Home | History | Annotate | Line # | Download | only in npf
npf_inet.c revision 1.9
      1  1.9  jakllsch /*	$NetBSD: npf_inet.c,v 1.9 2011/11/12 14:51:41 jakllsch Exp $	*/
      2  1.1     rmind 
      3  1.1     rmind /*-
      4  1.6     rmind  * Copyright (c) 2009-2011 The NetBSD Foundation, Inc.
      5  1.1     rmind  * All rights reserved.
      6  1.1     rmind  *
      7  1.1     rmind  * This material is based upon work partially supported by The
      8  1.1     rmind  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
      9  1.1     rmind  *
     10  1.1     rmind  * Redistribution and use in source and binary forms, with or without
     11  1.1     rmind  * modification, are permitted provided that the following conditions
     12  1.1     rmind  * are met:
     13  1.1     rmind  * 1. Redistributions of source code must retain the above copyright
     14  1.1     rmind  *    notice, this list of conditions and the following disclaimer.
     15  1.1     rmind  * 2. Redistributions in binary form must reproduce the above copyright
     16  1.1     rmind  *    notice, this list of conditions and the following disclaimer in the
     17  1.1     rmind  *    documentation and/or other materials provided with the distribution.
     18  1.1     rmind  *
     19  1.1     rmind  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  1.1     rmind  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  1.1     rmind  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  1.1     rmind  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  1.1     rmind  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  1.1     rmind  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  1.1     rmind  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  1.1     rmind  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  1.1     rmind  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  1.1     rmind  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  1.1     rmind  * POSSIBILITY OF SUCH DAMAGE.
     30  1.1     rmind  */
     31  1.1     rmind 
     32  1.1     rmind /*
     33  1.1     rmind  * Various procotol related helper routines.
     34  1.1     rmind  */
     35  1.1     rmind 
     36  1.1     rmind #include <sys/cdefs.h>
     37  1.9  jakllsch __KERNEL_RCSID(0, "$NetBSD: npf_inet.c,v 1.9 2011/11/12 14:51:41 jakllsch Exp $");
     38  1.1     rmind 
     39  1.1     rmind #include <sys/param.h>
     40  1.1     rmind #include <sys/kernel.h>
     41  1.1     rmind 
     42  1.4     rmind #include <net/pfil.h>
     43  1.4     rmind #include <net/if.h>
     44  1.4     rmind #include <net/ethertypes.h>
     45  1.4     rmind #include <net/if_ether.h>
     46  1.4     rmind 
     47  1.1     rmind #include <netinet/in_systm.h>
     48  1.1     rmind #include <netinet/in.h>
     49  1.4     rmind #include <netinet/in_var.h>
     50  1.1     rmind #include <netinet/ip.h>
     51  1.4     rmind #include <netinet/ip6.h>
     52  1.1     rmind #include <netinet/tcp.h>
     53  1.1     rmind #include <netinet/udp.h>
     54  1.1     rmind #include <netinet/ip_icmp.h>
     55  1.1     rmind 
     56  1.1     rmind #include "npf_impl.h"
     57  1.1     rmind 
     58  1.1     rmind /*
     59  1.1     rmind  * npf_fixup{16,32}_cksum: update IPv4 checksum.
     60  1.1     rmind  */
     61  1.1     rmind 
     62  1.1     rmind uint16_t
     63  1.1     rmind npf_fixup16_cksum(uint16_t cksum, uint16_t odatum, uint16_t ndatum)
     64  1.1     rmind {
     65  1.1     rmind 	uint32_t sum;
     66  1.1     rmind 
     67  1.1     rmind 	/*
     68  1.1     rmind 	 * RFC 1624:
     69  1.1     rmind 	 *	HC' = ~(~HC + ~m + m')
     70  1.1     rmind 	 */
     71  1.1     rmind 	sum = ~ntohs(cksum) & 0xffff;
     72  1.1     rmind 	sum += (~ntohs(odatum) & 0xffff) + ntohs(ndatum);
     73  1.1     rmind 	sum = (sum >> 16) + (sum & 0xffff);
     74  1.1     rmind 	sum += (sum >> 16);
     75  1.1     rmind 
     76  1.1     rmind 	return htons(~sum & 0xffff);
     77  1.1     rmind }
     78  1.1     rmind 
     79  1.1     rmind uint16_t
     80  1.1     rmind npf_fixup32_cksum(uint16_t cksum, uint32_t odatum, uint32_t ndatum)
     81  1.1     rmind {
     82  1.1     rmind 
     83  1.1     rmind 	cksum = npf_fixup16_cksum(cksum, odatum & 0xffff, ndatum & 0xffff);
     84  1.1     rmind 	cksum = npf_fixup16_cksum(cksum, odatum >> 16, ndatum >> 16);
     85  1.1     rmind 	return cksum;
     86  1.1     rmind }
     87  1.1     rmind 
     88  1.1     rmind /*
     89  1.4     rmind  * npf_addr_cksum: calculate checksum of the address, either IPv4 or IPv6.
     90  1.4     rmind  */
     91  1.4     rmind uint16_t
     92  1.4     rmind npf_addr_cksum(uint16_t cksum, int sz, npf_addr_t *oaddr, npf_addr_t *naddr)
     93  1.4     rmind {
     94  1.4     rmind 	uint32_t *oip32 = (uint32_t *)oaddr, *nip32 = (uint32_t *)naddr;
     95  1.4     rmind 
     96  1.4     rmind 	KASSERT(sz % sizeof(uint32_t) == 0);
     97  1.4     rmind 	do {
     98  1.4     rmind 		cksum = npf_fixup32_cksum(cksum, *oip32++, *nip32++);
     99  1.4     rmind 		sz -= sizeof(uint32_t);
    100  1.4     rmind 	} while (sz);
    101  1.4     rmind 
    102  1.4     rmind 	return cksum;
    103  1.4     rmind }
    104  1.4     rmind 
    105  1.4     rmind /*
    106  1.4     rmind  * npf_addr_sum: provide IP address as a summed (if needed) 32-bit integer.
    107  1.4     rmind  * Note: used for hash function.
    108  1.1     rmind  */
    109  1.4     rmind uint32_t
    110  1.4     rmind npf_addr_sum(const int sz, const npf_addr_t *a1, const npf_addr_t *a2)
    111  1.1     rmind {
    112  1.4     rmind 	uint32_t mix = 0;
    113  1.4     rmind 	int i;
    114  1.1     rmind 
    115  1.5     rmind 	KASSERT(sz > 0 && a1 != NULL && a2 != NULL);
    116  1.5     rmind 
    117  1.4     rmind 	for (i = 0; i < (sz >> 2); i++) {
    118  1.4     rmind 		mix += a1->s6_addr32[i];
    119  1.4     rmind 		mix += a2->s6_addr32[i];
    120  1.4     rmind 	}
    121  1.4     rmind 	return mix;
    122  1.4     rmind }
    123  1.1     rmind 
    124  1.4     rmind /*
    125  1.4     rmind  * npf_tcpsaw: helper to fetch SEQ, ACK, WIN and return TCP data length.
    126  1.4     rmind  * Returns all values in host byte-order.
    127  1.4     rmind  */
    128  1.4     rmind int
    129  1.8     rmind npf_tcpsaw(npf_cache_t *npc, nbuf_t *nbuf, tcp_seq *seq, tcp_seq *ack,
    130  1.8     rmind     uint32_t *win)
    131  1.4     rmind {
    132  1.4     rmind 	struct tcphdr *th = &npc->npc_l4.tcp;
    133  1.8     rmind 	u_int thlen;
    134  1.1     rmind 
    135  1.7    zoltan 	KASSERT(npf_iscached(npc, NPC_TCP));
    136  1.1     rmind 
    137  1.4     rmind 	*seq = ntohl(th->th_seq);
    138  1.4     rmind 	*ack = ntohl(th->th_ack);
    139  1.4     rmind 	*win = (uint32_t)ntohs(th->th_win);
    140  1.8     rmind 	thlen = th->th_off << 2;
    141  1.1     rmind 
    142  1.7    zoltan 	if (npf_iscached(npc, NPC_IP4)) {
    143  1.7    zoltan 		struct ip *ip = &npc->npc_ip.v4;
    144  1.8     rmind 		return ntohs(ip->ip_len) - npf_cache_hlen(npc, nbuf) - thlen;
    145  1.7    zoltan 	} else {
    146  1.7    zoltan 		KASSERT(npf_iscached(npc, NPC_IP6));
    147  1.7    zoltan 		struct ip6_hdr *ip6 = &npc->npc_ip.v6;
    148  1.8     rmind 		return ntohs(ip6->ip6_plen) - thlen;
    149  1.7    zoltan 	}
    150  1.7    zoltan 	return 0;
    151  1.1     rmind }
    152  1.1     rmind 
    153  1.1     rmind /*
    154  1.4     rmind  * npf_fetch_tcpopts: parse and return TCP options.
    155  1.1     rmind  */
    156  1.1     rmind bool
    157  1.4     rmind npf_fetch_tcpopts(const npf_cache_t *npc, nbuf_t *nbuf,
    158  1.4     rmind     uint16_t *mss, int *wscale)
    159  1.1     rmind {
    160  1.4     rmind 	void *n_ptr = nbuf_dataptr(nbuf);
    161  1.4     rmind 	const struct tcphdr *th = &npc->npc_l4.tcp;
    162  1.4     rmind 	int topts_len, step;
    163  1.4     rmind 	uint16_t val16;
    164  1.4     rmind 	uint8_t val;
    165  1.4     rmind 
    166  1.7    zoltan 	KASSERT(npf_iscached(npc, NPC_IP46));
    167  1.7    zoltan 	KASSERT(npf_iscached(npc, NPC_TCP));
    168  1.4     rmind 	/* Determine if there are any TCP options, get their length. */
    169  1.4     rmind 	topts_len = (th->th_off << 2) - sizeof(struct tcphdr);
    170  1.4     rmind 	if (topts_len <= 0) {
    171  1.4     rmind 		/* No options. */
    172  1.1     rmind 		return false;
    173  1.4     rmind 	}
    174  1.4     rmind 	KASSERT(topts_len <= MAX_TCPOPTLEN);
    175  1.1     rmind 
    176  1.4     rmind 	/* First step: IP and TCP header up to options. */
    177  1.7    zoltan 	step = npf_cache_hlen(npc, nbuf) + sizeof(struct tcphdr);
    178  1.4     rmind next:
    179  1.4     rmind 	if (nbuf_advfetch(&nbuf, &n_ptr, step, sizeof(val), &val)) {
    180  1.1     rmind 		return false;
    181  1.4     rmind 	}
    182  1.4     rmind 	switch (val) {
    183  1.4     rmind 	case TCPOPT_EOL:
    184  1.4     rmind 		/* Done. */
    185  1.4     rmind 		return true;
    186  1.4     rmind 	case TCPOPT_NOP:
    187  1.4     rmind 		topts_len--;
    188  1.4     rmind 		step = 1;
    189  1.4     rmind 		break;
    190  1.4     rmind 	case TCPOPT_MAXSEG:
    191  1.4     rmind 		/*
    192  1.4     rmind 		 * XXX: clean this mess.
    193  1.4     rmind 		 */
    194  1.4     rmind 		if (mss && *mss) {
    195  1.4     rmind 			val16 = *mss;
    196  1.4     rmind 			if (nbuf_advstore(&nbuf, &n_ptr, 2,
    197  1.4     rmind 			    sizeof(val16), &val16))
    198  1.4     rmind 				return false;
    199  1.4     rmind 		} else if (nbuf_advfetch(&nbuf, &n_ptr, 2,
    200  1.4     rmind 		    sizeof(val16), &val16)) {
    201  1.4     rmind 			return false;
    202  1.4     rmind 		}
    203  1.4     rmind 		if (mss) {
    204  1.4     rmind 			*mss = val16;
    205  1.4     rmind 		}
    206  1.4     rmind 		topts_len -= TCPOLEN_MAXSEG;
    207  1.4     rmind 		step = sizeof(val16);
    208  1.4     rmind 		break;
    209  1.4     rmind 	case TCPOPT_WINDOW:
    210  1.4     rmind 		if (nbuf_advfetch(&nbuf, &n_ptr, 2, sizeof(val), &val)) {
    211  1.4     rmind 			return false;
    212  1.4     rmind 		}
    213  1.4     rmind 		*wscale = (val > TCP_MAX_WINSHIFT) ? TCP_MAX_WINSHIFT : val;
    214  1.4     rmind 		topts_len -= TCPOLEN_WINDOW;
    215  1.4     rmind 		step = sizeof(val);
    216  1.4     rmind 		break;
    217  1.4     rmind 	default:
    218  1.4     rmind 		if (nbuf_advfetch(&nbuf, &n_ptr, 1, sizeof(val), &val)) {
    219  1.4     rmind 			return false;
    220  1.4     rmind 		}
    221  1.4     rmind 		if (val < 2 || val >= topts_len) {
    222  1.4     rmind 			return false;
    223  1.4     rmind 		}
    224  1.4     rmind 		topts_len -= val;
    225  1.4     rmind 		step = val - 1;
    226  1.4     rmind 	}
    227  1.6     rmind 	/* Any options left? */
    228  1.4     rmind 	if (__predict_true(topts_len > 0)) {
    229  1.4     rmind 		goto next;
    230  1.4     rmind 	}
    231  1.6     rmind 	return true;
    232  1.1     rmind }
    233  1.1     rmind 
    234  1.1     rmind /*
    235  1.4     rmind  * npf_fetch_ip: fetch, check and cache IP header.
    236  1.1     rmind  */
    237  1.1     rmind bool
    238  1.4     rmind npf_fetch_ip(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr)
    239  1.1     rmind {
    240  1.4     rmind 	struct ip *ip;
    241  1.7    zoltan 	struct ip6_hdr *ip6;
    242  1.4     rmind 	uint8_t ver;
    243  1.1     rmind 
    244  1.4     rmind 	if (nbuf_fetch_datum(nbuf, n_ptr, sizeof(uint8_t), &ver)) {
    245  1.1     rmind 		return false;
    246  1.4     rmind 	}
    247  1.4     rmind 	switch (ver >> 4) {
    248  1.4     rmind 	case IPVERSION:
    249  1.4     rmind 		/* IPv4 */
    250  1.4     rmind 		ip = &npc->npc_ip.v4;
    251  1.4     rmind 		/* Fetch the header. */
    252  1.4     rmind 		if (nbuf_fetch_datum(nbuf, n_ptr, sizeof(struct ip), ip)) {
    253  1.4     rmind 			return false;
    254  1.4     rmind 		}
    255  1.4     rmind 		/* Check header length and fragment offset. */
    256  1.4     rmind 		if ((ip->ip_hl << 2) < sizeof(struct ip)) {
    257  1.4     rmind 			return false;
    258  1.4     rmind 		}
    259  1.4     rmind 		if (ip->ip_off & ~htons(IP_DF | IP_RF)) {
    260  1.4     rmind 			/* Note fragmentation. */
    261  1.4     rmind 			npc->npc_info |= NPC_IPFRAG;
    262  1.4     rmind 		}
    263  1.4     rmind 		/* Cache: layer 3 - IPv4. */
    264  1.4     rmind 		npc->npc_ipsz = sizeof(struct in_addr);
    265  1.4     rmind 		npc->npc_srcip = (npf_addr_t *)&ip->ip_src;
    266  1.4     rmind 		npc->npc_dstip = (npf_addr_t *)&ip->ip_dst;
    267  1.4     rmind 		npc->npc_info |= NPC_IP4;
    268  1.7    zoltan 		npc->npc_hlen = ip->ip_hl << 2;
    269  1.7    zoltan 		npc->npc_next_proto = npc->npc_ip.v4.ip_p;
    270  1.4     rmind 		break;
    271  1.4     rmind 
    272  1.4     rmind 	case (IPV6_VERSION >> 4):
    273  1.7    zoltan 		ip6 = &npc->npc_ip.v6;
    274  1.7    zoltan 		if (nbuf_fetch_datum(nbuf, n_ptr, sizeof(struct ip6_hdr), ip6)) {
    275  1.7    zoltan 			return false;
    276  1.7    zoltan 		}
    277  1.7    zoltan 
    278  1.7    zoltan 		size_t toskip = sizeof(struct ip6_hdr);
    279  1.7    zoltan 		bool processing_ends = false;
    280  1.7    zoltan 		npc->npc_next_proto = ip6->ip6_nxt;
    281  1.8     rmind 		npc->npc_hlen = 0;
    282  1.7    zoltan 
    283  1.7    zoltan 		do {
    284  1.8     rmind 			struct ip6_ext ip6e;
    285  1.8     rmind 
    286  1.8     rmind 			/*
    287  1.8     rmind 			 * Advance by the length of the previous known header
    288  1.8     rmind 			 * and fetch the next extension header's length.
    289  1.8     rmind 			 */
    290  1.8     rmind 			if (nbuf_advfetch(&nbuf, &n_ptr, toskip,
    291  1.8     rmind 			    sizeof(struct ip6_ext), &ip6e)) {
    292  1.7    zoltan 				return false;
    293  1.7    zoltan 			}
    294  1.7    zoltan 
    295  1.7    zoltan 			switch (npc->npc_next_proto) {
    296  1.7    zoltan 			case IPPROTO_DSTOPTS:
    297  1.7    zoltan 			case IPPROTO_ROUTING:
    298  1.7    zoltan 				toskip = (ip6e.ip6e_len + 1) << 3;
    299  1.7    zoltan 				break;
    300  1.7    zoltan 			case IPPROTO_FRAGMENT:
    301  1.7    zoltan 				npc->npc_info |= NPC_IPFRAG;
    302  1.7    zoltan 				toskip = sizeof(struct ip6_frag);
    303  1.7    zoltan 				break;
    304  1.7    zoltan 			case IPPROTO_AH:
    305  1.7    zoltan 				toskip = (ip6e.ip6e_len + 2) << 2;
    306  1.7    zoltan 				break;
    307  1.7    zoltan 			default:
    308  1.7    zoltan 				processing_ends = true;
    309  1.7    zoltan 				break;
    310  1.7    zoltan 			}
    311  1.7    zoltan 
    312  1.7    zoltan 			npc->npc_hlen += toskip;
    313  1.8     rmind 
    314  1.7    zoltan 			if (!processing_ends) {
    315  1.7    zoltan 				npc->npc_next_proto = ip6e.ip6e_nxt;
    316  1.7    zoltan 			}
    317  1.7    zoltan 		} while (!processing_ends);
    318  1.7    zoltan 
    319  1.7    zoltan 		npc->npc_ipsz = sizeof(struct in6_addr);
    320  1.7    zoltan 		npc->npc_srcip = (npf_addr_t *)&ip6->ip6_src;
    321  1.7    zoltan 		npc->npc_dstip = (npf_addr_t *)&ip6->ip6_dst;
    322  1.7    zoltan 		npc->npc_info |= NPC_IP6;
    323  1.7    zoltan 		break;
    324  1.4     rmind 	default:
    325  1.1     rmind 		return false;
    326  1.4     rmind 	}
    327  1.4     rmind 	return true;
    328  1.4     rmind }
    329  1.1     rmind 
    330  1.4     rmind bool
    331  1.4     rmind npf_fetch_tcp(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr)
    332  1.4     rmind {
    333  1.4     rmind 	struct tcphdr *th;
    334  1.1     rmind 
    335  1.4     rmind 	/* Must have IP header processed for its length and protocol. */
    336  1.4     rmind 	if (!npf_iscached(npc, NPC_IP46) && !npf_fetch_ip(npc, nbuf, n_ptr)) {
    337  1.1     rmind 		return false;
    338  1.4     rmind 	}
    339  1.7    zoltan 	if (npf_cache_ipproto(npc) != IPPROTO_TCP) {
    340  1.1     rmind 		return false;
    341  1.4     rmind 	}
    342  1.4     rmind 	th = &npc->npc_l4.tcp;
    343  1.4     rmind 
    344  1.4     rmind 	/* Fetch TCP header. */
    345  1.8     rmind 	if (nbuf_advfetch(&nbuf, &n_ptr, npf_cache_hlen(npc, nbuf),
    346  1.8     rmind 	    sizeof(struct tcphdr), th)) {
    347  1.1     rmind 		return false;
    348  1.4     rmind 	}
    349  1.1     rmind 
    350  1.4     rmind 	/* Cache: layer 4 - TCP. */
    351  1.4     rmind 	npc->npc_info |= (NPC_LAYER4 | NPC_TCP);
    352  1.1     rmind 	return true;
    353  1.1     rmind }
    354  1.1     rmind 
    355  1.1     rmind bool
    356  1.4     rmind npf_fetch_udp(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr)
    357  1.1     rmind {
    358  1.4     rmind 	struct ip *ip = &npc->npc_ip.v4;
    359  1.4     rmind 	struct udphdr *uh;
    360  1.7    zoltan 	size_t hlen;
    361  1.1     rmind 
    362  1.4     rmind 	/* Must have IP header processed for its length and protocol. */
    363  1.4     rmind 	if (!npf_iscached(npc, NPC_IP46) && !npf_fetch_ip(npc, nbuf, n_ptr)) {
    364  1.4     rmind 		return false;
    365  1.4     rmind 	}
    366  1.4     rmind 	if (ip->ip_p != IPPROTO_UDP) {
    367  1.1     rmind 		return false;
    368  1.4     rmind 	}
    369  1.4     rmind 	uh = &npc->npc_l4.udp;
    370  1.7    zoltan 	hlen = npf_cache_hlen(npc, nbuf);
    371  1.1     rmind 
    372  1.4     rmind 	/* Fetch ICMP header. */
    373  1.4     rmind 	if (nbuf_advfetch(&nbuf, &n_ptr, hlen, sizeof(struct udphdr), uh)) {
    374  1.1     rmind 		return false;
    375  1.4     rmind 	}
    376  1.1     rmind 
    377  1.9  jakllsch 	/* Cache: layer 4 - UDP. */
    378  1.4     rmind 	npc->npc_info |= (NPC_LAYER4 | NPC_UDP);
    379  1.1     rmind 	return true;
    380  1.1     rmind }
    381  1.1     rmind 
    382  1.2     rmind /*
    383  1.4     rmind  * npf_fetch_icmp: fetch ICMP code, type and possible query ID.
    384  1.4     rmind  *
    385  1.4     rmind  * => Stores both all fetched items into the cache.
    386  1.2     rmind  */
    387  1.2     rmind bool
    388  1.4     rmind npf_fetch_icmp(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr)
    389  1.1     rmind {
    390  1.4     rmind 	struct ip *ip = &npc->npc_ip.v4;
    391  1.4     rmind 	struct icmp *ic;
    392  1.7    zoltan 	u_int iclen;
    393  1.7    zoltan 	size_t hlen;
    394  1.1     rmind 
    395  1.4     rmind 	/* Must have IP header processed for its length and protocol. */
    396  1.4     rmind 	if (!npf_iscached(npc, NPC_IP46) && !npf_fetch_ip(npc, nbuf, n_ptr)) {
    397  1.4     rmind 		return false;
    398  1.4     rmind 	}
    399  1.4     rmind 	if (ip->ip_p != IPPROTO_ICMP) {
    400  1.1     rmind 		return false;
    401  1.3     rmind 	}
    402  1.4     rmind 	ic = &npc->npc_l4.icmp;
    403  1.7    zoltan 	hlen = npf_cache_hlen(npc, nbuf);
    404  1.4     rmind 
    405  1.4     rmind 	/* Fetch basic ICMP header, up to the "data" point. */
    406  1.6     rmind 	iclen = offsetof(struct icmp, icmp_data);
    407  1.6     rmind 	if (nbuf_advfetch(&nbuf, &n_ptr, hlen, iclen, ic)) {
    408  1.4     rmind 		return false;
    409  1.4     rmind 	}
    410  1.4     rmind 
    411  1.4     rmind 	/* Cache: layer 4 - ICMP. */
    412  1.4     rmind 	npc->npc_info |= (NPC_LAYER4 | NPC_ICMP);
    413  1.1     rmind 	return true;
    414  1.1     rmind }
    415  1.1     rmind 
    416  1.1     rmind /*
    417  1.4     rmind  * npf_cache_all: general routine to cache all relevant IP (v4 or v6)
    418  1.4     rmind  * and TCP, UDP or ICMP data.
    419  1.1     rmind  */
    420  1.1     rmind bool
    421  1.2     rmind npf_cache_all(npf_cache_t *npc, nbuf_t *nbuf)
    422  1.1     rmind {
    423  1.1     rmind 	void *n_ptr = nbuf_dataptr(nbuf);
    424  1.1     rmind 
    425  1.4     rmind 	if (!npf_iscached(npc, NPC_IP46) && !npf_fetch_ip(npc, nbuf, n_ptr)) {
    426  1.1     rmind 		return false;
    427  1.1     rmind 	}
    428  1.4     rmind 	if (npf_iscached(npc, NPC_IPFRAG)) {
    429  1.4     rmind 		return true;
    430  1.1     rmind 	}
    431  1.4     rmind 	switch (npf_cache_ipproto(npc)) {
    432  1.1     rmind 	case IPPROTO_TCP:
    433  1.4     rmind 		return npf_fetch_tcp(npc, nbuf, n_ptr);
    434  1.1     rmind 	case IPPROTO_UDP:
    435  1.4     rmind 		return npf_fetch_udp(npc, nbuf, n_ptr);
    436  1.1     rmind 	case IPPROTO_ICMP:
    437  1.1     rmind 		return npf_fetch_icmp(npc, nbuf, n_ptr);
    438  1.1     rmind 	}
    439  1.1     rmind 	return false;
    440  1.1     rmind }
    441  1.1     rmind 
    442  1.1     rmind /*
    443  1.4     rmind  * npf_rwrip: rewrite required IP address, update the cache.
    444  1.4     rmind  */
    445  1.4     rmind bool
    446  1.4     rmind npf_rwrip(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr, const int di,
    447  1.4     rmind     npf_addr_t *addr)
    448  1.4     rmind {
    449  1.4     rmind 	npf_addr_t *oaddr;
    450  1.4     rmind 	u_int offby;
    451  1.4     rmind 
    452  1.4     rmind 	KASSERT(npf_iscached(npc, NPC_IP46));
    453  1.4     rmind 
    454  1.4     rmind 	if (di == PFIL_OUT) {
    455  1.4     rmind 		/* Rewrite source address, if outgoing. */
    456  1.4     rmind 		offby = offsetof(struct ip, ip_src);
    457  1.4     rmind 		oaddr = npc->npc_srcip;
    458  1.4     rmind 	} else {
    459  1.4     rmind 		/* Rewrite destination, if incoming. */
    460  1.4     rmind 		offby = offsetof(struct ip, ip_dst);
    461  1.4     rmind 		oaddr = npc->npc_dstip;
    462  1.4     rmind 	}
    463  1.4     rmind 
    464  1.4     rmind 	/* Advance to the address and rewrite it. */
    465  1.4     rmind 	if (nbuf_advstore(&nbuf, &n_ptr, offby, npc->npc_ipsz, addr))
    466  1.4     rmind 		return false;
    467  1.4     rmind 
    468  1.4     rmind 	/* Cache: IP address. */
    469  1.4     rmind 	memcpy(oaddr, addr, npc->npc_ipsz);
    470  1.4     rmind 	return true;
    471  1.4     rmind }
    472  1.4     rmind 
    473  1.4     rmind /*
    474  1.4     rmind  * npf_rwrport: rewrite required TCP/UDP port, update the cache.
    475  1.1     rmind  */
    476  1.1     rmind bool
    477  1.1     rmind npf_rwrport(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr, const int di,
    478  1.4     rmind     in_port_t port)
    479  1.1     rmind {
    480  1.4     rmind 	const int proto = npf_cache_ipproto(npc);
    481  1.7    zoltan 	u_int offby = npf_cache_hlen(npc, nbuf);
    482  1.4     rmind 	in_port_t *oport;
    483  1.1     rmind 
    484  1.4     rmind 	KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP));
    485  1.1     rmind 	KASSERT(proto == IPPROTO_TCP || proto == IPPROTO_UDP);
    486  1.1     rmind 
    487  1.4     rmind 	/* Offset to the port and pointer in the cache. */
    488  1.4     rmind 	if (proto == IPPROTO_TCP) {
    489  1.4     rmind 		struct tcphdr *th = &npc->npc_l4.tcp;
    490  1.4     rmind 		if (di == PFIL_OUT) {
    491  1.4     rmind 			CTASSERT(offsetof(struct tcphdr, th_sport) == 0);
    492  1.4     rmind 			oport = &th->th_sport;
    493  1.1     rmind 		} else {
    494  1.4     rmind 			offby += offsetof(struct tcphdr, th_dport);
    495  1.4     rmind 			oport = &th->th_dport;
    496  1.1     rmind 		}
    497  1.1     rmind 	} else {
    498  1.4     rmind 		struct udphdr *uh = &npc->npc_l4.udp;
    499  1.4     rmind 		if (di == PFIL_OUT) {
    500  1.4     rmind 			CTASSERT(offsetof(struct udphdr, uh_sport) == 0);
    501  1.4     rmind 			oport = &uh->uh_sport;
    502  1.1     rmind 		} else {
    503  1.4     rmind 			offby += offsetof(struct udphdr, uh_dport);
    504  1.4     rmind 			oport = &uh->uh_dport;
    505  1.1     rmind 		}
    506  1.1     rmind 	}
    507  1.1     rmind 
    508  1.4     rmind 	/* Advance and rewrite the port. */
    509  1.4     rmind 	if (nbuf_advstore(&nbuf, &n_ptr, offby, sizeof(in_port_t), &port))
    510  1.1     rmind 		return false;
    511  1.1     rmind 
    512  1.4     rmind 	/* Cache: TCP/UDP port. */
    513  1.4     rmind 	*oport = port;
    514  1.1     rmind 	return true;
    515  1.1     rmind }
    516  1.1     rmind 
    517  1.1     rmind /*
    518  1.6     rmind  * npf_rwrcksum: rewrite IPv4 and/or TCP/UDP checksum, update the cache.
    519  1.1     rmind  */
    520  1.1     rmind bool
    521  1.4     rmind npf_rwrcksum(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr, const int di,
    522  1.4     rmind     npf_addr_t *addr, in_port_t port)
    523  1.1     rmind {
    524  1.4     rmind 	const int proto = npf_cache_ipproto(npc);
    525  1.4     rmind 	npf_addr_t *oaddr;
    526  1.4     rmind 	in_port_t *oport;
    527  1.4     rmind 	uint16_t *cksum;
    528  1.1     rmind 	u_int offby;
    529  1.1     rmind 
    530  1.4     rmind 	/* Checksum update for IPv4 header. */
    531  1.4     rmind 	if (npf_iscached(npc, NPC_IP4)) {
    532  1.4     rmind 		struct ip *ip = &npc->npc_ip.v4;
    533  1.4     rmind 		uint16_t ipsum;
    534  1.4     rmind 
    535  1.4     rmind 		oaddr = (di == PFIL_OUT) ? npc->npc_srcip : npc->npc_dstip;
    536  1.4     rmind 		ipsum = npf_addr_cksum(ip->ip_sum, npc->npc_ipsz, oaddr, addr);
    537  1.4     rmind 
    538  1.4     rmind 		/* Advance to the IPv4 checksum and rewrite it. */
    539  1.4     rmind 		offby = offsetof(struct ip, ip_sum);
    540  1.4     rmind 		if (nbuf_advstore(&nbuf, &n_ptr, offby, sizeof(ipsum), &ipsum))
    541  1.4     rmind 			return false;
    542  1.4     rmind 
    543  1.4     rmind 		ip->ip_sum = ipsum;
    544  1.7    zoltan 		offby = npf_cache_hlen(npc, nbuf) - offby;
    545  1.4     rmind 	} else {
    546  1.4     rmind 		/* No checksum for IPv6. */
    547  1.4     rmind 		KASSERT(npf_iscached(npc, NPC_IP6));
    548  1.4     rmind 		oaddr = NULL;
    549  1.4     rmind 		offby = 0;
    550  1.6     rmind 		return false;	/* XXX: Not yet supported. */
    551  1.4     rmind 	}
    552  1.4     rmind 
    553  1.4     rmind 	/* Determine whether TCP/UDP checksum update is needed. */
    554  1.6     rmind 	if (proto == IPPROTO_ICMP || port == 0) {
    555  1.4     rmind 		return true;
    556  1.4     rmind 	}
    557  1.7    zoltan 	KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP));
    558  1.4     rmind 
    559  1.4     rmind 	/* Calculate TCP/UDP checksum. */
    560  1.4     rmind 	if (proto == IPPROTO_TCP) {
    561  1.4     rmind 		struct tcphdr *th = &npc->npc_l4.tcp;
    562  1.4     rmind 
    563  1.4     rmind 		cksum = &th->th_sum;
    564  1.4     rmind 		offby += offsetof(struct tcphdr, th_sum);
    565  1.4     rmind 		oport = (di == PFIL_OUT) ? &th->th_sport : &th->th_dport;
    566  1.4     rmind 	} else {
    567  1.4     rmind 		struct udphdr *uh = &npc->npc_l4.udp;
    568  1.4     rmind 
    569  1.4     rmind 		KASSERT(proto == IPPROTO_UDP);
    570  1.4     rmind 		cksum = &uh->uh_sum;
    571  1.4     rmind 		if (*cksum == 0) {
    572  1.4     rmind 			/* No need to update. */
    573  1.4     rmind 			return true;
    574  1.4     rmind 		}
    575  1.4     rmind 		offby += offsetof(struct udphdr, uh_sum);
    576  1.4     rmind 		oport = (di == PFIL_OUT) ? &uh->uh_sport : &uh->uh_dport;
    577  1.4     rmind 	}
    578  1.4     rmind 	*cksum = npf_addr_cksum(*cksum, npc->npc_ipsz, oaddr, addr);
    579  1.4     rmind 	*cksum = npf_fixup16_cksum(*cksum, *oport, port);
    580  1.1     rmind 
    581  1.4     rmind 	/* Advance to TCP/UDP checksum and rewrite it. */
    582  1.4     rmind 	if (nbuf_advstore(&nbuf, &n_ptr, offby, sizeof(uint16_t), cksum)) {
    583  1.1     rmind 		return false;
    584  1.4     rmind 	}
    585  1.4     rmind 	return true;
    586  1.4     rmind }
    587  1.4     rmind 
    588  1.4     rmind static inline bool
    589  1.5     rmind npf_normalize_ip4(npf_cache_t *npc, nbuf_t *nbuf,
    590  1.5     rmind     bool rnd, bool no_df, int minttl)
    591  1.4     rmind {
    592  1.4     rmind 	void *n_ptr = nbuf_dataptr(nbuf);
    593  1.4     rmind 	struct ip *ip = &npc->npc_ip.v4;
    594  1.4     rmind 	uint16_t cksum = ip->ip_sum;
    595  1.5     rmind 	uint16_t ip_off = ip->ip_off;
    596  1.4     rmind 	uint8_t ttl = ip->ip_ttl;
    597  1.4     rmind 	u_int offby = 0;
    598  1.4     rmind 
    599  1.5     rmind 	KASSERT(rnd || minttl || no_df);
    600  1.4     rmind 
    601  1.4     rmind 	/* Randomize IPv4 ID. */
    602  1.4     rmind 	if (rnd) {
    603  1.4     rmind 		uint16_t oid = ip->ip_id, nid;
    604  1.4     rmind 
    605  1.4     rmind 		nid = htons(ip_randomid(ip_ids, 0));
    606  1.4     rmind 		offby = offsetof(struct ip, ip_id);
    607  1.4     rmind 		if (nbuf_advstore(&nbuf, &n_ptr, offby, sizeof(nid), &nid)) {
    608  1.4     rmind 			return false;
    609  1.4     rmind 		}
    610  1.4     rmind 		cksum = npf_fixup16_cksum(cksum, oid, nid);
    611  1.4     rmind 		ip->ip_id = nid;
    612  1.4     rmind 	}
    613  1.1     rmind 
    614  1.5     rmind 	/* IP_DF flag cleansing. */
    615  1.5     rmind 	if (no_df && (ip_off & htons(IP_DF)) != 0) {
    616  1.5     rmind 		uint16_t nip_off = ip_off & ~htons(IP_DF);
    617  1.5     rmind 
    618  1.5     rmind 		if (nbuf_advstore(&nbuf, &n_ptr,
    619  1.5     rmind 		    offsetof(struct ip, ip_off) - offby,
    620  1.6     rmind 		    sizeof(uint16_t), &nip_off)) {
    621  1.5     rmind 			return false;
    622  1.5     rmind 		}
    623  1.5     rmind 		cksum = npf_fixup16_cksum(cksum, ip_off, nip_off);
    624  1.5     rmind 		ip->ip_off = nip_off;
    625  1.5     rmind 		offby = offsetof(struct ip, ip_off);
    626  1.5     rmind 	}
    627  1.5     rmind 
    628  1.4     rmind 	/* Enforce minimum TTL. */
    629  1.4     rmind 	if (minttl && ttl < minttl) {
    630  1.4     rmind 		if (nbuf_advstore(&nbuf, &n_ptr,
    631  1.4     rmind 		    offsetof(struct ip, ip_ttl) - offby,
    632  1.4     rmind 		    sizeof(uint8_t), &minttl)) {
    633  1.4     rmind 			return false;
    634  1.4     rmind 		}
    635  1.4     rmind 		cksum = npf_fixup16_cksum(cksum, ttl, minttl);
    636  1.4     rmind 		ip->ip_ttl = minttl;
    637  1.4     rmind 		offby = offsetof(struct ip, ip_ttl);
    638  1.1     rmind 	}
    639  1.1     rmind 
    640  1.4     rmind 	/* Update IP checksum. */
    641  1.4     rmind 	offby = offsetof(struct ip, ip_sum) - offby;
    642  1.4     rmind 	if (nbuf_advstore(&nbuf, &n_ptr, offby, sizeof(cksum), &cksum)) {
    643  1.1     rmind 		return false;
    644  1.4     rmind 	}
    645  1.4     rmind 	ip->ip_sum = cksum;
    646  1.4     rmind 	return true;
    647  1.4     rmind }
    648  1.4     rmind 
    649  1.4     rmind bool
    650  1.4     rmind npf_normalize(npf_cache_t *npc, nbuf_t *nbuf,
    651  1.5     rmind     bool no_df, bool rnd, u_int minttl, u_int maxmss)
    652  1.4     rmind {
    653  1.4     rmind 	void *n_ptr = nbuf_dataptr(nbuf);
    654  1.4     rmind 	struct tcphdr *th = &npc->npc_l4.tcp;
    655  1.4     rmind 	uint16_t cksum, mss;
    656  1.4     rmind 	int offby, wscale;
    657  1.4     rmind 
    658  1.4     rmind 	/* Normalize IPv4. */
    659  1.4     rmind 	if (npf_iscached(npc, NPC_IP4) && (rnd || minttl)) {
    660  1.5     rmind 		if (!npf_normalize_ip4(npc, nbuf, rnd, no_df, minttl)) {
    661  1.4     rmind 			return false;
    662  1.4     rmind 		}
    663  1.6     rmind 	} else if (!npf_iscached(npc, NPC_IP4)) {
    664  1.6     rmind 		/* XXX: no IPv6 */
    665  1.6     rmind 		return false;
    666  1.4     rmind 	}
    667  1.1     rmind 
    668  1.4     rmind 	/*
    669  1.4     rmind 	 * TCP Maximum Segment Size (MSS) "clamping".  Only if SYN packet.
    670  1.6     rmind 	 * Fetch MSS and check whether rewrite to lower is needed.
    671  1.4     rmind 	 */
    672  1.4     rmind 	if (maxmss == 0 || !npf_iscached(npc, NPC_TCP) ||
    673  1.4     rmind 	    (th->th_flags & TH_SYN) == 0) {
    674  1.4     rmind 		/* Not required; done. */
    675  1.4     rmind 		return true;
    676  1.4     rmind 	}
    677  1.4     rmind 	mss = 0;
    678  1.4     rmind 	if (!npf_fetch_tcpopts(npc, nbuf, &mss, &wscale)) {
    679  1.4     rmind 		return false;
    680  1.4     rmind 	}
    681  1.4     rmind 	if (ntohs(mss) <= maxmss) {
    682  1.4     rmind 		return true;
    683  1.4     rmind 	}
    684  1.4     rmind 
    685  1.6     rmind 	/* Calculate TCP checksum, then rewrite MSS and the checksum. */
    686  1.4     rmind 	maxmss = htons(maxmss);
    687  1.4     rmind 	cksum = npf_fixup16_cksum(th->th_sum, mss, maxmss);
    688  1.4     rmind 	th->th_sum = cksum;
    689  1.4     rmind 	mss = maxmss;
    690  1.4     rmind 	if (!npf_fetch_tcpopts(npc, nbuf, &mss, &wscale)) {
    691  1.1     rmind 		return false;
    692  1.4     rmind 	}
    693  1.7    zoltan 	offby = npf_cache_hlen(npc, nbuf) + offsetof(struct tcphdr, th_sum);
    694  1.4     rmind 	if (nbuf_advstore(&nbuf, &n_ptr, offby, sizeof(cksum), &cksum)) {
    695  1.4     rmind 		return false;
    696  1.4     rmind 	}
    697  1.1     rmind 	return true;
    698  1.1     rmind }
    699