Home | History | Annotate | Line # | Download | only in npf
npf_nat.c revision 1.17
      1 /*	$NetBSD: npf_nat.c,v 1.16 2012/08/12 03:35:14 rmind Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2010-2012 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This material is based upon work partially supported by The
      8  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 /*
     33  * NPF network address port translation (NAPT).
     34  * Described in RFC 2663, RFC 3022.  Commonly just "NAT".
     35  *
     36  * Overview
     37  *
     38  *	There are few mechanisms: NAT policy, port map and translation.
     39  *	NAT module has a separate ruleset, where rules contain associated
     40  *	NAT policy, thus flexible filter criteria can be used.
     41  *
     42  * Translation types
     43  *
     44  *	There are two types of translation: outbound (NPF_NATOUT) and
     45  *	inbound (NPF_NATIN).  It should not be confused with connection
     46  *	direction.
     47  *
     48  *	Outbound NAT rewrites:
     49  *	- Source on "forwards" stream.
     50  *	- Destination on "backwards" stream.
     51  *	Inbound NAT rewrites:
     52  *	- Destination on "forwards" stream.
     53  *	- Source on "backwards" stream.
     54  *
     55  *	It should be noted that bi-directional NAT is a combined outbound
     56  *	and inbound translation, therefore constructed as two policies.
     57  *
     58  * NAT policies and port maps
     59  *
     60  *	NAT (translation) policy is applied when a packet matches the rule.
     61  *	Apart from filter criteria, NAT policy has a translation IP address
     62  *	and associated port map.  Port map is a bitmap used to reserve and
     63  *	use unique TCP/UDP ports for translation.  Port maps are unique to
     64  *	the IP addresses, therefore multiple NAT policies with the same IP
     65  *	will share the same port map.
     66  *
     67  * Sessions, translation entries and their life-cycle
     68  *
     69  *	NAT module relies on session management module.  Each translated
     70  *	session has an associated translation entry (npf_nat_t), which
     71  *	contains information used for backwards stream translation, i.e.
     72  *	original IP address with port and translation port, allocated from
     73  *	the port map.  Each NAT entry is associated with the policy, which
     74  *	contains translation IP address.  Allocated port is returned to the
     75  *	port map and NAT entry is destroyed when session expires.
     76  */
     77 
     78 #include <sys/cdefs.h>
     79 __KERNEL_RCSID(0, "$NetBSD: npf_nat.c,v 1.16 2012/08/12 03:35:14 rmind Exp $");
     80 
     81 #include <sys/param.h>
     82 #include <sys/types.h>
     83 
     84 #include <sys/atomic.h>
     85 #include <sys/bitops.h>
     86 #include <sys/condvar.h>
     87 #include <sys/kmem.h>
     88 #include <sys/mutex.h>
     89 #include <sys/pool.h>
     90 #include <sys/cprng.h>
     91 
     92 #include <net/pfil.h>
     93 #include <netinet/in.h>
     94 
     95 #include "npf_impl.h"
     96 
     97 /*
     98  * NPF portmap structure.
     99  */
    100 typedef struct {
    101 	u_int			p_refcnt;
    102 	uint32_t		p_bitmap[0];
    103 } npf_portmap_t;
    104 
    105 /* Portmap range: [ 1024 .. 65535 ] */
    106 #define	PORTMAP_FIRST		(1024)
    107 #define	PORTMAP_SIZE		((65536 - PORTMAP_FIRST) / 32)
    108 #define	PORTMAP_FILLED		((uint32_t)~0)
    109 #define	PORTMAP_MASK		(31)
    110 #define	PORTMAP_SHIFT		(5)
    111 
    112 #define	PORTMAP_MEM_SIZE	\
    113     (sizeof(npf_portmap_t) + (PORTMAP_SIZE * sizeof(uint32_t)))
    114 
    115 /*
    116  * NAT policy structure.
    117  */
    118 struct npf_natpolicy {
    119 	LIST_HEAD(, npf_nat)	n_nat_list;
    120 	kmutex_t		n_lock;
    121 	kcondvar_t		n_cv;
    122 	npf_portmap_t *		n_portmap;
    123 	/* NPF_NP_CMP_START */
    124 	int			n_type;
    125 	u_int			n_flags;
    126 	size_t			n_addr_sz;
    127 	npf_addr_t		n_taddr;
    128 	in_port_t		n_tport;
    129 };
    130 
    131 #define	NPF_NP_CMP_START	offsetof(npf_natpolicy_t, n_type)
    132 #define	NPF_NP_CMP_SIZE		(sizeof(npf_natpolicy_t) - NPF_NP_CMP_START)
    133 
    134 /*
    135  * NAT translation entry for a session.
    136  */
    137 struct npf_nat {
    138 	/* Association (list entry and a link pointer) with NAT policy. */
    139 	LIST_ENTRY(npf_nat)	nt_entry;
    140 	npf_natpolicy_t *	nt_natpolicy;
    141 	npf_session_t *		nt_session;
    142 	/* Original address and port (for backwards translation). */
    143 	npf_addr_t		nt_oaddr;
    144 	in_port_t		nt_oport;
    145 	/* Translation port (for redirects). */
    146 	in_port_t		nt_tport;
    147 	/* ALG (if any) associated with this NAT entry. */
    148 	npf_alg_t *		nt_alg;
    149 	uintptr_t		nt_alg_arg;
    150 };
    151 
    152 static pool_cache_t		nat_cache	__read_mostly;
    153 
    154 /*
    155  * npf_nat_sys{init,fini}: initialise/destroy NAT subsystem structures.
    156  */
    157 
    158 void
    159 npf_nat_sysinit(void)
    160 {
    161 
    162 	nat_cache = pool_cache_init(sizeof(npf_nat_t), coherency_unit,
    163 	    0, 0, "npfnatpl", NULL, IPL_NET, NULL, NULL, NULL);
    164 	KASSERT(nat_cache != NULL);
    165 }
    166 
    167 void
    168 npf_nat_sysfini(void)
    169 {
    170 
    171 	/* NAT policies should already be destroyed. */
    172 	pool_cache_destroy(nat_cache);
    173 }
    174 
    175 /*
    176  * npf_nat_newpolicy: create a new NAT policy.
    177  *
    178  * => Shares portmap if policy is on existing translation address.
    179  * => XXX: serialise at upper layer.
    180  */
    181 npf_natpolicy_t *
    182 npf_nat_newpolicy(prop_dictionary_t natdict, npf_ruleset_t *nrlset)
    183 {
    184 	npf_natpolicy_t *np;
    185 	prop_object_t obj;
    186 	npf_portmap_t *pm;
    187 
    188 	np = kmem_zalloc(sizeof(npf_natpolicy_t), KM_SLEEP);
    189 
    190 	/* Translation type and flags. */
    191 	prop_dictionary_get_int32(natdict, "type", &np->n_type);
    192 	prop_dictionary_get_uint32(natdict, "flags", &np->n_flags);
    193 
    194 	/* Should be exclusively either inbound or outbound NAT. */
    195 	if (((np->n_type == NPF_NATIN) ^ (np->n_type == NPF_NATOUT)) == 0) {
    196 		kmem_free(np, sizeof(npf_natpolicy_t));
    197 		return NULL;
    198 	}
    199 	mutex_init(&np->n_lock, MUTEX_DEFAULT, IPL_SOFTNET);
    200 	cv_init(&np->n_cv, "npfnatcv");
    201 	LIST_INIT(&np->n_nat_list);
    202 
    203 	/* Translation IP. */
    204 	obj = prop_dictionary_get(natdict, "translation-ip");
    205 	np->n_addr_sz = prop_data_size(obj);
    206 	KASSERT(np->n_addr_sz > 0 && np->n_addr_sz <= sizeof(npf_addr_t));
    207 	memcpy(&np->n_taddr, prop_data_data_nocopy(obj), np->n_addr_sz);
    208 
    209 	/* Translation port (for redirect case). */
    210 	prop_dictionary_get_uint16(natdict, "translation-port", &np->n_tport);
    211 
    212 	/* Determine if port map is needed. */
    213 	np->n_portmap = NULL;
    214 	if ((np->n_flags & NPF_NAT_PORTMAP) == 0) {
    215 		/* No port map. */
    216 		return np;
    217 	}
    218 
    219 	/*
    220 	 * Inspect NAT policies in the ruleset for port map sharing.
    221 	 * Note that npf_ruleset_sharepm() will increase the reference count.
    222 	 */
    223 	if (!npf_ruleset_sharepm(nrlset, np)) {
    224 		/* Allocate a new port map for the NAT policy. */
    225 		pm = kmem_zalloc(PORTMAP_MEM_SIZE, KM_SLEEP);
    226 		pm->p_refcnt = 1;
    227 		KASSERT((uintptr_t)pm->p_bitmap == (uintptr_t)pm + sizeof(*pm));
    228 		np->n_portmap = pm;
    229 	} else {
    230 		KASSERT(np->n_portmap != NULL);
    231 	}
    232 	return np;
    233 }
    234 
    235 /*
    236  * npf_nat_freepolicy: free NAT policy and, on last reference, free portmap.
    237  *
    238  * => Called from npf_rule_free() during the reload via npf_ruleset_destroy().
    239  */
    240 void
    241 npf_nat_freepolicy(npf_natpolicy_t *np)
    242 {
    243 	npf_portmap_t *pm = np->n_portmap;
    244 	npf_session_t *se;
    245 	npf_nat_t *nt;
    246 
    247 	/* De-associate all entries from the policy. */
    248 	mutex_enter(&np->n_lock);
    249 	LIST_FOREACH(nt, &np->n_nat_list, nt_entry) {
    250 		se = nt->nt_session; /* XXXSMP */
    251 		if (se == NULL) {
    252 			continue;
    253 		}
    254 		npf_session_expire(se);
    255 	}
    256 	while (!LIST_EMPTY(&np->n_nat_list)) {
    257 		cv_wait(&np->n_cv, &np->n_lock);
    258 	}
    259 	mutex_exit(&np->n_lock);
    260 
    261 	/* Destroy the port map, on last reference. */
    262 	if (pm && --pm->p_refcnt == 0) {
    263 		KASSERT((np->n_flags & NPF_NAT_PORTMAP) != 0);
    264 		kmem_free(pm, PORTMAP_MEM_SIZE);
    265 	}
    266 	cv_destroy(&np->n_cv);
    267 	mutex_destroy(&np->n_lock);
    268 	kmem_free(np, sizeof(npf_natpolicy_t));
    269 }
    270 
    271 void
    272 npf_nat_freealg(npf_natpolicy_t *np, npf_alg_t *alg)
    273 {
    274 	npf_nat_t *nt;
    275 
    276 	mutex_enter(&np->n_lock);
    277 	LIST_FOREACH(nt, &np->n_nat_list, nt_entry) {
    278 		if (nt->nt_alg != alg) {
    279 			continue;
    280 		}
    281 		nt->nt_alg = NULL;
    282 	}
    283 	mutex_exit(&np->n_lock);
    284 }
    285 
    286 /*
    287  * npf_nat_matchpolicy: compare two NAT policies.
    288  *
    289  * => Return 0 on match, and non-zero otherwise.
    290  */
    291 bool
    292 npf_nat_matchpolicy(npf_natpolicy_t *np, npf_natpolicy_t *mnp)
    293 {
    294 	void *np_raw, *mnp_raw;
    295 	/*
    296 	 * Compare the relevant NAT policy information (in raw form),
    297 	 * which is enough for matching criterion.
    298 	 */
    299 	KASSERT(np && mnp && np != mnp);
    300 	np_raw = (uint8_t *)np + NPF_NP_CMP_START;
    301 	mnp_raw = (uint8_t *)mnp + NPF_NP_CMP_START;
    302 	return (memcmp(np_raw, mnp_raw, NPF_NP_CMP_SIZE) == 0);
    303 }
    304 
    305 bool
    306 npf_nat_sharepm(npf_natpolicy_t *np, npf_natpolicy_t *mnp)
    307 {
    308 	npf_portmap_t *pm, *mpm;
    309 
    310 	KASSERT(np && mnp && np != mnp);
    311 
    312 	/* Using port map and having equal translation address? */
    313 	if ((np->n_flags & mnp->n_flags & NPF_NAT_PORTMAP) == 0) {
    314 		return false;
    315 	}
    316 	if (np->n_addr_sz != mnp->n_addr_sz) {
    317 		return false;
    318 	}
    319 	if (memcmp(&np->n_taddr, &mnp->n_taddr, np->n_addr_sz) != 0) {
    320 		return false;
    321 	}
    322 	/* If NAT policy has an old port map - drop the reference. */
    323 	mpm = mnp->n_portmap;
    324 	if (mpm) {
    325 		/* Note: at this point we cannot hold a last reference. */
    326 		KASSERT(mpm->p_refcnt > 1);
    327 		mpm->p_refcnt--;
    328 	}
    329 	/* Share the port map. */
    330 	pm = np->n_portmap;
    331 	mnp->n_portmap = pm;
    332 	pm->p_refcnt++;
    333 	return true;
    334 }
    335 
    336 /*
    337  * npf_nat_getport: allocate and return a port in the NAT policy portmap.
    338  *
    339  * => Returns in network byte-order.
    340  * => Zero indicates failure.
    341  */
    342 static in_port_t
    343 npf_nat_getport(npf_natpolicy_t *np)
    344 {
    345 	npf_portmap_t *pm = np->n_portmap;
    346 	u_int n = PORTMAP_SIZE, idx, bit;
    347 	uint32_t map, nmap;
    348 
    349 	idx = cprng_fast32() % PORTMAP_SIZE;
    350 	for (;;) {
    351 		KASSERT(idx < PORTMAP_SIZE);
    352 		map = pm->p_bitmap[idx];
    353 		if (__predict_false(map == PORTMAP_FILLED)) {
    354 			if (n-- == 0) {
    355 				/* No space. */
    356 				return 0;
    357 			}
    358 			/* This bitmap is filled, next. */
    359 			idx = (idx ? idx : PORTMAP_SIZE) - 1;
    360 			continue;
    361 		}
    362 		bit = ffs32(~map) - 1;
    363 		nmap = map | (1 << bit);
    364 		if (atomic_cas_32(&pm->p_bitmap[idx], map, nmap) == map) {
    365 			/* Success. */
    366 			break;
    367 		}
    368 	}
    369 	return htons(PORTMAP_FIRST + (idx << PORTMAP_SHIFT) + bit);
    370 }
    371 
    372 /*
    373  * npf_nat_takeport: allocate specific port in the NAT policy portmap.
    374  */
    375 static bool
    376 npf_nat_takeport(npf_natpolicy_t *np, in_port_t port)
    377 {
    378 	npf_portmap_t *pm = np->n_portmap;
    379 	uint32_t map, nmap;
    380 	u_int idx, bit;
    381 
    382 	port = ntohs(port) - PORTMAP_FIRST;
    383 	idx = port >> PORTMAP_SHIFT;
    384 	bit = port & PORTMAP_MASK;
    385 	map = pm->p_bitmap[idx];
    386 	nmap = map | (1 << bit);
    387 	if (map == nmap) {
    388 		/* Already taken. */
    389 		return false;
    390 	}
    391 	return atomic_cas_32(&pm->p_bitmap[idx], map, nmap) == map;
    392 }
    393 
    394 /*
    395  * npf_nat_putport: return port as available in the NAT policy portmap.
    396  *
    397  * => Port should be in network byte-order.
    398  */
    399 static void
    400 npf_nat_putport(npf_natpolicy_t *np, in_port_t port)
    401 {
    402 	npf_portmap_t *pm = np->n_portmap;
    403 	uint32_t map, nmap;
    404 	u_int idx, bit;
    405 
    406 	port = ntohs(port) - PORTMAP_FIRST;
    407 	idx = port >> PORTMAP_SHIFT;
    408 	bit = port & PORTMAP_MASK;
    409 	do {
    410 		map = pm->p_bitmap[idx];
    411 		KASSERT(map | (1 << bit));
    412 		nmap = map & ~(1 << bit);
    413 	} while (atomic_cas_32(&pm->p_bitmap[idx], map, nmap) != map);
    414 }
    415 
    416 /*
    417  * npf_nat_inspect: inspect packet against NAT ruleset and return a policy.
    418  */
    419 static npf_natpolicy_t *
    420 npf_nat_inspect(npf_cache_t *npc, nbuf_t *nbuf, const ifnet_t *ifp,
    421     const int di)
    422 {
    423 	npf_ruleset_t *rlset;
    424 	npf_natpolicy_t *np;
    425 	npf_rule_t *rl;
    426 
    427 	npf_core_enter();
    428 	rlset = npf_core_natset();
    429 	rl = npf_ruleset_inspect(npc, nbuf, rlset, ifp, di, NPF_LAYER_3);
    430 	if (rl == NULL) {
    431 		npf_core_exit();
    432 		return NULL;
    433 	}
    434 	np = npf_rule_getnat(rl);
    435 	if (np == NULL) {
    436 		npf_core_exit();
    437 		return NULL;
    438 	}
    439 	return np;
    440 }
    441 
    442 /*
    443  * npf_nat_create: create a new NAT translation entry.
    444  */
    445 static npf_nat_t *
    446 npf_nat_create(npf_cache_t *npc, npf_natpolicy_t *np)
    447 {
    448 	const int proto = npf_cache_ipproto(npc);
    449 	npf_nat_t *nt;
    450 
    451 	KASSERT(npf_iscached(npc, NPC_IP46));
    452 	KASSERT(npf_iscached(npc, NPC_LAYER4));
    453 
    454 	/* New NAT association. */
    455 	nt = pool_cache_get(nat_cache, PR_NOWAIT);
    456 	if (nt == NULL){
    457 		return NULL;
    458 	}
    459 	npf_stats_inc(NPF_STAT_NAT_CREATE);
    460 	nt->nt_natpolicy = np;
    461 	nt->nt_session = NULL;
    462 	nt->nt_alg = NULL;
    463 
    464 	/* Save the original address which may be rewritten. */
    465 	if (np->n_type == NPF_NATOUT) {
    466 		/* Source (local) for Outbound NAT. */
    467 		memcpy(&nt->nt_oaddr, npc->npc_srcip, npc->npc_alen);
    468 	} else {
    469 		/* Destination (external) for Inbound NAT. */
    470 		KASSERT(np->n_type == NPF_NATIN);
    471 		memcpy(&nt->nt_oaddr, npc->npc_dstip, npc->npc_alen);
    472 	}
    473 
    474 	/*
    475 	 * Port translation, if required, and if it is TCP/UDP.
    476 	 */
    477 	if ((np->n_flags & NPF_NAT_PORTS) == 0 ||
    478 	    (proto != IPPROTO_TCP && proto != IPPROTO_UDP)) {
    479 		nt->nt_oport = 0;
    480 		nt->nt_tport = 0;
    481 		goto out;
    482 	}
    483 
    484 	/* Save the relevant TCP/UDP port. */
    485 	if (proto == IPPROTO_TCP) {
    486 		struct tcphdr *th = &npc->npc_l4.tcp;
    487 		nt->nt_oport = (np->n_type == NPF_NATOUT) ?
    488 		    th->th_sport : th->th_dport;
    489 	} else {
    490 		struct udphdr *uh = &npc->npc_l4.udp;
    491 		nt->nt_oport = (np->n_type == NPF_NATOUT) ?
    492 		    uh->uh_sport : uh->uh_dport;
    493 	}
    494 
    495 	/* Get a new port for translation. */
    496 	if ((np->n_flags & NPF_NAT_PORTMAP) != 0) {
    497 		nt->nt_tport = npf_nat_getport(np);
    498 	} else {
    499 		nt->nt_tport = np->n_tport;
    500 	}
    501 out:
    502 	mutex_enter(&np->n_lock);
    503 	LIST_INSERT_HEAD(&np->n_nat_list, nt, nt_entry);
    504 	mutex_exit(&np->n_lock);
    505 	return nt;
    506 }
    507 
    508 /*
    509  * npf_nat_translate: perform address and/or port translation.
    510  */
    511 static int
    512 npf_nat_translate(npf_cache_t *npc, nbuf_t *nbuf, npf_nat_t *nt,
    513     const bool forw, const int di)
    514 {
    515 	void *n_ptr = nbuf_dataptr(nbuf);
    516 	npf_natpolicy_t *np = nt->nt_natpolicy;
    517 	npf_addr_t *addr;
    518 	in_port_t port;
    519 
    520 	KASSERT(npf_iscached(npc, NPC_IP46));
    521 
    522 	if (forw) {
    523 		/* "Forwards" stream: use translation address/port. */
    524 		addr = &np->n_taddr;
    525 		port = nt->nt_tport;
    526 	} else {
    527 		/* "Backwards" stream: use original address/port. */
    528 		addr = &nt->nt_oaddr;
    529 		port = nt->nt_oport;
    530 	}
    531 	KASSERT((np->n_flags & NPF_NAT_PORTS) != 0 || port == 0);
    532 
    533 	/* Execute ALG hook first. */
    534 	npf_alg_exec(npc, nbuf, nt, di);
    535 
    536 	/*
    537 	 * Rewrite IP and/or TCP/UDP checksums first, since it will use
    538 	 * the cache containing original values for checksum calculation.
    539 	 */
    540 	if (!npf_rwrcksum(npc, nbuf, n_ptr, di, addr, port)) {
    541 		return EINVAL;
    542 	}
    543 
    544 	/*
    545 	 * Address translation: rewrite source/destination address, depending
    546 	 * on direction (PFIL_OUT - for source, PFIL_IN - for destination).
    547 	 */
    548 	if (!npf_rwrip(npc, nbuf, n_ptr, di, addr)) {
    549 		return EINVAL;
    550 	}
    551 	if ((np->n_flags & NPF_NAT_PORTS) == 0) {
    552 		/* Done. */
    553 		return 0;
    554 	}
    555 
    556 	switch (npf_cache_ipproto(npc)) {
    557 	case IPPROTO_TCP:
    558 	case IPPROTO_UDP:
    559 		KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP));
    560 		/* Rewrite source/destination port. */
    561 		if (!npf_rwrport(npc, nbuf, n_ptr, di, port)) {
    562 			return EINVAL;
    563 		}
    564 		break;
    565 	case IPPROTO_ICMP:
    566 		KASSERT(npf_iscached(npc, NPC_ICMP));
    567 		/* Nothing. */
    568 		break;
    569 	default:
    570 		return ENOTSUP;
    571 	}
    572 	return 0;
    573 }
    574 
    575 /*
    576  * npf_do_nat:
    577  *	- Inspect packet for a NAT policy, unless a session with a NAT
    578  *	  association already exists.  In such case, determine whether it
    579  *	  is a "forwards" or "backwards" stream.
    580  *	- Perform translation: rewrite source or destination fields,
    581  *	  depending on translation type and direction.
    582  *	- Associate a NAT policy with a session (may establish a new).
    583  */
    584 int
    585 npf_do_nat(npf_cache_t *npc, npf_session_t *se, nbuf_t *nbuf,
    586     const ifnet_t *ifp, const int di)
    587 {
    588 	npf_session_t *nse = NULL;
    589 	npf_natpolicy_t *np;
    590 	npf_nat_t *nt;
    591 	int error;
    592 	bool forw, new;
    593 
    594 	/* All relevant IPv4 data should be already cached. */
    595 	if (!npf_iscached(npc, NPC_IP46) || !npf_iscached(npc, NPC_LAYER4)) {
    596 		return 0;
    597 	}
    598 
    599 	/*
    600 	 * Return the NAT entry associated with the session, if any.
    601 	 * Determines whether the stream is "forwards" or "backwards".
    602 	 * Note: no need to lock, since reference on session is held.
    603 	 */
    604 	if (se && (nt = npf_session_retnat(se, di, &forw)) != NULL) {
    605 		np = nt->nt_natpolicy;
    606 		new = false;
    607 		goto translate;
    608 	}
    609 
    610 	/*
    611 	 * Inspect the packet for a NAT policy, if there is no session.
    612 	 * Note: acquires the lock (releases, if not found).
    613 	 */
    614 	np = npf_nat_inspect(npc, nbuf, ifp, di);
    615 	if (np == NULL) {
    616 		/* If packet does not match - done. */
    617 		return 0;
    618 	}
    619 	forw = true;
    620 
    621 	/*
    622 	 * Create a new NAT entry.  Note: it is safe to unlock, since the
    623 	 * NAT policy wont be desotroyed while there are list entries, which
    624 	 * are removed only on session expiration.  Currently, NAT entry is
    625 	 * not yet associated with any session.
    626 	 */
    627 	nt = npf_nat_create(npc, np);
    628 	if (nt == NULL) {
    629 		npf_core_exit();
    630 		return ENOMEM;
    631 	}
    632 	npf_core_exit();
    633 	new = true;
    634 
    635 	/* Determine whether any ALG matches. */
    636 	if (npf_alg_match(npc, nbuf, nt)) {
    637 		KASSERT(nt->nt_alg != NULL);
    638 	}
    639 
    640 	/*
    641 	 * If there is no local session (no "stateful" rule - unusual, but
    642 	 * possible configuration), establish one before translation.  Note
    643 	 * that it is not a "pass" session, therefore passing of "backwards"
    644 	 * stream depends on other, stateless filtering rules.
    645 	 */
    646 	if (se == NULL) {
    647 		nse = npf_session_establish(npc, nbuf, ifp, di);
    648 		if (nse == NULL) {
    649 			error = ENOMEM;
    650 			goto out;
    651 		}
    652 		se = nse;
    653 	}
    654 translate:
    655 	/* Perform the translation. */
    656 	error = npf_nat_translate(npc, nbuf, nt, forw, di);
    657 	if (error) {
    658 		goto out;
    659 	}
    660 
    661 	if (__predict_false(new)) {
    662 		/*
    663 		 * Associate NAT translation entry with the session.
    664 		 * Note: packet now has a translated address in the cache.
    665 		 */
    666 		nt->nt_session = se;
    667 		error = npf_session_setnat(se, nt, di);
    668 out:
    669 		if (error) {
    670 			/* If session was for NAT only - expire it. */
    671 			if (nse) {
    672 				npf_session_expire(nse);
    673 			}
    674 			/* Will free the structure and return the port. */
    675 			npf_nat_expire(nt);
    676 		}
    677 		if (nse) {
    678 			npf_session_release(nse);
    679 		}
    680 	}
    681 	return error;
    682 }
    683 
    684 /*
    685  * npf_nat_gettrans: return translation IP address and port.
    686  */
    687 void
    688 npf_nat_gettrans(npf_nat_t *nt, npf_addr_t **addr, in_port_t *port)
    689 {
    690 	npf_natpolicy_t *np = nt->nt_natpolicy;
    691 
    692 	*addr = &np->n_taddr;
    693 	*port = nt->nt_tport;
    694 }
    695 
    696 /*
    697  * npf_nat_getorig: return original IP address and port from translation entry.
    698  */
    699 void
    700 npf_nat_getorig(npf_nat_t *nt, npf_addr_t **addr, in_port_t *port)
    701 {
    702 
    703 	*addr = &nt->nt_oaddr;
    704 	*port = nt->nt_oport;
    705 }
    706 
    707 /*
    708  * npf_nat_setalg: associate an ALG with the NAT entry.
    709  */
    710 void
    711 npf_nat_setalg(npf_nat_t *nt, npf_alg_t *alg, uintptr_t arg)
    712 {
    713 
    714 	nt->nt_alg = alg;
    715 	nt->nt_alg_arg = arg;
    716 }
    717 
    718 /*
    719  * npf_nat_expire: free NAT-related data structures on session expiration.
    720  */
    721 void
    722 npf_nat_expire(npf_nat_t *nt)
    723 {
    724 	npf_natpolicy_t *np = nt->nt_natpolicy;
    725 
    726 	/* Return any taken port to the portmap. */
    727 	if ((np->n_flags & NPF_NAT_PORTMAP) != 0 && nt->nt_tport) {
    728 		npf_nat_putport(np, nt->nt_tport);
    729 	}
    730 
    731 	/* Remove NAT entry from the list, notify any waiters if last entry. */
    732 	mutex_enter(&np->n_lock);
    733 	LIST_REMOVE(nt, nt_entry);
    734 	if (LIST_EMPTY(&np->n_nat_list)) {
    735 		cv_broadcast(&np->n_cv);
    736 	}
    737 	mutex_exit(&np->n_lock);
    738 
    739 	/* Free structure, increase the counter. */
    740 	pool_cache_put(nat_cache, nt);
    741 	npf_stats_inc(NPF_STAT_NAT_DESTROY);
    742 }
    743 
    744 /*
    745  * npf_nat_save: construct NAT entry and reference to the NAT policy.
    746  */
    747 int
    748 npf_nat_save(prop_dictionary_t sedict, prop_array_t natlist, npf_nat_t *nt)
    749 {
    750 	npf_natpolicy_t *np = nt->nt_natpolicy;
    751 	prop_object_iterator_t it;
    752 	prop_dictionary_t npdict;
    753 	prop_data_t nd, npd;
    754 	uint64_t itnp;
    755 
    756 	/* Set NAT entry data. */
    757 	nd = prop_data_create_data(nt, sizeof(npf_nat_t));
    758 	prop_dictionary_set(sedict, "nat-data", nd);
    759 	prop_object_release(nd);
    760 
    761 	/* Find or create a NAT policy. */
    762 	it = prop_array_iterator(natlist);
    763 	while ((npdict = prop_object_iterator_next(it)) != NULL) {
    764 		CTASSERT(sizeof(uintptr_t) <= sizeof(uint64_t));
    765 		prop_dictionary_get_uint64(npdict, "id-ptr", &itnp);
    766 		if ((uintptr_t)itnp == (uintptr_t)np) {
    767 			break;
    768 		}
    769 	}
    770 	if (npdict == NULL) {
    771 		/* Create NAT policy dictionary and copy the data. */
    772 		npdict = prop_dictionary_create();
    773 		npd = prop_data_create_data(np, sizeof(npf_natpolicy_t));
    774 		prop_dictionary_set(npdict, "nat-policy-data", npd);
    775 		prop_object_release(npd);
    776 
    777 		CTASSERT(sizeof(uintptr_t) <= sizeof(uint64_t));
    778 		prop_dictionary_set_uint64(npdict, "id-ptr", (uintptr_t)np);
    779 		prop_array_add(natlist, npdict);
    780 		prop_object_release(npdict);
    781 	}
    782 	prop_dictionary_set(sedict, "nat-policy", npdict);
    783 	prop_object_release(npdict);
    784 	return 0;
    785 }
    786 
    787 /*
    788  * npf_nat_restore: find a matching NAT policy and restore NAT entry.
    789  *
    790  * => Caller should lock the active NAT ruleset.
    791  */
    792 npf_nat_t *
    793 npf_nat_restore(prop_dictionary_t sedict, npf_session_t *se)
    794 {
    795 	const npf_natpolicy_t *onp;
    796 	const npf_nat_t *ntraw;
    797 	prop_object_t obj;
    798 	npf_natpolicy_t *np;
    799 	npf_rule_t *rl;
    800 	npf_nat_t *nt;
    801 
    802 	/* Get raw NAT entry. */
    803 	obj = prop_dictionary_get(sedict, "nat-data");
    804 	ntraw = prop_data_data_nocopy(obj);
    805 	if (ntraw == NULL || prop_data_size(obj) != sizeof(npf_nat_t)) {
    806 		return NULL;
    807 	}
    808 
    809 	/* Find a stored NAT policy information. */
    810 	obj = prop_dictionary_get(
    811 	    prop_dictionary_get(sedict, "nat-policy"), "nat-policy-data");
    812 	onp = prop_data_data_nocopy(obj);
    813 	if (onp == NULL || prop_data_size(obj) != sizeof(npf_natpolicy_t)) {
    814 		return NULL;
    815 	}
    816 
    817 	/* Match if there is an existing NAT policy. */
    818 	rl = npf_ruleset_matchnat(npf_core_natset(), __UNCONST(onp));
    819 	if (rl == NULL) {
    820 		return NULL;
    821 	}
    822 	np = npf_rule_getnat(rl);
    823 	KASSERT(np != NULL);
    824 
    825 	/* Take a specific port from port-map. */
    826 	if (!npf_nat_takeport(np, ntraw->nt_tport)) {
    827 		return NULL;
    828 	}
    829 
    830 	/* Create and return NAT entry for association. */
    831 	nt = pool_cache_get(nat_cache, PR_WAITOK);
    832 	memcpy(nt, ntraw, sizeof(npf_nat_t));
    833 	LIST_INSERT_HEAD(&np->n_nat_list, nt, nt_entry);
    834 	nt->nt_natpolicy = np;
    835 	nt->nt_session = se;
    836 	nt->nt_alg = NULL;
    837 	return nt;
    838 }
    839 
    840 #if defined(DDB) || defined(_NPF_TESTING)
    841 
    842 void
    843 npf_nat_dump(const npf_nat_t *nt)
    844 {
    845 	const npf_natpolicy_t *np;
    846 	struct in_addr ip;
    847 
    848 	np = nt->nt_natpolicy;
    849 	memcpy(&ip, &np->n_taddr, sizeof(ip));
    850 	printf("\tNATP(%p): type %d flags 0x%x taddr %s tport %d\n",
    851 	    np, np->n_type, np->n_flags, inet_ntoa(ip), np->n_tport);
    852 	memcpy(&ip, &nt->nt_oaddr, sizeof(ip));
    853 	printf("\tNAT: original address %s oport %d tport %d\n",
    854 	    inet_ntoa(ip), ntohs(nt->nt_oport), ntohs(nt->nt_tport));
    855 	if (nt->nt_alg) {
    856 		printf("\tNAT ALG = %p, ARG = %p\n",
    857 		    nt->nt_alg, (void *)nt->nt_alg_arg);
    858 	}
    859 }
    860 
    861 #endif
    862