npf_alg_icmp.c revision 1.3.2.2
1 1.3.2.2 yamt /* $NetBSD: npf_alg_icmp.c,v 1.3.2.2 2010/10/09 03:32:37 yamt Exp $ */ 2 1.3.2.2 yamt 3 1.3.2.2 yamt /*- 4 1.3.2.2 yamt * Copyright (c) 2010 The NetBSD Foundation, Inc. 5 1.3.2.2 yamt * All rights reserved. 6 1.3.2.2 yamt * 7 1.3.2.2 yamt * This material is based upon work partially supported by The 8 1.3.2.2 yamt * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 1.3.2.2 yamt * 10 1.3.2.2 yamt * Redistribution and use in source and binary forms, with or without 11 1.3.2.2 yamt * modification, are permitted provided that the following conditions 12 1.3.2.2 yamt * are met: 13 1.3.2.2 yamt * 1. Redistributions of source code must retain the above copyright 14 1.3.2.2 yamt * notice, this list of conditions and the following disclaimer. 15 1.3.2.2 yamt * 2. Redistributions in binary form must reproduce the above copyright 16 1.3.2.2 yamt * notice, this list of conditions and the following disclaimer in the 17 1.3.2.2 yamt * documentation and/or other materials provided with the distribution. 18 1.3.2.2 yamt * 19 1.3.2.2 yamt * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 1.3.2.2 yamt * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 1.3.2.2 yamt * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 1.3.2.2 yamt * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 1.3.2.2 yamt * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 1.3.2.2 yamt * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 1.3.2.2 yamt * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 1.3.2.2 yamt * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 1.3.2.2 yamt * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 1.3.2.2 yamt * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 1.3.2.2 yamt * POSSIBILITY OF SUCH DAMAGE. 30 1.3.2.2 yamt */ 31 1.3.2.2 yamt 32 1.3.2.2 yamt /* 33 1.3.2.2 yamt * NPF ALG for ICMP and traceroute translations. 34 1.3.2.2 yamt */ 35 1.3.2.2 yamt 36 1.3.2.2 yamt #ifdef _KERNEL 37 1.3.2.2 yamt #include <sys/cdefs.h> 38 1.3.2.2 yamt __KERNEL_RCSID(0, "$NetBSD: npf_alg_icmp.c,v 1.3.2.2 2010/10/09 03:32:37 yamt Exp $"); 39 1.3.2.2 yamt 40 1.3.2.2 yamt #include <sys/param.h> 41 1.3.2.2 yamt #include <sys/kernel.h> 42 1.3.2.2 yamt #endif 43 1.3.2.2 yamt #include <sys/module.h> 44 1.3.2.2 yamt #include <sys/pool.h> 45 1.3.2.2 yamt 46 1.3.2.2 yamt #include <netinet/in_systm.h> 47 1.3.2.2 yamt #include <netinet/in.h> 48 1.3.2.2 yamt #include <netinet/ip.h> 49 1.3.2.2 yamt #include <netinet/tcp.h> 50 1.3.2.2 yamt #include <netinet/udp.h> 51 1.3.2.2 yamt #include <netinet/ip_icmp.h> 52 1.3.2.2 yamt #include <net/pfil.h> 53 1.3.2.2 yamt 54 1.3.2.2 yamt #include "npf_impl.h" 55 1.3.2.2 yamt 56 1.3.2.2 yamt MODULE(MODULE_CLASS_MISC, npf_alg_icmp, "npf"); 57 1.3.2.2 yamt 58 1.3.2.2 yamt /* 59 1.3.2.2 yamt * Traceroute criteria. 60 1.3.2.2 yamt * 61 1.3.2.2 yamt * IANA assigned base port: 33434. However, common practice is to increase 62 1.3.2.2 yamt * the port, thus monitor [33434-33484] range. Additional filter is TTL < 50. 63 1.3.2.2 yamt */ 64 1.3.2.2 yamt 65 1.3.2.2 yamt #define TR_BASE_PORT 33434 66 1.3.2.2 yamt #define TR_PORT_RANGE 33484 67 1.3.2.2 yamt #define TR_MAX_TTL 50 68 1.3.2.2 yamt 69 1.3.2.2 yamt static npf_alg_t * alg_icmp; 70 1.3.2.2 yamt 71 1.3.2.2 yamt static bool npfa_icmp_match(npf_cache_t *, nbuf_t *, void *); 72 1.3.2.2 yamt static bool npfa_icmp_natin(npf_cache_t *, nbuf_t *, void *); 73 1.3.2.2 yamt static bool npfa_icmp_session(npf_cache_t *, nbuf_t *, void *); 74 1.3.2.2 yamt 75 1.3.2.2 yamt /* 76 1.3.2.2 yamt * npf_alg_icmp_{init,fini,modcmd}: ICMP ALG initialization, destruction 77 1.3.2.2 yamt * and module interface. 78 1.3.2.2 yamt */ 79 1.3.2.2 yamt 80 1.3.2.2 yamt static int 81 1.3.2.2 yamt npf_alg_icmp_init(void) 82 1.3.2.2 yamt { 83 1.3.2.2 yamt 84 1.3.2.2 yamt alg_icmp = npf_alg_register(npfa_icmp_match, NULL, 85 1.3.2.2 yamt npfa_icmp_natin, npfa_icmp_session); 86 1.3.2.2 yamt KASSERT(alg_icmp != NULL); 87 1.3.2.2 yamt return 0; 88 1.3.2.2 yamt } 89 1.3.2.2 yamt 90 1.3.2.2 yamt static int 91 1.3.2.2 yamt npf_alg_icmp_fini(void) 92 1.3.2.2 yamt { 93 1.3.2.2 yamt 94 1.3.2.2 yamt KASSERT(alg_icmp != NULL); 95 1.3.2.2 yamt return npf_alg_unregister(alg_icmp); 96 1.3.2.2 yamt } 97 1.3.2.2 yamt 98 1.3.2.2 yamt static int 99 1.3.2.2 yamt npf_alg_icmp_modcmd(modcmd_t cmd, void *arg) 100 1.3.2.2 yamt { 101 1.3.2.2 yamt 102 1.3.2.2 yamt switch (cmd) { 103 1.3.2.2 yamt case MODULE_CMD_INIT: 104 1.3.2.2 yamt return npf_alg_icmp_init(); 105 1.3.2.2 yamt case MODULE_CMD_FINI: 106 1.3.2.2 yamt return npf_alg_icmp_fini(); 107 1.3.2.2 yamt default: 108 1.3.2.2 yamt return ENOTTY; 109 1.3.2.2 yamt } 110 1.3.2.2 yamt return 0; 111 1.3.2.2 yamt } 112 1.3.2.2 yamt 113 1.3.2.2 yamt /* 114 1.3.2.2 yamt * npfa_icmp_match: ALG matching inspector, determines ALG case and 115 1.3.2.2 yamt * establishes a session for "backwards" stream. 116 1.3.2.2 yamt */ 117 1.3.2.2 yamt static bool 118 1.3.2.2 yamt npfa_icmp_match(npf_cache_t *npc, nbuf_t *nbuf, void *ntptr) 119 1.3.2.2 yamt { 120 1.3.2.2 yamt const int proto = npc->npc_proto; 121 1.3.2.2 yamt void *n_ptr = nbuf_dataptr(nbuf); 122 1.3.2.2 yamt u_int offby; 123 1.3.2.2 yamt uint8_t ttl; 124 1.3.2.2 yamt 125 1.3.2.2 yamt /* Handle TCP/UDP traceroute - check for port range. */ 126 1.3.2.2 yamt if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) { 127 1.3.2.2 yamt return false; 128 1.3.2.2 yamt } 129 1.3.2.2 yamt KASSERT(npf_iscached(npc, NPC_PORTS)); 130 1.3.2.2 yamt in_port_t dport = ntohs(npc->npc_dport); 131 1.3.2.2 yamt if (dport < TR_BASE_PORT || dport > TR_PORT_RANGE) { 132 1.3.2.2 yamt return false; 133 1.3.2.2 yamt } 134 1.3.2.2 yamt 135 1.3.2.2 yamt /* Check for low TTL. */ 136 1.3.2.2 yamt offby = offsetof(struct ip, ip_ttl); 137 1.3.2.2 yamt if (nbuf_advfetch(&nbuf, &n_ptr, offby, sizeof(uint8_t), &ttl)) 138 1.3.2.2 yamt return false; 139 1.3.2.2 yamt if (ttl > TR_MAX_TTL) 140 1.3.2.2 yamt return false; 141 1.3.2.2 yamt 142 1.3.2.2 yamt /* Associate ALG with translation entry. */ 143 1.3.2.2 yamt npf_nat_t *nt = ntptr; 144 1.3.2.2 yamt npf_nat_setalg(nt, alg_icmp, 0); 145 1.3.2.2 yamt return true; 146 1.3.2.2 yamt } 147 1.3.2.2 yamt 148 1.3.2.2 yamt /* 149 1.3.2.2 yamt * npf_icmp_uniqid: retrieve unique identifiers - either ICMP query ID 150 1.3.2.2 yamt * or TCP/UDP ports of the original packet, which is embedded. 151 1.3.2.2 yamt */ 152 1.3.2.2 yamt static inline bool 153 1.3.2.2 yamt npf_icmp_uniqid(const int type, npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr) 154 1.3.2.2 yamt { 155 1.3.2.2 yamt u_int offby; 156 1.3.2.2 yamt 157 1.3.2.2 yamt /* Per RFC 792. */ 158 1.3.2.2 yamt switch (type) { 159 1.3.2.2 yamt case ICMP_UNREACH: 160 1.3.2.2 yamt case ICMP_SOURCEQUENCH: 161 1.3.2.2 yamt case ICMP_REDIRECT: 162 1.3.2.2 yamt case ICMP_TIMXCEED: 163 1.3.2.2 yamt case ICMP_PARAMPROB: 164 1.3.2.2 yamt /* Should contain original IP header. */ 165 1.3.2.2 yamt offby = offsetof(struct icmp, icmp_ip); 166 1.3.2.2 yamt if ((n_ptr = nbuf_advance(&nbuf, n_ptr, offby)) == NULL) { 167 1.3.2.2 yamt return false; 168 1.3.2.2 yamt } 169 1.3.2.2 yamt /* Fetch into the cache. */ 170 1.3.2.2 yamt if (!npf_ip4_proto(npc, nbuf, n_ptr)) { 171 1.3.2.2 yamt return false; 172 1.3.2.2 yamt } 173 1.3.2.2 yamt const int proto = npc->npc_proto; 174 1.3.2.2 yamt if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) { 175 1.3.2.2 yamt return false; 176 1.3.2.2 yamt } 177 1.3.2.2 yamt if (!npf_fetch_ip4addrs(npc, nbuf, n_ptr)) { 178 1.3.2.2 yamt return false; 179 1.3.2.2 yamt } 180 1.3.2.2 yamt if (!npf_fetch_ports(npc, nbuf, n_ptr, proto)) { 181 1.3.2.2 yamt return false; 182 1.3.2.2 yamt } 183 1.3.2.2 yamt return true; 184 1.3.2.2 yamt 185 1.3.2.2 yamt case ICMP_ECHOREPLY: 186 1.3.2.2 yamt case ICMP_ECHO: 187 1.3.2.2 yamt case ICMP_TSTAMP: 188 1.3.2.2 yamt case ICMP_TSTAMPREPLY: 189 1.3.2.2 yamt case ICMP_IREQ: 190 1.3.2.2 yamt case ICMP_IREQREPLY: 191 1.3.2.2 yamt /* Should contain ICMP query ID. */ 192 1.3.2.2 yamt offby = offsetof(struct icmp, icmp_id); 193 1.3.2.2 yamt if (nbuf_advfetch(&nbuf, &n_ptr, offby, sizeof(uint16_t), 194 1.3.2.2 yamt &npc->npc_icmp_id)) { 195 1.3.2.2 yamt return false; 196 1.3.2.2 yamt } 197 1.3.2.2 yamt npc->npc_info |= NPC_ICMP_ID; 198 1.3.2.2 yamt return true; 199 1.3.2.2 yamt default: 200 1.3.2.2 yamt break; 201 1.3.2.2 yamt } 202 1.3.2.2 yamt /* No unique IDs. */ 203 1.3.2.2 yamt return false; 204 1.3.2.2 yamt } 205 1.3.2.2 yamt 206 1.3.2.2 yamt /* 207 1.3.2.2 yamt * npfa_icmp_session: ALG session inspector, determines unique identifiers. 208 1.3.2.2 yamt */ 209 1.3.2.2 yamt static bool 210 1.3.2.2 yamt npfa_icmp_session(npf_cache_t *npc, nbuf_t *nbuf, void *keyptr) 211 1.3.2.2 yamt { 212 1.3.2.2 yamt npf_cache_t *key = keyptr; 213 1.3.2.2 yamt void *n_ptr; 214 1.3.2.2 yamt 215 1.3.2.2 yamt /* ICMP? Get unique identifiers from ICMP packet. */ 216 1.3.2.2 yamt if (npc->npc_proto != IPPROTO_ICMP) { 217 1.3.2.2 yamt return false; 218 1.3.2.2 yamt } 219 1.3.2.2 yamt KASSERT(npf_iscached(npc, NPC_IP46 | NPC_ICMP)); 220 1.3.2.2 yamt key->npc_info = NPC_ICMP; 221 1.3.2.2 yamt 222 1.3.2.2 yamt /* Advance to ICMP header. */ 223 1.3.2.2 yamt n_ptr = nbuf_dataptr(nbuf); 224 1.3.2.2 yamt if ((n_ptr = nbuf_advance(&nbuf, n_ptr, npc->npc_hlen)) == NULL) { 225 1.3.2.2 yamt return false; 226 1.3.2.2 yamt } 227 1.3.2.2 yamt 228 1.3.2.2 yamt /* Fetch into the separate (key) cache. */ 229 1.3.2.2 yamt if (!npf_icmp_uniqid(npc->npc_icmp_type, key, nbuf, n_ptr)) { 230 1.3.2.2 yamt return false; 231 1.3.2.2 yamt } 232 1.3.2.2 yamt 233 1.3.2.2 yamt if (npf_iscached(key, NPC_ICMP_ID)) { 234 1.3.2.2 yamt /* Construct the key. */ 235 1.3.2.2 yamt key->npc_proto = npc->npc_proto; 236 1.3.2.2 yamt key->npc_dir = npc->npc_dir; 237 1.3.2.2 yamt /* Save IP addresses. */ 238 1.3.2.2 yamt key->npc_srcip = npc->npc_srcip; 239 1.3.2.2 yamt key->npc_dstip = npc->npc_dstip; 240 1.3.2.2 yamt key->npc_info |= NPC_IP46 | NPC_ADDRS | NPC_PORTS; 241 1.3.2.2 yamt /* Fake ports with ICMP query IDs. */ 242 1.3.2.2 yamt key->npc_sport = key->npc_icmp_id; 243 1.3.2.2 yamt key->npc_dport = key->npc_icmp_id; 244 1.3.2.2 yamt } else { 245 1.3.2.2 yamt in_addr_t addr; 246 1.3.2.2 yamt in_port_t port; 247 1.3.2.2 yamt /* 248 1.3.2.2 yamt * Embedded IP packet is the original of "forwards" stream. 249 1.3.2.2 yamt * We should imitate the "backwards" stream for inspection. 250 1.3.2.2 yamt */ 251 1.3.2.2 yamt KASSERT(npf_iscached(key, NPC_IP46 | NPC_ADDRS | NPC_PORTS)); 252 1.3.2.2 yamt addr = key->npc_srcip; 253 1.3.2.2 yamt port = key->npc_sport; 254 1.3.2.2 yamt key->npc_srcip = key->npc_dstip; 255 1.3.2.2 yamt key->npc_dstip = addr; 256 1.3.2.2 yamt key->npc_sport = key->npc_dport; 257 1.3.2.2 yamt key->npc_dport = port; 258 1.3.2.2 yamt } 259 1.3.2.2 yamt return true; 260 1.3.2.2 yamt } 261 1.3.2.2 yamt 262 1.3.2.2 yamt /* 263 1.3.2.2 yamt * npfa_icmp_natin: ALG inbound translation inspector, rewrite IP address 264 1.3.2.2 yamt * in the IP header, which is embedded in ICMP packet. 265 1.3.2.2 yamt */ 266 1.3.2.2 yamt static bool 267 1.3.2.2 yamt npfa_icmp_natin(npf_cache_t *npc, nbuf_t *nbuf, void *ntptr) 268 1.3.2.2 yamt { 269 1.3.2.2 yamt void *n_ptr = nbuf_dataptr(nbuf); 270 1.3.2.2 yamt npf_cache_t enpc; 271 1.3.2.2 yamt u_int offby; 272 1.3.2.2 yamt uint16_t cksum; 273 1.3.2.2 yamt 274 1.3.2.2 yamt /* XXX: Duplicated work. */ 275 1.3.2.2 yamt if (!npfa_icmp_session(npc, nbuf, &enpc)) { 276 1.3.2.2 yamt return false; 277 1.3.2.2 yamt } 278 1.3.2.2 yamt KASSERT(npf_iscached(&enpc, NPC_IP46 | NPC_ADDRS | NPC_PORTS)); 279 1.3.2.2 yamt 280 1.3.2.2 yamt /* Advance to ICMP checksum and fetch it. */ 281 1.3.2.2 yamt offby = npc->npc_hlen + offsetof(struct icmp, icmp_cksum); 282 1.3.2.2 yamt if (nbuf_advfetch(&nbuf, &n_ptr, offby, sizeof(uint16_t), &cksum)) { 283 1.3.2.2 yamt return false; 284 1.3.2.2 yamt } 285 1.3.2.2 yamt 286 1.3.2.2 yamt /* Save the data for checksum update later. */ 287 1.3.2.2 yamt void *cnbuf = nbuf, *cnptr = n_ptr; 288 1.3.2.2 yamt uint16_t ecksum = enpc.npc_ipsum; 289 1.3.2.2 yamt 290 1.3.2.2 yamt /* Advance to the original IP header, which is embedded after ICMP. */ 291 1.3.2.2 yamt offby = offsetof(struct icmp, icmp_ip) - 292 1.3.2.2 yamt offsetof(struct icmp, icmp_cksum); 293 1.3.2.2 yamt if ((n_ptr = nbuf_advance(&nbuf, n_ptr, offby)) == NULL) { 294 1.3.2.2 yamt return false; 295 1.3.2.2 yamt } 296 1.3.2.2 yamt 297 1.3.2.2 yamt /* 298 1.3.2.2 yamt * Rewrite source IP address and port of the embedded IP header, 299 1.3.2.2 yamt * which represents original packet - therefore passing PFIL_OUT. 300 1.3.2.2 yamt */ 301 1.3.2.2 yamt npf_nat_t *nt = ntptr; 302 1.3.2.2 yamt in_addr_t addr; 303 1.3.2.2 yamt in_port_t port; 304 1.3.2.2 yamt 305 1.3.2.2 yamt npf_nat_getorig(nt, &addr, &port); 306 1.3.2.2 yamt 307 1.3.2.2 yamt if (!npf_rwrip(&enpc, nbuf, n_ptr, PFIL_OUT, addr)) { 308 1.3.2.2 yamt return false; 309 1.3.2.2 yamt } 310 1.3.2.2 yamt if (!npf_rwrport(&enpc, nbuf, n_ptr, PFIL_OUT, port, addr)) { 311 1.3.2.2 yamt return false; 312 1.3.2.2 yamt } 313 1.3.2.2 yamt 314 1.3.2.2 yamt /* 315 1.3.2.2 yamt * Fixup and update ICMP checksum. 316 1.3.2.2 yamt * Note: npf_rwrip() has updated the IP checksum. 317 1.3.2.2 yamt */ 318 1.3.2.2 yamt cksum = npf_fixup32_cksum(cksum, enpc.npc_srcip, addr); 319 1.3.2.2 yamt cksum = npf_fixup16_cksum(cksum, enpc.npc_sport, port); 320 1.3.2.2 yamt cksum = npf_fixup16_cksum(cksum, ecksum, enpc.npc_ipsum); 321 1.3.2.2 yamt /* FIXME: Updated UDP/TCP checksum joins-in too., when != 0, sigh. */ 322 1.3.2.2 yamt if (nbuf_store_datum(cnbuf, cnptr, sizeof(uint16_t), &cksum)){ 323 1.3.2.2 yamt return false; 324 1.3.2.2 yamt } 325 1.3.2.2 yamt return true; 326 1.3.2.2 yamt } 327
Indexes created Fri Oct 03 02:09:57 GMT 2025