1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002 - 2008 Henning Brauer 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 * 32 * Effort sponsored in part by the Defense Advanced Research Projects 33 * Agency (DARPA) and Air Force Research Laboratory, Air Force 34 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 35 * 36 * $OpenBSD: pf_lb.c,v 1.2 2009/02/12 02:13:15 sthen Exp $ 37 */ 38 39 #include <sys/cdefs.h> 40 #include "opt_pf.h" 41 #include "opt_inet.h" 42 #include "opt_inet6.h" 43 44 #include <sys/param.h> 45 #include <sys/lock.h> 46 #include <sys/mbuf.h> 47 #include <sys/socket.h> 48 #include <sys/sysctl.h> 49 50 #include <crypto/siphash/siphash.h> 51 52 #include <net/if.h> 53 #include <net/if_var.h> 54 #include <net/vnet.h> 55 #include <net/pfvar.h> 56 #include <net/if_pflog.h> 57 58 #ifdef INET 59 #include <netinet/in_var.h> 60 #endif /* INET */ 61 62 #ifdef INET6 63 #include <netinet6/in6_var.h> 64 #endif /* INET6 */ 65 66 67 /* 68 * Limit the amount of work we do to find a free source port for redirects that 69 * introduce a state conflict. 70 */ 71 #define V_pf_rdr_srcport_rewrite_tries VNET(pf_rdr_srcport_rewrite_tries) 72 VNET_DEFINE_STATIC(int, pf_rdr_srcport_rewrite_tries) = 16; 73 74 static uint64_t pf_hash(struct pf_addr *, struct pf_addr *, 75 struct pf_poolhashkey *, sa_family_t); 76 static struct pf_krule *pf_match_translation(int, struct pf_test_ctx *); 77 static enum pf_test_status pf_step_into_translation_anchor(int, struct pf_test_ctx *, 78 struct pf_krule *); 79 static int pf_get_sport(struct pf_pdesc *, struct pf_krule *, 80 struct pf_addr *, uint16_t *, uint16_t, uint16_t, 81 struct pf_kpool *, struct pf_udp_mapping **, 82 pf_sn_types_t); 83 static bool pf_islinklocal(const sa_family_t, const struct pf_addr *); 84 85 static uint64_t 86 pf_hash(struct pf_addr *inaddr, struct pf_addr *hash, 87 struct pf_poolhashkey *key, sa_family_t af) 88 { 89 SIPHASH_CTX ctx; 90 #ifdef INET6 91 union { 92 uint64_t hash64; 93 uint32_t hash32[2]; 94 } h; 95 #endif /* INET6 */ 96 uint64_t res = 0; 97 98 _Static_assert(sizeof(*key) >= SIPHASH_KEY_LENGTH, ""); 99 100 switch (af) { 101 #ifdef INET 102 case AF_INET: 103 res = SipHash24(&ctx, (const uint8_t *)key, 104 &inaddr->addr32[0], sizeof(inaddr->addr32[0])); 105 hash->addr32[0] = res; 106 break; 107 #endif /* INET */ 108 #ifdef INET6 109 case AF_INET6: 110 res = SipHash24(&ctx, (const uint8_t *)key, 111 &inaddr->addr32[0], 4 * sizeof(inaddr->addr32[0])); 112 h.hash64 = res; 113 hash->addr32[0] = h.hash32[0]; 114 hash->addr32[1] = h.hash32[1]; 115 /* 116 * siphash isn't big enough, but flipping it around is 117 * good enough here. 118 */ 119 hash->addr32[2] = ~h.hash32[1]; 120 hash->addr32[3] = ~h.hash32[0]; 121 break; 122 #endif /* INET6 */ 123 default: 124 unhandled_af(af); 125 } 126 return (res); 127 } 128 129 #define PF_TEST_ATTRIB(t, a) \ 130 if (t) { \ 131 r = a; \ 132 continue; \ 133 } else do { \ 134 } while (0) 135 136 static enum pf_test_status 137 pf_match_translation_rule(int rs_num, struct pf_test_ctx *ctx, struct pf_kruleset *ruleset) 138 { 139 struct pf_krule *r; 140 struct pf_pdesc *pd = ctx->pd; 141 int rtableid = -1; 142 143 r = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr); 144 while (r != NULL) { 145 struct pf_rule_addr *src = NULL, *dst = NULL; 146 struct pf_addr_wrap *xdst = NULL; 147 148 if (r->action == PF_BINAT && pd->dir == PF_IN) { 149 src = &r->dst; 150 if (r->rdr.cur != NULL) 151 xdst = &r->rdr.cur->addr; 152 } else { 153 src = &r->src; 154 dst = &r->dst; 155 } 156 157 pf_counter_u64_add(&r->evaluations, 1); 158 PF_TEST_ATTRIB(pfi_kkif_match(r->kif, pd->kif) == r->ifnot, 159 r->skip[PF_SKIP_IFP]); 160 PF_TEST_ATTRIB(r->direction && r->direction != pd->dir, 161 r->skip[PF_SKIP_DIR]); 162 PF_TEST_ATTRIB(r->af && r->af != pd->af, 163 r->skip[PF_SKIP_AF]); 164 PF_TEST_ATTRIB(r->proto && r->proto != pd->proto, 165 r->skip[PF_SKIP_PROTO]); 166 PF_TEST_ATTRIB(PF_MISMATCHAW(&src->addr, &pd->nsaddr, pd->af, 167 src->neg, pd->kif, M_GETFIB(pd->m)), 168 r->skip[src == &r->src ? PF_SKIP_SRC_ADDR : 169 PF_SKIP_DST_ADDR]); 170 PF_TEST_ATTRIB(src->port_op && !pf_match_port(src->port_op, 171 src->port[0], src->port[1], pd->nsport), 172 r->skip[src == &r->src ? PF_SKIP_SRC_PORT : 173 PF_SKIP_DST_PORT]); 174 PF_TEST_ATTRIB(dst != NULL && 175 PF_MISMATCHAW(&dst->addr, &pd->ndaddr, pd->af, dst->neg, NULL, 176 M_GETFIB(pd->m)), 177 r->skip[PF_SKIP_DST_ADDR]); 178 PF_TEST_ATTRIB(xdst != NULL && PF_MISMATCHAW(xdst, &pd->ndaddr, pd->af, 179 0, NULL, M_GETFIB(pd->m)), 180 TAILQ_NEXT(r, entries)); 181 PF_TEST_ATTRIB(dst != NULL && dst->port_op && 182 !pf_match_port(dst->port_op, dst->port[0], 183 dst->port[1], pd->ndport), 184 r->skip[PF_SKIP_DST_PORT]); 185 PF_TEST_ATTRIB(r->match_tag && !pf_match_tag(pd->m, r, &ctx->tag, 186 pd->pf_mtag ? pd->pf_mtag->tag : 0), 187 TAILQ_NEXT(r, entries)); 188 PF_TEST_ATTRIB(r->os_fingerprint != PF_OSFP_ANY && (pd->proto != 189 IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, 190 &pd->hdr.tcp), r->os_fingerprint)), 191 TAILQ_NEXT(r, entries)); 192 if (r->tag) 193 ctx->tag = r->tag; 194 if (r->rtableid >= 0) 195 rtableid = r->rtableid; 196 if (r->anchor == NULL) { 197 if (r->action == PF_NONAT || 198 r->action == PF_NORDR || 199 r->action == PF_NOBINAT) { 200 *ctx->rm = NULL; 201 } else { 202 /* 203 * found matching r 204 */ 205 ctx->tr = r; 206 /* 207 * anchor, with ruleset, where r belongs to 208 */ 209 *ctx->am = ctx->a; 210 /* 211 * ruleset where r belongs to 212 */ 213 *ctx->rsm = ruleset; 214 /* 215 * ruleset, where anchor belongs to. 216 */ 217 ctx->arsm = ctx->aruleset; 218 } 219 break; 220 } else { 221 ctx->a = r; /* remember anchor */ 222 ctx->aruleset = ruleset; /* and its ruleset */ 223 if (pf_step_into_translation_anchor(rs_num, ctx, 224 r) != PF_TEST_OK) { 225 break; 226 } 227 /* If we found a match in the anchor we're done. */ 228 if (ctx->tr != NULL) { 229 break; 230 } 231 } 232 r = TAILQ_NEXT(r, entries); 233 } 234 235 if (ctx->tag > 0 && pf_tag_packet(pd, ctx->tag)) 236 return (PF_TEST_FAIL); 237 if (rtableid >= 0) 238 M_SETFIB(pd->m, rtableid); 239 240 return (PF_TEST_OK); 241 } 242 243 static enum pf_test_status 244 pf_step_into_translation_anchor(int rs_num, struct pf_test_ctx *ctx, struct pf_krule *r) 245 { 246 enum pf_test_status rv; 247 248 PF_RULES_RASSERT(); 249 250 if (ctx->depth >= PF_ANCHOR_STACK_MAX) { 251 printf("%s: anchor stack overflow on %s\n", 252 __func__, r->anchor->name); 253 return (PF_TEST_FAIL); 254 } 255 256 ctx->depth++; 257 258 if (r->anchor_wildcard) { 259 struct pf_kanchor *child; 260 rv = PF_TEST_OK; 261 RB_FOREACH(child, pf_kanchor_node, &r->anchor->children) { 262 rv = pf_match_translation_rule(rs_num, ctx, &child->ruleset); 263 if ((rv == PF_TEST_QUICK) || (rv == PF_TEST_FAIL)) { 264 /* 265 * we either hit a rule qith quick action 266 * (more likely), or hit some runtime 267 * error (e.g. pool_get() faillure). 268 */ 269 break; 270 } 271 } 272 } else { 273 rv = pf_match_translation_rule(rs_num, ctx, &r->anchor->ruleset); 274 } 275 276 ctx->depth--; 277 278 return (rv); 279 } 280 281 static struct pf_krule * 282 pf_match_translation(int rs_num, struct pf_test_ctx *ctx) 283 { 284 enum pf_test_status rv; 285 286 MPASS(ctx->depth == 0); 287 rv = pf_match_translation_rule(rs_num, ctx, &pf_main_ruleset); 288 MPASS(ctx->depth == 0); 289 if (rv != PF_TEST_OK) 290 return (NULL); 291 292 return (ctx->tr); 293 } 294 295 static int 296 pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r, struct pf_addr *naddr, 297 uint16_t *nport, uint16_t low, uint16_t high, struct pf_kpool *rpool, 298 struct pf_udp_mapping **udp_mapping, pf_sn_types_t sn_type) 299 { 300 struct pf_state_key_cmp key; 301 struct pf_addr init_addr; 302 int dir = (pd->dir == PF_IN) ? PF_OUT : PF_IN; 303 int sidx = pd->sidx; 304 int didx = pd->didx; 305 306 bzero(&init_addr, sizeof(init_addr)); 307 308 MPASS(udp_mapping == NULL || 309 *udp_mapping == NULL); 310 311 /* 312 * If we are UDP and have an existing mapping we can get source port 313 * from the mapping. In this case we have to look up the src_node as 314 * pf_map_addr would. 315 */ 316 if (pd->proto == IPPROTO_UDP && (rpool->opts & PF_POOL_ENDPI)) { 317 struct pf_udp_endpoint_cmp udp_source; 318 319 bzero(&udp_source, sizeof(udp_source)); 320 udp_source.af = pd->af; 321 pf_addrcpy(&udp_source.addr, &pd->nsaddr, pd->af); 322 udp_source.port = pd->nsport; 323 if (udp_mapping) { 324 struct pf_ksrc_node *sn = NULL; 325 struct pf_srchash *sh = NULL; 326 *udp_mapping = pf_udp_mapping_find(&udp_source); 327 if (*udp_mapping) { 328 pf_addrcpy(naddr, 329 &(*udp_mapping)->endpoints[1].addr, 330 pd->af); 331 *nport = (*udp_mapping)->endpoints[1].port; 332 /* 333 * Try to find a src_node as per pf_map_addr(). 334 * XXX: Why? This code seems to do nothing. 335 */ 336 if (rpool->opts & PF_POOL_STICKYADDR && 337 (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) 338 sn = pf_find_src_node(&pd->nsaddr, r, 339 pd->af, &sh, sn_type, false); 340 if (sn != NULL) 341 PF_SRC_NODE_UNLOCK(sn); 342 return (0); 343 } else { 344 *udp_mapping = pf_udp_mapping_create(pd->af, &pd->nsaddr, 345 pd->nsport, &init_addr, 0); 346 if (*udp_mapping == NULL) 347 return (1); 348 } 349 } 350 } 351 352 if (pf_map_addr_sn(pd->naf, r, &pd->nsaddr, naddr, &(pd->naf), NULL, 353 &init_addr, rpool, sn_type)) 354 goto failed; 355 356 if (pd->proto == IPPROTO_ICMP) { 357 if (pd->ndport == htons(ICMP_ECHO)) { 358 low = 1; 359 high = 65535; 360 } else { 361 MPASS(udp_mapping == NULL || 362 *udp_mapping == NULL); 363 return (0); /* Don't try to modify non-echo ICMP */ 364 } 365 } 366 #ifdef INET6 367 if (pd->proto == IPPROTO_ICMPV6) { 368 if (pd->ndport == htons(ICMP6_ECHO_REQUEST)) { 369 low = 1; 370 high = 65535; 371 } else { 372 MPASS(udp_mapping == NULL || 373 *udp_mapping == NULL); 374 return (0); /* Don't try to modify non-echo ICMP */ 375 } 376 } 377 #endif /* INET6 */ 378 379 bzero(&key, sizeof(key)); 380 key.af = pd->naf; 381 key.proto = pd->proto; 382 383 do { 384 pf_addrcpy(&key.addr[didx], &pd->ndaddr, key.af); 385 pf_addrcpy(&key.addr[sidx], naddr, key.af); 386 key.port[didx] = pd->ndport; 387 388 if (udp_mapping && *udp_mapping) 389 pf_addrcpy(&(*udp_mapping)->endpoints[1].addr, naddr, 390 pd->af); 391 392 /* 393 * port search; start random, step; 394 * similar 2 portloop in in_pcbbind 395 */ 396 if (pd->proto == IPPROTO_SCTP) { 397 key.port[sidx] = pd->nsport; 398 MPASS(udp_mapping == NULL || 399 *udp_mapping == NULL); 400 if (!pf_find_state_all_exists(&key, dir)) { 401 *nport = pd->nsport; 402 return (0); 403 } else { 404 return (1); /* Fail mapping. */ 405 } 406 } else if (!(pd->proto == IPPROTO_TCP || pd->proto == IPPROTO_UDP || 407 pd->proto == IPPROTO_ICMP) || (low == 0 && high == 0)) { 408 /* 409 * XXX bug: icmp states don't use the id on both sides. 410 * (traceroute -I through nat) 411 */ 412 key.port[sidx] = pd->nsport; 413 if (!pf_find_state_all_exists(&key, dir)) { 414 if (udp_mapping && *udp_mapping != NULL) { 415 (*udp_mapping)->endpoints[1].port = pd->nsport; 416 if (pf_udp_mapping_insert(*udp_mapping) == 0) { 417 *nport = pd->nsport; 418 return (0); 419 } 420 } else { 421 MPASS(udp_mapping == NULL || 422 *udp_mapping == NULL); 423 *nport = pd->nsport; 424 return (0); 425 } 426 } 427 } else if (low == high) { 428 key.port[sidx] = htons(low); 429 if (!pf_find_state_all_exists(&key, dir)) { 430 if (udp_mapping && *udp_mapping != NULL) { 431 (*udp_mapping)->endpoints[1].port = htons(low); 432 if (pf_udp_mapping_insert(*udp_mapping) == 0) { 433 *nport = htons(low); 434 return (0); 435 } 436 } else { 437 MPASS(udp_mapping == NULL || 438 *udp_mapping == NULL); 439 *nport = htons(low); 440 return (0); 441 } 442 } 443 } else { 444 uint32_t tmp; 445 uint16_t cut; 446 447 if (low > high) { 448 tmp = low; 449 low = high; 450 high = tmp; 451 } 452 /* low < high */ 453 cut = arc4random() % (1 + high - low) + low; 454 /* low <= cut <= high */ 455 for (tmp = cut; tmp <= high && tmp <= 0xffff; ++tmp) { 456 if (udp_mapping && *udp_mapping != NULL) { 457 (*udp_mapping)->endpoints[sidx].port = htons(tmp); 458 if (pf_udp_mapping_insert(*udp_mapping) == 0) { 459 *nport = htons(tmp); 460 return (0); 461 } 462 } else { 463 key.port[sidx] = htons(tmp); 464 if (!pf_find_state_all_exists(&key, dir)) { 465 *nport = htons(tmp); 466 MPASS(udp_mapping == NULL || 467 *udp_mapping == NULL); 468 return (0); 469 } 470 } 471 } 472 tmp = cut; 473 for (tmp -= 1; tmp >= low && tmp <= 0xffff; --tmp) { 474 if (pd->proto == IPPROTO_UDP && 475 (rpool->opts & PF_POOL_ENDPI && 476 udp_mapping != NULL)) { 477 (*udp_mapping)->endpoints[1].port = htons(tmp); 478 if (pf_udp_mapping_insert(*udp_mapping) == 0) { 479 *nport = htons(tmp); 480 return (0); 481 } 482 } else { 483 key.port[sidx] = htons(tmp); 484 if (!pf_find_state_all_exists(&key, dir)) { 485 MPASS(udp_mapping == NULL || 486 *udp_mapping == NULL); 487 *nport = htons(tmp); 488 return (0); 489 } 490 } 491 } 492 } 493 494 switch (rpool->opts & PF_POOL_TYPEMASK) { 495 case PF_POOL_RANDOM: 496 case PF_POOL_ROUNDROBIN: 497 /* 498 * pick a different source address since we're out 499 * of free port choices for the current one. 500 */ 501 if (pf_map_addr_sn(pd->naf, r, &pd->nsaddr, naddr, 502 &(pd->naf), NULL, &init_addr, rpool, sn_type)) 503 goto failed; 504 break; 505 case PF_POOL_NONE: 506 case PF_POOL_SRCHASH: 507 case PF_POOL_BITMASK: 508 default: 509 goto failed; 510 } 511 } while (! PF_AEQ(&init_addr, naddr, pd->naf) ); 512 513 failed: 514 if (udp_mapping) { 515 uma_zfree(V_pf_udp_mapping_z, *udp_mapping); 516 *udp_mapping = NULL; 517 } 518 519 return (1); /* none available */ 520 } 521 522 static bool 523 pf_islinklocal(const sa_family_t af, const struct pf_addr *addr) 524 { 525 if (af == AF_INET6 && IN6_IS_ADDR_LINKLOCAL(&addr->v6)) 526 return (true); 527 return (false); 528 } 529 530 static int 531 pf_get_mape_sport(struct pf_pdesc *pd, struct pf_krule *r, 532 struct pf_addr *naddr, uint16_t *nport, struct pf_udp_mapping **udp_mapping, 533 struct pf_kpool *rpool) 534 { 535 uint16_t psmask, low, highmask; 536 uint16_t i, ahigh, cut; 537 int ashift, psidshift; 538 539 ashift = 16 - rpool->mape.offset; 540 psidshift = ashift - rpool->mape.psidlen; 541 psmask = rpool->mape.psid & ((1U << rpool->mape.psidlen) - 1); 542 psmask = psmask << psidshift; 543 highmask = (1U << psidshift) - 1; 544 545 ahigh = (1U << rpool->mape.offset) - 1; 546 cut = arc4random() & ahigh; 547 if (cut == 0) 548 cut = 1; 549 550 for (i = cut; i <= ahigh; i++) { 551 low = (i << ashift) | psmask; 552 if (!pf_get_sport(pd, r, naddr, nport, low, low | highmask, 553 rpool, udp_mapping, PF_SN_NAT)) 554 return (0); 555 } 556 for (i = cut - 1; i > 0; i--) { 557 low = (i << ashift) | psmask; 558 if (!pf_get_sport(pd, r, naddr, nport, low, low | highmask, 559 rpool, udp_mapping, PF_SN_NAT)) 560 return (0); 561 } 562 return (1); 563 } 564 565 static __inline u_short 566 pf_check_src_node_valid(struct pf_ksrc_node *sn, struct pf_kpool *rpool) 567 { 568 struct pf_addr *raddr, *rmask; 569 struct pf_addr *caddr; /* cached redirection address */ 570 struct pf_kpooladdr *pa; 571 sa_family_t raf; 572 sa_family_t caf; /* cached redirection AF */ 573 u_short valid = 0; 574 575 KASSERT(sn != NULL, ("sn is NULL")); 576 KASSERT(rpool != NULL, ("rpool is NULL")); 577 578 /* check if the cached entry is still valid */ 579 580 if (sn->type == PF_SN_LIMIT) { 581 /* Always valid as it does not store redirection address */ 582 return (1); 583 } 584 585 mtx_lock(&rpool->mtx); 586 caddr = &(sn->raddr); 587 caf = sn->raf; 588 589 TAILQ_FOREACH(pa, &rpool->list, entries) { 590 if (PF_AZERO(caddr, caf)) { 591 valid = 1; 592 goto done; 593 } else if (pa->addr.type == PF_ADDR_DYNIFTL) { 594 if (pfr_kentry_byaddr(pa->addr.p.dyn->pfid_kt, caddr, caf, 0)) { 595 valid = 1; 596 goto done; 597 } 598 } else if (pa->addr.type == PF_ADDR_TABLE) { 599 if (pfr_kentry_byaddr(pa->addr.p.tbl, caddr, caf, 0)) { 600 valid = 1; 601 goto done; 602 } 603 } else if (pa->addr.type != PF_ADDR_NOROUTE) { 604 /* PF_ADDR_URPFFAILED, PF_ADDR_RANGE, PF_ADDR_ADDRMASK */ 605 raddr = &(pa->addr.v.a.addr); 606 rmask = &(pa->addr.v.a.mask); 607 raf = pa->af; 608 if (raf == caf && pf_match_addr(0, raddr, rmask, caddr, caf)) { 609 valid = 1; 610 goto done; 611 } 612 } 613 /* else PF_ADDR_NOROUTE */ 614 } 615 616 done: 617 mtx_unlock(&rpool->mtx); 618 619 return (valid); 620 } 621 622 u_short 623 pf_map_addr(sa_family_t saf, struct pf_krule *r, struct pf_addr *saddr, 624 struct pf_addr *naddr, struct pfi_kkif **nkif, sa_family_t *naf, 625 struct pf_addr *init_addr, struct pf_kpool *rpool) 626 { 627 u_short reason = PFRES_MATCH; 628 struct pf_addr *raddr = NULL, *rmask = NULL; 629 struct pfr_ktable *kt; 630 uint64_t hashidx; 631 int cnt; 632 sa_family_t wanted_af; 633 u_int8_t pool_type; 634 bool prefer_ipv6_nexthop = rpool->opts & PF_POOL_IPV6NH; 635 636 KASSERT(saf != 0, ("%s: saf == 0", __func__)); 637 KASSERT(naf != NULL, ("%s: naf = NULL", __func__)); 638 KASSERT((*naf) != 0, ("%s: *naf = 0", __func__)); 639 640 /* 641 * Given (*naf) is a hint about AF of the forwarded packet. 642 * It might be changed if prefer_ipv6_nexthop is enabled and 643 * the combination of nexthop AF and packet AF allows for it. 644 */ 645 wanted_af = (*naf); 646 647 mtx_lock(&rpool->mtx); 648 /* Find the route using chosen algorithm. Store the found route 649 in src_node if it was given or found. */ 650 if (rpool->cur->addr.type == PF_ADDR_NOROUTE) { 651 reason = PFRES_MAPFAILED; 652 goto done_pool_mtx; 653 } 654 if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 655 switch (wanted_af) { 656 #ifdef INET 657 case AF_INET: 658 if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 && 659 !PF_POOL_DYNTYPE(rpool->opts)) { 660 reason = PFRES_MAPFAILED; 661 goto done_pool_mtx; 662 } 663 raddr = &rpool->cur->addr.p.dyn->pfid_addr4; 664 rmask = &rpool->cur->addr.p.dyn->pfid_mask4; 665 break; 666 #endif /* INET */ 667 #ifdef INET6 668 case AF_INET6: 669 if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 && 670 !PF_POOL_DYNTYPE(rpool->opts)) { 671 reason = PFRES_MAPFAILED; 672 goto done_pool_mtx; 673 } 674 raddr = &rpool->cur->addr.p.dyn->pfid_addr6; 675 rmask = &rpool->cur->addr.p.dyn->pfid_mask6; 676 break; 677 #endif /* INET6 */ 678 default: 679 unhandled_af(wanted_af); 680 } 681 } else if (rpool->cur->addr.type == PF_ADDR_TABLE) { 682 if (!PF_POOL_DYNTYPE(rpool->opts)) { 683 reason = PFRES_MAPFAILED; 684 goto done_pool_mtx; /* unsupported */ 685 } 686 } else { 687 raddr = &rpool->cur->addr.v.a.addr; 688 rmask = &rpool->cur->addr.v.a.mask; 689 } 690 691 /* 692 * For pools with a single host with the prefer-ipv6-nexthop option 693 * we can return pool address of any AF, unless the forwarded packet 694 * is IPv6, then we can return only if pool address is IPv6. 695 * For non-prefer-ipv6-nexthop we can return pool address only 696 * of wanted AF, unless the pool address'es AF is unknown, which 697 * happens in case old ioctls have been used to set up the pool. 698 * 699 * Round-robin pools have their own logic for retrying next addresses. 700 */ 701 pool_type = rpool->opts & PF_POOL_TYPEMASK; 702 if (pool_type == PF_POOL_NONE || pool_type == PF_POOL_BITMASK || 703 ((pool_type == PF_POOL_RANDOM || pool_type == PF_POOL_SRCHASH) && 704 rpool->cur->addr.type != PF_ADDR_TABLE && 705 rpool->cur->addr.type != PF_ADDR_DYNIFTL)) { 706 if (prefer_ipv6_nexthop) { 707 if (rpool->cur->af == AF_INET && (*naf) == AF_INET6) { 708 reason = PFRES_MAPFAILED; 709 goto done_pool_mtx; 710 } 711 wanted_af = rpool->cur->af; 712 } else { 713 if (rpool->cur->af != 0 && rpool->cur->af != (*naf)) { 714 reason = PFRES_MAPFAILED; 715 goto done_pool_mtx; 716 } 717 } 718 } 719 720 switch (pool_type) { 721 case PF_POOL_NONE: 722 pf_addrcpy(naddr, raddr, wanted_af); 723 break; 724 case PF_POOL_BITMASK: 725 pf_poolmask(naddr, raddr, rmask, saddr, wanted_af); 726 break; 727 case PF_POOL_RANDOM: 728 if (rpool->cur->addr.type == PF_ADDR_TABLE || 729 rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 730 if (rpool->cur->addr.type == PF_ADDR_TABLE) 731 kt = rpool->cur->addr.p.tbl; 732 else 733 kt = rpool->cur->addr.p.dyn->pfid_kt; 734 kt = pfr_ktable_select_active(kt); 735 if (kt == NULL) { 736 reason = PFRES_MAPFAILED; 737 goto done_pool_mtx; /* unsupported */ 738 } 739 cnt = kt->pfrkt_cnt; 740 if (cnt == 0) 741 rpool->tblidx = 0; 742 else 743 rpool->tblidx = (int)arc4random_uniform(cnt); 744 memset(&rpool->counter, 0, sizeof(rpool->counter)); 745 if (prefer_ipv6_nexthop) 746 wanted_af = AF_INET6; 747 retry_other_af_random: 748 if (pfr_pool_get(kt, &rpool->tblidx, &rpool->counter, 749 wanted_af, pf_islinklocal, false)) { 750 /* Retry with IPv4 nexthop for IPv4 traffic */ 751 if (prefer_ipv6_nexthop && 752 wanted_af == AF_INET6 && 753 (*naf) == AF_INET) { 754 wanted_af = AF_INET; 755 goto retry_other_af_random; 756 } else { 757 /* no hosts in wanted AF */ 758 reason = PFRES_MAPFAILED; 759 goto done_pool_mtx; 760 } 761 } 762 pf_addrcpy(naddr, &rpool->counter, wanted_af); 763 } else if (init_addr != NULL && PF_AZERO(init_addr, 764 wanted_af)) { 765 switch (wanted_af) { 766 #ifdef INET 767 case AF_INET: 768 rpool->counter.addr32[0] = arc4random(); 769 break; 770 #endif /* INET */ 771 #ifdef INET6 772 case AF_INET6: 773 if (rmask->addr32[3] != 0xffffffff) 774 rpool->counter.addr32[3] = 775 arc4random(); 776 else 777 break; 778 if (rmask->addr32[2] != 0xffffffff) 779 rpool->counter.addr32[2] = 780 arc4random(); 781 else 782 break; 783 if (rmask->addr32[1] != 0xffffffff) 784 rpool->counter.addr32[1] = 785 arc4random(); 786 else 787 break; 788 if (rmask->addr32[0] != 0xffffffff) 789 rpool->counter.addr32[0] = 790 arc4random(); 791 break; 792 #endif /* INET6 */ 793 } 794 pf_poolmask(naddr, raddr, rmask, &rpool->counter, 795 wanted_af); 796 pf_addrcpy(init_addr, naddr, wanted_af); 797 798 } else { 799 pf_addr_inc(&rpool->counter, wanted_af); 800 pf_poolmask(naddr, raddr, rmask, &rpool->counter, 801 wanted_af); 802 } 803 break; 804 case PF_POOL_SRCHASH: 805 { 806 unsigned char hash[16]; 807 808 hashidx = 809 pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, 810 wanted_af); 811 if (rpool->cur->addr.type == PF_ADDR_TABLE || 812 rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 813 if (rpool->cur->addr.type == PF_ADDR_TABLE) 814 kt = rpool->cur->addr.p.tbl; 815 else 816 kt = rpool->cur->addr.p.dyn->pfid_kt; 817 kt = pfr_ktable_select_active(kt); 818 if (kt == NULL) { 819 reason = PFRES_MAPFAILED; 820 goto done_pool_mtx; /* unsupported */ 821 } 822 cnt = kt->pfrkt_cnt; 823 if (cnt == 0) 824 rpool->tblidx = 0; 825 else 826 rpool->tblidx = (int)(hashidx % cnt); 827 memset(&rpool->counter, 0, sizeof(rpool->counter)); 828 if (prefer_ipv6_nexthop) 829 wanted_af = AF_INET6; 830 retry_other_af_srchash: 831 if (pfr_pool_get(kt, &rpool->tblidx, &rpool->counter, 832 wanted_af, pf_islinklocal, false)) { 833 /* Retry with IPv4 nexthop for IPv4 traffic */ 834 if (prefer_ipv6_nexthop && 835 wanted_af == AF_INET6 && 836 (*naf) == AF_INET) { 837 wanted_af = AF_INET; 838 goto retry_other_af_srchash; 839 } else { 840 /* no hosts in wanted AF */ 841 reason = PFRES_MAPFAILED; 842 goto done_pool_mtx; 843 } 844 } 845 pf_addrcpy(naddr, &rpool->counter, wanted_af); 846 } else { 847 pf_poolmask(naddr, raddr, rmask, 848 (struct pf_addr *)&hash, wanted_af); 849 } 850 break; 851 } 852 case PF_POOL_ROUNDROBIN: 853 { 854 struct pf_kpooladdr *acur = rpool->cur; 855 856 retry_other_af_rr: 857 if (prefer_ipv6_nexthop) 858 wanted_af = rpool->ipv6_nexthop_af; 859 if (rpool->cur->addr.type == PF_ADDR_TABLE) { 860 if (!pfr_pool_get(rpool->cur->addr.p.tbl, 861 &rpool->tblidx, &rpool->counter, wanted_af, 862 NULL, true)) 863 goto get_addr; 864 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 865 if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt, 866 &rpool->tblidx, &rpool->counter, wanted_af, 867 pf_islinklocal, true)) 868 goto get_addr; 869 } else if (rpool->cur->af == wanted_af && 870 pf_match_addr(0, raddr, rmask, &rpool->counter, wanted_af)) 871 goto get_addr; 872 if (prefer_ipv6_nexthop && 873 (*naf) == AF_INET && wanted_af == AF_INET6) { 874 /* Reset table index when changing wanted AF. */ 875 rpool->tblidx = -1; 876 rpool->ipv6_nexthop_af = AF_INET; 877 goto retry_other_af_rr; 878 } 879 try_next: 880 /* Reset prefer-ipv6-nexthop search to IPv6 when iterating pools. */ 881 rpool->ipv6_nexthop_af = AF_INET6; 882 if (TAILQ_NEXT(rpool->cur, entries) == NULL) 883 rpool->cur = TAILQ_FIRST(&rpool->list); 884 else 885 rpool->cur = TAILQ_NEXT(rpool->cur, entries); 886 try_next_ipv6_nexthop_rr: 887 /* Reset table index when iterating pools or changing wanted AF. */ 888 rpool->tblidx = -1; 889 if (prefer_ipv6_nexthop) 890 wanted_af = rpool->ipv6_nexthop_af; 891 if (rpool->cur->addr.type == PF_ADDR_TABLE) { 892 if (!pfr_pool_get(rpool->cur->addr.p.tbl, 893 &rpool->tblidx, &rpool->counter, wanted_af, NULL, 894 true)) 895 goto get_addr; 896 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 897 if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt, 898 &rpool->tblidx, &rpool->counter, wanted_af, pf_islinklocal, 899 true)) 900 goto get_addr; 901 } else { 902 if (rpool->cur->af == wanted_af) { 903 raddr = &rpool->cur->addr.v.a.addr; 904 rmask = &rpool->cur->addr.v.a.mask; 905 pf_addrcpy(&rpool->counter, raddr, wanted_af); 906 goto get_addr; 907 } 908 } 909 if (prefer_ipv6_nexthop && 910 (*naf) == AF_INET && wanted_af == AF_INET6) { 911 rpool->ipv6_nexthop_af = AF_INET; 912 goto try_next_ipv6_nexthop_rr; 913 } 914 if (rpool->cur != acur) 915 goto try_next; 916 reason = PFRES_MAPFAILED; 917 goto done_pool_mtx; 918 get_addr: 919 pf_addrcpy(naddr, &rpool->counter, wanted_af); 920 if (init_addr != NULL && PF_AZERO(init_addr, wanted_af)) 921 pf_addrcpy(init_addr, naddr, wanted_af); 922 pf_addr_inc(&rpool->counter, wanted_af); 923 break; 924 } 925 } 926 927 if (wanted_af == 0) { 928 reason = PFRES_MAPFAILED; 929 goto done_pool_mtx; 930 } 931 932 if (nkif) 933 *nkif = rpool->cur->kif; 934 935 (*naf) = wanted_af; 936 937 done_pool_mtx: 938 mtx_unlock(&rpool->mtx); 939 940 return (reason); 941 } 942 943 u_short 944 pf_map_addr_sn(sa_family_t saf, struct pf_krule *r, struct pf_addr *saddr, 945 struct pf_addr *naddr, sa_family_t *naf, struct pfi_kkif **nkif, 946 struct pf_addr *init_addr, struct pf_kpool *rpool, pf_sn_types_t sn_type) 947 { 948 struct pf_ksrc_node *sn = NULL; 949 struct pf_srchash *sh = NULL; 950 u_short reason = 0; 951 952 /* 953 * If this is a sticky-address rule, try to find an existing src_node. 954 */ 955 if (rpool->opts & PF_POOL_STICKYADDR && 956 (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) 957 sn = pf_find_src_node(saddr, r, saf, &sh, sn_type, false); 958 959 if (sn != NULL) { 960 PF_SRC_NODE_LOCK_ASSERT(sn); 961 /* 962 * Check if source node's redirection address still exists 963 * in pool from which the SN was created. If not, delete it. 964 * Similar to pf_kill_srcnodes(). Unlink the source node 965 * from tree, unlink it from states, then free it. Do not 966 * overlap source node and state locks to avoid LOR. 967 */ 968 if (!pf_check_src_node_valid(sn, rpool)) { 969 pf_unlink_src_node(sn); 970 PF_SRC_NODE_UNLOCK(sn); 971 if (V_pf_status.debug >= PF_DEBUG_NOISY) { 972 printf("%s: stale src tracking (%d) ", 973 __func__, sn_type); 974 pf_print_host(saddr, 0, saf); 975 printf(" to "); 976 pf_print_host(&(sn->raddr), 0, sn->raf); 977 if (nkif) 978 printf("@%s", sn->rkif->pfik_name); 979 printf("\n"); 980 } 981 982 for (int i = 0; i <= V_pf_hashmask; i++) { 983 struct pf_idhash *ih = &V_pf_idhash[i]; 984 struct pf_kstate *st; 985 986 PF_HASHROW_LOCK(ih); 987 LIST_FOREACH(st, &ih->states, entry) { 988 if (st->sns[sn->type] == sn) { 989 st->sns[sn->type] = NULL; 990 } 991 } 992 PF_HASHROW_UNLOCK(ih); 993 } 994 pf_free_src_node(sn); 995 counter_u64_add(V_pf_status.scounters[SCNT_SRC_NODE_REMOVALS], 1); 996 sn = NULL; 997 goto map_addr; 998 } 999 1000 (*naf) = sn->raf; 1001 1002 /* If the supplied address is the same as the current one we've 1003 * been asked before, so tell the caller that there's no other 1004 * address to be had. */ 1005 1006 if (PF_AEQ(naddr, &(sn->raddr), *naf)) { 1007 printf("%s: no more addresses\n", __func__); 1008 reason = PFRES_MAPFAILED; 1009 goto done; 1010 } 1011 1012 pf_addrcpy(naddr, &(sn->raddr), *naf); 1013 1014 if (nkif) 1015 *nkif = sn->rkif; 1016 if (V_pf_status.debug >= PF_DEBUG_NOISY) { 1017 printf("%s: src tracking maps ", __func__); 1018 pf_print_host(saddr, 0, saf); 1019 printf(" to "); 1020 pf_print_host(naddr, 0, *naf); 1021 if (nkif) 1022 printf("@%s", (*nkif)->pfik_name); 1023 printf("\n"); 1024 } 1025 goto done; 1026 } 1027 1028 map_addr: 1029 /* 1030 * Source node has not been found or is invalid. Find a new address 1031 * and store it in variables given by the caller. 1032 */ 1033 if ((reason = pf_map_addr(saf, r, saddr, naddr, nkif, naf, init_addr, 1034 rpool)) != 0) { 1035 if (V_pf_status.debug >= PF_DEBUG_MISC) 1036 printf("%s: pf_map_addr has failed\n", __func__); 1037 goto done; 1038 } 1039 1040 if (V_pf_status.debug >= PF_DEBUG_NOISY && 1041 (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) { 1042 printf("%s: selected address ", __func__); 1043 pf_print_host(naddr, 0, *naf); 1044 if (nkif) 1045 printf("@%s", (*nkif)->pfik_name); 1046 printf("\n"); 1047 } 1048 1049 done: 1050 if (sn != NULL) 1051 PF_SRC_NODE_UNLOCK(sn); 1052 1053 return (reason); 1054 } 1055 1056 u_short 1057 pf_get_translation(struct pf_test_ctx *ctx) 1058 { 1059 struct pf_krule *r = NULL; 1060 u_short transerror; 1061 1062 PF_RULES_RASSERT(); 1063 KASSERT(ctx->sk == NULL, ("*skp not NULL")); 1064 KASSERT(ctx->nk == NULL, ("*nkp not NULL")); 1065 1066 ctx->nr = NULL; 1067 1068 if (ctx->pd->dir == PF_OUT) { 1069 r = pf_match_translation(PF_RULESET_BINAT, ctx); 1070 if (r == NULL) 1071 r = pf_match_translation(PF_RULESET_NAT, ctx); 1072 } else { 1073 r = pf_match_translation(PF_RULESET_RDR, ctx); 1074 if (r == NULL) 1075 r = pf_match_translation(PF_RULESET_BINAT, ctx); 1076 } 1077 1078 if (r == NULL) 1079 return (PFRES_MAX); 1080 1081 switch (r->action) { 1082 case PF_NONAT: 1083 case PF_NOBINAT: 1084 case PF_NORDR: 1085 return (PFRES_MAX); 1086 } 1087 1088 transerror = pf_get_transaddr(ctx, r, r->action, &(r->rdr)); 1089 if (transerror == PFRES_MATCH) 1090 ctx->nr = r; 1091 1092 return (transerror); 1093 } 1094 1095 u_short 1096 pf_get_transaddr(struct pf_test_ctx *ctx, struct pf_krule *r, 1097 uint8_t nat_action, struct pf_kpool *rpool) 1098 { 1099 struct pf_pdesc *pd = ctx->pd; 1100 struct pf_addr *naddr; 1101 int idx; 1102 uint16_t *nportp; 1103 uint16_t low, high; 1104 u_short reason; 1105 1106 PF_RULES_RASSERT(); 1107 KASSERT(r != NULL, ("r is NULL")); 1108 KASSERT(!(r->rule_flag & PFRULE_AFTO), ("AFTO rule")); 1109 1110 if (ctx->sk == NULL && ctx->nk == NULL) { 1111 if (pf_state_key_setup(pd, pd->nsport, pd->ndport, &ctx->sk, 1112 &ctx->nk)) 1113 return (PFRES_MEMORY); 1114 if (ctx->sk == ctx->nk) { 1115 ctx->nk = pf_state_key_clone(ctx->sk); 1116 if (ctx->nk == NULL) { 1117 uma_zfree(V_pf_state_key_z, ctx->sk); 1118 ctx->sk = NULL; 1119 return (PFRES_MEMORY); 1120 } 1121 } 1122 } 1123 1124 switch (nat_action) { 1125 case PF_NAT: 1126 idx = pd->sidx; 1127 break; 1128 case PF_BINAT: 1129 idx = 1; 1130 break; 1131 case PF_RDR: 1132 idx = pd->didx; 1133 break; 1134 } 1135 naddr = &ctx->nk->addr[idx]; 1136 nportp = &ctx->nk->port[idx]; 1137 1138 switch (nat_action) { 1139 case PF_NAT: 1140 if (pd->proto == IPPROTO_ICMP) { 1141 low = 1; 1142 high = 65535; 1143 } else { 1144 low = rpool->proxy_port[0]; 1145 high = rpool->proxy_port[1]; 1146 } 1147 if (rpool->mape.offset > 0) { 1148 if (pf_get_mape_sport(pd, r, naddr, nportp, 1149 &ctx->udp_mapping, rpool)) { 1150 DPFPRINTF(PF_DEBUG_MISC, 1151 "pf: MAP-E port allocation (%u/%u/%u)" 1152 " failed", 1153 rpool->mape.offset, 1154 rpool->mape.psidlen, 1155 rpool->mape.psid); 1156 reason = PFRES_MAPFAILED; 1157 goto notrans; 1158 } 1159 } else if (pf_get_sport(pd, r, naddr, nportp, low, high, 1160 rpool, &ctx->udp_mapping, PF_SN_NAT)) { 1161 DPFPRINTF(PF_DEBUG_MISC, 1162 "pf: NAT proxy port allocation (%u-%u) failed", 1163 rpool->proxy_port[0], rpool->proxy_port[1]); 1164 reason = PFRES_MAPFAILED; 1165 goto notrans; 1166 } 1167 break; 1168 case PF_BINAT: 1169 switch (pd->dir) { 1170 case PF_OUT: 1171 if (rpool->cur->addr.type == PF_ADDR_DYNIFTL){ 1172 switch (pd->af) { 1173 #ifdef INET 1174 case AF_INET: 1175 if (rpool->cur->addr.p.dyn-> 1176 pfid_acnt4 < 1) { 1177 reason = PFRES_MAPFAILED; 1178 goto notrans; 1179 } 1180 pf_poolmask(naddr, 1181 &rpool->cur->addr.p.dyn->pfid_addr4, 1182 &rpool->cur->addr.p.dyn->pfid_mask4, 1183 &pd->nsaddr, AF_INET); 1184 break; 1185 #endif /* INET */ 1186 #ifdef INET6 1187 case AF_INET6: 1188 if (rpool->cur->addr.p.dyn-> 1189 pfid_acnt6 < 1) { 1190 reason = PFRES_MAPFAILED; 1191 goto notrans; 1192 } 1193 pf_poolmask(naddr, 1194 &rpool->cur->addr.p.dyn->pfid_addr6, 1195 &rpool->cur->addr.p.dyn->pfid_mask6, 1196 &pd->nsaddr, AF_INET6); 1197 break; 1198 #endif /* INET6 */ 1199 } 1200 } else 1201 pf_poolmask(naddr, 1202 &rpool->cur->addr.v.a.addr, 1203 &rpool->cur->addr.v.a.mask, &pd->nsaddr, 1204 pd->af); 1205 break; 1206 case PF_IN: 1207 if (r->src.addr.type == PF_ADDR_DYNIFTL) { 1208 switch (pd->af) { 1209 #ifdef INET 1210 case AF_INET: 1211 if (r->src.addr.p.dyn->pfid_acnt4 < 1) { 1212 reason = PFRES_MAPFAILED; 1213 goto notrans; 1214 } 1215 pf_poolmask(naddr, 1216 &r->src.addr.p.dyn->pfid_addr4, 1217 &r->src.addr.p.dyn->pfid_mask4, 1218 &pd->ndaddr, AF_INET); 1219 break; 1220 #endif /* INET */ 1221 #ifdef INET6 1222 case AF_INET6: 1223 if (r->src.addr.p.dyn->pfid_acnt6 < 1) { 1224 reason = PFRES_MAPFAILED; 1225 goto notrans; 1226 } 1227 pf_poolmask(naddr, 1228 &r->src.addr.p.dyn->pfid_addr6, 1229 &r->src.addr.p.dyn->pfid_mask6, 1230 &pd->ndaddr, AF_INET6); 1231 break; 1232 #endif /* INET6 */ 1233 } 1234 } else 1235 pf_poolmask(naddr, &r->src.addr.v.a.addr, 1236 &r->src.addr.v.a.mask, &pd->ndaddr, pd->af); 1237 break; 1238 } 1239 break; 1240 case PF_RDR: { 1241 struct pf_state_key_cmp key; 1242 int tries; 1243 uint16_t cut, low, high, nport; 1244 1245 reason = pf_map_addr_sn(pd->af, r, &pd->nsaddr, naddr, 1246 &(pd->naf), NULL, NULL, rpool, PF_SN_NAT); 1247 1248 if (reason != 0) 1249 goto notrans; 1250 if ((rpool->opts & PF_POOL_TYPEMASK) == PF_POOL_BITMASK) 1251 pf_poolmask(naddr, naddr, &rpool->cur->addr.v.a.mask, 1252 &pd->ndaddr, pd->af); 1253 1254 /* Do not change SCTP ports. */ 1255 if (pd->proto == IPPROTO_SCTP) 1256 break; 1257 1258 if (rpool->proxy_port[1]) { 1259 uint32_t tmp_nport; 1260 uint16_t div; 1261 1262 div = r->rdr.proxy_port[1] - r->rdr.proxy_port[0] + 1; 1263 div = (div == 0) ? 1 : div; 1264 1265 tmp_nport = ((ntohs(pd->ndport) - ntohs(r->dst.port[0])) % div) + 1266 rpool->proxy_port[0]; 1267 1268 /* Wrap around if necessary. */ 1269 if (tmp_nport > 65535) 1270 tmp_nport -= 65535; 1271 nport = htons((uint16_t)tmp_nport); 1272 } else if (rpool->proxy_port[0]) 1273 nport = htons(rpool->proxy_port[0]); 1274 else 1275 nport = pd->ndport; 1276 1277 /* 1278 * Update the destination port. 1279 */ 1280 *nportp = nport; 1281 1282 /* 1283 * Do we have a source port conflict in the stack state? Try to 1284 * modulate the source port if so. Note that this is racy since 1285 * the state lookup may not find any matches here but will once 1286 * pf_create_state() actually instantiates the state. 1287 */ 1288 bzero(&key, sizeof(key)); 1289 key.af = pd->af; 1290 key.proto = pd->proto; 1291 key.port[0] = pd->nsport; 1292 pf_addrcpy(&key.addr[0], &pd->nsaddr, key.af); 1293 key.port[1] = nport; 1294 pf_addrcpy(&key.addr[1], naddr, key.af); 1295 1296 if (!pf_find_state_all_exists(&key, PF_OUT)) 1297 break; 1298 1299 tries = 0; 1300 1301 low = 50001; /* XXX-MJ PF_NAT_PROXY_PORT_LOW/HIGH */ 1302 high = 65535; 1303 cut = arc4random() % (1 + high - low) + low; 1304 for (uint32_t tmp = cut; 1305 tmp <= high && tmp <= UINT16_MAX && 1306 tries < V_pf_rdr_srcport_rewrite_tries; 1307 tmp++, tries++) { 1308 key.port[0] = htons(tmp); 1309 if (!pf_find_state_all_exists(&key, PF_OUT)) { 1310 /* Update the source port. */ 1311 ctx->nk->port[0] = htons(tmp); 1312 goto out; 1313 } 1314 } 1315 for (uint32_t tmp = cut - 1; 1316 tmp >= low && tries < V_pf_rdr_srcport_rewrite_tries; 1317 tmp--, tries++) { 1318 key.port[0] = htons(tmp); 1319 if (!pf_find_state_all_exists(&key, PF_OUT)) { 1320 /* Update the source port. */ 1321 ctx->nk->port[0] = htons(tmp); 1322 goto out; 1323 } 1324 } 1325 1326 /* 1327 * We failed to find a match. Push on ahead anyway, let 1328 * pf_state_insert() be the arbiter of whether the state 1329 * conflict is tolerable. In particular, with TCP connections 1330 * the state may be reused if the TCP state is terminal. 1331 */ 1332 DPFPRINTF(PF_DEBUG_MISC, 1333 "pf: RDR source port allocation failed"); 1334 break; 1335 1336 out: 1337 DPFPRINTF(PF_DEBUG_MISC, 1338 "pf: RDR source port allocation %u->%u", 1339 ntohs(pd->nsport), ntohs(ctx->nk->port[0])); 1340 break; 1341 } 1342 default: 1343 panic("%s: unknown action %u", __func__, r->action); 1344 } 1345 1346 /* Return success only if translation really happened. */ 1347 if (bcmp(ctx->sk, ctx->nk, sizeof(struct pf_state_key_cmp))) { 1348 return (PFRES_MATCH); 1349 } 1350 1351 reason = PFRES_MAX; 1352 notrans: 1353 uma_zfree(V_pf_state_key_z, ctx->nk); 1354 if (ctx->nk != ctx->sk) 1355 uma_zfree(V_pf_state_key_z, ctx->sk); 1356 ctx->sk = ctx->nk = NULL; 1357 1358 return (reason); 1359 } 1360 1361 int 1362 pf_get_transaddr_af(struct pf_krule *r, struct pf_pdesc *pd) 1363 { 1364 #if defined(INET) && defined(INET6) 1365 struct pf_addr ndaddr, nsaddr, naddr; 1366 u_int16_t nport = 0; 1367 int prefixlen = 96; 1368 1369 bzero(&nsaddr, sizeof(nsaddr)); 1370 bzero(&ndaddr, sizeof(ndaddr)); 1371 1372 if (V_pf_status.debug >= PF_DEBUG_MISC) { 1373 printf("pf: af-to %s %s, ", 1374 pd->naf == AF_INET ? "inet" : "inet6", 1375 TAILQ_EMPTY(&r->rdr.list) ? "nat" : "rdr"); 1376 pf_print_host(&pd->nsaddr, pd->nsport, pd->af); 1377 printf(" -> "); 1378 pf_print_host(&pd->ndaddr, pd->ndport, pd->af); 1379 printf("\n"); 1380 } 1381 1382 if (TAILQ_EMPTY(&r->nat.list)) 1383 panic("pf_get_transaddr_af: no nat pool for source address"); 1384 1385 /* get source address and port */ 1386 if (pf_get_sport(pd, r, &nsaddr, &nport, r->nat.proxy_port[0], 1387 r->nat.proxy_port[1], &r->nat, NULL, PF_SN_NAT)) { 1388 DPFPRINTF(PF_DEBUG_MISC, 1389 "pf: af-to NAT proxy port allocation (%u-%u) failed", 1390 r->nat.proxy_port[0], r->nat.proxy_port[1]); 1391 return (-1); 1392 } 1393 1394 if (pd->proto == IPPROTO_ICMPV6 && pd->naf == AF_INET) { 1395 pd->ndport = ntohs(pd->ndport); 1396 if (pd->ndport == ICMP6_ECHO_REQUEST) 1397 pd->ndport = ICMP_ECHO; 1398 else if (pd->ndport == ICMP6_ECHO_REPLY) 1399 pd->ndport = ICMP_ECHOREPLY; 1400 pd->ndport = htons(pd->ndport); 1401 } else if (pd->proto == IPPROTO_ICMP && pd->naf == AF_INET6) { 1402 pd->nsport = ntohs(pd->nsport); 1403 if (pd->ndport == ICMP_ECHO) 1404 pd->ndport = ICMP6_ECHO_REQUEST; 1405 else if (pd->ndport == ICMP_ECHOREPLY) 1406 pd->ndport = ICMP6_ECHO_REPLY; 1407 pd->nsport = htons(pd->nsport); 1408 } 1409 1410 /* get the destination address and port */ 1411 if (! TAILQ_EMPTY(&r->rdr.list)) { 1412 if (pf_map_addr_sn(pd->naf, r, &nsaddr, &naddr, &(pd->naf), 1413 NULL, NULL, &r->rdr, PF_SN_NAT)) 1414 return (-1); 1415 if (r->rdr.proxy_port[0]) 1416 pd->ndport = htons(r->rdr.proxy_port[0]); 1417 1418 if (pd->naf == AF_INET) { 1419 /* The prefix is the IPv4 rdr address */ 1420 prefixlen = in_mask2len( 1421 (struct in_addr *)&r->rdr.cur->addr.v.a.mask); 1422 inet_nat46(pd->naf, &pd->ndaddr, &ndaddr, &naddr, 1423 prefixlen); 1424 } else { 1425 /* The prefix is the IPv6 rdr address */ 1426 prefixlen = in6_mask2len( 1427 (struct in6_addr *)&r->rdr.cur->addr.v.a.mask, NULL); 1428 inet_nat64(pd->naf, &pd->ndaddr, &ndaddr, &naddr, 1429 prefixlen); 1430 } 1431 } else { 1432 if (pd->naf == AF_INET) { 1433 /* The prefix is the IPv6 dst address */ 1434 prefixlen = in6_mask2len( 1435 (struct in6_addr *)&r->dst.addr.v.a.mask, NULL); 1436 if (prefixlen < 32) 1437 prefixlen = 96; 1438 inet_nat64(pd->naf, &pd->ndaddr, &ndaddr, &pd->ndaddr, 1439 prefixlen); 1440 } else { 1441 /* 1442 * The prefix is the IPv6 nat address 1443 * (that was stored in pd->nsaddr) 1444 */ 1445 prefixlen = in6_mask2len( 1446 (struct in6_addr *)&r->nat.cur->addr.v.a.mask, NULL); 1447 if (prefixlen > 96) 1448 prefixlen = 96; 1449 inet_nat64(pd->naf, &pd->ndaddr, &ndaddr, &nsaddr, 1450 prefixlen); 1451 } 1452 } 1453 1454 pf_addrcpy(&pd->nsaddr, &nsaddr, pd->naf); 1455 pf_addrcpy(&pd->ndaddr, &ndaddr, pd->naf); 1456 1457 if (V_pf_status.debug >= PF_DEBUG_MISC) { 1458 printf("pf: af-to %s done, prefixlen %d, ", 1459 pd->naf == AF_INET ? "inet" : "inet6", 1460 prefixlen); 1461 pf_print_host(&pd->nsaddr, pd->nsport, pd->naf); 1462 printf(" -> "); 1463 pf_print_host(&pd->ndaddr, pd->ndport, pd->naf); 1464 printf("\n"); 1465 } 1466 1467 return (0); 1468 #else 1469 return (-1); 1470 #endif 1471 } 1472