pf_lb.c revision 240641
1/* $OpenBSD: pf_lb.c,v 1.2 2009/02/12 02:13:15 sthen Exp $ */ 2 3/* 4 * Copyright (c) 2001 Daniel Hartmeier 5 * Copyright (c) 2002 - 2008 Henning Brauer 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * - Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * - Redistributions in binary form must reproduce the above 15 * copyright notice, this list of conditions and the following 16 * disclaimer in the documentation and/or other materials provided 17 * with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN 29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 * 32 * Effort sponsored in part by the Defense Advanced Research Projects 33 * Agency (DARPA) and Air Force Research Laboratory, Air Force 34 * Materiel Command, USAF, under agreement number F30602-01-2-0537. 35 * 36 */ 37 38#include <sys/cdefs.h> 39__FBSDID("$FreeBSD: head/sys/netpfil/pf/pf_lb.c 240641 2012-09-18 10:54:56Z glebius $"); 40 41#include "opt_pf.h" 42#include "opt_inet.h" 43#include "opt_inet6.h" 44 45#include <sys/param.h> 46#include <sys/socket.h> 47#include <sys/sysctl.h> 48 49#include <net/if.h> 50#include <net/pfvar.h> 51#include <net/if_pflog.h> 52#include <net/pf_mtag.h> 53 54#define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x 55 56static void pf_hash(struct pf_addr *, struct pf_addr *, 57 struct pf_poolhashkey *, sa_family_t); 58static struct pf_rule *pf_match_translation(struct pf_pdesc *, struct mbuf *, 59 int, int, struct pfi_kif *, 60 struct pf_addr *, u_int16_t, struct pf_addr *, 61 uint16_t, int, struct pf_anchor_stackframe *); 62static int pf_get_sport(sa_family_t, u_int8_t, struct pf_rule *, 63 struct pf_addr *, struct pf_addr *, u_int16_t, 64 struct pf_addr *, u_int16_t*, u_int16_t, u_int16_t, 65 struct pf_src_node **); 66 67#define mix(a,b,c) \ 68 do { \ 69 a -= b; a -= c; a ^= (c >> 13); \ 70 b -= c; b -= a; b ^= (a << 8); \ 71 c -= a; c -= b; c ^= (b >> 13); \ 72 a -= b; a -= c; a ^= (c >> 12); \ 73 b -= c; b -= a; b ^= (a << 16); \ 74 c -= a; c -= b; c ^= (b >> 5); \ 75 a -= b; a -= c; a ^= (c >> 3); \ 76 b -= c; b -= a; b ^= (a << 10); \ 77 c -= a; c -= b; c ^= (b >> 15); \ 78 } while (0) 79 80/* 81 * hash function based on bridge_hash in if_bridge.c 82 */ 83static void 84pf_hash(struct pf_addr *inaddr, struct pf_addr *hash, 85 struct pf_poolhashkey *key, sa_family_t af) 86{ 87 u_int32_t a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0]; 88 89 switch (af) { 90#ifdef INET 91 case AF_INET: 92 a += inaddr->addr32[0]; 93 b += key->key32[1]; 94 mix(a, b, c); 95 hash->addr32[0] = c + key->key32[2]; 96 break; 97#endif /* INET */ 98#ifdef INET6 99 case AF_INET6: 100 a += inaddr->addr32[0]; 101 b += inaddr->addr32[2]; 102 mix(a, b, c); 103 hash->addr32[0] = c; 104 a += inaddr->addr32[1]; 105 b += inaddr->addr32[3]; 106 c += key->key32[1]; 107 mix(a, b, c); 108 hash->addr32[1] = c; 109 a += inaddr->addr32[2]; 110 b += inaddr->addr32[1]; 111 c += key->key32[2]; 112 mix(a, b, c); 113 hash->addr32[2] = c; 114 a += inaddr->addr32[3]; 115 b += inaddr->addr32[0]; 116 c += key->key32[3]; 117 mix(a, b, c); 118 hash->addr32[3] = c; 119 break; 120#endif /* INET6 */ 121 } 122} 123 124static struct pf_rule * 125pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off, 126 int direction, struct pfi_kif *kif, struct pf_addr *saddr, u_int16_t sport, 127 struct pf_addr *daddr, uint16_t dport, int rs_num, 128 struct pf_anchor_stackframe *anchor_stack) 129{ 130 struct pf_rule *r, *rm = NULL; 131 struct pf_ruleset *ruleset = NULL; 132 int tag = -1; 133 int rtableid = -1; 134 int asd = 0; 135 136 r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr); 137 while (r && rm == NULL) { 138 struct pf_rule_addr *src = NULL, *dst = NULL; 139 struct pf_addr_wrap *xdst = NULL; 140 141 if (r->action == PF_BINAT && direction == PF_IN) { 142 src = &r->dst; 143 if (r->rpool.cur != NULL) 144 xdst = &r->rpool.cur->addr; 145 } else { 146 src = &r->src; 147 dst = &r->dst; 148 } 149 150 r->evaluations++; 151 if (pfi_kif_match(r->kif, kif) == r->ifnot) 152 r = r->skip[PF_SKIP_IFP].ptr; 153 else if (r->direction && r->direction != direction) 154 r = r->skip[PF_SKIP_DIR].ptr; 155 else if (r->af && r->af != pd->af) 156 r = r->skip[PF_SKIP_AF].ptr; 157 else if (r->proto && r->proto != pd->proto) 158 r = r->skip[PF_SKIP_PROTO].ptr; 159 else if (PF_MISMATCHAW(&src->addr, saddr, pd->af, 160 src->neg, kif, M_GETFIB(m))) 161 r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR : 162 PF_SKIP_DST_ADDR].ptr; 163 else if (src->port_op && !pf_match_port(src->port_op, 164 src->port[0], src->port[1], sport)) 165 r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT : 166 PF_SKIP_DST_PORT].ptr; 167 else if (dst != NULL && 168 PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->neg, NULL, 169 M_GETFIB(m))) 170 r = r->skip[PF_SKIP_DST_ADDR].ptr; 171 else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af, 172 0, NULL, M_GETFIB(m))) 173 r = TAILQ_NEXT(r, entries); 174 else if (dst != NULL && dst->port_op && 175 !pf_match_port(dst->port_op, dst->port[0], 176 dst->port[1], dport)) 177 r = r->skip[PF_SKIP_DST_PORT].ptr; 178 else if (r->match_tag && !pf_match_tag(m, r, &tag, 179 pd->pf_mtag ? pd->pf_mtag->tag : 0)) 180 r = TAILQ_NEXT(r, entries); 181 else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto != 182 IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m, 183 off, pd->hdr.tcp), r->os_fingerprint))) 184 r = TAILQ_NEXT(r, entries); 185 else { 186 if (r->tag) 187 tag = r->tag; 188 if (r->rtableid >= 0) 189 rtableid = r->rtableid; 190 if (r->anchor == NULL) { 191 rm = r; 192 } else 193 pf_step_into_anchor(anchor_stack, &asd, 194 &ruleset, rs_num, &r, NULL, NULL); 195 } 196 if (r == NULL) 197 pf_step_out_of_anchor(anchor_stack, &asd, &ruleset, 198 rs_num, &r, NULL, NULL); 199 } 200 201 if (tag > 0 && pf_tag_packet(m, pd, tag)) 202 return (NULL); 203 if (rtableid >= 0) 204 M_SETFIB(m, rtableid); 205 206 if (rm != NULL && (rm->action == PF_NONAT || 207 rm->action == PF_NORDR || rm->action == PF_NOBINAT)) 208 return (NULL); 209 return (rm); 210} 211 212static int 213pf_get_sport(sa_family_t af, u_int8_t proto, struct pf_rule *r, 214 struct pf_addr *saddr, struct pf_addr *daddr, u_int16_t dport, 215 struct pf_addr *naddr, u_int16_t *nport, u_int16_t low, u_int16_t high, 216 struct pf_src_node **sn) 217{ 218 struct pf_state_key_cmp key; 219 struct pf_addr init_addr; 220 u_int16_t cut; 221 222 bzero(&init_addr, sizeof(init_addr)); 223 if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn)) 224 return (1); 225 226 if (proto == IPPROTO_ICMP) { 227 low = 1; 228 high = 65535; 229 } 230 231 do { 232 key.af = af; 233 key.proto = proto; 234 PF_ACPY(&key.addr[1], daddr, key.af); 235 PF_ACPY(&key.addr[0], naddr, key.af); 236 key.port[1] = dport; 237 238 /* 239 * port search; start random, step; 240 * similar 2 portloop in in_pcbbind 241 */ 242 if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP || 243 proto == IPPROTO_ICMP)) { 244 key.port[0] = dport; 245 if (pf_find_state_all(&key, PF_IN, NULL) == NULL) 246 return (0); 247 } else if (low == 0 && high == 0) { 248 key.port[0] = *nport; 249 if (pf_find_state_all(&key, PF_IN, NULL) == NULL) 250 return (0); 251 } else if (low == high) { 252 key.port[0] = htons(low); 253 if (pf_find_state_all(&key, PF_IN, NULL) == NULL) { 254 *nport = htons(low); 255 return (0); 256 } 257 } else { 258 u_int16_t tmp; 259 260 if (low > high) { 261 tmp = low; 262 low = high; 263 high = tmp; 264 } 265 /* low < high */ 266 cut = htonl(arc4random()) % (1 + high - low) + low; 267 /* low <= cut <= high */ 268 for (tmp = cut; tmp <= high; ++(tmp)) { 269 key.port[0] = htons(tmp); 270 if (pf_find_state_all(&key, PF_IN, NULL) == 271 NULL) { 272 *nport = htons(tmp); 273 return (0); 274 } 275 } 276 for (tmp = cut - 1; tmp >= low; --(tmp)) { 277 key.port[0] = htons(tmp); 278 if (pf_find_state_all(&key, PF_IN, NULL) == 279 NULL) { 280 *nport = htons(tmp); 281 return (0); 282 } 283 } 284 } 285 286 switch (r->rpool.opts & PF_POOL_TYPEMASK) { 287 case PF_POOL_RANDOM: 288 case PF_POOL_ROUNDROBIN: 289 if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn)) 290 return (1); 291 break; 292 case PF_POOL_NONE: 293 case PF_POOL_SRCHASH: 294 case PF_POOL_BITMASK: 295 default: 296 return (1); 297 } 298 } while (! PF_AEQ(&init_addr, naddr, af) ); 299 return (1); /* none available */ 300} 301 302int 303pf_map_addr(sa_family_t af, struct pf_rule *r, struct pf_addr *saddr, 304 struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn) 305{ 306 struct pf_pool *rpool = &r->rpool; 307 struct pf_addr *raddr = NULL, *rmask = NULL; 308 309 if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR && 310 (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) { 311 *sn = pf_find_src_node(saddr, r, af, 0); 312 if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, af)) { 313 PF_ACPY(naddr, &(*sn)->raddr, af); 314 if (V_pf_status.debug >= PF_DEBUG_MISC) { 315 printf("pf_map_addr: src tracking maps "); 316 pf_print_host(saddr, 0, af); 317 printf(" to "); 318 pf_print_host(naddr, 0, af); 319 printf("\n"); 320 } 321 return (0); 322 } 323 } 324 325 if (rpool->cur->addr.type == PF_ADDR_NOROUTE) 326 return (1); 327 if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 328 switch (af) { 329#ifdef INET 330 case AF_INET: 331 if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 && 332 (rpool->opts & PF_POOL_TYPEMASK) != 333 PF_POOL_ROUNDROBIN) 334 return (1); 335 raddr = &rpool->cur->addr.p.dyn->pfid_addr4; 336 rmask = &rpool->cur->addr.p.dyn->pfid_mask4; 337 break; 338#endif /* INET */ 339#ifdef INET6 340 case AF_INET6: 341 if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 && 342 (rpool->opts & PF_POOL_TYPEMASK) != 343 PF_POOL_ROUNDROBIN) 344 return (1); 345 raddr = &rpool->cur->addr.p.dyn->pfid_addr6; 346 rmask = &rpool->cur->addr.p.dyn->pfid_mask6; 347 break; 348#endif /* INET6 */ 349 } 350 } else if (rpool->cur->addr.type == PF_ADDR_TABLE) { 351 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN) 352 return (1); /* unsupported */ 353 } else { 354 raddr = &rpool->cur->addr.v.a.addr; 355 rmask = &rpool->cur->addr.v.a.mask; 356 } 357 358 switch (rpool->opts & PF_POOL_TYPEMASK) { 359 case PF_POOL_NONE: 360 PF_ACPY(naddr, raddr, af); 361 break; 362 case PF_POOL_BITMASK: 363 PF_POOLMASK(naddr, raddr, rmask, saddr, af); 364 break; 365 case PF_POOL_RANDOM: 366 if (init_addr != NULL && PF_AZERO(init_addr, af)) { 367 switch (af) { 368#ifdef INET 369 case AF_INET: 370 rpool->counter.addr32[0] = htonl(arc4random()); 371 break; 372#endif /* INET */ 373#ifdef INET6 374 case AF_INET6: 375 if (rmask->addr32[3] != 0xffffffff) 376 rpool->counter.addr32[3] = 377 htonl(arc4random()); 378 else 379 break; 380 if (rmask->addr32[2] != 0xffffffff) 381 rpool->counter.addr32[2] = 382 htonl(arc4random()); 383 else 384 break; 385 if (rmask->addr32[1] != 0xffffffff) 386 rpool->counter.addr32[1] = 387 htonl(arc4random()); 388 else 389 break; 390 if (rmask->addr32[0] != 0xffffffff) 391 rpool->counter.addr32[0] = 392 htonl(arc4random()); 393 break; 394#endif /* INET6 */ 395 } 396 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af); 397 PF_ACPY(init_addr, naddr, af); 398 399 } else { 400 PF_AINC(&rpool->counter, af); 401 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af); 402 } 403 break; 404 case PF_POOL_SRCHASH: 405 { 406 unsigned char hash[16]; 407 408 pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, af); 409 PF_POOLMASK(naddr, raddr, rmask, (struct pf_addr *)&hash, af); 410 break; 411 } 412 case PF_POOL_ROUNDROBIN: 413 { 414 struct pf_pooladdr *acur = rpool->cur; 415 416 /* 417 * XXXGL: in the round-robin case we need to store 418 * the round-robin machine state in the rule, thus 419 * forwarding thread needs to modify rule. 420 * 421 * This is done w/o locking, because performance is assumed 422 * more important than round-robin precision. 423 * 424 * In the simpliest case we just update the "rpool->cur" 425 * pointer. However, if pool contains tables or dynamic 426 * addresses, then "tblidx" is also used to store machine 427 * state. Since "tblidx" is int, concurrent access to it can't 428 * lead to inconsistence, only to lost of precision. 429 * 430 * Things get worse, if table contains not hosts, but 431 * prefixes. In this case counter also stores machine state, 432 * and for IPv6 address, counter can't be updated atomically. 433 * Probably, using round-robin on a table containing IPv6 434 * prefixes (or even IPv4) would cause a panic. 435 */ 436 437 if (rpool->cur->addr.type == PF_ADDR_TABLE) { 438 if (!pfr_pool_get(rpool->cur->addr.p.tbl, 439 &rpool->tblidx, &rpool->counter, af)) 440 goto get_addr; 441 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 442 if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt, 443 &rpool->tblidx, &rpool->counter, af)) 444 goto get_addr; 445 } else if (pf_match_addr(0, raddr, rmask, &rpool->counter, af)) 446 goto get_addr; 447 448 try_next: 449 if (TAILQ_NEXT(rpool->cur, entries) == NULL) 450 rpool->cur = TAILQ_FIRST(&rpool->list); 451 else 452 rpool->cur = TAILQ_NEXT(rpool->cur, entries); 453 if (rpool->cur->addr.type == PF_ADDR_TABLE) { 454 rpool->tblidx = -1; 455 if (pfr_pool_get(rpool->cur->addr.p.tbl, 456 &rpool->tblidx, &rpool->counter, af)) { 457 /* table contains no address of type 'af' */ 458 if (rpool->cur != acur) 459 goto try_next; 460 return (1); 461 } 462 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) { 463 rpool->tblidx = -1; 464 if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt, 465 &rpool->tblidx, &rpool->counter, af)) { 466 /* table contains no address of type 'af' */ 467 if (rpool->cur != acur) 468 goto try_next; 469 return (1); 470 } 471 } else { 472 raddr = &rpool->cur->addr.v.a.addr; 473 rmask = &rpool->cur->addr.v.a.mask; 474 PF_ACPY(&rpool->counter, raddr, af); 475 } 476 477 get_addr: 478 PF_ACPY(naddr, &rpool->counter, af); 479 if (init_addr != NULL && PF_AZERO(init_addr, af)) 480 PF_ACPY(init_addr, naddr, af); 481 PF_AINC(&rpool->counter, af); 482 break; 483 } 484 } 485 if (*sn != NULL) 486 PF_ACPY(&(*sn)->raddr, naddr, af); 487 488 if (V_pf_status.debug >= PF_DEBUG_MISC && 489 (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) { 490 printf("pf_map_addr: selected address "); 491 pf_print_host(naddr, 0, af); 492 printf("\n"); 493 } 494 495 return (0); 496} 497 498struct pf_rule * 499pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off, int direction, 500 struct pfi_kif *kif, struct pf_src_node **sn, 501 struct pf_state_key **skp, struct pf_state_key **nkp, 502 struct pf_addr *saddr, struct pf_addr *daddr, 503 uint16_t sport, uint16_t dport, struct pf_anchor_stackframe *anchor_stack) 504{ 505 struct pf_rule *r = NULL; 506 struct pf_addr *naddr; 507 uint16_t *nport; 508 509 PF_RULES_RASSERT(); 510 KASSERT(*skp == NULL, ("*skp not NULL")); 511 KASSERT(*nkp == NULL, ("*nkp not NULL")); 512 513 if (direction == PF_OUT) { 514 r = pf_match_translation(pd, m, off, direction, kif, saddr, 515 sport, daddr, dport, PF_RULESET_BINAT, anchor_stack); 516 if (r == NULL) 517 r = pf_match_translation(pd, m, off, direction, kif, 518 saddr, sport, daddr, dport, PF_RULESET_NAT, 519 anchor_stack); 520 } else { 521 r = pf_match_translation(pd, m, off, direction, kif, saddr, 522 sport, daddr, dport, PF_RULESET_RDR, anchor_stack); 523 if (r == NULL) 524 r = pf_match_translation(pd, m, off, direction, kif, 525 saddr, sport, daddr, dport, PF_RULESET_BINAT, 526 anchor_stack); 527 } 528 529 if (r == NULL) 530 return (NULL); 531 532 switch (r->action) { 533 case PF_NONAT: 534 case PF_NOBINAT: 535 case PF_NORDR: 536 return (NULL); 537 } 538 539 *skp = pf_state_key_setup(pd, saddr, daddr, sport, dport); 540 if (*skp == NULL) 541 return (NULL); 542 *nkp = pf_state_key_clone(*skp); 543 if (*nkp == NULL) { 544 uma_zfree(V_pf_state_key_z, skp); 545 *skp = NULL; 546 return (NULL); 547 } 548 549 /* XXX We only modify one side for now. */ 550 naddr = &(*nkp)->addr[1]; 551 nport = &(*nkp)->port[1]; 552 553 switch (r->action) { 554 case PF_NAT: 555 if (pf_get_sport(pd->af, pd->proto, r, saddr, daddr, dport, 556 naddr, nport, r->rpool.proxy_port[0], 557 r->rpool.proxy_port[1], sn)) { 558 DPFPRINTF(PF_DEBUG_MISC, 559 ("pf: NAT proxy port allocation (%u-%u) failed\n", 560 r->rpool.proxy_port[0], r->rpool.proxy_port[1])); 561 goto notrans; 562 } 563 break; 564 case PF_BINAT: 565 switch (direction) { 566 case PF_OUT: 567 if (r->rpool.cur->addr.type == PF_ADDR_DYNIFTL){ 568 switch (pd->af) { 569#ifdef INET 570 case AF_INET: 571 if (r->rpool.cur->addr.p.dyn-> 572 pfid_acnt4 < 1) 573 goto notrans; 574 PF_POOLMASK(naddr, 575 &r->rpool.cur->addr.p.dyn-> 576 pfid_addr4, 577 &r->rpool.cur->addr.p.dyn-> 578 pfid_mask4, saddr, AF_INET); 579 break; 580#endif /* INET */ 581#ifdef INET6 582 case AF_INET6: 583 if (r->rpool.cur->addr.p.dyn-> 584 pfid_acnt6 < 1) 585 goto notrans; 586 PF_POOLMASK(naddr, 587 &r->rpool.cur->addr.p.dyn-> 588 pfid_addr6, 589 &r->rpool.cur->addr.p.dyn-> 590 pfid_mask6, saddr, AF_INET6); 591 break; 592#endif /* INET6 */ 593 } 594 } else 595 PF_POOLMASK(naddr, 596 &r->rpool.cur->addr.v.a.addr, 597 &r->rpool.cur->addr.v.a.mask, saddr, 598 pd->af); 599 break; 600 case PF_IN: 601 if (r->src.addr.type == PF_ADDR_DYNIFTL) { 602 switch (pd->af) { 603#ifdef INET 604 case AF_INET: 605 if (r->src.addr.p.dyn-> pfid_acnt4 < 1) 606 goto notrans; 607 PF_POOLMASK(naddr, 608 &r->src.addr.p.dyn->pfid_addr4, 609 &r->src.addr.p.dyn->pfid_mask4, 610 daddr, AF_INET); 611 break; 612#endif /* INET */ 613#ifdef INET6 614 case AF_INET6: 615 if (r->src.addr.p.dyn->pfid_acnt6 < 1) 616 goto notrans; 617 PF_POOLMASK(naddr, 618 &r->src.addr.p.dyn->pfid_addr6, 619 &r->src.addr.p.dyn->pfid_mask6, 620 daddr, AF_INET6); 621 break; 622#endif /* INET6 */ 623 } 624 } else 625 PF_POOLMASK(naddr, &r->src.addr.v.a.addr, 626 &r->src.addr.v.a.mask, daddr, pd->af); 627 break; 628 } 629 break; 630 case PF_RDR: { 631 if (pf_map_addr(pd->af, r, saddr, naddr, NULL, sn)) 632 goto notrans; 633 if ((r->rpool.opts & PF_POOL_TYPEMASK) == PF_POOL_BITMASK) 634 PF_POOLMASK(naddr, naddr, &r->rpool.cur->addr.v.a.mask, 635 daddr, pd->af); 636 637 if (r->rpool.proxy_port[1]) { 638 uint32_t tmp_nport; 639 640 tmp_nport = ((ntohs(dport) - ntohs(r->dst.port[0])) % 641 (r->rpool.proxy_port[1] - r->rpool.proxy_port[0] + 642 1)) + r->rpool.proxy_port[0]; 643 644 /* Wrap around if necessary. */ 645 if (tmp_nport > 65535) 646 tmp_nport -= 65535; 647 *nport = htons((uint16_t)tmp_nport); 648 } else if (r->rpool.proxy_port[0]) 649 *nport = htons(r->rpool.proxy_port[0]); 650 break; 651 } 652 default: 653 panic("%s: unknown action %u", __func__, r->action); 654 } 655 656 /* Return success only if translation really happened. */ 657 if (bcmp(*skp, *nkp, sizeof(struct pf_state_key_cmp))) 658 return (r); 659 660notrans: 661 uma_zfree(V_pf_state_key_z, *nkp); 662 uma_zfree(V_pf_state_key_z, *skp); 663 *skp = *nkp = NULL; 664 665 return (NULL); 666} 667