/*-
* Copyright (c) 2014-2020 Mindaugas Rasiukevicius <rmind at noxt eu>
* Copyright (c) 2010-2013 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This material is based upon work partially supported by The
* NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
/*
* NPF network address port translation (NAPT) and other forms of NAT.
* Described in RFC 2663, RFC 3022, etc.
*
* Overview
*
* There are a few mechanisms: NAT policy, port map and translation.
* The NAT module has a separate ruleset where rules always have an
* associated NAT policy.
*
* Translation types
*
* There are two types of translation: outbound (NPF_NATOUT) and
* inbound (NPF_NATIN). It should not be confused with connection
* direction. See npf_nat_which() for the description of how the
* addresses are rewritten. The bi-directional NAT is a combined
* outbound and inbound translation, therefore is constructed as
* two policies.
*
* NAT policies and port maps
*
* The NAT (translation) policy is applied when packet matches the
* rule. Apart from the filter criteria, the NAT policy always has
* a translation IP address or a table. If port translation is set,
* then NAT mechanism relies on port map mechanism.
*
* Connections, translation entries and their life-cycle
*
* NAT relies on the connection tracking module. Each translated
* connection has an associated translation entry (npf_nat_t) which
* contains information used for backwards stream translation, i.e.
* the original IP address with port and translation port, allocated
* from the port map. Each NAT entry is associated with the policy,
* which contains translation IP address. Allocated port is returned
* to the port map and NAT entry is destroyed when connection expires.
*/
/*
* Translation type, flags, address or table and the port.
* Additionally, there may be translation algorithm and any
* auxiliary data, e.g. NPTv6 adjustment value.
*
* NPF_NP_CMP_START mark starts here.
*/
unsigned n_type;
unsigned n_flags;
unsigned n_alen;
/*
* NAT entry for a connection.
*/
struct npf_nat {
/* Associated NAT policy. */
npf_natpolicy_t * nt_natpolicy;
uint16_t nt_ifid;
uint16_t nt_alen;
/*
* Translation address as well as the original address which is
* used for backwards translation. The same for ports.
*/
npf_addr_t nt_taddr;
npf_addr_t nt_oaddr;
in_port_t nt_oport;
in_port_t nt_tport;
/* ALG (if any) associated with this NAT entry. */
npf_alg_t * nt_alg;
uintptr_t nt_alg_arg;
/* Should be exclusively either inbound or outbound NAT. */
if (((np->n_type == NPF_NATIN) ^ (np->n_type == NPF_NATOUT)) == 0) {
goto err;
}
mutex_init(&np->n_lock, MUTEX_DEFAULT, IPL_SOFTNET);
LIST_INIT(&np->n_nat_list);
/*
* Translation IP, mask and port (if applicable). If using the
* the table, specified by the ID, then the nat-addr/nat-mask will
* be used as a filter for the addresses selected from table.
*/
if (nvlist_exists_number(nat, "nat-table-id")) {
if (np->n_flags & NPF_NAT_STATIC) {
goto err;
}
np->n_tid = nvlist_get_number(nat, "nat-table-id");
np->n_tmask = NPF_NO_NETMASK;
np->n_flags |= NPF_NAT_USETABLE;
} else {
addr = dnvlist_get_binary(nat, "nat-addr", &len, NULL, 0);
if (!addr || len == 0 || len > sizeof(npf_addr_t)) {
goto err;
}
memcpy(&np->n_taddr, addr, len);
np->n_alen = len;
np->n_tmask = dnvlist_get_number(nat, "nat-mask", NPF_NO_NETMASK);
if (npf_netmask_check(np->n_alen, np->n_tmask)) {
goto err;
}
}
np->n_tport = dnvlist_get_number(nat, "nat-port", 0);
/*
* NAT algorithm.
*/
np->n_algo = dnvlist_get_number(nat, "nat-algo", 0);
switch (np->n_algo) {
case NPF_ALGO_NPT66:
np->n_npt66_adj = dnvlist_get_number(nat, "npt66-adj", 0);
break;
case NPF_ALGO_NETMAP:
break;
case NPF_ALGO_IPHASH:
case NPF_ALGO_RR:
default:
if (np->n_tmask != NPF_NO_NETMASK) {
goto err;
}
break;
}
return np;
err:
mutex_destroy(&np->n_lock);
kmem_free(np, sizeof(npf_natpolicy_t));
return NULL;
}
/*
* npf_natpolicy_destroy: free the NAT policy.
*
* => Called from npf_rule_free() during the reload via npf_ruleset_destroy().
* => At this point, NAT policy cannot acquire new references.
*/
void
npf_natpolicy_destroy(npf_natpolicy_t *np)
{
/*
* Drain the references. If there are active NAT connections,
* then expire them and kick the worker.
*/
if (atomic_load_relaxed(&np->n_refcnt) > 1) {
npf_nat_t *nt;
/*
* Drop the initial reference, but it might not be the last one.
* If so, the last reference will be triggered via:
*
* npf_conn_destroy() -> npf_nat_destroy() -> npf_natpolicy_release()
*/
npf_natpolicy_release(np);
}
/*
* npf_nat_which: tell which address (source or destination) should be
* rewritten given the combination of the NAT type and flow direction.
*
* => Returns NPF_SRC or NPF_DST constant.
*/
static inline unsigned
npf_nat_which(const unsigned type, const npf_flow_t flow)
{
unsigned which;
/* The logic below relies on these values being 0 or 1. */
CTASSERT(NPF_SRC == 0 && NPF_DST == 1);
CTASSERT(NPF_FLOW_FORW == NPF_SRC && NPF_FLOW_BACK == NPF_DST);
/* Construct a new NAT entry and associate it with the connection. */
nt = pool_cache_get(nat_cache, PR_NOWAIT);
if (__predict_false(!nt)) {
return NULL;
}
npf_stats_inc(npf, NPF_STAT_NAT_CREATE);
nt->nt_natpolicy = np;
nt->nt_conn = con;
nt->nt_alg = NULL;
/*
* Save the interface ID.
*
* Note: this can be different from the given connection if it
* was established on a different interface, using the global state
* mode (state.key.interface = 0).
*/
KASSERT(nbuf->nb_ifid != 0);
nt->nt_ifid = nbuf->nb_ifid;
/*
* Select the translation address.
*/
if (np->n_flags & NPF_NAT_USETABLE) {
int slock = npf_config_read_enter(npf);
taddr = npf_nat_getaddr(npc, np, alen);
if (__predict_false(!taddr)) {
npf_config_read_exit(npf, slock);
pool_cache_put(nat_cache, nt);
return NULL;
}
memcpy(&nt->nt_taddr, taddr, alen);
npf_config_read_exit(npf, slock);
/* Save the original address which may be rewritten. */
if (np->n_type == NPF_NATOUT) {
/* Outbound NAT: source (think internal) address. */
memcpy(&nt->nt_oaddr, npc->npc_ips[NPF_SRC], alen);
} else {
/* Inbound NAT: destination (think external) address. */
KASSERT(np->n_type == NPF_NATIN);
memcpy(&nt->nt_oaddr, npc->npc_ips[NPF_DST], alen);
}
/*
* Port translation, if required, and if it is TCP/UDP.
*/
if ((np->n_flags & NPF_NAT_PORTS) == 0 ||
(proto != IPPROTO_TCP && proto != IPPROTO_UDP)) {
nt->nt_oport = 0;
nt->nt_tport = 0;
goto out;
}
/* Get a new port for translation. */
if ((np->n_flags & NPF_NAT_PORTMAP) != 0) {
npf_portmap_t *pm = np->n_npfctx->portmap;
nt->nt_tport = npf_portmap_get(pm, alen, taddr);
} else {
nt->nt_tport = np->n_tport;
}
out:
mutex_enter(&np->n_lock);
LIST_INSERT_HEAD(&np->n_nat_list, nt, nt_entry);
/* Note: we also consume the reference on policy. */
mutex_exit(&np->n_lock);
return nt;
}
/*
* npf_dnat_translate: perform translation given the state data.
*/
static inline int
npf_dnat_translate(npf_cache_t *npc, npf_nat_t *nt, npf_flow_t flow)
{
const npf_natpolicy_t *np = nt->nt_natpolicy;
const unsigned which = npf_nat_which(np->n_type, flow);
const npf_addr_t *addr;
in_port_t port;
/*
* Associate NAT policy with an existing connection state.
*/
npf_nat_t *
npf_nat_share_policy(npf_cache_t *npc, npf_conn_t *con, npf_nat_t *src_nt)
{
npf_natpolicy_t *np = src_nt->nt_natpolicy;
npf_nat_t *nt;
int ret;
/* Create a new NAT entry. */
nt = npf_nat_create(npc, np, con);
if (__predict_false(nt == NULL)) {
return NULL;
}
atomic_inc_uint(&np->n_refcnt);
/* Associate the NAT translation entry with the connection. */
ret = npf_conn_setnat(npc, con, nt, np->n_type);
if (__predict_false(ret)) {
/* Will release the reference. */
npf_nat_destroy(con, nt);
return NULL;
}
return nt;
}
/*
* npf_nat_lookup: lookup the (dynamic) NAT state and return its entry,
*
* => Checks that the packet is on the interface where NAT policy is applied.
* => Determines the flow direction in the context of the NAT policy.
*/
static npf_nat_t *
npf_nat_lookup(const npf_cache_t *npc, npf_conn_t *con,
const unsigned di, npf_flow_t *flow)
{
const nbuf_t *nbuf = npc->npc_nbuf;
const npf_natpolicy_t *np;
npf_nat_t *nt;
if ((nt = npf_conn_getnat(con)) == NULL) {
return NULL;
}
if (nt->nt_ifid != nbuf->nb_ifid) {
return NULL;
}
/*
* We rely on NPF_NAT{IN,OUT} being equal to PFIL_{IN,OUT}.
*/
CTASSERT(NPF_NATIN == PFIL_IN && NPF_NATOUT == PFIL_OUT);
*flow = (np->n_type == di) ? NPF_FLOW_FORW : NPF_FLOW_BACK;
return nt;
}
/*
* npf_do_nat:
*
* - Inspect packet for a NAT policy, unless a connection with a NAT
* association already exists. In such case, determine whether it
* is a "forwards" or "backwards" stream.
*
* - Perform translation: rewrite source or destination fields,
* depending on translation type and direction.
*
* - Associate a NAT policy with a connection (may establish a new).
*/
int
npf_do_nat(npf_cache_t *npc, npf_conn_t *con, const unsigned di)
{
nbuf_t *nbuf = npc->npc_nbuf;
npf_conn_t *ncon = NULL;
npf_natpolicy_t *np;
npf_flow_t flow;
npf_nat_t *nt;
int error;
/* All relevant data should be already cached. */
if (!npf_iscached(npc, NPC_IP46) || !npf_iscached(npc, NPC_LAYER4)) {
return 0;
}
KASSERT(!nbuf_flag_p(nbuf, NBUF_DATAREF_RESET));
/*
* Return the NAT entry associated with the connection, if any.
* Determines whether the stream is "forwards" or "backwards".
* Note: no need to lock, since reference on connection is held.
*/
if (con && (nt = npf_nat_lookup(npc, con, di, &flow)) != NULL) {
np = nt->nt_natpolicy;
goto translate;
}
/*
* Inspect the packet for a NAT policy, if there is no connection.
* Note: acquires a reference if found.
*/
np = npf_nat_inspect(npc, di);
if (np == NULL) {
/* If packet does not match - done. */
return 0;
}
flow = NPF_FLOW_FORW;
/* Static NAT - just perform the translation. */
if (np->n_flags & NPF_NAT_STATIC) {
if (nbuf_cksum_barrier(nbuf, di)) {
npf_recache(npc);
}
error = npf_snat_translate(npc, np, flow);
npf_natpolicy_release(np);
return error;
}
/*
* If there is no local connection (no "stateful" rule - unusual,
* but possible configuration), establish one before translation.
* Note that it is not a "pass" connection, therefore passing of
* "backwards" stream depends on other, stateless filtering rules.
*/
if (con == NULL) {
ncon = npf_conn_establish(npc, di, true);
if (ncon == NULL) {
npf_natpolicy_release(np);
return ENOMEM;
}
con = ncon;
}
/*
* Create a new NAT entry and associate with the connection.
* We will consume the reference on success (release on error).
*/
nt = npf_nat_create(npc, np, con);
if (nt == NULL) {
npf_natpolicy_release(np);
error = ENOMEM;
goto out;
}
/* Determine whether any ALG matches. */
if (npf_alg_match(npc, nt, di)) {
KASSERT(nt->nt_alg != NULL);
}
/* Associate the NAT translation entry with the connection. */
error = npf_conn_setnat(npc, con, nt, np->n_type);
if (error) {
/* Will release the reference. */
npf_nat_destroy(con, nt);
goto out;
}
translate:
/* May need to process the delayed checksums first (XXX: NetBSD). */
if (nbuf_cksum_barrier(nbuf, di)) {
npf_recache(npc);
}
/* Perform the translation. */
error = npf_dnat_translate(npc, nt, flow);
out:
if (__predict_false(ncon)) {
if (error) {
/* It was created for NAT - just expire. */
npf_conn_expire(ncon);
}
npf_conn_release(ncon);
}
return error;
}
/* Execute the ALG destroy callback, if any. */
if ((alg = npf_nat_getalg(nt)) != NULL) {
npf_alg_destroy(npf, alg, nt, con);
nt->nt_alg = NULL;
}
/* Return taken port to the portmap. */
if ((np->n_flags & NPF_NAT_PORTMAP) != 0 && nt->nt_tport) {
npf_portmap_t *pm = npf->portmap;
npf_portmap_put(pm, nt->nt_alen, &nt->nt_taddr, nt->nt_tport);
}
npf_stats_inc(np->n_npfctx, NPF_STAT_NAT_DESTROY);
/*
* Remove the connection from the list and drop the reference on
* the NAT policy. Note: this might trigger its destruction.
*/
mutex_enter(&np->n_lock);
LIST_REMOVE(nt, nt_entry);
mutex_exit(&np->n_lock);
npf_natpolicy_release(np);
