1d8caf56eSAndrey V. Elsukov /*- 2002cae78SAndrey V. Elsukov * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3002cae78SAndrey V. Elsukov * 4002cae78SAndrey V. Elsukov * Copyright (c) 2015-2019 Yandex LLC 5002cae78SAndrey V. Elsukov * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org> 6d8caf56eSAndrey V. Elsukov * 7d8caf56eSAndrey V. Elsukov * Redistribution and use in source and binary forms, with or without 8d8caf56eSAndrey V. Elsukov * modification, are permitted provided that the following conditions 9d8caf56eSAndrey V. Elsukov * are met: 10d8caf56eSAndrey V. Elsukov * 11d8caf56eSAndrey V. Elsukov * 1. Redistributions of source code must retain the above copyright 12d8caf56eSAndrey V. Elsukov * notice, this list of conditions and the following disclaimer. 13d8caf56eSAndrey V. Elsukov * 2. Redistributions in binary form must reproduce the above copyright 14d8caf56eSAndrey V. Elsukov * notice, this list of conditions and the following disclaimer in the 15d8caf56eSAndrey V. Elsukov * documentation and/or other materials provided with the distribution. 16d8caf56eSAndrey V. Elsukov * 17d8caf56eSAndrey V. Elsukov * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18d8caf56eSAndrey V. Elsukov * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19d8caf56eSAndrey V. Elsukov * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20d8caf56eSAndrey V. Elsukov * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21d8caf56eSAndrey V. Elsukov * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22d8caf56eSAndrey V. Elsukov * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23d8caf56eSAndrey V. Elsukov * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24d8caf56eSAndrey V. Elsukov * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25d8caf56eSAndrey V. Elsukov * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26d8caf56eSAndrey V. Elsukov * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27d8caf56eSAndrey V. Elsukov */ 28d8caf56eSAndrey V. Elsukov 29d8caf56eSAndrey V. Elsukov #include <sys/cdefs.h> 30d8caf56eSAndrey V. Elsukov __FBSDID("$FreeBSD$"); 31d8caf56eSAndrey V. Elsukov 3228739809SAndrey V. Elsukov #include "opt_ipstealth.h" 3328739809SAndrey V. Elsukov 34d8caf56eSAndrey V. Elsukov #include <sys/param.h> 35d8caf56eSAndrey V. Elsukov #include <sys/systm.h> 36d8caf56eSAndrey V. Elsukov #include <sys/counter.h> 37d8caf56eSAndrey V. Elsukov #include <sys/errno.h> 38d8caf56eSAndrey V. Elsukov #include <sys/kernel.h> 39d8caf56eSAndrey V. Elsukov #include <sys/lock.h> 40d8caf56eSAndrey V. Elsukov #include <sys/mbuf.h> 41d8caf56eSAndrey V. Elsukov #include <sys/module.h> 42d8caf56eSAndrey V. Elsukov #include <sys/rmlock.h> 43d8caf56eSAndrey V. Elsukov #include <sys/rwlock.h> 44d8caf56eSAndrey V. Elsukov #include <sys/socket.h> 45d8caf56eSAndrey V. Elsukov #include <sys/queue.h> 46d8caf56eSAndrey V. Elsukov 47d8caf56eSAndrey V. Elsukov #include <net/if.h> 48d8caf56eSAndrey V. Elsukov #include <net/if_var.h> 49d8caf56eSAndrey V. Elsukov #include <net/if_pflog.h> 50d8caf56eSAndrey V. Elsukov #include <net/pfil.h> 51d8caf56eSAndrey V. Elsukov #include <net/netisr.h> 52d8caf56eSAndrey V. Elsukov #include <net/route.h> 536ad7446cSAlexander V. Chernikov #include <net/route/nhop.h> 54d8caf56eSAndrey V. Elsukov 55d8caf56eSAndrey V. Elsukov #include <netinet/in.h> 56c570565fSAndrey V. Elsukov #include <netinet/in_fib.h> 576ad7446cSAlexander V. Chernikov #include <netinet/in_var.h> 58d8caf56eSAndrey V. Elsukov #include <netinet/ip.h> 59d8caf56eSAndrey V. Elsukov #include <netinet/ip_var.h> 60d8caf56eSAndrey V. Elsukov #include <netinet/ip_fw.h> 61d8caf56eSAndrey V. Elsukov #include <netinet/ip6.h> 62d8caf56eSAndrey V. Elsukov #include <netinet/icmp6.h> 63d8caf56eSAndrey V. Elsukov #include <netinet/ip_icmp.h> 64d8caf56eSAndrey V. Elsukov #include <netinet/tcp.h> 65d8caf56eSAndrey V. Elsukov #include <netinet/udp.h> 66d8caf56eSAndrey V. Elsukov #include <netinet6/in6_var.h> 67c570565fSAndrey V. Elsukov #include <netinet6/in6_fib.h> 68d8caf56eSAndrey V. Elsukov #include <netinet6/ip6_var.h> 69b11efc1eSAndrey V. Elsukov #include <netinet6/ip_fw_nat64.h> 70d8caf56eSAndrey V. Elsukov 71d8caf56eSAndrey V. Elsukov #include <netpfil/pf/pf.h> 72d8caf56eSAndrey V. Elsukov #include <netpfil/ipfw/ip_fw_private.h> 73d8caf56eSAndrey V. Elsukov #include <machine/in_cksum.h> 74d8caf56eSAndrey V. Elsukov 75782360deSAndrey V. Elsukov #include "ip_fw_nat64.h" 76782360deSAndrey V. Elsukov #include "nat64_translate.h" 77782360deSAndrey V. Elsukov 78aa271561SAndrey V. Elsukov typedef int (*nat64_output_t)(struct ifnet *, struct mbuf *, 79aa271561SAndrey V. Elsukov struct sockaddr *, struct nat64_counters *, void *); 80aa271561SAndrey V. Elsukov typedef int (*nat64_output_one_t)(struct mbuf *, struct nat64_counters *, 81aa271561SAndrey V. Elsukov void *); 82aa271561SAndrey V. Elsukov 836ad7446cSAlexander V. Chernikov static struct nhop_object *nat64_find_route4(struct sockaddr_in *, 84aa271561SAndrey V. Elsukov struct mbuf *); 856ad7446cSAlexander V. Chernikov static struct nhop_object *nat64_find_route6(struct sockaddr_in6 *, 86aa271561SAndrey V. Elsukov struct mbuf *); 87aa271561SAndrey V. Elsukov static int nat64_output_one(struct mbuf *, struct nat64_counters *, void *); 88aa271561SAndrey V. Elsukov static int nat64_output(struct ifnet *, struct mbuf *, struct sockaddr *, 89aa271561SAndrey V. Elsukov struct nat64_counters *, void *); 90aa271561SAndrey V. Elsukov static int nat64_direct_output_one(struct mbuf *, struct nat64_counters *, 91aa271561SAndrey V. Elsukov void *); 92aa271561SAndrey V. Elsukov static int nat64_direct_output(struct ifnet *, struct mbuf *, 93aa271561SAndrey V. Elsukov struct sockaddr *, struct nat64_counters *, void *); 94aa271561SAndrey V. Elsukov 95aa271561SAndrey V. Elsukov struct nat64_methods { 96aa271561SAndrey V. Elsukov nat64_output_t output; 97aa271561SAndrey V. Elsukov nat64_output_one_t output_one; 98aa271561SAndrey V. Elsukov }; 99aa271561SAndrey V. Elsukov static const struct nat64_methods nat64_netisr = { 100aa271561SAndrey V. Elsukov .output = nat64_output, 101aa271561SAndrey V. Elsukov .output_one = nat64_output_one 102aa271561SAndrey V. Elsukov }; 103aa271561SAndrey V. Elsukov static const struct nat64_methods nat64_direct = { 104aa271561SAndrey V. Elsukov .output = nat64_direct_output, 105aa271561SAndrey V. Elsukov .output_one = nat64_direct_output_one 106aa271561SAndrey V. Elsukov }; 10728739809SAndrey V. Elsukov 10828739809SAndrey V. Elsukov /* These variables should be initialized explicitly on module loading */ 10928739809SAndrey V. Elsukov VNET_DEFINE_STATIC(const struct nat64_methods *, nat64out); 11028739809SAndrey V. Elsukov VNET_DEFINE_STATIC(const int *, nat64ipstealth); 11128739809SAndrey V. Elsukov VNET_DEFINE_STATIC(const int *, nat64ip6stealth); 112aa271561SAndrey V. Elsukov #define V_nat64out VNET(nat64out) 11328739809SAndrey V. Elsukov #define V_nat64ipstealth VNET(nat64ipstealth) 11428739809SAndrey V. Elsukov #define V_nat64ip6stealth VNET(nat64ip6stealth) 11528739809SAndrey V. Elsukov 11628739809SAndrey V. Elsukov static const int stealth_on = 1; 11728739809SAndrey V. Elsukov #ifndef IPSTEALTH 11828739809SAndrey V. Elsukov static const int stealth_off = 0; 11928739809SAndrey V. Elsukov #endif 120aa271561SAndrey V. Elsukov 121aa271561SAndrey V. Elsukov void 122aa271561SAndrey V. Elsukov nat64_set_output_method(int direct) 123aa271561SAndrey V. Elsukov { 124aa271561SAndrey V. Elsukov 12528739809SAndrey V. Elsukov if (direct != 0) { 12628739809SAndrey V. Elsukov V_nat64out = &nat64_direct; 12728739809SAndrey V. Elsukov #ifdef IPSTEALTH 12828739809SAndrey V. Elsukov /* Honor corresponding variables, if IPSTEALTH is defined */ 12928739809SAndrey V. Elsukov V_nat64ipstealth = &V_ipstealth; 13028739809SAndrey V. Elsukov V_nat64ip6stealth = &V_ip6stealth; 13128739809SAndrey V. Elsukov #else 13228739809SAndrey V. Elsukov /* otherwise we need to decrement HLIM/TTL for direct case */ 13328739809SAndrey V. Elsukov V_nat64ipstealth = V_nat64ip6stealth = &stealth_off; 13428739809SAndrey V. Elsukov #endif 13528739809SAndrey V. Elsukov } else { 13628739809SAndrey V. Elsukov V_nat64out = &nat64_netisr; 13728739809SAndrey V. Elsukov /* Leave TTL/HLIM decrementing to forwarding code */ 13828739809SAndrey V. Elsukov V_nat64ipstealth = V_nat64ip6stealth = &stealth_on; 13928739809SAndrey V. Elsukov } 140aa271561SAndrey V. Elsukov } 141aa271561SAndrey V. Elsukov 142aa271561SAndrey V. Elsukov int 143aa271561SAndrey V. Elsukov nat64_get_output_method(void) 144aa271561SAndrey V. Elsukov { 145aa271561SAndrey V. Elsukov 146aa271561SAndrey V. Elsukov return (V_nat64out == &nat64_direct ? 1: 0); 147aa271561SAndrey V. Elsukov } 148aa271561SAndrey V. Elsukov 149d8caf56eSAndrey V. Elsukov static void 150d8caf56eSAndrey V. Elsukov nat64_log(struct pfloghdr *logdata, struct mbuf *m, sa_family_t family) 151d8caf56eSAndrey V. Elsukov { 152d8caf56eSAndrey V. Elsukov 153d8caf56eSAndrey V. Elsukov logdata->dir = PF_OUT; 154d8caf56eSAndrey V. Elsukov logdata->af = family; 155d8caf56eSAndrey V. Elsukov ipfw_bpf_mtap2(logdata, PFLOG_HDRLEN, m); 156d8caf56eSAndrey V. Elsukov } 157c570565fSAndrey V. Elsukov 158aa271561SAndrey V. Elsukov static int 159aa271561SAndrey V. Elsukov nat64_direct_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst, 160782360deSAndrey V. Elsukov struct nat64_counters *stats, void *logdata) 161d8caf56eSAndrey V. Elsukov { 162d8caf56eSAndrey V. Elsukov int error; 163d8caf56eSAndrey V. Elsukov 164d8caf56eSAndrey V. Elsukov if (logdata != NULL) 165d8caf56eSAndrey V. Elsukov nat64_log(logdata, m, dst->sa_family); 166782360deSAndrey V. Elsukov error = (*ifp->if_output)(ifp, m, dst, NULL); 167d8caf56eSAndrey V. Elsukov if (error != 0) 168d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, oerrors); 169d8caf56eSAndrey V. Elsukov return (error); 170d8caf56eSAndrey V. Elsukov } 171d8caf56eSAndrey V. Elsukov 172aa271561SAndrey V. Elsukov static int 173aa271561SAndrey V. Elsukov nat64_direct_output_one(struct mbuf *m, struct nat64_counters *stats, 174aa271561SAndrey V. Elsukov void *logdata) 175d8caf56eSAndrey V. Elsukov { 1766ad7446cSAlexander V. Chernikov struct nhop_object *nh4 = NULL; 1776ad7446cSAlexander V. Chernikov struct nhop_object *nh6 = NULL; 178c570565fSAndrey V. Elsukov struct sockaddr_in6 dst6; 179c570565fSAndrey V. Elsukov struct sockaddr_in dst4; 180d8caf56eSAndrey V. Elsukov struct sockaddr *dst; 181d8caf56eSAndrey V. Elsukov struct ip6_hdr *ip6; 182d8caf56eSAndrey V. Elsukov struct ip *ip4; 183c570565fSAndrey V. Elsukov struct ifnet *ifp; 184d8caf56eSAndrey V. Elsukov int error; 185d8caf56eSAndrey V. Elsukov 186d8caf56eSAndrey V. Elsukov ip4 = mtod(m, struct ip *); 1876ad7446cSAlexander V. Chernikov error = 0; 188d8caf56eSAndrey V. Elsukov switch (ip4->ip_v) { 189d8caf56eSAndrey V. Elsukov case IPVERSION: 190c570565fSAndrey V. Elsukov dst4.sin_addr = ip4->ip_dst; 1916ad7446cSAlexander V. Chernikov nh4 = nat64_find_route4(&dst4, m); 1926ad7446cSAlexander V. Chernikov if (nh4 == NULL) { 193d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, noroute4); 1946ad7446cSAlexander V. Chernikov error = EHOSTUNREACH; 1956ad7446cSAlexander V. Chernikov } else { 1966ad7446cSAlexander V. Chernikov ifp = nh4->nh_ifp; 197c570565fSAndrey V. Elsukov dst = (struct sockaddr *)&dst4; 198c570565fSAndrey V. Elsukov } 199d8caf56eSAndrey V. Elsukov break; 200d8caf56eSAndrey V. Elsukov case (IPV6_VERSION >> 4): 201c570565fSAndrey V. Elsukov ip6 = mtod(m, struct ip6_hdr *); 202c570565fSAndrey V. Elsukov dst6.sin6_addr = ip6->ip6_dst; 2036ad7446cSAlexander V. Chernikov nh6 = nat64_find_route6(&dst6, m); 2046ad7446cSAlexander V. Chernikov if (nh6 == NULL) { 205d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, noroute6); 2066ad7446cSAlexander V. Chernikov error = EHOSTUNREACH; 2076ad7446cSAlexander V. Chernikov } else { 2086ad7446cSAlexander V. Chernikov ifp = nh6->nh_ifp; 209c570565fSAndrey V. Elsukov dst = (struct sockaddr *)&dst6; 210c570565fSAndrey V. Elsukov } 211d8caf56eSAndrey V. Elsukov break; 212d8caf56eSAndrey V. Elsukov default: 213d8caf56eSAndrey V. Elsukov m_freem(m); 214d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, dropped); 215d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "dropped due to unknown IP version"); 216d8caf56eSAndrey V. Elsukov return (EAFNOSUPPORT); 217d8caf56eSAndrey V. Elsukov } 218c570565fSAndrey V. Elsukov if (error != 0) { 219d8caf56eSAndrey V. Elsukov m_freem(m); 220d8caf56eSAndrey V. Elsukov return (EHOSTUNREACH); 221d8caf56eSAndrey V. Elsukov } 222d8caf56eSAndrey V. Elsukov if (logdata != NULL) 223d8caf56eSAndrey V. Elsukov nat64_log(logdata, m, dst->sa_family); 224c570565fSAndrey V. Elsukov error = (*ifp->if_output)(ifp, m, dst, NULL); 225d8caf56eSAndrey V. Elsukov if (error != 0) 226d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, oerrors); 227d8caf56eSAndrey V. Elsukov return (error); 228d8caf56eSAndrey V. Elsukov } 229aa271561SAndrey V. Elsukov 230aa271561SAndrey V. Elsukov static int 231782360deSAndrey V. Elsukov nat64_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst, 232782360deSAndrey V. Elsukov struct nat64_counters *stats, void *logdata) 233d8caf56eSAndrey V. Elsukov { 234d8caf56eSAndrey V. Elsukov struct ip *ip4; 235d8caf56eSAndrey V. Elsukov int ret, af; 236d8caf56eSAndrey V. Elsukov 237d8caf56eSAndrey V. Elsukov ip4 = mtod(m, struct ip *); 238d8caf56eSAndrey V. Elsukov switch (ip4->ip_v) { 239d8caf56eSAndrey V. Elsukov case IPVERSION: 240d8caf56eSAndrey V. Elsukov af = AF_INET; 241d8caf56eSAndrey V. Elsukov ret = NETISR_IP; 242d8caf56eSAndrey V. Elsukov break; 243d8caf56eSAndrey V. Elsukov case (IPV6_VERSION >> 4): 244d8caf56eSAndrey V. Elsukov af = AF_INET6; 245d8caf56eSAndrey V. Elsukov ret = NETISR_IPV6; 246d8caf56eSAndrey V. Elsukov break; 247d8caf56eSAndrey V. Elsukov default: 248d8caf56eSAndrey V. Elsukov m_freem(m); 249d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, dropped); 250d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "unknown IP version"); 251d8caf56eSAndrey V. Elsukov return (EAFNOSUPPORT); 252d8caf56eSAndrey V. Elsukov } 253d8caf56eSAndrey V. Elsukov if (logdata != NULL) 254d8caf56eSAndrey V. Elsukov nat64_log(logdata, m, af); 255d7622795SAndrey V. Elsukov if (m->m_pkthdr.rcvif == NULL) 256d7622795SAndrey V. Elsukov m->m_pkthdr.rcvif = V_loif; 257d8caf56eSAndrey V. Elsukov ret = netisr_queue(ret, m); 258d8caf56eSAndrey V. Elsukov if (ret != 0) 259d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, oerrors); 260d8caf56eSAndrey V. Elsukov return (ret); 261d8caf56eSAndrey V. Elsukov } 262d8caf56eSAndrey V. Elsukov 263aa271561SAndrey V. Elsukov static int 264782360deSAndrey V. Elsukov nat64_output_one(struct mbuf *m, struct nat64_counters *stats, void *logdata) 265d8caf56eSAndrey V. Elsukov { 266d8caf56eSAndrey V. Elsukov 267782360deSAndrey V. Elsukov return (nat64_output(NULL, m, NULL, stats, logdata)); 268d8caf56eSAndrey V. Elsukov } 269d8caf56eSAndrey V. Elsukov 270782360deSAndrey V. Elsukov /* 271782360deSAndrey V. Elsukov * Check the given IPv6 prefix and length according to RFC6052: 272782360deSAndrey V. Elsukov * The prefixes can only have one of the following lengths: 273782360deSAndrey V. Elsukov * 32, 40, 48, 56, 64, or 96 (The Well-Known Prefix is 96 bits long). 274782360deSAndrey V. Elsukov * Returns zero on success, otherwise EINVAL. 275782360deSAndrey V. Elsukov */ 276782360deSAndrey V. Elsukov int 277b11efc1eSAndrey V. Elsukov nat64_check_prefixlen(int length) 278d8caf56eSAndrey V. Elsukov { 279d8caf56eSAndrey V. Elsukov 280782360deSAndrey V. Elsukov switch (length) { 281782360deSAndrey V. Elsukov case 32: 282782360deSAndrey V. Elsukov case 40: 283782360deSAndrey V. Elsukov case 48: 284782360deSAndrey V. Elsukov case 56: 285782360deSAndrey V. Elsukov case 64: 286782360deSAndrey V. Elsukov case 96: 287b11efc1eSAndrey V. Elsukov return (0); 288b11efc1eSAndrey V. Elsukov } 289b11efc1eSAndrey V. Elsukov return (EINVAL); 290b11efc1eSAndrey V. Elsukov } 291b11efc1eSAndrey V. Elsukov 292b11efc1eSAndrey V. Elsukov int 293b11efc1eSAndrey V. Elsukov nat64_check_prefix6(const struct in6_addr *prefix, int length) 294b11efc1eSAndrey V. Elsukov { 295b11efc1eSAndrey V. Elsukov 296b11efc1eSAndrey V. Elsukov if (nat64_check_prefixlen(length) != 0) 297b11efc1eSAndrey V. Elsukov return (EINVAL); 298b11efc1eSAndrey V. Elsukov 299b11efc1eSAndrey V. Elsukov /* Well-known prefix has 96 prefix length */ 300b11efc1eSAndrey V. Elsukov if (IN6_IS_ADDR_WKPFX(prefix) && length != 96) 301b11efc1eSAndrey V. Elsukov return (EINVAL); 302b11efc1eSAndrey V. Elsukov 303782360deSAndrey V. Elsukov /* Bits 64 to 71 must be set to zero */ 304782360deSAndrey V. Elsukov if (prefix->__u6_addr.__u6_addr8[8] != 0) 305782360deSAndrey V. Elsukov return (EINVAL); 306b11efc1eSAndrey V. Elsukov 307782360deSAndrey V. Elsukov /* Some extra checks */ 308782360deSAndrey V. Elsukov if (IN6_IS_ADDR_MULTICAST(prefix) || 309782360deSAndrey V. Elsukov IN6_IS_ADDR_UNSPECIFIED(prefix) || 310782360deSAndrey V. Elsukov IN6_IS_ADDR_LOOPBACK(prefix)) 311782360deSAndrey V. Elsukov return (EINVAL); 312782360deSAndrey V. Elsukov return (0); 313782360deSAndrey V. Elsukov } 314d8caf56eSAndrey V. Elsukov 315782360deSAndrey V. Elsukov int 316782360deSAndrey V. Elsukov nat64_check_private_ip4(const struct nat64_config *cfg, in_addr_t ia) 317d8caf56eSAndrey V. Elsukov { 318d8caf56eSAndrey V. Elsukov 319b11efc1eSAndrey V. Elsukov if (cfg->flags & NAT64_ALLOW_PRIVATE) 320782360deSAndrey V. Elsukov return (0); 321782360deSAndrey V. Elsukov 322782360deSAndrey V. Elsukov /* WKPFX must not be used to represent non-global IPv4 addresses */ 323782360deSAndrey V. Elsukov if (cfg->flags & NAT64_WKPFX) { 324782360deSAndrey V. Elsukov /* IN_PRIVATE */ 325782360deSAndrey V. Elsukov if ((ia & htonl(0xff000000)) == htonl(0x0a000000) || 326782360deSAndrey V. Elsukov (ia & htonl(0xfff00000)) == htonl(0xac100000) || 327782360deSAndrey V. Elsukov (ia & htonl(0xffff0000)) == htonl(0xc0a80000)) 328782360deSAndrey V. Elsukov return (1); 329782360deSAndrey V. Elsukov /* 330782360deSAndrey V. Elsukov * RFC 5735: 331782360deSAndrey V. Elsukov * 192.0.0.0/24 - reserved for IETF protocol assignments 332782360deSAndrey V. Elsukov * 192.88.99.0/24 - for use as 6to4 relay anycast addresses 333782360deSAndrey V. Elsukov * 198.18.0.0/15 - for use in benchmark tests 334782360deSAndrey V. Elsukov * 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 - for use 335782360deSAndrey V. Elsukov * in documentation and example code 336782360deSAndrey V. Elsukov */ 337782360deSAndrey V. Elsukov if ((ia & htonl(0xffffff00)) == htonl(0xc0000000) || 338782360deSAndrey V. Elsukov (ia & htonl(0xffffff00)) == htonl(0xc0586300) || 339782360deSAndrey V. Elsukov (ia & htonl(0xfffffe00)) == htonl(0xc6120000) || 340782360deSAndrey V. Elsukov (ia & htonl(0xffffff00)) == htonl(0xc0000200) || 341782360deSAndrey V. Elsukov (ia & htonl(0xfffffe00)) == htonl(0xc6336400) || 342782360deSAndrey V. Elsukov (ia & htonl(0xffffff00)) == htonl(0xcb007100)) 343782360deSAndrey V. Elsukov return (1); 344782360deSAndrey V. Elsukov } 345782360deSAndrey V. Elsukov return (0); 346782360deSAndrey V. Elsukov } 347782360deSAndrey V. Elsukov 348b11efc1eSAndrey V. Elsukov /* 349b11efc1eSAndrey V. Elsukov * Embed @ia IPv4 address into @ip6 IPv6 address. 350b11efc1eSAndrey V. Elsukov * Place to embedding determined from prefix length @plen. 351b11efc1eSAndrey V. Elsukov */ 352782360deSAndrey V. Elsukov void 353b11efc1eSAndrey V. Elsukov nat64_embed_ip4(struct in6_addr *ip6, int plen, in_addr_t ia) 354782360deSAndrey V. Elsukov { 355782360deSAndrey V. Elsukov 356b11efc1eSAndrey V. Elsukov switch (plen) { 357d8caf56eSAndrey V. Elsukov case 32: 358d8caf56eSAndrey V. Elsukov case 96: 359b11efc1eSAndrey V. Elsukov ip6->s6_addr32[plen / 32] = ia; 360d8caf56eSAndrey V. Elsukov break; 361d8caf56eSAndrey V. Elsukov case 40: 362d8caf56eSAndrey V. Elsukov case 48: 363d8caf56eSAndrey V. Elsukov case 56: 364b11efc1eSAndrey V. Elsukov /* 365b11efc1eSAndrey V. Elsukov * Preserve prefix bits. 366b11efc1eSAndrey V. Elsukov * Since suffix bits should be zero and reserved for future 367b11efc1eSAndrey V. Elsukov * use, we just overwrite the whole word, where they are. 368b11efc1eSAndrey V. Elsukov */ 369b11efc1eSAndrey V. Elsukov ip6->s6_addr32[1] &= 0xffffffff << (32 - plen % 32); 370d8caf56eSAndrey V. Elsukov #if BYTE_ORDER == BIG_ENDIAN 371b11efc1eSAndrey V. Elsukov ip6->s6_addr32[1] |= ia >> (plen % 32); 372b11efc1eSAndrey V. Elsukov ip6->s6_addr32[2] = ia << (24 - plen % 32); 373d8caf56eSAndrey V. Elsukov #elif BYTE_ORDER == LITTLE_ENDIAN 374b11efc1eSAndrey V. Elsukov ip6->s6_addr32[1] |= ia << (plen % 32); 375b11efc1eSAndrey V. Elsukov ip6->s6_addr32[2] = ia >> (24 - plen % 32); 376d8caf56eSAndrey V. Elsukov #endif 377d8caf56eSAndrey V. Elsukov break; 378d8caf56eSAndrey V. Elsukov case 64: 379d8caf56eSAndrey V. Elsukov #if BYTE_ORDER == BIG_ENDIAN 380d8caf56eSAndrey V. Elsukov ip6->s6_addr32[2] = ia >> 8; 381d8caf56eSAndrey V. Elsukov ip6->s6_addr32[3] = ia << 24; 382d8caf56eSAndrey V. Elsukov #elif BYTE_ORDER == LITTLE_ENDIAN 383d8caf56eSAndrey V. Elsukov ip6->s6_addr32[2] = ia << 8; 384d8caf56eSAndrey V. Elsukov ip6->s6_addr32[3] = ia >> 24; 385d8caf56eSAndrey V. Elsukov #endif 386d8caf56eSAndrey V. Elsukov break; 387d8caf56eSAndrey V. Elsukov default: 388b11efc1eSAndrey V. Elsukov panic("Wrong plen: %d", plen); 389d8caf56eSAndrey V. Elsukov }; 390b11efc1eSAndrey V. Elsukov /* 391b11efc1eSAndrey V. Elsukov * Bits 64 to 71 of the address are reserved for compatibility 392b11efc1eSAndrey V. Elsukov * with the host identifier format defined in the IPv6 addressing 393b11efc1eSAndrey V. Elsukov * architecture [RFC4291]. These bits MUST be set to zero. 394b11efc1eSAndrey V. Elsukov */ 395d8caf56eSAndrey V. Elsukov ip6->s6_addr8[8] = 0; 396d8caf56eSAndrey V. Elsukov } 397d8caf56eSAndrey V. Elsukov 398782360deSAndrey V. Elsukov in_addr_t 399b11efc1eSAndrey V. Elsukov nat64_extract_ip4(const struct in6_addr *ip6, int plen) 400d8caf56eSAndrey V. Elsukov { 401d8caf56eSAndrey V. Elsukov in_addr_t ia; 402d8caf56eSAndrey V. Elsukov 403d8caf56eSAndrey V. Elsukov /* 404d8caf56eSAndrey V. Elsukov * According to RFC 6052 p2.2: 405d8caf56eSAndrey V. Elsukov * IPv4-embedded IPv6 addresses are composed of a variable-length 406d8caf56eSAndrey V. Elsukov * prefix, the embedded IPv4 address, and a variable length suffix. 407d8caf56eSAndrey V. Elsukov * The suffix bits are reserved for future extensions and SHOULD 408d8caf56eSAndrey V. Elsukov * be set to zero. 409d8caf56eSAndrey V. Elsukov */ 410b11efc1eSAndrey V. Elsukov switch (plen) { 411d8caf56eSAndrey V. Elsukov case 32: 412d8caf56eSAndrey V. Elsukov if (ip6->s6_addr32[3] != 0 || ip6->s6_addr32[2] != 0) 413d8caf56eSAndrey V. Elsukov goto badip6; 414d8caf56eSAndrey V. Elsukov break; 415d8caf56eSAndrey V. Elsukov case 40: 416d8caf56eSAndrey V. Elsukov if (ip6->s6_addr32[3] != 0 || 417d8caf56eSAndrey V. Elsukov (ip6->s6_addr32[2] & htonl(0xff00ffff)) != 0) 418d8caf56eSAndrey V. Elsukov goto badip6; 419d8caf56eSAndrey V. Elsukov break; 420d8caf56eSAndrey V. Elsukov case 48: 421d8caf56eSAndrey V. Elsukov if (ip6->s6_addr32[3] != 0 || 422d8caf56eSAndrey V. Elsukov (ip6->s6_addr32[2] & htonl(0xff0000ff)) != 0) 423d8caf56eSAndrey V. Elsukov goto badip6; 424d8caf56eSAndrey V. Elsukov break; 425d8caf56eSAndrey V. Elsukov case 56: 426d8caf56eSAndrey V. Elsukov if (ip6->s6_addr32[3] != 0 || ip6->s6_addr8[8] != 0) 427d8caf56eSAndrey V. Elsukov goto badip6; 428d8caf56eSAndrey V. Elsukov break; 429d8caf56eSAndrey V. Elsukov case 64: 430d8caf56eSAndrey V. Elsukov if (ip6->s6_addr8[8] != 0 || 431d8caf56eSAndrey V. Elsukov (ip6->s6_addr32[3] & htonl(0x00ffffff)) != 0) 432d8caf56eSAndrey V. Elsukov goto badip6; 433d8caf56eSAndrey V. Elsukov }; 434b11efc1eSAndrey V. Elsukov switch (plen) { 435d8caf56eSAndrey V. Elsukov case 32: 436d8caf56eSAndrey V. Elsukov case 96: 437b11efc1eSAndrey V. Elsukov ia = ip6->s6_addr32[plen / 32]; 438d8caf56eSAndrey V. Elsukov break; 439d8caf56eSAndrey V. Elsukov case 40: 440d8caf56eSAndrey V. Elsukov case 48: 441d8caf56eSAndrey V. Elsukov case 56: 442d8caf56eSAndrey V. Elsukov #if BYTE_ORDER == BIG_ENDIAN 443b11efc1eSAndrey V. Elsukov ia = (ip6->s6_addr32[1] << (plen % 32)) | 444b11efc1eSAndrey V. Elsukov (ip6->s6_addr32[2] >> (24 - plen % 32)); 445d8caf56eSAndrey V. Elsukov #elif BYTE_ORDER == LITTLE_ENDIAN 446b11efc1eSAndrey V. Elsukov ia = (ip6->s6_addr32[1] >> (plen % 32)) | 447b11efc1eSAndrey V. Elsukov (ip6->s6_addr32[2] << (24 - plen % 32)); 448d8caf56eSAndrey V. Elsukov #endif 449d8caf56eSAndrey V. Elsukov break; 450d8caf56eSAndrey V. Elsukov case 64: 451d8caf56eSAndrey V. Elsukov #if BYTE_ORDER == BIG_ENDIAN 452d8caf56eSAndrey V. Elsukov ia = (ip6->s6_addr32[2] << 8) | (ip6->s6_addr32[3] >> 24); 453d8caf56eSAndrey V. Elsukov #elif BYTE_ORDER == LITTLE_ENDIAN 454d8caf56eSAndrey V. Elsukov ia = (ip6->s6_addr32[2] >> 8) | (ip6->s6_addr32[3] << 24); 455d8caf56eSAndrey V. Elsukov #endif 456d8caf56eSAndrey V. Elsukov break; 457d8caf56eSAndrey V. Elsukov default: 458d8caf56eSAndrey V. Elsukov return (0); 459d8caf56eSAndrey V. Elsukov }; 460b11efc1eSAndrey V. Elsukov if (nat64_check_ip4(ia) == 0) 461d8caf56eSAndrey V. Elsukov return (ia); 462b11efc1eSAndrey V. Elsukov 463782360deSAndrey V. Elsukov DPRINTF(DP_GENERIC | DP_DROPS, 464782360deSAndrey V. Elsukov "invalid destination address: %08x", ia); 465d8caf56eSAndrey V. Elsukov return (0); 466d8caf56eSAndrey V. Elsukov badip6: 467782360deSAndrey V. Elsukov DPRINTF(DP_GENERIC | DP_DROPS, "invalid IPv4-embedded IPv6 address"); 468d8caf56eSAndrey V. Elsukov return (0); 469d8caf56eSAndrey V. Elsukov } 470d8caf56eSAndrey V. Elsukov 471d8caf56eSAndrey V. Elsukov /* 472d8caf56eSAndrey V. Elsukov * According to RFC 1624 the equation for incremental checksum update is: 473d8caf56eSAndrey V. Elsukov * HC' = ~(~HC + ~m + m') -- [Eqn. 3] 474d8caf56eSAndrey V. Elsukov * HC' = HC - ~m - m' -- [Eqn. 4] 475d8caf56eSAndrey V. Elsukov * So, when we are replacing IPv4 addresses to IPv6, we 476d8caf56eSAndrey V. Elsukov * can assume, that new bytes previously were zeros, and vise versa - 477d8caf56eSAndrey V. Elsukov * when we replacing IPv6 addresses to IPv4, now unused bytes become 478d8caf56eSAndrey V. Elsukov * zeros. The payload length in pseudo header has bigger size, but one 479d8caf56eSAndrey V. Elsukov * half of it should be zero. Using the equation 4 we get: 480d8caf56eSAndrey V. Elsukov * HC' = HC - (~m0 + m0') -- m0 is first changed word 481d8caf56eSAndrey V. Elsukov * HC' = (HC - (~m0 + m0')) - (~m1 + m1') -- m1 is second changed word 482d8caf56eSAndrey V. Elsukov * HC' = HC - ~m0 - m0' - ~m1 - m1' - ... = 483d8caf56eSAndrey V. Elsukov * = HC - sum(~m[i] + m'[i]) 484d8caf56eSAndrey V. Elsukov * 485d8caf56eSAndrey V. Elsukov * The function result should be used as follows: 486d8caf56eSAndrey V. Elsukov * IPv6 to IPv4: HC' = cksum_add(HC, result) 487d8caf56eSAndrey V. Elsukov * IPv4 to IPv6: HC' = cksum_add(HC, ~result) 488d8caf56eSAndrey V. Elsukov */ 489b11efc1eSAndrey V. Elsukov static uint16_t 490d8caf56eSAndrey V. Elsukov nat64_cksum_convert(struct ip6_hdr *ip6, struct ip *ip) 491d8caf56eSAndrey V. Elsukov { 492d8caf56eSAndrey V. Elsukov uint32_t sum; 493d8caf56eSAndrey V. Elsukov uint16_t *p; 494d8caf56eSAndrey V. Elsukov 495d8caf56eSAndrey V. Elsukov sum = ~ip->ip_src.s_addr >> 16; 496d8caf56eSAndrey V. Elsukov sum += ~ip->ip_src.s_addr & 0xffff; 497d8caf56eSAndrey V. Elsukov sum += ~ip->ip_dst.s_addr >> 16; 498d8caf56eSAndrey V. Elsukov sum += ~ip->ip_dst.s_addr & 0xffff; 499d8caf56eSAndrey V. Elsukov 500d8caf56eSAndrey V. Elsukov for (p = (uint16_t *)&ip6->ip6_src; 501d8caf56eSAndrey V. Elsukov p < (uint16_t *)(&ip6->ip6_src + 2); p++) 502d8caf56eSAndrey V. Elsukov sum += *p; 503d8caf56eSAndrey V. Elsukov 504d8caf56eSAndrey V. Elsukov while (sum >> 16) 505d8caf56eSAndrey V. Elsukov sum = (sum & 0xffff) + (sum >> 16); 506d8caf56eSAndrey V. Elsukov return (sum); 507d8caf56eSAndrey V. Elsukov } 508d8caf56eSAndrey V. Elsukov 509b11efc1eSAndrey V. Elsukov static void 510d8caf56eSAndrey V. Elsukov nat64_init_ip4hdr(const struct ip6_hdr *ip6, const struct ip6_frag *frag, 511d8caf56eSAndrey V. Elsukov uint16_t plen, uint8_t proto, struct ip *ip) 512d8caf56eSAndrey V. Elsukov { 513d8caf56eSAndrey V. Elsukov 514d8caf56eSAndrey V. Elsukov /* assume addresses are already initialized */ 515d8caf56eSAndrey V. Elsukov ip->ip_v = IPVERSION; 516d8caf56eSAndrey V. Elsukov ip->ip_hl = sizeof(*ip) >> 2; 517d8caf56eSAndrey V. Elsukov ip->ip_tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 518d8caf56eSAndrey V. Elsukov ip->ip_len = htons(sizeof(*ip) + plen); 519d8caf56eSAndrey V. Elsukov ip->ip_ttl = ip6->ip6_hlim; 52028739809SAndrey V. Elsukov if (*V_nat64ip6stealth == 0) 521aa271561SAndrey V. Elsukov ip->ip_ttl -= IPV6_HLIMDEC; 522d8caf56eSAndrey V. Elsukov ip->ip_sum = 0; 523d8caf56eSAndrey V. Elsukov ip->ip_p = (proto == IPPROTO_ICMPV6) ? IPPROTO_ICMP: proto; 524d8caf56eSAndrey V. Elsukov ip_fillid(ip); 525d8caf56eSAndrey V. Elsukov if (frag != NULL) { 526d8caf56eSAndrey V. Elsukov ip->ip_off = htons(ntohs(frag->ip6f_offlg) >> 3); 527d8caf56eSAndrey V. Elsukov if (frag->ip6f_offlg & IP6F_MORE_FRAG) 528d8caf56eSAndrey V. Elsukov ip->ip_off |= htons(IP_MF); 529d8caf56eSAndrey V. Elsukov } else { 530d8caf56eSAndrey V. Elsukov ip->ip_off = htons(IP_DF); 531d8caf56eSAndrey V. Elsukov } 532d8caf56eSAndrey V. Elsukov ip->ip_sum = in_cksum_hdr(ip); 533d8caf56eSAndrey V. Elsukov } 534d8caf56eSAndrey V. Elsukov 535d8caf56eSAndrey V. Elsukov #define FRAGSZ(mtu) ((mtu) - sizeof(struct ip6_hdr) - sizeof(struct ip6_frag)) 536c402a01bSAndrey V. Elsukov static NAT64NOINLINE int 537782360deSAndrey V. Elsukov nat64_fragment6(struct nat64_counters *stats, struct ip6_hdr *ip6, 538782360deSAndrey V. Elsukov struct mbufq *mq, struct mbuf *m, uint32_t mtu, uint16_t ip_id, 539782360deSAndrey V. Elsukov uint16_t ip_off) 540d8caf56eSAndrey V. Elsukov { 541d8caf56eSAndrey V. Elsukov struct ip6_frag ip6f; 542d8caf56eSAndrey V. Elsukov struct mbuf *n; 543d8caf56eSAndrey V. Elsukov uint16_t hlen, len, offset; 544d8caf56eSAndrey V. Elsukov int plen; 545d8caf56eSAndrey V. Elsukov 546d8caf56eSAndrey V. Elsukov plen = ntohs(ip6->ip6_plen); 547d8caf56eSAndrey V. Elsukov hlen = sizeof(struct ip6_hdr); 548d8caf56eSAndrey V. Elsukov 549d8caf56eSAndrey V. Elsukov /* Fragmentation isn't needed */ 550d8caf56eSAndrey V. Elsukov if (ip_off == 0 && plen <= mtu - hlen) { 551d8caf56eSAndrey V. Elsukov M_PREPEND(m, hlen, M_NOWAIT); 552d8caf56eSAndrey V. Elsukov if (m == NULL) { 553d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, nomem); 554d8caf56eSAndrey V. Elsukov return (ENOMEM); 555d8caf56eSAndrey V. Elsukov } 556d8caf56eSAndrey V. Elsukov bcopy(ip6, mtod(m, void *), hlen); 557d8caf56eSAndrey V. Elsukov if (mbufq_enqueue(mq, m) != 0) { 558d8caf56eSAndrey V. Elsukov m_freem(m); 559d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, dropped); 560d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "dropped due to mbufq overflow"); 561d8caf56eSAndrey V. Elsukov return (ENOBUFS); 562d8caf56eSAndrey V. Elsukov } 563d8caf56eSAndrey V. Elsukov return (0); 564d8caf56eSAndrey V. Elsukov } 565d8caf56eSAndrey V. Elsukov 566d8caf56eSAndrey V. Elsukov hlen += sizeof(struct ip6_frag); 567d8caf56eSAndrey V. Elsukov ip6f.ip6f_reserved = 0; 568d8caf56eSAndrey V. Elsukov ip6f.ip6f_nxt = ip6->ip6_nxt; 569d8caf56eSAndrey V. Elsukov ip6->ip6_nxt = IPPROTO_FRAGMENT; 570d8caf56eSAndrey V. Elsukov if (ip_off != 0) { 571d8caf56eSAndrey V. Elsukov /* 572d8caf56eSAndrey V. Elsukov * We have got an IPv4 fragment. 573d8caf56eSAndrey V. Elsukov * Use offset value and ip_id from original fragment. 574d8caf56eSAndrey V. Elsukov */ 575d8caf56eSAndrey V. Elsukov ip6f.ip6f_ident = htonl(ntohs(ip_id)); 576d8caf56eSAndrey V. Elsukov offset = (ntohs(ip_off) & IP_OFFMASK) << 3; 577d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, ifrags); 578d8caf56eSAndrey V. Elsukov } else { 579d8caf56eSAndrey V. Elsukov /* The packet size exceeds interface MTU */ 580d8caf56eSAndrey V. Elsukov ip6f.ip6f_ident = htonl(ip6_randomid()); 581d8caf56eSAndrey V. Elsukov offset = 0; /* First fragment*/ 582d8caf56eSAndrey V. Elsukov } 583d8caf56eSAndrey V. Elsukov while (plen > 0 && m != NULL) { 584d8caf56eSAndrey V. Elsukov n = NULL; 585d8caf56eSAndrey V. Elsukov len = FRAGSZ(mtu) & ~7; 586d8caf56eSAndrey V. Elsukov if (len > plen) 587d8caf56eSAndrey V. Elsukov len = plen; 588d8caf56eSAndrey V. Elsukov ip6->ip6_plen = htons(len + sizeof(ip6f)); 589d8caf56eSAndrey V. Elsukov ip6f.ip6f_offlg = ntohs(offset); 590d8caf56eSAndrey V. Elsukov if (len < plen || (ip_off & htons(IP_MF)) != 0) 591d8caf56eSAndrey V. Elsukov ip6f.ip6f_offlg |= IP6F_MORE_FRAG; 592d8caf56eSAndrey V. Elsukov offset += len; 593d8caf56eSAndrey V. Elsukov plen -= len; 594d8caf56eSAndrey V. Elsukov if (plen > 0) { 595d8caf56eSAndrey V. Elsukov n = m_split(m, len, M_NOWAIT); 596d8caf56eSAndrey V. Elsukov if (n == NULL) 597d8caf56eSAndrey V. Elsukov goto fail; 598d8caf56eSAndrey V. Elsukov } 599d8caf56eSAndrey V. Elsukov M_PREPEND(m, hlen, M_NOWAIT); 600d8caf56eSAndrey V. Elsukov if (m == NULL) 601d8caf56eSAndrey V. Elsukov goto fail; 602d8caf56eSAndrey V. Elsukov bcopy(ip6, mtod(m, void *), sizeof(struct ip6_hdr)); 603d8caf56eSAndrey V. Elsukov bcopy(&ip6f, mtodo(m, sizeof(struct ip6_hdr)), 604d8caf56eSAndrey V. Elsukov sizeof(struct ip6_frag)); 605d8caf56eSAndrey V. Elsukov if (mbufq_enqueue(mq, m) != 0) 606d8caf56eSAndrey V. Elsukov goto fail; 607d8caf56eSAndrey V. Elsukov m = n; 608d8caf56eSAndrey V. Elsukov } 609d8caf56eSAndrey V. Elsukov NAT64STAT_ADD(stats, ofrags, mbufq_len(mq)); 610d8caf56eSAndrey V. Elsukov return (0); 611d8caf56eSAndrey V. Elsukov fail: 612d8caf56eSAndrey V. Elsukov if (m != NULL) 613d8caf56eSAndrey V. Elsukov m_freem(m); 614d8caf56eSAndrey V. Elsukov if (n != NULL) 615d8caf56eSAndrey V. Elsukov m_freem(n); 616d8caf56eSAndrey V. Elsukov mbufq_drain(mq); 617d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, nomem); 618d8caf56eSAndrey V. Elsukov return (ENOMEM); 619d8caf56eSAndrey V. Elsukov } 620d8caf56eSAndrey V. Elsukov 6216ad7446cSAlexander V. Chernikov static struct nhop_object * 6226ad7446cSAlexander V. Chernikov nat64_find_route6(struct sockaddr_in6 *dst, struct mbuf *m) 623d8caf56eSAndrey V. Elsukov { 6246ad7446cSAlexander V. Chernikov struct nhop_object *nh; 6256ad7446cSAlexander V. Chernikov NET_EPOCH_ASSERT(); 6266ad7446cSAlexander V. Chernikov nh = fib6_lookup(M_GETFIB(m), &dst->sin6_addr, 0, 0, 0); 6276ad7446cSAlexander V. Chernikov if (nh == NULL) 6286ad7446cSAlexander V. Chernikov return NULL; 6296ad7446cSAlexander V. Chernikov if (nh->nh_flags & (NHF_BLACKHOLE | NHF_REJECT)) 6306ad7446cSAlexander V. Chernikov return NULL; 631c570565fSAndrey V. Elsukov /* 632c570565fSAndrey V. Elsukov * XXX: we need to use destination address with embedded scope 633c570565fSAndrey V. Elsukov * zone id, because LLTABLE uses such form of addresses for lookup. 634c570565fSAndrey V. Elsukov */ 635d8caf56eSAndrey V. Elsukov dst->sin6_family = AF_INET6; 636d8caf56eSAndrey V. Elsukov dst->sin6_len = sizeof(*dst); 6376ad7446cSAlexander V. Chernikov dst->sin6_addr = ifatoia6(nh->nh_ifa)->ia_addr.sin6_addr; 638c570565fSAndrey V. Elsukov if (IN6_IS_SCOPE_LINKLOCAL(&dst->sin6_addr)) 639c570565fSAndrey V. Elsukov dst->sin6_addr.s6_addr16[1] = 6406ad7446cSAlexander V. Chernikov htons(nh->nh_ifp->if_index & 0xffff); 641c570565fSAndrey V. Elsukov dst->sin6_port = 0; 642c570565fSAndrey V. Elsukov dst->sin6_scope_id = 0; 643c570565fSAndrey V. Elsukov dst->sin6_flowinfo = 0; 644c570565fSAndrey V. Elsukov 6456ad7446cSAlexander V. Chernikov return nh; 646d8caf56eSAndrey V. Elsukov } 647d8caf56eSAndrey V. Elsukov 648d8caf56eSAndrey V. Elsukov #define NAT64_ICMP6_PLEN 64 649c402a01bSAndrey V. Elsukov static NAT64NOINLINE void 650d8caf56eSAndrey V. Elsukov nat64_icmp6_reflect(struct mbuf *m, uint8_t type, uint8_t code, uint32_t mtu, 651782360deSAndrey V. Elsukov struct nat64_counters *stats, void *logdata) 652d8caf56eSAndrey V. Elsukov { 653d8caf56eSAndrey V. Elsukov struct icmp6_hdr *icmp6; 654d8caf56eSAndrey V. Elsukov struct ip6_hdr *ip6, *oip6; 655d8caf56eSAndrey V. Elsukov struct mbuf *n; 65628739809SAndrey V. Elsukov int len, plen, proto; 657d8caf56eSAndrey V. Elsukov 658d8caf56eSAndrey V. Elsukov len = 0; 65928739809SAndrey V. Elsukov proto = nat64_getlasthdr(m, &len); 66028739809SAndrey V. Elsukov if (proto < 0) { 661d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "mbuf isn't contigious"); 662d8caf56eSAndrey V. Elsukov goto freeit; 663d8caf56eSAndrey V. Elsukov } 664d8caf56eSAndrey V. Elsukov /* 665d8caf56eSAndrey V. Elsukov * Do not send ICMPv6 in reply to ICMPv6 errors. 666d8caf56eSAndrey V. Elsukov */ 66728739809SAndrey V. Elsukov if (proto == IPPROTO_ICMPV6) { 668d8caf56eSAndrey V. Elsukov if (m->m_len < len + sizeof(*icmp6)) { 669d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "mbuf isn't contigious"); 670d8caf56eSAndrey V. Elsukov goto freeit; 671d8caf56eSAndrey V. Elsukov } 672d8caf56eSAndrey V. Elsukov icmp6 = mtodo(m, len); 673d8caf56eSAndrey V. Elsukov if (icmp6->icmp6_type < ICMP6_ECHO_REQUEST || 674d8caf56eSAndrey V. Elsukov icmp6->icmp6_type == ND_REDIRECT) { 675d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "do not send ICMPv6 in reply to " 676d8caf56eSAndrey V. Elsukov "ICMPv6 errors"); 677d8caf56eSAndrey V. Elsukov goto freeit; 678d8caf56eSAndrey V. Elsukov } 67928739809SAndrey V. Elsukov /* 68028739809SAndrey V. Elsukov * If there are extra headers between IPv6 and ICMPv6, 68128739809SAndrey V. Elsukov * strip off them. 68228739809SAndrey V. Elsukov */ 68328739809SAndrey V. Elsukov if (len > sizeof(struct ip6_hdr)) { 68428739809SAndrey V. Elsukov /* 68528739809SAndrey V. Elsukov * NOTE: ipfw_chk already did m_pullup() and it is 68628739809SAndrey V. Elsukov * expected that data is contigious from the start 68728739809SAndrey V. Elsukov * of IPv6 header up to the end of ICMPv6 header. 68828739809SAndrey V. Elsukov */ 68928739809SAndrey V. Elsukov bcopy(mtod(m, caddr_t), 69028739809SAndrey V. Elsukov mtodo(m, len - sizeof(struct ip6_hdr)), 69128739809SAndrey V. Elsukov sizeof(struct ip6_hdr)); 69228739809SAndrey V. Elsukov m_adj(m, len - sizeof(struct ip6_hdr)); 69328739809SAndrey V. Elsukov } 694d8caf56eSAndrey V. Elsukov } 695d8caf56eSAndrey V. Elsukov /* 696d8caf56eSAndrey V. Elsukov if (icmp6_ratelimit(&ip6->ip6_src, type, code)) 697d8caf56eSAndrey V. Elsukov goto freeit; 698d8caf56eSAndrey V. Elsukov */ 699d8caf56eSAndrey V. Elsukov ip6 = mtod(m, struct ip6_hdr *); 700d8caf56eSAndrey V. Elsukov switch (type) { 701d8caf56eSAndrey V. Elsukov case ICMP6_DST_UNREACH: 702d8caf56eSAndrey V. Elsukov case ICMP6_PACKET_TOO_BIG: 703d8caf56eSAndrey V. Elsukov case ICMP6_TIME_EXCEEDED: 704d8caf56eSAndrey V. Elsukov case ICMP6_PARAM_PROB: 705d8caf56eSAndrey V. Elsukov break; 706d8caf56eSAndrey V. Elsukov default: 707d8caf56eSAndrey V. Elsukov goto freeit; 708d8caf56eSAndrey V. Elsukov } 709d8caf56eSAndrey V. Elsukov /* Calculate length of ICMPv6 payload */ 710d8caf56eSAndrey V. Elsukov len = (m->m_pkthdr.len > NAT64_ICMP6_PLEN) ? NAT64_ICMP6_PLEN: 711d8caf56eSAndrey V. Elsukov m->m_pkthdr.len; 712d8caf56eSAndrey V. Elsukov 713d8caf56eSAndrey V. Elsukov /* Create new ICMPv6 datagram */ 714d8caf56eSAndrey V. Elsukov plen = len + sizeof(struct icmp6_hdr); 715d8caf56eSAndrey V. Elsukov n = m_get2(sizeof(struct ip6_hdr) + plen + max_hdr, M_NOWAIT, 716d8caf56eSAndrey V. Elsukov MT_HEADER, M_PKTHDR); 717d8caf56eSAndrey V. Elsukov if (n == NULL) { 718d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, nomem); 719d8caf56eSAndrey V. Elsukov m_freem(m); 720d8caf56eSAndrey V. Elsukov return; 721d8caf56eSAndrey V. Elsukov } 722d8caf56eSAndrey V. Elsukov /* 723d8caf56eSAndrey V. Elsukov * Move pkthdr from original mbuf. We should have initialized some 724d8caf56eSAndrey V. Elsukov * fields, because we can reinject this mbuf to netisr and it will 725183502d1SGordon Bergling * go through input path (it requires at least rcvif should be set). 726d8caf56eSAndrey V. Elsukov * Also do M_ALIGN() to reduce chances of need to allocate new mbuf 727d8caf56eSAndrey V. Elsukov * in the chain, when we will do M_PREPEND() or make some type of 728d8caf56eSAndrey V. Elsukov * tunneling. 729d8caf56eSAndrey V. Elsukov */ 730d8caf56eSAndrey V. Elsukov m_move_pkthdr(n, m); 731d8caf56eSAndrey V. Elsukov M_ALIGN(n, sizeof(struct ip6_hdr) + plen + max_hdr); 732d8caf56eSAndrey V. Elsukov 733d8caf56eSAndrey V. Elsukov n->m_len = n->m_pkthdr.len = sizeof(struct ip6_hdr) + plen; 734d8caf56eSAndrey V. Elsukov oip6 = mtod(n, struct ip6_hdr *); 73528739809SAndrey V. Elsukov /* 73628739809SAndrey V. Elsukov * Make IPv6 source address selection for reflected datagram. 73728739809SAndrey V. Elsukov * nat64_check_ip6() doesn't allow scoped addresses, therefore 73828739809SAndrey V. Elsukov * we use zero scopeid. 73928739809SAndrey V. Elsukov */ 74028739809SAndrey V. Elsukov if (in6_selectsrc_addr(M_GETFIB(n), &ip6->ip6_src, 0, 74128739809SAndrey V. Elsukov n->m_pkthdr.rcvif, &oip6->ip6_src, NULL) != 0) { 74228739809SAndrey V. Elsukov /* 74328739809SAndrey V. Elsukov * Failed to find proper source address, drop the packet. 74428739809SAndrey V. Elsukov */ 74528739809SAndrey V. Elsukov m_freem(n); 74628739809SAndrey V. Elsukov goto freeit; 74728739809SAndrey V. Elsukov } 748d8caf56eSAndrey V. Elsukov oip6->ip6_dst = ip6->ip6_src; 749d8caf56eSAndrey V. Elsukov oip6->ip6_nxt = IPPROTO_ICMPV6; 750d8caf56eSAndrey V. Elsukov oip6->ip6_flow = 0; 751d8caf56eSAndrey V. Elsukov oip6->ip6_vfc |= IPV6_VERSION; 752d8caf56eSAndrey V. Elsukov oip6->ip6_hlim = V_ip6_defhlim; 753d8caf56eSAndrey V. Elsukov oip6->ip6_plen = htons(plen); 754d8caf56eSAndrey V. Elsukov 755d8caf56eSAndrey V. Elsukov icmp6 = mtodo(n, sizeof(struct ip6_hdr)); 756d8caf56eSAndrey V. Elsukov icmp6->icmp6_cksum = 0; 757d8caf56eSAndrey V. Elsukov icmp6->icmp6_type = type; 758d8caf56eSAndrey V. Elsukov icmp6->icmp6_code = code; 759d8caf56eSAndrey V. Elsukov icmp6->icmp6_mtu = htonl(mtu); 760d8caf56eSAndrey V. Elsukov 761d8caf56eSAndrey V. Elsukov m_copydata(m, 0, len, mtodo(n, sizeof(struct ip6_hdr) + 762d8caf56eSAndrey V. Elsukov sizeof(struct icmp6_hdr))); 763d8caf56eSAndrey V. Elsukov icmp6->icmp6_cksum = in6_cksum(n, IPPROTO_ICMPV6, 764d8caf56eSAndrey V. Elsukov sizeof(struct ip6_hdr), plen); 765d8caf56eSAndrey V. Elsukov m_freem(m); 766aa271561SAndrey V. Elsukov V_nat64out->output_one(n, stats, logdata); 767d8caf56eSAndrey V. Elsukov return; 768d8caf56eSAndrey V. Elsukov freeit: 769d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, dropped); 770d8caf56eSAndrey V. Elsukov m_freem(m); 771d8caf56eSAndrey V. Elsukov } 772d8caf56eSAndrey V. Elsukov 7736ad7446cSAlexander V. Chernikov static struct nhop_object * 7746ad7446cSAlexander V. Chernikov nat64_find_route4(struct sockaddr_in *dst, struct mbuf *m) 775d8caf56eSAndrey V. Elsukov { 7766ad7446cSAlexander V. Chernikov struct nhop_object *nh; 777d8caf56eSAndrey V. Elsukov 7786ad7446cSAlexander V. Chernikov NET_EPOCH_ASSERT(); 7796ad7446cSAlexander V. Chernikov nh = fib4_lookup(M_GETFIB(m), dst->sin_addr, 0, 0, 0); 7806ad7446cSAlexander V. Chernikov if (nh == NULL) 7816ad7446cSAlexander V. Chernikov return NULL; 7826ad7446cSAlexander V. Chernikov if (nh->nh_flags & (NHF_BLACKHOLE | NHF_BROADCAST | NHF_REJECT)) 7836ad7446cSAlexander V. Chernikov return NULL; 784c570565fSAndrey V. Elsukov 785d8caf56eSAndrey V. Elsukov dst->sin_family = AF_INET; 786d8caf56eSAndrey V. Elsukov dst->sin_len = sizeof(*dst); 7876ad7446cSAlexander V. Chernikov dst->sin_addr = IA_SIN(nh->nh_ifa)->sin_addr; 788c570565fSAndrey V. Elsukov dst->sin_port = 0; 7896ad7446cSAlexander V. Chernikov return nh; 790d8caf56eSAndrey V. Elsukov } 791d8caf56eSAndrey V. Elsukov 792d8caf56eSAndrey V. Elsukov #define NAT64_ICMP_PLEN 64 793c402a01bSAndrey V. Elsukov static NAT64NOINLINE void 794d8caf56eSAndrey V. Elsukov nat64_icmp_reflect(struct mbuf *m, uint8_t type, 795782360deSAndrey V. Elsukov uint8_t code, uint16_t mtu, struct nat64_counters *stats, void *logdata) 796d8caf56eSAndrey V. Elsukov { 797d8caf56eSAndrey V. Elsukov struct icmp *icmp; 798d8caf56eSAndrey V. Elsukov struct ip *ip, *oip; 799d8caf56eSAndrey V. Elsukov struct mbuf *n; 800d8caf56eSAndrey V. Elsukov int len, plen; 801d8caf56eSAndrey V. Elsukov 802d8caf56eSAndrey V. Elsukov ip = mtod(m, struct ip *); 803d8caf56eSAndrey V. Elsukov /* Do not send ICMP error if packet is not the first fragment */ 804d8caf56eSAndrey V. Elsukov if (ip->ip_off & ~ntohs(IP_MF|IP_DF)) { 805d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "not first fragment"); 806d8caf56eSAndrey V. Elsukov goto freeit; 807d8caf56eSAndrey V. Elsukov } 808d8caf56eSAndrey V. Elsukov /* Do not send ICMP in reply to ICMP errors */ 809d8caf56eSAndrey V. Elsukov if (ip->ip_p == IPPROTO_ICMP) { 810d8caf56eSAndrey V. Elsukov if (m->m_len < (ip->ip_hl << 2)) { 811d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "mbuf isn't contigious"); 812d8caf56eSAndrey V. Elsukov goto freeit; 813d8caf56eSAndrey V. Elsukov } 814d8caf56eSAndrey V. Elsukov icmp = mtodo(m, ip->ip_hl << 2); 815d8caf56eSAndrey V. Elsukov if (!ICMP_INFOTYPE(icmp->icmp_type)) { 816d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "do not send ICMP in reply to " 817d8caf56eSAndrey V. Elsukov "ICMP errors"); 818d8caf56eSAndrey V. Elsukov goto freeit; 819d8caf56eSAndrey V. Elsukov } 820d8caf56eSAndrey V. Elsukov } 821d8caf56eSAndrey V. Elsukov switch (type) { 822d8caf56eSAndrey V. Elsukov case ICMP_UNREACH: 823d8caf56eSAndrey V. Elsukov case ICMP_TIMXCEED: 824d8caf56eSAndrey V. Elsukov case ICMP_PARAMPROB: 825d8caf56eSAndrey V. Elsukov break; 826d8caf56eSAndrey V. Elsukov default: 827d8caf56eSAndrey V. Elsukov goto freeit; 828d8caf56eSAndrey V. Elsukov } 829d8caf56eSAndrey V. Elsukov /* Calculate length of ICMP payload */ 830d8caf56eSAndrey V. Elsukov len = (m->m_pkthdr.len > NAT64_ICMP_PLEN) ? (ip->ip_hl << 2) + 8: 831d8caf56eSAndrey V. Elsukov m->m_pkthdr.len; 832d8caf56eSAndrey V. Elsukov 833d8caf56eSAndrey V. Elsukov /* Create new ICMPv4 datagram */ 834d8caf56eSAndrey V. Elsukov plen = len + sizeof(struct icmphdr) + sizeof(uint32_t); 835d8caf56eSAndrey V. Elsukov n = m_get2(sizeof(struct ip) + plen + max_hdr, M_NOWAIT, 836d8caf56eSAndrey V. Elsukov MT_HEADER, M_PKTHDR); 837d8caf56eSAndrey V. Elsukov if (n == NULL) { 838d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, nomem); 839d8caf56eSAndrey V. Elsukov m_freem(m); 840d8caf56eSAndrey V. Elsukov return; 841d8caf56eSAndrey V. Elsukov } 842d8caf56eSAndrey V. Elsukov m_move_pkthdr(n, m); 843d8caf56eSAndrey V. Elsukov M_ALIGN(n, sizeof(struct ip) + plen + max_hdr); 844d8caf56eSAndrey V. Elsukov 845d8caf56eSAndrey V. Elsukov n->m_len = n->m_pkthdr.len = sizeof(struct ip) + plen; 846d8caf56eSAndrey V. Elsukov oip = mtod(n, struct ip *); 847d8caf56eSAndrey V. Elsukov oip->ip_v = IPVERSION; 848d8caf56eSAndrey V. Elsukov oip->ip_hl = sizeof(struct ip) >> 2; 849d8caf56eSAndrey V. Elsukov oip->ip_tos = 0; 850d8caf56eSAndrey V. Elsukov oip->ip_len = htons(n->m_pkthdr.len); 851d8caf56eSAndrey V. Elsukov oip->ip_ttl = V_ip_defttl; 852d8caf56eSAndrey V. Elsukov oip->ip_p = IPPROTO_ICMP; 853d8caf56eSAndrey V. Elsukov ip_fillid(oip); 854d8caf56eSAndrey V. Elsukov oip->ip_off = htons(IP_DF); 855d8caf56eSAndrey V. Elsukov oip->ip_src = ip->ip_dst; 856d8caf56eSAndrey V. Elsukov oip->ip_dst = ip->ip_src; 857d8caf56eSAndrey V. Elsukov oip->ip_sum = 0; 858d8caf56eSAndrey V. Elsukov oip->ip_sum = in_cksum_hdr(oip); 859d8caf56eSAndrey V. Elsukov 860d8caf56eSAndrey V. Elsukov icmp = mtodo(n, sizeof(struct ip)); 861d8caf56eSAndrey V. Elsukov icmp->icmp_type = type; 862d8caf56eSAndrey V. Elsukov icmp->icmp_code = code; 863d8caf56eSAndrey V. Elsukov icmp->icmp_cksum = 0; 864d8caf56eSAndrey V. Elsukov icmp->icmp_pmvoid = 0; 865d8caf56eSAndrey V. Elsukov icmp->icmp_nextmtu = htons(mtu); 866d8caf56eSAndrey V. Elsukov m_copydata(m, 0, len, mtodo(n, sizeof(struct ip) + 867d8caf56eSAndrey V. Elsukov sizeof(struct icmphdr) + sizeof(uint32_t))); 868d8caf56eSAndrey V. Elsukov icmp->icmp_cksum = in_cksum_skip(n, sizeof(struct ip) + plen, 869d8caf56eSAndrey V. Elsukov sizeof(struct ip)); 870d8caf56eSAndrey V. Elsukov m_freem(m); 871aa271561SAndrey V. Elsukov V_nat64out->output_one(n, stats, logdata); 872d8caf56eSAndrey V. Elsukov return; 873d8caf56eSAndrey V. Elsukov freeit: 874d8caf56eSAndrey V. Elsukov NAT64STAT_INC(stats, dropped); 875d8caf56eSAndrey V. Elsukov m_freem(m); 876d8caf56eSAndrey V. Elsukov } 877d8caf56eSAndrey V. Elsukov 878d8caf56eSAndrey V. Elsukov /* Translate ICMP echo request/reply into ICMPv6 */ 879d8caf56eSAndrey V. Elsukov static void 880d8caf56eSAndrey V. Elsukov nat64_icmp_handle_echo(struct ip6_hdr *ip6, struct icmp6_hdr *icmp6, 881d8caf56eSAndrey V. Elsukov uint16_t id, uint8_t type) 882d8caf56eSAndrey V. Elsukov { 883d8caf56eSAndrey V. Elsukov uint16_t old; 884d8caf56eSAndrey V. Elsukov 885d8caf56eSAndrey V. Elsukov old = *(uint16_t *)icmp6; /* save type+code in one word */ 886d8caf56eSAndrey V. Elsukov icmp6->icmp6_type = type; 887d8caf56eSAndrey V. Elsukov /* Reflect ICMPv6 -> ICMPv4 type translation in the cksum */ 888d8caf56eSAndrey V. Elsukov icmp6->icmp6_cksum = cksum_adjust(icmp6->icmp6_cksum, 889d8caf56eSAndrey V. Elsukov old, *(uint16_t *)icmp6); 890d8caf56eSAndrey V. Elsukov if (id != 0) { 891d8caf56eSAndrey V. Elsukov old = icmp6->icmp6_id; 892d8caf56eSAndrey V. Elsukov icmp6->icmp6_id = id; 893d8caf56eSAndrey V. Elsukov /* Reflect ICMP id translation in the cksum */ 894d8caf56eSAndrey V. Elsukov icmp6->icmp6_cksum = cksum_adjust(icmp6->icmp6_cksum, 895d8caf56eSAndrey V. Elsukov old, id); 896d8caf56eSAndrey V. Elsukov } 897d8caf56eSAndrey V. Elsukov /* Reflect IPv6 pseudo header in the cksum */ 898d8caf56eSAndrey V. Elsukov icmp6->icmp6_cksum = ~in6_cksum_pseudo(ip6, ntohs(ip6->ip6_plen), 899d8caf56eSAndrey V. Elsukov IPPROTO_ICMPV6, ~icmp6->icmp6_cksum); 900d8caf56eSAndrey V. Elsukov } 901d8caf56eSAndrey V. Elsukov 902c402a01bSAndrey V. Elsukov static NAT64NOINLINE struct mbuf * 903d8caf56eSAndrey V. Elsukov nat64_icmp_translate(struct mbuf *m, struct ip6_hdr *ip6, uint16_t icmpid, 904782360deSAndrey V. Elsukov int offset, struct nat64_config *cfg) 905d8caf56eSAndrey V. Elsukov { 906d8caf56eSAndrey V. Elsukov struct ip ip; 907d8caf56eSAndrey V. Elsukov struct icmp *icmp; 908d8caf56eSAndrey V. Elsukov struct tcphdr *tcp; 909d8caf56eSAndrey V. Elsukov struct udphdr *udp; 910d8caf56eSAndrey V. Elsukov struct ip6_hdr *eip6; 911d8caf56eSAndrey V. Elsukov struct mbuf *n; 912d8caf56eSAndrey V. Elsukov uint32_t mtu; 913d8caf56eSAndrey V. Elsukov int len, hlen, plen; 914d8caf56eSAndrey V. Elsukov uint8_t type, code; 915d8caf56eSAndrey V. Elsukov 916d8caf56eSAndrey V. Elsukov if (m->m_len < offset + ICMP_MINLEN) 917d8caf56eSAndrey V. Elsukov m = m_pullup(m, offset + ICMP_MINLEN); 918d8caf56eSAndrey V. Elsukov if (m == NULL) { 919782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, nomem); 920d8caf56eSAndrey V. Elsukov return (m); 921d8caf56eSAndrey V. Elsukov } 922d8caf56eSAndrey V. Elsukov mtu = 0; 923d8caf56eSAndrey V. Elsukov icmp = mtodo(m, offset); 924d8caf56eSAndrey V. Elsukov /* RFC 7915 p4.2 */ 925d8caf56eSAndrey V. Elsukov switch (icmp->icmp_type) { 926d8caf56eSAndrey V. Elsukov case ICMP_ECHOREPLY: 927d8caf56eSAndrey V. Elsukov type = ICMP6_ECHO_REPLY; 928d8caf56eSAndrey V. Elsukov code = 0; 929d8caf56eSAndrey V. Elsukov break; 930d8caf56eSAndrey V. Elsukov case ICMP_UNREACH: 931d8caf56eSAndrey V. Elsukov type = ICMP6_DST_UNREACH; 932d8caf56eSAndrey V. Elsukov switch (icmp->icmp_code) { 933d8caf56eSAndrey V. Elsukov case ICMP_UNREACH_NET: 934d8caf56eSAndrey V. Elsukov case ICMP_UNREACH_HOST: 935d8caf56eSAndrey V. Elsukov case ICMP_UNREACH_SRCFAIL: 936d8caf56eSAndrey V. Elsukov case ICMP_UNREACH_NET_UNKNOWN: 937d8caf56eSAndrey V. Elsukov case ICMP_UNREACH_HOST_UNKNOWN: 938d8caf56eSAndrey V. Elsukov case ICMP_UNREACH_TOSNET: 939d8caf56eSAndrey V. Elsukov case ICMP_UNREACH_TOSHOST: 940d8caf56eSAndrey V. Elsukov code = ICMP6_DST_UNREACH_NOROUTE; 941d8caf56eSAndrey V. Elsukov break; 942d8caf56eSAndrey V. Elsukov case ICMP_UNREACH_PROTOCOL: 943d8caf56eSAndrey V. Elsukov type = ICMP6_PARAM_PROB; 944d8caf56eSAndrey V. Elsukov code = ICMP6_PARAMPROB_NEXTHEADER; 945d8caf56eSAndrey V. Elsukov break; 946d8caf56eSAndrey V. Elsukov case ICMP_UNREACH_PORT: 947d8caf56eSAndrey V. Elsukov code = ICMP6_DST_UNREACH_NOPORT; 948d8caf56eSAndrey V. Elsukov break; 949d8caf56eSAndrey V. Elsukov case ICMP_UNREACH_NEEDFRAG: 950d8caf56eSAndrey V. Elsukov type = ICMP6_PACKET_TOO_BIG; 951d8caf56eSAndrey V. Elsukov code = 0; 952d8caf56eSAndrey V. Elsukov /* XXX: needs an additional look */ 953d8caf56eSAndrey V. Elsukov mtu = max(IPV6_MMTU, ntohs(icmp->icmp_nextmtu) + 20); 954d8caf56eSAndrey V. Elsukov break; 955d8caf56eSAndrey V. Elsukov case ICMP_UNREACH_NET_PROHIB: 956d8caf56eSAndrey V. Elsukov case ICMP_UNREACH_HOST_PROHIB: 957d8caf56eSAndrey V. Elsukov case ICMP_UNREACH_FILTER_PROHIB: 958d8caf56eSAndrey V. Elsukov case ICMP_UNREACH_PRECEDENCE_CUTOFF: 959d8caf56eSAndrey V. Elsukov code = ICMP6_DST_UNREACH_ADMIN; 960d8caf56eSAndrey V. Elsukov break; 961d8caf56eSAndrey V. Elsukov default: 962d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Unsupported ICMP type %d, code %d", 963d8caf56eSAndrey V. Elsukov icmp->icmp_type, icmp->icmp_code); 964d8caf56eSAndrey V. Elsukov goto freeit; 965d8caf56eSAndrey V. Elsukov } 966d8caf56eSAndrey V. Elsukov break; 967d8caf56eSAndrey V. Elsukov case ICMP_TIMXCEED: 968d8caf56eSAndrey V. Elsukov type = ICMP6_TIME_EXCEEDED; 969d8caf56eSAndrey V. Elsukov code = icmp->icmp_code; 970d8caf56eSAndrey V. Elsukov break; 971d8caf56eSAndrey V. Elsukov case ICMP_ECHO: 972d8caf56eSAndrey V. Elsukov type = ICMP6_ECHO_REQUEST; 973d8caf56eSAndrey V. Elsukov code = 0; 974d8caf56eSAndrey V. Elsukov break; 975d8caf56eSAndrey V. Elsukov case ICMP_PARAMPROB: 976d8caf56eSAndrey V. Elsukov type = ICMP6_PARAM_PROB; 977d8caf56eSAndrey V. Elsukov switch (icmp->icmp_code) { 978d8caf56eSAndrey V. Elsukov case ICMP_PARAMPROB_ERRATPTR: 979d8caf56eSAndrey V. Elsukov case ICMP_PARAMPROB_LENGTH: 980d8caf56eSAndrey V. Elsukov code = ICMP6_PARAMPROB_HEADER; 981d8caf56eSAndrey V. Elsukov switch (icmp->icmp_pptr) { 982d8caf56eSAndrey V. Elsukov case 0: /* Version/IHL */ 983d8caf56eSAndrey V. Elsukov case 1: /* Type Of Service */ 984d8caf56eSAndrey V. Elsukov mtu = icmp->icmp_pptr; 985d8caf56eSAndrey V. Elsukov break; 986d8caf56eSAndrey V. Elsukov case 2: /* Total Length */ 987d8caf56eSAndrey V. Elsukov case 3: mtu = 4; /* Payload Length */ 988d8caf56eSAndrey V. Elsukov break; 989d8caf56eSAndrey V. Elsukov case 8: /* Time to Live */ 990d8caf56eSAndrey V. Elsukov mtu = 7; /* Hop Limit */ 991d8caf56eSAndrey V. Elsukov break; 992d8caf56eSAndrey V. Elsukov case 9: /* Protocol */ 993d8caf56eSAndrey V. Elsukov mtu = 6; /* Next Header */ 994d8caf56eSAndrey V. Elsukov break; 995d8caf56eSAndrey V. Elsukov case 12: /* Source address */ 996d8caf56eSAndrey V. Elsukov case 13: 997d8caf56eSAndrey V. Elsukov case 14: 998d8caf56eSAndrey V. Elsukov case 15: 999d8caf56eSAndrey V. Elsukov mtu = 8; 1000d8caf56eSAndrey V. Elsukov break; 1001d8caf56eSAndrey V. Elsukov case 16: /* Destination address */ 1002d8caf56eSAndrey V. Elsukov case 17: 1003d8caf56eSAndrey V. Elsukov case 18: 1004d8caf56eSAndrey V. Elsukov case 19: 1005d8caf56eSAndrey V. Elsukov mtu = 24; 1006d8caf56eSAndrey V. Elsukov break; 1007d8caf56eSAndrey V. Elsukov default: /* Silently drop */ 1008d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Unsupported ICMP type %d," 1009d8caf56eSAndrey V. Elsukov " code %d, pptr %d", icmp->icmp_type, 1010d8caf56eSAndrey V. Elsukov icmp->icmp_code, icmp->icmp_pptr); 1011d8caf56eSAndrey V. Elsukov goto freeit; 1012d8caf56eSAndrey V. Elsukov } 1013d8caf56eSAndrey V. Elsukov break; 1014d8caf56eSAndrey V. Elsukov default: 1015d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Unsupported ICMP type %d," 1016d8caf56eSAndrey V. Elsukov " code %d, pptr %d", icmp->icmp_type, 1017d8caf56eSAndrey V. Elsukov icmp->icmp_code, icmp->icmp_pptr); 1018d8caf56eSAndrey V. Elsukov goto freeit; 1019d8caf56eSAndrey V. Elsukov } 1020d8caf56eSAndrey V. Elsukov break; 1021d8caf56eSAndrey V. Elsukov default: 1022d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Unsupported ICMP type %d, code %d", 1023d8caf56eSAndrey V. Elsukov icmp->icmp_type, icmp->icmp_code); 1024d8caf56eSAndrey V. Elsukov goto freeit; 1025d8caf56eSAndrey V. Elsukov } 1026d8caf56eSAndrey V. Elsukov /* 1027d8caf56eSAndrey V. Elsukov * For echo request/reply we can use original payload, 1028d8caf56eSAndrey V. Elsukov * but we need adjust icmp_cksum, because ICMPv6 cksum covers 1029d8caf56eSAndrey V. Elsukov * IPv6 pseudo header and ICMPv6 types differs from ICMPv4. 1030d8caf56eSAndrey V. Elsukov */ 1031d8caf56eSAndrey V. Elsukov if (type == ICMP6_ECHO_REQUEST || type == ICMP6_ECHO_REPLY) { 1032d8caf56eSAndrey V. Elsukov nat64_icmp_handle_echo(ip6, ICMP6(icmp), icmpid, type); 1033d8caf56eSAndrey V. Elsukov return (m); 1034d8caf56eSAndrey V. Elsukov } 1035d8caf56eSAndrey V. Elsukov /* 1036d8caf56eSAndrey V. Elsukov * For other types of ICMP messages we need to translate inner 1037d8caf56eSAndrey V. Elsukov * IPv4 header to IPv6 header. 1038d8caf56eSAndrey V. Elsukov * Assume ICMP src is the same as payload dst 1039d8caf56eSAndrey V. Elsukov * E.g. we have ( GWsrc1 , NATIP1 ) in outer header 1040d8caf56eSAndrey V. Elsukov * and ( NATIP1, Hostdst1 ) in ICMP copy header. 1041d8caf56eSAndrey V. Elsukov * In that case, we already have map for NATIP1 and GWsrc1. 1042d8caf56eSAndrey V. Elsukov * The only thing we need is to copy IPv6 map prefix to 1043d8caf56eSAndrey V. Elsukov * Hostdst1. 1044d8caf56eSAndrey V. Elsukov */ 1045d8caf56eSAndrey V. Elsukov hlen = offset + ICMP_MINLEN; 1046d8caf56eSAndrey V. Elsukov if (m->m_pkthdr.len < hlen + sizeof(struct ip) + ICMP_MINLEN) { 1047d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Message is too short %d", 1048d8caf56eSAndrey V. Elsukov m->m_pkthdr.len); 1049d8caf56eSAndrey V. Elsukov goto freeit; 1050d8caf56eSAndrey V. Elsukov } 1051d8caf56eSAndrey V. Elsukov m_copydata(m, hlen, sizeof(struct ip), (char *)&ip); 1052d8caf56eSAndrey V. Elsukov if (ip.ip_v != IPVERSION) { 1053d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Wrong IP version %d", ip.ip_v); 1054d8caf56eSAndrey V. Elsukov goto freeit; 1055d8caf56eSAndrey V. Elsukov } 1056d8caf56eSAndrey V. Elsukov hlen += ip.ip_hl << 2; /* Skip inner IP header */ 1057d8caf56eSAndrey V. Elsukov if (nat64_check_ip4(ip.ip_src.s_addr) != 0 || 1058d8caf56eSAndrey V. Elsukov nat64_check_ip4(ip.ip_dst.s_addr) != 0 || 1059782360deSAndrey V. Elsukov nat64_check_private_ip4(cfg, ip.ip_src.s_addr) != 0 || 1060782360deSAndrey V. Elsukov nat64_check_private_ip4(cfg, ip.ip_dst.s_addr) != 0) { 1061d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "IP addresses checks failed %04x -> %04x", 1062d8caf56eSAndrey V. Elsukov ntohl(ip.ip_src.s_addr), ntohl(ip.ip_dst.s_addr)); 1063d8caf56eSAndrey V. Elsukov goto freeit; 1064d8caf56eSAndrey V. Elsukov } 1065d8caf56eSAndrey V. Elsukov if (m->m_pkthdr.len < hlen + ICMP_MINLEN) { 1066d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Message is too short %d", 1067d8caf56eSAndrey V. Elsukov m->m_pkthdr.len); 1068d8caf56eSAndrey V. Elsukov goto freeit; 1069d8caf56eSAndrey V. Elsukov } 1070d8caf56eSAndrey V. Elsukov #if 0 1071d8caf56eSAndrey V. Elsukov /* 1072d8caf56eSAndrey V. Elsukov * Check that inner source matches the outer destination. 1073d8caf56eSAndrey V. Elsukov * XXX: We need some method to convert IPv4 into IPv6 address here, 1074d8caf56eSAndrey V. Elsukov * and compare IPv6 addresses. 1075d8caf56eSAndrey V. Elsukov */ 1076d8caf56eSAndrey V. Elsukov if (ip.ip_src.s_addr != nat64_get_ip4(&ip6->ip6_dst)) { 1077d8caf56eSAndrey V. Elsukov DPRINTF(DP_GENERIC, "Inner source doesn't match destination ", 1078d8caf56eSAndrey V. Elsukov "%04x vs %04x", ip.ip_src.s_addr, 1079d8caf56eSAndrey V. Elsukov nat64_get_ip4(&ip6->ip6_dst)); 1080d8caf56eSAndrey V. Elsukov goto freeit; 1081d8caf56eSAndrey V. Elsukov } 1082d8caf56eSAndrey V. Elsukov #endif 1083d8caf56eSAndrey V. Elsukov /* 1084d8caf56eSAndrey V. Elsukov * Create new mbuf for ICMPv6 datagram. 1085d8caf56eSAndrey V. Elsukov * NOTE: len is data length just after inner IP header. 1086d8caf56eSAndrey V. Elsukov */ 1087d8caf56eSAndrey V. Elsukov len = m->m_pkthdr.len - hlen; 1088d8caf56eSAndrey V. Elsukov if (sizeof(struct ip6_hdr) + 1089d8caf56eSAndrey V. Elsukov sizeof(struct icmp6_hdr) + len > NAT64_ICMP6_PLEN) 1090d8caf56eSAndrey V. Elsukov len = NAT64_ICMP6_PLEN - sizeof(struct icmp6_hdr) - 1091d8caf56eSAndrey V. Elsukov sizeof(struct ip6_hdr); 1092d8caf56eSAndrey V. Elsukov plen = sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr) + len; 1093d8caf56eSAndrey V. Elsukov n = m_get2(offset + plen + max_hdr, M_NOWAIT, MT_HEADER, M_PKTHDR); 1094d8caf56eSAndrey V. Elsukov if (n == NULL) { 1095782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, nomem); 1096d8caf56eSAndrey V. Elsukov m_freem(m); 1097d8caf56eSAndrey V. Elsukov return (NULL); 1098d8caf56eSAndrey V. Elsukov } 1099d8caf56eSAndrey V. Elsukov m_move_pkthdr(n, m); 1100d8caf56eSAndrey V. Elsukov M_ALIGN(n, offset + plen + max_hdr); 1101d8caf56eSAndrey V. Elsukov n->m_len = n->m_pkthdr.len = offset + plen; 1102d8caf56eSAndrey V. Elsukov /* Adjust ip6_plen in outer header */ 1103d8caf56eSAndrey V. Elsukov ip6->ip6_plen = htons(plen); 1104d8caf56eSAndrey V. Elsukov /* Construct new inner IPv6 header */ 1105d8caf56eSAndrey V. Elsukov eip6 = mtodo(n, offset + sizeof(struct icmp6_hdr)); 1106d8caf56eSAndrey V. Elsukov eip6->ip6_src = ip6->ip6_dst; 1107b11efc1eSAndrey V. Elsukov 1108b11efc1eSAndrey V. Elsukov /* Use the same prefix that we have in outer header */ 1109d8caf56eSAndrey V. Elsukov eip6->ip6_dst = ip6->ip6_src; 1110b11efc1eSAndrey V. Elsukov MPASS(cfg->flags & NAT64_PLATPFX); 1111b11efc1eSAndrey V. Elsukov nat64_embed_ip4(&eip6->ip6_dst, cfg->plat_plen, ip.ip_dst.s_addr); 1112d8caf56eSAndrey V. Elsukov 1113d8caf56eSAndrey V. Elsukov eip6->ip6_flow = htonl(ip.ip_tos << 20); 1114d8caf56eSAndrey V. Elsukov eip6->ip6_vfc |= IPV6_VERSION; 1115d8caf56eSAndrey V. Elsukov eip6->ip6_hlim = ip.ip_ttl; 1116d8caf56eSAndrey V. Elsukov eip6->ip6_plen = htons(ntohs(ip.ip_len) - (ip.ip_hl << 2)); 1117d8caf56eSAndrey V. Elsukov eip6->ip6_nxt = (ip.ip_p == IPPROTO_ICMP) ? IPPROTO_ICMPV6: ip.ip_p; 1118d8caf56eSAndrey V. Elsukov m_copydata(m, hlen, len, (char *)(eip6 + 1)); 1119d8caf56eSAndrey V. Elsukov /* 1120d8caf56eSAndrey V. Elsukov * We need to translate source port in the inner ULP header, 1121d8caf56eSAndrey V. Elsukov * and adjust ULP checksum. 1122d8caf56eSAndrey V. Elsukov */ 1123d8caf56eSAndrey V. Elsukov switch (ip.ip_p) { 1124d8caf56eSAndrey V. Elsukov case IPPROTO_TCP: 1125d8caf56eSAndrey V. Elsukov if (len < offsetof(struct tcphdr, th_sum)) 1126d8caf56eSAndrey V. Elsukov break; 1127d8caf56eSAndrey V. Elsukov tcp = TCP(eip6 + 1); 1128d8caf56eSAndrey V. Elsukov if (icmpid != 0) { 1129d8caf56eSAndrey V. Elsukov tcp->th_sum = cksum_adjust(tcp->th_sum, 1130d8caf56eSAndrey V. Elsukov tcp->th_sport, icmpid); 1131d8caf56eSAndrey V. Elsukov tcp->th_sport = icmpid; 1132d8caf56eSAndrey V. Elsukov } 1133d8caf56eSAndrey V. Elsukov tcp->th_sum = cksum_add(tcp->th_sum, 1134d8caf56eSAndrey V. Elsukov ~nat64_cksum_convert(eip6, &ip)); 1135d8caf56eSAndrey V. Elsukov break; 1136d8caf56eSAndrey V. Elsukov case IPPROTO_UDP: 1137d8caf56eSAndrey V. Elsukov if (len < offsetof(struct udphdr, uh_sum)) 1138d8caf56eSAndrey V. Elsukov break; 1139d8caf56eSAndrey V. Elsukov udp = UDP(eip6 + 1); 1140d8caf56eSAndrey V. Elsukov if (icmpid != 0) { 1141d8caf56eSAndrey V. Elsukov udp->uh_sum = cksum_adjust(udp->uh_sum, 1142d8caf56eSAndrey V. Elsukov udp->uh_sport, icmpid); 1143d8caf56eSAndrey V. Elsukov udp->uh_sport = icmpid; 1144d8caf56eSAndrey V. Elsukov } 1145d8caf56eSAndrey V. Elsukov udp->uh_sum = cksum_add(udp->uh_sum, 1146d8caf56eSAndrey V. Elsukov ~nat64_cksum_convert(eip6, &ip)); 1147d8caf56eSAndrey V. Elsukov break; 1148d8caf56eSAndrey V. Elsukov case IPPROTO_ICMP: 1149d8caf56eSAndrey V. Elsukov /* 1150d8caf56eSAndrey V. Elsukov * Check if this is an ICMP error message for echo request 1151d8caf56eSAndrey V. Elsukov * that we sent. I.e. ULP in the data containing invoking 1152d8caf56eSAndrey V. Elsukov * packet is IPPROTO_ICMP and its type is ICMP_ECHO. 1153d8caf56eSAndrey V. Elsukov */ 1154d8caf56eSAndrey V. Elsukov icmp = (struct icmp *)(eip6 + 1); 1155d8caf56eSAndrey V. Elsukov if (icmp->icmp_type != ICMP_ECHO) { 1156d8caf56eSAndrey V. Elsukov m_freem(n); 1157d8caf56eSAndrey V. Elsukov goto freeit; 1158d8caf56eSAndrey V. Elsukov } 1159d8caf56eSAndrey V. Elsukov /* 1160d8caf56eSAndrey V. Elsukov * For our client this original datagram should looks 1161d8caf56eSAndrey V. Elsukov * like it was ICMPv6 datagram with type ICMP6_ECHO_REQUEST. 1162d8caf56eSAndrey V. Elsukov * Thus we need adjust icmp_cksum and convert type from 1163d8caf56eSAndrey V. Elsukov * ICMP_ECHO to ICMP6_ECHO_REQUEST. 1164d8caf56eSAndrey V. Elsukov */ 1165d8caf56eSAndrey V. Elsukov nat64_icmp_handle_echo(eip6, ICMP6(icmp), icmpid, 1166d8caf56eSAndrey V. Elsukov ICMP6_ECHO_REQUEST); 1167d8caf56eSAndrey V. Elsukov } 1168d8caf56eSAndrey V. Elsukov m_freem(m); 1169d8caf56eSAndrey V. Elsukov /* Convert ICMPv4 into ICMPv6 header */ 1170d8caf56eSAndrey V. Elsukov icmp = mtodo(n, offset); 1171d8caf56eSAndrey V. Elsukov ICMP6(icmp)->icmp6_type = type; 1172d8caf56eSAndrey V. Elsukov ICMP6(icmp)->icmp6_code = code; 1173d8caf56eSAndrey V. Elsukov ICMP6(icmp)->icmp6_mtu = htonl(mtu); 1174d8caf56eSAndrey V. Elsukov ICMP6(icmp)->icmp6_cksum = 0; 1175d8caf56eSAndrey V. Elsukov ICMP6(icmp)->icmp6_cksum = cksum_add( 1176d8caf56eSAndrey V. Elsukov ~in6_cksum_pseudo(ip6, plen, IPPROTO_ICMPV6, 0), 1177d8caf56eSAndrey V. Elsukov in_cksum_skip(n, n->m_pkthdr.len, offset)); 1178d8caf56eSAndrey V. Elsukov return (n); 1179d8caf56eSAndrey V. Elsukov freeit: 1180d8caf56eSAndrey V. Elsukov m_freem(m); 1181782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1182d8caf56eSAndrey V. Elsukov return (NULL); 1183d8caf56eSAndrey V. Elsukov } 1184d8caf56eSAndrey V. Elsukov 1185d8caf56eSAndrey V. Elsukov int 1186d8caf56eSAndrey V. Elsukov nat64_getlasthdr(struct mbuf *m, int *offset) 1187d8caf56eSAndrey V. Elsukov { 1188d8caf56eSAndrey V. Elsukov struct ip6_hdr *ip6; 1189d8caf56eSAndrey V. Elsukov struct ip6_hbh *hbh; 1190d8caf56eSAndrey V. Elsukov int proto, hlen; 1191d8caf56eSAndrey V. Elsukov 1192d8caf56eSAndrey V. Elsukov if (offset != NULL) 1193d8caf56eSAndrey V. Elsukov hlen = *offset; 1194d8caf56eSAndrey V. Elsukov else 1195d8caf56eSAndrey V. Elsukov hlen = 0; 1196d8caf56eSAndrey V. Elsukov 1197d8caf56eSAndrey V. Elsukov if (m->m_len < hlen + sizeof(*ip6)) 1198d8caf56eSAndrey V. Elsukov return (-1); 1199d8caf56eSAndrey V. Elsukov 1200d8caf56eSAndrey V. Elsukov ip6 = mtodo(m, hlen); 1201d8caf56eSAndrey V. Elsukov hlen += sizeof(*ip6); 1202d8caf56eSAndrey V. Elsukov proto = ip6->ip6_nxt; 1203d8caf56eSAndrey V. Elsukov /* Skip extension headers */ 1204d8caf56eSAndrey V. Elsukov while (proto == IPPROTO_HOPOPTS || proto == IPPROTO_ROUTING || 1205d8caf56eSAndrey V. Elsukov proto == IPPROTO_DSTOPTS) { 1206d8caf56eSAndrey V. Elsukov hbh = mtodo(m, hlen); 1207d8caf56eSAndrey V. Elsukov /* 1208d8caf56eSAndrey V. Elsukov * We expect mbuf has contigious data up to 1209d8caf56eSAndrey V. Elsukov * upper level header. 1210d8caf56eSAndrey V. Elsukov */ 1211d8caf56eSAndrey V. Elsukov if (m->m_len < hlen) 1212d8caf56eSAndrey V. Elsukov return (-1); 1213d8caf56eSAndrey V. Elsukov /* 1214d8caf56eSAndrey V. Elsukov * We doesn't support Jumbo payload option, 1215d8caf56eSAndrey V. Elsukov * so return error. 1216d8caf56eSAndrey V. Elsukov */ 1217d8caf56eSAndrey V. Elsukov if (proto == IPPROTO_HOPOPTS && ip6->ip6_plen == 0) 1218d8caf56eSAndrey V. Elsukov return (-1); 1219d8caf56eSAndrey V. Elsukov proto = hbh->ip6h_nxt; 1220785c0d4dSAndrey V. Elsukov hlen += (hbh->ip6h_len + 1) << 3; 1221d8caf56eSAndrey V. Elsukov } 1222d8caf56eSAndrey V. Elsukov if (offset != NULL) 1223d8caf56eSAndrey V. Elsukov *offset = hlen; 1224d8caf56eSAndrey V. Elsukov return (proto); 1225d8caf56eSAndrey V. Elsukov } 1226d8caf56eSAndrey V. Elsukov 1227d8caf56eSAndrey V. Elsukov int 1228d8caf56eSAndrey V. Elsukov nat64_do_handle_ip4(struct mbuf *m, struct in6_addr *saddr, 1229782360deSAndrey V. Elsukov struct in6_addr *daddr, uint16_t lport, struct nat64_config *cfg, 1230d8caf56eSAndrey V. Elsukov void *logdata) 1231d8caf56eSAndrey V. Elsukov { 12326ad7446cSAlexander V. Chernikov struct nhop_object *nh; 1233d8caf56eSAndrey V. Elsukov struct ip6_hdr ip6; 1234c570565fSAndrey V. Elsukov struct sockaddr_in6 dst; 1235d8caf56eSAndrey V. Elsukov struct ip *ip; 1236d8caf56eSAndrey V. Elsukov struct mbufq mq; 1237d8caf56eSAndrey V. Elsukov uint16_t ip_id, ip_off; 1238d8caf56eSAndrey V. Elsukov uint16_t *csum; 1239d8caf56eSAndrey V. Elsukov int plen, hlen; 1240d8caf56eSAndrey V. Elsukov uint8_t proto; 1241d8caf56eSAndrey V. Elsukov 1242d8caf56eSAndrey V. Elsukov ip = mtod(m, struct ip*); 1243d8caf56eSAndrey V. Elsukov 124428739809SAndrey V. Elsukov if (*V_nat64ipstealth == 0 && ip->ip_ttl <= IPTTLDEC) { 1245d8caf56eSAndrey V. Elsukov nat64_icmp_reflect(m, ICMP_TIMXCEED, 1246782360deSAndrey V. Elsukov ICMP_TIMXCEED_INTRANS, 0, &cfg->stats, logdata); 1247d8caf56eSAndrey V. Elsukov return (NAT64RETURN); 1248d8caf56eSAndrey V. Elsukov } 1249d8caf56eSAndrey V. Elsukov 1250d8caf56eSAndrey V. Elsukov ip6.ip6_dst = *daddr; 1251d8caf56eSAndrey V. Elsukov ip6.ip6_src = *saddr; 1252d8caf56eSAndrey V. Elsukov 1253d8caf56eSAndrey V. Elsukov hlen = ip->ip_hl << 2; 1254d8caf56eSAndrey V. Elsukov plen = ntohs(ip->ip_len) - hlen; 1255d8caf56eSAndrey V. Elsukov proto = ip->ip_p; 1256d8caf56eSAndrey V. Elsukov 1257d8caf56eSAndrey V. Elsukov /* Save ip_id and ip_off, both are in network byte order */ 1258d8caf56eSAndrey V. Elsukov ip_id = ip->ip_id; 1259d8caf56eSAndrey V. Elsukov ip_off = ip->ip_off & htons(IP_OFFMASK | IP_MF); 1260d8caf56eSAndrey V. Elsukov 1261d8caf56eSAndrey V. Elsukov /* Fragment length must be multiple of 8 octets */ 1262d8caf56eSAndrey V. Elsukov if ((ip->ip_off & htons(IP_MF)) != 0 && (plen & 0x7) != 0) { 1263d8caf56eSAndrey V. Elsukov nat64_icmp_reflect(m, ICMP_PARAMPROB, 1264782360deSAndrey V. Elsukov ICMP_PARAMPROB_LENGTH, 0, &cfg->stats, logdata); 1265d8caf56eSAndrey V. Elsukov return (NAT64RETURN); 1266d8caf56eSAndrey V. Elsukov } 1267d8caf56eSAndrey V. Elsukov /* Fragmented ICMP is unsupported */ 1268d8caf56eSAndrey V. Elsukov if (proto == IPPROTO_ICMP && ip_off != 0) { 1269d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "dropped due to fragmented ICMP"); 1270782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1271d8caf56eSAndrey V. Elsukov return (NAT64MFREE); 1272d8caf56eSAndrey V. Elsukov } 1273d8caf56eSAndrey V. Elsukov 1274c570565fSAndrey V. Elsukov dst.sin6_addr = ip6.ip6_dst; 12756ad7446cSAlexander V. Chernikov nh = nat64_find_route6(&dst, m); 12766ad7446cSAlexander V. Chernikov if (nh == NULL) { 1277782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, noroute6); 1278d8caf56eSAndrey V. Elsukov nat64_icmp_reflect(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 1279782360deSAndrey V. Elsukov &cfg->stats, logdata); 1280d8caf56eSAndrey V. Elsukov return (NAT64RETURN); 1281d8caf56eSAndrey V. Elsukov } 12826ad7446cSAlexander V. Chernikov if (nh->nh_mtu < plen + sizeof(ip6) && 1283c570565fSAndrey V. Elsukov (ip->ip_off & htons(IP_DF)) != 0) { 1284d8caf56eSAndrey V. Elsukov nat64_icmp_reflect(m, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 12856ad7446cSAlexander V. Chernikov FRAGSZ(nh->nh_mtu) + sizeof(struct ip), &cfg->stats, logdata); 1286d8caf56eSAndrey V. Elsukov return (NAT64RETURN); 1287d8caf56eSAndrey V. Elsukov } 1288d8caf56eSAndrey V. Elsukov 1289d8caf56eSAndrey V. Elsukov ip6.ip6_flow = htonl(ip->ip_tos << 20); 1290d8caf56eSAndrey V. Elsukov ip6.ip6_vfc |= IPV6_VERSION; 1291d8caf56eSAndrey V. Elsukov ip6.ip6_hlim = ip->ip_ttl; 129228739809SAndrey V. Elsukov if (*V_nat64ipstealth == 0) 1293aa271561SAndrey V. Elsukov ip6.ip6_hlim -= IPTTLDEC; 1294d8caf56eSAndrey V. Elsukov ip6.ip6_plen = htons(plen); 1295d8caf56eSAndrey V. Elsukov ip6.ip6_nxt = (proto == IPPROTO_ICMP) ? IPPROTO_ICMPV6: proto; 1296aaef76e1SAndrey V. Elsukov 1297aaef76e1SAndrey V. Elsukov /* Handle delayed checksums if needed. */ 1298aaef76e1SAndrey V. Elsukov if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) { 1299aaef76e1SAndrey V. Elsukov in_delayed_cksum(m); 1300aaef76e1SAndrey V. Elsukov m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA; 1301aaef76e1SAndrey V. Elsukov } 1302d8caf56eSAndrey V. Elsukov /* Convert checksums. */ 1303d8caf56eSAndrey V. Elsukov switch (proto) { 1304d8caf56eSAndrey V. Elsukov case IPPROTO_TCP: 1305d8caf56eSAndrey V. Elsukov csum = &TCP(mtodo(m, hlen))->th_sum; 1306d8caf56eSAndrey V. Elsukov if (lport != 0) { 1307d8caf56eSAndrey V. Elsukov struct tcphdr *tcp = TCP(mtodo(m, hlen)); 1308d8caf56eSAndrey V. Elsukov *csum = cksum_adjust(*csum, tcp->th_dport, lport); 1309d8caf56eSAndrey V. Elsukov tcp->th_dport = lport; 1310d8caf56eSAndrey V. Elsukov } 1311d8caf56eSAndrey V. Elsukov *csum = cksum_add(*csum, ~nat64_cksum_convert(&ip6, ip)); 1312d8caf56eSAndrey V. Elsukov break; 1313d8caf56eSAndrey V. Elsukov case IPPROTO_UDP: 1314d8caf56eSAndrey V. Elsukov csum = &UDP(mtodo(m, hlen))->uh_sum; 1315d8caf56eSAndrey V. Elsukov if (lport != 0) { 1316d8caf56eSAndrey V. Elsukov struct udphdr *udp = UDP(mtodo(m, hlen)); 1317d8caf56eSAndrey V. Elsukov *csum = cksum_adjust(*csum, udp->uh_dport, lport); 1318d8caf56eSAndrey V. Elsukov udp->uh_dport = lport; 1319d8caf56eSAndrey V. Elsukov } 1320d8caf56eSAndrey V. Elsukov *csum = cksum_add(*csum, ~nat64_cksum_convert(&ip6, ip)); 1321d8caf56eSAndrey V. Elsukov break; 1322d8caf56eSAndrey V. Elsukov case IPPROTO_ICMP: 1323782360deSAndrey V. Elsukov m = nat64_icmp_translate(m, &ip6, lport, hlen, cfg); 1324c570565fSAndrey V. Elsukov if (m == NULL) /* stats already accounted */ 1325d8caf56eSAndrey V. Elsukov return (NAT64RETURN); 1326d8caf56eSAndrey V. Elsukov } 1327d8caf56eSAndrey V. Elsukov 1328d8caf56eSAndrey V. Elsukov m_adj(m, hlen); 1329d8caf56eSAndrey V. Elsukov mbufq_init(&mq, 255); 13306ad7446cSAlexander V. Chernikov nat64_fragment6(&cfg->stats, &ip6, &mq, m, nh->nh_mtu, ip_id, ip_off); 1331d8caf56eSAndrey V. Elsukov while ((m = mbufq_dequeue(&mq)) != NULL) { 13326ad7446cSAlexander V. Chernikov if (V_nat64out->output(nh->nh_ifp, m, (struct sockaddr *)&dst, 1333782360deSAndrey V. Elsukov &cfg->stats, logdata) != 0) 1334d8caf56eSAndrey V. Elsukov break; 1335782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, opcnt46); 1336d8caf56eSAndrey V. Elsukov } 1337d8caf56eSAndrey V. Elsukov mbufq_drain(&mq); 1338d8caf56eSAndrey V. Elsukov return (NAT64RETURN); 1339d8caf56eSAndrey V. Elsukov } 1340d8caf56eSAndrey V. Elsukov 1341d8caf56eSAndrey V. Elsukov int 1342d8caf56eSAndrey V. Elsukov nat64_handle_icmp6(struct mbuf *m, int hlen, uint32_t aaddr, uint16_t aport, 1343782360deSAndrey V. Elsukov struct nat64_config *cfg, void *logdata) 1344d8caf56eSAndrey V. Elsukov { 1345d8caf56eSAndrey V. Elsukov struct ip ip; 1346d8caf56eSAndrey V. Elsukov struct icmp6_hdr *icmp6; 1347d8caf56eSAndrey V. Elsukov struct ip6_frag *ip6f; 1348d8caf56eSAndrey V. Elsukov struct ip6_hdr *ip6, *ip6i; 1349d8caf56eSAndrey V. Elsukov uint32_t mtu; 1350d8caf56eSAndrey V. Elsukov int plen, proto; 1351d8caf56eSAndrey V. Elsukov uint8_t type, code; 1352d8caf56eSAndrey V. Elsukov 1353d8caf56eSAndrey V. Elsukov if (hlen == 0) { 1354d8caf56eSAndrey V. Elsukov ip6 = mtod(m, struct ip6_hdr *); 1355d8caf56eSAndrey V. Elsukov if (nat64_check_ip6(&ip6->ip6_src) != 0 || 1356d8caf56eSAndrey V. Elsukov nat64_check_ip6(&ip6->ip6_dst) != 0) 1357d8caf56eSAndrey V. Elsukov return (NAT64SKIP); 1358d8caf56eSAndrey V. Elsukov 1359d8caf56eSAndrey V. Elsukov proto = nat64_getlasthdr(m, &hlen); 1360d8caf56eSAndrey V. Elsukov if (proto != IPPROTO_ICMPV6) { 1361d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, 1362d8caf56eSAndrey V. Elsukov "dropped due to mbuf isn't contigious"); 1363782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1364d8caf56eSAndrey V. Elsukov return (NAT64MFREE); 1365d8caf56eSAndrey V. Elsukov } 1366d8caf56eSAndrey V. Elsukov } 1367d8caf56eSAndrey V. Elsukov 1368d8caf56eSAndrey V. Elsukov /* 1369d8caf56eSAndrey V. Elsukov * Translate ICMPv6 type and code to ICMPv4 (RFC7915). 1370d8caf56eSAndrey V. Elsukov * NOTE: ICMPv6 echo handled by nat64_do_handle_ip6(). 1371d8caf56eSAndrey V. Elsukov */ 1372d8caf56eSAndrey V. Elsukov icmp6 = mtodo(m, hlen); 1373d8caf56eSAndrey V. Elsukov mtu = 0; 1374d8caf56eSAndrey V. Elsukov switch (icmp6->icmp6_type) { 1375d8caf56eSAndrey V. Elsukov case ICMP6_DST_UNREACH: 1376d8caf56eSAndrey V. Elsukov type = ICMP_UNREACH; 1377d8caf56eSAndrey V. Elsukov switch (icmp6->icmp6_code) { 1378d8caf56eSAndrey V. Elsukov case ICMP6_DST_UNREACH_NOROUTE: 1379d8caf56eSAndrey V. Elsukov case ICMP6_DST_UNREACH_BEYONDSCOPE: 1380d8caf56eSAndrey V. Elsukov case ICMP6_DST_UNREACH_ADDR: 1381d8caf56eSAndrey V. Elsukov code = ICMP_UNREACH_HOST; 1382d8caf56eSAndrey V. Elsukov break; 1383d8caf56eSAndrey V. Elsukov case ICMP6_DST_UNREACH_ADMIN: 1384d8caf56eSAndrey V. Elsukov code = ICMP_UNREACH_HOST_PROHIB; 1385d8caf56eSAndrey V. Elsukov break; 1386d8caf56eSAndrey V. Elsukov case ICMP6_DST_UNREACH_NOPORT: 1387d8caf56eSAndrey V. Elsukov code = ICMP_UNREACH_PORT; 1388d8caf56eSAndrey V. Elsukov break; 1389d8caf56eSAndrey V. Elsukov default: 1390d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Unsupported ICMPv6 type %d," 1391d8caf56eSAndrey V. Elsukov " code %d", icmp6->icmp6_type, 1392d8caf56eSAndrey V. Elsukov icmp6->icmp6_code); 1393782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1394d8caf56eSAndrey V. Elsukov return (NAT64MFREE); 1395d8caf56eSAndrey V. Elsukov } 1396d8caf56eSAndrey V. Elsukov break; 1397d8caf56eSAndrey V. Elsukov case ICMP6_PACKET_TOO_BIG: 1398d8caf56eSAndrey V. Elsukov type = ICMP_UNREACH; 1399d8caf56eSAndrey V. Elsukov code = ICMP_UNREACH_NEEDFRAG; 1400d8caf56eSAndrey V. Elsukov mtu = ntohl(icmp6->icmp6_mtu); 1401d8caf56eSAndrey V. Elsukov if (mtu < IPV6_MMTU) { 1402d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Wrong MTU %d in ICMPv6 type %d," 1403d8caf56eSAndrey V. Elsukov " code %d", mtu, icmp6->icmp6_type, 1404d8caf56eSAndrey V. Elsukov icmp6->icmp6_code); 1405782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1406d8caf56eSAndrey V. Elsukov return (NAT64MFREE); 1407d8caf56eSAndrey V. Elsukov } 1408d8caf56eSAndrey V. Elsukov /* 1409d8caf56eSAndrey V. Elsukov * Adjust MTU to reflect difference between 1410d8caf56eSAndrey V. Elsukov * IPv6 an IPv4 headers. 1411d8caf56eSAndrey V. Elsukov */ 1412d8caf56eSAndrey V. Elsukov mtu -= sizeof(struct ip6_hdr) - sizeof(struct ip); 1413d8caf56eSAndrey V. Elsukov break; 1414c5f2dbb6SAndrey V. Elsukov case ICMP6_TIME_EXCEEDED: 1415d8caf56eSAndrey V. Elsukov type = ICMP_TIMXCEED; 1416c5f2dbb6SAndrey V. Elsukov code = icmp6->icmp6_code; 1417d8caf56eSAndrey V. Elsukov break; 1418d8caf56eSAndrey V. Elsukov case ICMP6_PARAM_PROB: 1419d8caf56eSAndrey V. Elsukov switch (icmp6->icmp6_code) { 1420d8caf56eSAndrey V. Elsukov case ICMP6_PARAMPROB_HEADER: 1421d8caf56eSAndrey V. Elsukov type = ICMP_PARAMPROB; 1422d8caf56eSAndrey V. Elsukov code = ICMP_PARAMPROB_ERRATPTR; 1423d8caf56eSAndrey V. Elsukov mtu = ntohl(icmp6->icmp6_pptr); 1424d8caf56eSAndrey V. Elsukov switch (mtu) { 1425d8caf56eSAndrey V. Elsukov case 0: /* Version/Traffic Class */ 1426d8caf56eSAndrey V. Elsukov case 1: /* Traffic Class/Flow Label */ 1427d8caf56eSAndrey V. Elsukov break; 1428d8caf56eSAndrey V. Elsukov case 4: /* Payload Length */ 1429d8caf56eSAndrey V. Elsukov case 5: 1430d8caf56eSAndrey V. Elsukov mtu = 2; 1431d8caf56eSAndrey V. Elsukov break; 1432d8caf56eSAndrey V. Elsukov case 6: /* Next Header */ 1433d8caf56eSAndrey V. Elsukov mtu = 9; 1434d8caf56eSAndrey V. Elsukov break; 1435d8caf56eSAndrey V. Elsukov case 7: /* Hop Limit */ 1436d8caf56eSAndrey V. Elsukov mtu = 8; 1437d8caf56eSAndrey V. Elsukov break; 1438d8caf56eSAndrey V. Elsukov default: 1439d8caf56eSAndrey V. Elsukov if (mtu >= 8 && mtu <= 23) { 1440d8caf56eSAndrey V. Elsukov mtu = 12; /* Source address */ 1441d8caf56eSAndrey V. Elsukov break; 1442d8caf56eSAndrey V. Elsukov } 1443d8caf56eSAndrey V. Elsukov if (mtu >= 24 && mtu <= 39) { 1444d8caf56eSAndrey V. Elsukov mtu = 16; /* Destination address */ 1445d8caf56eSAndrey V. Elsukov break; 1446d8caf56eSAndrey V. Elsukov } 1447d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Unsupported ICMPv6 type %d," 1448d8caf56eSAndrey V. Elsukov " code %d, pptr %d", icmp6->icmp6_type, 1449d8caf56eSAndrey V. Elsukov icmp6->icmp6_code, mtu); 1450782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1451d8caf56eSAndrey V. Elsukov return (NAT64MFREE); 1452d8caf56eSAndrey V. Elsukov } 1453d8caf56eSAndrey V. Elsukov case ICMP6_PARAMPROB_NEXTHEADER: 1454d8caf56eSAndrey V. Elsukov type = ICMP_UNREACH; 1455d8caf56eSAndrey V. Elsukov code = ICMP_UNREACH_PROTOCOL; 1456d8caf56eSAndrey V. Elsukov break; 1457d8caf56eSAndrey V. Elsukov default: 1458d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Unsupported ICMPv6 type %d," 1459d8caf56eSAndrey V. Elsukov " code %d, pptr %d", icmp6->icmp6_type, 1460d8caf56eSAndrey V. Elsukov icmp6->icmp6_code, ntohl(icmp6->icmp6_pptr)); 1461782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1462d8caf56eSAndrey V. Elsukov return (NAT64MFREE); 1463d8caf56eSAndrey V. Elsukov } 1464d8caf56eSAndrey V. Elsukov break; 1465d8caf56eSAndrey V. Elsukov default: 1466d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Unsupported ICMPv6 type %d, code %d", 1467d8caf56eSAndrey V. Elsukov icmp6->icmp6_type, icmp6->icmp6_code); 1468782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1469d8caf56eSAndrey V. Elsukov return (NAT64MFREE); 1470d8caf56eSAndrey V. Elsukov } 1471d8caf56eSAndrey V. Elsukov 1472d8caf56eSAndrey V. Elsukov hlen += sizeof(struct icmp6_hdr); 1473d8caf56eSAndrey V. Elsukov if (m->m_pkthdr.len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN) { 1474782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1475d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Message is too short %d", 1476d8caf56eSAndrey V. Elsukov m->m_pkthdr.len); 1477d8caf56eSAndrey V. Elsukov return (NAT64MFREE); 1478d8caf56eSAndrey V. Elsukov } 1479d8caf56eSAndrey V. Elsukov /* 1480d8caf56eSAndrey V. Elsukov * We need at least ICMP_MINLEN bytes of original datagram payload 1481d8caf56eSAndrey V. Elsukov * to generate ICMP message. It is nice that ICMP_MINLEN is equal 1482d8caf56eSAndrey V. Elsukov * to sizeof(struct ip6_frag). So, if embedded datagram had a fragment 1483d8caf56eSAndrey V. Elsukov * header we will not have to do m_pullup() again. 1484d8caf56eSAndrey V. Elsukov * 1485d8caf56eSAndrey V. Elsukov * What we have here: 1486d8caf56eSAndrey V. Elsukov * Outer header: (IPv6iGW, v4mapPRefix+v4exthost) 1487d8caf56eSAndrey V. Elsukov * Inner header: (v4mapPRefix+v4host, IPv6iHost) [sport, dport] 1488d8caf56eSAndrey V. Elsukov * We need to translate it to: 1489d8caf56eSAndrey V. Elsukov * 1490d8caf56eSAndrey V. Elsukov * Outer header: (alias_host, v4exthost) 1491d8caf56eSAndrey V. Elsukov * Inner header: (v4exthost, alias_host) [sport, alias_port] 1492d8caf56eSAndrey V. Elsukov * 1493d8caf56eSAndrey V. Elsukov * Assume caller function has checked if v4mapPRefix+v4host 1494d8caf56eSAndrey V. Elsukov * matches configured prefix. 1495d8caf56eSAndrey V. Elsukov * The only two things we should be provided with are mapping between 1496d8caf56eSAndrey V. Elsukov * IPv6iHost <> alias_host and between dport and alias_port. 1497d8caf56eSAndrey V. Elsukov */ 1498d8caf56eSAndrey V. Elsukov if (m->m_len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN) 1499d8caf56eSAndrey V. Elsukov m = m_pullup(m, hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN); 1500d8caf56eSAndrey V. Elsukov if (m == NULL) { 1501782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, nomem); 1502d8caf56eSAndrey V. Elsukov return (NAT64RETURN); 1503d8caf56eSAndrey V. Elsukov } 1504d8caf56eSAndrey V. Elsukov ip6 = mtod(m, struct ip6_hdr *); 1505d8caf56eSAndrey V. Elsukov ip6i = mtodo(m, hlen); 1506d8caf56eSAndrey V. Elsukov ip6f = NULL; 1507d8caf56eSAndrey V. Elsukov proto = ip6i->ip6_nxt; 1508d8caf56eSAndrey V. Elsukov plen = ntohs(ip6i->ip6_plen); 1509d8caf56eSAndrey V. Elsukov hlen += sizeof(struct ip6_hdr); 1510d8caf56eSAndrey V. Elsukov if (proto == IPPROTO_FRAGMENT) { 1511d8caf56eSAndrey V. Elsukov if (m->m_pkthdr.len < hlen + sizeof(struct ip6_frag) + 1512d8caf56eSAndrey V. Elsukov ICMP_MINLEN) 1513d8caf56eSAndrey V. Elsukov goto fail; 1514d8caf56eSAndrey V. Elsukov ip6f = mtodo(m, hlen); 1515d8caf56eSAndrey V. Elsukov proto = ip6f->ip6f_nxt; 1516d8caf56eSAndrey V. Elsukov plen -= sizeof(struct ip6_frag); 1517d8caf56eSAndrey V. Elsukov hlen += sizeof(struct ip6_frag); 1518d8caf56eSAndrey V. Elsukov /* Ajust MTU to reflect frag header size */ 1519d8caf56eSAndrey V. Elsukov if (type == ICMP_UNREACH && code == ICMP_UNREACH_NEEDFRAG) 1520d8caf56eSAndrey V. Elsukov mtu -= sizeof(struct ip6_frag); 1521d8caf56eSAndrey V. Elsukov } 1522d8caf56eSAndrey V. Elsukov if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) { 1523d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Unsupported proto %d in the inner header", 1524d8caf56eSAndrey V. Elsukov proto); 1525d8caf56eSAndrey V. Elsukov goto fail; 1526d8caf56eSAndrey V. Elsukov } 1527d8caf56eSAndrey V. Elsukov if (nat64_check_ip6(&ip6i->ip6_src) != 0 || 1528d8caf56eSAndrey V. Elsukov nat64_check_ip6(&ip6i->ip6_dst) != 0) { 1529d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Inner addresses do not passes the check"); 1530d8caf56eSAndrey V. Elsukov goto fail; 1531d8caf56eSAndrey V. Elsukov } 1532d8caf56eSAndrey V. Elsukov /* Check if outer dst is the same as inner src */ 1533d8caf56eSAndrey V. Elsukov if (!IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &ip6i->ip6_src)) { 1534d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "Inner src doesn't match outer dst"); 1535d8caf56eSAndrey V. Elsukov goto fail; 1536d8caf56eSAndrey V. Elsukov } 1537d8caf56eSAndrey V. Elsukov 1538d8caf56eSAndrey V. Elsukov /* Now we need to make a fake IPv4 packet to generate ICMP message */ 1539d8caf56eSAndrey V. Elsukov ip.ip_dst.s_addr = aaddr; 1540b11efc1eSAndrey V. Elsukov ip.ip_src.s_addr = nat64_extract_ip4(&ip6i->ip6_src, cfg->plat_plen); 1541b11efc1eSAndrey V. Elsukov if (ip.ip_src.s_addr == 0) 1542b11efc1eSAndrey V. Elsukov goto fail; 1543d8caf56eSAndrey V. Elsukov /* XXX: Make fake ulp header */ 1544aa271561SAndrey V. Elsukov if (V_nat64out == &nat64_direct) /* init_ip4hdr will decrement it */ 1545aa271561SAndrey V. Elsukov ip6i->ip6_hlim += IPV6_HLIMDEC; 1546d8caf56eSAndrey V. Elsukov nat64_init_ip4hdr(ip6i, ip6f, plen, proto, &ip); 1547d8caf56eSAndrey V. Elsukov m_adj(m, hlen - sizeof(struct ip)); 1548d8caf56eSAndrey V. Elsukov bcopy(&ip, mtod(m, void *), sizeof(ip)); 1549782360deSAndrey V. Elsukov nat64_icmp_reflect(m, type, code, (uint16_t)mtu, &cfg->stats, 1550782360deSAndrey V. Elsukov logdata); 1551d8caf56eSAndrey V. Elsukov return (NAT64RETURN); 1552d8caf56eSAndrey V. Elsukov fail: 1553d8caf56eSAndrey V. Elsukov /* 1554d8caf56eSAndrey V. Elsukov * We must call m_freem() because mbuf pointer could be 1555d8caf56eSAndrey V. Elsukov * changed with m_pullup(). 1556d8caf56eSAndrey V. Elsukov */ 1557d8caf56eSAndrey V. Elsukov m_freem(m); 1558782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1559d8caf56eSAndrey V. Elsukov return (NAT64RETURN); 1560d8caf56eSAndrey V. Elsukov } 1561d8caf56eSAndrey V. Elsukov 1562d8caf56eSAndrey V. Elsukov int 1563d8caf56eSAndrey V. Elsukov nat64_do_handle_ip6(struct mbuf *m, uint32_t aaddr, uint16_t aport, 1564782360deSAndrey V. Elsukov struct nat64_config *cfg, void *logdata) 1565d8caf56eSAndrey V. Elsukov { 1566d8caf56eSAndrey V. Elsukov struct ip ip; 15676ad7446cSAlexander V. Chernikov struct nhop_object *nh; 1568c570565fSAndrey V. Elsukov struct sockaddr_in dst; 1569d8caf56eSAndrey V. Elsukov struct ip6_frag *frag; 1570d8caf56eSAndrey V. Elsukov struct ip6_hdr *ip6; 1571d8caf56eSAndrey V. Elsukov struct icmp6_hdr *icmp6; 1572d8caf56eSAndrey V. Elsukov uint16_t *csum; 1573db68f783SBjoern A. Zeeb int plen, hlen, proto; 1574d8caf56eSAndrey V. Elsukov 1575d8caf56eSAndrey V. Elsukov /* 1576d8caf56eSAndrey V. Elsukov * XXX: we expect ipfw_chk() did m_pullup() up to upper level 1577d8caf56eSAndrey V. Elsukov * protocol's headers. Also we skip some checks, that ip6_input(), 1578d8caf56eSAndrey V. Elsukov * ip6_forward(), ip6_fastfwd() and ipfw_chk() already did. 1579d8caf56eSAndrey V. Elsukov */ 1580d8caf56eSAndrey V. Elsukov ip6 = mtod(m, struct ip6_hdr *); 1581d8caf56eSAndrey V. Elsukov if (nat64_check_ip6(&ip6->ip6_src) != 0 || 1582d8caf56eSAndrey V. Elsukov nat64_check_ip6(&ip6->ip6_dst) != 0) { 1583d8caf56eSAndrey V. Elsukov return (NAT64SKIP); 1584d8caf56eSAndrey V. Elsukov } 1585d8caf56eSAndrey V. Elsukov 1586d8caf56eSAndrey V. Elsukov /* Starting from this point we must not return zero */ 1587d8caf56eSAndrey V. Elsukov ip.ip_src.s_addr = aaddr; 1588d8caf56eSAndrey V. Elsukov if (nat64_check_ip4(ip.ip_src.s_addr) != 0) { 1589782360deSAndrey V. Elsukov DPRINTF(DP_GENERIC | DP_DROPS, "invalid source address: %08x", 1590d8caf56eSAndrey V. Elsukov ip.ip_src.s_addr); 1591782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1592d8caf56eSAndrey V. Elsukov return (NAT64MFREE); 1593d8caf56eSAndrey V. Elsukov } 1594d8caf56eSAndrey V. Elsukov 1595b11efc1eSAndrey V. Elsukov ip.ip_dst.s_addr = nat64_extract_ip4(&ip6->ip6_dst, cfg->plat_plen); 1596d8caf56eSAndrey V. Elsukov if (ip.ip_dst.s_addr == 0) { 1597782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1598d8caf56eSAndrey V. Elsukov return (NAT64MFREE); 1599d8caf56eSAndrey V. Elsukov } 1600d8caf56eSAndrey V. Elsukov 160128739809SAndrey V. Elsukov if (*V_nat64ip6stealth == 0 && ip6->ip6_hlim <= IPV6_HLIMDEC) { 1602d8caf56eSAndrey V. Elsukov nat64_icmp6_reflect(m, ICMP6_TIME_EXCEEDED, 1603782360deSAndrey V. Elsukov ICMP6_TIME_EXCEED_TRANSIT, 0, &cfg->stats, logdata); 1604d8caf56eSAndrey V. Elsukov return (NAT64RETURN); 1605d8caf56eSAndrey V. Elsukov } 1606d8caf56eSAndrey V. Elsukov 1607d8caf56eSAndrey V. Elsukov hlen = 0; 1608d8caf56eSAndrey V. Elsukov plen = ntohs(ip6->ip6_plen); 1609d8caf56eSAndrey V. Elsukov proto = nat64_getlasthdr(m, &hlen); 1610d8caf56eSAndrey V. Elsukov if (proto < 0) { 1611d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "dropped due to mbuf isn't contigious"); 1612782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1613d8caf56eSAndrey V. Elsukov return (NAT64MFREE); 1614d8caf56eSAndrey V. Elsukov } 1615d8caf56eSAndrey V. Elsukov frag = NULL; 1616d8caf56eSAndrey V. Elsukov if (proto == IPPROTO_FRAGMENT) { 1617d8caf56eSAndrey V. Elsukov /* ipfw_chk should m_pullup up to frag header */ 1618d8caf56eSAndrey V. Elsukov if (m->m_len < hlen + sizeof(*frag)) { 1619d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, 1620d8caf56eSAndrey V. Elsukov "dropped due to mbuf isn't contigious"); 1621782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1622d8caf56eSAndrey V. Elsukov return (NAT64MFREE); 1623d8caf56eSAndrey V. Elsukov } 1624d8caf56eSAndrey V. Elsukov frag = mtodo(m, hlen); 1625d8caf56eSAndrey V. Elsukov proto = frag->ip6f_nxt; 1626d8caf56eSAndrey V. Elsukov hlen += sizeof(*frag); 1627d8caf56eSAndrey V. Elsukov /* Fragmented ICMPv6 is unsupported */ 1628d8caf56eSAndrey V. Elsukov if (proto == IPPROTO_ICMPV6) { 1629d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "dropped due to fragmented ICMPv6"); 1630782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1631d8caf56eSAndrey V. Elsukov return (NAT64MFREE); 1632d8caf56eSAndrey V. Elsukov } 1633d8caf56eSAndrey V. Elsukov /* Fragment length must be multiple of 8 octets */ 1634d8caf56eSAndrey V. Elsukov if ((frag->ip6f_offlg & IP6F_MORE_FRAG) != 0 && 1635d8caf56eSAndrey V. Elsukov ((plen + sizeof(struct ip6_hdr) - hlen) & 0x7) != 0) { 1636d8caf56eSAndrey V. Elsukov nat64_icmp6_reflect(m, ICMP6_PARAM_PROB, 1637d8caf56eSAndrey V. Elsukov ICMP6_PARAMPROB_HEADER, 1638782360deSAndrey V. Elsukov offsetof(struct ip6_hdr, ip6_plen), &cfg->stats, 1639d8caf56eSAndrey V. Elsukov logdata); 1640d8caf56eSAndrey V. Elsukov return (NAT64RETURN); 1641d8caf56eSAndrey V. Elsukov } 1642d8caf56eSAndrey V. Elsukov } 1643d8caf56eSAndrey V. Elsukov plen -= hlen - sizeof(struct ip6_hdr); 1644d8caf56eSAndrey V. Elsukov if (plen < 0 || m->m_pkthdr.len < plen + hlen) { 1645d8caf56eSAndrey V. Elsukov DPRINTF(DP_DROPS, "plen %d, pkthdr.len %d, hlen %d", 1646d8caf56eSAndrey V. Elsukov plen, m->m_pkthdr.len, hlen); 1647782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, dropped); 1648d8caf56eSAndrey V. Elsukov return (NAT64MFREE); 1649d8caf56eSAndrey V. Elsukov } 1650d8caf56eSAndrey V. Elsukov 1651d8caf56eSAndrey V. Elsukov icmp6 = NULL; /* Make gcc happy */ 1652d8caf56eSAndrey V. Elsukov if (proto == IPPROTO_ICMPV6) { 1653d8caf56eSAndrey V. Elsukov icmp6 = mtodo(m, hlen); 1654d8caf56eSAndrey V. Elsukov if (icmp6->icmp6_type != ICMP6_ECHO_REQUEST && 1655d8caf56eSAndrey V. Elsukov icmp6->icmp6_type != ICMP6_ECHO_REPLY) 1656d8caf56eSAndrey V. Elsukov return (nat64_handle_icmp6(m, hlen, aaddr, aport, 1657782360deSAndrey V. Elsukov cfg, logdata)); 1658d8caf56eSAndrey V. Elsukov } 1659c570565fSAndrey V. Elsukov dst.sin_addr.s_addr = ip.ip_dst.s_addr; 16606ad7446cSAlexander V. Chernikov nh = nat64_find_route4(&dst, m); 16616ad7446cSAlexander V. Chernikov if (nh == NULL) { 1662782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, noroute4); 1663d8caf56eSAndrey V. Elsukov nat64_icmp6_reflect(m, ICMP6_DST_UNREACH, 1664782360deSAndrey V. Elsukov ICMP6_DST_UNREACH_NOROUTE, 0, &cfg->stats, logdata); 1665d8caf56eSAndrey V. Elsukov return (NAT64RETURN); 1666d8caf56eSAndrey V. Elsukov } 16676ad7446cSAlexander V. Chernikov if (nh->nh_mtu < plen + sizeof(ip)) { 16686ad7446cSAlexander V. Chernikov nat64_icmp6_reflect(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu, 1669782360deSAndrey V. Elsukov &cfg->stats, logdata); 1670d8caf56eSAndrey V. Elsukov return (NAT64RETURN); 1671d8caf56eSAndrey V. Elsukov } 1672d8caf56eSAndrey V. Elsukov nat64_init_ip4hdr(ip6, frag, plen, proto, &ip); 1673aaef76e1SAndrey V. Elsukov 1674aaef76e1SAndrey V. Elsukov /* Handle delayed checksums if needed. */ 1675aaef76e1SAndrey V. Elsukov if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6) { 1676aaef76e1SAndrey V. Elsukov in6_delayed_cksum(m, plen, hlen); 1677aaef76e1SAndrey V. Elsukov m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6; 1678aaef76e1SAndrey V. Elsukov } 1679d8caf56eSAndrey V. Elsukov /* Convert checksums. */ 1680d8caf56eSAndrey V. Elsukov switch (proto) { 1681d8caf56eSAndrey V. Elsukov case IPPROTO_TCP: 1682d8caf56eSAndrey V. Elsukov csum = &TCP(mtodo(m, hlen))->th_sum; 1683d8caf56eSAndrey V. Elsukov if (aport != 0) { 1684d8caf56eSAndrey V. Elsukov struct tcphdr *tcp = TCP(mtodo(m, hlen)); 1685d8caf56eSAndrey V. Elsukov *csum = cksum_adjust(*csum, tcp->th_sport, aport); 1686d8caf56eSAndrey V. Elsukov tcp->th_sport = aport; 1687d8caf56eSAndrey V. Elsukov } 1688d8caf56eSAndrey V. Elsukov *csum = cksum_add(*csum, nat64_cksum_convert(ip6, &ip)); 1689d8caf56eSAndrey V. Elsukov break; 1690d8caf56eSAndrey V. Elsukov case IPPROTO_UDP: 1691d8caf56eSAndrey V. Elsukov csum = &UDP(mtodo(m, hlen))->uh_sum; 1692d8caf56eSAndrey V. Elsukov if (aport != 0) { 1693d8caf56eSAndrey V. Elsukov struct udphdr *udp = UDP(mtodo(m, hlen)); 1694d8caf56eSAndrey V. Elsukov *csum = cksum_adjust(*csum, udp->uh_sport, aport); 1695d8caf56eSAndrey V. Elsukov udp->uh_sport = aport; 1696d8caf56eSAndrey V. Elsukov } 1697d8caf56eSAndrey V. Elsukov *csum = cksum_add(*csum, nat64_cksum_convert(ip6, &ip)); 1698d8caf56eSAndrey V. Elsukov break; 1699d8caf56eSAndrey V. Elsukov case IPPROTO_ICMPV6: 1700d8caf56eSAndrey V. Elsukov /* Checksum in ICMPv6 covers pseudo header */ 1701d8caf56eSAndrey V. Elsukov csum = &icmp6->icmp6_cksum; 1702d8caf56eSAndrey V. Elsukov *csum = cksum_add(*csum, in6_cksum_pseudo(ip6, plen, 1703d8caf56eSAndrey V. Elsukov IPPROTO_ICMPV6, 0)); 1704d8caf56eSAndrey V. Elsukov /* Convert ICMPv6 types to ICMP */ 1705c570565fSAndrey V. Elsukov proto = *(uint16_t *)icmp6; /* save old word for cksum_adjust */ 1706d8caf56eSAndrey V. Elsukov if (icmp6->icmp6_type == ICMP6_ECHO_REQUEST) 1707d8caf56eSAndrey V. Elsukov icmp6->icmp6_type = ICMP_ECHO; 1708d8caf56eSAndrey V. Elsukov else /* ICMP6_ECHO_REPLY */ 1709d8caf56eSAndrey V. Elsukov icmp6->icmp6_type = ICMP_ECHOREPLY; 1710c570565fSAndrey V. Elsukov *csum = cksum_adjust(*csum, (uint16_t)proto, 1711c570565fSAndrey V. Elsukov *(uint16_t *)icmp6); 1712d8caf56eSAndrey V. Elsukov if (aport != 0) { 1713d8caf56eSAndrey V. Elsukov uint16_t old_id = icmp6->icmp6_id; 1714d8caf56eSAndrey V. Elsukov icmp6->icmp6_id = aport; 1715d8caf56eSAndrey V. Elsukov *csum = cksum_adjust(*csum, old_id, aport); 1716d8caf56eSAndrey V. Elsukov } 1717d8caf56eSAndrey V. Elsukov break; 1718d8caf56eSAndrey V. Elsukov }; 1719d8caf56eSAndrey V. Elsukov 1720d8caf56eSAndrey V. Elsukov m_adj(m, hlen - sizeof(ip)); 1721d8caf56eSAndrey V. Elsukov bcopy(&ip, mtod(m, void *), sizeof(ip)); 17226ad7446cSAlexander V. Chernikov if (V_nat64out->output(nh->nh_ifp, m, (struct sockaddr *)&dst, 1723782360deSAndrey V. Elsukov &cfg->stats, logdata) == 0) 1724782360deSAndrey V. Elsukov NAT64STAT_INC(&cfg->stats, opcnt64); 1725d8caf56eSAndrey V. Elsukov return (NAT64RETURN); 1726d8caf56eSAndrey V. Elsukov } 1727