npf_inet.c revision 1.9 1 1.9 jakllsch /* $NetBSD: npf_inet.c,v 1.9 2011/11/12 14:51:41 jakllsch Exp $ */
2 1.1 rmind
3 1.1 rmind /*-
4 1.6 rmind * Copyright (c) 2009-2011 The NetBSD Foundation, Inc.
5 1.1 rmind * All rights reserved.
6 1.1 rmind *
7 1.1 rmind * This material is based upon work partially supported by The
8 1.1 rmind * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
9 1.1 rmind *
10 1.1 rmind * Redistribution and use in source and binary forms, with or without
11 1.1 rmind * modification, are permitted provided that the following conditions
12 1.1 rmind * are met:
13 1.1 rmind * 1. Redistributions of source code must retain the above copyright
14 1.1 rmind * notice, this list of conditions and the following disclaimer.
15 1.1 rmind * 2. Redistributions in binary form must reproduce the above copyright
16 1.1 rmind * notice, this list of conditions and the following disclaimer in the
17 1.1 rmind * documentation and/or other materials provided with the distribution.
18 1.1 rmind *
19 1.1 rmind * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 1.1 rmind * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 1.1 rmind * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 1.1 rmind * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 1.1 rmind * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 1.1 rmind * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 1.1 rmind * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 1.1 rmind * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 1.1 rmind * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 1.1 rmind * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 1.1 rmind * POSSIBILITY OF SUCH DAMAGE.
30 1.1 rmind */
31 1.1 rmind
32 1.1 rmind /*
33 1.1 rmind * Various procotol related helper routines.
34 1.1 rmind */
35 1.1 rmind
36 1.1 rmind #include <sys/cdefs.h>
37 1.9 jakllsch __KERNEL_RCSID(0, "$NetBSD: npf_inet.c,v 1.9 2011/11/12 14:51:41 jakllsch Exp $");
38 1.1 rmind
39 1.1 rmind #include <sys/param.h>
40 1.1 rmind #include <sys/kernel.h>
41 1.1 rmind
42 1.4 rmind #include <net/pfil.h>
43 1.4 rmind #include <net/if.h>
44 1.4 rmind #include <net/ethertypes.h>
45 1.4 rmind #include <net/if_ether.h>
46 1.4 rmind
47 1.1 rmind #include <netinet/in_systm.h>
48 1.1 rmind #include <netinet/in.h>
49 1.4 rmind #include <netinet/in_var.h>
50 1.1 rmind #include <netinet/ip.h>
51 1.4 rmind #include <netinet/ip6.h>
52 1.1 rmind #include <netinet/tcp.h>
53 1.1 rmind #include <netinet/udp.h>
54 1.1 rmind #include <netinet/ip_icmp.h>
55 1.1 rmind
56 1.1 rmind #include "npf_impl.h"
57 1.1 rmind
58 1.1 rmind /*
59 1.1 rmind * npf_fixup{16,32}_cksum: update IPv4 checksum.
60 1.1 rmind */
61 1.1 rmind
62 1.1 rmind uint16_t
63 1.1 rmind npf_fixup16_cksum(uint16_t cksum, uint16_t odatum, uint16_t ndatum)
64 1.1 rmind {
65 1.1 rmind uint32_t sum;
66 1.1 rmind
67 1.1 rmind /*
68 1.1 rmind * RFC 1624:
69 1.1 rmind * HC' = ~(~HC + ~m + m')
70 1.1 rmind */
71 1.1 rmind sum = ~ntohs(cksum) & 0xffff;
72 1.1 rmind sum += (~ntohs(odatum) & 0xffff) + ntohs(ndatum);
73 1.1 rmind sum = (sum >> 16) + (sum & 0xffff);
74 1.1 rmind sum += (sum >> 16);
75 1.1 rmind
76 1.1 rmind return htons(~sum & 0xffff);
77 1.1 rmind }
78 1.1 rmind
79 1.1 rmind uint16_t
80 1.1 rmind npf_fixup32_cksum(uint16_t cksum, uint32_t odatum, uint32_t ndatum)
81 1.1 rmind {
82 1.1 rmind
83 1.1 rmind cksum = npf_fixup16_cksum(cksum, odatum & 0xffff, ndatum & 0xffff);
84 1.1 rmind cksum = npf_fixup16_cksum(cksum, odatum >> 16, ndatum >> 16);
85 1.1 rmind return cksum;
86 1.1 rmind }
87 1.1 rmind
88 1.1 rmind /*
89 1.4 rmind * npf_addr_cksum: calculate checksum of the address, either IPv4 or IPv6.
90 1.4 rmind */
91 1.4 rmind uint16_t
92 1.4 rmind npf_addr_cksum(uint16_t cksum, int sz, npf_addr_t *oaddr, npf_addr_t *naddr)
93 1.4 rmind {
94 1.4 rmind uint32_t *oip32 = (uint32_t *)oaddr, *nip32 = (uint32_t *)naddr;
95 1.4 rmind
96 1.4 rmind KASSERT(sz % sizeof(uint32_t) == 0);
97 1.4 rmind do {
98 1.4 rmind cksum = npf_fixup32_cksum(cksum, *oip32++, *nip32++);
99 1.4 rmind sz -= sizeof(uint32_t);
100 1.4 rmind } while (sz);
101 1.4 rmind
102 1.4 rmind return cksum;
103 1.4 rmind }
104 1.4 rmind
105 1.4 rmind /*
106 1.4 rmind * npf_addr_sum: provide IP address as a summed (if needed) 32-bit integer.
107 1.4 rmind * Note: used for hash function.
108 1.1 rmind */
109 1.4 rmind uint32_t
110 1.4 rmind npf_addr_sum(const int sz, const npf_addr_t *a1, const npf_addr_t *a2)
111 1.1 rmind {
112 1.4 rmind uint32_t mix = 0;
113 1.4 rmind int i;
114 1.1 rmind
115 1.5 rmind KASSERT(sz > 0 && a1 != NULL && a2 != NULL);
116 1.5 rmind
117 1.4 rmind for (i = 0; i < (sz >> 2); i++) {
118 1.4 rmind mix += a1->s6_addr32[i];
119 1.4 rmind mix += a2->s6_addr32[i];
120 1.4 rmind }
121 1.4 rmind return mix;
122 1.4 rmind }
123 1.1 rmind
124 1.4 rmind /*
125 1.4 rmind * npf_tcpsaw: helper to fetch SEQ, ACK, WIN and return TCP data length.
126 1.4 rmind * Returns all values in host byte-order.
127 1.4 rmind */
128 1.4 rmind int
129 1.8 rmind npf_tcpsaw(npf_cache_t *npc, nbuf_t *nbuf, tcp_seq *seq, tcp_seq *ack,
130 1.8 rmind uint32_t *win)
131 1.4 rmind {
132 1.4 rmind struct tcphdr *th = &npc->npc_l4.tcp;
133 1.8 rmind u_int thlen;
134 1.1 rmind
135 1.7 zoltan KASSERT(npf_iscached(npc, NPC_TCP));
136 1.1 rmind
137 1.4 rmind *seq = ntohl(th->th_seq);
138 1.4 rmind *ack = ntohl(th->th_ack);
139 1.4 rmind *win = (uint32_t)ntohs(th->th_win);
140 1.8 rmind thlen = th->th_off << 2;
141 1.1 rmind
142 1.7 zoltan if (npf_iscached(npc, NPC_IP4)) {
143 1.7 zoltan struct ip *ip = &npc->npc_ip.v4;
144 1.8 rmind return ntohs(ip->ip_len) - npf_cache_hlen(npc, nbuf) - thlen;
145 1.7 zoltan } else {
146 1.7 zoltan KASSERT(npf_iscached(npc, NPC_IP6));
147 1.7 zoltan struct ip6_hdr *ip6 = &npc->npc_ip.v6;
148 1.8 rmind return ntohs(ip6->ip6_plen) - thlen;
149 1.7 zoltan }
150 1.7 zoltan return 0;
151 1.1 rmind }
152 1.1 rmind
153 1.1 rmind /*
154 1.4 rmind * npf_fetch_tcpopts: parse and return TCP options.
155 1.1 rmind */
156 1.1 rmind bool
157 1.4 rmind npf_fetch_tcpopts(const npf_cache_t *npc, nbuf_t *nbuf,
158 1.4 rmind uint16_t *mss, int *wscale)
159 1.1 rmind {
160 1.4 rmind void *n_ptr = nbuf_dataptr(nbuf);
161 1.4 rmind const struct tcphdr *th = &npc->npc_l4.tcp;
162 1.4 rmind int topts_len, step;
163 1.4 rmind uint16_t val16;
164 1.4 rmind uint8_t val;
165 1.4 rmind
166 1.7 zoltan KASSERT(npf_iscached(npc, NPC_IP46));
167 1.7 zoltan KASSERT(npf_iscached(npc, NPC_TCP));
168 1.4 rmind /* Determine if there are any TCP options, get their length. */
169 1.4 rmind topts_len = (th->th_off << 2) - sizeof(struct tcphdr);
170 1.4 rmind if (topts_len <= 0) {
171 1.4 rmind /* No options. */
172 1.1 rmind return false;
173 1.4 rmind }
174 1.4 rmind KASSERT(topts_len <= MAX_TCPOPTLEN);
175 1.1 rmind
176 1.4 rmind /* First step: IP and TCP header up to options. */
177 1.7 zoltan step = npf_cache_hlen(npc, nbuf) + sizeof(struct tcphdr);
178 1.4 rmind next:
179 1.4 rmind if (nbuf_advfetch(&nbuf, &n_ptr, step, sizeof(val), &val)) {
180 1.1 rmind return false;
181 1.4 rmind }
182 1.4 rmind switch (val) {
183 1.4 rmind case TCPOPT_EOL:
184 1.4 rmind /* Done. */
185 1.4 rmind return true;
186 1.4 rmind case TCPOPT_NOP:
187 1.4 rmind topts_len--;
188 1.4 rmind step = 1;
189 1.4 rmind break;
190 1.4 rmind case TCPOPT_MAXSEG:
191 1.4 rmind /*
192 1.4 rmind * XXX: clean this mess.
193 1.4 rmind */
194 1.4 rmind if (mss && *mss) {
195 1.4 rmind val16 = *mss;
196 1.4 rmind if (nbuf_advstore(&nbuf, &n_ptr, 2,
197 1.4 rmind sizeof(val16), &val16))
198 1.4 rmind return false;
199 1.4 rmind } else if (nbuf_advfetch(&nbuf, &n_ptr, 2,
200 1.4 rmind sizeof(val16), &val16)) {
201 1.4 rmind return false;
202 1.4 rmind }
203 1.4 rmind if (mss) {
204 1.4 rmind *mss = val16;
205 1.4 rmind }
206 1.4 rmind topts_len -= TCPOLEN_MAXSEG;
207 1.4 rmind step = sizeof(val16);
208 1.4 rmind break;
209 1.4 rmind case TCPOPT_WINDOW:
210 1.4 rmind if (nbuf_advfetch(&nbuf, &n_ptr, 2, sizeof(val), &val)) {
211 1.4 rmind return false;
212 1.4 rmind }
213 1.4 rmind *wscale = (val > TCP_MAX_WINSHIFT) ? TCP_MAX_WINSHIFT : val;
214 1.4 rmind topts_len -= TCPOLEN_WINDOW;
215 1.4 rmind step = sizeof(val);
216 1.4 rmind break;
217 1.4 rmind default:
218 1.4 rmind if (nbuf_advfetch(&nbuf, &n_ptr, 1, sizeof(val), &val)) {
219 1.4 rmind return false;
220 1.4 rmind }
221 1.4 rmind if (val < 2 || val >= topts_len) {
222 1.4 rmind return false;
223 1.4 rmind }
224 1.4 rmind topts_len -= val;
225 1.4 rmind step = val - 1;
226 1.4 rmind }
227 1.6 rmind /* Any options left? */
228 1.4 rmind if (__predict_true(topts_len > 0)) {
229 1.4 rmind goto next;
230 1.4 rmind }
231 1.6 rmind return true;
232 1.1 rmind }
233 1.1 rmind
234 1.1 rmind /*
235 1.4 rmind * npf_fetch_ip: fetch, check and cache IP header.
236 1.1 rmind */
237 1.1 rmind bool
238 1.4 rmind npf_fetch_ip(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr)
239 1.1 rmind {
240 1.4 rmind struct ip *ip;
241 1.7 zoltan struct ip6_hdr *ip6;
242 1.4 rmind uint8_t ver;
243 1.1 rmind
244 1.4 rmind if (nbuf_fetch_datum(nbuf, n_ptr, sizeof(uint8_t), &ver)) {
245 1.1 rmind return false;
246 1.4 rmind }
247 1.4 rmind switch (ver >> 4) {
248 1.4 rmind case IPVERSION:
249 1.4 rmind /* IPv4 */
250 1.4 rmind ip = &npc->npc_ip.v4;
251 1.4 rmind /* Fetch the header. */
252 1.4 rmind if (nbuf_fetch_datum(nbuf, n_ptr, sizeof(struct ip), ip)) {
253 1.4 rmind return false;
254 1.4 rmind }
255 1.4 rmind /* Check header length and fragment offset. */
256 1.4 rmind if ((ip->ip_hl << 2) < sizeof(struct ip)) {
257 1.4 rmind return false;
258 1.4 rmind }
259 1.4 rmind if (ip->ip_off & ~htons(IP_DF | IP_RF)) {
260 1.4 rmind /* Note fragmentation. */
261 1.4 rmind npc->npc_info |= NPC_IPFRAG;
262 1.4 rmind }
263 1.4 rmind /* Cache: layer 3 - IPv4. */
264 1.4 rmind npc->npc_ipsz = sizeof(struct in_addr);
265 1.4 rmind npc->npc_srcip = (npf_addr_t *)&ip->ip_src;
266 1.4 rmind npc->npc_dstip = (npf_addr_t *)&ip->ip_dst;
267 1.4 rmind npc->npc_info |= NPC_IP4;
268 1.7 zoltan npc->npc_hlen = ip->ip_hl << 2;
269 1.7 zoltan npc->npc_next_proto = npc->npc_ip.v4.ip_p;
270 1.4 rmind break;
271 1.4 rmind
272 1.4 rmind case (IPV6_VERSION >> 4):
273 1.7 zoltan ip6 = &npc->npc_ip.v6;
274 1.7 zoltan if (nbuf_fetch_datum(nbuf, n_ptr, sizeof(struct ip6_hdr), ip6)) {
275 1.7 zoltan return false;
276 1.7 zoltan }
277 1.7 zoltan
278 1.7 zoltan size_t toskip = sizeof(struct ip6_hdr);
279 1.7 zoltan bool processing_ends = false;
280 1.7 zoltan npc->npc_next_proto = ip6->ip6_nxt;
281 1.8 rmind npc->npc_hlen = 0;
282 1.7 zoltan
283 1.7 zoltan do {
284 1.8 rmind struct ip6_ext ip6e;
285 1.8 rmind
286 1.8 rmind /*
287 1.8 rmind * Advance by the length of the previous known header
288 1.8 rmind * and fetch the next extension header's length.
289 1.8 rmind */
290 1.8 rmind if (nbuf_advfetch(&nbuf, &n_ptr, toskip,
291 1.8 rmind sizeof(struct ip6_ext), &ip6e)) {
292 1.7 zoltan return false;
293 1.7 zoltan }
294 1.7 zoltan
295 1.7 zoltan switch (npc->npc_next_proto) {
296 1.7 zoltan case IPPROTO_DSTOPTS:
297 1.7 zoltan case IPPROTO_ROUTING:
298 1.7 zoltan toskip = (ip6e.ip6e_len + 1) << 3;
299 1.7 zoltan break;
300 1.7 zoltan case IPPROTO_FRAGMENT:
301 1.7 zoltan npc->npc_info |= NPC_IPFRAG;
302 1.7 zoltan toskip = sizeof(struct ip6_frag);
303 1.7 zoltan break;
304 1.7 zoltan case IPPROTO_AH:
305 1.7 zoltan toskip = (ip6e.ip6e_len + 2) << 2;
306 1.7 zoltan break;
307 1.7 zoltan default:
308 1.7 zoltan processing_ends = true;
309 1.7 zoltan break;
310 1.7 zoltan }
311 1.7 zoltan
312 1.7 zoltan npc->npc_hlen += toskip;
313 1.8 rmind
314 1.7 zoltan if (!processing_ends) {
315 1.7 zoltan npc->npc_next_proto = ip6e.ip6e_nxt;
316 1.7 zoltan }
317 1.7 zoltan } while (!processing_ends);
318 1.7 zoltan
319 1.7 zoltan npc->npc_ipsz = sizeof(struct in6_addr);
320 1.7 zoltan npc->npc_srcip = (npf_addr_t *)&ip6->ip6_src;
321 1.7 zoltan npc->npc_dstip = (npf_addr_t *)&ip6->ip6_dst;
322 1.7 zoltan npc->npc_info |= NPC_IP6;
323 1.7 zoltan break;
324 1.4 rmind default:
325 1.1 rmind return false;
326 1.4 rmind }
327 1.4 rmind return true;
328 1.4 rmind }
329 1.1 rmind
330 1.4 rmind bool
331 1.4 rmind npf_fetch_tcp(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr)
332 1.4 rmind {
333 1.4 rmind struct tcphdr *th;
334 1.1 rmind
335 1.4 rmind /* Must have IP header processed for its length and protocol. */
336 1.4 rmind if (!npf_iscached(npc, NPC_IP46) && !npf_fetch_ip(npc, nbuf, n_ptr)) {
337 1.1 rmind return false;
338 1.4 rmind }
339 1.7 zoltan if (npf_cache_ipproto(npc) != IPPROTO_TCP) {
340 1.1 rmind return false;
341 1.4 rmind }
342 1.4 rmind th = &npc->npc_l4.tcp;
343 1.4 rmind
344 1.4 rmind /* Fetch TCP header. */
345 1.8 rmind if (nbuf_advfetch(&nbuf, &n_ptr, npf_cache_hlen(npc, nbuf),
346 1.8 rmind sizeof(struct tcphdr), th)) {
347 1.1 rmind return false;
348 1.4 rmind }
349 1.1 rmind
350 1.4 rmind /* Cache: layer 4 - TCP. */
351 1.4 rmind npc->npc_info |= (NPC_LAYER4 | NPC_TCP);
352 1.1 rmind return true;
353 1.1 rmind }
354 1.1 rmind
355 1.1 rmind bool
356 1.4 rmind npf_fetch_udp(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr)
357 1.1 rmind {
358 1.4 rmind struct ip *ip = &npc->npc_ip.v4;
359 1.4 rmind struct udphdr *uh;
360 1.7 zoltan size_t hlen;
361 1.1 rmind
362 1.4 rmind /* Must have IP header processed for its length and protocol. */
363 1.4 rmind if (!npf_iscached(npc, NPC_IP46) && !npf_fetch_ip(npc, nbuf, n_ptr)) {
364 1.4 rmind return false;
365 1.4 rmind }
366 1.4 rmind if (ip->ip_p != IPPROTO_UDP) {
367 1.1 rmind return false;
368 1.4 rmind }
369 1.4 rmind uh = &npc->npc_l4.udp;
370 1.7 zoltan hlen = npf_cache_hlen(npc, nbuf);
371 1.1 rmind
372 1.4 rmind /* Fetch ICMP header. */
373 1.4 rmind if (nbuf_advfetch(&nbuf, &n_ptr, hlen, sizeof(struct udphdr), uh)) {
374 1.1 rmind return false;
375 1.4 rmind }
376 1.1 rmind
377 1.9 jakllsch /* Cache: layer 4 - UDP. */
378 1.4 rmind npc->npc_info |= (NPC_LAYER4 | NPC_UDP);
379 1.1 rmind return true;
380 1.1 rmind }
381 1.1 rmind
382 1.2 rmind /*
383 1.4 rmind * npf_fetch_icmp: fetch ICMP code, type and possible query ID.
384 1.4 rmind *
385 1.4 rmind * => Stores both all fetched items into the cache.
386 1.2 rmind */
387 1.2 rmind bool
388 1.4 rmind npf_fetch_icmp(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr)
389 1.1 rmind {
390 1.4 rmind struct ip *ip = &npc->npc_ip.v4;
391 1.4 rmind struct icmp *ic;
392 1.7 zoltan u_int iclen;
393 1.7 zoltan size_t hlen;
394 1.1 rmind
395 1.4 rmind /* Must have IP header processed for its length and protocol. */
396 1.4 rmind if (!npf_iscached(npc, NPC_IP46) && !npf_fetch_ip(npc, nbuf, n_ptr)) {
397 1.4 rmind return false;
398 1.4 rmind }
399 1.4 rmind if (ip->ip_p != IPPROTO_ICMP) {
400 1.1 rmind return false;
401 1.3 rmind }
402 1.4 rmind ic = &npc->npc_l4.icmp;
403 1.7 zoltan hlen = npf_cache_hlen(npc, nbuf);
404 1.4 rmind
405 1.4 rmind /* Fetch basic ICMP header, up to the "data" point. */
406 1.6 rmind iclen = offsetof(struct icmp, icmp_data);
407 1.6 rmind if (nbuf_advfetch(&nbuf, &n_ptr, hlen, iclen, ic)) {
408 1.4 rmind return false;
409 1.4 rmind }
410 1.4 rmind
411 1.4 rmind /* Cache: layer 4 - ICMP. */
412 1.4 rmind npc->npc_info |= (NPC_LAYER4 | NPC_ICMP);
413 1.1 rmind return true;
414 1.1 rmind }
415 1.1 rmind
416 1.1 rmind /*
417 1.4 rmind * npf_cache_all: general routine to cache all relevant IP (v4 or v6)
418 1.4 rmind * and TCP, UDP or ICMP data.
419 1.1 rmind */
420 1.1 rmind bool
421 1.2 rmind npf_cache_all(npf_cache_t *npc, nbuf_t *nbuf)
422 1.1 rmind {
423 1.1 rmind void *n_ptr = nbuf_dataptr(nbuf);
424 1.1 rmind
425 1.4 rmind if (!npf_iscached(npc, NPC_IP46) && !npf_fetch_ip(npc, nbuf, n_ptr)) {
426 1.1 rmind return false;
427 1.1 rmind }
428 1.4 rmind if (npf_iscached(npc, NPC_IPFRAG)) {
429 1.4 rmind return true;
430 1.1 rmind }
431 1.4 rmind switch (npf_cache_ipproto(npc)) {
432 1.1 rmind case IPPROTO_TCP:
433 1.4 rmind return npf_fetch_tcp(npc, nbuf, n_ptr);
434 1.1 rmind case IPPROTO_UDP:
435 1.4 rmind return npf_fetch_udp(npc, nbuf, n_ptr);
436 1.1 rmind case IPPROTO_ICMP:
437 1.1 rmind return npf_fetch_icmp(npc, nbuf, n_ptr);
438 1.1 rmind }
439 1.1 rmind return false;
440 1.1 rmind }
441 1.1 rmind
442 1.1 rmind /*
443 1.4 rmind * npf_rwrip: rewrite required IP address, update the cache.
444 1.4 rmind */
445 1.4 rmind bool
446 1.4 rmind npf_rwrip(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr, const int di,
447 1.4 rmind npf_addr_t *addr)
448 1.4 rmind {
449 1.4 rmind npf_addr_t *oaddr;
450 1.4 rmind u_int offby;
451 1.4 rmind
452 1.4 rmind KASSERT(npf_iscached(npc, NPC_IP46));
453 1.4 rmind
454 1.4 rmind if (di == PFIL_OUT) {
455 1.4 rmind /* Rewrite source address, if outgoing. */
456 1.4 rmind offby = offsetof(struct ip, ip_src);
457 1.4 rmind oaddr = npc->npc_srcip;
458 1.4 rmind } else {
459 1.4 rmind /* Rewrite destination, if incoming. */
460 1.4 rmind offby = offsetof(struct ip, ip_dst);
461 1.4 rmind oaddr = npc->npc_dstip;
462 1.4 rmind }
463 1.4 rmind
464 1.4 rmind /* Advance to the address and rewrite it. */
465 1.4 rmind if (nbuf_advstore(&nbuf, &n_ptr, offby, npc->npc_ipsz, addr))
466 1.4 rmind return false;
467 1.4 rmind
468 1.4 rmind /* Cache: IP address. */
469 1.4 rmind memcpy(oaddr, addr, npc->npc_ipsz);
470 1.4 rmind return true;
471 1.4 rmind }
472 1.4 rmind
473 1.4 rmind /*
474 1.4 rmind * npf_rwrport: rewrite required TCP/UDP port, update the cache.
475 1.1 rmind */
476 1.1 rmind bool
477 1.1 rmind npf_rwrport(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr, const int di,
478 1.4 rmind in_port_t port)
479 1.1 rmind {
480 1.4 rmind const int proto = npf_cache_ipproto(npc);
481 1.7 zoltan u_int offby = npf_cache_hlen(npc, nbuf);
482 1.4 rmind in_port_t *oport;
483 1.1 rmind
484 1.4 rmind KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP));
485 1.1 rmind KASSERT(proto == IPPROTO_TCP || proto == IPPROTO_UDP);
486 1.1 rmind
487 1.4 rmind /* Offset to the port and pointer in the cache. */
488 1.4 rmind if (proto == IPPROTO_TCP) {
489 1.4 rmind struct tcphdr *th = &npc->npc_l4.tcp;
490 1.4 rmind if (di == PFIL_OUT) {
491 1.4 rmind CTASSERT(offsetof(struct tcphdr, th_sport) == 0);
492 1.4 rmind oport = &th->th_sport;
493 1.1 rmind } else {
494 1.4 rmind offby += offsetof(struct tcphdr, th_dport);
495 1.4 rmind oport = &th->th_dport;
496 1.1 rmind }
497 1.1 rmind } else {
498 1.4 rmind struct udphdr *uh = &npc->npc_l4.udp;
499 1.4 rmind if (di == PFIL_OUT) {
500 1.4 rmind CTASSERT(offsetof(struct udphdr, uh_sport) == 0);
501 1.4 rmind oport = &uh->uh_sport;
502 1.1 rmind } else {
503 1.4 rmind offby += offsetof(struct udphdr, uh_dport);
504 1.4 rmind oport = &uh->uh_dport;
505 1.1 rmind }
506 1.1 rmind }
507 1.1 rmind
508 1.4 rmind /* Advance and rewrite the port. */
509 1.4 rmind if (nbuf_advstore(&nbuf, &n_ptr, offby, sizeof(in_port_t), &port))
510 1.1 rmind return false;
511 1.1 rmind
512 1.4 rmind /* Cache: TCP/UDP port. */
513 1.4 rmind *oport = port;
514 1.1 rmind return true;
515 1.1 rmind }
516 1.1 rmind
517 1.1 rmind /*
518 1.6 rmind * npf_rwrcksum: rewrite IPv4 and/or TCP/UDP checksum, update the cache.
519 1.1 rmind */
520 1.1 rmind bool
521 1.4 rmind npf_rwrcksum(npf_cache_t *npc, nbuf_t *nbuf, void *n_ptr, const int di,
522 1.4 rmind npf_addr_t *addr, in_port_t port)
523 1.1 rmind {
524 1.4 rmind const int proto = npf_cache_ipproto(npc);
525 1.4 rmind npf_addr_t *oaddr;
526 1.4 rmind in_port_t *oport;
527 1.4 rmind uint16_t *cksum;
528 1.1 rmind u_int offby;
529 1.1 rmind
530 1.4 rmind /* Checksum update for IPv4 header. */
531 1.4 rmind if (npf_iscached(npc, NPC_IP4)) {
532 1.4 rmind struct ip *ip = &npc->npc_ip.v4;
533 1.4 rmind uint16_t ipsum;
534 1.4 rmind
535 1.4 rmind oaddr = (di == PFIL_OUT) ? npc->npc_srcip : npc->npc_dstip;
536 1.4 rmind ipsum = npf_addr_cksum(ip->ip_sum, npc->npc_ipsz, oaddr, addr);
537 1.4 rmind
538 1.4 rmind /* Advance to the IPv4 checksum and rewrite it. */
539 1.4 rmind offby = offsetof(struct ip, ip_sum);
540 1.4 rmind if (nbuf_advstore(&nbuf, &n_ptr, offby, sizeof(ipsum), &ipsum))
541 1.4 rmind return false;
542 1.4 rmind
543 1.4 rmind ip->ip_sum = ipsum;
544 1.7 zoltan offby = npf_cache_hlen(npc, nbuf) - offby;
545 1.4 rmind } else {
546 1.4 rmind /* No checksum for IPv6. */
547 1.4 rmind KASSERT(npf_iscached(npc, NPC_IP6));
548 1.4 rmind oaddr = NULL;
549 1.4 rmind offby = 0;
550 1.6 rmind return false; /* XXX: Not yet supported. */
551 1.4 rmind }
552 1.4 rmind
553 1.4 rmind /* Determine whether TCP/UDP checksum update is needed. */
554 1.6 rmind if (proto == IPPROTO_ICMP || port == 0) {
555 1.4 rmind return true;
556 1.4 rmind }
557 1.7 zoltan KASSERT(npf_iscached(npc, NPC_TCP) || npf_iscached(npc, NPC_UDP));
558 1.4 rmind
559 1.4 rmind /* Calculate TCP/UDP checksum. */
560 1.4 rmind if (proto == IPPROTO_TCP) {
561 1.4 rmind struct tcphdr *th = &npc->npc_l4.tcp;
562 1.4 rmind
563 1.4 rmind cksum = &th->th_sum;
564 1.4 rmind offby += offsetof(struct tcphdr, th_sum);
565 1.4 rmind oport = (di == PFIL_OUT) ? &th->th_sport : &th->th_dport;
566 1.4 rmind } else {
567 1.4 rmind struct udphdr *uh = &npc->npc_l4.udp;
568 1.4 rmind
569 1.4 rmind KASSERT(proto == IPPROTO_UDP);
570 1.4 rmind cksum = &uh->uh_sum;
571 1.4 rmind if (*cksum == 0) {
572 1.4 rmind /* No need to update. */
573 1.4 rmind return true;
574 1.4 rmind }
575 1.4 rmind offby += offsetof(struct udphdr, uh_sum);
576 1.4 rmind oport = (di == PFIL_OUT) ? &uh->uh_sport : &uh->uh_dport;
577 1.4 rmind }
578 1.4 rmind *cksum = npf_addr_cksum(*cksum, npc->npc_ipsz, oaddr, addr);
579 1.4 rmind *cksum = npf_fixup16_cksum(*cksum, *oport, port);
580 1.1 rmind
581 1.4 rmind /* Advance to TCP/UDP checksum and rewrite it. */
582 1.4 rmind if (nbuf_advstore(&nbuf, &n_ptr, offby, sizeof(uint16_t), cksum)) {
583 1.1 rmind return false;
584 1.4 rmind }
585 1.4 rmind return true;
586 1.4 rmind }
587 1.4 rmind
588 1.4 rmind static inline bool
589 1.5 rmind npf_normalize_ip4(npf_cache_t *npc, nbuf_t *nbuf,
590 1.5 rmind bool rnd, bool no_df, int minttl)
591 1.4 rmind {
592 1.4 rmind void *n_ptr = nbuf_dataptr(nbuf);
593 1.4 rmind struct ip *ip = &npc->npc_ip.v4;
594 1.4 rmind uint16_t cksum = ip->ip_sum;
595 1.5 rmind uint16_t ip_off = ip->ip_off;
596 1.4 rmind uint8_t ttl = ip->ip_ttl;
597 1.4 rmind u_int offby = 0;
598 1.4 rmind
599 1.5 rmind KASSERT(rnd || minttl || no_df);
600 1.4 rmind
601 1.4 rmind /* Randomize IPv4 ID. */
602 1.4 rmind if (rnd) {
603 1.4 rmind uint16_t oid = ip->ip_id, nid;
604 1.4 rmind
605 1.4 rmind nid = htons(ip_randomid(ip_ids, 0));
606 1.4 rmind offby = offsetof(struct ip, ip_id);
607 1.4 rmind if (nbuf_advstore(&nbuf, &n_ptr, offby, sizeof(nid), &nid)) {
608 1.4 rmind return false;
609 1.4 rmind }
610 1.4 rmind cksum = npf_fixup16_cksum(cksum, oid, nid);
611 1.4 rmind ip->ip_id = nid;
612 1.4 rmind }
613 1.1 rmind
614 1.5 rmind /* IP_DF flag cleansing. */
615 1.5 rmind if (no_df && (ip_off & htons(IP_DF)) != 0) {
616 1.5 rmind uint16_t nip_off = ip_off & ~htons(IP_DF);
617 1.5 rmind
618 1.5 rmind if (nbuf_advstore(&nbuf, &n_ptr,
619 1.5 rmind offsetof(struct ip, ip_off) - offby,
620 1.6 rmind sizeof(uint16_t), &nip_off)) {
621 1.5 rmind return false;
622 1.5 rmind }
623 1.5 rmind cksum = npf_fixup16_cksum(cksum, ip_off, nip_off);
624 1.5 rmind ip->ip_off = nip_off;
625 1.5 rmind offby = offsetof(struct ip, ip_off);
626 1.5 rmind }
627 1.5 rmind
628 1.4 rmind /* Enforce minimum TTL. */
629 1.4 rmind if (minttl && ttl < minttl) {
630 1.4 rmind if (nbuf_advstore(&nbuf, &n_ptr,
631 1.4 rmind offsetof(struct ip, ip_ttl) - offby,
632 1.4 rmind sizeof(uint8_t), &minttl)) {
633 1.4 rmind return false;
634 1.4 rmind }
635 1.4 rmind cksum = npf_fixup16_cksum(cksum, ttl, minttl);
636 1.4 rmind ip->ip_ttl = minttl;
637 1.4 rmind offby = offsetof(struct ip, ip_ttl);
638 1.1 rmind }
639 1.1 rmind
640 1.4 rmind /* Update IP checksum. */
641 1.4 rmind offby = offsetof(struct ip, ip_sum) - offby;
642 1.4 rmind if (nbuf_advstore(&nbuf, &n_ptr, offby, sizeof(cksum), &cksum)) {
643 1.1 rmind return false;
644 1.4 rmind }
645 1.4 rmind ip->ip_sum = cksum;
646 1.4 rmind return true;
647 1.4 rmind }
648 1.4 rmind
649 1.4 rmind bool
650 1.4 rmind npf_normalize(npf_cache_t *npc, nbuf_t *nbuf,
651 1.5 rmind bool no_df, bool rnd, u_int minttl, u_int maxmss)
652 1.4 rmind {
653 1.4 rmind void *n_ptr = nbuf_dataptr(nbuf);
654 1.4 rmind struct tcphdr *th = &npc->npc_l4.tcp;
655 1.4 rmind uint16_t cksum, mss;
656 1.4 rmind int offby, wscale;
657 1.4 rmind
658 1.4 rmind /* Normalize IPv4. */
659 1.4 rmind if (npf_iscached(npc, NPC_IP4) && (rnd || minttl)) {
660 1.5 rmind if (!npf_normalize_ip4(npc, nbuf, rnd, no_df, minttl)) {
661 1.4 rmind return false;
662 1.4 rmind }
663 1.6 rmind } else if (!npf_iscached(npc, NPC_IP4)) {
664 1.6 rmind /* XXX: no IPv6 */
665 1.6 rmind return false;
666 1.4 rmind }
667 1.1 rmind
668 1.4 rmind /*
669 1.4 rmind * TCP Maximum Segment Size (MSS) "clamping". Only if SYN packet.
670 1.6 rmind * Fetch MSS and check whether rewrite to lower is needed.
671 1.4 rmind */
672 1.4 rmind if (maxmss == 0 || !npf_iscached(npc, NPC_TCP) ||
673 1.4 rmind (th->th_flags & TH_SYN) == 0) {
674 1.4 rmind /* Not required; done. */
675 1.4 rmind return true;
676 1.4 rmind }
677 1.4 rmind mss = 0;
678 1.4 rmind if (!npf_fetch_tcpopts(npc, nbuf, &mss, &wscale)) {
679 1.4 rmind return false;
680 1.4 rmind }
681 1.4 rmind if (ntohs(mss) <= maxmss) {
682 1.4 rmind return true;
683 1.4 rmind }
684 1.4 rmind
685 1.6 rmind /* Calculate TCP checksum, then rewrite MSS and the checksum. */
686 1.4 rmind maxmss = htons(maxmss);
687 1.4 rmind cksum = npf_fixup16_cksum(th->th_sum, mss, maxmss);
688 1.4 rmind th->th_sum = cksum;
689 1.4 rmind mss = maxmss;
690 1.4 rmind if (!npf_fetch_tcpopts(npc, nbuf, &mss, &wscale)) {
691 1.1 rmind return false;
692 1.4 rmind }
693 1.7 zoltan offby = npf_cache_hlen(npc, nbuf) + offsetof(struct tcphdr, th_sum);
694 1.4 rmind if (nbuf_advstore(&nbuf, &n_ptr, offby, sizeof(cksum), &cksum)) {
695 1.4 rmind return false;
696 1.4 rmind }
697 1.1 rmind return true;
698 1.1 rmind }
699