npf_inet.c revision 1.48 1 1.48 maxv /* $NetBSD: npf_inet.c,v 1.48 2018/04/06 14:50:55 maxv Exp $ */
2 1.1 rmind
3 1.1 rmind /*-
4 1.29 rmind * Copyright (c) 2009-2014 The NetBSD Foundation, Inc.
5 1.1 rmind * All rights reserved.
6 1.1 rmind *
7 1.1 rmind * This material is based upon work partially supported by The
8 1.1 rmind * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
9 1.1 rmind *
10 1.1 rmind * Redistribution and use in source and binary forms, with or without
11 1.1 rmind * modification, are permitted provided that the following conditions
12 1.1 rmind * are met:
13 1.1 rmind * 1. Redistributions of source code must retain the above copyright
14 1.1 rmind * notice, this list of conditions and the following disclaimer.
15 1.1 rmind * 2. Redistributions in binary form must reproduce the above copyright
16 1.1 rmind * notice, this list of conditions and the following disclaimer in the
17 1.1 rmind * documentation and/or other materials provided with the distribution.
18 1.1 rmind *
19 1.1 rmind * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 1.1 rmind * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 1.1 rmind * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 1.1 rmind * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 1.1 rmind * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 1.1 rmind * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 1.1 rmind * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 1.1 rmind * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 1.1 rmind * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 1.1 rmind * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 1.1 rmind * POSSIBILITY OF SUCH DAMAGE.
30 1.1 rmind */
31 1.1 rmind
32 1.1 rmind /*
33 1.22 rmind * Various protocol related helper routines.
34 1.12 rmind *
35 1.12 rmind * This layer manipulates npf_cache_t structure i.e. caches requested headers
36 1.12 rmind * and stores which information was cached in the information bit field.
37 1.12 rmind * It is also responsibility of this layer to update or invalidate the cache
38 1.12 rmind * on rewrites (e.g. by translation routines).
39 1.1 rmind */
40 1.1 rmind
41 1.36 christos #ifdef _KERNEL
42 1.1 rmind #include <sys/cdefs.h>
43 1.48 maxv __KERNEL_RCSID(0, "$NetBSD: npf_inet.c,v 1.48 2018/04/06 14:50:55 maxv Exp $");
44 1.1 rmind
45 1.1 rmind #include <sys/param.h>
46 1.11 rmind #include <sys/types.h>
47 1.1 rmind
48 1.4 rmind #include <net/pfil.h>
49 1.4 rmind #include <net/if.h>
50 1.4 rmind #include <net/ethertypes.h>
51 1.4 rmind #include <net/if_ether.h>
52 1.4 rmind
53 1.1 rmind #include <netinet/in_systm.h>
54 1.1 rmind #include <netinet/in.h>
55 1.33 mlelstv #include <netinet6/in6_var.h>
56 1.1 rmind #include <netinet/ip.h>
57 1.4 rmind #include <netinet/ip6.h>
58 1.1 rmind #include <netinet/tcp.h>
59 1.1 rmind #include <netinet/udp.h>
60 1.1 rmind #include <netinet/ip_icmp.h>
61 1.36 christos #endif
62 1.1 rmind
63 1.1 rmind #include "npf_impl.h"
64 1.1 rmind
65 1.1 rmind /*
66 1.27 rmind * npf_fixup{16,32}_cksum: incremental update of the Internet checksum.
67 1.1 rmind */
68 1.1 rmind
69 1.1 rmind uint16_t
70 1.1 rmind npf_fixup16_cksum(uint16_t cksum, uint16_t odatum, uint16_t ndatum)
71 1.1 rmind {
72 1.1 rmind uint32_t sum;
73 1.1 rmind
74 1.1 rmind /*
75 1.1 rmind * RFC 1624:
76 1.1 rmind * HC' = ~(~HC + ~m + m')
77 1.27 rmind *
78 1.27 rmind * Note: 1's complement sum is endian-independent (RFC 1071, page 2).
79 1.1 rmind */
80 1.27 rmind sum = ~cksum & 0xffff;
81 1.27 rmind sum += (~odatum & 0xffff) + ndatum;
82 1.1 rmind sum = (sum >> 16) + (sum & 0xffff);
83 1.1 rmind sum += (sum >> 16);
84 1.1 rmind
85 1.27 rmind return ~sum & 0xffff;
86 1.1 rmind }
87 1.1 rmind
88 1.1 rmind uint16_t
89 1.1 rmind npf_fixup32_cksum(uint16_t cksum, uint32_t odatum, uint32_t ndatum)
90 1.1 rmind {
91 1.27 rmind uint32_t sum;
92 1.27 rmind
93 1.27 rmind /*
94 1.27 rmind * Checksum 32-bit datum as as two 16-bit. Note, the first
95 1.27 rmind * 32->16 bit reduction is not necessary.
96 1.27 rmind */
97 1.27 rmind sum = ~cksum & 0xffff;
98 1.27 rmind sum += (~odatum & 0xffff) + (ndatum & 0xffff);
99 1.1 rmind
100 1.27 rmind sum += (~odatum >> 16) + (ndatum >> 16);
101 1.27 rmind sum = (sum >> 16) + (sum & 0xffff);
102 1.27 rmind sum += (sum >> 16);
103 1.27 rmind return ~sum & 0xffff;
104 1.1 rmind }
105 1.1 rmind
106 1.1 rmind /*
107 1.4 rmind * npf_addr_cksum: calculate checksum of the address, either IPv4 or IPv6.
108 1.4 rmind */
109 1.4 rmind uint16_t
110 1.19 rmind npf_addr_cksum(uint16_t cksum, int sz, const npf_addr_t *oaddr,
111 1.19 rmind const npf_addr_t *naddr)
112 1.4 rmind {
113 1.19 rmind const uint32_t *oip32 = (const uint32_t *)oaddr;
114 1.19 rmind const uint32_t *nip32 = (const uint32_t *)naddr;
115 1.4 rmind
116 1.4 rmind KASSERT(sz % sizeof(uint32_t) == 0);
117 1.4 rmind do {
118 1.4 rmind cksum = npf_fixup32_cksum(cksum, *oip32++, *nip32++);
119 1.4 rmind sz -= sizeof(uint32_t);
120 1.4 rmind } while (sz);
121 1.4 rmind
122 1.4 rmind return cksum;
123 1.4 rmind }
124 1.4 rmind
125 1.4 rmind /*
126 1.26 rmind * npf_addr_sum: provide IP addresses as a XORed 32-bit integer.
127 1.4 rmind * Note: used for hash function.
128 1.1 rmind */
129 1.4 rmind uint32_t
130 1.26 rmind npf_addr_mix(const int sz, const npf_addr_t *a1, const npf_addr_t *a2)
131 1.1 rmind {
132 1.4 rmind uint32_t mix = 0;
133 1.1 rmind
134 1.5 rmind KASSERT(sz > 0 && a1 != NULL && a2 != NULL);
135 1.5 rmind
136 1.26 rmind for (int i = 0; i < (sz >> 2); i++) {
137 1.36 christos mix ^= a1->word32[i];
138 1.36 christos mix ^= a2->word32[i];
139 1.4 rmind }
140 1.4 rmind return mix;
141 1.4 rmind }
142 1.1 rmind
143 1.13 rmind /*
144 1.13 rmind * npf_addr_mask: apply the mask to a given address and store the result.
145 1.13 rmind */
146 1.13 rmind void
147 1.13 rmind npf_addr_mask(const npf_addr_t *addr, const npf_netmask_t mask,
148 1.13 rmind const int alen, npf_addr_t *out)
149 1.12 rmind {
150 1.13 rmind const int nwords = alen >> 2;
151 1.12 rmind uint_fast8_t length = mask;
152 1.12 rmind
153 1.12 rmind /* Note: maximum length is 32 for IPv4 and 128 for IPv6. */
154 1.12 rmind KASSERT(length <= NPF_MAX_NETMASK);
155 1.12 rmind
156 1.13 rmind for (int i = 0; i < nwords; i++) {
157 1.13 rmind uint32_t wordmask;
158 1.13 rmind
159 1.12 rmind if (length >= 32) {
160 1.13 rmind wordmask = htonl(0xffffffff);
161 1.12 rmind length -= 32;
162 1.13 rmind } else if (length) {
163 1.13 rmind wordmask = htonl(0xffffffff << (32 - length));
164 1.13 rmind length = 0;
165 1.12 rmind } else {
166 1.13 rmind wordmask = 0;
167 1.12 rmind }
168 1.36 christos out->word32[i] = addr->word32[i] & wordmask;
169 1.12 rmind }
170 1.12 rmind }
171 1.12 rmind
172 1.12 rmind /*
173 1.12 rmind * npf_addr_cmp: compare two addresses, either IPv4 or IPv6.
174 1.12 rmind *
175 1.13 rmind * => Return 0 if equal and negative/positive if less/greater accordingly.
176 1.12 rmind * => Ignore the mask, if NPF_NO_NETMASK is specified.
177 1.12 rmind */
178 1.12 rmind int
179 1.12 rmind npf_addr_cmp(const npf_addr_t *addr1, const npf_netmask_t mask1,
180 1.13 rmind const npf_addr_t *addr2, const npf_netmask_t mask2, const int alen)
181 1.12 rmind {
182 1.13 rmind npf_addr_t realaddr1, realaddr2;
183 1.12 rmind
184 1.12 rmind if (mask1 != NPF_NO_NETMASK) {
185 1.13 rmind npf_addr_mask(addr1, mask1, alen, &realaddr1);
186 1.13 rmind addr1 = &realaddr1;
187 1.12 rmind }
188 1.12 rmind if (mask2 != NPF_NO_NETMASK) {
189 1.13 rmind npf_addr_mask(addr2, mask2, alen, &realaddr2);
190 1.13 rmind addr2 = &realaddr2;
191 1.12 rmind }
192 1.13 rmind return memcmp(addr1, addr2, alen);
193 1.12 rmind }
194 1.12 rmind
195 1.4 rmind /*
196 1.4 rmind * npf_tcpsaw: helper to fetch SEQ, ACK, WIN and return TCP data length.
197 1.12 rmind *
198 1.12 rmind * => Returns all values in host byte-order.
199 1.4 rmind */
200 1.4 rmind int
201 1.12 rmind npf_tcpsaw(const npf_cache_t *npc, tcp_seq *seq, tcp_seq *ack, uint32_t *win)
202 1.4 rmind {
203 1.19 rmind const struct tcphdr *th = npc->npc_l4.tcp;
204 1.8 rmind u_int thlen;
205 1.1 rmind
206 1.7 zoltan KASSERT(npf_iscached(npc, NPC_TCP));
207 1.1 rmind
208 1.4 rmind *seq = ntohl(th->th_seq);
209 1.4 rmind *ack = ntohl(th->th_ack);
210 1.4 rmind *win = (uint32_t)ntohs(th->th_win);
211 1.8 rmind thlen = th->th_off << 2;
212 1.1 rmind
213 1.7 zoltan if (npf_iscached(npc, NPC_IP4)) {
214 1.19 rmind const struct ip *ip = npc->npc_ip.v4;
215 1.21 rmind return ntohs(ip->ip_len) - npc->npc_hlen - thlen;
216 1.12 rmind } else if (npf_iscached(npc, NPC_IP6)) {
217 1.19 rmind const struct ip6_hdr *ip6 = npc->npc_ip.v6;
218 1.42 maxv return ntohs(ip6->ip6_plen) -
219 1.42 maxv (npc->npc_hlen - sizeof(*ip6)) - thlen;
220 1.7 zoltan }
221 1.7 zoltan return 0;
222 1.1 rmind }
223 1.1 rmind
224 1.1 rmind /*
225 1.4 rmind * npf_fetch_tcpopts: parse and return TCP options.
226 1.1 rmind */
227 1.1 rmind bool
228 1.32 rmind npf_fetch_tcpopts(npf_cache_t *npc, uint16_t *mss, int *wscale)
229 1.1 rmind {
230 1.32 rmind nbuf_t *nbuf = npc->npc_nbuf;
231 1.19 rmind const struct tcphdr *th = npc->npc_l4.tcp;
232 1.4 rmind int topts_len, step;
233 1.48 maxv bool setmss = false;
234 1.39 maxv uint8_t *nptr;
235 1.4 rmind uint8_t val;
236 1.19 rmind bool ok;
237 1.4 rmind
238 1.7 zoltan KASSERT(npf_iscached(npc, NPC_IP46));
239 1.7 zoltan KASSERT(npf_iscached(npc, NPC_TCP));
240 1.10 rmind
241 1.4 rmind /* Determine if there are any TCP options, get their length. */
242 1.4 rmind topts_len = (th->th_off << 2) - sizeof(struct tcphdr);
243 1.4 rmind if (topts_len <= 0) {
244 1.4 rmind /* No options. */
245 1.1 rmind return false;
246 1.4 rmind }
247 1.4 rmind KASSERT(topts_len <= MAX_TCPOPTLEN);
248 1.1 rmind
249 1.48 maxv /* Determine if we want to set or get the mss. */
250 1.48 maxv if (mss) {
251 1.48 maxv setmss = (*mss != 0);
252 1.48 maxv }
253 1.48 maxv
254 1.4 rmind /* First step: IP and TCP header up to options. */
255 1.21 rmind step = npc->npc_hlen + sizeof(struct tcphdr);
256 1.19 rmind nbuf_reset(nbuf);
257 1.4 rmind next:
258 1.19 rmind if ((nptr = nbuf_advance(nbuf, step, 1)) == NULL) {
259 1.19 rmind ok = false;
260 1.19 rmind goto done;
261 1.4 rmind }
262 1.39 maxv val = *nptr;
263 1.12 rmind
264 1.4 rmind switch (val) {
265 1.4 rmind case TCPOPT_EOL:
266 1.4 rmind /* Done. */
267 1.19 rmind ok = true;
268 1.19 rmind goto done;
269 1.4 rmind case TCPOPT_NOP:
270 1.4 rmind topts_len--;
271 1.4 rmind step = 1;
272 1.4 rmind break;
273 1.4 rmind case TCPOPT_MAXSEG:
274 1.39 maxv if ((nptr = nbuf_ensure_contig(nbuf, TCPOLEN_MAXSEG)) == NULL) {
275 1.19 rmind ok = false;
276 1.19 rmind goto done;
277 1.4 rmind }
278 1.4 rmind if (mss) {
279 1.48 maxv if (setmss) {
280 1.39 maxv memcpy(nptr + 2, mss, sizeof(uint16_t));
281 1.19 rmind } else {
282 1.39 maxv memcpy(mss, nptr + 2, sizeof(uint16_t));
283 1.19 rmind }
284 1.4 rmind }
285 1.4 rmind topts_len -= TCPOLEN_MAXSEG;
286 1.39 maxv step = TCPOLEN_MAXSEG;
287 1.4 rmind break;
288 1.4 rmind case TCPOPT_WINDOW:
289 1.10 rmind /* TCP Window Scaling (RFC 1323). */
290 1.39 maxv if ((nptr = nbuf_ensure_contig(nbuf, TCPOLEN_WINDOW)) == NULL) {
291 1.19 rmind ok = false;
292 1.19 rmind goto done;
293 1.4 rmind }
294 1.39 maxv val = *(nptr + 2);
295 1.4 rmind *wscale = (val > TCP_MAX_WINSHIFT) ? TCP_MAX_WINSHIFT : val;
296 1.4 rmind topts_len -= TCPOLEN_WINDOW;
297 1.39 maxv step = TCPOLEN_WINDOW;
298 1.4 rmind break;
299 1.4 rmind default:
300 1.39 maxv if ((nptr = nbuf_ensure_contig(nbuf, 2)) == NULL) {
301 1.19 rmind ok = false;
302 1.19 rmind goto done;
303 1.4 rmind }
304 1.39 maxv val = *(nptr + 1);
305 1.16 rmind if (val < 2 || val > topts_len) {
306 1.19 rmind ok = false;
307 1.19 rmind goto done;
308 1.4 rmind }
309 1.4 rmind topts_len -= val;
310 1.39 maxv step = val;
311 1.4 rmind }
312 1.12 rmind
313 1.6 rmind /* Any options left? */
314 1.4 rmind if (__predict_true(topts_len > 0)) {
315 1.4 rmind goto next;
316 1.4 rmind }
317 1.19 rmind ok = true;
318 1.19 rmind done:
319 1.19 rmind if (nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)) {
320 1.32 rmind npf_recache(npc);
321 1.19 rmind }
322 1.19 rmind return ok;
323 1.1 rmind }
324 1.1 rmind
325 1.19 rmind static int
326 1.19 rmind npf_cache_ip(npf_cache_t *npc, nbuf_t *nbuf)
327 1.1 rmind {
328 1.19 rmind const void *nptr = nbuf_dataptr(nbuf);
329 1.19 rmind const uint8_t ver = *(const uint8_t *)nptr;
330 1.19 rmind int flags = 0;
331 1.12 rmind
332 1.43 maxv /*
333 1.43 maxv * We intentionally don't read the L4 payload after IPPROTO_AH.
334 1.43 maxv */
335 1.43 maxv
336 1.4 rmind switch (ver >> 4) {
337 1.12 rmind case IPVERSION: {
338 1.19 rmind struct ip *ip;
339 1.12 rmind
340 1.19 rmind ip = nbuf_ensure_contig(nbuf, sizeof(struct ip));
341 1.19 rmind if (ip == NULL) {
342 1.38 maxv return NPC_FMTERR;
343 1.4 rmind }
344 1.12 rmind
345 1.46 maxv /* Retrieve the complete header. */
346 1.10 rmind if ((u_int)(ip->ip_hl << 2) < sizeof(struct ip)) {
347 1.38 maxv return NPC_FMTERR;
348 1.4 rmind }
349 1.46 maxv ip = nbuf_ensure_contig(nbuf, (u_int)(ip->ip_hl << 2));
350 1.46 maxv if (ip == NULL) {
351 1.46 maxv return NPC_FMTERR;
352 1.46 maxv }
353 1.46 maxv
354 1.4 rmind if (ip->ip_off & ~htons(IP_DF | IP_RF)) {
355 1.4 rmind /* Note fragmentation. */
356 1.19 rmind flags |= NPC_IPFRAG;
357 1.4 rmind }
358 1.12 rmind
359 1.4 rmind /* Cache: layer 3 - IPv4. */
360 1.14 rmind npc->npc_alen = sizeof(struct in_addr);
361 1.28 rmind npc->npc_ips[NPF_SRC] = (npf_addr_t *)&ip->ip_src;
362 1.28 rmind npc->npc_ips[NPF_DST] = (npf_addr_t *)&ip->ip_dst;
363 1.7 zoltan npc->npc_hlen = ip->ip_hl << 2;
364 1.19 rmind npc->npc_proto = ip->ip_p;
365 1.19 rmind
366 1.19 rmind npc->npc_ip.v4 = ip;
367 1.19 rmind flags |= NPC_IP4;
368 1.4 rmind break;
369 1.12 rmind }
370 1.4 rmind
371 1.12 rmind case (IPV6_VERSION >> 4): {
372 1.19 rmind struct ip6_hdr *ip6;
373 1.19 rmind struct ip6_ext *ip6e;
374 1.37 christos struct ip6_frag *ip6f;
375 1.19 rmind size_t off, hlen;
376 1.38 maxv int frag_present;
377 1.19 rmind
378 1.19 rmind ip6 = nbuf_ensure_contig(nbuf, sizeof(struct ip6_hdr));
379 1.19 rmind if (ip6 == NULL) {
380 1.38 maxv return NPC_FMTERR;
381 1.7 zoltan }
382 1.19 rmind
383 1.44 maxv /*
384 1.44 maxv * XXX: We don't handle IPv6 Jumbograms.
385 1.44 maxv */
386 1.44 maxv
387 1.19 rmind /* Set initial next-protocol value. */
388 1.19 rmind hlen = sizeof(struct ip6_hdr);
389 1.19 rmind npc->npc_proto = ip6->ip6_nxt;
390 1.13 rmind npc->npc_hlen = hlen;
391 1.7 zoltan
392 1.38 maxv frag_present = 0;
393 1.38 maxv
394 1.12 rmind /*
395 1.19 rmind * Advance by the length of the current header.
396 1.12 rmind */
397 1.19 rmind off = nbuf_offset(nbuf);
398 1.38 maxv while ((ip6e = nbuf_advance(nbuf, hlen, sizeof(*ip6e))) != NULL) {
399 1.13 rmind /*
400 1.13 rmind * Determine whether we are going to continue.
401 1.13 rmind */
402 1.19 rmind switch (npc->npc_proto) {
403 1.13 rmind case IPPROTO_HOPOPTS:
404 1.7 zoltan case IPPROTO_DSTOPTS:
405 1.7 zoltan case IPPROTO_ROUTING:
406 1.19 rmind hlen = (ip6e->ip6e_len + 1) << 3;
407 1.7 zoltan break;
408 1.7 zoltan case IPPROTO_FRAGMENT:
409 1.38 maxv if (frag_present++)
410 1.38 maxv return NPC_FMTERR;
411 1.37 christos ip6f = nbuf_ensure_contig(nbuf, sizeof(*ip6f));
412 1.37 christos if (ip6f == NULL)
413 1.38 maxv return NPC_FMTERR;
414 1.38 maxv
415 1.41 maxv /* RFC6946: Skip dummy fragments. */
416 1.41 maxv if (!ntohs(ip6f->ip6f_offlg & IP6F_OFF_MASK) &&
417 1.41 maxv !(ip6f->ip6f_offlg & IP6F_MORE_FRAG)) {
418 1.41 maxv hlen = sizeof(struct ip6_frag);
419 1.41 maxv break;
420 1.41 maxv }
421 1.41 maxv
422 1.40 maxv hlen = 0;
423 1.40 maxv flags |= NPC_IPFRAG;
424 1.37 christos
425 1.7 zoltan break;
426 1.7 zoltan default:
427 1.13 rmind hlen = 0;
428 1.13 rmind break;
429 1.13 rmind }
430 1.13 rmind
431 1.13 rmind if (!hlen) {
432 1.7 zoltan break;
433 1.7 zoltan }
434 1.19 rmind npc->npc_proto = ip6e->ip6e_nxt;
435 1.13 rmind npc->npc_hlen += hlen;
436 1.13 rmind }
437 1.7 zoltan
438 1.46 maxv if (ip6e == NULL) {
439 1.46 maxv return NPC_FMTERR;
440 1.46 maxv }
441 1.46 maxv
442 1.23 rmind /*
443 1.23 rmind * Re-fetch the header pointers (nbufs might have been
444 1.23 rmind * reallocated). Restore the original offset (if any).
445 1.23 rmind */
446 1.19 rmind nbuf_reset(nbuf);
447 1.23 rmind ip6 = nbuf_dataptr(nbuf);
448 1.19 rmind if (off) {
449 1.19 rmind nbuf_advance(nbuf, off, 0);
450 1.19 rmind }
451 1.19 rmind
452 1.12 rmind /* Cache: layer 3 - IPv6. */
453 1.14 rmind npc->npc_alen = sizeof(struct in6_addr);
454 1.28 rmind npc->npc_ips[NPF_SRC] = (npf_addr_t *)&ip6->ip6_src;
455 1.44 maxv npc->npc_ips[NPF_DST] = (npf_addr_t *)&ip6->ip6_dst;
456 1.19 rmind
457 1.19 rmind npc->npc_ip.v6 = ip6;
458 1.19 rmind flags |= NPC_IP6;
459 1.7 zoltan break;
460 1.12 rmind }
461 1.4 rmind default:
462 1.19 rmind break;
463 1.4 rmind }
464 1.19 rmind return flags;
465 1.1 rmind }
466 1.1 rmind
467 1.1 rmind /*
468 1.4 rmind * npf_cache_all: general routine to cache all relevant IP (v4 or v6)
469 1.12 rmind * and TCP, UDP or ICMP headers.
470 1.19 rmind *
471 1.19 rmind * => nbuf offset shall be set accordingly.
472 1.1 rmind */
473 1.10 rmind int
474 1.32 rmind npf_cache_all(npf_cache_t *npc)
475 1.1 rmind {
476 1.32 rmind nbuf_t *nbuf = npc->npc_nbuf;
477 1.19 rmind int flags, l4flags;
478 1.19 rmind u_int hlen;
479 1.19 rmind
480 1.19 rmind /*
481 1.19 rmind * This routine is a main point where the references are cached,
482 1.19 rmind * therefore clear the flag as we reset.
483 1.19 rmind */
484 1.19 rmind again:
485 1.19 rmind nbuf_unset_flag(nbuf, NBUF_DATAREF_RESET);
486 1.1 rmind
487 1.19 rmind /*
488 1.19 rmind * First, cache the L3 header (IPv4 or IPv6). If IP packet is
489 1.19 rmind * fragmented, then we cannot look into L4.
490 1.19 rmind */
491 1.19 rmind flags = npf_cache_ip(npc, nbuf);
492 1.38 maxv if ((flags & NPC_IP46) == 0 || (flags & NPC_IPFRAG) != 0 ||
493 1.38 maxv (flags & NPC_FMTERR) != 0) {
494 1.47 maxv goto out;
495 1.1 rmind }
496 1.19 rmind hlen = npc->npc_hlen;
497 1.19 rmind
498 1.45 maxv /*
499 1.45 maxv * Note: we guarantee that the potential "Query Id" field of the
500 1.45 maxv * ICMPv4/ICMPv6 packets is in the nbuf. This field is used in the
501 1.45 maxv * ICMP ALG.
502 1.45 maxv */
503 1.19 rmind switch (npc->npc_proto) {
504 1.1 rmind case IPPROTO_TCP:
505 1.19 rmind /* Cache: layer 4 - TCP. */
506 1.19 rmind npc->npc_l4.tcp = nbuf_advance(nbuf, hlen,
507 1.19 rmind sizeof(struct tcphdr));
508 1.19 rmind l4flags = NPC_LAYER4 | NPC_TCP;
509 1.10 rmind break;
510 1.1 rmind case IPPROTO_UDP:
511 1.19 rmind /* Cache: layer 4 - UDP. */
512 1.19 rmind npc->npc_l4.udp = nbuf_advance(nbuf, hlen,
513 1.19 rmind sizeof(struct udphdr));
514 1.19 rmind l4flags = NPC_LAYER4 | NPC_UDP;
515 1.10 rmind break;
516 1.1 rmind case IPPROTO_ICMP:
517 1.19 rmind /* Cache: layer 4 - ICMPv4. */
518 1.19 rmind npc->npc_l4.icmp = nbuf_advance(nbuf, hlen,
519 1.45 maxv ICMP_MINLEN);
520 1.19 rmind l4flags = NPC_LAYER4 | NPC_ICMP;
521 1.19 rmind break;
522 1.15 spz case IPPROTO_ICMPV6:
523 1.19 rmind /* Cache: layer 4 - ICMPv6. */
524 1.19 rmind npc->npc_l4.icmp6 = nbuf_advance(nbuf, hlen,
525 1.45 maxv sizeof(struct icmp6_hdr));
526 1.19 rmind l4flags = NPC_LAYER4 | NPC_ICMP;
527 1.19 rmind break;
528 1.19 rmind default:
529 1.19 rmind l4flags = 0;
530 1.10 rmind break;
531 1.1 rmind }
532 1.19 rmind
533 1.47 maxv /* Error out if nbuf_advance failed. */
534 1.47 maxv if (l4flags && npc->npc_l4.hdr == NULL) {
535 1.47 maxv goto err;
536 1.47 maxv }
537 1.47 maxv
538 1.19 rmind if (nbuf_flag_p(nbuf, NBUF_DATAREF_RESET)) {
539 1.19 rmind goto again;
540 1.19 rmind }
541 1.19 rmind
542 1.47 maxv flags |= l4flags;
543 1.47 maxv npc->npc_info |= flags;
544 1.47 maxv return flags;
545 1.47 maxv
546 1.47 maxv err:
547 1.47 maxv flags = NPC_FMTERR;
548 1.47 maxv out:
549 1.47 maxv nbuf_unset_flag(nbuf, NBUF_DATAREF_RESET);
550 1.19 rmind npc->npc_info |= flags;
551 1.19 rmind return flags;
552 1.19 rmind }
553 1.19 rmind
554 1.19 rmind void
555 1.32 rmind npf_recache(npf_cache_t *npc)
556 1.19 rmind {
557 1.32 rmind nbuf_t *nbuf = npc->npc_nbuf;
558 1.24 martin const int mflags __diagused = npc->npc_info & (NPC_IP46 | NPC_LAYER4);
559 1.25 mrg int flags __diagused;
560 1.19 rmind
561 1.19 rmind nbuf_reset(nbuf);
562 1.19 rmind npc->npc_info = 0;
563 1.32 rmind flags = npf_cache_all(npc);
564 1.32 rmind
565 1.19 rmind KASSERT((flags & mflags) == mflags);
566 1.19 rmind KASSERT(nbuf_flag_p(nbuf, NBUF_DATAREF_RESET) == 0);
567 1.1 rmind }
568 1.1 rmind
569 1.1 rmind /*
570 1.19 rmind * npf_rwrip: rewrite required IP address.
571 1.4 rmind */
572 1.4 rmind bool
573 1.28 rmind npf_rwrip(const npf_cache_t *npc, u_int which, const npf_addr_t *addr)
574 1.4 rmind {
575 1.4 rmind KASSERT(npf_iscached(npc, NPC_IP46));
576 1.28 rmind KASSERT(which == NPF_SRC || which == NPF_DST);
577 1.4 rmind
578 1.28 rmind memcpy(npc->npc_ips[which], addr, npc->npc_alen);
579 1.4 rmind return true;
580 1.4 rmind }
581 1.4 rmind
582 1.4 rmind /*
583 1.19 rmind * npf_rwrport: rewrite required TCP/UDP port.
584 1.1 rmind */
585 1.1 rmind bool
586 1.28 rmind npf_rwrport(const npf_cache_t *npc, u_int which, const in_port_t port)
587 1.1 rmind {
588 1.21 rmind const int proto = npc->npc_proto;
589 1.4 rmind in_port_t *oport;
590 1.1 rmind
591 1.4 rmind KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP));
592 1.1 rmind KASSERT(proto == IPPROTO_TCP || proto == IPPROTO_UDP);
593 1.28 rmind KASSERT(which == NPF_SRC || which == NPF_DST);
594 1.1 rmind
595 1.19 rmind /* Get the offset and store the port in it. */
596 1.4 rmind if (proto == IPPROTO_TCP) {
597 1.19 rmind struct tcphdr *th = npc->npc_l4.tcp;
598 1.28 rmind oport = (which == NPF_SRC) ? &th->th_sport : &th->th_dport;
599 1.1 rmind } else {
600 1.19 rmind struct udphdr *uh = npc->npc_l4.udp;
601 1.28 rmind oport = (which == NPF_SRC) ? &uh->uh_sport : &uh->uh_dport;
602 1.1 rmind }
603 1.19 rmind memcpy(oport, &port, sizeof(in_port_t));
604 1.1 rmind return true;
605 1.1 rmind }
606 1.1 rmind
607 1.1 rmind /*
608 1.19 rmind * npf_rwrcksum: rewrite IPv4 and/or TCP/UDP checksum.
609 1.1 rmind */
610 1.1 rmind bool
611 1.28 rmind npf_rwrcksum(const npf_cache_t *npc, u_int which,
612 1.19 rmind const npf_addr_t *addr, const in_port_t port)
613 1.1 rmind {
614 1.28 rmind const npf_addr_t *oaddr = npc->npc_ips[which];
615 1.21 rmind const int proto = npc->npc_proto;
616 1.19 rmind const int alen = npc->npc_alen;
617 1.18 rmind uint16_t *ocksum;
618 1.18 rmind in_port_t oport;
619 1.18 rmind
620 1.19 rmind KASSERT(npf_iscached(npc, NPC_LAYER4));
621 1.28 rmind KASSERT(which == NPF_SRC || which == NPF_DST);
622 1.18 rmind
623 1.4 rmind if (npf_iscached(npc, NPC_IP4)) {
624 1.19 rmind struct ip *ip = npc->npc_ip.v4;
625 1.19 rmind uint16_t ipsum = ip->ip_sum;
626 1.4 rmind
627 1.19 rmind /* Recalculate IPv4 checksum and rewrite. */
628 1.19 rmind ip->ip_sum = npf_addr_cksum(ipsum, alen, oaddr, addr);
629 1.4 rmind } else {
630 1.4 rmind /* No checksum for IPv6. */
631 1.4 rmind KASSERT(npf_iscached(npc, NPC_IP6));
632 1.4 rmind }
633 1.4 rmind
634 1.18 rmind /* Nothing else to do for ICMP. */
635 1.30 rmind if (proto == IPPROTO_ICMP || proto == IPPROTO_ICMPV6) {
636 1.4 rmind return true;
637 1.4 rmind }
638 1.7 zoltan KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP));
639 1.4 rmind
640 1.18 rmind /*
641 1.18 rmind * Calculate TCP/UDP checksum:
642 1.18 rmind * - Skip if UDP and the current checksum is zero.
643 1.18 rmind * - Fixup the IP address change.
644 1.18 rmind * - Fixup the port change, if required (non-zero).
645 1.18 rmind */
646 1.4 rmind if (proto == IPPROTO_TCP) {
647 1.19 rmind struct tcphdr *th = npc->npc_l4.tcp;
648 1.4 rmind
649 1.18 rmind ocksum = &th->th_sum;
650 1.28 rmind oport = (which == NPF_SRC) ? th->th_sport : th->th_dport;
651 1.4 rmind } else {
652 1.19 rmind struct udphdr *uh = npc->npc_l4.udp;
653 1.4 rmind
654 1.4 rmind KASSERT(proto == IPPROTO_UDP);
655 1.18 rmind ocksum = &uh->uh_sum;
656 1.18 rmind if (*ocksum == 0) {
657 1.4 rmind /* No need to update. */
658 1.4 rmind return true;
659 1.4 rmind }
660 1.28 rmind oport = (which == NPF_SRC) ? uh->uh_sport : uh->uh_dport;
661 1.18 rmind }
662 1.18 rmind
663 1.19 rmind uint16_t cksum = npf_addr_cksum(*ocksum, alen, oaddr, addr);
664 1.18 rmind if (port) {
665 1.18 rmind cksum = npf_fixup16_cksum(cksum, oport, port);
666 1.4 rmind }
667 1.1 rmind
668 1.19 rmind /* Rewrite TCP/UDP checksum. */
669 1.19 rmind memcpy(ocksum, &cksum, sizeof(uint16_t));
670 1.4 rmind return true;
671 1.4 rmind }
672 1.4 rmind
673 1.29 rmind /*
674 1.30 rmind * npf_napt_rwr: perform address and/or port translation.
675 1.30 rmind */
676 1.30 rmind int
677 1.30 rmind npf_napt_rwr(const npf_cache_t *npc, u_int which,
678 1.30 rmind const npf_addr_t *addr, const in_addr_t port)
679 1.30 rmind {
680 1.30 rmind const unsigned proto = npc->npc_proto;
681 1.30 rmind
682 1.30 rmind /*
683 1.30 rmind * Rewrite IP and/or TCP/UDP checksums first, since we need the
684 1.30 rmind * current (old) address/port for the calculations. Then perform
685 1.30 rmind * the address translation i.e. rewrite source or destination.
686 1.30 rmind */
687 1.30 rmind if (!npf_rwrcksum(npc, which, addr, port)) {
688 1.30 rmind return EINVAL;
689 1.30 rmind }
690 1.30 rmind if (!npf_rwrip(npc, which, addr)) {
691 1.30 rmind return EINVAL;
692 1.30 rmind }
693 1.30 rmind if (port == 0) {
694 1.30 rmind /* Done. */
695 1.30 rmind return 0;
696 1.30 rmind }
697 1.30 rmind
698 1.30 rmind switch (proto) {
699 1.30 rmind case IPPROTO_TCP:
700 1.30 rmind case IPPROTO_UDP:
701 1.30 rmind /* Rewrite source/destination port. */
702 1.30 rmind if (!npf_rwrport(npc, which, port)) {
703 1.30 rmind return EINVAL;
704 1.30 rmind }
705 1.30 rmind break;
706 1.30 rmind case IPPROTO_ICMP:
707 1.30 rmind case IPPROTO_ICMPV6:
708 1.30 rmind KASSERT(npf_iscached(npc, NPC_ICMP));
709 1.30 rmind /* Nothing. */
710 1.30 rmind break;
711 1.30 rmind default:
712 1.30 rmind return ENOTSUP;
713 1.30 rmind }
714 1.30 rmind return 0;
715 1.30 rmind }
716 1.30 rmind
717 1.30 rmind /*
718 1.29 rmind * IPv6-to-IPv6 Network Prefix Translation (NPTv6), as per RFC 6296.
719 1.29 rmind */
720 1.29 rmind
721 1.29 rmind int
722 1.29 rmind npf_npt66_rwr(const npf_cache_t *npc, u_int which, const npf_addr_t *pref,
723 1.29 rmind npf_netmask_t len, uint16_t adj)
724 1.29 rmind {
725 1.29 rmind npf_addr_t *addr = npc->npc_ips[which];
726 1.29 rmind unsigned remnant, word, preflen = len >> 4;
727 1.29 rmind uint32_t sum;
728 1.29 rmind
729 1.29 rmind KASSERT(which == NPF_SRC || which == NPF_DST);
730 1.29 rmind
731 1.29 rmind if (!npf_iscached(npc, NPC_IP6)) {
732 1.29 rmind return EINVAL;
733 1.29 rmind }
734 1.29 rmind if (len <= 48) {
735 1.29 rmind /*
736 1.29 rmind * The word to adjust. Cannot translate the 0xffff
737 1.29 rmind * subnet if /48 or shorter.
738 1.29 rmind */
739 1.29 rmind word = 3;
740 1.36 christos if (addr->word16[word] == 0xffff) {
741 1.29 rmind return EINVAL;
742 1.29 rmind }
743 1.29 rmind } else {
744 1.29 rmind /*
745 1.29 rmind * Also, all 0s or 1s in the host part are disallowed for
746 1.29 rmind * longer than /48 prefixes.
747 1.29 rmind */
748 1.36 christos if ((addr->word32[2] == 0 && addr->word32[3] == 0) ||
749 1.36 christos (addr->word32[2] == ~0U && addr->word32[3] == ~0U))
750 1.29 rmind return EINVAL;
751 1.29 rmind
752 1.29 rmind /* Determine the 16-bit word to adjust. */
753 1.29 rmind for (word = 4; word < 8; word++)
754 1.36 christos if (addr->word16[word] != 0xffff)
755 1.29 rmind break;
756 1.29 rmind }
757 1.29 rmind
758 1.29 rmind /* Rewrite the prefix. */
759 1.29 rmind for (unsigned i = 0; i < preflen; i++) {
760 1.36 christos addr->word16[i] = pref->word16[i];
761 1.29 rmind }
762 1.29 rmind
763 1.29 rmind /*
764 1.29 rmind * If prefix length is within a 16-bit word (not dividable by 16),
765 1.29 rmind * then prepare a mask, determine the word and adjust it.
766 1.29 rmind */
767 1.29 rmind if ((remnant = len - (preflen << 4)) != 0) {
768 1.29 rmind const uint16_t wordmask = (1U << remnant) - 1;
769 1.29 rmind const unsigned i = preflen;
770 1.29 rmind
771 1.36 christos addr->word16[i] = (pref->word16[i] & wordmask) |
772 1.36 christos (addr->word16[i] & ~wordmask);
773 1.29 rmind }
774 1.29 rmind
775 1.29 rmind /*
776 1.29 rmind * Performing 1's complement sum/difference.
777 1.29 rmind */
778 1.36 christos sum = addr->word16[word] + adj;
779 1.29 rmind while (sum >> 16) {
780 1.29 rmind sum = (sum >> 16) + (sum & 0xffff);
781 1.29 rmind }
782 1.29 rmind if (sum == 0xffff) {
783 1.29 rmind /* RFC 1071. */
784 1.29 rmind sum = 0x0000;
785 1.29 rmind }
786 1.36 christos addr->word16[word] = sum;
787 1.29 rmind return 0;
788 1.29 rmind }
789 1.29 rmind
790 1.13 rmind #if defined(DDB) || defined(_NPF_TESTING)
791 1.13 rmind
792 1.31 rmind const char *
793 1.31 rmind npf_addr_dump(const npf_addr_t *addr, int alen)
794 1.13 rmind {
795 1.31 rmind if (alen == sizeof(struct in_addr)) {
796 1.31 rmind struct in_addr ip;
797 1.31 rmind memcpy(&ip, addr, alen);
798 1.31 rmind return inet_ntoa(ip);
799 1.31 rmind }
800 1.36 christos return "[IPv6]";
801 1.13 rmind }
802 1.13 rmind
803 1.13 rmind #endif
804