npf_inet.c revision 1.3.2.2
1 1.3.2.2 yamt /* $NetBSD: npf_inet.c,v 1.3.2.2 2010/10/09 03:32:37 yamt Exp $ */ 2 1.3.2.2 yamt 3 1.3.2.2 yamt /*- 4 1.3.2.2 yamt * Copyright (c) 2009-2010 The NetBSD Foundation, Inc. 5 1.3.2.2 yamt * All rights reserved. 6 1.3.2.2 yamt * 7 1.3.2.2 yamt * This material is based upon work partially supported by The 8 1.3.2.2 yamt * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 1.3.2.2 yamt * 10 1.3.2.2 yamt * Redistribution and use in source and binary forms, with or without 11 1.3.2.2 yamt * modification, are permitted provided that the following conditions 12 1.3.2.2 yamt * are met: 13 1.3.2.2 yamt * 1. Redistributions of source code must retain the above copyright 14 1.3.2.2 yamt * notice, this list of conditions and the following disclaimer. 15 1.3.2.2 yamt * 2. Redistributions in binary form must reproduce the above copyright 16 1.3.2.2 yamt * notice, this list of conditions and the following disclaimer in the 17 1.3.2.2 yamt * documentation and/or other materials provided with the distribution. 18 1.3.2.2 yamt * 19 1.3.2.2 yamt * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 1.3.2.2 yamt * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 1.3.2.2 yamt * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 1.3.2.2 yamt * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 1.3.2.2 yamt * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 1.3.2.2 yamt * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 1.3.2.2 yamt * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 1.3.2.2 yamt * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 1.3.2.2 yamt * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 1.3.2.2 yamt * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 1.3.2.2 yamt * POSSIBILITY OF SUCH DAMAGE. 30 1.3.2.2 yamt */ 31 1.3.2.2 yamt 32 1.3.2.2 yamt /* 33 1.3.2.2 yamt * Various procotol related helper routines. 34 1.3.2.2 yamt */ 35 1.3.2.2 yamt 36 1.3.2.2 yamt #ifdef _KERNEL 37 1.3.2.2 yamt #include <sys/cdefs.h> 38 1.3.2.2 yamt __KERNEL_RCSID(0, "$NetBSD: npf_inet.c,v 1.3.2.2 2010/10/09 03:32:37 yamt Exp $"); 39 1.3.2.2 yamt 40 1.3.2.2 yamt #include <sys/param.h> 41 1.3.2.2 yamt #include <sys/kernel.h> 42 1.3.2.2 yamt 43 1.3.2.2 yamt #include <netinet/in_systm.h> 44 1.3.2.2 yamt #include <netinet/in.h> 45 1.3.2.2 yamt #include <netinet/ip.h> 46 1.3.2.2 yamt #include <netinet/tcp.h> 47 1.3.2.2 yamt #include <netinet/udp.h> 48 1.3.2.2 yamt #include <netinet/ip_icmp.h> 49 1.3.2.2 yamt 50 1.3.2.2 yamt #include <net/if.h> 51 1.3.2.2 yamt #include <net/ethertypes.h> 52 1.3.2.2 yamt #include <net/if_ether.h> 53 1.3.2.2 yamt #endif 54 1.3.2.2 yamt #include <net/pfil.h> 55 1.3.2.2 yamt 56 1.3.2.2 yamt #include "npf_impl.h" 57 1.3.2.2 yamt 58 1.3.2.2 yamt /* 59 1.3.2.2 yamt * npf_fixup{16,32}_cksum: update IPv4 checksum. 60 1.3.2.2 yamt */ 61 1.3.2.2 yamt 62 1.3.2.2 yamt uint16_t 63 1.3.2.2 yamt npf_fixup16_cksum(uint16_t cksum, uint16_t odatum, uint16_t ndatum) 64 1.3.2.2 yamt { 65 1.3.2.2 yamt uint32_t sum; 66 1.3.2.2 yamt 67 1.3.2.2 yamt /* 68 1.3.2.2 yamt * RFC 1624: 69 1.3.2.2 yamt * HC' = ~(~HC + ~m + m') 70 1.3.2.2 yamt */ 71 1.3.2.2 yamt sum = ~ntohs(cksum) & 0xffff; 72 1.3.2.2 yamt sum += (~ntohs(odatum) & 0xffff) + ntohs(ndatum); 73 1.3.2.2 yamt sum = (sum >> 16) + (sum & 0xffff); 74 1.3.2.2 yamt sum += (sum >> 16); 75 1.3.2.2 yamt 76 1.3.2.2 yamt return htons(~sum & 0xffff); 77 1.3.2.2 yamt } 78 1.3.2.2 yamt 79 1.3.2.2 yamt uint16_t 80 1.3.2.2 yamt npf_fixup32_cksum(uint16_t cksum, uint32_t odatum, uint32_t ndatum) 81 1.3.2.2 yamt { 82 1.3.2.2 yamt 83 1.3.2.2 yamt cksum = npf_fixup16_cksum(cksum, odatum & 0xffff, ndatum & 0xffff); 84 1.3.2.2 yamt cksum = npf_fixup16_cksum(cksum, odatum >> 16, ndatum >> 16); 85 1.3.2.2 yamt return cksum; 86 1.3.2.2 yamt } 87 1.3.2.2 yamt 88 1.3.2.2 yamt /* 89 1.3.2.2 yamt * npf_ip4_proto: check IPv4 header length and match protocol number. 90 1.3.2.2 yamt * 91 1.3.2.2 yamt * => Returns pointer to protocol header or NULL on failure. 92 1.3.2.2 yamt * => Stores protocol number in the cache. 93 1.3.2.2 yamt * => Updates nbuf pointer to header's nbuf. 94 1.3.2.2 yamt */ 95 1.3.2.2 yamt bool 96 1.3.2.2 yamt npf_ip4_proto(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr) 97 1.3.2.2 yamt { 98 1.3.2.2 yamt u_int hlen, offby; 99 1.3.2.2 yamt uint8_t val8; 100 1.3.2.2 yamt int error; 101 1.3.2.2 yamt 102 1.3.2.2 yamt /* IPv4 header: check IP version and header length. */ 103 1.3.2.2 yamt error = nbuf_fetch_datum(nbuf, n_ptr, sizeof(uint8_t), &val8); 104 1.3.2.2 yamt if (error || (val8 >> 4) != IPVERSION) 105 1.3.2.2 yamt return false; 106 1.3.2.2 yamt hlen = (val8 & 0xf) << 2; 107 1.3.2.2 yamt if (hlen < sizeof(struct ip)) 108 1.3.2.2 yamt return false; 109 1.3.2.2 yamt 110 1.3.2.2 yamt /* IPv4 header: check fragment offset. */ 111 1.3.2.2 yamt offby = offsetof(struct ip, ip_off); 112 1.3.2.2 yamt error = nbuf_advfetch(&nbuf, &n_ptr, offby, sizeof(uint8_t), &val8); 113 1.3.2.2 yamt if (error || (val8 & ~htons(IP_DF | IP_RF))) 114 1.3.2.2 yamt return false; 115 1.3.2.2 yamt 116 1.3.2.2 yamt /* Get and match protocol. */ 117 1.3.2.2 yamt KASSERT(offsetof(struct ip, ip_p) > offby); 118 1.3.2.2 yamt offby = offsetof(struct ip, ip_p) - offby; 119 1.3.2.2 yamt if (nbuf_advfetch(&nbuf, &n_ptr, offby, sizeof(uint8_t), &val8)) 120 1.3.2.2 yamt return false; 121 1.3.2.2 yamt 122 1.3.2.2 yamt /* IP checksum. */ 123 1.3.2.2 yamt offby = offsetof(struct ip, ip_sum) - offsetof(struct ip, ip_p); 124 1.3.2.2 yamt if (nbuf_advfetch(&nbuf, &n_ptr, offby, 125 1.3.2.2 yamt sizeof(uint16_t), &npc->npc_ipsum)) 126 1.3.2.2 yamt return false; 127 1.3.2.2 yamt 128 1.3.2.2 yamt /* Cache: IPv4, protocol, header length. */ 129 1.3.2.2 yamt npc->npc_info |= NPC_IP46; 130 1.3.2.2 yamt npc->npc_proto = val8; 131 1.3.2.2 yamt npc->npc_hlen = hlen; 132 1.3.2.2 yamt return true; 133 1.3.2.2 yamt } 134 1.3.2.2 yamt 135 1.3.2.2 yamt /* 136 1.3.2.2 yamt * npf_fetch_ip4addrs: fetch source and destination address from IPv4 header. 137 1.3.2.2 yamt * 138 1.3.2.2 yamt * => Stores both source and destination addresses into the cache. 139 1.3.2.2 yamt */ 140 1.3.2.2 yamt bool 141 1.3.2.2 yamt npf_fetch_ip4addrs(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr) 142 1.3.2.2 yamt { 143 1.3.2.2 yamt in_addr_t *src = &npc->npc_srcip, *dst = &npc->npc_dstip; 144 1.3.2.2 yamt u_int offby; 145 1.3.2.2 yamt 146 1.3.2.2 yamt /* Source address. */ 147 1.3.2.2 yamt offby = offsetof(struct ip, ip_src); 148 1.3.2.2 yamt if (nbuf_advfetch(&nbuf, &n_ptr, offby, sizeof(in_addr_t), src)) 149 1.3.2.2 yamt return false; 150 1.3.2.2 yamt 151 1.3.2.2 yamt /* Destination address. */ 152 1.3.2.2 yamt offby = offsetof(struct ip, ip_dst) - offby; 153 1.3.2.2 yamt if (nbuf_advfetch(&nbuf, &n_ptr, offby, sizeof(in_addr_t), dst)) 154 1.3.2.2 yamt return false; 155 1.3.2.2 yamt 156 1.3.2.2 yamt /* Both addresses are cached. */ 157 1.3.2.2 yamt npc->npc_info |= NPC_ADDRS; 158 1.3.2.2 yamt return true; 159 1.3.2.2 yamt } 160 1.3.2.2 yamt 161 1.3.2.2 yamt /* 162 1.3.2.2 yamt * npf_fetch_ports: fetch ports from either TCP or UDP header. 163 1.3.2.2 yamt * 164 1.3.2.2 yamt * => Stores both source and destination ports into the cache. 165 1.3.2.2 yamt */ 166 1.3.2.2 yamt bool 167 1.3.2.2 yamt npf_fetch_ports(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr, const int proto) 168 1.3.2.2 yamt { 169 1.3.2.2 yamt u_int dst_off; 170 1.3.2.2 yamt 171 1.3.2.2 yamt /* Perform checks, advance to TCP/UDP header. */ 172 1.3.2.2 yamt if (!npf_iscached(npc, NPC_IP46) && !npf_ip4_proto(npc, nbuf, n_ptr)) 173 1.3.2.2 yamt return false; 174 1.3.2.2 yamt n_ptr = nbuf_advance(&nbuf, n_ptr, npc->npc_hlen); 175 1.3.2.2 yamt if (n_ptr == NULL || npc->npc_proto != proto) 176 1.3.2.2 yamt return false; 177 1.3.2.2 yamt 178 1.3.2.2 yamt /* 179 1.3.2.2 yamt * TCP/UDP header: fetch source and destination ports. For both 180 1.3.2.2 yamt * protocols offset of the source port offset is 0. 181 1.3.2.2 yamt */ 182 1.3.2.2 yamt CTASSERT(offsetof(struct tcphdr, th_sport) == 0); 183 1.3.2.2 yamt CTASSERT(offsetof(struct udphdr, uh_sport) == 0); 184 1.3.2.2 yamt if (proto == IPPROTO_TCP) { 185 1.3.2.2 yamt dst_off = offsetof(struct tcphdr, th_dport); 186 1.3.2.2 yamt } else { 187 1.3.2.2 yamt KASSERT(proto == IPPROTO_UDP); 188 1.3.2.2 yamt dst_off = offsetof(struct udphdr, uh_dport); 189 1.3.2.2 yamt } 190 1.3.2.2 yamt 191 1.3.2.2 yamt if (nbuf_fetch_datum(nbuf, n_ptr, sizeof(in_port_t), &npc->npc_sport)) 192 1.3.2.2 yamt return false; 193 1.3.2.2 yamt if ((n_ptr = nbuf_advance(&nbuf, n_ptr, dst_off)) == NULL) 194 1.3.2.2 yamt return false; 195 1.3.2.2 yamt if (nbuf_fetch_datum(nbuf, n_ptr, sizeof(in_port_t), &npc->npc_dport)) 196 1.3.2.2 yamt return false; 197 1.3.2.2 yamt 198 1.3.2.2 yamt /* Both ports are cached. */ 199 1.3.2.2 yamt npc->npc_info |= NPC_PORTS; 200 1.3.2.2 yamt return true; 201 1.3.2.2 yamt } 202 1.3.2.2 yamt 203 1.3.2.2 yamt /* 204 1.3.2.2 yamt * npf_fetch_icmp: fetch ICMP code, type and possible query ID. 205 1.3.2.2 yamt * 206 1.3.2.2 yamt * => Stores both all fetched items into the cache. 207 1.3.2.2 yamt */ 208 1.3.2.2 yamt bool 209 1.3.2.2 yamt npf_fetch_icmp(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr) 210 1.3.2.2 yamt { 211 1.3.2.2 yamt uint8_t *type = &npc->npc_icmp_type, *code = &npc->npc_icmp_code; 212 1.3.2.2 yamt u_int offby; 213 1.3.2.2 yamt 214 1.3.2.2 yamt KASSERT(npf_iscached(npc, NPC_IP46)); 215 1.3.2.2 yamt 216 1.3.2.2 yamt /* ICMP type. */ 217 1.3.2.2 yamt offby = npc->npc_hlen; 218 1.3.2.2 yamt CTASSERT(offsetof(struct icmp, icmp_type) == 0); 219 1.3.2.2 yamt if (nbuf_advfetch(&nbuf, &n_ptr, offby, sizeof(uint8_t), type)) 220 1.3.2.2 yamt return false; 221 1.3.2.2 yamt 222 1.3.2.2 yamt /* ICMP code. */ 223 1.3.2.2 yamt offby = offsetof(struct icmp, icmp_code); 224 1.3.2.2 yamt if (nbuf_advfetch(&nbuf, &n_ptr, offby, sizeof(uint8_t), code)) 225 1.3.2.2 yamt return false; 226 1.3.2.2 yamt 227 1.3.2.2 yamt /* Mark as cached. */ 228 1.3.2.2 yamt npc->npc_info |= NPC_ICMP; 229 1.3.2.2 yamt return true; 230 1.3.2.2 yamt } 231 1.3.2.2 yamt 232 1.3.2.2 yamt /* 233 1.3.2.2 yamt * npf_fetch_tcpfl: fetch TCP flags and store into the cache. 234 1.3.2.2 yamt */ 235 1.3.2.2 yamt bool 236 1.3.2.2 yamt npf_fetch_tcpfl(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr) 237 1.3.2.2 yamt { 238 1.3.2.2 yamt const u_int offby = npc->npc_hlen + offsetof(struct tcphdr, th_flags); 239 1.3.2.2 yamt uint8_t *tcpfl = &npc->npc_tcp_flags; 240 1.3.2.2 yamt 241 1.3.2.2 yamt if (nbuf_advfetch(&nbuf, &n_ptr, offby, sizeof(uint8_t), tcpfl)) { 242 1.3.2.2 yamt return false; 243 1.3.2.2 yamt } 244 1.3.2.2 yamt return true; 245 1.3.2.2 yamt } 246 1.3.2.2 yamt 247 1.3.2.2 yamt /* 248 1.3.2.2 yamt * npf_cache_all: general routine to cache all relevant IPv4 and 249 1.3.2.2 yamt * TCP, UDP or ICMP data. 250 1.3.2.2 yamt */ 251 1.3.2.2 yamt bool 252 1.3.2.2 yamt npf_cache_all(npf_cache_t *npc, nbuf_t *nbuf) 253 1.3.2.2 yamt { 254 1.3.2.2 yamt void *n_ptr = nbuf_dataptr(nbuf); 255 1.3.2.2 yamt 256 1.3.2.2 yamt /* IPv4: get protocol, source and destination addresses. */ 257 1.3.2.2 yamt if (!npf_iscached(npc, NPC_IP46) && !npf_ip4_proto(npc, nbuf, n_ptr)) { 258 1.3.2.2 yamt return false; 259 1.3.2.2 yamt } 260 1.3.2.2 yamt if (!npf_iscached(npc, NPC_ADDRS) && 261 1.3.2.2 yamt !npf_fetch_ip4addrs(npc, nbuf, n_ptr)) { 262 1.3.2.2 yamt return false; 263 1.3.2.2 yamt } 264 1.3.2.2 yamt switch (npc->npc_proto) { 265 1.3.2.2 yamt case IPPROTO_TCP: 266 1.3.2.2 yamt /* TCP flags. */ 267 1.3.2.2 yamt if (!npf_fetch_tcpfl(npc, nbuf, n_ptr)) { 268 1.3.2.2 yamt return false; 269 1.3.2.2 yamt } 270 1.3.2.2 yamt /* FALLTHROUGH */ 271 1.3.2.2 yamt 272 1.3.2.2 yamt case IPPROTO_UDP: 273 1.3.2.2 yamt /* Fetch TCP/UDP ports. */ 274 1.3.2.2 yamt return npf_fetch_ports(npc, nbuf, n_ptr, npc->npc_proto); 275 1.3.2.2 yamt 276 1.3.2.2 yamt case IPPROTO_ICMP: 277 1.3.2.2 yamt /* Fetch ICMP data. */ 278 1.3.2.2 yamt return npf_fetch_icmp(npc, nbuf, n_ptr); 279 1.3.2.2 yamt } 280 1.3.2.2 yamt return false; 281 1.3.2.2 yamt } 282 1.3.2.2 yamt 283 1.3.2.2 yamt /* 284 1.3.2.2 yamt * npf_rwrport: rewrite required TCP/UDP port and update checksum. 285 1.3.2.2 yamt */ 286 1.3.2.2 yamt bool 287 1.3.2.2 yamt npf_rwrport(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr, const int di, 288 1.3.2.2 yamt in_port_t port, in_addr_t naddr) 289 1.3.2.2 yamt { 290 1.3.2.2 yamt const int proto = npc->npc_proto; 291 1.3.2.2 yamt u_int offby, toff; 292 1.3.2.2 yamt in_addr_t oaddr; 293 1.3.2.2 yamt in_port_t oport; 294 1.3.2.2 yamt uint16_t cksum; 295 1.3.2.2 yamt 296 1.3.2.2 yamt KASSERT(npf_iscached(npc, NPC_PORTS)); 297 1.3.2.2 yamt KASSERT(proto == IPPROTO_TCP || proto == IPPROTO_UDP); 298 1.3.2.2 yamt 299 1.3.2.2 yamt offby = npc->npc_hlen; 300 1.3.2.2 yamt 301 1.3.2.2 yamt if (di == PFIL_OUT) { 302 1.3.2.2 yamt /* Offset to the source port is zero. */ 303 1.3.2.2 yamt CTASSERT(offsetof(struct tcphdr, th_sport) == 0); 304 1.3.2.2 yamt CTASSERT(offsetof(struct udphdr, uh_sport) == 0); 305 1.3.2.2 yamt if (proto == IPPROTO_TCP) { 306 1.3.2.2 yamt toff = offsetof(struct tcphdr, th_sum); 307 1.3.2.2 yamt } else { 308 1.3.2.2 yamt toff = offsetof(struct udphdr, uh_sum); 309 1.3.2.2 yamt } 310 1.3.2.2 yamt oaddr = npc->npc_srcip; 311 1.3.2.2 yamt oport = npc->npc_sport; 312 1.3.2.2 yamt } else { 313 1.3.2.2 yamt /* Calculate offset to destination port and checksum. */ 314 1.3.2.2 yamt u_int poff; 315 1.3.2.2 yamt if (proto == IPPROTO_TCP) { 316 1.3.2.2 yamt poff = offsetof(struct tcphdr, th_dport); 317 1.3.2.2 yamt toff = offsetof(struct tcphdr, th_sum) - poff; 318 1.3.2.2 yamt } else { 319 1.3.2.2 yamt poff = offsetof(struct udphdr, uh_dport); 320 1.3.2.2 yamt toff = offsetof(struct udphdr, uh_sum) - poff; 321 1.3.2.2 yamt } 322 1.3.2.2 yamt oaddr = npc->npc_dstip; 323 1.3.2.2 yamt oport = npc->npc_dport; 324 1.3.2.2 yamt offby += poff; 325 1.3.2.2 yamt } 326 1.3.2.2 yamt 327 1.3.2.2 yamt /* Advance and rewrite port. */ 328 1.3.2.2 yamt if ((n_ptr = nbuf_advance(&nbuf, n_ptr, offby)) == NULL) 329 1.3.2.2 yamt return false; 330 1.3.2.2 yamt if (nbuf_store_datum(nbuf, n_ptr, sizeof(in_port_t), &port)) 331 1.3.2.2 yamt return false; 332 1.3.2.2 yamt 333 1.3.2.2 yamt /* Advance and update TCP/UDP checksum. */ 334 1.3.2.2 yamt if (nbuf_advfetch(&nbuf, &n_ptr, toff, sizeof(uint16_t), &cksum)) { 335 1.3.2.2 yamt return false; 336 1.3.2.2 yamt } 337 1.3.2.2 yamt if (__predict_true(cksum || proto == IPPROTO_TCP)) { 338 1.3.2.2 yamt cksum = npf_fixup32_cksum(cksum, oaddr, naddr); 339 1.3.2.2 yamt cksum = npf_fixup16_cksum(cksum, oport, port); 340 1.3.2.2 yamt if (nbuf_store_datum(nbuf, n_ptr, sizeof(uint16_t), &cksum)) 341 1.3.2.2 yamt return false; 342 1.3.2.2 yamt } 343 1.3.2.2 yamt return true; 344 1.3.2.2 yamt } 345 1.3.2.2 yamt 346 1.3.2.2 yamt /* 347 1.3.2.2 yamt * npf_rwrip: rewrite required IP address and update checksum. 348 1.3.2.2 yamt */ 349 1.3.2.2 yamt bool 350 1.3.2.2 yamt npf_rwrip(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr, const int di, 351 1.3.2.2 yamt in_addr_t addr) 352 1.3.2.2 yamt { 353 1.3.2.2 yamt u_int offby; 354 1.3.2.2 yamt in_addr_t oaddr; 355 1.3.2.2 yamt 356 1.3.2.2 yamt KASSERT(npf_iscached(npc, NPC_IP46 | NPC_ADDRS)); 357 1.3.2.2 yamt 358 1.3.2.2 yamt /* Advance to the checksum in IP header and fetch it. */ 359 1.3.2.2 yamt offby = offsetof(struct ip, ip_sum); 360 1.3.2.2 yamt if ((n_ptr = nbuf_advance(&nbuf, n_ptr, offby)) == NULL) 361 1.3.2.2 yamt return false; 362 1.3.2.2 yamt 363 1.3.2.2 yamt if (di == PFIL_OUT) { 364 1.3.2.2 yamt /* Rewrite source address, if outgoing. */ 365 1.3.2.2 yamt offby = offsetof(struct ip, ip_src) - offby; 366 1.3.2.2 yamt oaddr = npc->npc_srcip; 367 1.3.2.2 yamt } else { 368 1.3.2.2 yamt /* Rewrite destination, if incoming. */ 369 1.3.2.2 yamt offby = offsetof(struct ip, ip_dst) - offby; 370 1.3.2.2 yamt oaddr = npc->npc_dstip; 371 1.3.2.2 yamt } 372 1.3.2.2 yamt 373 1.3.2.2 yamt /* Write new IP checksum (it is acceptable to do this earlier). */ 374 1.3.2.2 yamt uint16_t cksum = npf_fixup32_cksum(npc->npc_ipsum, oaddr, addr); 375 1.3.2.2 yamt if (nbuf_store_datum(nbuf, n_ptr, sizeof(uint16_t), &cksum)) 376 1.3.2.2 yamt return false; 377 1.3.2.2 yamt 378 1.3.2.2 yamt /* Advance to address and rewrite it. */ 379 1.3.2.2 yamt if ((n_ptr = nbuf_advance(&nbuf, n_ptr, offby)) == NULL) 380 1.3.2.2 yamt return false; 381 1.3.2.2 yamt if (nbuf_store_datum(nbuf, n_ptr, sizeof(in_addr_t), &addr)) 382 1.3.2.2 yamt return false; 383 1.3.2.2 yamt 384 1.3.2.2 yamt npc->npc_ipsum = cksum; 385 1.3.2.2 yamt return true; 386 1.3.2.2 yamt } 387
Indexes created Thu Oct 23 22:10:10 GMT 2025