nat64stl.c revision 304046
1304046Sae/*-
2304046Sae * Copyright (c) 2015-2016 Yandex LLC
3304046Sae * Copyright (c) 2015-2016 Andrey V. Elsukov <ae@FreeBSD.org>
4304046Sae * All rights reserved.
5304046Sae *
6304046Sae * Redistribution and use in source and binary forms, with or without
7304046Sae * modification, are permitted provided that the following conditions
8304046Sae * are met:
9304046Sae *
10304046Sae * 1. Redistributions of source code must retain the above copyright
11304046Sae *    notice, this list of conditions and the following disclaimer.
12304046Sae * 2. Redistributions in binary form must reproduce the above copyright
13304046Sae *    notice, this list of conditions and the following disclaimer in the
14304046Sae *    documentation and/or other materials provided with the distribution.
15304046Sae *
16304046Sae * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17304046Sae * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18304046Sae * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19304046Sae * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20304046Sae * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21304046Sae * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22304046Sae * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23304046Sae * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24304046Sae * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25304046Sae * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26304046Sae */
27304046Sae
28304046Sae#include <sys/cdefs.h>
29304046Sae__FBSDID("$FreeBSD: head/sys/netpfil/ipfw/nat64/nat64stl.c 304046 2016-08-13 16:09:49Z ae $");
30304046Sae
31304046Sae#include <sys/param.h>
32304046Sae#include <sys/systm.h>
33304046Sae#include <sys/counter.h>
34304046Sae#include <sys/kernel.h>
35304046Sae#include <sys/lock.h>
36304046Sae#include <sys/mbuf.h>
37304046Sae#include <sys/module.h>
38304046Sae#include <sys/rmlock.h>
39304046Sae#include <sys/rwlock.h>
40304046Sae#include <sys/socket.h>
41304046Sae#include <sys/sysctl.h>
42304046Sae
43304046Sae#include <net/if.h>
44304046Sae#include <net/if_var.h>
45304046Sae#include <net/if_pflog.h>
46304046Sae#include <net/pfil.h>
47304046Sae
48304046Sae#include <netinet/in.h>
49304046Sae#include <netinet/ip.h>
50304046Sae#include <netinet/ip_icmp.h>
51304046Sae#include <netinet/ip_var.h>
52304046Sae#include <netinet/ip_fw.h>
53304046Sae#include <netinet/ip6.h>
54304046Sae#include <netinet/icmp6.h>
55304046Sae#include <netinet6/ip_fw_nat64.h>
56304046Sae
57304046Sae#include <netpfil/ipfw/ip_fw_private.h>
58304046Sae#include <netpfil/ipfw/nat64/ip_fw_nat64.h>
59304046Sae#include <netpfil/ipfw/nat64/nat64_translate.h>
60304046Sae#include <netpfil/ipfw/nat64/nat64stl.h>
61304046Sae#include <netpfil/pf/pf.h>
62304046Sae
63304046Sae#define	NAT64_LOOKUP(chain, cmd)	\
64304046Sae	(struct nat64stl_cfg *)SRV_OBJECT((chain), (cmd)->arg1)
65304046Sae
66304046Saestatic void
67304046Saenat64stl_log(struct pfloghdr *plog, struct mbuf *m, sa_family_t family,
68304046Sae    uint32_t kidx)
69304046Sae{
70304046Sae	static uint32_t pktid = 0;
71304046Sae
72304046Sae	memset(plog, 0, sizeof(plog));
73304046Sae	plog->length = PFLOG_REAL_HDRLEN;
74304046Sae	plog->af = family;
75304046Sae	plog->action = PF_NAT;
76304046Sae	plog->dir = PF_IN;
77304046Sae	plog->rulenr = htonl(kidx);
78304046Sae	plog->subrulenr = htonl(++pktid);
79304046Sae	plog->ruleset[0] = '\0';
80304046Sae	strlcpy(plog->ifname, "NAT64STL", sizeof(plog->ifname));
81304046Sae	ipfw_bpf_mtap2(plog, PFLOG_HDRLEN, m);
82304046Sae}
83304046Sae
84304046Saestatic int
85304046Saenat64stl_handle_ip4(struct ip_fw_chain *chain, struct nat64stl_cfg *cfg,
86304046Sae    struct mbuf *m, uint32_t tablearg)
87304046Sae{
88304046Sae	struct pfloghdr loghdr, *logdata;
89304046Sae	struct in6_addr saddr, daddr;
90304046Sae	struct ip *ip;
91304046Sae
92304046Sae	ip = mtod(m, struct ip*);
93304046Sae	if (nat64_check_ip4(ip->ip_src.s_addr) != 0 ||
94304046Sae	    nat64_check_ip4(ip->ip_dst.s_addr) != 0 ||
95304046Sae	    nat64_check_private_ip4(ip->ip_src.s_addr) != 0 ||
96304046Sae	    nat64_check_private_ip4(ip->ip_dst.s_addr) != 0)
97304046Sae		return (NAT64SKIP);
98304046Sae
99304046Sae	daddr = TARG_VAL(chain, tablearg, nh6);
100304046Sae	if (nat64_check_ip6(&daddr) != 0)
101304046Sae		return (NAT64MFREE);
102304046Sae	saddr = cfg->prefix6;
103304046Sae	nat64_set_ip4(&saddr, ip->ip_src.s_addr);
104304046Sae
105304046Sae	if (cfg->flags & NAT64_LOG) {
106304046Sae		logdata = &loghdr;
107304046Sae		nat64stl_log(logdata, m, AF_INET, cfg->no.kidx);
108304046Sae	} else
109304046Sae		logdata = NULL;
110304046Sae	return (nat64_do_handle_ip4(m, &saddr, &daddr, 0, &cfg->stats,
111304046Sae	    logdata));
112304046Sae}
113304046Sae
114304046Saestatic int
115304046Saenat64stl_handle_ip6(struct ip_fw_chain *chain, struct nat64stl_cfg *cfg,
116304046Sae    struct mbuf *m, uint32_t tablearg)
117304046Sae{
118304046Sae	struct pfloghdr loghdr, *logdata;
119304046Sae	struct ip6_hdr *ip6;
120304046Sae	uint32_t aaddr;
121304046Sae
122304046Sae	aaddr = htonl(TARG_VAL(chain, tablearg, nh4));
123304046Sae
124304046Sae	/*
125304046Sae	 * NOTE: we expect ipfw_chk() did m_pullup() up to upper level
126304046Sae	 * protocol's headers. Also we skip some checks, that ip6_input(),
127304046Sae	 * ip6_forward(), ip6_fastfwd() and ipfw_chk() already did.
128304046Sae	 */
129304046Sae	ip6 = mtod(m, struct ip6_hdr *);
130304046Sae	/* Check ip6_dst matches configured prefix */
131304046Sae	if (bcmp(&ip6->ip6_dst, &cfg->prefix6, cfg->plen6 / 8) != 0)
132304046Sae		return (NAT64SKIP);
133304046Sae
134304046Sae	if (cfg->flags & NAT64_LOG) {
135304046Sae		logdata = &loghdr;
136304046Sae		nat64stl_log(logdata, m, AF_INET6, cfg->no.kidx);
137304046Sae	} else
138304046Sae		logdata = NULL;
139304046Sae	return (nat64_do_handle_ip6(m, aaddr, 0, &cfg->stats, logdata));
140304046Sae}
141304046Sae
142304046Saestatic int
143304046Saenat64stl_handle_icmp6(struct ip_fw_chain *chain, struct nat64stl_cfg *cfg,
144304046Sae    struct mbuf *m)
145304046Sae{
146304046Sae	struct pfloghdr loghdr, *logdata;
147304046Sae	nat64_stats_block *stats;
148304046Sae	struct ip6_hdr *ip6i;
149304046Sae	struct icmp6_hdr *icmp6;
150304046Sae	uint32_t tablearg;
151304046Sae	int hlen, proto;
152304046Sae
153304046Sae	hlen = 0;
154304046Sae	stats = &cfg->stats;
155304046Sae	proto = nat64_getlasthdr(m, &hlen);
156304046Sae	if (proto != IPPROTO_ICMPV6) {
157304046Sae		NAT64STAT_INC(stats, dropped);
158304046Sae		return (NAT64MFREE);
159304046Sae	}
160304046Sae	icmp6 = mtodo(m, hlen);
161304046Sae	switch (icmp6->icmp6_type) {
162304046Sae	case ICMP6_DST_UNREACH:
163304046Sae	case ICMP6_PACKET_TOO_BIG:
164304046Sae	case ICMP6_TIME_EXCEED_TRANSIT:
165304046Sae	case ICMP6_PARAM_PROB:
166304046Sae		break;
167304046Sae	default:
168304046Sae		NAT64STAT_INC(stats, dropped);
169304046Sae		return (NAT64MFREE);
170304046Sae	}
171304046Sae	hlen += sizeof(struct icmp6_hdr);
172304046Sae	if (m->m_pkthdr.len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN) {
173304046Sae		NAT64STAT_INC(stats, dropped);
174304046Sae		return (NAT64MFREE);
175304046Sae	}
176304046Sae	if (m->m_len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN)
177304046Sae		m = m_pullup(m, hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN);
178304046Sae	if (m == NULL) {
179304046Sae		NAT64STAT_INC(stats, nomem);
180304046Sae		return (NAT64RETURN);
181304046Sae	}
182304046Sae	/*
183304046Sae	 * Use destination address from inner IPv6 header to determine
184304046Sae	 * IPv4 mapped address.
185304046Sae	 */
186304046Sae	ip6i = mtodo(m, hlen);
187304046Sae	if (ipfw_lookup_table_extended(chain, cfg->map64,
188304046Sae	    sizeof(struct in6_addr), &ip6i->ip6_dst, &tablearg) == 0) {
189304046Sae		m_freem(m);
190304046Sae		return (NAT64RETURN);
191304046Sae	}
192304046Sae	if (cfg->flags & NAT64_LOG) {
193304046Sae		logdata = &loghdr;
194304046Sae		nat64stl_log(logdata, m, AF_INET6, cfg->no.kidx);
195304046Sae	} else
196304046Sae		logdata = NULL;
197304046Sae	return (nat64_handle_icmp6(m, 0,
198304046Sae	    htonl(TARG_VAL(chain, tablearg, nh4)), 0, stats, logdata));
199304046Sae}
200304046Sae
201304046Saeint
202304046Saeipfw_nat64stl(struct ip_fw_chain *chain, struct ip_fw_args *args,
203304046Sae    ipfw_insn *cmd, int *done)
204304046Sae{
205304046Sae	ipfw_insn *icmd;
206304046Sae	struct nat64stl_cfg *cfg;
207304046Sae	uint32_t tablearg;
208304046Sae	int ret;
209304046Sae
210304046Sae	IPFW_RLOCK_ASSERT(chain);
211304046Sae
212304046Sae	*done = 0; /* try next rule if not matched */
213304046Sae	icmd = cmd + 1;
214304046Sae	if (cmd->opcode != O_EXTERNAL_ACTION ||
215304046Sae	    cmd->arg1 != V_nat64stl_eid ||
216304046Sae	    icmd->opcode != O_EXTERNAL_INSTANCE ||
217304046Sae	    (cfg = NAT64_LOOKUP(chain, icmd)) == NULL)
218304046Sae		return (0);
219304046Sae
220304046Sae	switch (args->f_id.addr_type) {
221304046Sae	case 4:
222304046Sae		ret = ipfw_lookup_table(chain, cfg->map46,
223304046Sae		    htonl(args->f_id.dst_ip), &tablearg);
224304046Sae		break;
225304046Sae	case 6:
226304046Sae		ret = ipfw_lookup_table_extended(chain, cfg->map64,
227304046Sae		    sizeof(struct in6_addr), &args->f_id.src_ip6, &tablearg);
228304046Sae		break;
229304046Sae	default:
230304046Sae		return (0);
231304046Sae	}
232304046Sae	if (ret == 0) {
233304046Sae		/*
234304046Sae		 * In case when packet is ICMPv6 message from an intermediate
235304046Sae		 * router, the source address of message will not match the
236304046Sae		 * addresses from our map64 table.
237304046Sae		 */
238304046Sae		if (args->f_id.proto != IPPROTO_ICMPV6)
239304046Sae			return (0);
240304046Sae
241304046Sae		ret = nat64stl_handle_icmp6(chain, cfg, args->m);
242304046Sae	} else {
243304046Sae		if (args->f_id.addr_type == 4)
244304046Sae			ret = nat64stl_handle_ip4(chain, cfg, args->m,
245304046Sae			    tablearg);
246304046Sae		else
247304046Sae			ret = nat64stl_handle_ip6(chain, cfg, args->m,
248304046Sae			    tablearg);
249304046Sae	}
250304046Sae	if (ret == NAT64SKIP)
251304046Sae		return (0);
252304046Sae
253304046Sae	*done = 1; /* terminate the search */
254304046Sae	if (ret == NAT64MFREE)
255304046Sae		m_freem(args->m);
256304046Sae	args->m = NULL;
257304046Sae	return (IP_FW_DENY);
258304046Sae}
259304046Sae
260304046Sae
261