1/*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2015-2019 Yandex LLC 5 * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org> 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29#include <sys/cdefs.h> 30#include "opt_ipstealth.h" 31 32#include <sys/param.h> 33#include <sys/systm.h> 34#include <sys/counter.h> 35#include <sys/errno.h> 36#include <sys/kernel.h> 37#include <sys/lock.h> 38#include <sys/mbuf.h> 39#include <sys/module.h> 40#include <sys/rmlock.h> 41#include <sys/rwlock.h> 42#include <sys/socket.h> 43#include <sys/queue.h> 44 45#include <net/if.h> 46#include <net/if_var.h> 47#include <net/if_private.h> 48#include <net/if_pflog.h> 49#include <net/pfil.h> 50#include <net/netisr.h> 51#include <net/route.h> 52#include <net/route/nhop.h> 53 54#include <netinet/in.h> 55#include <netinet/in_fib.h> 56#include <netinet/in_var.h> 57#include <netinet/ip.h> 58#include <netinet/ip_var.h> 59#include <netinet/ip_fw.h> 60#include <netinet/ip6.h> 61#include <netinet/icmp6.h> 62#include <netinet/ip_icmp.h> 63#include <netinet/tcp.h> 64#include <netinet/udp.h> 65#include <netinet6/in6_var.h> 66#include <netinet6/in6_fib.h> 67#include <netinet6/ip6_var.h> 68#include <netinet6/ip_fw_nat64.h> 69 70#include <netpfil/pf/pf.h> 71#include <netpfil/ipfw/ip_fw_private.h> 72#include <machine/in_cksum.h> 73 74#include "ip_fw_nat64.h" 75#include "nat64_translate.h" 76 77typedef int (*nat64_output_t)(struct ifnet *, struct mbuf *, 78 struct sockaddr *, struct nat64_counters *, void *); 79typedef int (*nat64_output_one_t)(struct mbuf *, struct nat64_counters *, 80 void *); 81 82static struct nhop_object *nat64_find_route4(struct sockaddr_in *, 83 struct mbuf *); 84static struct nhop_object *nat64_find_route6(struct sockaddr_in6 *, 85 struct mbuf *); 86static int nat64_output_one(struct mbuf *, struct nat64_counters *, void *); 87static int nat64_output(struct ifnet *, struct mbuf *, struct sockaddr *, 88 struct nat64_counters *, void *); 89static int nat64_direct_output_one(struct mbuf *, struct nat64_counters *, 90 void *); 91static int nat64_direct_output(struct ifnet *, struct mbuf *, 92 struct sockaddr *, struct nat64_counters *, void *); 93 94struct nat64_methods { 95 nat64_output_t output; 96 nat64_output_one_t output_one; 97}; 98static const struct nat64_methods nat64_netisr = { 99 .output = nat64_output, 100 .output_one = nat64_output_one 101}; 102static const struct nat64_methods nat64_direct = { 103 .output = nat64_direct_output, 104 .output_one = nat64_direct_output_one 105}; 106 107/* These variables should be initialized explicitly on module loading */ 108VNET_DEFINE_STATIC(const struct nat64_methods *, nat64out); 109VNET_DEFINE_STATIC(const int *, nat64ipstealth); 110VNET_DEFINE_STATIC(const int *, nat64ip6stealth); 111#define V_nat64out VNET(nat64out) 112#define V_nat64ipstealth VNET(nat64ipstealth) 113#define V_nat64ip6stealth VNET(nat64ip6stealth) 114 115static const int stealth_on = 1; 116#ifndef IPSTEALTH 117static const int stealth_off = 0; 118#endif 119 120void 121nat64_set_output_method(int direct) 122{ 123 124 if (direct != 0) { 125 V_nat64out = &nat64_direct; 126#ifdef IPSTEALTH 127 /* Honor corresponding variables, if IPSTEALTH is defined */ 128 V_nat64ipstealth = &V_ipstealth; 129 V_nat64ip6stealth = &V_ip6stealth; 130#else 131 /* otherwise we need to decrement HLIM/TTL for direct case */ 132 V_nat64ipstealth = V_nat64ip6stealth = &stealth_off; 133#endif 134 } else { 135 V_nat64out = &nat64_netisr; 136 /* Leave TTL/HLIM decrementing to forwarding code */ 137 V_nat64ipstealth = V_nat64ip6stealth = &stealth_on; 138 } 139} 140 141int 142nat64_get_output_method(void) 143{ 144 145 return (V_nat64out == &nat64_direct ? 1: 0); 146} 147 148static void 149nat64_log(struct pfloghdr *logdata, struct mbuf *m, sa_family_t family) 150{ 151 152 logdata->dir = PF_OUT; 153 logdata->af = family; 154 ipfw_bpf_mtap2(logdata, PFLOG_HDRLEN, m); 155} 156 157static int 158nat64_direct_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst, 159 struct nat64_counters *stats, void *logdata) 160{ 161 int error; 162 163 if (logdata != NULL) 164 nat64_log(logdata, m, dst->sa_family); 165 error = (*ifp->if_output)(ifp, m, dst, NULL); 166 if (error != 0) 167 NAT64STAT_INC(stats, oerrors); 168 return (error); 169} 170 171static int 172nat64_direct_output_one(struct mbuf *m, struct nat64_counters *stats, 173 void *logdata) 174{ 175 struct nhop_object *nh4 = NULL; 176 struct nhop_object *nh6 = NULL; 177 struct sockaddr_in6 dst6; 178 struct sockaddr_in dst4; 179 struct sockaddr *dst; 180 struct ip6_hdr *ip6; 181 struct ip *ip4; 182 struct ifnet *ifp; 183 int error; 184 185 ip4 = mtod(m, struct ip *); 186 error = 0; 187 switch (ip4->ip_v) { 188 case IPVERSION: 189 dst4.sin_addr = ip4->ip_dst; 190 nh4 = nat64_find_route4(&dst4, m); 191 if (nh4 == NULL) { 192 NAT64STAT_INC(stats, noroute4); 193 error = EHOSTUNREACH; 194 } else { 195 ifp = nh4->nh_ifp; 196 dst = (struct sockaddr *)&dst4; 197 } 198 break; 199 case (IPV6_VERSION >> 4): 200 ip6 = mtod(m, struct ip6_hdr *); 201 dst6.sin6_addr = ip6->ip6_dst; 202 nh6 = nat64_find_route6(&dst6, m); 203 if (nh6 == NULL) { 204 NAT64STAT_INC(stats, noroute6); 205 error = EHOSTUNREACH; 206 } else { 207 ifp = nh6->nh_ifp; 208 dst = (struct sockaddr *)&dst6; 209 } 210 break; 211 default: 212 m_freem(m); 213 NAT64STAT_INC(stats, dropped); 214 DPRINTF(DP_DROPS, "dropped due to unknown IP version"); 215 return (EAFNOSUPPORT); 216 } 217 if (error != 0) { 218 m_freem(m); 219 return (EHOSTUNREACH); 220 } 221 if (logdata != NULL) 222 nat64_log(logdata, m, dst->sa_family); 223 error = (*ifp->if_output)(ifp, m, dst, NULL); 224 if (error != 0) 225 NAT64STAT_INC(stats, oerrors); 226 return (error); 227} 228 229static int 230nat64_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst, 231 struct nat64_counters *stats, void *logdata) 232{ 233 struct ip *ip4; 234 int ret, af; 235 236 ip4 = mtod(m, struct ip *); 237 switch (ip4->ip_v) { 238 case IPVERSION: 239 af = AF_INET; 240 ret = NETISR_IP; 241 break; 242 case (IPV6_VERSION >> 4): 243 af = AF_INET6; 244 ret = NETISR_IPV6; 245 break; 246 default: 247 m_freem(m); 248 NAT64STAT_INC(stats, dropped); 249 DPRINTF(DP_DROPS, "unknown IP version"); 250 return (EAFNOSUPPORT); 251 } 252 if (logdata != NULL) 253 nat64_log(logdata, m, af); 254 if (m->m_pkthdr.rcvif == NULL) 255 m->m_pkthdr.rcvif = V_loif; 256 ret = netisr_queue(ret, m); 257 if (ret != 0) 258 NAT64STAT_INC(stats, oerrors); 259 return (ret); 260} 261 262static int 263nat64_output_one(struct mbuf *m, struct nat64_counters *stats, void *logdata) 264{ 265 266 return (nat64_output(NULL, m, NULL, stats, logdata)); 267} 268 269/* 270 * Check the given IPv6 prefix and length according to RFC6052: 271 * The prefixes can only have one of the following lengths: 272 * 32, 40, 48, 56, 64, or 96 (The Well-Known Prefix is 96 bits long). 273 * Returns zero on success, otherwise EINVAL. 274 */ 275int 276nat64_check_prefixlen(int length) 277{ 278 279 switch (length) { 280 case 32: 281 case 40: 282 case 48: 283 case 56: 284 case 64: 285 case 96: 286 return (0); 287 } 288 return (EINVAL); 289} 290 291int 292nat64_check_prefix6(const struct in6_addr *prefix, int length) 293{ 294 295 if (nat64_check_prefixlen(length) != 0) 296 return (EINVAL); 297 298 /* Well-known prefix has 96 prefix length */ 299 if (IN6_IS_ADDR_WKPFX(prefix) && length != 96) 300 return (EINVAL); 301 302 /* Bits 64 to 71 must be set to zero */ 303 if (prefix->__u6_addr.__u6_addr8[8] != 0) 304 return (EINVAL); 305 306 /* Some extra checks */ 307 if (IN6_IS_ADDR_MULTICAST(prefix) || 308 IN6_IS_ADDR_UNSPECIFIED(prefix) || 309 IN6_IS_ADDR_LOOPBACK(prefix)) 310 return (EINVAL); 311 return (0); 312} 313 314int 315nat64_check_private_ip4(const struct nat64_config *cfg, in_addr_t ia) 316{ 317 318 if (cfg->flags & NAT64_ALLOW_PRIVATE) 319 return (0); 320 321 /* WKPFX must not be used to represent non-global IPv4 addresses */ 322 if (cfg->flags & NAT64_WKPFX) { 323 /* IN_PRIVATE */ 324 if ((ia & htonl(0xff000000)) == htonl(0x0a000000) || 325 (ia & htonl(0xfff00000)) == htonl(0xac100000) || 326 (ia & htonl(0xffff0000)) == htonl(0xc0a80000)) 327 return (1); 328 /* 329 * RFC 5735: 330 * 192.0.0.0/24 - reserved for IETF protocol assignments 331 * 192.88.99.0/24 - for use as 6to4 relay anycast addresses 332 * 198.18.0.0/15 - for use in benchmark tests 333 * 192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 - for use 334 * in documentation and example code 335 */ 336 if ((ia & htonl(0xffffff00)) == htonl(0xc0000000) || 337 (ia & htonl(0xffffff00)) == htonl(0xc0586300) || 338 (ia & htonl(0xfffffe00)) == htonl(0xc6120000) || 339 (ia & htonl(0xffffff00)) == htonl(0xc0000200) || 340 (ia & htonl(0xfffffe00)) == htonl(0xc6336400) || 341 (ia & htonl(0xffffff00)) == htonl(0xcb007100)) 342 return (1); 343 } 344 return (0); 345} 346 347/* 348 * Embed @ia IPv4 address into @ip6 IPv6 address. 349 * Place to embedding determined from prefix length @plen. 350 */ 351void 352nat64_embed_ip4(struct in6_addr *ip6, int plen, in_addr_t ia) 353{ 354 355 switch (plen) { 356 case 32: 357 case 96: 358 ip6->s6_addr32[plen / 32] = ia; 359 break; 360 case 40: 361 case 48: 362 case 56: 363 /* 364 * Preserve prefix bits. 365 * Since suffix bits should be zero and reserved for future 366 * use, we just overwrite the whole word, where they are. 367 */ 368 ip6->s6_addr32[1] &= 0xffffffff << (32 - plen % 32); 369#if BYTE_ORDER == BIG_ENDIAN 370 ip6->s6_addr32[1] |= ia >> (plen % 32); 371 ip6->s6_addr32[2] = ia << (24 - plen % 32); 372#elif BYTE_ORDER == LITTLE_ENDIAN 373 ip6->s6_addr32[1] |= ia << (plen % 32); 374 ip6->s6_addr32[2] = ia >> (24 - plen % 32); 375#endif 376 break; 377 case 64: 378#if BYTE_ORDER == BIG_ENDIAN 379 ip6->s6_addr32[2] = ia >> 8; 380 ip6->s6_addr32[3] = ia << 24; 381#elif BYTE_ORDER == LITTLE_ENDIAN 382 ip6->s6_addr32[2] = ia << 8; 383 ip6->s6_addr32[3] = ia >> 24; 384#endif 385 break; 386 default: 387 panic("Wrong plen: %d", plen); 388 }; 389 /* 390 * Bits 64 to 71 of the address are reserved for compatibility 391 * with the host identifier format defined in the IPv6 addressing 392 * architecture [RFC4291]. These bits MUST be set to zero. 393 */ 394 ip6->s6_addr8[8] = 0; 395} 396 397in_addr_t 398nat64_extract_ip4(const struct in6_addr *ip6, int plen) 399{ 400 in_addr_t ia; 401 402 /* 403 * According to RFC 6052 p2.2: 404 * IPv4-embedded IPv6 addresses are composed of a variable-length 405 * prefix, the embedded IPv4 address, and a variable length suffix. 406 * The suffix bits are reserved for future extensions and SHOULD 407 * be set to zero. 408 */ 409 switch (plen) { 410 case 32: 411 if (ip6->s6_addr32[3] != 0 || ip6->s6_addr32[2] != 0) 412 goto badip6; 413 break; 414 case 40: 415 if (ip6->s6_addr32[3] != 0 || 416 (ip6->s6_addr32[2] & htonl(0xff00ffff)) != 0) 417 goto badip6; 418 break; 419 case 48: 420 if (ip6->s6_addr32[3] != 0 || 421 (ip6->s6_addr32[2] & htonl(0xff0000ff)) != 0) 422 goto badip6; 423 break; 424 case 56: 425 if (ip6->s6_addr32[3] != 0 || ip6->s6_addr8[8] != 0) 426 goto badip6; 427 break; 428 case 64: 429 if (ip6->s6_addr8[8] != 0 || 430 (ip6->s6_addr32[3] & htonl(0x00ffffff)) != 0) 431 goto badip6; 432 }; 433 switch (plen) { 434 case 32: 435 case 96: 436 ia = ip6->s6_addr32[plen / 32]; 437 break; 438 case 40: 439 case 48: 440 case 56: 441#if BYTE_ORDER == BIG_ENDIAN 442 ia = (ip6->s6_addr32[1] << (plen % 32)) | 443 (ip6->s6_addr32[2] >> (24 - plen % 32)); 444#elif BYTE_ORDER == LITTLE_ENDIAN 445 ia = (ip6->s6_addr32[1] >> (plen % 32)) | 446 (ip6->s6_addr32[2] << (24 - plen % 32)); 447#endif 448 break; 449 case 64: 450#if BYTE_ORDER == BIG_ENDIAN 451 ia = (ip6->s6_addr32[2] << 8) | (ip6->s6_addr32[3] >> 24); 452#elif BYTE_ORDER == LITTLE_ENDIAN 453 ia = (ip6->s6_addr32[2] >> 8) | (ip6->s6_addr32[3] << 24); 454#endif 455 break; 456 default: 457 return (0); 458 }; 459 if (nat64_check_ip4(ia) == 0) 460 return (ia); 461 462 DPRINTF(DP_GENERIC | DP_DROPS, 463 "invalid destination address: %08x", ia); 464 return (0); 465badip6: 466 DPRINTF(DP_GENERIC | DP_DROPS, "invalid IPv4-embedded IPv6 address"); 467 return (0); 468} 469 470/* 471 * According to RFC 1624 the equation for incremental checksum update is: 472 * HC' = ~(~HC + ~m + m') -- [Eqn. 3] 473 * HC' = HC - ~m - m' -- [Eqn. 4] 474 * So, when we are replacing IPv4 addresses to IPv6, we 475 * can assume, that new bytes previously were zeros, and vise versa - 476 * when we replacing IPv6 addresses to IPv4, now unused bytes become 477 * zeros. The payload length in pseudo header has bigger size, but one 478 * half of it should be zero. Using the equation 4 we get: 479 * HC' = HC - (~m0 + m0') -- m0 is first changed word 480 * HC' = (HC - (~m0 + m0')) - (~m1 + m1') -- m1 is second changed word 481 * HC' = HC - ~m0 - m0' - ~m1 - m1' - ... = 482 * = HC - sum(~m[i] + m'[i]) 483 * 484 * The function result should be used as follows: 485 * IPv6 to IPv4: HC' = cksum_add(HC, result) 486 * IPv4 to IPv6: HC' = cksum_add(HC, ~result) 487 */ 488static uint16_t 489nat64_cksum_convert(struct ip6_hdr *ip6, struct ip *ip) 490{ 491 uint32_t sum; 492 uint16_t *p; 493 494 sum = ~ip->ip_src.s_addr >> 16; 495 sum += ~ip->ip_src.s_addr & 0xffff; 496 sum += ~ip->ip_dst.s_addr >> 16; 497 sum += ~ip->ip_dst.s_addr & 0xffff; 498 499 for (p = (uint16_t *)&ip6->ip6_src; 500 p < (uint16_t *)(&ip6->ip6_src + 2); p++) 501 sum += *p; 502 503 while (sum >> 16) 504 sum = (sum & 0xffff) + (sum >> 16); 505 return (sum); 506} 507 508static void 509nat64_init_ip4hdr(const struct ip6_hdr *ip6, const struct ip6_frag *frag, 510 uint16_t plen, uint8_t proto, struct ip *ip) 511{ 512 513 /* assume addresses are already initialized */ 514 ip->ip_v = IPVERSION; 515 ip->ip_hl = sizeof(*ip) >> 2; 516 ip->ip_tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 517 ip->ip_len = htons(sizeof(*ip) + plen); 518 ip->ip_ttl = ip6->ip6_hlim; 519 if (*V_nat64ip6stealth == 0) 520 ip->ip_ttl -= IPV6_HLIMDEC; 521 ip->ip_sum = 0; 522 ip->ip_p = (proto == IPPROTO_ICMPV6) ? IPPROTO_ICMP: proto; 523 ip_fillid(ip); 524 if (frag != NULL) { 525 ip->ip_off = htons(ntohs(frag->ip6f_offlg) >> 3); 526 if (frag->ip6f_offlg & IP6F_MORE_FRAG) 527 ip->ip_off |= htons(IP_MF); 528 } else { 529 ip->ip_off = htons(IP_DF); 530 } 531 ip->ip_sum = in_cksum_hdr(ip); 532} 533 534#define FRAGSZ(mtu) ((mtu) - sizeof(struct ip6_hdr) - sizeof(struct ip6_frag)) 535static NAT64NOINLINE int 536nat64_fragment6(struct nat64_counters *stats, struct ip6_hdr *ip6, 537 struct mbufq *mq, struct mbuf *m, uint32_t mtu, uint16_t ip_id, 538 uint16_t ip_off) 539{ 540 struct ip6_frag ip6f; 541 struct mbuf *n; 542 uint16_t hlen, len, offset; 543 int plen; 544 545 plen = ntohs(ip6->ip6_plen); 546 hlen = sizeof(struct ip6_hdr); 547 548 /* Fragmentation isn't needed */ 549 if (ip_off == 0 && plen <= mtu - hlen) { 550 M_PREPEND(m, hlen, M_NOWAIT); 551 if (m == NULL) { 552 NAT64STAT_INC(stats, nomem); 553 return (ENOMEM); 554 } 555 bcopy(ip6, mtod(m, void *), hlen); 556 if (mbufq_enqueue(mq, m) != 0) { 557 m_freem(m); 558 NAT64STAT_INC(stats, dropped); 559 DPRINTF(DP_DROPS, "dropped due to mbufq overflow"); 560 return (ENOBUFS); 561 } 562 return (0); 563 } 564 565 hlen += sizeof(struct ip6_frag); 566 ip6f.ip6f_reserved = 0; 567 ip6f.ip6f_nxt = ip6->ip6_nxt; 568 ip6->ip6_nxt = IPPROTO_FRAGMENT; 569 if (ip_off != 0) { 570 /* 571 * We have got an IPv4 fragment. 572 * Use offset value and ip_id from original fragment. 573 */ 574 ip6f.ip6f_ident = htonl(ntohs(ip_id)); 575 offset = (ntohs(ip_off) & IP_OFFMASK) << 3; 576 NAT64STAT_INC(stats, ifrags); 577 } else { 578 /* The packet size exceeds interface MTU */ 579 ip6f.ip6f_ident = htonl(ip6_randomid()); 580 offset = 0; /* First fragment*/ 581 } 582 while (plen > 0 && m != NULL) { 583 n = NULL; 584 len = FRAGSZ(mtu) & ~7; 585 if (len > plen) 586 len = plen; 587 ip6->ip6_plen = htons(len + sizeof(ip6f)); 588 ip6f.ip6f_offlg = ntohs(offset); 589 if (len < plen || (ip_off & htons(IP_MF)) != 0) 590 ip6f.ip6f_offlg |= IP6F_MORE_FRAG; 591 offset += len; 592 plen -= len; 593 if (plen > 0) { 594 n = m_split(m, len, M_NOWAIT); 595 if (n == NULL) 596 goto fail; 597 } 598 M_PREPEND(m, hlen, M_NOWAIT); 599 if (m == NULL) 600 goto fail; 601 bcopy(ip6, mtod(m, void *), sizeof(struct ip6_hdr)); 602 bcopy(&ip6f, mtodo(m, sizeof(struct ip6_hdr)), 603 sizeof(struct ip6_frag)); 604 if (mbufq_enqueue(mq, m) != 0) 605 goto fail; 606 m = n; 607 } 608 NAT64STAT_ADD(stats, ofrags, mbufq_len(mq)); 609 return (0); 610fail: 611 if (m != NULL) 612 m_freem(m); 613 if (n != NULL) 614 m_freem(n); 615 mbufq_drain(mq); 616 NAT64STAT_INC(stats, nomem); 617 return (ENOMEM); 618} 619 620static struct nhop_object * 621nat64_find_route6(struct sockaddr_in6 *dst, struct mbuf *m) 622{ 623 struct nhop_object *nh; 624 625 NET_EPOCH_ASSERT(); 626 nh = fib6_lookup(M_GETFIB(m), &dst->sin6_addr, 0, NHR_NONE, 0); 627 if (nh == NULL) 628 return (NULL); 629 if (nh->nh_flags & (NHF_BLACKHOLE | NHF_REJECT)) 630 return (NULL); 631 632 dst->sin6_family = AF_INET6; 633 dst->sin6_len = sizeof(*dst); 634 if (nh->nh_flags & NHF_GATEWAY) 635 dst->sin6_addr = nh->gw6_sa.sin6_addr; 636 dst->sin6_port = 0; 637 dst->sin6_scope_id = 0; 638 dst->sin6_flowinfo = 0; 639 return (nh); 640} 641 642#define NAT64_ICMP6_PLEN 64 643static NAT64NOINLINE void 644nat64_icmp6_reflect(struct mbuf *m, uint8_t type, uint8_t code, uint32_t mtu, 645 struct nat64_counters *stats, void *logdata) 646{ 647 struct icmp6_hdr *icmp6; 648 struct ip6_hdr *ip6, *oip6; 649 struct mbuf *n; 650 int len, plen, proto; 651 652 len = 0; 653 proto = nat64_getlasthdr(m, &len); 654 if (proto < 0) { 655 DPRINTF(DP_DROPS, "mbuf isn't contigious"); 656 goto freeit; 657 } 658 /* 659 * Do not send ICMPv6 in reply to ICMPv6 errors. 660 */ 661 if (proto == IPPROTO_ICMPV6) { 662 if (m->m_len < len + sizeof(*icmp6)) { 663 DPRINTF(DP_DROPS, "mbuf isn't contigious"); 664 goto freeit; 665 } 666 icmp6 = mtodo(m, len); 667 if (icmp6->icmp6_type < ICMP6_ECHO_REQUEST || 668 icmp6->icmp6_type == ND_REDIRECT) { 669 DPRINTF(DP_DROPS, "do not send ICMPv6 in reply to " 670 "ICMPv6 errors"); 671 goto freeit; 672 } 673 /* 674 * If there are extra headers between IPv6 and ICMPv6, 675 * strip off them. 676 */ 677 if (len > sizeof(struct ip6_hdr)) { 678 /* 679 * NOTE: ipfw_chk already did m_pullup() and it is 680 * expected that data is contigious from the start 681 * of IPv6 header up to the end of ICMPv6 header. 682 */ 683 bcopy(mtod(m, caddr_t), 684 mtodo(m, len - sizeof(struct ip6_hdr)), 685 sizeof(struct ip6_hdr)); 686 m_adj(m, len - sizeof(struct ip6_hdr)); 687 } 688 } 689 /* 690 if (icmp6_ratelimit(&ip6->ip6_src, type, code)) 691 goto freeit; 692 */ 693 ip6 = mtod(m, struct ip6_hdr *); 694 switch (type) { 695 case ICMP6_DST_UNREACH: 696 case ICMP6_PACKET_TOO_BIG: 697 case ICMP6_TIME_EXCEEDED: 698 case ICMP6_PARAM_PROB: 699 break; 700 default: 701 goto freeit; 702 } 703 /* Calculate length of ICMPv6 payload */ 704 len = (m->m_pkthdr.len > NAT64_ICMP6_PLEN) ? NAT64_ICMP6_PLEN: 705 m->m_pkthdr.len; 706 707 /* Create new ICMPv6 datagram */ 708 plen = len + sizeof(struct icmp6_hdr); 709 n = m_get2(sizeof(struct ip6_hdr) + plen + max_hdr, M_NOWAIT, 710 MT_HEADER, M_PKTHDR); 711 if (n == NULL) { 712 NAT64STAT_INC(stats, nomem); 713 m_freem(m); 714 return; 715 } 716 /* 717 * Move pkthdr from original mbuf. We should have initialized some 718 * fields, because we can reinject this mbuf to netisr and it will 719 * go through input path (it requires at least rcvif should be set). 720 * Also do M_ALIGN() to reduce chances of need to allocate new mbuf 721 * in the chain, when we will do M_PREPEND() or make some type of 722 * tunneling. 723 */ 724 m_move_pkthdr(n, m); 725 M_ALIGN(n, sizeof(struct ip6_hdr) + plen + max_hdr); 726 727 n->m_len = n->m_pkthdr.len = sizeof(struct ip6_hdr) + plen; 728 oip6 = mtod(n, struct ip6_hdr *); 729 /* 730 * Make IPv6 source address selection for reflected datagram. 731 * nat64_check_ip6() doesn't allow scoped addresses, therefore 732 * we use zero scopeid. 733 */ 734 if (in6_selectsrc_addr(M_GETFIB(n), &ip6->ip6_src, 0, 735 n->m_pkthdr.rcvif, &oip6->ip6_src, NULL) != 0) { 736 /* 737 * Failed to find proper source address, drop the packet. 738 */ 739 m_freem(n); 740 goto freeit; 741 } 742 oip6->ip6_dst = ip6->ip6_src; 743 oip6->ip6_nxt = IPPROTO_ICMPV6; 744 oip6->ip6_flow = 0; 745 oip6->ip6_vfc |= IPV6_VERSION; 746 oip6->ip6_hlim = V_ip6_defhlim; 747 oip6->ip6_plen = htons(plen); 748 749 icmp6 = mtodo(n, sizeof(struct ip6_hdr)); 750 icmp6->icmp6_cksum = 0; 751 icmp6->icmp6_type = type; 752 icmp6->icmp6_code = code; 753 icmp6->icmp6_mtu = htonl(mtu); 754 755 m_copydata(m, 0, len, mtodo(n, sizeof(struct ip6_hdr) + 756 sizeof(struct icmp6_hdr))); 757 icmp6->icmp6_cksum = in6_cksum(n, IPPROTO_ICMPV6, 758 sizeof(struct ip6_hdr), plen); 759 m_freem(m); 760 V_nat64out->output_one(n, stats, logdata); 761 return; 762freeit: 763 NAT64STAT_INC(stats, dropped); 764 m_freem(m); 765} 766 767static struct nhop_object * 768nat64_find_route4(struct sockaddr_in *dst, struct mbuf *m) 769{ 770 struct nhop_object *nh; 771 772 NET_EPOCH_ASSERT(); 773 nh = fib4_lookup(M_GETFIB(m), dst->sin_addr, 0, NHR_NONE, 0); 774 if (nh == NULL) 775 return (NULL); 776 if (nh->nh_flags & (NHF_BLACKHOLE | NHF_BROADCAST | NHF_REJECT)) 777 return (NULL); 778 779 dst->sin_family = AF_INET; 780 dst->sin_len = sizeof(*dst); 781 if (nh->nh_flags & NHF_GATEWAY) 782 dst->sin_addr = nh->gw4_sa.sin_addr; 783 dst->sin_port = 0; 784 return (nh); 785} 786 787#define NAT64_ICMP_PLEN 64 788static NAT64NOINLINE void 789nat64_icmp_reflect(struct mbuf *m, uint8_t type, 790 uint8_t code, uint16_t mtu, struct nat64_counters *stats, void *logdata) 791{ 792 struct icmp *icmp; 793 struct ip *ip, *oip; 794 struct mbuf *n; 795 int len, plen; 796 797 ip = mtod(m, struct ip *); 798 /* Do not send ICMP error if packet is not the first fragment */ 799 if (ip->ip_off & ~ntohs(IP_MF|IP_DF)) { 800 DPRINTF(DP_DROPS, "not first fragment"); 801 goto freeit; 802 } 803 /* Do not send ICMP in reply to ICMP errors */ 804 if (ip->ip_p == IPPROTO_ICMP) { 805 if (m->m_len < (ip->ip_hl << 2)) { 806 DPRINTF(DP_DROPS, "mbuf isn't contigious"); 807 goto freeit; 808 } 809 icmp = mtodo(m, ip->ip_hl << 2); 810 if (!ICMP_INFOTYPE(icmp->icmp_type)) { 811 DPRINTF(DP_DROPS, "do not send ICMP in reply to " 812 "ICMP errors"); 813 goto freeit; 814 } 815 } 816 switch (type) { 817 case ICMP_UNREACH: 818 case ICMP_TIMXCEED: 819 case ICMP_PARAMPROB: 820 break; 821 default: 822 goto freeit; 823 } 824 /* Calculate length of ICMP payload */ 825 len = (m->m_pkthdr.len > NAT64_ICMP_PLEN) ? (ip->ip_hl << 2) + 8: 826 m->m_pkthdr.len; 827 828 /* Create new ICMPv4 datagram */ 829 plen = len + sizeof(struct icmphdr) + sizeof(uint32_t); 830 n = m_get2(sizeof(struct ip) + plen + max_hdr, M_NOWAIT, 831 MT_HEADER, M_PKTHDR); 832 if (n == NULL) { 833 NAT64STAT_INC(stats, nomem); 834 m_freem(m); 835 return; 836 } 837 m_move_pkthdr(n, m); 838 M_ALIGN(n, sizeof(struct ip) + plen + max_hdr); 839 840 n->m_len = n->m_pkthdr.len = sizeof(struct ip) + plen; 841 oip = mtod(n, struct ip *); 842 oip->ip_v = IPVERSION; 843 oip->ip_hl = sizeof(struct ip) >> 2; 844 oip->ip_tos = 0; 845 oip->ip_len = htons(n->m_pkthdr.len); 846 oip->ip_ttl = V_ip_defttl; 847 oip->ip_p = IPPROTO_ICMP; 848 ip_fillid(oip); 849 oip->ip_off = htons(IP_DF); 850 oip->ip_src = ip->ip_dst; 851 oip->ip_dst = ip->ip_src; 852 oip->ip_sum = 0; 853 oip->ip_sum = in_cksum_hdr(oip); 854 855 icmp = mtodo(n, sizeof(struct ip)); 856 icmp->icmp_type = type; 857 icmp->icmp_code = code; 858 icmp->icmp_cksum = 0; 859 icmp->icmp_pmvoid = 0; 860 icmp->icmp_nextmtu = htons(mtu); 861 m_copydata(m, 0, len, mtodo(n, sizeof(struct ip) + 862 sizeof(struct icmphdr) + sizeof(uint32_t))); 863 icmp->icmp_cksum = in_cksum_skip(n, sizeof(struct ip) + plen, 864 sizeof(struct ip)); 865 m_freem(m); 866 V_nat64out->output_one(n, stats, logdata); 867 return; 868freeit: 869 NAT64STAT_INC(stats, dropped); 870 m_freem(m); 871} 872 873/* Translate ICMP echo request/reply into ICMPv6 */ 874static void 875nat64_icmp_handle_echo(struct ip6_hdr *ip6, struct icmp6_hdr *icmp6, 876 uint16_t id, uint8_t type) 877{ 878 uint16_t old; 879 880 old = *(uint16_t *)icmp6; /* save type+code in one word */ 881 icmp6->icmp6_type = type; 882 /* Reflect ICMPv6 -> ICMPv4 type translation in the cksum */ 883 icmp6->icmp6_cksum = cksum_adjust(icmp6->icmp6_cksum, 884 old, *(uint16_t *)icmp6); 885 if (id != 0) { 886 old = icmp6->icmp6_id; 887 icmp6->icmp6_id = id; 888 /* Reflect ICMP id translation in the cksum */ 889 icmp6->icmp6_cksum = cksum_adjust(icmp6->icmp6_cksum, 890 old, id); 891 } 892 /* Reflect IPv6 pseudo header in the cksum */ 893 icmp6->icmp6_cksum = ~in6_cksum_pseudo(ip6, ntohs(ip6->ip6_plen), 894 IPPROTO_ICMPV6, ~icmp6->icmp6_cksum); 895} 896 897static NAT64NOINLINE struct mbuf * 898nat64_icmp_translate(struct mbuf *m, struct ip6_hdr *ip6, uint16_t icmpid, 899 int offset, struct nat64_config *cfg) 900{ 901 struct ip ip; 902 struct icmp *icmp; 903 struct tcphdr *tcp; 904 struct udphdr *udp; 905 struct ip6_hdr *eip6; 906 struct mbuf *n; 907 uint32_t mtu; 908 int len, hlen, plen; 909 uint8_t type, code; 910 911 if (m->m_len < offset + ICMP_MINLEN) 912 m = m_pullup(m, offset + ICMP_MINLEN); 913 if (m == NULL) { 914 NAT64STAT_INC(&cfg->stats, nomem); 915 return (m); 916 } 917 mtu = 0; 918 icmp = mtodo(m, offset); 919 /* RFC 7915 p4.2 */ 920 switch (icmp->icmp_type) { 921 case ICMP_ECHOREPLY: 922 type = ICMP6_ECHO_REPLY; 923 code = 0; 924 break; 925 case ICMP_UNREACH: 926 type = ICMP6_DST_UNREACH; 927 switch (icmp->icmp_code) { 928 case ICMP_UNREACH_NET: 929 case ICMP_UNREACH_HOST: 930 case ICMP_UNREACH_SRCFAIL: 931 case ICMP_UNREACH_NET_UNKNOWN: 932 case ICMP_UNREACH_HOST_UNKNOWN: 933 case ICMP_UNREACH_TOSNET: 934 case ICMP_UNREACH_TOSHOST: 935 code = ICMP6_DST_UNREACH_NOROUTE; 936 break; 937 case ICMP_UNREACH_PROTOCOL: 938 type = ICMP6_PARAM_PROB; 939 code = ICMP6_PARAMPROB_NEXTHEADER; 940 break; 941 case ICMP_UNREACH_PORT: 942 code = ICMP6_DST_UNREACH_NOPORT; 943 break; 944 case ICMP_UNREACH_NEEDFRAG: 945 type = ICMP6_PACKET_TOO_BIG; 946 code = 0; 947 /* XXX: needs an additional look */ 948 mtu = max(IPV6_MMTU, ntohs(icmp->icmp_nextmtu) + 20); 949 break; 950 case ICMP_UNREACH_NET_PROHIB: 951 case ICMP_UNREACH_HOST_PROHIB: 952 case ICMP_UNREACH_FILTER_PROHIB: 953 case ICMP_UNREACH_PRECEDENCE_CUTOFF: 954 code = ICMP6_DST_UNREACH_ADMIN; 955 break; 956 default: 957 DPRINTF(DP_DROPS, "Unsupported ICMP type %d, code %d", 958 icmp->icmp_type, icmp->icmp_code); 959 goto freeit; 960 } 961 break; 962 case ICMP_TIMXCEED: 963 type = ICMP6_TIME_EXCEEDED; 964 code = icmp->icmp_code; 965 break; 966 case ICMP_ECHO: 967 type = ICMP6_ECHO_REQUEST; 968 code = 0; 969 break; 970 case ICMP_PARAMPROB: 971 type = ICMP6_PARAM_PROB; 972 switch (icmp->icmp_code) { 973 case ICMP_PARAMPROB_ERRATPTR: 974 case ICMP_PARAMPROB_LENGTH: 975 code = ICMP6_PARAMPROB_HEADER; 976 switch (icmp->icmp_pptr) { 977 case 0: /* Version/IHL */ 978 case 1: /* Type Of Service */ 979 mtu = icmp->icmp_pptr; 980 break; 981 case 2: /* Total Length */ 982 case 3: mtu = 4; /* Payload Length */ 983 break; 984 case 8: /* Time to Live */ 985 mtu = 7; /* Hop Limit */ 986 break; 987 case 9: /* Protocol */ 988 mtu = 6; /* Next Header */ 989 break; 990 case 12: /* Source address */ 991 case 13: 992 case 14: 993 case 15: 994 mtu = 8; 995 break; 996 case 16: /* Destination address */ 997 case 17: 998 case 18: 999 case 19: 1000 mtu = 24; 1001 break; 1002 default: /* Silently drop */ 1003 DPRINTF(DP_DROPS, "Unsupported ICMP type %d," 1004 " code %d, pptr %d", icmp->icmp_type, 1005 icmp->icmp_code, icmp->icmp_pptr); 1006 goto freeit; 1007 } 1008 break; 1009 default: 1010 DPRINTF(DP_DROPS, "Unsupported ICMP type %d," 1011 " code %d, pptr %d", icmp->icmp_type, 1012 icmp->icmp_code, icmp->icmp_pptr); 1013 goto freeit; 1014 } 1015 break; 1016 default: 1017 DPRINTF(DP_DROPS, "Unsupported ICMP type %d, code %d", 1018 icmp->icmp_type, icmp->icmp_code); 1019 goto freeit; 1020 } 1021 /* 1022 * For echo request/reply we can use original payload, 1023 * but we need adjust icmp_cksum, because ICMPv6 cksum covers 1024 * IPv6 pseudo header and ICMPv6 types differs from ICMPv4. 1025 */ 1026 if (type == ICMP6_ECHO_REQUEST || type == ICMP6_ECHO_REPLY) { 1027 nat64_icmp_handle_echo(ip6, ICMP6(icmp), icmpid, type); 1028 return (m); 1029 } 1030 /* 1031 * For other types of ICMP messages we need to translate inner 1032 * IPv4 header to IPv6 header. 1033 * Assume ICMP src is the same as payload dst 1034 * E.g. we have ( GWsrc1 , NATIP1 ) in outer header 1035 * and ( NATIP1, Hostdst1 ) in ICMP copy header. 1036 * In that case, we already have map for NATIP1 and GWsrc1. 1037 * The only thing we need is to copy IPv6 map prefix to 1038 * Hostdst1. 1039 */ 1040 hlen = offset + ICMP_MINLEN; 1041 if (m->m_pkthdr.len < hlen + sizeof(struct ip) + ICMP_MINLEN) { 1042 DPRINTF(DP_DROPS, "Message is too short %d", 1043 m->m_pkthdr.len); 1044 goto freeit; 1045 } 1046 m_copydata(m, hlen, sizeof(struct ip), (char *)&ip); 1047 if (ip.ip_v != IPVERSION) { 1048 DPRINTF(DP_DROPS, "Wrong IP version %d", ip.ip_v); 1049 goto freeit; 1050 } 1051 hlen += ip.ip_hl << 2; /* Skip inner IP header */ 1052 if (nat64_check_ip4(ip.ip_src.s_addr) != 0 || 1053 nat64_check_ip4(ip.ip_dst.s_addr) != 0 || 1054 nat64_check_private_ip4(cfg, ip.ip_src.s_addr) != 0 || 1055 nat64_check_private_ip4(cfg, ip.ip_dst.s_addr) != 0) { 1056 DPRINTF(DP_DROPS, "IP addresses checks failed %04x -> %04x", 1057 ntohl(ip.ip_src.s_addr), ntohl(ip.ip_dst.s_addr)); 1058 goto freeit; 1059 } 1060 if (m->m_pkthdr.len < hlen + ICMP_MINLEN) { 1061 DPRINTF(DP_DROPS, "Message is too short %d", 1062 m->m_pkthdr.len); 1063 goto freeit; 1064 } 1065#if 0 1066 /* 1067 * Check that inner source matches the outer destination. 1068 * XXX: We need some method to convert IPv4 into IPv6 address here, 1069 * and compare IPv6 addresses. 1070 */ 1071 if (ip.ip_src.s_addr != nat64_get_ip4(&ip6->ip6_dst)) { 1072 DPRINTF(DP_GENERIC, "Inner source doesn't match destination ", 1073 "%04x vs %04x", ip.ip_src.s_addr, 1074 nat64_get_ip4(&ip6->ip6_dst)); 1075 goto freeit; 1076 } 1077#endif 1078 /* 1079 * Create new mbuf for ICMPv6 datagram. 1080 * NOTE: len is data length just after inner IP header. 1081 */ 1082 len = m->m_pkthdr.len - hlen; 1083 if (sizeof(struct ip6_hdr) + 1084 sizeof(struct icmp6_hdr) + len > NAT64_ICMP6_PLEN) 1085 len = NAT64_ICMP6_PLEN - sizeof(struct icmp6_hdr) - 1086 sizeof(struct ip6_hdr); 1087 plen = sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr) + len; 1088 n = m_get2(offset + plen + max_hdr, M_NOWAIT, MT_HEADER, M_PKTHDR); 1089 if (n == NULL) { 1090 NAT64STAT_INC(&cfg->stats, nomem); 1091 m_freem(m); 1092 return (NULL); 1093 } 1094 m_move_pkthdr(n, m); 1095 M_ALIGN(n, offset + plen + max_hdr); 1096 n->m_len = n->m_pkthdr.len = offset + plen; 1097 /* Adjust ip6_plen in outer header */ 1098 ip6->ip6_plen = htons(plen); 1099 /* Construct new inner IPv6 header */ 1100 eip6 = mtodo(n, offset + sizeof(struct icmp6_hdr)); 1101 eip6->ip6_src = ip6->ip6_dst; 1102 1103 /* Use the same prefix that we have in outer header */ 1104 eip6->ip6_dst = ip6->ip6_src; 1105 MPASS(cfg->flags & NAT64_PLATPFX); 1106 nat64_embed_ip4(&eip6->ip6_dst, cfg->plat_plen, ip.ip_dst.s_addr); 1107 1108 eip6->ip6_flow = htonl(ip.ip_tos << 20); 1109 eip6->ip6_vfc |= IPV6_VERSION; 1110 eip6->ip6_hlim = ip.ip_ttl; 1111 eip6->ip6_plen = htons(ntohs(ip.ip_len) - (ip.ip_hl << 2)); 1112 eip6->ip6_nxt = (ip.ip_p == IPPROTO_ICMP) ? IPPROTO_ICMPV6: ip.ip_p; 1113 m_copydata(m, hlen, len, (char *)(eip6 + 1)); 1114 /* 1115 * We need to translate source port in the inner ULP header, 1116 * and adjust ULP checksum. 1117 */ 1118 switch (ip.ip_p) { 1119 case IPPROTO_TCP: 1120 if (len < offsetof(struct tcphdr, th_sum)) 1121 break; 1122 tcp = TCP(eip6 + 1); 1123 if (icmpid != 0) { 1124 tcp->th_sum = cksum_adjust(tcp->th_sum, 1125 tcp->th_sport, icmpid); 1126 tcp->th_sport = icmpid; 1127 } 1128 tcp->th_sum = cksum_add(tcp->th_sum, 1129 ~nat64_cksum_convert(eip6, &ip)); 1130 break; 1131 case IPPROTO_UDP: 1132 if (len < offsetof(struct udphdr, uh_sum)) 1133 break; 1134 udp = UDP(eip6 + 1); 1135 if (icmpid != 0) { 1136 udp->uh_sum = cksum_adjust(udp->uh_sum, 1137 udp->uh_sport, icmpid); 1138 udp->uh_sport = icmpid; 1139 } 1140 udp->uh_sum = cksum_add(udp->uh_sum, 1141 ~nat64_cksum_convert(eip6, &ip)); 1142 break; 1143 case IPPROTO_ICMP: 1144 /* 1145 * Check if this is an ICMP error message for echo request 1146 * that we sent. I.e. ULP in the data containing invoking 1147 * packet is IPPROTO_ICMP and its type is ICMP_ECHO. 1148 */ 1149 icmp = (struct icmp *)(eip6 + 1); 1150 if (icmp->icmp_type != ICMP_ECHO) { 1151 m_freem(n); 1152 goto freeit; 1153 } 1154 /* 1155 * For our client this original datagram should looks 1156 * like it was ICMPv6 datagram with type ICMP6_ECHO_REQUEST. 1157 * Thus we need adjust icmp_cksum and convert type from 1158 * ICMP_ECHO to ICMP6_ECHO_REQUEST. 1159 */ 1160 nat64_icmp_handle_echo(eip6, ICMP6(icmp), icmpid, 1161 ICMP6_ECHO_REQUEST); 1162 } 1163 m_freem(m); 1164 /* Convert ICMPv4 into ICMPv6 header */ 1165 icmp = mtodo(n, offset); 1166 ICMP6(icmp)->icmp6_type = type; 1167 ICMP6(icmp)->icmp6_code = code; 1168 ICMP6(icmp)->icmp6_mtu = htonl(mtu); 1169 ICMP6(icmp)->icmp6_cksum = 0; 1170 ICMP6(icmp)->icmp6_cksum = cksum_add( 1171 ~in6_cksum_pseudo(ip6, plen, IPPROTO_ICMPV6, 0), 1172 in_cksum_skip(n, n->m_pkthdr.len, offset)); 1173 return (n); 1174freeit: 1175 m_freem(m); 1176 NAT64STAT_INC(&cfg->stats, dropped); 1177 return (NULL); 1178} 1179 1180int 1181nat64_getlasthdr(struct mbuf *m, int *offset) 1182{ 1183 struct ip6_hdr *ip6; 1184 struct ip6_hbh *hbh; 1185 int proto, hlen; 1186 1187 if (offset != NULL) 1188 hlen = *offset; 1189 else 1190 hlen = 0; 1191 1192 if (m->m_len < hlen + sizeof(*ip6)) 1193 return (-1); 1194 1195 ip6 = mtodo(m, hlen); 1196 hlen += sizeof(*ip6); 1197 proto = ip6->ip6_nxt; 1198 /* Skip extension headers */ 1199 while (proto == IPPROTO_HOPOPTS || proto == IPPROTO_ROUTING || 1200 proto == IPPROTO_DSTOPTS) { 1201 hbh = mtodo(m, hlen); 1202 /* 1203 * We expect mbuf has contigious data up to 1204 * upper level header. 1205 */ 1206 if (m->m_len < hlen) 1207 return (-1); 1208 /* 1209 * We doesn't support Jumbo payload option, 1210 * so return error. 1211 */ 1212 if (proto == IPPROTO_HOPOPTS && ip6->ip6_plen == 0) 1213 return (-1); 1214 proto = hbh->ip6h_nxt; 1215 hlen += (hbh->ip6h_len + 1) << 3; 1216 } 1217 if (offset != NULL) 1218 *offset = hlen; 1219 return (proto); 1220} 1221 1222int 1223nat64_do_handle_ip4(struct mbuf *m, struct in6_addr *saddr, 1224 struct in6_addr *daddr, uint16_t lport, struct nat64_config *cfg, 1225 void *logdata) 1226{ 1227 struct nhop_object *nh; 1228 struct ip6_hdr ip6; 1229 struct sockaddr_in6 dst; 1230 struct ip *ip; 1231 struct mbufq mq; 1232 uint16_t ip_id, ip_off; 1233 uint16_t *csum; 1234 int plen, hlen; 1235 uint8_t proto; 1236 1237 ip = mtod(m, struct ip*); 1238 1239 if (*V_nat64ipstealth == 0 && ip->ip_ttl <= IPTTLDEC) { 1240 nat64_icmp_reflect(m, ICMP_TIMXCEED, 1241 ICMP_TIMXCEED_INTRANS, 0, &cfg->stats, logdata); 1242 return (NAT64RETURN); 1243 } 1244 1245 ip6.ip6_dst = *daddr; 1246 ip6.ip6_src = *saddr; 1247 1248 hlen = ip->ip_hl << 2; 1249 plen = ntohs(ip->ip_len) - hlen; 1250 proto = ip->ip_p; 1251 1252 /* Save ip_id and ip_off, both are in network byte order */ 1253 ip_id = ip->ip_id; 1254 ip_off = ip->ip_off & htons(IP_OFFMASK | IP_MF); 1255 1256 /* Fragment length must be multiple of 8 octets */ 1257 if ((ip->ip_off & htons(IP_MF)) != 0 && (plen & 0x7) != 0) { 1258 nat64_icmp_reflect(m, ICMP_PARAMPROB, 1259 ICMP_PARAMPROB_LENGTH, 0, &cfg->stats, logdata); 1260 return (NAT64RETURN); 1261 } 1262 /* Fragmented ICMP is unsupported */ 1263 if (proto == IPPROTO_ICMP && ip_off != 0) { 1264 DPRINTF(DP_DROPS, "dropped due to fragmented ICMP"); 1265 NAT64STAT_INC(&cfg->stats, dropped); 1266 return (NAT64MFREE); 1267 } 1268 1269 dst.sin6_addr = ip6.ip6_dst; 1270 nh = nat64_find_route6(&dst, m); 1271 if (nh == NULL) { 1272 NAT64STAT_INC(&cfg->stats, noroute6); 1273 nat64_icmp_reflect(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 1274 &cfg->stats, logdata); 1275 return (NAT64RETURN); 1276 } 1277 if (nh->nh_mtu < plen + sizeof(ip6) && 1278 (ip->ip_off & htons(IP_DF)) != 0) { 1279 nat64_icmp_reflect(m, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 1280 FRAGSZ(nh->nh_mtu) + sizeof(struct ip), &cfg->stats, logdata); 1281 return (NAT64RETURN); 1282 } 1283 1284 ip6.ip6_flow = htonl(ip->ip_tos << 20); 1285 ip6.ip6_vfc |= IPV6_VERSION; 1286 ip6.ip6_hlim = ip->ip_ttl; 1287 if (*V_nat64ipstealth == 0) 1288 ip6.ip6_hlim -= IPTTLDEC; 1289 ip6.ip6_plen = htons(plen); 1290 ip6.ip6_nxt = (proto == IPPROTO_ICMP) ? IPPROTO_ICMPV6: proto; 1291 1292 /* Handle delayed checksums if needed. */ 1293 if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) { 1294 in_delayed_cksum(m); 1295 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA; 1296 } 1297 /* Convert checksums. */ 1298 switch (proto) { 1299 case IPPROTO_TCP: 1300 csum = &TCP(mtodo(m, hlen))->th_sum; 1301 if (lport != 0) { 1302 struct tcphdr *tcp = TCP(mtodo(m, hlen)); 1303 *csum = cksum_adjust(*csum, tcp->th_dport, lport); 1304 tcp->th_dport = lport; 1305 } 1306 *csum = cksum_add(*csum, ~nat64_cksum_convert(&ip6, ip)); 1307 break; 1308 case IPPROTO_UDP: 1309 csum = &UDP(mtodo(m, hlen))->uh_sum; 1310 if (lport != 0) { 1311 struct udphdr *udp = UDP(mtodo(m, hlen)); 1312 *csum = cksum_adjust(*csum, udp->uh_dport, lport); 1313 udp->uh_dport = lport; 1314 } 1315 *csum = cksum_add(*csum, ~nat64_cksum_convert(&ip6, ip)); 1316 break; 1317 case IPPROTO_ICMP: 1318 m = nat64_icmp_translate(m, &ip6, lport, hlen, cfg); 1319 if (m == NULL) /* stats already accounted */ 1320 return (NAT64RETURN); 1321 } 1322 1323 m_adj(m, hlen); 1324 mbufq_init(&mq, 255); 1325 nat64_fragment6(&cfg->stats, &ip6, &mq, m, nh->nh_mtu, ip_id, ip_off); 1326 while ((m = mbufq_dequeue(&mq)) != NULL) { 1327 if (V_nat64out->output(nh->nh_ifp, m, (struct sockaddr *)&dst, 1328 &cfg->stats, logdata) != 0) 1329 break; 1330 NAT64STAT_INC(&cfg->stats, opcnt46); 1331 } 1332 mbufq_drain(&mq); 1333 return (NAT64RETURN); 1334} 1335 1336int 1337nat64_handle_icmp6(struct mbuf *m, int hlen, uint32_t aaddr, uint16_t aport, 1338 struct nat64_config *cfg, void *logdata) 1339{ 1340 struct ip ip; 1341 struct icmp6_hdr *icmp6; 1342 struct ip6_frag *ip6f; 1343 struct ip6_hdr *ip6, *ip6i; 1344 uint32_t mtu; 1345 int plen, proto; 1346 uint8_t type, code; 1347 1348 if (hlen == 0) { 1349 ip6 = mtod(m, struct ip6_hdr *); 1350 if (nat64_check_ip6(&ip6->ip6_src) != 0 || 1351 nat64_check_ip6(&ip6->ip6_dst) != 0) 1352 return (NAT64SKIP); 1353 1354 proto = nat64_getlasthdr(m, &hlen); 1355 if (proto != IPPROTO_ICMPV6) { 1356 DPRINTF(DP_DROPS, 1357 "dropped due to mbuf isn't contigious"); 1358 NAT64STAT_INC(&cfg->stats, dropped); 1359 return (NAT64MFREE); 1360 } 1361 } 1362 1363 /* 1364 * Translate ICMPv6 type and code to ICMPv4 (RFC7915). 1365 * NOTE: ICMPv6 echo handled by nat64_do_handle_ip6(). 1366 */ 1367 icmp6 = mtodo(m, hlen); 1368 mtu = 0; 1369 switch (icmp6->icmp6_type) { 1370 case ICMP6_DST_UNREACH: 1371 type = ICMP_UNREACH; 1372 switch (icmp6->icmp6_code) { 1373 case ICMP6_DST_UNREACH_NOROUTE: 1374 case ICMP6_DST_UNREACH_BEYONDSCOPE: 1375 case ICMP6_DST_UNREACH_ADDR: 1376 code = ICMP_UNREACH_HOST; 1377 break; 1378 case ICMP6_DST_UNREACH_ADMIN: 1379 code = ICMP_UNREACH_HOST_PROHIB; 1380 break; 1381 case ICMP6_DST_UNREACH_NOPORT: 1382 code = ICMP_UNREACH_PORT; 1383 break; 1384 default: 1385 DPRINTF(DP_DROPS, "Unsupported ICMPv6 type %d," 1386 " code %d", icmp6->icmp6_type, 1387 icmp6->icmp6_code); 1388 NAT64STAT_INC(&cfg->stats, dropped); 1389 return (NAT64MFREE); 1390 } 1391 break; 1392 case ICMP6_PACKET_TOO_BIG: 1393 type = ICMP_UNREACH; 1394 code = ICMP_UNREACH_NEEDFRAG; 1395 mtu = ntohl(icmp6->icmp6_mtu); 1396 if (mtu < IPV6_MMTU) { 1397 DPRINTF(DP_DROPS, "Wrong MTU %d in ICMPv6 type %d," 1398 " code %d", mtu, icmp6->icmp6_type, 1399 icmp6->icmp6_code); 1400 NAT64STAT_INC(&cfg->stats, dropped); 1401 return (NAT64MFREE); 1402 } 1403 /* 1404 * Adjust MTU to reflect difference between 1405 * IPv6 an IPv4 headers. 1406 */ 1407 mtu -= sizeof(struct ip6_hdr) - sizeof(struct ip); 1408 break; 1409 case ICMP6_TIME_EXCEEDED: 1410 type = ICMP_TIMXCEED; 1411 code = icmp6->icmp6_code; 1412 break; 1413 case ICMP6_PARAM_PROB: 1414 switch (icmp6->icmp6_code) { 1415 case ICMP6_PARAMPROB_HEADER: 1416 type = ICMP_PARAMPROB; 1417 code = ICMP_PARAMPROB_ERRATPTR; 1418 mtu = ntohl(icmp6->icmp6_pptr); 1419 switch (mtu) { 1420 case 0: /* Version/Traffic Class */ 1421 case 1: /* Traffic Class/Flow Label */ 1422 break; 1423 case 4: /* Payload Length */ 1424 case 5: 1425 mtu = 2; 1426 break; 1427 case 6: /* Next Header */ 1428 mtu = 9; 1429 break; 1430 case 7: /* Hop Limit */ 1431 mtu = 8; 1432 break; 1433 default: 1434 if (mtu >= 8 && mtu <= 23) { 1435 mtu = 12; /* Source address */ 1436 break; 1437 } 1438 if (mtu >= 24 && mtu <= 39) { 1439 mtu = 16; /* Destination address */ 1440 break; 1441 } 1442 DPRINTF(DP_DROPS, "Unsupported ICMPv6 type %d," 1443 " code %d, pptr %d", icmp6->icmp6_type, 1444 icmp6->icmp6_code, mtu); 1445 NAT64STAT_INC(&cfg->stats, dropped); 1446 return (NAT64MFREE); 1447 } 1448 case ICMP6_PARAMPROB_NEXTHEADER: 1449 type = ICMP_UNREACH; 1450 code = ICMP_UNREACH_PROTOCOL; 1451 break; 1452 default: 1453 DPRINTF(DP_DROPS, "Unsupported ICMPv6 type %d," 1454 " code %d, pptr %d", icmp6->icmp6_type, 1455 icmp6->icmp6_code, ntohl(icmp6->icmp6_pptr)); 1456 NAT64STAT_INC(&cfg->stats, dropped); 1457 return (NAT64MFREE); 1458 } 1459 break; 1460 default: 1461 DPRINTF(DP_DROPS, "Unsupported ICMPv6 type %d, code %d", 1462 icmp6->icmp6_type, icmp6->icmp6_code); 1463 NAT64STAT_INC(&cfg->stats, dropped); 1464 return (NAT64MFREE); 1465 } 1466 1467 hlen += sizeof(struct icmp6_hdr); 1468 if (m->m_pkthdr.len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN) { 1469 NAT64STAT_INC(&cfg->stats, dropped); 1470 DPRINTF(DP_DROPS, "Message is too short %d", 1471 m->m_pkthdr.len); 1472 return (NAT64MFREE); 1473 } 1474 /* 1475 * We need at least ICMP_MINLEN bytes of original datagram payload 1476 * to generate ICMP message. It is nice that ICMP_MINLEN is equal 1477 * to sizeof(struct ip6_frag). So, if embedded datagram had a fragment 1478 * header we will not have to do m_pullup() again. 1479 * 1480 * What we have here: 1481 * Outer header: (IPv6iGW, v4mapPRefix+v4exthost) 1482 * Inner header: (v4mapPRefix+v4host, IPv6iHost) [sport, dport] 1483 * We need to translate it to: 1484 * 1485 * Outer header: (alias_host, v4exthost) 1486 * Inner header: (v4exthost, alias_host) [sport, alias_port] 1487 * 1488 * Assume caller function has checked if v4mapPRefix+v4host 1489 * matches configured prefix. 1490 * The only two things we should be provided with are mapping between 1491 * IPv6iHost <> alias_host and between dport and alias_port. 1492 */ 1493 if (m->m_len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN) 1494 m = m_pullup(m, hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN); 1495 if (m == NULL) { 1496 NAT64STAT_INC(&cfg->stats, nomem); 1497 return (NAT64RETURN); 1498 } 1499 ip6 = mtod(m, struct ip6_hdr *); 1500 ip6i = mtodo(m, hlen); 1501 ip6f = NULL; 1502 proto = ip6i->ip6_nxt; 1503 plen = ntohs(ip6i->ip6_plen); 1504 hlen += sizeof(struct ip6_hdr); 1505 if (proto == IPPROTO_FRAGMENT) { 1506 if (m->m_pkthdr.len < hlen + sizeof(struct ip6_frag) + 1507 ICMP_MINLEN) 1508 goto fail; 1509 ip6f = mtodo(m, hlen); 1510 proto = ip6f->ip6f_nxt; 1511 plen -= sizeof(struct ip6_frag); 1512 hlen += sizeof(struct ip6_frag); 1513 /* Ajust MTU to reflect frag header size */ 1514 if (type == ICMP_UNREACH && code == ICMP_UNREACH_NEEDFRAG) 1515 mtu -= sizeof(struct ip6_frag); 1516 } 1517 if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) { 1518 DPRINTF(DP_DROPS, "Unsupported proto %d in the inner header", 1519 proto); 1520 goto fail; 1521 } 1522 if (nat64_check_ip6(&ip6i->ip6_src) != 0 || 1523 nat64_check_ip6(&ip6i->ip6_dst) != 0) { 1524 DPRINTF(DP_DROPS, "Inner addresses do not passes the check"); 1525 goto fail; 1526 } 1527 /* Check if outer dst is the same as inner src */ 1528 if (!IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &ip6i->ip6_src)) { 1529 DPRINTF(DP_DROPS, "Inner src doesn't match outer dst"); 1530 goto fail; 1531 } 1532 1533 /* Now we need to make a fake IPv4 packet to generate ICMP message */ 1534 ip.ip_dst.s_addr = aaddr; 1535 ip.ip_src.s_addr = nat64_extract_ip4(&ip6i->ip6_src, cfg->plat_plen); 1536 if (ip.ip_src.s_addr == 0) 1537 goto fail; 1538 /* XXX: Make fake ulp header */ 1539 if (V_nat64out == &nat64_direct) /* init_ip4hdr will decrement it */ 1540 ip6i->ip6_hlim += IPV6_HLIMDEC; 1541 nat64_init_ip4hdr(ip6i, ip6f, plen, proto, &ip); 1542 m_adj(m, hlen - sizeof(struct ip)); 1543 bcopy(&ip, mtod(m, void *), sizeof(ip)); 1544 nat64_icmp_reflect(m, type, code, (uint16_t)mtu, &cfg->stats, 1545 logdata); 1546 return (NAT64RETURN); 1547fail: 1548 /* 1549 * We must call m_freem() because mbuf pointer could be 1550 * changed with m_pullup(). 1551 */ 1552 m_freem(m); 1553 NAT64STAT_INC(&cfg->stats, dropped); 1554 return (NAT64RETURN); 1555} 1556 1557int 1558nat64_do_handle_ip6(struct mbuf *m, uint32_t aaddr, uint16_t aport, 1559 struct nat64_config *cfg, void *logdata) 1560{ 1561 struct ip ip; 1562 struct nhop_object *nh; 1563 struct sockaddr_in dst; 1564 struct ip6_frag *frag; 1565 struct ip6_hdr *ip6; 1566 struct icmp6_hdr *icmp6; 1567 uint16_t *csum; 1568 int plen, hlen, proto; 1569 1570 /* 1571 * XXX: we expect ipfw_chk() did m_pullup() up to upper level 1572 * protocol's headers. Also we skip some checks, that ip6_input(), 1573 * ip6_forward(), ip6_fastfwd() and ipfw_chk() already did. 1574 */ 1575 ip6 = mtod(m, struct ip6_hdr *); 1576 if (nat64_check_ip6(&ip6->ip6_src) != 0 || 1577 nat64_check_ip6(&ip6->ip6_dst) != 0) { 1578 return (NAT64SKIP); 1579 } 1580 1581 /* Starting from this point we must not return zero */ 1582 ip.ip_src.s_addr = aaddr; 1583 if (nat64_check_ip4(ip.ip_src.s_addr) != 0) { 1584 DPRINTF(DP_GENERIC | DP_DROPS, "invalid source address: %08x", 1585 ip.ip_src.s_addr); 1586 NAT64STAT_INC(&cfg->stats, dropped); 1587 return (NAT64MFREE); 1588 } 1589 1590 ip.ip_dst.s_addr = nat64_extract_ip4(&ip6->ip6_dst, cfg->plat_plen); 1591 if (ip.ip_dst.s_addr == 0) { 1592 NAT64STAT_INC(&cfg->stats, dropped); 1593 return (NAT64MFREE); 1594 } 1595 1596 if (*V_nat64ip6stealth == 0 && ip6->ip6_hlim <= IPV6_HLIMDEC) { 1597 nat64_icmp6_reflect(m, ICMP6_TIME_EXCEEDED, 1598 ICMP6_TIME_EXCEED_TRANSIT, 0, &cfg->stats, logdata); 1599 return (NAT64RETURN); 1600 } 1601 1602 hlen = 0; 1603 plen = ntohs(ip6->ip6_plen); 1604 proto = nat64_getlasthdr(m, &hlen); 1605 if (proto < 0) { 1606 DPRINTF(DP_DROPS, "dropped due to mbuf isn't contigious"); 1607 NAT64STAT_INC(&cfg->stats, dropped); 1608 return (NAT64MFREE); 1609 } 1610 frag = NULL; 1611 if (proto == IPPROTO_FRAGMENT) { 1612 /* ipfw_chk should m_pullup up to frag header */ 1613 if (m->m_len < hlen + sizeof(*frag)) { 1614 DPRINTF(DP_DROPS, 1615 "dropped due to mbuf isn't contigious"); 1616 NAT64STAT_INC(&cfg->stats, dropped); 1617 return (NAT64MFREE); 1618 } 1619 frag = mtodo(m, hlen); 1620 proto = frag->ip6f_nxt; 1621 hlen += sizeof(*frag); 1622 /* Fragmented ICMPv6 is unsupported */ 1623 if (proto == IPPROTO_ICMPV6) { 1624 DPRINTF(DP_DROPS, "dropped due to fragmented ICMPv6"); 1625 NAT64STAT_INC(&cfg->stats, dropped); 1626 return (NAT64MFREE); 1627 } 1628 /* Fragment length must be multiple of 8 octets */ 1629 if ((frag->ip6f_offlg & IP6F_MORE_FRAG) != 0 && 1630 ((plen + sizeof(struct ip6_hdr) - hlen) & 0x7) != 0) { 1631 nat64_icmp6_reflect(m, ICMP6_PARAM_PROB, 1632 ICMP6_PARAMPROB_HEADER, 1633 offsetof(struct ip6_hdr, ip6_plen), &cfg->stats, 1634 logdata); 1635 return (NAT64RETURN); 1636 } 1637 } 1638 plen -= hlen - sizeof(struct ip6_hdr); 1639 if (plen < 0 || m->m_pkthdr.len < plen + hlen) { 1640 DPRINTF(DP_DROPS, "plen %d, pkthdr.len %d, hlen %d", 1641 plen, m->m_pkthdr.len, hlen); 1642 NAT64STAT_INC(&cfg->stats, dropped); 1643 return (NAT64MFREE); 1644 } 1645 1646 icmp6 = NULL; /* Make gcc happy */ 1647 if (proto == IPPROTO_ICMPV6) { 1648 icmp6 = mtodo(m, hlen); 1649 if (icmp6->icmp6_type != ICMP6_ECHO_REQUEST && 1650 icmp6->icmp6_type != ICMP6_ECHO_REPLY) 1651 return (nat64_handle_icmp6(m, hlen, aaddr, aport, 1652 cfg, logdata)); 1653 } 1654 dst.sin_addr.s_addr = ip.ip_dst.s_addr; 1655 nh = nat64_find_route4(&dst, m); 1656 if (nh == NULL) { 1657 NAT64STAT_INC(&cfg->stats, noroute4); 1658 nat64_icmp6_reflect(m, ICMP6_DST_UNREACH, 1659 ICMP6_DST_UNREACH_NOROUTE, 0, &cfg->stats, logdata); 1660 return (NAT64RETURN); 1661 } 1662 if (nh->nh_mtu < plen + sizeof(ip)) { 1663 nat64_icmp6_reflect(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu, 1664 &cfg->stats, logdata); 1665 return (NAT64RETURN); 1666 } 1667 nat64_init_ip4hdr(ip6, frag, plen, proto, &ip); 1668 1669 /* Handle delayed checksums if needed. */ 1670 if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6) { 1671 in6_delayed_cksum(m, plen, hlen); 1672 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6; 1673 } 1674 /* Convert checksums. */ 1675 switch (proto) { 1676 case IPPROTO_TCP: 1677 csum = &TCP(mtodo(m, hlen))->th_sum; 1678 if (aport != 0) { 1679 struct tcphdr *tcp = TCP(mtodo(m, hlen)); 1680 *csum = cksum_adjust(*csum, tcp->th_sport, aport); 1681 tcp->th_sport = aport; 1682 } 1683 *csum = cksum_add(*csum, nat64_cksum_convert(ip6, &ip)); 1684 break; 1685 case IPPROTO_UDP: 1686 csum = &UDP(mtodo(m, hlen))->uh_sum; 1687 if (aport != 0) { 1688 struct udphdr *udp = UDP(mtodo(m, hlen)); 1689 *csum = cksum_adjust(*csum, udp->uh_sport, aport); 1690 udp->uh_sport = aport; 1691 } 1692 *csum = cksum_add(*csum, nat64_cksum_convert(ip6, &ip)); 1693 break; 1694 case IPPROTO_ICMPV6: 1695 /* Checksum in ICMPv6 covers pseudo header */ 1696 csum = &icmp6->icmp6_cksum; 1697 *csum = cksum_add(*csum, in6_cksum_pseudo(ip6, plen, 1698 IPPROTO_ICMPV6, 0)); 1699 /* Convert ICMPv6 types to ICMP */ 1700 proto = *(uint16_t *)icmp6; /* save old word for cksum_adjust */ 1701 if (icmp6->icmp6_type == ICMP6_ECHO_REQUEST) 1702 icmp6->icmp6_type = ICMP_ECHO; 1703 else /* ICMP6_ECHO_REPLY */ 1704 icmp6->icmp6_type = ICMP_ECHOREPLY; 1705 *csum = cksum_adjust(*csum, (uint16_t)proto, 1706 *(uint16_t *)icmp6); 1707 if (aport != 0) { 1708 uint16_t old_id = icmp6->icmp6_id; 1709 icmp6->icmp6_id = aport; 1710 *csum = cksum_adjust(*csum, old_id, aport); 1711 } 1712 break; 1713 }; 1714 1715 m_adj(m, hlen - sizeof(ip)); 1716 bcopy(&ip, mtod(m, void *), sizeof(ip)); 1717 if (V_nat64out->output(nh->nh_ifp, m, (struct sockaddr *)&dst, 1718 &cfg->stats, logdata) == 0) 1719 NAT64STAT_INC(&cfg->stats, opcnt64); 1720 return (NAT64RETURN); 1721} 1722