1 /* $NetBSD: npf_nat.c,v 1.40 2016/03/18 10:09:46 mrg Exp $ */
2
3 /*-
4 * Copyright (c) 2014 Mindaugas Rasiukevicius <rmind at netbsd org>
5 * Copyright (c) 2010-2013 The NetBSD Foundation, Inc.
6 * All rights reserved.
7 *
8 * This material is based upon work partially supported by The
9 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
31 */
32
33 /*
34 * NPF network address port translation (NAPT) and other forms of NAT.
35 * Described in RFC 2663, RFC 3022, etc.
36 *
37 * Overview
38 *
39 * There are few mechanisms: NAT policy, port map and translation.
40 * NAT module has a separate ruleset, where rules contain associated
41 * NAT policy, thus flexible filter criteria can be used.
42 *
43 * Translation types
44 *
45 * There are two types of translation: outbound (NPF_NATOUT) and
46 * inbound (NPF_NATIN). It should not be confused with connection
47 * direction. See npf_nat_which() for the description of how the
48 * addresses are rewritten.
49 *
50 * It should be noted that bi-directional NAT is a combined outbound
51 * and inbound translation, therefore constructed as two policies.
52 *
53 * NAT policies and port maps
54 *
55 * NAT (translation) policy is applied when a packet matches the rule.
56 * Apart from filter criteria, NAT policy has a translation IP address
57 * and associated port map. Port map is a bitmap used to reserve and
58 * use unique TCP/UDP ports for translation. Port maps are unique to
59 * the IP addresses, therefore multiple NAT policies with the same IP
60 * will share the same port map.
61 *
62 * Connections, translation entries and their life-cycle
63 *
64 * NAT module relies on connection tracking module. Each translated
65 * connection has an associated translation entry (npf_nat_t), which
66 * contains information used for backwards stream translation, i.e.
67 * original IP address with port and translation port, allocated from
68 * the port map. Each NAT entry is associated with the policy, which
69 * contains translation IP address. Allocated port is returned to the
70 * port map and NAT entry is destroyed when connection expires.
71 */
72
73 #include <sys/cdefs.h>
74 __KERNEL_RCSID(0, "$NetBSD: npf_nat.c,v 1.40 2016/03/18 10:09:46 mrg Exp $");
75
76 #include <sys/param.h>
77 #include <sys/types.h>
78
79 #include <sys/atomic.h>
80 #include <sys/bitops.h>
81 #include <sys/condvar.h>
82 #include <sys/kmem.h>
83 #include <sys/mutex.h>
84 #include <sys/pool.h>
85 #include <sys/proc.h>
86 #include <sys/cprng.h>
87
88 #include <net/pfil.h>
89 #include <netinet/in.h>
90
91 #include "npf_impl.h"
92 #include "npf_conn.h"
93
94 /*
95 * NPF portmap structure.
96 */
97 typedef struct {
98 u_int p_refcnt;
99 uint32_t p_bitmap[0];
100 } npf_portmap_t;
101
102 /* Portmap range: [ 1024 .. 65535 ] */
103 #define PORTMAP_FIRST (1024)
104 #define PORTMAP_SIZE ((65536 - PORTMAP_FIRST) / 32)
105 #define PORTMAP_FILLED ((uint32_t)~0U)
106 #define PORTMAP_MASK (31)
107 #define PORTMAP_SHIFT (5)
108
109 #define PORTMAP_MEM_SIZE \
110 (sizeof(npf_portmap_t) + (PORTMAP_SIZE * sizeof(uint32_t)))
111
112 /*
113 * NAT policy structure.
114 */
115 struct npf_natpolicy {
116 kmutex_t n_lock;
117 LIST_HEAD(, npf_nat) n_nat_list;
118 volatile u_int n_refcnt;
119 npf_portmap_t * n_portmap;
120 uint64_t n_id;
121
122 /*
123 * Translation type, flags and address. Optionally, prefix
124 * for the NPTv6 and translation port. Translation algorithm
125 * and related data (for NPTv6, the adjustment value).
126 *
127 * NPF_NP_CMP_START mark starts here.
128 */
129 int n_type;
130 u_int n_flags;
131 u_int n_alen;
132 npf_addr_t n_taddr;
133 npf_netmask_t n_tmask;
134 in_port_t n_tport;
135 u_int n_algo;
136 union {
137 uint16_t n_npt66_adj;
138 };
139 };
140
141 #define NPF_NP_CMP_START offsetof(npf_natpolicy_t, n_type)
142 #define NPF_NP_CMP_SIZE (sizeof(npf_natpolicy_t) - NPF_NP_CMP_START)
143
144 /*
145 * NAT translation entry for a connection.
146 */
147 struct npf_nat {
148 /* Associated NAT policy. */
149 npf_natpolicy_t * nt_natpolicy;
150
151 /*
152 * Original address and port (for backwards translation).
153 * Translation port (for redirects).
154 */
155 npf_addr_t nt_oaddr;
156 in_port_t nt_oport;
157 in_port_t nt_tport;
158
159 /* ALG (if any) associated with this NAT entry. */
160 npf_alg_t * nt_alg;
161 uintptr_t nt_alg_arg;
162
163 LIST_ENTRY(npf_nat) nt_entry;
164 npf_conn_t * nt_conn;
165 };
166
167 static pool_cache_t nat_cache __read_mostly;
168
169 /*
170 * npf_nat_sys{init,fini}: initialise/destroy NAT subsystem structures.
171 */
172
173 void
npf_nat_sysinit(void)174 npf_nat_sysinit(void)
175 {
176 nat_cache = pool_cache_init(sizeof(npf_nat_t), coherency_unit,
177 0, 0, "npfnatpl", NULL, IPL_NET, NULL, NULL, NULL);
178 KASSERT(nat_cache != NULL);
179 }
180
181 void
npf_nat_sysfini(void)182 npf_nat_sysfini(void)
183 {
184 /* All NAT policies should already be destroyed. */
185 pool_cache_destroy(nat_cache);
186 }
187
188 /*
189 * npf_nat_newpolicy: create a new NAT policy.
190 *
191 * => Shares portmap if policy is on existing translation address.
192 */
193 npf_natpolicy_t *
npf_nat_newpolicy(prop_dictionary_t natdict,npf_ruleset_t * rset)194 npf_nat_newpolicy(prop_dictionary_t natdict, npf_ruleset_t *rset)
195 {
196 npf_natpolicy_t *np;
197 prop_object_t obj;
198 npf_portmap_t *pm;
199
200 np = kmem_zalloc(sizeof(npf_natpolicy_t), KM_SLEEP);
201
202 /* The translation type, flags and policy ID. */
203 prop_dictionary_get_int32(natdict, "type", &np->n_type);
204 prop_dictionary_get_uint32(natdict, "flags", &np->n_flags);
205 prop_dictionary_get_uint64(natdict, "nat-policy", &np->n_id);
206
207 /* Should be exclusively either inbound or outbound NAT. */
208 if (((np->n_type == NPF_NATIN) ^ (np->n_type == NPF_NATOUT)) == 0) {
209 goto err;
210 }
211 mutex_init(&np->n_lock, MUTEX_DEFAULT, IPL_SOFTNET);
212 LIST_INIT(&np->n_nat_list);
213
214 /* Translation IP, mask and port (if applicable). */
215 obj = prop_dictionary_get(natdict, "nat-ip");
216 np->n_alen = prop_data_size(obj);
217 if (np->n_alen == 0 || np->n_alen > sizeof(npf_addr_t)) {
218 goto err;
219 }
220 memcpy(&np->n_taddr, prop_data_data_nocopy(obj), np->n_alen);
221 prop_dictionary_get_uint8(natdict, "nat-mask", &np->n_tmask);
222 prop_dictionary_get_uint16(natdict, "nat-port", &np->n_tport);
223
224 prop_dictionary_get_uint32(natdict, "nat-algo", &np->n_algo);
225 switch (np->n_algo) {
226 case NPF_ALGO_NPT66:
227 prop_dictionary_get_uint16(natdict, "npt66-adj",
228 &np->n_npt66_adj);
229 break;
230 default:
231 if (np->n_tmask != NPF_NO_NETMASK)
232 goto err;
233 break;
234 }
235
236 /* Determine if port map is needed. */
237 np->n_portmap = NULL;
238 if ((np->n_flags & NPF_NAT_PORTMAP) == 0) {
239 /* No port map. */
240 return np;
241 }
242
243 /*
244 * Inspect NAT policies in the ruleset for port map sharing.
245 * Note that npf_ruleset_sharepm() will increase the reference count.
246 */
247 if (!npf_ruleset_sharepm(rset, np)) {
248 /* Allocate a new port map for the NAT policy. */
249 pm = kmem_zalloc(PORTMAP_MEM_SIZE, KM_SLEEP);
250 pm->p_refcnt = 1;
251 KASSERT((uintptr_t)pm->p_bitmap == (uintptr_t)pm + sizeof(*pm));
252 np->n_portmap = pm;
253 } else {
254 KASSERT(np->n_portmap != NULL);
255 KASSERT(np->n_portmap->p_refcnt > 0);
256 }
257 return np;
258 err:
259 mutex_destroy(&np->n_lock);
260 kmem_free(np, sizeof(npf_natpolicy_t));
261 return NULL;
262 }
263
264 int
npf_nat_policyexport(const npf_natpolicy_t * np,prop_dictionary_t natdict)265 npf_nat_policyexport(const npf_natpolicy_t *np, prop_dictionary_t natdict)
266 {
267 prop_data_t d;
268
269 prop_dictionary_set_int32(natdict, "type", np->n_type);
270 prop_dictionary_set_uint32(natdict, "flags", np->n_flags);
271
272 d = prop_data_create_data(&np->n_taddr, np->n_alen);
273 prop_dictionary_set_and_rel(natdict, "nat-ip", d);
274
275 prop_dictionary_set_uint8(natdict, "nat-mask", np->n_tmask);
276 prop_dictionary_set_uint16(natdict, "nat-port", np->n_tport);
277 prop_dictionary_set_uint32(natdict, "nat-algo", np->n_algo);
278
279 switch (np->n_algo) {
280 case NPF_ALGO_NPT66:
281 prop_dictionary_set_uint16(natdict, "npt66-adj", np->n_npt66_adj);
282 break;
283 }
284 prop_dictionary_set_uint64(natdict, "nat-policy", np->n_id);
285 return 0;
286 }
287
288 /*
289 * npf_nat_freepolicy: free NAT policy and, on last reference, free portmap.
290 *
291 * => Called from npf_rule_free() during the reload via npf_ruleset_destroy().
292 */
293 void
npf_nat_freepolicy(npf_natpolicy_t * np)294 npf_nat_freepolicy(npf_natpolicy_t *np)
295 {
296 npf_portmap_t *pm = np->n_portmap;
297 npf_conn_t *con;
298 npf_nat_t *nt;
299
300 /*
301 * Disassociate all entries from the policy. At this point,
302 * new entries can no longer be created for this policy.
303 */
304 while (np->n_refcnt) {
305 mutex_enter(&np->n_lock);
306 LIST_FOREACH(nt, &np->n_nat_list, nt_entry) {
307 con = nt->nt_conn;
308 KASSERT(con != NULL);
309 npf_conn_expire(con);
310 }
311 mutex_exit(&np->n_lock);
312
313 /* Kick the worker - all references should be going away. */
314 npf_worker_signal();
315 kpause("npfgcnat", false, 1, NULL);
316 }
317 KASSERT(LIST_EMPTY(&np->n_nat_list));
318 KASSERT(pm == NULL || pm->p_refcnt > 0);
319
320 /* Destroy the port map, on last reference. */
321 if (pm && atomic_dec_uint_nv(&pm->p_refcnt) == 0) {
322 KASSERT((np->n_flags & NPF_NAT_PORTMAP) != 0);
323 kmem_free(pm, PORTMAP_MEM_SIZE);
324 }
325 mutex_destroy(&np->n_lock);
326 kmem_free(np, sizeof(npf_natpolicy_t));
327 }
328
329 void
npf_nat_freealg(npf_natpolicy_t * np,npf_alg_t * alg)330 npf_nat_freealg(npf_natpolicy_t *np, npf_alg_t *alg)
331 {
332 npf_nat_t *nt;
333
334 mutex_enter(&np->n_lock);
335 LIST_FOREACH(nt, &np->n_nat_list, nt_entry) {
336 if (nt->nt_alg == alg)
337 nt->nt_alg = NULL;
338 }
339 mutex_exit(&np->n_lock);
340 }
341
342 /*
343 * npf_nat_cmppolicy: compare two NAT policies.
344 *
345 * => Return 0 on match, and non-zero otherwise.
346 */
347 bool
npf_nat_cmppolicy(npf_natpolicy_t * np,npf_natpolicy_t * mnp)348 npf_nat_cmppolicy(npf_natpolicy_t *np, npf_natpolicy_t *mnp)
349 {
350 const void *np_raw, *mnp_raw;
351
352 /*
353 * Compare the relevant NAT policy information (in raw form),
354 * which is enough for matching criterion.
355 */
356 KASSERT(np && mnp && np != mnp);
357 np_raw = (const uint8_t *)np + NPF_NP_CMP_START;
358 mnp_raw = (const uint8_t *)mnp + NPF_NP_CMP_START;
359 return memcmp(np_raw, mnp_raw, NPF_NP_CMP_SIZE) == 0;
360 }
361
362 bool
npf_nat_sharepm(npf_natpolicy_t * np,npf_natpolicy_t * mnp)363 npf_nat_sharepm(npf_natpolicy_t *np, npf_natpolicy_t *mnp)
364 {
365 npf_portmap_t *pm, *mpm;
366
367 KASSERT(np && mnp && np != mnp);
368 KASSERT(LIST_EMPTY(&mnp->n_nat_list));
369 KASSERT(mnp->n_refcnt == 0);
370
371 /* Using port map and having equal translation address? */
372 if ((np->n_flags & mnp->n_flags & NPF_NAT_PORTMAP) == 0) {
373 return false;
374 }
375 if (np->n_alen != mnp->n_alen) {
376 return false;
377 }
378 if (memcmp(&np->n_taddr, &mnp->n_taddr, np->n_alen) != 0) {
379 return false;
380 }
381 mpm = mnp->n_portmap;
382 KASSERT(mpm == NULL || mpm->p_refcnt > 0);
383
384 /*
385 * If NAT policy has an old port map - drop the reference
386 * and destroy the port map if it was the last.
387 */
388 if (mpm && atomic_dec_uint_nv(&mpm->p_refcnt) == 0) {
389 kmem_free(mpm, PORTMAP_MEM_SIZE);
390 }
391
392 /* Share the port map. */
393 pm = np->n_portmap;
394 atomic_inc_uint(&pm->p_refcnt);
395 mnp->n_portmap = pm;
396 return true;
397 }
398
399 void
npf_nat_setid(npf_natpolicy_t * np,uint64_t id)400 npf_nat_setid(npf_natpolicy_t *np, uint64_t id)
401 {
402 np->n_id = id;
403 }
404
405 uint64_t
npf_nat_getid(const npf_natpolicy_t * np)406 npf_nat_getid(const npf_natpolicy_t *np)
407 {
408 return np->n_id;
409 }
410
411 /*
412 * npf_nat_getport: allocate and return a port in the NAT policy portmap.
413 *
414 * => Returns in network byte-order.
415 * => Zero indicates failure.
416 */
417 static in_port_t
npf_nat_getport(npf_natpolicy_t * np)418 npf_nat_getport(npf_natpolicy_t *np)
419 {
420 npf_portmap_t *pm = np->n_portmap;
421 u_int n = PORTMAP_SIZE, idx, bit;
422 uint32_t map, nmap;
423
424 KASSERT((np->n_flags & NPF_NAT_PORTMAP) != 0);
425 KASSERT(pm->p_refcnt > 0);
426
427 idx = cprng_fast32() % PORTMAP_SIZE;
428 for (;;) {
429 KASSERT(idx < PORTMAP_SIZE);
430 map = pm->p_bitmap[idx];
431 if (__predict_false(map == PORTMAP_FILLED)) {
432 if (n-- == 0) {
433 /* No space. */
434 return 0;
435 }
436 /* This bitmap is filled, next. */
437 idx = (idx ? idx : PORTMAP_SIZE) - 1;
438 continue;
439 }
440 bit = ffs32(~map) - 1;
441 nmap = map | (1 << bit);
442 if (atomic_cas_32(&pm->p_bitmap[idx], map, nmap) == map) {
443 /* Success. */
444 break;
445 }
446 }
447 return htons(PORTMAP_FIRST + (idx << PORTMAP_SHIFT) + bit);
448 }
449
450 /*
451 * npf_nat_takeport: allocate specific port in the NAT policy portmap.
452 */
453 static bool
npf_nat_takeport(npf_natpolicy_t * np,in_port_t port)454 npf_nat_takeport(npf_natpolicy_t *np, in_port_t port)
455 {
456 npf_portmap_t *pm = np->n_portmap;
457 uint32_t map, nmap;
458 u_int idx, bit;
459
460 KASSERT((np->n_flags & NPF_NAT_PORTMAP) != 0);
461 KASSERT(pm->p_refcnt > 0);
462
463 port = ntohs(port) - PORTMAP_FIRST;
464 idx = port >> PORTMAP_SHIFT;
465 bit = port & PORTMAP_MASK;
466 map = pm->p_bitmap[idx];
467 nmap = map | (1 << bit);
468 if (map == nmap) {
469 /* Already taken. */
470 return false;
471 }
472 return atomic_cas_32(&pm->p_bitmap[idx], map, nmap) == map;
473 }
474
475 /*
476 * npf_nat_putport: return port as available in the NAT policy portmap.
477 *
478 * => Port should be in network byte-order.
479 */
480 static void
npf_nat_putport(npf_natpolicy_t * np,in_port_t port)481 npf_nat_putport(npf_natpolicy_t *np, in_port_t port)
482 {
483 npf_portmap_t *pm = np->n_portmap;
484 uint32_t map, nmap;
485 u_int idx, bit;
486
487 KASSERT((np->n_flags & NPF_NAT_PORTMAP) != 0);
488 KASSERT(pm->p_refcnt > 0);
489
490 port = ntohs(port) - PORTMAP_FIRST;
491 idx = port >> PORTMAP_SHIFT;
492 bit = port & PORTMAP_MASK;
493 do {
494 map = pm->p_bitmap[idx];
495 KASSERT(map | (1 << bit));
496 nmap = map & ~(1 << bit);
497 } while (atomic_cas_32(&pm->p_bitmap[idx], map, nmap) != map);
498 }
499
500 /*
501 * npf_nat_which: tell which address (source or destination) should be
502 * rewritten given the combination of the NAT type and flow direction.
503 */
504 static inline u_int
npf_nat_which(const int type,bool forw)505 npf_nat_which(const int type, bool forw)
506 {
507 /*
508 * Outbound NAT rewrites:
509 * - Source (NPF_SRC) on "forwards" stream.
510 * - Destination (NPF_DST) on "backwards" stream.
511 * Inbound NAT is other way round.
512 */
513 if (type == NPF_NATOUT) {
514 forw = !forw;
515 } else {
516 KASSERT(type == NPF_NATIN);
517 }
518 CTASSERT(NPF_SRC == 0 && NPF_DST == 1);
519 KASSERT(forw == NPF_SRC || forw == NPF_DST);
520 return (u_int)forw;
521 }
522
523 /*
524 * npf_nat_inspect: inspect packet against NAT ruleset and return a policy.
525 *
526 * => Acquire a reference on the policy, if found.
527 */
528 static npf_natpolicy_t *
npf_nat_inspect(npf_cache_t * npc,const int di)529 npf_nat_inspect(npf_cache_t *npc, const int di)
530 {
531 int slock = npf_config_read_enter();
532 npf_ruleset_t *rlset = npf_config_natset();
533 npf_natpolicy_t *np;
534 npf_rule_t *rl;
535
536 rl = npf_ruleset_inspect(npc, rlset, di, NPF_LAYER_3);
537 if (rl == NULL) {
538 npf_config_read_exit(slock);
539 return NULL;
540 }
541 np = npf_rule_getnat(rl);
542 atomic_inc_uint(&np->n_refcnt);
543 npf_config_read_exit(slock);
544 return np;
545 }
546
547 /*
548 * npf_nat_create: create a new NAT translation entry.
549 */
550 static npf_nat_t *
npf_nat_create(npf_cache_t * npc,npf_natpolicy_t * np,npf_conn_t * con)551 npf_nat_create(npf_cache_t *npc, npf_natpolicy_t *np, npf_conn_t *con)
552 {
553 const int proto = npc->npc_proto;
554 npf_nat_t *nt;
555
556 KASSERT(npf_iscached(npc, NPC_IP46));
557 KASSERT(npf_iscached(npc, NPC_LAYER4));
558
559 /* Construct a new NAT entry and associate it with the connection. */
560 nt = pool_cache_get(nat_cache, PR_NOWAIT);
561 if (nt == NULL){
562 return NULL;
563 }
564 npf_stats_inc(NPF_STAT_NAT_CREATE);
565 nt->nt_natpolicy = np;
566 nt->nt_conn = con;
567 nt->nt_alg = NULL;
568
569 /* Save the original address which may be rewritten. */
570 if (np->n_type == NPF_NATOUT) {
571 /* Outbound NAT: source (think internal) address. */
572 memcpy(&nt->nt_oaddr, npc->npc_ips[NPF_SRC], npc->npc_alen);
573 } else {
574 /* Inbound NAT: destination (think external) address. */
575 KASSERT(np->n_type == NPF_NATIN);
576 memcpy(&nt->nt_oaddr, npc->npc_ips[NPF_DST], npc->npc_alen);
577 }
578
579 /*
580 * Port translation, if required, and if it is TCP/UDP.
581 */
582 if ((np->n_flags & NPF_NAT_PORTS) == 0 ||
583 (proto != IPPROTO_TCP && proto != IPPROTO_UDP)) {
584 nt->nt_oport = 0;
585 nt->nt_tport = 0;
586 goto out;
587 }
588
589 /* Save the relevant TCP/UDP port. */
590 if (proto == IPPROTO_TCP) {
591 const struct tcphdr *th = npc->npc_l4.tcp;
592 nt->nt_oport = (np->n_type == NPF_NATOUT) ?
593 th->th_sport : th->th_dport;
594 } else {
595 const struct udphdr *uh = npc->npc_l4.udp;
596 nt->nt_oport = (np->n_type == NPF_NATOUT) ?
597 uh->uh_sport : uh->uh_dport;
598 }
599
600 /* Get a new port for translation. */
601 if ((np->n_flags & NPF_NAT_PORTMAP) != 0) {
602 nt->nt_tport = npf_nat_getport(np);
603 } else {
604 nt->nt_tport = np->n_tport;
605 }
606 out:
607 mutex_enter(&np->n_lock);
608 LIST_INSERT_HEAD(&np->n_nat_list, nt, nt_entry);
609 mutex_exit(&np->n_lock);
610 return nt;
611 }
612
613 /*
614 * npf_nat_translate: perform translation given the state data.
615 */
616 static inline int
npf_nat_translate(npf_cache_t * npc,npf_nat_t * nt,bool forw)617 npf_nat_translate(npf_cache_t *npc, npf_nat_t *nt, bool forw)
618 {
619 const npf_natpolicy_t *np = nt->nt_natpolicy;
620 const u_int which = npf_nat_which(np->n_type, forw);
621 const npf_addr_t *addr;
622 in_port_t port;
623
624 KASSERT(npf_iscached(npc, NPC_IP46));
625 KASSERT(npf_iscached(npc, NPC_LAYER4));
626
627 if (forw) {
628 /* "Forwards" stream: use translation address/port. */
629 addr = &np->n_taddr;
630 port = nt->nt_tport;
631 } else {
632 /* "Backwards" stream: use original address/port. */
633 addr = &nt->nt_oaddr;
634 port = nt->nt_oport;
635 }
636 KASSERT((np->n_flags & NPF_NAT_PORTS) != 0 || port == 0);
637
638 /* Execute ALG translation first. */
639 if ((npc->npc_info & NPC_ALG_EXEC) == 0) {
640 npc->npc_info |= NPC_ALG_EXEC;
641 npf_alg_exec(npc, nt, forw);
642 npf_recache(npc);
643 }
644 KASSERT(!nbuf_flag_p(npc->npc_nbuf, NBUF_DATAREF_RESET));
645
646 /* Finally, perform the translation. */
647 return npf_napt_rwr(npc, which, addr, port);
648 }
649
650 /*
651 * npf_nat_algo: perform the translation given the algorithm.
652 */
653 static inline int
npf_nat_algo(npf_cache_t * npc,const npf_natpolicy_t * np,bool forw)654 npf_nat_algo(npf_cache_t *npc, const npf_natpolicy_t *np, bool forw)
655 {
656 const u_int which = npf_nat_which(np->n_type, forw);
657 int error;
658
659 switch (np->n_algo) {
660 #ifdef INET6
661 case NPF_ALGO_NPT66:
662 error = npf_npt66_rwr(npc, which, &np->n_taddr,
663 np->n_tmask, np->n_npt66_adj);
664 break;
665 #endif
666 default:
667 error = npf_napt_rwr(npc, which, &np->n_taddr, np->n_tport);
668 break;
669 }
670
671 return error;
672 }
673
674 /*
675 * npf_do_nat:
676 * - Inspect packet for a NAT policy, unless a connection with a NAT
677 * association already exists. In such case, determine whether it
678 * is a "forwards" or "backwards" stream.
679 * - Perform translation: rewrite source or destination fields,
680 * depending on translation type and direction.
681 * - Associate a NAT policy with a connection (may establish a new).
682 */
683 int
npf_do_nat(npf_cache_t * npc,npf_conn_t * con,const int di)684 npf_do_nat(npf_cache_t *npc, npf_conn_t *con, const int di)
685 {
686 nbuf_t *nbuf = npc->npc_nbuf;
687 npf_conn_t *ncon = NULL;
688 npf_natpolicy_t *np;
689 npf_nat_t *nt;
690 int error;
691 bool forw;
692
693 /* All relevant IPv4 data should be already cached. */
694 if (!npf_iscached(npc, NPC_IP46) || !npf_iscached(npc, NPC_LAYER4)) {
695 return 0;
696 }
697 KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET));
698
699 /*
700 * Return the NAT entry associated with the connection, if any.
701 * Determines whether the stream is "forwards" or "backwards".
702 * Note: no need to lock, since reference on connection is held.
703 */
704 if (con && (nt = npf_conn_getnat(con, di, &forw)) != NULL) {
705 np = nt->nt_natpolicy;
706 goto translate;
707 }
708
709 /*
710 * Inspect the packet for a NAT policy, if there is no connection.
711 * Note: acquires a reference if found.
712 */
713 np = npf_nat_inspect(npc, di);
714 if (np == NULL) {
715 /* If packet does not match - done. */
716 return 0;
717 }
718 forw = true;
719
720 /* Static NAT - just perform the translation. */
721 if (np->n_flags & NPF_NAT_STATIC) {
722 if (nbuf_cksum_barrier(nbuf, di)) {
723 npf_recache(npc);
724 }
725 error = npf_nat_algo(npc, np, forw);
726 atomic_dec_uint(&np->n_refcnt);
727 return error;
728 }
729
730 /*
731 * If there is no local connection (no "stateful" rule - unusual,
732 * but possible configuration), establish one before translation.
733 * Note that it is not a "pass" connection, therefore passing of
734 * "backwards" stream depends on other, stateless filtering rules.
735 */
736 if (con == NULL) {
737 ncon = npf_conn_establish(npc, di, true);
738 if (ncon == NULL) {
739 atomic_dec_uint(&np->n_refcnt);
740 return ENOMEM;
741 }
742 con = ncon;
743 }
744
745 /*
746 * Create a new NAT entry and associate with the connection.
747 * We will consume the reference on success (release on error).
748 */
749 nt = npf_nat_create(npc, np, con);
750 if (nt == NULL) {
751 atomic_dec_uint(&np->n_refcnt);
752 error = ENOMEM;
753 goto out;
754 }
755
756 /* Associate the NAT translation entry with the connection. */
757 error = npf_conn_setnat(npc, con, nt, np->n_type);
758 if (error) {
759 /* Will release the reference. */
760 npf_nat_destroy(nt);
761 goto out;
762 }
763
764 /* Determine whether any ALG matches. */
765 if (npf_alg_match(npc, nt, di)) {
766 KASSERT(nt->nt_alg != NULL);
767 }
768
769 translate:
770 /* May need to process the delayed checksums first (XXX: NetBSD). */
771 if (nbuf_cksum_barrier(nbuf, di)) {
772 npf_recache(npc);
773 }
774
775 /* Perform the translation. */
776 error = npf_nat_translate(npc, nt, forw);
777 out:
778 if (__predict_false(ncon)) {
779 if (error) {
780 /* It created for NAT - just expire. */
781 npf_conn_expire(ncon);
782 }
783 npf_conn_release(ncon);
784 }
785 return error;
786 }
787
788 /*
789 * npf_nat_gettrans: return translation IP address and port.
790 */
791 void
npf_nat_gettrans(npf_nat_t * nt,npf_addr_t ** addr,in_port_t * port)792 npf_nat_gettrans(npf_nat_t *nt, npf_addr_t **addr, in_port_t *port)
793 {
794 npf_natpolicy_t *np = nt->nt_natpolicy;
795
796 *addr = &np->n_taddr;
797 *port = nt->nt_tport;
798 }
799
800 /*
801 * npf_nat_getorig: return original IP address and port from translation entry.
802 */
803 void
npf_nat_getorig(npf_nat_t * nt,npf_addr_t ** addr,in_port_t * port)804 npf_nat_getorig(npf_nat_t *nt, npf_addr_t **addr, in_port_t *port)
805 {
806 *addr = &nt->nt_oaddr;
807 *port = nt->nt_oport;
808 }
809
810 /*
811 * npf_nat_setalg: associate an ALG with the NAT entry.
812 */
813 void
npf_nat_setalg(npf_nat_t * nt,npf_alg_t * alg,uintptr_t arg)814 npf_nat_setalg(npf_nat_t *nt, npf_alg_t *alg, uintptr_t arg)
815 {
816 nt->nt_alg = alg;
817 nt->nt_alg_arg = arg;
818 }
819
820 /*
821 * npf_nat_destroy: destroy NAT structure (performed on connection expiration).
822 */
823 void
npf_nat_destroy(npf_nat_t * nt)824 npf_nat_destroy(npf_nat_t *nt)
825 {
826 npf_natpolicy_t *np = nt->nt_natpolicy;
827
828 /* Return any taken port to the portmap. */
829 if ((np->n_flags & NPF_NAT_PORTMAP) != 0 && nt->nt_tport) {
830 npf_nat_putport(np, nt->nt_tport);
831 }
832
833 mutex_enter(&np->n_lock);
834 LIST_REMOVE(nt, nt_entry);
835 KASSERT(np->n_refcnt > 0);
836 atomic_dec_uint(&np->n_refcnt);
837 mutex_exit(&np->n_lock);
838
839 pool_cache_put(nat_cache, nt);
840 npf_stats_inc(NPF_STAT_NAT_DESTROY);
841 }
842
843 /*
844 * npf_nat_export: serialise the NAT entry with a NAT policy ID.
845 */
846 void
npf_nat_export(prop_dictionary_t condict,npf_nat_t * nt)847 npf_nat_export(prop_dictionary_t condict, npf_nat_t *nt)
848 {
849 npf_natpolicy_t *np = nt->nt_natpolicy;
850 prop_dictionary_t natdict;
851 prop_data_t d;
852
853 natdict = prop_dictionary_create();
854 d = prop_data_create_data(&nt->nt_oaddr, sizeof(npf_addr_t));
855 prop_dictionary_set_and_rel(natdict, "oaddr", d);
856 prop_dictionary_set_uint16(natdict, "oport", nt->nt_oport);
857 prop_dictionary_set_uint16(natdict, "tport", nt->nt_tport);
858 prop_dictionary_set_uint64(natdict, "nat-policy", np->n_id);
859 prop_dictionary_set_and_rel(condict, "nat", natdict);
860 }
861
862 /*
863 * npf_nat_import: find the NAT policy and unserialise the NAT entry.
864 */
865 npf_nat_t *
npf_nat_import(prop_dictionary_t natdict,npf_ruleset_t * natlist,npf_conn_t * con)866 npf_nat_import(prop_dictionary_t natdict, npf_ruleset_t *natlist,
867 npf_conn_t *con)
868 {
869 npf_natpolicy_t *np;
870 npf_nat_t *nt;
871 uint64_t np_id;
872 const void *d;
873
874 prop_dictionary_get_uint64(natdict, "nat-policy", &np_id);
875 if ((np = npf_ruleset_findnat(natlist, np_id)) == NULL) {
876 return NULL;
877 }
878 nt = pool_cache_get(nat_cache, PR_WAITOK);
879 memset(nt, 0, sizeof(npf_nat_t));
880
881 prop_object_t obj = prop_dictionary_get(natdict, "oaddr");
882 if ((d = prop_data_data_nocopy(obj)) == NULL ||
883 prop_data_size(obj) != sizeof(npf_addr_t)) {
884 pool_cache_put(nat_cache, nt);
885 return NULL;
886 }
887 memcpy(&nt->nt_oaddr, d, sizeof(npf_addr_t));
888 prop_dictionary_get_uint16(natdict, "oport", &nt->nt_oport);
889 prop_dictionary_get_uint16(natdict, "tport", &nt->nt_tport);
890
891 /* Take a specific port from port-map. */
892 if ((np->n_flags & NPF_NAT_PORTMAP) != 0 && nt->nt_tport &
893 !npf_nat_takeport(np, nt->nt_tport)) {
894 pool_cache_put(nat_cache, nt);
895 return NULL;
896 }
897 npf_stats_inc(NPF_STAT_NAT_CREATE);
898
899 /*
900 * Associate, take a reference and insert. Unlocked since
901 * the policy is not yet visible.
902 */
903 nt->nt_natpolicy = np;
904 nt->nt_conn = con;
905 np->n_refcnt++;
906 LIST_INSERT_HEAD(&np->n_nat_list, nt, nt_entry);
907 return nt;
908 }
909
910 #if defined(DDB) || defined(_NPF_TESTING)
911
912 void
npf_nat_dump(const npf_nat_t * nt)913 npf_nat_dump(const npf_nat_t *nt)
914 {
915 const npf_natpolicy_t *np;
916 struct in_addr ip;
917
918 np = nt->nt_natpolicy;
919 memcpy(&ip, &np->n_taddr, sizeof(ip));
920 printf("\tNATP(%p): type %d flags 0x%x taddr %s tport %d\n", np,
921 np->n_type, np->n_flags, inet_ntoa(ip), ntohs(np->n_tport));
922 memcpy(&ip, &nt->nt_oaddr, sizeof(ip));
923 printf("\tNAT: original address %s oport %d tport %d\n",
924 inet_ntoa(ip), ntohs(nt->nt_oport), ntohs(nt->nt_tport));
925 if (nt->nt_alg) {
926 printf("\tNAT ALG = %p, ARG = %p\n",
927 nt->nt_alg, (void *)nt->nt_alg_arg);
928 }
929 }
930
931 #endif
932