 /* 358 * npf_nat_getport: allocate and return a port in the NAT policy portmap. 359 * 360 * => Returns in network byte-order. 361 * => Zero indicates failure. 362 */ 363 static in_port_t 364 npf_nat_getport(npf_natpolicy_t *np) 365 { 366 npf_portmap_t *pm = np->n_portmap; 367 u_int n = PORTMAP_SIZE, idx, bit; 368 uint32_t map, nmap; 369 370 idx = cprng_fast32() % PORTMAP_SIZE; 371 for (;;) { 372 KASSERT(idx < PORTMAP_SIZE); 373 map = pm->p_bitmap[idx]; 374 if (__predict_false(map == PORTMAP_FILLED)) { 375 if (n-- == 0) { 376 /* No space. */ 377 return 0; 378 } 379 /* This bitmap is filled, next. */ 380 idx = (idx ? idx : PORTMAP_SIZE) - 1; 381 continue; 382 } 383 bit = ffs32(~map) - 1; 384 nmap = map | (1 << bit); 385 if (atomic_cas_32(&pm->p_bitmap[idx], map, nmap) == map) { 386 /* Success. */ 387 break; 388 } 389 } 390 return htons(PORTMAP_FIRST + (idx << PORTMAP_SHIFT) + bit); 391 } 392 393 /* 394 * npf_nat_takeport: allocate specific port in the NAT policy portmap. 395 */ 396 static bool 397 npf_nat_takeport(npf_natpolicy_t *np, in_port_t port) 398 { 399 npf_portmap_t *pm = np->n_portmap; 400 uint32_t map, nmap; 401 u_int idx, bit; 402 403 port = ntohs(port) - PORTMAP_FIRST; 404 idx = port >> PORTMAP_SHIFT; 405 bit = port & PORTMAP_MASK; 406 map = pm->p_bitmap[idx]; 407 nmap = map | (1 << bit); 408 if (map == nmap) { 409 /* Already taken. */ 410 return false; 411 } 412 return atomic_cas_32(&pm->p_bitmap[idx], map, nmap) == map; 413 } 414 415 /* 416 * npf_nat_putport: return port as available in the NAT policy portmap. 417 * 418 * => Port should be in network byte-order. 419 */ 420 static void 421 npf_nat_putport(npf_natpolicy_t *np, in_port_t port) 422 { 423 npf_portmap_t *pm = np->n_portmap; 424 uint32_t map, nmap; 425 u_int idx, bit; 426 427 port = ntohs(port) - PORTMAP_FIRST; 428 idx = port >> PORTMAP_SHIFT; 429 bit = port & PORTMAP_MASK; 430 do { 431 map = pm->p_bitmap[idx]; 432 KASSERT(map | (1 << bit)); 433 nmap = map & ~(1 << bit); 434 } while (atomic_cas_32(&pm->p_bitmap[idx], map, nmap) != map); 435 } 436 437 /* 438 * npf_nat_which: tell which address (source or destination) should be 439 * rewritten given the combination of the NAT type and flow direction. 440 */ 441 static inline u_int 442 npf_nat_which(const int type, bool forw) 443 { 444 /* 445 * Outbound NAT rewrites: 446 * - Source (NPF_SRC) on "forwards" stream. 447 * - Destination (NPF_DST) on "backwards" stream. 448 * Inbound NAT is other way round. 449 */ 450 if (type == NPF_NATOUT) { 451 forw = !forw; 452 } else { 453 KASSERT(type == NPF_NATIN); 454 } 455 CTASSERT(NPF_SRC == 0 && NPF_DST == 1); 456 KASSERT(forw == NPF_SRC || forw == NPF_DST); 457 return (u_int)forw; 458 } 459 460 /* 461 * npf_nat_inspect: inspect packet against NAT ruleset and return a policy. 462 * 463 * => Acquire a reference on the policy, if found. 464 */ 465 static npf_natpolicy_t * 466 npf_nat_inspect(npf_cache_t *npc, nbuf_t *nbuf, const int di) 467 { 468 int slock = npf_config_read_enter(); 469 npf_ruleset_t *rlset = npf_config_natset(); 470 npf_natpolicy_t *np; 471 npf_rule_t *rl; 472 473 rl = npf_ruleset_inspect(npc, nbuf, rlset, di, NPF_LAYER_3); 474 if (rl == NULL) { 475 npf_config_read_exit(slock); 476 return NULL; 477 } 478 np = npf_rule_getnat(rl); 479 atomic_inc_uint(&np->n_refcnt); 480 npf_config_read_exit(slock); 481 return np; 482 } 483 484 /* 485 * npf_nat_create: create a new NAT translation entry. 486 */ 487 static npf_nat_t * 488 npf_nat_create(npf_cache_t *npc, npf_natpolicy_t *np, npf_session_t *se) 489 { 490 const int proto = npc->npc_proto; 491 npf_nat_t *nt; 492 493 KASSERT(npf_iscached(npc, NPC_IP46)); 494 KASSERT(npf_iscached(npc, NPC_LAYER4)); 495 496 /* Construct a new NAT entry and associate it with the session. */ 497 nt = pool_cache_get(nat_cache, PR_NOWAIT); 498 if (nt == NULL){ 499 return NULL; 500 } 501 npf_stats_inc(NPF_STAT_NAT_CREATE); 502 nt->nt_natpolicy = np; 503 nt->nt_session = se; 504 nt->nt_alg = NULL; 505 506 /* Save the original address which may be rewritten. */ 507 if (np->n_type == NPF_NATOUT) { 508 /* Outbound NAT: source (think internal) address. */ 509 memcpy(&nt->nt_oaddr, npc->npc_ips[NPF_SRC], npc->npc_alen); 510 } else { 511 /* Inbound NAT: destination (think external) address. */ 512 KASSERT(np->n_type == NPF_NATIN); 513 memcpy(&nt->nt_oaddr, npc->npc_ips[NPF_DST], npc->npc_alen); 514 } 515 516 /* 517 * Port translation, if required, and if it is TCP/UDP. 518 */ 519 if ((np->n_flags & NPF_NAT_PORTS) == 0 || 520 (proto != IPPROTO_TCP && proto != IPPROTO_UDP)) { 521 nt->nt_oport = 0; 522 nt->nt_tport = 0; 523 goto out; 524 } 525 526 /* Save the relevant TCP/UDP port. */ 527 if (proto == IPPROTO_TCP) { 528 const struct tcphdr *th = npc->npc_l4.tcp; 529 nt->nt_oport = (np->n_type == NPF_NATOUT) ? 530 th->th_sport : th->th_dport; 531 } else { 532 const struct udphdr *uh = npc->npc_l4.udp; 533 nt->nt_oport = (np->n_type == NPF_NATOUT) ? 534 uh->uh_sport : uh->uh_dport; 535 } 536 537 /* Get a new port for translation. */ 538 if ((np->n_flags & NPF_NAT_PORTMAP) != 0) { 539 nt->nt_tport = npf_nat_getport(np); 540 } else { 541 nt->nt_tport = np->n_tport; 542 } 543 out: 544 mutex_enter(&np->n_lock); 545 LIST_INSERT_HEAD(&np->n_nat_list, nt, nt_entry); 546 mutex_exit(&np->n_lock); 547 return nt; 548 } 549 550 /* 551 * npf_nat_translate: perform translation given the state data. 552 */ 553 static inline int 554 npf_nat_translate(npf_cache_t *npc, nbuf_t *nbuf, npf_nat_t *nt, bool forw) 555 { 556 const npf_natpolicy_t *np = nt->nt_natpolicy; 557 const u_int which = npf_nat_which(np->n_type, forw); 558 const npf_addr_t *addr; 559 in_port_t port; 560 561 KASSERT(npf_iscached(npc, NPC_IP46)); 562 KASSERT(npf_iscached(npc, NPC_LAYER4)); 563 564 if (forw) { 565 /* "Forwards" stream: use translation address/port. */ 566 addr = &np->n_taddr; 567 port = nt->nt_tport; 568 } else { 569 /* "Backwards" stream: use original address/port. */ 570 addr = &nt->nt_oaddr; 571 port = nt->nt_oport; 572 } 573 KASSERT((np->n_flags & NPF_NAT_PORTS) != 0 || port == 0); 574 575 /* Execute ALG translation first. */ 576 if ((npc->npc_info & NPC_ALG_EXEC) == 0) { 577 npc->npc_info |= NPC_ALG_EXEC; 578 npf_alg_exec(npc, nbuf, nt, forw); 579 npf_recache(npc, nbuf); 580 } 581 KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)); 582 583 /* Finally, perform the translation. */ 584 return npf_napt_rwr(npc, which, addr, port); 585 } 586 587 /* 588 * npf_nat_algo: perform the translation given the algorithm. 589 */ 590 static inline int 591 npf_nat_algo(npf_cache_t *npc, const npf_natpolicy_t *np, bool forw) 592 { 593 const u_int which = npf_nat_which(np->n_type, forw); 594 int error; 595 596 switch (np->n_algo) { 597 case NPF_ALGO_NPT66: 598 error = npf_npt66_rwr(npc, which, &np->n_taddr, 599 np->n_tmask, np->n_npt66_adj); 600 break; 601 default: 602 error = npf_napt_rwr(npc, which, &np->n_taddr, np->n_tport); 603 break; 604 } 605 606 return error; 607 } 608 609 /* 610 * npf_do_nat: 611 * - Inspect packet for a NAT policy, unless a session with a NAT 612 * association already exists. In such case, determine whether it 613 * is a "forwards" or "backwards" stream. 614 * - Perform translation: rewrite source or destination fields, 615 * depending on translation type and direction. 616 * - Associate a NAT policy with a session (may establish a new). 617 */ 618 int 619 npf_do_nat(npf_cache_t *npc, npf_session_t *se, nbuf_t *nbuf, const int di) 620 { 621 npf_session_t *nse = NULL; 622 npf_natpolicy_t *np; 623 npf_nat_t *nt; 624 int error; 625 bool forw; 626 627 /* All relevant IPv4 data should be already cached. */ 628 if (!npf_iscached(npc, NPC_IP46) || !npf_iscached(npc, NPC_LAYER4)) { 629 return 0; 630 } 631 KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)); 632 633 /* 634 * Return the NAT entry associated with the session, if any. 635 * Determines whether the stream is "forwards" or "backwards". 636 * Note: no need to lock, since reference on session is held. 637 */ 638 if (se && (nt = npf_session_retnat(se, di, &forw)) != NULL) { 639 np = nt->nt_natpolicy; 640 goto translate; 641 } 642 643 /* 644 * Inspect the packet for a NAT policy, if there is no session. 645 * Note: acquires a reference if found. 646 */ 647 np = npf_nat_inspect(npc, nbuf, di); 648 if (np == NULL) { 649 /* If packet does not match - done. */ 650 return 0; 651 } 652 forw = true; 653 654 /* Static NAT - just perform the translation. */ 655 if (np->n_flags & NPF_NAT_STATIC) { 656 if (nbuf_cksum_barrier(nbuf, di)) { 657 npf_recache(npc, nbuf); 658 } 659 error = npf_nat_algo(npc, np, forw); 660 atomic_dec_uint(&np->n_refcnt); 661 return error; 662 } 663 664 /* 665 * If there is no local session (no "stateful" rule - unusual, but 666 * possible configuration), establish one before translation. Note 667 * that it is not a "pass" session, therefore passing of "backwards" 668 * stream depends on other, stateless filtering rules. 669 */ 670 if (se == NULL) { 671 nse = npf_session_establish(npc, nbuf, di, true); 672 if (nse == NULL) { 673 atomic_dec_uint(&np->n_refcnt); 674 return ENOMEM; 675 } 676 se = nse; 677 } 678 679 /* 680 * Create a new NAT entry and associate with the session. 681 * We will consume the reference on success (release on error). 682 */ 683 nt = npf_nat_create(npc, np, se); 684 if (nt == NULL) { 685 atomic_dec_uint(&np->n_refcnt); 686 error = ENOMEM; 687 goto out; 688 } 689 690 /* Associate the NAT translation entry with the session. */ 691 error = npf_session_setnat(se, nt, np->n_type); 692 if (error) { 693 /* Will release the reference. */ 694 npf_nat_destroy(nt); 695 goto out; 696 } 697 698 /* Determine whether any ALG matches. */ 699 if (npf_alg_match(npc, nbuf, nt, di)) { 700 KASSERT(nt->nt_alg != NULL); 701 } 702 703 translate: 704 /* May need to process the delayed checksums first (XXX: NetBSD). */ 705 if (nbuf_cksum_barrier(nbuf, di)) { 706 npf_recache(npc, nbuf); 707 } 708 709 /* Perform the translation. */ 710 error = npf_nat_translate(npc, nbuf, nt, forw); 711 out: 712 if (__predict_false(nse)) { 713 if (error) { 714 /* It created for NAT - just expire. */ 715 npf_session_expire(nse); 716 } 717 npf_session_release(nse); 718 } 719 return error; 720 } 721 722 /* 723 * npf_nat_gettrans: return translation IP address and port. 724 */ 725 void 726 npf_nat_gettrans(npf_nat_t *nt, npf_addr_t **addr, in_port_t *port) 727 { 728 npf_natpolicy_t *np = nt->nt_natpolicy; 729 730 *addr = &np->n_taddr; 731 *port = nt->nt_tport; 732 } 733 734 /* 735 * npf_nat_getorig: return original IP address and port from translation entry. 736 */ 737 void 738 npf_nat_getorig(npf_nat_t *nt, npf_addr_t **addr, in_port_t *port) 739 { 740 *addr = &nt->nt_oaddr; 741 *port = nt->nt_oport; 742 } 743 744 /* 745 * npf_nat_setalg: associate an ALG with the NAT entry. 746 */ 747 void 748 npf_nat_setalg(npf_nat_t *nt, npf_alg_t *alg, uintptr_t arg) 749 { 750 nt->nt_alg = alg; 751 nt->nt_alg_arg = arg; 752 } 753 754 /* 755 * npf_nat_destroy: destroy NAT structure (performed on session expiration). 756 */ 757 void 758 npf_nat_destroy(npf_nat_t *nt) 759 { 760 npf_natpolicy_t *np = nt->nt_natpolicy; 761 762 /* Return any taken port to the portmap. */ 763 if ((np->n_flags & NPF_NAT_PORTMAP) != 0 && nt->nt_tport) { 764 npf_nat_putport(np, nt->nt_tport); 765 } 766 767 mutex_enter(&np->n_lock); 768 LIST_REMOVE(nt, nt_entry); 769 atomic_dec_uint(&np->n_refcnt); 770 mutex_exit(&np->n_lock); 771 772 pool_cache_put(nat_cache, nt); 773 npf_stats_inc(NPF_STAT_NAT_DESTROY); 774 } 775 776 /* 777 * npf_nat_save: construct NAT entry and reference to the NAT policy. 778 */ 779 int 780 npf_nat_save(prop_dictionary_t sedict, prop_array_t natlist, npf_nat_t *nt) 781 { 782 npf_natpolicy_t *np = nt->nt_natpolicy; 783 prop_object_iterator_t it; 784 prop_dictionary_t npdict; 785 prop_data_t nd, npd; 786 uint64_t itnp; 787 788 /* Set NAT entry data. */ 789 nd = prop_data_create_data(nt, sizeof(npf_nat_t)); 790 prop_dictionary_set(sedict, "nat-data", nd); 791 prop_object_release(nd); 792 793 /* Find or create a NAT policy. */ 794 it = prop_array_iterator(natlist); 795 while ((npdict = prop_object_iterator_next(it)) != NULL) { 796 CTASSERT(sizeof(uintptr_t) <= sizeof(uint64_t)); 797 prop_dictionary_get_uint64(npdict, "id-ptr", &itnp); 798 if ((uintptr_t)itnp == (uintptr_t)np) { 799 break; 800 } 801 } 802 if (npdict == NULL) { 803 /* Create NAT policy dictionary and copy the data. */ 804 npdict = prop_dictionary_create(); 805 npd = prop_data_create_data(np, sizeof(npf_natpolicy_t)); 806 prop_dictionary_set(npdict, "nat-policy-data", npd); 807 prop_object_release(npd); 808 809 CTASSERT(sizeof(uintptr_t) <= sizeof(uint64_t)); 810 prop_dictionary_set_uint64(npdict, "id-ptr", (uintptr_t)np); 811 prop_array_add(natlist, npdict); 812 prop_object_release(npdict); 813 } 814 prop_dictionary_set(sedict, "nat-policy", npdict); 815 prop_object_release(npdict); 816 return 0; 817 } 818 819 /* 820 * npf_nat_restore: find a matching NAT policy and restore NAT entry. 821 * 822 * => Caller should lock the active NAT ruleset. 823 */ 824 npf_nat_t * 825 npf_nat_restore(prop_dictionary_t sedict, npf_session_t *se) 826 { 827 const npf_natpolicy_t *onp; 828 const npf_nat_t *ntraw; 829 prop_object_t obj; 830 npf_natpolicy_t *np; 831 npf_rule_t *rl; 832 npf_nat_t *nt; 833 834 /* Get raw NAT entry. */ 835 obj = prop_dictionary_get(sedict, "nat-data"); 836 ntraw = prop_data_data_nocopy(obj); 837 if (ntraw == NULL || prop_data_size(obj) != sizeof(npf_nat_t)) { 838 return NULL; 839 } 840 841 /* Find a stored NAT policy information. */ 842 obj = prop_dictionary_get( 843 prop_dictionary_get(sedict, "nat-policy"), "nat-policy-data"); 844 onp = prop_data_data_nocopy(obj); 845 if (onp == NULL || prop_data_size(obj) != sizeof(npf_natpolicy_t)) { 846 return NULL; 847 } 848 849 /* 850 * Match if there is an existing NAT policy. Will acquire the 851 * reference on it if further operations are successful. 852 */ 853 KASSERT(npf_config_locked_p()); 854 rl = npf_ruleset_matchnat(npf_config_natset(), __UNCONST(onp)); 855 if (rl == NULL) { 856 return NULL; 857 } 858 np = npf_rule_getnat(rl); 859 KASSERT(np != NULL); 860 861 /* Take a specific port from port-map. */ 862 if (!npf_nat_takeport(np, ntraw->nt_tport)) { 863 return NULL; 864 } 865 atomic_inc_uint(&np->n_refcnt); 866 867 /* Create and return NAT entry for association. */ 868 nt = pool_cache_get(nat_cache, PR_WAITOK); 869 memcpy(nt, ntraw, sizeof(npf_nat_t)); 870 LIST_INSERT_HEAD(&np->n_nat_list, nt, nt_entry); 871 nt->nt_natpolicy = np; 872 nt->nt_session = se; 873 nt->nt_alg = NULL; 874 return nt; 875 } 876 877 #if defined(DDB) || defined(_NPF_TESTING) 878 879 void 880 npf_nat_dump(const npf_nat_t *nt) 881 { 882 const npf_natpolicy_t *np; 883 struct in_addr ip; 884 885 np = nt->nt_natpolicy; 886 memcpy(&ip, &np->n_taddr, sizeof(ip)); 887 printf("\tNATP(%p): type %d flags 0x%x taddr %s tport %d\n", 888 np, np->n_type, np->n_flags, inet_ntoa(ip), np->n_tport); 889 memcpy(&ip, &nt->nt_oaddr, sizeof(ip)); 890 printf("\tNAT: original address %s oport %d tport %d\n", 891 inet_ntoa(ip), ntohs(nt->nt_oport), ntohs(nt->nt_tport)); 892 if (nt->nt_alg) { 893 printf("\tNAT ALG = %p, ARG = %p\n", 894 nt->nt_alg, (void *)nt->nt_alg_arg); 895 } 896 } 897 898 #endif 899