1 /*- 2 * Copyright (c) 2014-2020 Mindaugas Rasiukevicius <rmind at netbsd org> 3 * Copyright (c) 2010-2014 The NetBSD Foundation, Inc. 4 * All rights reserved. 5 * 6 * This material is based upon work partially supported by The 7 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 19 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 20 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 21 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 22 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28 * POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31 /* 32 * Connection key -- is an n-tuple structure encoding the address length, 33 * layer 3 protocol, source and destination addresses and ports (or other 34 * protocol IDs) and some configurable elements (see below). 35 * 36 * Key layout 37 * 38 * The single key is formed out of 32-bit integers. The layout is 39 * as follows (first row -- fields, second row -- number of bits): 40 * 41 * | alen | proto | ckey | src-id | dst-id | src-addr | dst-addr | 42 * +------+-------+--------+--------+--------+----------+----------+ 43 * | 4 | 8 | 20 | 16 | 16 | 32-128 | 32-128 | 44 * 45 * The source and destination are inverted if the key is for the 46 * backwards stream (NPF_FLOW_BACK). The address length depends on 47 * the 'alen' field. The length is in words and is either 1 or 4, 48 * meaning 4 or 16 in bytes. 49 * 50 * The 20-bit configurable key area ('ckey') is for the optional 51 * elements which may be included or excluded by the user. It has 52 * the following layout: 53 * 54 * | direction | interface-id | 55 * +-----------+--------------+ 56 * | 2 | 18 | 57 * 58 * Note: neither direction nor interface ID cannot be zero; we rely 59 * on this by reserving the zero 'ckey' value to for the case when 60 * these checks are not applicable. 61 * 62 * Embedding in the connection structure (npf_conn_t) 63 * 64 * Two keys are stored in the npf_conn_t::c_keys[] array, which is 65 * variable-length, depending on whether the keys store IPv4 or IPv6 66 * addresses. The length of the first key determines the position 67 * of the second key. 68 * 69 * WARNING: the keys must be immutable while they are in conndb. 70 */ 71 72 #ifdef _KERNEL 73 #include <sys/cdefs.h> 74 __KERNEL_RCSID(0, "$NetBSD: npf_connkey.c,v 1.2 2020/05/30 14:16:56 rmind Exp $"); 75 76 #include <sys/param.h> 77 #include <sys/types.h> 78 #endif 79 80 #define __NPF_CONN_PRIVATE 81 #include "npf_conn.h" 82 #include "npf_impl.h" 83 84 unsigned 85 npf_connkey_setkey(npf_connkey_t *key, unsigned alen, unsigned proto, 86 const void *ipv, const uint16_t *id, const npf_flow_t flow) 87 { 88 const npf_addr_t * const *ips = ipv; 89 uint32_t *k = key->ck_key; 90 unsigned isrc, idst; 91 92 if (__predict_true(flow == NPF_FLOW_FORW)) { 93 isrc = NPF_SRC, idst = NPF_DST; 94 } else { 95 isrc = NPF_DST, idst = NPF_SRC; 96 } 97 98 /* 99 * See the key layout explanation above. 100 */ 101 KASSERT((alen >> 2) <= 0xf && proto <= 0xff); 102 k[0] = ((uint32_t)(alen >> 2) << 28) | (proto << 20); 103 k[1] = ((uint32_t)id[isrc] << 16) | id[idst]; 104 105 if (__predict_true(alen == sizeof(in_addr_t))) { 106 k[2] = ips[isrc]->word32[0]; 107 k[3] = ips[idst]->word32[0]; 108 return 4 * sizeof(uint32_t); 109 } else { 110 const unsigned nwords = alen >> 2; 111 memcpy(&k[2], ips[isrc], alen); 112 memcpy(&k[2 + nwords], ips[idst], alen); 113 return (2 + (nwords * 2)) * sizeof(uint32_t); 114 } 115 } 116 117 void 118 npf_connkey_getkey(const npf_connkey_t *key, unsigned *alen, unsigned *proto, 119 npf_addr_t *ips, uint16_t *id) 120 { 121 const uint32_t *k = key->ck_key; 122 123 /* 124 * See the key layout explanation above. 125 */ 126 127 *alen = (k[0] >> 28) << 2; 128 *proto = (k[0] >> 16) & 0xff; 129 id[NPF_SRC] = k[1] >> 16; 130 id[NPF_DST] = k[1] & 0xffff; 131 132 switch (*alen) { 133 case sizeof(struct in6_addr): 134 case sizeof(struct in_addr): 135 memcpy(&ips[NPF_SRC], &k[2], *alen); 136 memcpy(&ips[NPF_DST], &k[2 + ((unsigned)*alen >> 2)], *alen); 137 return; 138 default: 139 KASSERT(0); 140 } 141 } 142 143 static inline void 144 npf_connkey_setckey(npf_connkey_t *key, unsigned ifid, unsigned di) 145 { 146 if (ifid) { 147 /* 148 * Interface ID: the lower 18 bits of the 20-bit 'ckey'. 149 * Note: the interface ID cannot be zero. 150 */ 151 CTASSERT(NPF_MAX_IFMAP < (1U << 18)); 152 key->ck_key[0] |= ifid; 153 } 154 if (di) { 155 /* 156 * Direction: The highest 2 bits of the 20-bit 'ckey'. 157 * Note: we rely on PFIL_IN and PFIL_OUT definitions. 158 */ 159 CTASSERT(PFIL_IN == 0x1 || PFIL_OUT == 0x2); 160 KASSERT((di & ~PFIL_ALL) == 0); 161 key->ck_key[0] |= ((uint32_t)di << 18); 162 } 163 } 164 165 static void 166 npf_connkey_getckey(const npf_connkey_t *key, unsigned *ifid, unsigned *di) 167 { 168 const uint32_t * const k = key->ck_key; 169 170 *ifid = k[0] & ((1U << 20) - 1); 171 *di = (k[0] >> 18) & PFIL_ALL; 172 } 173 174 /* 175 * npf_conn_adjkey: adjust the connection key by setting the address/port. 176 * 177 * => The 'which' must either be NPF_SRC or NPF_DST. 178 */ 179 void 180 npf_conn_adjkey(npf_connkey_t *key, const npf_addr_t *naddr, 181 const uint16_t id, const unsigned which) 182 { 183 const unsigned alen = NPF_CONNKEY_ALEN(key); 184 uint32_t * const k = key->ck_key; 185 uint32_t *addr = &k[2 + ((alen >> 2) * which)]; 186 187 KASSERT(which == NPF_SRC || which == NPF_DST); 188 KASSERT(alen > 0); 189 memcpy(addr, naddr, alen); 190 191 if (id) { 192 const uint32_t oid = k[1]; 193 const unsigned shift = 16 * !which; 194 const uint32_t mask = 0xffff0000 >> shift; 195 k[1] = ((uint32_t)id << shift) | (oid & mask); 196 } 197 } 198 199 static unsigned 200 npf_connkey_copy(const npf_connkey_t *skey, npf_connkey_t *dkey, bool invert) 201 { 202 const unsigned klen = NPF_CONNKEY_LEN(skey); 203 const uint32_t *sk = skey->ck_key; 204 uint32_t *dk = dkey->ck_key; 205 206 if (invert) { 207 const unsigned alen = NPF_CONNKEY_ALEN(skey); 208 const unsigned nwords = alen >> 2; 209 210 dk[0] = sk[1]; 211 dk[1] = (sk[1] >> 16) | (sk[1] << 16); 212 memcpy(&dk[2], &sk[2 + nwords], alen); 213 memcpy(&dk[2 + nwords], &sk[2], alen); 214 } else { 215 memcpy(dk, sk, klen); 216 } 217 return klen; 218 } 219 220 /* 221 * npf_conn_conkey: construct a key for the connection lookup. 222 * 223 * => Returns the key length in bytes or zero on failure. 224 */ 225 unsigned 226 npf_conn_conkey(const npf_cache_t *npc, npf_connkey_t *key, 227 const unsigned di, const npf_flow_t flow) 228 { 229 const npf_conn_params_t *params = npc->npc_ctx->params[NPF_PARAMS_CONN]; 230 const nbuf_t *nbuf = npc->npc_nbuf; 231 const unsigned proto = npc->npc_proto; 232 const unsigned alen = npc->npc_alen; 233 const struct tcphdr *th; 234 const struct udphdr *uh; 235 uint16_t id[2] = { 0, 0 }; 236 unsigned ret; 237 238 if (npc->npc_ckey) { 239 /* 240 * Request to override the connection key. 241 */ 242 const bool invert = flow != NPF_FLOW_FORW; 243 return npf_connkey_copy(npc->npc_ckey, key, invert); 244 } 245 246 switch (proto) { 247 case IPPROTO_TCP: 248 KASSERT(npf_iscached(npc, NPC_TCP)); 249 th = npc->npc_l4.tcp; 250 id[NPF_SRC] = th->th_sport; 251 id[NPF_DST] = th->th_dport; 252 break; 253 case IPPROTO_UDP: 254 KASSERT(npf_iscached(npc, NPC_UDP)); 255 uh = npc->npc_l4.udp; 256 id[NPF_SRC] = uh->uh_sport; 257 id[NPF_DST] = uh->uh_dport; 258 break; 259 case IPPROTO_ICMP: 260 if (npf_iscached(npc, NPC_ICMP_ID)) { 261 const struct icmp *ic = npc->npc_l4.icmp; 262 id[NPF_SRC] = ic->icmp_id; 263 id[NPF_DST] = ic->icmp_id; 264 break; 265 } 266 return 0; 267 case IPPROTO_ICMPV6: 268 if (npf_iscached(npc, NPC_ICMP_ID)) { 269 const struct icmp6_hdr *ic6 = npc->npc_l4.icmp6; 270 id[NPF_SRC] = ic6->icmp6_id; 271 id[NPF_DST] = ic6->icmp6_id; 272 break; 273 } 274 return 0; 275 default: 276 /* Unsupported protocol. */ 277 return 0; 278 } 279 280 ret = npf_connkey_setkey(key, alen, proto, npc->npc_ips, id, flow); 281 npf_connkey_setckey(key, 282 params->connkey_interface ? nbuf->nb_ifid : 0, 283 params->connkey_direction ? (di & PFIL_ALL) : 0); 284 return ret; 285 } 286 287 /* 288 * npf_conn_getforwkey: get the address to the "forwards" key. 289 */ 290 npf_connkey_t * 291 npf_conn_getforwkey(npf_conn_t *conn) 292 { 293 return (void *)&conn->c_keys[0]; 294 } 295 296 /* 297 * npf_conn_getbackkey: get the address to the "backwards" key. 298 * 299 * => It depends on the address length. 300 */ 301 npf_connkey_t * 302 npf_conn_getbackkey(npf_conn_t *conn, unsigned alen) 303 { 304 const unsigned off = 2 + ((alen * 2) >> 2); 305 KASSERT(off == NPF_CONNKEY_V4WORDS || off == NPF_CONNKEY_V6WORDS); 306 return (void *)&conn->c_keys[off]; 307 } 308 309 /* 310 * Connection key exporting/importing. 311 */ 312 313 nvlist_t * 314 npf_connkey_export(npf_t *npf, const npf_connkey_t *key) 315 { 316 unsigned alen, proto, ifid, di; 317 npf_addr_t ips[2]; 318 uint16_t ids[2]; 319 nvlist_t *key_nv; 320 321 key_nv = nvlist_create(0); 322 323 npf_connkey_getkey(key, &alen, &proto, ips, ids); 324 nvlist_add_number(key_nv, "proto", proto); 325 nvlist_add_number(key_nv, "sport", ids[NPF_SRC]); 326 nvlist_add_number(key_nv, "dport", ids[NPF_DST]); 327 nvlist_add_binary(key_nv, "saddr", &ips[NPF_SRC], alen); 328 nvlist_add_binary(key_nv, "daddr", &ips[NPF_DST], alen); 329 330 npf_connkey_getckey(key, &ifid, &di); 331 if (ifid) { 332 char ifname[IFNAMSIZ]; 333 npf_ifmap_copyname(npf, ifid, ifname, sizeof(ifname)); 334 nvlist_add_string(key_nv, "ifname", ifname); 335 } 336 if (di) { 337 nvlist_add_number(key_nv, "di", di); 338 } 339 340 return key_nv; 341 } 342 343 unsigned 344 npf_connkey_import(npf_t *npf, const nvlist_t *key_nv, npf_connkey_t *key) 345 { 346 npf_addr_t const * ips[2]; 347 size_t alen1, alen2, proto; 348 unsigned ret, di, ifid = 0; 349 const char *ifname; 350 uint16_t ids[2]; 351 352 proto = dnvlist_get_number(key_nv, "proto", 0); 353 if (proto >= IPPROTO_MAX) { 354 return 0; 355 } 356 ids[NPF_SRC] = dnvlist_get_number(key_nv, "sport", 0); 357 ids[NPF_DST] = dnvlist_get_number(key_nv, "dport", 0); 358 ips[NPF_SRC] = dnvlist_get_binary(key_nv, "saddr", &alen1, NULL, 0); 359 ips[NPF_DST] = dnvlist_get_binary(key_nv, "daddr", &alen2, NULL, 0); 360 if (alen1 == 0 || alen1 > sizeof(npf_addr_t) || alen1 != alen2) { 361 return 0; 362 } 363 ret = npf_connkey_setkey(key, alen1, proto, ips, ids, NPF_FLOW_FORW); 364 if (ret == 0) { 365 return 0; 366 } 367 368 ifname = dnvlist_get_string(key_nv, "ifname", NULL); 369 if (ifname && (ifid = npf_ifmap_register(npf, ifname)) == 0) { 370 return 0; 371 } 372 di = dnvlist_get_number(key_nv, "di", 0) & PFIL_ALL; 373 npf_connkey_setckey(key, ifid, di); 374 375 return ret; 376 } 377 378 #if defined(DDB) || defined(_NPF_TESTING) 379 380 void 381 npf_connkey_print(const npf_connkey_t *key) 382 { 383 unsigned alen, proto, ifid, di; 384 npf_addr_t ips[2]; 385 uint16_t ids[2]; 386 387 npf_connkey_getkey(key, &alen, &proto, ips, ids); 388 npf_connkey_getckey(key, &ifid, &di); 389 printf("\tkey (ifid %u, di %x)\t", ifid, di); 390 printf("%s:%u", npf_addr_dump(&ips[0], alen), ids[0]); 391 printf("-> %s:%u\n", npf_addr_dump(&ips[1], alen), ids[1]); 392 } 393 394 #endif 395
Indexes created Mon Sep 22 10:09:38 GMT 2025