Annotation of src/sys/net/npf/npf_nat.c, Revision 1.27
1.27 ! rmind 1: /* $NetBSD: npf_nat.c,v 1.26 2014/02/19 03:51:31 rmind Exp $ */
1.1 rmind 2:
3: /*-
1.25 rmind 4: * Copyright (c) 2014 Mindaugas Rasiukevicius <rmind at netbsd org>
1.19 rmind 5: * Copyright (c) 2010-2013 The NetBSD Foundation, Inc.
1.1 rmind 6: * All rights reserved.
7: *
8: * This material is based upon work partially supported by The
9: * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
10: *
11: * Redistribution and use in source and binary forms, with or without
12: * modification, are permitted provided that the following conditions
13: * are met:
14: * 1. Redistributions of source code must retain the above copyright
15: * notice, this list of conditions and the following disclaimer.
16: * 2. Redistributions in binary form must reproduce the above copyright
17: * notice, this list of conditions and the following disclaimer in the
18: * documentation and/or other materials provided with the distribution.
19: *
20: * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21: * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22: * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23: * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24: * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25: * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26: * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27: * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28: * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29: * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30: * POSSIBILITY OF SUCH DAMAGE.
31: */
32:
33: /*
1.19 rmind 34: * NPF network address port translation (NAPT) and other forms of NAT.
35: * Described in RFC 2663, RFC 3022, etc.
1.1 rmind 36: *
37: * Overview
38: *
39: * There are few mechanisms: NAT policy, port map and translation.
40: * NAT module has a separate ruleset, where rules contain associated
41: * NAT policy, thus flexible filter criteria can be used.
42: *
1.2 rmind 43: * Translation types
44: *
45: * There are two types of translation: outbound (NPF_NATOUT) and
46: * inbound (NPF_NATIN). It should not be confused with connection
1.23 rmind 47: * direction. See npf_nat_which() for the description of how the
48: * addresses are rewritten.
1.2 rmind 49: *
50: * It should be noted that bi-directional NAT is a combined outbound
51: * and inbound translation, therefore constructed as two policies.
52: *
1.1 rmind 53: * NAT policies and port maps
54: *
1.2 rmind 55: * NAT (translation) policy is applied when a packet matches the rule.
56: * Apart from filter criteria, NAT policy has a translation IP address
1.1 rmind 57: * and associated port map. Port map is a bitmap used to reserve and
58: * use unique TCP/UDP ports for translation. Port maps are unique to
59: * the IP addresses, therefore multiple NAT policies with the same IP
60: * will share the same port map.
61: *
1.4 rmind 62: * Sessions, translation entries and their life-cycle
1.1 rmind 63: *
1.4 rmind 64: * NAT module relies on session management module. Each translated
65: * session has an associated translation entry (npf_nat_t), which
66: * contains information used for backwards stream translation, i.e.
67: * original IP address with port and translation port, allocated from
68: * the port map. Each NAT entry is associated with the policy, which
69: * contains translation IP address. Allocated port is returned to the
70: * port map and NAT entry is destroyed when session expires.
1.1 rmind 71: */
72:
73: #include <sys/cdefs.h>
1.27 ! rmind 74: __KERNEL_RCSID(0, "$NetBSD: npf_nat.c,v 1.26 2014/02/19 03:51:31 rmind Exp $");
1.1 rmind 75:
76: #include <sys/param.h>
1.11 rmind 77: #include <sys/types.h>
1.1 rmind 78:
79: #include <sys/atomic.h>
80: #include <sys/bitops.h>
1.4 rmind 81: #include <sys/condvar.h>
1.1 rmind 82: #include <sys/kmem.h>
1.4 rmind 83: #include <sys/mutex.h>
1.1 rmind 84: #include <sys/pool.h>
1.19 rmind 85: #include <sys/proc.h>
1.8 tls 86: #include <sys/cprng.h>
87:
1.1 rmind 88: #include <net/pfil.h>
89: #include <netinet/in.h>
90:
91: #include "npf_impl.h"
92:
93: /*
94: * NPF portmap structure.
95: */
96: typedef struct {
1.4 rmind 97: u_int p_refcnt;
98: uint32_t p_bitmap[0];
1.1 rmind 99: } npf_portmap_t;
100:
101: /* Portmap range: [ 1024 .. 65535 ] */
1.4 rmind 102: #define PORTMAP_FIRST (1024)
103: #define PORTMAP_SIZE ((65536 - PORTMAP_FIRST) / 32)
1.25 rmind 104: #define PORTMAP_FILLED ((uint32_t)~0U)
1.4 rmind 105: #define PORTMAP_MASK (31)
106: #define PORTMAP_SHIFT (5)
107:
108: #define PORTMAP_MEM_SIZE \
109: (sizeof(npf_portmap_t) + (PORTMAP_SIZE * sizeof(uint32_t)))
1.1 rmind 110:
1.12 rmind 111: /*
112: * NAT policy structure.
113: */
1.1 rmind 114: struct npf_natpolicy {
1.4 rmind 115: LIST_HEAD(, npf_nat) n_nat_list;
1.19 rmind 116: volatile u_int n_refcnt;
1.4 rmind 117: kmutex_t n_lock;
118: kcondvar_t n_cv;
119: npf_portmap_t * n_portmap;
1.15 rmind 120: /* NPF_NP_CMP_START */
1.4 rmind 121: int n_type;
1.6 rmind 122: u_int n_flags;
1.4 rmind 123: size_t n_addr_sz;
124: npf_addr_t n_taddr;
1.25 rmind 125: npf_netmask_t n_tmask;
1.4 rmind 126: in_port_t n_tport;
1.25 rmind 127: u_int n_algo;
128: union {
129: uint16_t n_npt66_adj;
130: };
1.1 rmind 131: };
132:
1.4 rmind 133: #define NPF_NP_CMP_START offsetof(npf_natpolicy_t, n_type)
134: #define NPF_NP_CMP_SIZE (sizeof(npf_natpolicy_t) - NPF_NP_CMP_START)
135:
1.12 rmind 136: /*
137: * NAT translation entry for a session.
138: */
1.1 rmind 139: struct npf_nat {
1.4 rmind 140: /* Association (list entry and a link pointer) with NAT policy. */
141: LIST_ENTRY(npf_nat) nt_entry;
142: npf_natpolicy_t * nt_natpolicy;
143: npf_session_t * nt_session;
1.2 rmind 144: /* Original address and port (for backwards translation). */
1.4 rmind 145: npf_addr_t nt_oaddr;
146: in_port_t nt_oport;
1.2 rmind 147: /* Translation port (for redirects). */
1.4 rmind 148: in_port_t nt_tport;
1.1 rmind 149: /* ALG (if any) associated with this NAT entry. */
1.4 rmind 150: npf_alg_t * nt_alg;
151: uintptr_t nt_alg_arg;
1.1 rmind 152: };
153:
1.4 rmind 154: static pool_cache_t nat_cache __read_mostly;
1.1 rmind 155:
156: /*
157: * npf_nat_sys{init,fini}: initialise/destroy NAT subsystem structures.
158: */
159:
160: void
161: npf_nat_sysinit(void)
162: {
163: nat_cache = pool_cache_init(sizeof(npf_nat_t), coherency_unit,
164: 0, 0, "npfnatpl", NULL, IPL_NET, NULL, NULL, NULL);
165: KASSERT(nat_cache != NULL);
166: }
167:
168: void
169: npf_nat_sysfini(void)
170: {
1.23 rmind 171: /* All NAT policies should already be destroyed. */
1.1 rmind 172: pool_cache_destroy(nat_cache);
173: }
174:
175: /*
1.2 rmind 176: * npf_nat_newpolicy: create a new NAT policy.
1.1 rmind 177: *
178: * => Shares portmap if policy is on existing translation address.
179: */
180: npf_natpolicy_t *
1.5 rmind 181: npf_nat_newpolicy(prop_dictionary_t natdict, npf_ruleset_t *nrlset)
1.1 rmind 182: {
1.5 rmind 183: npf_natpolicy_t *np;
1.4 rmind 184: prop_object_t obj;
1.1 rmind 185: npf_portmap_t *pm;
186:
187: np = kmem_zalloc(sizeof(npf_natpolicy_t), KM_SLEEP);
1.4 rmind 188:
1.6 rmind 189: /* Translation type and flags. */
190: prop_dictionary_get_int32(natdict, "type", &np->n_type);
191: prop_dictionary_get_uint32(natdict, "flags", &np->n_flags);
1.10 rmind 192:
193: /* Should be exclusively either inbound or outbound NAT. */
194: if (((np->n_type == NPF_NATIN) ^ (np->n_type == NPF_NATOUT)) == 0) {
1.25 rmind 195: goto err;
1.10 rmind 196: }
197: mutex_init(&np->n_lock, MUTEX_DEFAULT, IPL_SOFTNET);
198: cv_init(&np->n_cv, "npfnatcv");
199: LIST_INIT(&np->n_nat_list);
1.4 rmind 200:
1.25 rmind 201: /* Translation IP, mask and port (if applicable). */
1.4 rmind 202: obj = prop_dictionary_get(natdict, "translation-ip");
203: np->n_addr_sz = prop_data_size(obj);
1.25 rmind 204: if (np->n_addr_sz == 0 || np->n_addr_sz > sizeof(npf_addr_t)) {
205: goto err;
206: }
1.6 rmind 207: memcpy(&np->n_taddr, prop_data_data_nocopy(obj), np->n_addr_sz);
1.25 rmind 208: prop_dictionary_get_uint8(natdict, "translation-mask", &np->n_tmask);
209: prop_dictionary_get_uint16(natdict, "translation-port", &np->n_tport);
1.4 rmind 210:
1.25 rmind 211: prop_dictionary_get_uint32(natdict, "translation-algo", &np->n_algo);
212: switch (np->n_algo) {
213: case NPF_ALGO_NPT66:
214: prop_dictionary_get_uint16(natdict, "npt66-adjustment",
215: &np->n_npt66_adj);
216: break;
217: default:
218: if (np->n_tmask != NPF_NO_NETMASK)
219: goto err;
220: break;
221: }
1.2 rmind 222:
1.5 rmind 223: /* Determine if port map is needed. */
224: np->n_portmap = NULL;
1.4 rmind 225: if ((np->n_flags & NPF_NAT_PORTMAP) == 0) {
1.5 rmind 226: /* No port map. */
227: return np;
1.2 rmind 228: }
1.1 rmind 229:
1.5 rmind 230: /*
231: * Inspect NAT policies in the ruleset for port map sharing.
232: * Note that npf_ruleset_sharepm() will increase the reference count.
233: */
234: if (!npf_ruleset_sharepm(nrlset, np)) {
1.1 rmind 235: /* Allocate a new port map for the NAT policy. */
1.4 rmind 236: pm = kmem_zalloc(PORTMAP_MEM_SIZE, KM_SLEEP);
1.1 rmind 237: pm->p_refcnt = 1;
238: KASSERT((uintptr_t)pm->p_bitmap == (uintptr_t)pm + sizeof(*pm));
1.5 rmind 239: np->n_portmap = pm;
1.1 rmind 240: } else {
1.5 rmind 241: KASSERT(np->n_portmap != NULL);
1.1 rmind 242: }
243: return np;
1.25 rmind 244: err:
245: kmem_free(np, sizeof(npf_natpolicy_t));
246: return NULL;
1.1 rmind 247: }
248:
249: /*
250: * npf_nat_freepolicy: free NAT policy and, on last reference, free portmap.
251: *
1.4 rmind 252: * => Called from npf_rule_free() during the reload via npf_ruleset_destroy().
1.1 rmind 253: */
254: void
255: npf_nat_freepolicy(npf_natpolicy_t *np)
256: {
257: npf_portmap_t *pm = np->n_portmap;
1.5 rmind 258: npf_session_t *se;
1.4 rmind 259: npf_nat_t *nt;
1.1 rmind 260:
1.22 rmind 261: /*
262: * Disassociate all entries from the policy. At this point,
263: * new entries can no longer be created for this policy.
264: */
1.4 rmind 265: mutex_enter(&np->n_lock);
266: LIST_FOREACH(nt, &np->n_nat_list, nt_entry) {
1.22 rmind 267: se = nt->nt_session;
268: KASSERT(se != NULL);
1.5 rmind 269: npf_session_expire(se);
1.4 rmind 270: }
271: while (!LIST_EMPTY(&np->n_nat_list)) {
272: cv_wait(&np->n_cv, &np->n_lock);
273: }
274: mutex_exit(&np->n_lock);
275:
1.20 rmind 276: /* Kick the worker - all references should be going away. */
277: npf_worker_signal();
1.19 rmind 278: while (np->n_refcnt) {
279: kpause("npfgcnat", false, 1, NULL);
280: }
1.22 rmind 281: KASSERT(LIST_EMPTY(&np->n_nat_list));
1.19 rmind 282:
1.4 rmind 283: /* Destroy the port map, on last reference. */
1.2 rmind 284: if (pm && --pm->p_refcnt == 0) {
285: KASSERT((np->n_flags & NPF_NAT_PORTMAP) != 0);
1.4 rmind 286: kmem_free(pm, PORTMAP_MEM_SIZE);
1.1 rmind 287: }
1.4 rmind 288: cv_destroy(&np->n_cv);
289: mutex_destroy(&np->n_lock);
1.1 rmind 290: kmem_free(np, sizeof(npf_natpolicy_t));
291: }
292:
1.13 rmind 293: void
1.15 rmind 294: npf_nat_freealg(npf_natpolicy_t *np, npf_alg_t *alg)
1.13 rmind 295: {
1.15 rmind 296: npf_nat_t *nt;
297:
298: mutex_enter(&np->n_lock);
299: LIST_FOREACH(nt, &np->n_nat_list, nt_entry) {
300: if (nt->nt_alg != alg) {
301: continue;
302: }
303: nt->nt_alg = NULL;
304: }
305: mutex_exit(&np->n_lock);
1.13 rmind 306: }
307:
1.5 rmind 308: /*
309: * npf_nat_matchpolicy: compare two NAT policies.
310: *
311: * => Return 0 on match, and non-zero otherwise.
312: */
1.4 rmind 313: bool
314: npf_nat_matchpolicy(npf_natpolicy_t *np, npf_natpolicy_t *mnp)
1.1 rmind 315: {
1.4 rmind 316: void *np_raw, *mnp_raw;
317: /*
318: * Compare the relevant NAT policy information (in raw form),
319: * which is enough for matching criterion.
320: */
1.5 rmind 321: KASSERT(np && mnp && np != mnp);
1.4 rmind 322: np_raw = (uint8_t *)np + NPF_NP_CMP_START;
323: mnp_raw = (uint8_t *)mnp + NPF_NP_CMP_START;
324: return (memcmp(np_raw, mnp_raw, NPF_NP_CMP_SIZE) == 0);
1.1 rmind 325: }
326:
1.5 rmind 327: bool
328: npf_nat_sharepm(npf_natpolicy_t *np, npf_natpolicy_t *mnp)
329: {
330: npf_portmap_t *pm, *mpm;
331:
332: KASSERT(np && mnp && np != mnp);
333:
334: /* Using port map and having equal translation address? */
335: if ((np->n_flags & mnp->n_flags & NPF_NAT_PORTMAP) == 0) {
336: return false;
337: }
338: if (np->n_addr_sz != mnp->n_addr_sz) {
339: return false;
340: }
341: if (memcmp(&np->n_taddr, &mnp->n_taddr, np->n_addr_sz) != 0) {
342: return false;
343: }
344: /* If NAT policy has an old port map - drop the reference. */
345: mpm = mnp->n_portmap;
346: if (mpm) {
1.12 rmind 347: /* Note: at this point we cannot hold a last reference. */
1.5 rmind 348: KASSERT(mpm->p_refcnt > 1);
349: mpm->p_refcnt--;
350: }
351: /* Share the port map. */
352: pm = np->n_portmap;
353: mnp->n_portmap = pm;
354: pm->p_refcnt++;
355: return true;
356: }
357:
1.1 rmind 358: /*
359: * npf_nat_getport: allocate and return a port in the NAT policy portmap.
360: *
361: * => Returns in network byte-order.
362: * => Zero indicates failure.
363: */
364: static in_port_t
365: npf_nat_getport(npf_natpolicy_t *np)
366: {
367: npf_portmap_t *pm = np->n_portmap;
368: u_int n = PORTMAP_SIZE, idx, bit;
369: uint32_t map, nmap;
370:
1.8 tls 371: idx = cprng_fast32() % PORTMAP_SIZE;
1.1 rmind 372: for (;;) {
373: KASSERT(idx < PORTMAP_SIZE);
374: map = pm->p_bitmap[idx];
375: if (__predict_false(map == PORTMAP_FILLED)) {
376: if (n-- == 0) {
377: /* No space. */
378: return 0;
379: }
1.2 rmind 380: /* This bitmap is filled, next. */
1.1 rmind 381: idx = (idx ? idx : PORTMAP_SIZE) - 1;
382: continue;
383: }
384: bit = ffs32(~map) - 1;
385: nmap = map | (1 << bit);
386: if (atomic_cas_32(&pm->p_bitmap[idx], map, nmap) == map) {
387: /* Success. */
388: break;
389: }
390: }
391: return htons(PORTMAP_FIRST + (idx << PORTMAP_SHIFT) + bit);
392: }
393:
394: /*
1.4 rmind 395: * npf_nat_takeport: allocate specific port in the NAT policy portmap.
396: */
397: static bool
398: npf_nat_takeport(npf_natpolicy_t *np, in_port_t port)
399: {
400: npf_portmap_t *pm = np->n_portmap;
401: uint32_t map, nmap;
402: u_int idx, bit;
403:
404: port = ntohs(port) - PORTMAP_FIRST;
405: idx = port >> PORTMAP_SHIFT;
406: bit = port & PORTMAP_MASK;
407: map = pm->p_bitmap[idx];
408: nmap = map | (1 << bit);
409: if (map == nmap) {
410: /* Already taken. */
411: return false;
412: }
413: return atomic_cas_32(&pm->p_bitmap[idx], map, nmap) == map;
414: }
415:
416: /*
1.1 rmind 417: * npf_nat_putport: return port as available in the NAT policy portmap.
418: *
419: * => Port should be in network byte-order.
420: */
421: static void
422: npf_nat_putport(npf_natpolicy_t *np, in_port_t port)
423: {
424: npf_portmap_t *pm = np->n_portmap;
425: uint32_t map, nmap;
426: u_int idx, bit;
427:
428: port = ntohs(port) - PORTMAP_FIRST;
429: idx = port >> PORTMAP_SHIFT;
430: bit = port & PORTMAP_MASK;
431: do {
432: map = pm->p_bitmap[idx];
433: KASSERT(map | (1 << bit));
434: nmap = map & ~(1 << bit);
435: } while (atomic_cas_32(&pm->p_bitmap[idx], map, nmap) != map);
436: }
437:
438: /*
1.23 rmind 439: * npf_nat_which: tell which address (source or destination) should be
440: * rewritten given the combination of the NAT type and flow direction.
441: */
442: static inline u_int
443: npf_nat_which(const int type, bool forw)
444: {
445: /*
446: * Outbound NAT rewrites:
1.24 rmind 447: * - Source (NPF_SRC) on "forwards" stream.
448: * - Destination (NPF_DST) on "backwards" stream.
1.23 rmind 449: * Inbound NAT is other way round.
450: */
451: if (type == NPF_NATOUT) {
452: forw = !forw;
453: } else {
454: KASSERT(type == NPF_NATIN);
455: }
456: CTASSERT(NPF_SRC == 0 && NPF_DST == 1);
1.24 rmind 457: KASSERT(forw == NPF_SRC || forw == NPF_DST);
1.23 rmind 458: return (u_int)forw;
459: }
460:
461: /*
1.2 rmind 462: * npf_nat_inspect: inspect packet against NAT ruleset and return a policy.
1.19 rmind 463: *
464: * => Acquire a reference on the policy, if found.
1.2 rmind 465: */
466: static npf_natpolicy_t *
1.18 rmind 467: npf_nat_inspect(npf_cache_t *npc, nbuf_t *nbuf, const int di)
1.2 rmind 468: {
1.19 rmind 469: int slock = npf_config_read_enter();
470: npf_ruleset_t *rlset = npf_config_natset();
1.6 rmind 471: npf_natpolicy_t *np;
1.2 rmind 472: npf_rule_t *rl;
473:
1.18 rmind 474: rl = npf_ruleset_inspect(npc, nbuf, rlset, di, NPF_LAYER_3);
1.6 rmind 475: if (rl == NULL) {
1.19 rmind 476: npf_config_read_exit(slock);
1.6 rmind 477: return NULL;
478: }
479: np = npf_rule_getnat(rl);
1.19 rmind 480: atomic_inc_uint(&np->n_refcnt);
481: npf_config_read_exit(slock);
1.6 rmind 482: return np;
1.2 rmind 483: }
484:
485: /*
486: * npf_nat_create: create a new NAT translation entry.
1.1 rmind 487: */
1.2 rmind 488: static npf_nat_t *
1.22 rmind 489: npf_nat_create(npf_cache_t *npc, npf_natpolicy_t *np, npf_session_t *se)
1.1 rmind 490: {
1.19 rmind 491: const int proto = npc->npc_proto;
1.2 rmind 492: npf_nat_t *nt;
493:
1.7 zoltan 494: KASSERT(npf_iscached(npc, NPC_IP46));
495: KASSERT(npf_iscached(npc, NPC_LAYER4));
1.3 rmind 496:
1.22 rmind 497: /* Construct a new NAT entry and associate it with the session. */
1.2 rmind 498: nt = pool_cache_get(nat_cache, PR_NOWAIT);
499: if (nt == NULL){
500: return NULL;
501: }
1.4 rmind 502: npf_stats_inc(NPF_STAT_NAT_CREATE);
1.5 rmind 503: nt->nt_natpolicy = np;
1.22 rmind 504: nt->nt_session = se;
1.5 rmind 505: nt->nt_alg = NULL;
506:
1.2 rmind 507: /* Save the original address which may be rewritten. */
508: if (np->n_type == NPF_NATOUT) {
1.23 rmind 509: /* Outbound NAT: source (think internal) address. */
510: memcpy(&nt->nt_oaddr, npc->npc_ips[NPF_SRC], npc->npc_alen);
1.2 rmind 511: } else {
1.23 rmind 512: /* Inbound NAT: destination (think external) address. */
1.2 rmind 513: KASSERT(np->n_type == NPF_NATIN);
1.23 rmind 514: memcpy(&nt->nt_oaddr, npc->npc_ips[NPF_DST], npc->npc_alen);
1.2 rmind 515: }
516:
517: /*
518: * Port translation, if required, and if it is TCP/UDP.
519: */
520: if ((np->n_flags & NPF_NAT_PORTS) == 0 ||
521: (proto != IPPROTO_TCP && proto != IPPROTO_UDP)) {
522: nt->nt_oport = 0;
523: nt->nt_tport = 0;
1.12 rmind 524: goto out;
1.2 rmind 525: }
1.12 rmind 526:
1.3 rmind 527: /* Save the relevant TCP/UDP port. */
528: if (proto == IPPROTO_TCP) {
1.18 rmind 529: const struct tcphdr *th = npc->npc_l4.tcp;
1.3 rmind 530: nt->nt_oport = (np->n_type == NPF_NATOUT) ?
531: th->th_sport : th->th_dport;
1.2 rmind 532: } else {
1.18 rmind 533: const struct udphdr *uh = npc->npc_l4.udp;
1.3 rmind 534: nt->nt_oport = (np->n_type == NPF_NATOUT) ?
535: uh->uh_sport : uh->uh_dport;
1.2 rmind 536: }
1.3 rmind 537:
1.2 rmind 538: /* Get a new port for translation. */
539: if ((np->n_flags & NPF_NAT_PORTMAP) != 0) {
540: nt->nt_tport = npf_nat_getport(np);
541: } else {
542: nt->nt_tport = np->n_tport;
543: }
1.12 rmind 544: out:
545: mutex_enter(&np->n_lock);
546: LIST_INSERT_HEAD(&np->n_nat_list, nt, nt_entry);
547: mutex_exit(&np->n_lock);
1.2 rmind 548: return nt;
549: }
550:
551: /*
1.24 rmind 552: * npf_nat_translate: perform translation given the state data.
553: */
1.26 rmind 554: static inline int
1.24 rmind 555: npf_nat_translate(npf_cache_t *npc, nbuf_t *nbuf, npf_nat_t *nt, bool forw)
556: {
557: const npf_natpolicy_t *np = nt->nt_natpolicy;
1.26 rmind 558: const u_int which = npf_nat_which(np->n_type, forw);
1.24 rmind 559: const npf_addr_t *addr;
560: in_port_t port;
561:
562: KASSERT(npf_iscached(npc, NPC_IP46));
563: KASSERT(npf_iscached(npc, NPC_LAYER4));
564:
565: if (forw) {
566: /* "Forwards" stream: use translation address/port. */
567: addr = &np->n_taddr;
568: port = nt->nt_tport;
569: } else {
570: /* "Backwards" stream: use original address/port. */
571: addr = &nt->nt_oaddr;
572: port = nt->nt_oport;
573: }
574: KASSERT((np->n_flags & NPF_NAT_PORTS) != 0 || port == 0);
575:
1.26 rmind 576: /* Execute ALG translation first. */
1.24 rmind 577: if ((npc->npc_info & NPC_ALG_EXEC) == 0) {
578: npc->npc_info |= NPC_ALG_EXEC;
579: npf_alg_exec(npc, nbuf, nt, forw);
1.26 rmind 580: npf_recache(npc, nbuf);
1.24 rmind 581: }
1.26 rmind 582: KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET));
1.24 rmind 583:
584: /* Finally, perform the translation. */
1.26 rmind 585: return npf_napt_rwr(npc, which, addr, port);
1.24 rmind 586: }
587:
588: /*
1.25 rmind 589: * npf_nat_algo: perform the translation given the algorithm.
590: */
591: static inline int
592: npf_nat_algo(npf_cache_t *npc, const npf_natpolicy_t *np, bool forw)
593: {
1.26 rmind 594: const u_int which = npf_nat_which(np->n_type, forw);
1.25 rmind 595: int error;
596:
597: switch (np->n_algo) {
598: case NPF_ALGO_NPT66:
599: error = npf_npt66_rwr(npc, which, &np->n_taddr,
600: np->n_tmask, np->n_npt66_adj);
601: break;
602: default:
1.26 rmind 603: error = npf_napt_rwr(npc, which, &np->n_taddr, np->n_tport);
1.25 rmind 604: break;
605: }
606:
607: return error;
608: }
609:
610: /*
1.2 rmind 611: * npf_do_nat:
612: * - Inspect packet for a NAT policy, unless a session with a NAT
1.4 rmind 613: * association already exists. In such case, determine whether it
1.2 rmind 614: * is a "forwards" or "backwards" stream.
1.4 rmind 615: * - Perform translation: rewrite source or destination fields,
616: * depending on translation type and direction.
617: * - Associate a NAT policy with a session (may establish a new).
1.2 rmind 618: */
619: int
1.18 rmind 620: npf_do_nat(npf_cache_t *npc, npf_session_t *se, nbuf_t *nbuf, const int di)
1.2 rmind 621: {
622: npf_session_t *nse = NULL;
1.1 rmind 623: npf_natpolicy_t *np;
624: npf_nat_t *nt;
625: int error;
1.22 rmind 626: bool forw;
1.1 rmind 627:
628: /* All relevant IPv4 data should be already cached. */
1.3 rmind 629: if (!npf_iscached(npc, NPC_IP46) || !npf_iscached(npc, NPC_LAYER4)) {
1.1 rmind 630: return 0;
631: }
1.18 rmind 632: KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET));
1.1 rmind 633:
1.2 rmind 634: /*
635: * Return the NAT entry associated with the session, if any.
1.3 rmind 636: * Determines whether the stream is "forwards" or "backwards".
1.4 rmind 637: * Note: no need to lock, since reference on session is held.
1.2 rmind 638: */
639: if (se && (nt = npf_session_retnat(se, di, &forw)) != NULL) {
1.1 rmind 640: np = nt->nt_natpolicy;
1.2 rmind 641: goto translate;
1.1 rmind 642: }
643:
1.6 rmind 644: /*
645: * Inspect the packet for a NAT policy, if there is no session.
1.19 rmind 646: * Note: acquires a reference if found.
1.6 rmind 647: */
1.18 rmind 648: np = npf_nat_inspect(npc, nbuf, di);
1.1 rmind 649: if (np == NULL) {
650: /* If packet does not match - done. */
651: return 0;
652: }
1.2 rmind 653: forw = true;
1.1 rmind 654:
1.24 rmind 655: /* Static NAT - just perform the translation. */
656: if (np->n_flags & NPF_NAT_STATIC) {
657: if (nbuf_cksum_barrier(nbuf, di)) {
658: npf_recache(npc, nbuf);
659: }
1.25 rmind 660: error = npf_nat_algo(npc, np, forw);
1.24 rmind 661: atomic_dec_uint(&np->n_refcnt);
662: return error;
663: }
664:
1.4 rmind 665: /*
1.14 rmind 666: * If there is no local session (no "stateful" rule - unusual, but
1.2 rmind 667: * possible configuration), establish one before translation. Note
668: * that it is not a "pass" session, therefore passing of "backwards"
669: * stream depends on other, stateless filtering rules.
670: */
1.1 rmind 671: if (se == NULL) {
1.27 ! rmind 672: nse = npf_session_establish(npc, nbuf, di, true);
1.1 rmind 673: if (nse == NULL) {
1.22 rmind 674: atomic_dec_uint(&np->n_refcnt);
675: return ENOMEM;
1.1 rmind 676: }
677: se = nse;
678: }
1.22 rmind 679:
680: /*
681: * Create a new NAT entry and associate with the session.
682: * We will consume the reference on success (release on error).
683: */
684: nt = npf_nat_create(npc, np, se);
685: if (nt == NULL) {
686: atomic_dec_uint(&np->n_refcnt);
687: error = ENOMEM;
688: goto out;
689: }
690:
691: /* Associate the NAT translation entry with the session. */
692: error = npf_session_setnat(se, nt, np->n_type);
1.2 rmind 693: if (error) {
1.22 rmind 694: /* Will release the reference. */
695: npf_nat_destroy(nt);
1.1 rmind 696: goto out;
697: }
698:
1.22 rmind 699: /* Determine whether any ALG matches. */
700: if (npf_alg_match(npc, nbuf, nt, di)) {
701: KASSERT(nt->nt_alg != NULL);
702: }
703:
704: translate:
1.23 rmind 705: /* May need to process the delayed checksums first (XXX: NetBSD). */
706: if (nbuf_cksum_barrier(nbuf, di)) {
707: npf_recache(npc, nbuf);
708: }
709:
1.22 rmind 710: /* Perform the translation. */
1.23 rmind 711: error = npf_nat_translate(npc, nbuf, nt, forw);
1.1 rmind 712: out:
1.24 rmind 713: if (__predict_false(nse)) {
714: if (error) {
715: /* It created for NAT - just expire. */
716: npf_session_expire(nse);
717: }
1.22 rmind 718: npf_session_release(nse);
1.1 rmind 719: }
720: return error;
721: }
722:
723: /*
1.4 rmind 724: * npf_nat_gettrans: return translation IP address and port.
725: */
726: void
727: npf_nat_gettrans(npf_nat_t *nt, npf_addr_t **addr, in_port_t *port)
728: {
729: npf_natpolicy_t *np = nt->nt_natpolicy;
730:
731: *addr = &np->n_taddr;
732: *port = nt->nt_tport;
733: }
734:
735: /*
1.2 rmind 736: * npf_nat_getorig: return original IP address and port from translation entry.
1.1 rmind 737: */
738: void
1.3 rmind 739: npf_nat_getorig(npf_nat_t *nt, npf_addr_t **addr, in_port_t *port)
1.1 rmind 740: {
1.3 rmind 741: *addr = &nt->nt_oaddr;
1.2 rmind 742: *port = nt->nt_oport;
1.1 rmind 743: }
744:
1.3 rmind 745: /*
746: * npf_nat_setalg: associate an ALG with the NAT entry.
747: */
1.1 rmind 748: void
749: npf_nat_setalg(npf_nat_t *nt, npf_alg_t *alg, uintptr_t arg)
750: {
751: nt->nt_alg = alg;
752: nt->nt_alg_arg = arg;
753: }
754:
755: /*
1.22 rmind 756: * npf_nat_destroy: destroy NAT structure (performed on session expiration).
1.1 rmind 757: */
758: void
1.22 rmind 759: npf_nat_destroy(npf_nat_t *nt)
1.1 rmind 760: {
1.2 rmind 761: npf_natpolicy_t *np = nt->nt_natpolicy;
1.1 rmind 762:
1.4 rmind 763: /* Return any taken port to the portmap. */
764: if ((np->n_flags & NPF_NAT_PORTMAP) != 0 && nt->nt_tport) {
1.1 rmind 765: npf_nat_putport(np, nt->nt_tport);
766: }
1.4 rmind 767:
768: mutex_enter(&np->n_lock);
769: LIST_REMOVE(nt, nt_entry);
770: if (LIST_EMPTY(&np->n_nat_list)) {
1.22 rmind 771: /* Notify any waiters if empty. */
1.4 rmind 772: cv_broadcast(&np->n_cv);
773: }
1.19 rmind 774: atomic_dec_uint(&np->n_refcnt);
1.4 rmind 775: mutex_exit(&np->n_lock);
776:
1.1 rmind 777: pool_cache_put(nat_cache, nt);
1.4 rmind 778: npf_stats_inc(NPF_STAT_NAT_DESTROY);
779: }
780:
781: /*
782: * npf_nat_save: construct NAT entry and reference to the NAT policy.
783: */
784: int
785: npf_nat_save(prop_dictionary_t sedict, prop_array_t natlist, npf_nat_t *nt)
786: {
787: npf_natpolicy_t *np = nt->nt_natpolicy;
788: prop_object_iterator_t it;
789: prop_dictionary_t npdict;
790: prop_data_t nd, npd;
1.17 rmind 791: uint64_t itnp;
1.4 rmind 792:
793: /* Set NAT entry data. */
794: nd = prop_data_create_data(nt, sizeof(npf_nat_t));
795: prop_dictionary_set(sedict, "nat-data", nd);
1.6 rmind 796: prop_object_release(nd);
1.4 rmind 797:
798: /* Find or create a NAT policy. */
799: it = prop_array_iterator(natlist);
800: while ((npdict = prop_object_iterator_next(it)) != NULL) {
1.5 rmind 801: CTASSERT(sizeof(uintptr_t) <= sizeof(uint64_t));
1.17 rmind 802: prop_dictionary_get_uint64(npdict, "id-ptr", &itnp);
803: if ((uintptr_t)itnp == (uintptr_t)np) {
1.4 rmind 804: break;
805: }
806: }
807: if (npdict == NULL) {
808: /* Create NAT policy dictionary and copy the data. */
809: npdict = prop_dictionary_create();
810: npd = prop_data_create_data(np, sizeof(npf_natpolicy_t));
1.6 rmind 811: prop_dictionary_set(npdict, "nat-policy-data", npd);
812: prop_object_release(npd);
1.4 rmind 813:
1.5 rmind 814: CTASSERT(sizeof(uintptr_t) <= sizeof(uint64_t));
1.6 rmind 815: prop_dictionary_set_uint64(npdict, "id-ptr", (uintptr_t)np);
1.4 rmind 816: prop_array_add(natlist, npdict);
1.6 rmind 817: prop_object_release(npdict);
1.4 rmind 818: }
1.6 rmind 819: prop_dictionary_set(sedict, "nat-policy", npdict);
820: prop_object_release(npdict);
1.4 rmind 821: return 0;
822: }
823:
824: /*
825: * npf_nat_restore: find a matching NAT policy and restore NAT entry.
826: *
827: * => Caller should lock the active NAT ruleset.
828: */
829: npf_nat_t *
830: npf_nat_restore(prop_dictionary_t sedict, npf_session_t *se)
831: {
832: const npf_natpolicy_t *onp;
833: const npf_nat_t *ntraw;
834: prop_object_t obj;
835: npf_natpolicy_t *np;
836: npf_rule_t *rl;
837: npf_nat_t *nt;
838:
839: /* Get raw NAT entry. */
840: obj = prop_dictionary_get(sedict, "nat-data");
841: ntraw = prop_data_data_nocopy(obj);
842: if (ntraw == NULL || prop_data_size(obj) != sizeof(npf_nat_t)) {
843: return NULL;
844: }
845:
846: /* Find a stored NAT policy information. */
847: obj = prop_dictionary_get(
848: prop_dictionary_get(sedict, "nat-policy"), "nat-policy-data");
849: onp = prop_data_data_nocopy(obj);
850: if (onp == NULL || prop_data_size(obj) != sizeof(npf_natpolicy_t)) {
851: return NULL;
852: }
853:
1.20 rmind 854: /*
855: * Match if there is an existing NAT policy. Will acquire the
856: * reference on it if further operations are successful.
857: */
1.19 rmind 858: KASSERT(npf_config_locked_p());
859: rl = npf_ruleset_matchnat(npf_config_natset(), __UNCONST(onp));
1.4 rmind 860: if (rl == NULL) {
861: return NULL;
862: }
863: np = npf_rule_getnat(rl);
864: KASSERT(np != NULL);
865:
866: /* Take a specific port from port-map. */
867: if (!npf_nat_takeport(np, ntraw->nt_tport)) {
868: return NULL;
869: }
1.20 rmind 870: atomic_inc_uint(&np->n_refcnt);
1.4 rmind 871:
872: /* Create and return NAT entry for association. */
873: nt = pool_cache_get(nat_cache, PR_WAITOK);
874: memcpy(nt, ntraw, sizeof(npf_nat_t));
875: LIST_INSERT_HEAD(&np->n_nat_list, nt, nt_entry);
876: nt->nt_natpolicy = np;
877: nt->nt_session = se;
878: nt->nt_alg = NULL;
879: return nt;
1.1 rmind 880: }
881:
882: #if defined(DDB) || defined(_NPF_TESTING)
883:
884: void
1.14 rmind 885: npf_nat_dump(const npf_nat_t *nt)
1.1 rmind 886: {
1.14 rmind 887: const npf_natpolicy_t *np;
1.1 rmind 888: struct in_addr ip;
889:
1.4 rmind 890: np = nt->nt_natpolicy;
891: memcpy(&ip, &np->n_taddr, sizeof(ip));
892: printf("\tNATP(%p): type %d flags 0x%x taddr %s tport %d\n",
893: np, np->n_type, np->n_flags, inet_ntoa(ip), np->n_tport);
894: memcpy(&ip, &nt->nt_oaddr, sizeof(ip));
895: printf("\tNAT: original address %s oport %d tport %d\n",
896: inet_ntoa(ip), ntohs(nt->nt_oport), ntohs(nt->nt_tport));
897: if (nt->nt_alg) {
898: printf("\tNAT ALG = %p, ARG = %p\n",
899: nt->nt_alg, (void *)nt->nt_alg_arg);
1.1 rmind 900: }
901: }
902:
903: #endif
CVSweb <webmaster@jp.NetBSD.org>
![[BACK]](/icons/back.gif){kind=icon}
Return to npf_nat.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [cvs.NetBSD.org] / src / sys / net / npf