1 /* $NetBSD: npf_nat.c,v 1.31 2014/07/23 01:25:34 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2014 Mindaugas Rasiukevicius <rmind at netbsd org> 5 * Copyright (c) 2010-2013 The NetBSD Foundation, Inc. 6 * All rights reserved. 7 * 8 * This material is based upon work partially supported by The 9 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 21 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 /* 34 * NPF network address port translation (NAPT) and other forms of NAT. 35 * Described in RFC 2663, RFC 3022, etc. 36 * 37 * Overview 38 * 39 * There are few mechanisms: NAT policy, port map and translation. 40 * NAT module has a separate ruleset, where rules contain associated 41 * NAT policy, thus flexible filter criteria can be used. 42 * 43 * Translation types 44 * 45 * There are two types of translation: outbound (NPF_NATOUT) and 46 * inbound (NPF_NATIN). It should not be confused with connection 47 * direction. See npf_nat_which() for the description of how the 48 * addresses are rewritten. 49 * 50 * It should be noted that bi-directional NAT is a combined outbound 51 * and inbound translation, therefore constructed as two policies. 52 * 53 * NAT policies and port maps 54 * 55 * NAT (translation) policy is applied when a packet matches the rule. 56 * Apart from filter criteria, NAT policy has a translation IP address 57 * and associated port map. Port map is a bitmap used to reserve and 58 * use unique TCP/UDP ports for translation. Port maps are unique to 59 * the IP addresses, therefore multiple NAT policies with the same IP 60 * will share the same port map. 61 * 62 * Connections, translation entries and their life-cycle 63 * 64 * NAT module relies on connection tracking module. Each translated 65 * connection has an associated translation entry (npf_nat_t), which 66 * contains information used for backwards stream translation, i.e. 67 * original IP address with port and translation port, allocated from 68 * the port map. Each NAT entry is associated with the policy, which 69 * contains translation IP address. Allocated port is returned to the 70 * port map and NAT entry is destroyed when connection expires. 71 */ 72 73 #include <sys/cdefs.h> 74 __KERNEL_RCSID(0, "$NetBSD: npf_nat.c,v 1.31 2014/07/23 01:25:34 rmind Exp $"); 75 76 #include <sys/param.h> 77 #include <sys/types.h> 78 79 #include <sys/atomic.h> 80 #include <sys/bitops.h> 81 #include <sys/condvar.h> 82 #include <sys/kmem.h> 83 #include <sys/mutex.h> 84 #include <sys/pool.h> 85 #include <sys/proc.h> 86 #include <sys/cprng.h> 87 88 #include <net/pfil.h> 89 #include <netinet/in.h> 90 91 #include "npf_impl.h" 92 #include "npf_conn.h" 93 94 /* 95 * NPF portmap structure. 96 */ 97 typedef struct { 98 u_int p_refcnt; 99 uint32_t p_bitmap[0]; 100 } npf_portmap_t; 101 102 /* Portmap range: [ 1024 .. 65535 ] */ 103 #define PORTMAP_FIRST (1024) 104 #define PORTMAP_SIZE ((65536 - PORTMAP_FIRST) / 32) 105 #define PORTMAP_FILLED ((uint32_t)~0U) 106 #define PORTMAP_MASK (31) 107 #define PORTMAP_SHIFT (5) 108 109 #define PORTMAP_MEM_SIZE \ 110 (sizeof(npf_portmap_t) + (PORTMAP_SIZE * sizeof(uint32_t))) 111 112 /* 113 * NAT policy structure. 114 */ 115 struct npf_natpolicy { 116 kmutex_t n_lock; 117 LIST_HEAD(, npf_nat) n_nat_list; 118 volatile u_int n_refcnt; 119 npf_portmap_t * n_portmap; 120 uint64_t n_id; 121 122 /* 123 * Translation type, flags and address. Optionally, prefix 124 * for the NPTv6 and translation port. Translation algorithm 125 * and related data (for NPTv6, the adjustment value). 126 * 127 * NPF_NP_CMP_START mark starts here. 128 */ 129 int n_type; 130 u_int n_flags; 131 u_int n_alen; 132 npf_addr_t n_taddr; 133 npf_netmask_t n_tmask; 134 in_port_t n_tport; 135 u_int n_algo; 136 union { 137 uint16_t n_npt66_adj; 138 }; 139 }; 140 141 #define NPF_NP_CMP_START offsetof(npf_natpolicy_t, n_type) 142 #define NPF_NP_CMP_SIZE (sizeof(npf_natpolicy_t) - NPF_NP_CMP_START) 143 144 /* 145 * NAT translation entry for a connection. 146 */ 147 struct npf_nat { 148 /* Associated NAT policy. */ 149 npf_natpolicy_t * nt_natpolicy; 150 151 /* 152 * Original address and port (for backwards translation). 153 * Translation port (for redirects). 154 */ 155 npf_addr_t nt_oaddr; 156 in_port_t nt_oport; 157 in_port_t nt_tport; 158 159 /* ALG (if any) associated with this NAT entry. */ 160 npf_alg_t * nt_alg; 161 uintptr_t nt_alg_arg; 162 163 LIST_ENTRY(npf_nat) nt_entry; 164 npf_conn_t * nt_conn; 165 }; 166 167 static pool_cache_t nat_cache __read_mostly; 168 169 /* 170 * npf_nat_sys{init,fini}: initialise/destroy NAT subsystem structures. 171 */ 172 173 void 174 npf_nat_sysinit(void) 175 { 176 nat_cache = pool_cache_init(sizeof(npf_nat_t), coherency_unit, 177 0, 0, "npfnatpl", NULL, IPL_NET, NULL, NULL, NULL); 178 KASSERT(nat_cache != NULL); 179 } 180 181 void 182 npf_nat_sysfini(void) 183 { 184 /* All NAT policies should already be destroyed. */ 185 pool_cache_destroy(nat_cache); 186 } 187 188 /* 189 * npf_nat_newpolicy: create a new NAT policy. 190 * 191 * => Shares portmap if policy is on existing translation address. 192 */ 193 npf_natpolicy_t * 194 npf_nat_newpolicy(prop_dictionary_t natdict, npf_ruleset_t *rset) 195 { 196 npf_natpolicy_t *np; 197 prop_object_t obj; 198 npf_portmap_t *pm; 199 200 np = kmem_zalloc(sizeof(npf_natpolicy_t), KM_SLEEP); 201 202 /* Translation type and flags. */ 203 prop_dictionary_get_int32(natdict, "type", &np->n_type); 204 prop_dictionary_get_uint32(natdict, "flags", &np->n_flags); 205 206 /* Should be exclusively either inbound or outbound NAT. */ 207 if (((np->n_type == NPF_NATIN) ^ (np->n_type == NPF_NATOUT)) == 0) { 208 goto err; 209 } 210 mutex_init(&np->n_lock, MUTEX_DEFAULT, IPL_SOFTNET); 211 LIST_INIT(&np->n_nat_list); 212 213 /* Translation IP, mask and port (if applicable). */ 214 obj = prop_dictionary_get(natdict, "translation-ip"); 215 np->n_alen = prop_data_size(obj); 216 if (np->n_alen == 0 || np->n_alen > sizeof(npf_addr_t)) { 217 goto err; 218 } 219 memcpy(&np->n_taddr, prop_data_data_nocopy(obj), np->n_alen); 220 prop_dictionary_get_uint8(natdict, "translation-mask", &np->n_tmask); 221 prop_dictionary_get_uint16(natdict, "translation-port", &np->n_tport); 222 223 prop_dictionary_get_uint32(natdict, "translation-algo", &np->n_algo); 224 switch (np->n_algo) { 225 case NPF_ALGO_NPT66: 226 prop_dictionary_get_uint16(natdict, "npt66-adjustment", 227 &np->n_npt66_adj); 228 break; 229 default: 230 if (np->n_tmask != NPF_NO_NETMASK) 231 goto err; 232 break; 233 } 234 235 /* Determine if port map is needed. */ 236 np->n_portmap = NULL; 237 if ((np->n_flags & NPF_NAT_PORTMAP) == 0) { 238 /* No port map. */ 239 return np; 240 } 241 242 /* 243 * Inspect NAT policies in the ruleset for port map sharing. 244 * Note that npf_ruleset_sharepm() will increase the reference count. 245 */ 246 if (!npf_ruleset_sharepm(rset, np)) { 247 /* Allocate a new port map for the NAT policy. */ 248 pm = kmem_zalloc(PORTMAP_MEM_SIZE, KM_SLEEP); 249 pm->p_refcnt = 1; 250 KASSERT((uintptr_t)pm->p_bitmap == (uintptr_t)pm + sizeof(*pm)); 251 np->n_portmap = pm; 252 } else { 253 KASSERT(np->n_portmap != NULL); 254 } 255 return np; 256 err: 257 kmem_free(np, sizeof(npf_natpolicy_t)); 258 return NULL; 259 } 260 261 /* 262 * npf_nat_freepolicy: free NAT policy and, on last reference, free portmap. 263 * 264 * => Called from npf_rule_free() during the reload via npf_ruleset_destroy(). 265 */ 266 void 267 npf_nat_freepolicy(npf_natpolicy_t *np) 268 { 269 npf_portmap_t *pm = np->n_portmap; 270 npf_conn_t *con; 271 npf_nat_t *nt; 272 273 /* 274 * Disassociate all entries from the policy. At this point, 275 * new entries can no longer be created for this policy. 276 */ 277 while (np->n_refcnt) { 278 mutex_enter(&np->n_lock); 279 LIST_FOREACH(nt, &np->n_nat_list, nt_entry) { 280 con = nt->nt_conn; 281 KASSERT(con != NULL); 282 npf_conn_expire(con); 283 } 284 mutex_exit(&np->n_lock); 285 286 /* Kick the worker - all references should be going away. */ 287 npf_worker_signal(); 288 kpause("npfgcnat", false, 1, NULL); 289 } 290 KASSERT(LIST_EMPTY(&np->n_nat_list)); 291 292 /* Destroy the port map, on last reference. */ 293 if (pm && --pm->p_refcnt == 0) { 294 KASSERT((np->n_flags & NPF_NAT_PORTMAP) != 0); 295 kmem_free(pm, PORTMAP_MEM_SIZE); 296 } 297 mutex_destroy(&np->n_lock); 298 kmem_free(np, sizeof(npf_natpolicy_t)); 299 } 300 301 void 302 npf_nat_freealg(npf_natpolicy_t *np, npf_alg_t *alg) 303 { 304 npf_nat_t *nt; 305 306 mutex_enter(&np->n_lock); 307 LIST_FOREACH(nt, &np->n_nat_list, nt_entry) { 308 if (nt->nt_alg == alg) 309 nt->nt_alg = NULL; 310 } 311 mutex_exit(&np->n_lock); 312 } 313 314 /* 315 * npf_nat_cmppolicy: compare two NAT policies. 316 * 317 * => Return 0 on match, and non-zero otherwise. 318 */ 319 bool 320 npf_nat_cmppolicy(npf_natpolicy_t *np, npf_natpolicy_t *mnp) 321 { 322 const void *np_raw, *mnp_raw; 323 324 /* 325 * Compare the relevant NAT policy information (in raw form), 326 * which is enough for matching criterion. 327 */ 328 KASSERT(np && mnp && np != mnp); 329 np_raw = (const uint8_t *)np + NPF_NP_CMP_START; 330 mnp_raw = (const uint8_t *)mnp + NPF_NP_CMP_START; 331 return memcmp(np_raw, mnp_raw, NPF_NP_CMP_SIZE) == 0; 332 } 333 334 bool 335 npf_nat_sharepm(npf_natpolicy_t *np, npf_natpolicy_t *mnp) 336 { 337 npf_portmap_t *pm, *mpm; 338 339 KASSERT(np && mnp && np != mnp); 340 341 /* Using port map and having equal translation address? */ 342 if ((np->n_flags & mnp->n_flags & NPF_NAT_PORTMAP) == 0) { 343 return false; 344 } 345 if (np->n_alen != mnp->n_alen) { 346 return false; 347 } 348 if (memcmp(&np->n_taddr, &mnp->n_taddr, np->n_alen) != 0) { 349 return false; 350 } 351 /* If NAT policy has an old port map - drop the reference. */ 352 mpm = mnp->n_portmap; 353 if (mpm) { 354 /* Note: at this point we cannot hold a last reference. */ 355 KASSERT(mpm->p_refcnt > 1); 356 mpm->p_refcnt--; 357 } 358 /* Share the port map. */ 359 pm = np->n_portmap; 360 mnp->n_portmap = pm; 361 pm->p_refcnt++; 362 return true; 363 } 364 365 void 366 npf_nat_setid(npf_natpolicy_t *np, uint64_t id) 367 { 368 np->n_id = id; 369 } 370 371 uint64_t 372 npf_nat_getid(const npf_natpolicy_t *np) 373 { 374 return np->n_id; 375 } 376 377 /* 378 * npf_nat_getport: allocate and return a port in the NAT policy portmap. 379 * 380 * => Returns in network byte-order. 381 * => Zero indicates failure. 382 */ 383 static in_port_t 384 npf_nat_getport(npf_natpolicy_t *np) 385 { 386 npf_portmap_t *pm = np->n_portmap; 387 u_int n = PORTMAP_SIZE, idx, bit; 388 uint32_t map, nmap; 389 390 idx = cprng_fast32() % PORTMAP_SIZE; 391 for (;;) { 392 KASSERT(idx < PORTMAP_SIZE); 393 map = pm->p_bitmap[idx]; 394 if (__predict_false(map == PORTMAP_FILLED)) { 395 if (n-- == 0) { 396 /* No space. */ 397 return 0; 398 } 399 /* This bitmap is filled, next. */ 400 idx = (idx ? idx : PORTMAP_SIZE) - 1; 401 continue; 402 } 403 bit = ffs32(~map) - 1; 404 nmap = map | (1 << bit); 405 if (atomic_cas_32(&pm->p_bitmap[idx], map, nmap) == map) { 406 /* Success. */ 407 break; 408 } 409 } 410 return htons(PORTMAP_FIRST + (idx << PORTMAP_SHIFT) + bit); 411 } 412 413 /* 414 * npf_nat_takeport: allocate specific port in the NAT policy portmap. 415 */ 416 static bool 417 npf_nat_takeport(npf_natpolicy_t *np, in_port_t port) 418 { 419 npf_portmap_t *pm = np->n_portmap; 420 uint32_t map, nmap; 421 u_int idx, bit; 422 423 port = ntohs(port) - PORTMAP_FIRST; 424 idx = port >> PORTMAP_SHIFT; 425 bit = port & PORTMAP_MASK; 426 map = pm->p_bitmap[idx]; 427 nmap = map | (1 << bit); 428 if (map == nmap) { 429 /* Already taken. */ 430 return false; 431 } 432 return atomic_cas_32(&pm->p_bitmap[idx], map, nmap) == map; 433 } 434 435 /* 436 * npf_nat_putport: return port as available in the NAT policy portmap. 437 * 438 * => Port should be in network byte-order. 439 */ 440 static void 441 npf_nat_putport(npf_natpolicy_t *np, in_port_t port) 442 { 443 npf_portmap_t *pm = np->n_portmap; 444 uint32_t map, nmap; 445 u_int idx, bit; 446 447 port = ntohs(port) - PORTMAP_FIRST; 448 idx = port >> PORTMAP_SHIFT; 449 bit = port & PORTMAP_MASK; 450 do { 451 map = pm->p_bitmap[idx]; 452 KASSERT(map | (1 << bit)); 453 nmap = map & ~(1 << bit); 454 } while (atomic_cas_32(&pm->p_bitmap[idx], map, nmap) != map); 455 } 456 457 /* 458 * npf_nat_which: tell which address (source or destination) should be 459 * rewritten given the combination of the NAT type and flow direction. 460 */ 461 static inline u_int 462 npf_nat_which(const int type, bool forw) 463 { 464 /* 465 * Outbound NAT rewrites: 466 * - Source (NPF_SRC) on "forwards" stream. 467 * - Destination (NPF_DST) on "backwards" stream. 468 * Inbound NAT is other way round. 469 */ 470 if (type == NPF_NATOUT) { 471 forw = !forw; 472 } else { 473 KASSERT(type == NPF_NATIN); 474 } 475 CTASSERT(NPF_SRC == 0 && NPF_DST == 1); 476 KASSERT(forw == NPF_SRC || forw == NPF_DST); 477 return (u_int)forw; 478 } 479 480 /* 481 * npf_nat_inspect: inspect packet against NAT ruleset and return a policy. 482 * 483 * => Acquire a reference on the policy, if found. 484 */ 485 static npf_natpolicy_t * 486 npf_nat_inspect(npf_cache_t *npc, const int di) 487 { 488 int slock = npf_config_read_enter(); 489 npf_ruleset_t *rlset = npf_config_natset(); 490 npf_natpolicy_t *np; 491 npf_rule_t *rl; 492 493 rl = npf_ruleset_inspect(npc, rlset, di, NPF_LAYER_3); 494 if (rl == NULL) { 495 npf_config_read_exit(slock); 496 return NULL; 497 } 498 np = npf_rule_getnat(rl); 499 atomic_inc_uint(&np->n_refcnt); 500 npf_config_read_exit(slock); 501 return np; 502 } 503 504 /* 505 * npf_nat_create: create a new NAT translation entry. 506 */ 507 static npf_nat_t * 508 npf_nat_create(npf_cache_t *npc, npf_natpolicy_t *np, npf_conn_t *con) 509 { 510 const int proto = npc->npc_proto; 511 npf_nat_t *nt; 512 513 KASSERT(npf_iscached(npc, NPC_IP46)); 514 KASSERT(npf_iscached(npc, NPC_LAYER4)); 515 516 /* Construct a new NAT entry and associate it with the connection. */ 517 nt = pool_cache_get(nat_cache, PR_NOWAIT); 518 if (nt == NULL){ 519 return NULL; 520 } 521 npf_stats_inc(NPF_STAT_NAT_CREATE); 522 nt->nt_natpolicy = np; 523 nt->nt_conn = con; 524 nt->nt_alg = NULL; 525 526 /* Save the original address which may be rewritten. */ 527 if (np->n_type == NPF_NATOUT) { 528 /* Outbound NAT: source (think internal) address. */ 529 memcpy(&nt->nt_oaddr, npc->npc_ips[NPF_SRC], npc->npc_alen); 530 } else { 531 /* Inbound NAT: destination (think external) address. */ 532 KASSERT(np->n_type == NPF_NATIN); 533 memcpy(&nt->nt_oaddr, npc->npc_ips[NPF_DST], npc->npc_alen); 534 } 535 536 /* 537 * Port translation, if required, and if it is TCP/UDP. 538 */ 539 if ((np->n_flags & NPF_NAT_PORTS) == 0 || 540 (proto != IPPROTO_TCP && proto != IPPROTO_UDP)) { 541 nt->nt_oport = 0; 542 nt->nt_tport = 0; 543 goto out; 544 } 545 546 /* Save the relevant TCP/UDP port. */ 547 if (proto == IPPROTO_TCP) { 548 const struct tcphdr *th = npc->npc_l4.tcp; 549 nt->nt_oport = (np->n_type == NPF_NATOUT) ? 550 th->th_sport : th->th_dport; 551 } else { 552 const struct udphdr *uh = npc->npc_l4.udp; 553 nt->nt_oport = (np->n_type == NPF_NATOUT) ? 554 uh->uh_sport : uh->uh_dport; 555 } 556 557 /* Get a new port for translation. */ 558 if ((np->n_flags & NPF_NAT_PORTMAP) != 0) { 559 nt->nt_tport = npf_nat_getport(np); 560 } else { 561 nt->nt_tport = np->n_tport; 562 } 563 out: 564 mutex_enter(&np->n_lock); 565 LIST_INSERT_HEAD(&np->n_nat_list, nt, nt_entry); 566 mutex_exit(&np->n_lock); 567 return nt; 568 } 569 570 /* 571 * npf_nat_translate: perform translation given the state data. 572 */ 573 static inline int 574 npf_nat_translate(npf_cache_t *npc, npf_nat_t *nt, bool forw) 575 { 576 const npf_natpolicy_t *np = nt->nt_natpolicy; 577 const u_int which = npf_nat_which(np->n_type, forw); 578 const npf_addr_t *addr; 579 in_port_t port; 580 581 KASSERT(npf_iscached(npc, NPC_IP46)); 582 KASSERT(npf_iscached(npc, NPC_LAYER4)); 583 584 if (forw) { 585 /* "Forwards" stream: use translation address/port. */ 586 addr = &np->n_taddr; 587 port = nt->nt_tport; 588 } else { 589 /* "Backwards" stream: use original address/port. */ 590 addr = &nt->nt_oaddr; 591 port = nt->nt_oport; 592 } 593 KASSERT((np->n_flags & NPF_NAT_PORTS) != 0 || port == 0); 594 595 /* Execute ALG translation first. */ 596 if ((npc->npc_info & NPC_ALG_EXEC) == 0) { 597 npc->npc_info |= NPC_ALG_EXEC; 598 npf_alg_exec(npc, nt, forw); 599 npf_recache(npc); 600 } 601 KASSERT(!nbuf_flag_p(npc->npc_nbuf, NBUF_DATAREF_RESET)); 602 603 /* Finally, perform the translation. */ 604 return npf_napt_rwr(npc, which, addr, port); 605 } 606 607 /* 608 * npf_nat_algo: perform the translation given the algorithm. 609 */ 610 static inline int 611 npf_nat_algo(npf_cache_t *npc, const npf_natpolicy_t *np, bool forw) 612 { 613 const u_int which = npf_nat_which(np->n_type, forw); 614 int error; 615 616 switch (np->n_algo) { 617 case NPF_ALGO_NPT66: 618 error = npf_npt66_rwr(npc, which, &np->n_taddr, 619 np->n_tmask, np->n_npt66_adj); 620 break; 621 default: 622 error = npf_napt_rwr(npc, which, &np->n_taddr, np->n_tport); 623 break; 624 } 625 626 return error; 627 } 628 629 /* 630 * npf_do_nat: 631 * - Inspect packet for a NAT policy, unless a connection with a NAT 632 * association already exists. In such case, determine whether it 633 * is a "forwards" or "backwards" stream. 634 * - Perform translation: rewrite source or destination fields, 635 * depending on translation type and direction. 636 * - Associate a NAT policy with a connection (may establish a new). 637 */ 638 int 639 npf_do_nat(npf_cache_t *npc, npf_conn_t *con, const int di) 640 { 641 nbuf_t *nbuf = npc->npc_nbuf; 642 npf_conn_t *ncon = NULL; 643 npf_natpolicy_t *np; 644 npf_nat_t *nt; 645 int error; 646 bool forw; 647 648 /* All relevant IPv4 data should be already cached. */ 649 if (!npf_iscached(npc, NPC_IP46) || !npf_iscached(npc, NPC_LAYER4)) { 650 return 0; 651 } 652 KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)); 653 654 /* 655 * Return the NAT entry associated with the connection, if any. 656 * Determines whether the stream is "forwards" or "backwards". 657 * Note: no need to lock, since reference on connection is held. 658 */ 659 if (con && (nt = npf_conn_retnat(con, di, &forw)) != NULL) { 660 np = nt->nt_natpolicy; 661 goto translate; 662 } 663 664 /* 665 * Inspect the packet for a NAT policy, if there is no connection. 666 * Note: acquires a reference if found. 667 */ 668 np = npf_nat_inspect(npc, di); 669 if (np == NULL) { 670 /* If packet does not match - done. */ 671 return 0; 672 } 673 forw = true; 674 675 /* Static NAT - just perform the translation. */ 676 if (np->n_flags & NPF_NAT_STATIC) { 677 if (nbuf_cksum_barrier(nbuf, di)) { 678 npf_recache(npc); 679 } 680 error = npf_nat_algo(npc, np, forw); 681 atomic_dec_uint(&np->n_refcnt); 682 return error; 683 } 684 685 /* 686 * If there is no local connection (no "stateful" rule - unusual, 687 * but possible configuration), establish one before translation. 688 * Note that it is not a "pass" connection, therefore passing of 689 * "backwards" stream depends on other, stateless filtering rules. 690 */ 691 if (con == NULL) { 692 ncon = npf_conn_establish(npc, di, true); 693 if (ncon == NULL) { 694 atomic_dec_uint(&np->n_refcnt); 695 return ENOMEM; 696 } 697 con = ncon; 698 } 699 700 /* 701 * Create a new NAT entry and associate with the connection. 702 * We will consume the reference on success (release on error). 703 */ 704 nt = npf_nat_create(npc, np, con); 705 if (nt == NULL) { 706 atomic_dec_uint(&np->n_refcnt); 707 error = ENOMEM; 708 goto out; 709 } 710 711 /* Associate the NAT translation entry with the connection. */ 712 error = npf_conn_setnat(npc, con, nt, np->n_type); 713 if (error) { 714 /* Will release the reference. */ 715 npf_nat_destroy(nt); 716 goto out; 717 } 718 719 /* Determine whether any ALG matches. */ 720 if (npf_alg_match(npc, nt, di)) { 721 KASSERT(nt->nt_alg != NULL); 722 } 723 724 translate: 725 /* May need to process the delayed checksums first (XXX: NetBSD). */ 726 if (nbuf_cksum_barrier(nbuf, di)) { 727 npf_recache(npc); 728 } 729 730 /* Perform the translation. */ 731 error = npf_nat_translate(npc, nt, forw); 732 out: 733 if (__predict_false(ncon)) { 734 if (error) { 735 /* It created for NAT - just expire. */ 736 npf_conn_expire(ncon); 737 } 738 npf_conn_release(ncon); 739 } 740 return error; 741 } 742 743 /* 744 * npf_nat_gettrans: return translation IP address and port. 745 */ 746 void 747 npf_nat_gettrans(npf_nat_t *nt, npf_addr_t **addr, in_port_t *port) 748 { 749 npf_natpolicy_t *np = nt->nt_natpolicy; 750 751 *addr = &np->n_taddr; 752 *port = nt->nt_tport; 753 } 754 755 /* 756 * npf_nat_getorig: return original IP address and port from translation entry. 757 */ 758 void 759 npf_nat_getorig(npf_nat_t *nt, npf_addr_t **addr, in_port_t *port) 760 { 761 *addr = &nt->nt_oaddr; 762 *port = nt->nt_oport; 763 } 764 765 /* 766 * npf_nat_setalg: associate an ALG with the NAT entry. 767 */ 768 void 769 npf_nat_setalg(npf_nat_t *nt, npf_alg_t *alg, uintptr_t arg) 770 { 771 nt->nt_alg = alg; 772 nt->nt_alg_arg = arg; 773 } 774 775 /* 776 * npf_nat_destroy: destroy NAT structure (performed on connection expiration). 777 */ 778 void 779 npf_nat_destroy(npf_nat_t *nt) 780 { 781 npf_natpolicy_t *np = nt->nt_natpolicy; 782 783 /* Return any taken port to the portmap. */ 784 if ((np->n_flags & NPF_NAT_PORTMAP) != 0 && nt->nt_tport) { 785 npf_nat_putport(np, nt->nt_tport); 786 } 787 788 mutex_enter(&np->n_lock); 789 LIST_REMOVE(nt, nt_entry); 790 atomic_dec_uint(&np->n_refcnt); 791 mutex_exit(&np->n_lock); 792 793 pool_cache_put(nat_cache, nt); 794 npf_stats_inc(NPF_STAT_NAT_DESTROY); 795 } 796 797 /* 798 * npf_nat_export: serialise the NAT entry with a NAT policy ID. 799 */ 800 void 801 npf_nat_export(prop_dictionary_t condict, npf_nat_t *nt) 802 { 803 npf_natpolicy_t *np = nt->nt_natpolicy; 804 prop_dictionary_t natdict; 805 prop_data_t d; 806 807 natdict = prop_dictionary_create(); 808 d = prop_data_create_data(&nt->nt_oaddr, sizeof(npf_addr_t)); 809 prop_dictionary_set_and_rel(natdict, "oaddr", d); 810 prop_dictionary_set_uint16(natdict, "oport", nt->nt_oport); 811 prop_dictionary_set_uint16(natdict, "tport", nt->nt_tport); 812 prop_dictionary_set_uint64(natdict, "nat-policy", np->n_id); 813 prop_dictionary_set_and_rel(condict, "nat", natdict); 814 } 815 816 /* 817 * npf_nat_import: find the NAT policy and unserialise the NAT entry. 818 */ 819 npf_nat_t * 820 npf_nat_import(prop_dictionary_t natdict, npf_ruleset_t *natlist, 821 npf_conn_t *con) 822 { 823 npf_natpolicy_t *np; 824 npf_nat_t *nt; 825 uint64_t np_id; 826 const void *d; 827 828 prop_dictionary_get_uint64(natdict, "nat-policy", &np_id); 829 if ((np = npf_ruleset_findnat(natlist, np_id)) == NULL) { 830 return NULL; 831 } 832 nt = pool_cache_get(nat_cache, PR_WAITOK); 833 memset(nt, 0, sizeof(npf_nat_t)); 834 835 prop_object_t obj = prop_dictionary_get(natdict, "oaddr"); 836 if ((d = prop_data_data_nocopy(obj)) == NULL || 837 prop_data_size(obj) != sizeof(npf_addr_t)) { 838 pool_cache_put(nat_cache, nt); 839 return NULL; 840 } 841 memcpy(&nt->nt_oaddr, d, sizeof(npf_addr_t)); 842 prop_dictionary_get_uint16(natdict, "oport", &nt->nt_oport); 843 prop_dictionary_get_uint16(natdict, "tport", &nt->nt_tport); 844 845 /* Take a specific port from port-map. */ 846 if (!npf_nat_takeport(np, nt->nt_tport)) { 847 pool_cache_put(nat_cache, nt); 848 return NULL; 849 } 850 851 LIST_INSERT_HEAD(&np->n_nat_list, nt, nt_entry); 852 nt->nt_natpolicy = np; 853 nt->nt_conn = con; 854 return nt; 855 } 856 857 #if defined(DDB) || defined(_NPF_TESTING) 858 859 void 860 npf_nat_dump(const npf_nat_t *nt) 861 { 862 const npf_natpolicy_t *np; 863 struct in_addr ip; 864 865 np = nt->nt_natpolicy; 866 memcpy(&ip, &np->n_taddr, sizeof(ip)); 867 printf("\tNATP(%p): type %d flags 0x%x taddr %s tport %d\n", 868 np, np->n_type, np->n_flags, inet_ntoa(ip), np->n_tport); 869 memcpy(&ip, &nt->nt_oaddr, sizeof(ip)); 870 printf("\tNAT: original address %s oport %d tport %d\n", 871 inet_ntoa(ip), ntohs(nt->nt_oport), ntohs(nt->nt_tport)); 872 if (nt->nt_alg) { 873 printf("\tNAT ALG = %p, ARG = %p\n", 874 nt->nt_alg, (void *)nt->nt_alg_arg); 875 } 876 } 877 878 #endif 879