xref: /freebsd-13-stable/sys/netpfil/ipfw/nat64/nat64_translate.c (revision 3bc80996974a61a4223eae4c1ccd47b6ee32a48a)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2015-2019 Yandex LLC
5  * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org>
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 #include "opt_ipstealth.h"
31 
32 #include <sys/param.h>
33 #include <sys/systm.h>
34 #include <sys/counter.h>
35 #include <sys/errno.h>
36 #include <sys/kernel.h>
37 #include <sys/lock.h>
38 #include <sys/mbuf.h>
39 #include <sys/module.h>
40 #include <sys/rmlock.h>
41 #include <sys/rwlock.h>
42 #include <sys/socket.h>
43 #include <sys/queue.h>
44 
45 #include <net/if.h>
46 #include <net/if_var.h>
47 #include <net/if_pflog.h>
48 #include <net/pfil.h>
49 #include <net/netisr.h>
50 #include <net/route.h>
51 #include <net/route/nhop.h>
52 
53 #include <netinet/in.h>
54 #include <netinet/in_fib.h>
55 #include <netinet/in_var.h>
56 #include <netinet/ip.h>
57 #include <netinet/ip_var.h>
58 #include <netinet/ip_fw.h>
59 #include <netinet/ip6.h>
60 #include <netinet/icmp6.h>
61 #include <netinet/ip_icmp.h>
62 #include <netinet/tcp.h>
63 #include <netinet/udp.h>
64 #include <netinet6/in6_var.h>
65 #include <netinet6/in6_fib.h>
66 #include <netinet6/ip6_var.h>
67 #include <netinet6/ip_fw_nat64.h>
68 
69 #include <netpfil/pf/pf.h>
70 #include <netpfil/ipfw/ip_fw_private.h>
71 #include <machine/in_cksum.h>
72 
73 #include "ip_fw_nat64.h"
74 #include "nat64_translate.h"
75 
76 typedef int (*nat64_output_t)(struct ifnet *, struct mbuf *,
77     struct sockaddr *, struct nat64_counters *, void *);
78 typedef int (*nat64_output_one_t)(struct mbuf *, struct nat64_counters *,
79     void *);
80 
81 static struct nhop_object *nat64_find_route4(struct sockaddr_in *,
82     struct mbuf *);
83 static struct nhop_object *nat64_find_route6(struct sockaddr_in6 *,
84     struct mbuf *);
85 static int nat64_output_one(struct mbuf *, struct nat64_counters *, void *);
86 static int nat64_output(struct ifnet *, struct mbuf *, struct sockaddr *,
87     struct nat64_counters *, void *);
88 static int nat64_direct_output_one(struct mbuf *, struct nat64_counters *,
89     void *);
90 static int nat64_direct_output(struct ifnet *, struct mbuf *,
91     struct sockaddr *, struct nat64_counters *, void *);
92 
93 struct nat64_methods {
94 	nat64_output_t		output;
95 	nat64_output_one_t	output_one;
96 };
97 static const struct nat64_methods nat64_netisr = {
98 	.output = nat64_output,
99 	.output_one = nat64_output_one
100 };
101 static const struct nat64_methods nat64_direct = {
102 	.output = nat64_direct_output,
103 	.output_one = nat64_direct_output_one
104 };
105 
106 /* These variables should be initialized explicitly on module loading */
107 VNET_DEFINE_STATIC(const struct nat64_methods *, nat64out);
108 VNET_DEFINE_STATIC(const int *, nat64ipstealth);
109 VNET_DEFINE_STATIC(const int *, nat64ip6stealth);
110 #define	V_nat64out		VNET(nat64out)
111 #define	V_nat64ipstealth	VNET(nat64ipstealth)
112 #define	V_nat64ip6stealth	VNET(nat64ip6stealth)
113 
114 static const int stealth_on = 1;
115 #ifndef IPSTEALTH
116 static const int stealth_off = 0;
117 #endif
118 
119 void
nat64_set_output_method(int direct)120 nat64_set_output_method(int direct)
121 {
122 
123 	if (direct != 0) {
124 		V_nat64out = &nat64_direct;
125 #ifdef IPSTEALTH
126 		/* Honor corresponding variables, if IPSTEALTH is defined */
127 		V_nat64ipstealth = &V_ipstealth;
128 		V_nat64ip6stealth = &V_ip6stealth;
129 #else
130 		/* otherwise we need to decrement HLIM/TTL for direct case */
131 		V_nat64ipstealth = V_nat64ip6stealth = &stealth_off;
132 #endif
133 	} else {
134 		V_nat64out = &nat64_netisr;
135 		/* Leave TTL/HLIM decrementing to forwarding code */
136 		V_nat64ipstealth = V_nat64ip6stealth = &stealth_on;
137 	}
138 }
139 
140 int
nat64_get_output_method(void)141 nat64_get_output_method(void)
142 {
143 
144 	return (V_nat64out == &nat64_direct ? 1: 0);
145 }
146 
147 static void
nat64_log(struct pfloghdr * logdata,struct mbuf * m,sa_family_t family)148 nat64_log(struct pfloghdr *logdata, struct mbuf *m, sa_family_t family)
149 {
150 
151 	logdata->dir = PF_OUT;
152 	logdata->af = family;
153 	ipfw_bpf_mtap2(logdata, PFLOG_HDRLEN, m);
154 }
155 
156 static int
nat64_direct_output(struct ifnet * ifp,struct mbuf * m,struct sockaddr * dst,struct nat64_counters * stats,void * logdata)157 nat64_direct_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
158     struct nat64_counters *stats, void *logdata)
159 {
160 	int error;
161 
162 	if (logdata != NULL)
163 		nat64_log(logdata, m, dst->sa_family);
164 	error = (*ifp->if_output)(ifp, m, dst, NULL);
165 	if (error != 0)
166 		NAT64STAT_INC(stats, oerrors);
167 	return (error);
168 }
169 
170 static int
nat64_direct_output_one(struct mbuf * m,struct nat64_counters * stats,void * logdata)171 nat64_direct_output_one(struct mbuf *m, struct nat64_counters *stats,
172     void *logdata)
173 {
174 	struct nhop_object *nh4 = NULL;
175 	struct nhop_object *nh6 = NULL;
176 	struct sockaddr_in6 dst6;
177 	struct sockaddr_in dst4;
178 	struct sockaddr *dst;
179 	struct ip6_hdr *ip6;
180 	struct ip *ip4;
181 	struct ifnet *ifp;
182 	int error;
183 
184 	ip4 = mtod(m, struct ip *);
185 	error = 0;
186 	switch (ip4->ip_v) {
187 	case IPVERSION:
188 		dst4.sin_addr = ip4->ip_dst;
189 		nh4 = nat64_find_route4(&dst4, m);
190 		if (nh4 == NULL) {
191 			NAT64STAT_INC(stats, noroute4);
192 			error = EHOSTUNREACH;
193 		} else {
194 			ifp = nh4->nh_ifp;
195 			dst = (struct sockaddr *)&dst4;
196 		}
197 		break;
198 	case (IPV6_VERSION >> 4):
199 		ip6 = mtod(m, struct ip6_hdr *);
200 		dst6.sin6_addr = ip6->ip6_dst;
201 		nh6 = nat64_find_route6(&dst6, m);
202 		if (nh6 == NULL) {
203 			NAT64STAT_INC(stats, noroute6);
204 			error = EHOSTUNREACH;
205 		} else {
206 			ifp = nh6->nh_ifp;
207 			dst = (struct sockaddr *)&dst6;
208 		}
209 		break;
210 	default:
211 		m_freem(m);
212 		NAT64STAT_INC(stats, dropped);
213 		DPRINTF(DP_DROPS, "dropped due to unknown IP version");
214 		return (EAFNOSUPPORT);
215 	}
216 	if (error != 0) {
217 		m_freem(m);
218 		return (EHOSTUNREACH);
219 	}
220 	if (logdata != NULL)
221 		nat64_log(logdata, m, dst->sa_family);
222 	error = (*ifp->if_output)(ifp, m, dst, NULL);
223 	if (error != 0)
224 		NAT64STAT_INC(stats, oerrors);
225 	return (error);
226 }
227 
228 static int
nat64_output(struct ifnet * ifp,struct mbuf * m,struct sockaddr * dst,struct nat64_counters * stats,void * logdata)229 nat64_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
230     struct nat64_counters *stats, void *logdata)
231 {
232 	struct ip *ip4;
233 	int ret, af;
234 
235 	ip4 = mtod(m, struct ip *);
236 	switch (ip4->ip_v) {
237 	case IPVERSION:
238 		af = AF_INET;
239 		ret = NETISR_IP;
240 		break;
241 	case (IPV6_VERSION >> 4):
242 		af = AF_INET6;
243 		ret = NETISR_IPV6;
244 		break;
245 	default:
246 		m_freem(m);
247 		NAT64STAT_INC(stats, dropped);
248 		DPRINTF(DP_DROPS, "unknown IP version");
249 		return (EAFNOSUPPORT);
250 	}
251 	if (logdata != NULL)
252 		nat64_log(logdata, m, af);
253 	if (m->m_pkthdr.rcvif == NULL)
254 		m->m_pkthdr.rcvif = V_loif;
255 	ret = netisr_queue(ret, m);
256 	if (ret != 0)
257 		NAT64STAT_INC(stats, oerrors);
258 	return (ret);
259 }
260 
261 static int
nat64_output_one(struct mbuf * m,struct nat64_counters * stats,void * logdata)262 nat64_output_one(struct mbuf *m, struct nat64_counters *stats, void *logdata)
263 {
264 
265 	return (nat64_output(NULL, m, NULL, stats, logdata));
266 }
267 
268 /*
269  * Check the given IPv6 prefix and length according to RFC6052:
270  *   The prefixes can only have one of the following lengths:
271  *   32, 40, 48, 56, 64, or 96 (The Well-Known Prefix is 96 bits long).
272  * Returns zero on success, otherwise EINVAL.
273  */
274 int
nat64_check_prefixlen(int length)275 nat64_check_prefixlen(int length)
276 {
277 
278 	switch (length) {
279 	case 32:
280 	case 40:
281 	case 48:
282 	case 56:
283 	case 64:
284 	case 96:
285 		return (0);
286 	}
287 	return (EINVAL);
288 }
289 
290 int
nat64_check_prefix6(const struct in6_addr * prefix,int length)291 nat64_check_prefix6(const struct in6_addr *prefix, int length)
292 {
293 
294 	if (nat64_check_prefixlen(length) != 0)
295 		return (EINVAL);
296 
297 	/* Well-known prefix has 96 prefix length */
298 	if (IN6_IS_ADDR_WKPFX(prefix) && length != 96)
299 		return (EINVAL);
300 
301 	/* Bits 64 to 71 must be set to zero */
302 	if (prefix->__u6_addr.__u6_addr8[8] != 0)
303 		return (EINVAL);
304 
305 	/* Some extra checks */
306 	if (IN6_IS_ADDR_MULTICAST(prefix) ||
307 	    IN6_IS_ADDR_UNSPECIFIED(prefix) ||
308 	    IN6_IS_ADDR_LOOPBACK(prefix))
309 		return (EINVAL);
310 	return (0);
311 }
312 
313 int
nat64_check_private_ip4(const struct nat64_config * cfg,in_addr_t ia)314 nat64_check_private_ip4(const struct nat64_config *cfg, in_addr_t ia)
315 {
316 
317 	if (cfg->flags & NAT64_ALLOW_PRIVATE)
318 		return (0);
319 
320 	/* WKPFX must not be used to represent non-global IPv4 addresses */
321 	if (cfg->flags & NAT64_WKPFX) {
322 		/* IN_PRIVATE */
323 		if ((ia & htonl(0xff000000)) == htonl(0x0a000000) ||
324 		    (ia & htonl(0xfff00000)) == htonl(0xac100000) ||
325 		    (ia & htonl(0xffff0000)) == htonl(0xc0a80000))
326 			return (1);
327 		/*
328 		 * RFC 5735:
329 		 *  192.0.0.0/24 - reserved for IETF protocol assignments
330 		 *  192.88.99.0/24 - for use as 6to4 relay anycast addresses
331 		 *  198.18.0.0/15 - for use in benchmark tests
332 		 *  192.0.2.0/24, 198.51.100.0/24, 203.0.113.0/24 - for use
333 		 *   in documentation and example code
334 		 */
335 		if ((ia & htonl(0xffffff00)) == htonl(0xc0000000) ||
336 		    (ia & htonl(0xffffff00)) == htonl(0xc0586300) ||
337 		    (ia & htonl(0xfffffe00)) == htonl(0xc6120000) ||
338 		    (ia & htonl(0xffffff00)) == htonl(0xc0000200) ||
339 		    (ia & htonl(0xfffffe00)) == htonl(0xc6336400) ||
340 		    (ia & htonl(0xffffff00)) == htonl(0xcb007100))
341 			return (1);
342 	}
343 	return (0);
344 }
345 
346 /*
347  * Embed @ia IPv4 address into @ip6 IPv6 address.
348  * Place to embedding determined from prefix length @plen.
349  */
350 void
nat64_embed_ip4(struct in6_addr * ip6,int plen,in_addr_t ia)351 nat64_embed_ip4(struct in6_addr *ip6, int plen, in_addr_t ia)
352 {
353 
354 	switch (plen) {
355 	case 32:
356 	case 96:
357 		ip6->s6_addr32[plen / 32] = ia;
358 		break;
359 	case 40:
360 	case 48:
361 	case 56:
362 		/*
363 		 * Preserve prefix bits.
364 		 * Since suffix bits should be zero and reserved for future
365 		 * use, we just overwrite the whole word, where they are.
366 		 */
367 		ip6->s6_addr32[1] &= 0xffffffff << (32 - plen % 32);
368 #if BYTE_ORDER == BIG_ENDIAN
369 		ip6->s6_addr32[1] |= ia >> (plen % 32);
370 		ip6->s6_addr32[2] = ia << (24 - plen % 32);
371 #elif BYTE_ORDER == LITTLE_ENDIAN
372 		ip6->s6_addr32[1] |= ia << (plen % 32);
373 		ip6->s6_addr32[2] = ia >> (24 - plen % 32);
374 #endif
375 		break;
376 	case 64:
377 #if BYTE_ORDER == BIG_ENDIAN
378 		ip6->s6_addr32[2] = ia >> 8;
379 		ip6->s6_addr32[3] = ia << 24;
380 #elif BYTE_ORDER == LITTLE_ENDIAN
381 		ip6->s6_addr32[2] = ia << 8;
382 		ip6->s6_addr32[3] = ia >> 24;
383 #endif
384 		break;
385 	default:
386 		panic("Wrong plen: %d", plen);
387 	};
388 	/*
389 	 * Bits 64 to 71 of the address are reserved for compatibility
390 	 * with the host identifier format defined in the IPv6 addressing
391 	 * architecture [RFC4291]. These bits MUST be set to zero.
392 	 */
393 	ip6->s6_addr8[8] = 0;
394 }
395 
396 in_addr_t
nat64_extract_ip4(const struct in6_addr * ip6,int plen)397 nat64_extract_ip4(const struct in6_addr *ip6, int plen)
398 {
399 	in_addr_t ia;
400 
401 	/*
402 	 * According to RFC 6052 p2.2:
403 	 * IPv4-embedded IPv6 addresses are composed of a variable-length
404 	 * prefix, the embedded IPv4 address, and a variable length suffix.
405 	 * The suffix bits are reserved for future extensions and SHOULD
406 	 * be set to zero.
407 	 */
408 	switch (plen) {
409 	case 32:
410 		if (ip6->s6_addr32[3] != 0 || ip6->s6_addr32[2] != 0)
411 			goto badip6;
412 		break;
413 	case 40:
414 		if (ip6->s6_addr32[3] != 0 ||
415 		    (ip6->s6_addr32[2] & htonl(0xff00ffff)) != 0)
416 			goto badip6;
417 		break;
418 	case 48:
419 		if (ip6->s6_addr32[3] != 0 ||
420 		    (ip6->s6_addr32[2] & htonl(0xff0000ff)) != 0)
421 			goto badip6;
422 		break;
423 	case 56:
424 		if (ip6->s6_addr32[3] != 0 || ip6->s6_addr8[8] != 0)
425 			goto badip6;
426 		break;
427 	case 64:
428 		if (ip6->s6_addr8[8] != 0 ||
429 		    (ip6->s6_addr32[3] & htonl(0x00ffffff)) != 0)
430 			goto badip6;
431 	};
432 	switch (plen) {
433 	case 32:
434 	case 96:
435 		ia = ip6->s6_addr32[plen / 32];
436 		break;
437 	case 40:
438 	case 48:
439 	case 56:
440 #if BYTE_ORDER == BIG_ENDIAN
441 		ia = (ip6->s6_addr32[1] << (plen % 32)) |
442 		    (ip6->s6_addr32[2] >> (24 - plen % 32));
443 #elif BYTE_ORDER == LITTLE_ENDIAN
444 		ia = (ip6->s6_addr32[1] >> (plen % 32)) |
445 		    (ip6->s6_addr32[2] << (24 - plen % 32));
446 #endif
447 		break;
448 	case 64:
449 #if BYTE_ORDER == BIG_ENDIAN
450 		ia = (ip6->s6_addr32[2] << 8) | (ip6->s6_addr32[3] >> 24);
451 #elif BYTE_ORDER == LITTLE_ENDIAN
452 		ia = (ip6->s6_addr32[2] >> 8) | (ip6->s6_addr32[3] << 24);
453 #endif
454 		break;
455 	default:
456 		return (0);
457 	};
458 	if (nat64_check_ip4(ia) == 0)
459 		return (ia);
460 
461 	DPRINTF(DP_GENERIC | DP_DROPS,
462 	    "invalid destination address: %08x", ia);
463 	return (0);
464 badip6:
465 	DPRINTF(DP_GENERIC | DP_DROPS, "invalid IPv4-embedded IPv6 address");
466 	return (0);
467 }
468 
469 /*
470  * According to RFC 1624 the equation for incremental checksum update is:
471  *	HC' = ~(~HC + ~m + m')	--	[Eqn. 3]
472  *	HC' = HC - ~m - m'	--	[Eqn. 4]
473  * So, when we are replacing IPv4 addresses to IPv6, we
474  * can assume, that new bytes previously were zeros, and vise versa -
475  * when we replacing IPv6 addresses to IPv4, now unused bytes become
476  * zeros. The payload length in pseudo header has bigger size, but one
477  * half of it should be zero. Using the equation 4 we get:
478  *	HC' = HC - (~m0 + m0')	-- m0 is first changed word
479  *	HC' = (HC - (~m0 + m0')) - (~m1 + m1')	-- m1 is second changed word
480  *	HC' = HC - ~m0 - m0' - ~m1 - m1' - ... =
481  *	  = HC - sum(~m[i] + m'[i])
482  *
483  * The function result should be used as follows:
484  *	IPv6 to IPv4:	HC' = cksum_add(HC, result)
485  *	IPv4 to IPv6:	HC' = cksum_add(HC, ~result)
486  */
487 static uint16_t
nat64_cksum_convert(struct ip6_hdr * ip6,struct ip * ip)488 nat64_cksum_convert(struct ip6_hdr *ip6, struct ip *ip)
489 {
490 	uint32_t sum;
491 	uint16_t *p;
492 
493 	sum = ~ip->ip_src.s_addr >> 16;
494 	sum += ~ip->ip_src.s_addr & 0xffff;
495 	sum += ~ip->ip_dst.s_addr >> 16;
496 	sum += ~ip->ip_dst.s_addr & 0xffff;
497 
498 	for (p = (uint16_t *)&ip6->ip6_src;
499 	    p < (uint16_t *)(&ip6->ip6_src + 2); p++)
500 		sum += *p;
501 
502 	while (sum >> 16)
503 		sum = (sum & 0xffff) + (sum >> 16);
504 	return (sum);
505 }
506 
507 static void
nat64_init_ip4hdr(const struct ip6_hdr * ip6,const struct ip6_frag * frag,uint16_t plen,uint8_t proto,struct ip * ip)508 nat64_init_ip4hdr(const struct ip6_hdr *ip6, const struct ip6_frag *frag,
509     uint16_t plen, uint8_t proto, struct ip *ip)
510 {
511 
512 	/* assume addresses are already initialized */
513 	ip->ip_v = IPVERSION;
514 	ip->ip_hl = sizeof(*ip) >> 2;
515 	ip->ip_tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
516 	ip->ip_len = htons(sizeof(*ip) + plen);
517 	ip->ip_ttl = ip6->ip6_hlim;
518 	if (*V_nat64ip6stealth == 0)
519 		ip->ip_ttl -= IPV6_HLIMDEC;
520 	ip->ip_sum = 0;
521 	ip->ip_p = (proto == IPPROTO_ICMPV6) ? IPPROTO_ICMP: proto;
522 	ip_fillid(ip);
523 	if (frag != NULL) {
524 		ip->ip_off = htons(ntohs(frag->ip6f_offlg) >> 3);
525 		if (frag->ip6f_offlg & IP6F_MORE_FRAG)
526 			ip->ip_off |= htons(IP_MF);
527 	} else {
528 		ip->ip_off = htons(IP_DF);
529 	}
530 	ip->ip_sum = in_cksum_hdr(ip);
531 }
532 
533 #define	FRAGSZ(mtu) ((mtu) - sizeof(struct ip6_hdr) - sizeof(struct ip6_frag))
534 static NAT64NOINLINE int
nat64_fragment6(struct nat64_counters * stats,struct ip6_hdr * ip6,struct mbufq * mq,struct mbuf * m,uint32_t mtu,uint16_t ip_id,uint16_t ip_off)535 nat64_fragment6(struct nat64_counters *stats, struct ip6_hdr *ip6,
536     struct mbufq *mq, struct mbuf *m, uint32_t mtu, uint16_t ip_id,
537     uint16_t ip_off)
538 {
539 	struct ip6_frag ip6f;
540 	struct mbuf *n;
541 	uint16_t hlen, len, offset;
542 	int plen;
543 
544 	plen = ntohs(ip6->ip6_plen);
545 	hlen = sizeof(struct ip6_hdr);
546 
547 	/* Fragmentation isn't needed */
548 	if (ip_off == 0 && plen <= mtu - hlen) {
549 		M_PREPEND(m, hlen, M_NOWAIT);
550 		if (m == NULL) {
551 			NAT64STAT_INC(stats, nomem);
552 			return (ENOMEM);
553 		}
554 		bcopy(ip6, mtod(m, void *), hlen);
555 		if (mbufq_enqueue(mq, m) != 0) {
556 			m_freem(m);
557 			NAT64STAT_INC(stats, dropped);
558 			DPRINTF(DP_DROPS, "dropped due to mbufq overflow");
559 			return (ENOBUFS);
560 		}
561 		return (0);
562 	}
563 
564 	hlen += sizeof(struct ip6_frag);
565 	ip6f.ip6f_reserved = 0;
566 	ip6f.ip6f_nxt = ip6->ip6_nxt;
567 	ip6->ip6_nxt = IPPROTO_FRAGMENT;
568 	if (ip_off != 0) {
569 		/*
570 		 * We have got an IPv4 fragment.
571 		 * Use offset value and ip_id from original fragment.
572 		 */
573 		ip6f.ip6f_ident = htonl(ntohs(ip_id));
574 		offset = (ntohs(ip_off) & IP_OFFMASK) << 3;
575 		NAT64STAT_INC(stats, ifrags);
576 	} else {
577 		/* The packet size exceeds interface MTU */
578 		ip6f.ip6f_ident = htonl(ip6_randomid());
579 		offset = 0; /* First fragment*/
580 	}
581 	while (plen > 0 && m != NULL) {
582 		n = NULL;
583 		len = FRAGSZ(mtu) & ~7;
584 		if (len > plen)
585 			len = plen;
586 		ip6->ip6_plen = htons(len + sizeof(ip6f));
587 		ip6f.ip6f_offlg = ntohs(offset);
588 		if (len < plen || (ip_off & htons(IP_MF)) != 0)
589 			ip6f.ip6f_offlg |= IP6F_MORE_FRAG;
590 		offset += len;
591 		plen -= len;
592 		if (plen > 0) {
593 			n = m_split(m, len, M_NOWAIT);
594 			if (n == NULL)
595 				goto fail;
596 		}
597 		M_PREPEND(m, hlen, M_NOWAIT);
598 		if (m == NULL)
599 			goto fail;
600 		bcopy(ip6, mtod(m, void *), sizeof(struct ip6_hdr));
601 		bcopy(&ip6f, mtodo(m, sizeof(struct ip6_hdr)),
602 		    sizeof(struct ip6_frag));
603 		if (mbufq_enqueue(mq, m) != 0)
604 			goto fail;
605 		m = n;
606 	}
607 	NAT64STAT_ADD(stats, ofrags, mbufq_len(mq));
608 	return (0);
609 fail:
610 	if (m != NULL)
611 		m_freem(m);
612 	if (n != NULL)
613 		m_freem(n);
614 	mbufq_drain(mq);
615 	NAT64STAT_INC(stats, nomem);
616 	return (ENOMEM);
617 }
618 
619 static struct nhop_object *
nat64_find_route6(struct sockaddr_in6 * dst,struct mbuf * m)620 nat64_find_route6(struct sockaddr_in6 *dst, struct mbuf *m)
621 {
622 	struct nhop_object *nh;
623 
624 	NET_EPOCH_ASSERT();
625 	nh = fib6_lookup(M_GETFIB(m), &dst->sin6_addr, 0, NHR_NONE, 0);
626 	if (nh == NULL)
627 		return (NULL);
628 	if (nh->nh_flags & (NHF_BLACKHOLE | NHF_REJECT))
629 		return (NULL);
630 
631 	dst->sin6_family = AF_INET6;
632 	dst->sin6_len = sizeof(*dst);
633 	if (nh->nh_flags & NHF_GATEWAY)
634 		dst->sin6_addr = nh->gw6_sa.sin6_addr;
635 	dst->sin6_port = 0;
636 	dst->sin6_scope_id = 0;
637 	dst->sin6_flowinfo = 0;
638 	return (nh);
639 }
640 
641 #define	NAT64_ICMP6_PLEN	64
642 static NAT64NOINLINE void
nat64_icmp6_reflect(struct mbuf * m,uint8_t type,uint8_t code,uint32_t mtu,struct nat64_counters * stats,void * logdata)643 nat64_icmp6_reflect(struct mbuf *m, uint8_t type, uint8_t code, uint32_t mtu,
644     struct nat64_counters *stats, void *logdata)
645 {
646 	struct icmp6_hdr *icmp6;
647 	struct ip6_hdr *ip6, *oip6;
648 	struct mbuf *n;
649 	int len, plen, proto;
650 
651 	len = 0;
652 	proto = nat64_getlasthdr(m, &len);
653 	if (proto < 0) {
654 		DPRINTF(DP_DROPS, "mbuf isn't contigious");
655 		goto freeit;
656 	}
657 	/*
658 	 * Do not send ICMPv6 in reply to ICMPv6 errors.
659 	 */
660 	if (proto == IPPROTO_ICMPV6) {
661 		if (m->m_len < len + sizeof(*icmp6)) {
662 			DPRINTF(DP_DROPS, "mbuf isn't contigious");
663 			goto freeit;
664 		}
665 		icmp6 = mtodo(m, len);
666 		if (icmp6->icmp6_type < ICMP6_ECHO_REQUEST ||
667 		    icmp6->icmp6_type == ND_REDIRECT) {
668 			DPRINTF(DP_DROPS, "do not send ICMPv6 in reply to "
669 			    "ICMPv6 errors");
670 			goto freeit;
671 		}
672 		/*
673 		 * If there are extra headers between IPv6 and ICMPv6,
674 		 * strip off them.
675 		 */
676 		if (len > sizeof(struct ip6_hdr)) {
677 			/*
678 			 * NOTE: ipfw_chk already did m_pullup() and it is
679 			 * expected that data is contigious from the start
680 			 * of IPv6 header up to the end of ICMPv6 header.
681 			 */
682 			bcopy(mtod(m, caddr_t),
683 			    mtodo(m, len - sizeof(struct ip6_hdr)),
684 			    sizeof(struct ip6_hdr));
685 			m_adj(m, len - sizeof(struct ip6_hdr));
686 		}
687 	}
688 	/*
689 	if (icmp6_ratelimit(&ip6->ip6_src, type, code))
690 		goto freeit;
691 		*/
692 	ip6 = mtod(m, struct ip6_hdr *);
693 	switch (type) {
694 	case ICMP6_DST_UNREACH:
695 	case ICMP6_PACKET_TOO_BIG:
696 	case ICMP6_TIME_EXCEEDED:
697 	case ICMP6_PARAM_PROB:
698 		break;
699 	default:
700 		goto freeit;
701 	}
702 	/* Calculate length of ICMPv6 payload */
703 	len = (m->m_pkthdr.len > NAT64_ICMP6_PLEN) ? NAT64_ICMP6_PLEN:
704 	    m->m_pkthdr.len;
705 
706 	/* Create new ICMPv6 datagram */
707 	plen = len + sizeof(struct icmp6_hdr);
708 	n = m_get2(sizeof(struct ip6_hdr) + plen + max_hdr, M_NOWAIT,
709 	    MT_HEADER, M_PKTHDR);
710 	if (n == NULL) {
711 		NAT64STAT_INC(stats, nomem);
712 		m_freem(m);
713 		return;
714 	}
715 	/*
716 	 * Move pkthdr from original mbuf. We should have initialized some
717 	 * fields, because we can reinject this mbuf to netisr and it will
718 	 * go through input path (it requires at least rcvif should be set).
719 	 * Also do M_ALIGN() to reduce chances of need to allocate new mbuf
720 	 * in the chain, when we will do M_PREPEND() or make some type of
721 	 * tunneling.
722 	 */
723 	m_move_pkthdr(n, m);
724 	M_ALIGN(n, sizeof(struct ip6_hdr) + plen + max_hdr);
725 
726 	n->m_len = n->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
727 	oip6 = mtod(n, struct ip6_hdr *);
728 	/*
729 	 * Make IPv6 source address selection for reflected datagram.
730 	 * nat64_check_ip6() doesn't allow scoped addresses, therefore
731 	 * we use zero scopeid.
732 	 */
733 	if (in6_selectsrc_addr(M_GETFIB(n), &ip6->ip6_src, 0,
734 	    n->m_pkthdr.rcvif, &oip6->ip6_src, NULL) != 0) {
735 		/*
736 		 * Failed to find proper source address, drop the packet.
737 		 */
738 		m_freem(n);
739 		goto freeit;
740 	}
741 	oip6->ip6_dst = ip6->ip6_src;
742 	oip6->ip6_nxt = IPPROTO_ICMPV6;
743 	oip6->ip6_flow = 0;
744 	oip6->ip6_vfc |= IPV6_VERSION;
745 	oip6->ip6_hlim = V_ip6_defhlim;
746 	oip6->ip6_plen = htons(plen);
747 
748 	icmp6 = mtodo(n, sizeof(struct ip6_hdr));
749 	icmp6->icmp6_cksum = 0;
750 	icmp6->icmp6_type = type;
751 	icmp6->icmp6_code = code;
752 	icmp6->icmp6_mtu = htonl(mtu);
753 
754 	m_copydata(m, 0, len, mtodo(n, sizeof(struct ip6_hdr) +
755 	    sizeof(struct icmp6_hdr)));
756 	icmp6->icmp6_cksum = in6_cksum(n, IPPROTO_ICMPV6,
757 	    sizeof(struct ip6_hdr), plen);
758 	m_freem(m);
759 	V_nat64out->output_one(n, stats, logdata);
760 	return;
761 freeit:
762 	NAT64STAT_INC(stats, dropped);
763 	m_freem(m);
764 }
765 
766 static struct nhop_object *
nat64_find_route4(struct sockaddr_in * dst,struct mbuf * m)767 nat64_find_route4(struct sockaddr_in *dst, struct mbuf *m)
768 {
769 	struct nhop_object *nh;
770 
771 	NET_EPOCH_ASSERT();
772 	nh = fib4_lookup(M_GETFIB(m), dst->sin_addr, 0, NHR_NONE, 0);
773 	if (nh == NULL)
774 		return (NULL);
775 	if (nh->nh_flags & (NHF_BLACKHOLE | NHF_BROADCAST | NHF_REJECT))
776 		return (NULL);
777 
778 	dst->sin_family = AF_INET;
779 	dst->sin_len = sizeof(*dst);
780 	if (nh->nh_flags & NHF_GATEWAY)
781 		dst->sin_addr = nh->gw4_sa.sin_addr;
782 	dst->sin_port = 0;
783 	return (nh);
784 }
785 
786 #define	NAT64_ICMP_PLEN	64
787 static NAT64NOINLINE void
nat64_icmp_reflect(struct mbuf * m,uint8_t type,uint8_t code,uint16_t mtu,struct nat64_counters * stats,void * logdata)788 nat64_icmp_reflect(struct mbuf *m, uint8_t type,
789     uint8_t code, uint16_t mtu, struct nat64_counters *stats, void *logdata)
790 {
791 	struct icmp *icmp;
792 	struct ip *ip, *oip;
793 	struct mbuf *n;
794 	int len, plen;
795 
796 	ip = mtod(m, struct ip *);
797 	/* Do not send ICMP error if packet is not the first fragment */
798 	if (ip->ip_off & ~ntohs(IP_MF|IP_DF)) {
799 		DPRINTF(DP_DROPS, "not first fragment");
800 		goto freeit;
801 	}
802 	/* Do not send ICMP in reply to ICMP errors */
803 	if (ip->ip_p == IPPROTO_ICMP) {
804 		if (m->m_len < (ip->ip_hl << 2)) {
805 			DPRINTF(DP_DROPS, "mbuf isn't contigious");
806 			goto freeit;
807 		}
808 		icmp = mtodo(m, ip->ip_hl << 2);
809 		if (!ICMP_INFOTYPE(icmp->icmp_type)) {
810 			DPRINTF(DP_DROPS, "do not send ICMP in reply to "
811 			    "ICMP errors");
812 			goto freeit;
813 		}
814 	}
815 	switch (type) {
816 	case ICMP_UNREACH:
817 	case ICMP_TIMXCEED:
818 	case ICMP_PARAMPROB:
819 		break;
820 	default:
821 		goto freeit;
822 	}
823 	/* Calculate length of ICMP payload */
824 	len = (m->m_pkthdr.len > NAT64_ICMP_PLEN) ? (ip->ip_hl << 2) + 8:
825 	    m->m_pkthdr.len;
826 
827 	/* Create new ICMPv4 datagram */
828 	plen = len + sizeof(struct icmphdr) + sizeof(uint32_t);
829 	n = m_get2(sizeof(struct ip) + plen + max_hdr, M_NOWAIT,
830 	    MT_HEADER, M_PKTHDR);
831 	if (n == NULL) {
832 		NAT64STAT_INC(stats, nomem);
833 		m_freem(m);
834 		return;
835 	}
836 	m_move_pkthdr(n, m);
837 	M_ALIGN(n, sizeof(struct ip) + plen + max_hdr);
838 
839 	n->m_len = n->m_pkthdr.len = sizeof(struct ip) + plen;
840 	oip = mtod(n, struct ip *);
841 	oip->ip_v = IPVERSION;
842 	oip->ip_hl = sizeof(struct ip) >> 2;
843 	oip->ip_tos = 0;
844 	oip->ip_len = htons(n->m_pkthdr.len);
845 	oip->ip_ttl = V_ip_defttl;
846 	oip->ip_p = IPPROTO_ICMP;
847 	ip_fillid(oip);
848 	oip->ip_off = htons(IP_DF);
849 	oip->ip_src = ip->ip_dst;
850 	oip->ip_dst = ip->ip_src;
851 	oip->ip_sum = 0;
852 	oip->ip_sum = in_cksum_hdr(oip);
853 
854 	icmp = mtodo(n, sizeof(struct ip));
855 	icmp->icmp_type = type;
856 	icmp->icmp_code = code;
857 	icmp->icmp_cksum = 0;
858 	icmp->icmp_pmvoid = 0;
859 	icmp->icmp_nextmtu = htons(mtu);
860 	m_copydata(m, 0, len, mtodo(n, sizeof(struct ip) +
861 	    sizeof(struct icmphdr) + sizeof(uint32_t)));
862 	icmp->icmp_cksum = in_cksum_skip(n, sizeof(struct ip) + plen,
863 	    sizeof(struct ip));
864 	m_freem(m);
865 	V_nat64out->output_one(n, stats, logdata);
866 	return;
867 freeit:
868 	NAT64STAT_INC(stats, dropped);
869 	m_freem(m);
870 }
871 
872 /* Translate ICMP echo request/reply into ICMPv6 */
873 static void
nat64_icmp_handle_echo(struct ip6_hdr * ip6,struct icmp6_hdr * icmp6,uint16_t id,uint8_t type)874 nat64_icmp_handle_echo(struct ip6_hdr *ip6, struct icmp6_hdr *icmp6,
875     uint16_t id, uint8_t type)
876 {
877 	uint16_t old;
878 
879 	old = *(uint16_t *)icmp6;	/* save type+code in one word */
880 	icmp6->icmp6_type = type;
881 	/* Reflect ICMPv6 -> ICMPv4 type translation in the cksum */
882 	icmp6->icmp6_cksum = cksum_adjust(icmp6->icmp6_cksum,
883 	    old, *(uint16_t *)icmp6);
884 	if (id != 0) {
885 		old = icmp6->icmp6_id;
886 		icmp6->icmp6_id = id;
887 		/* Reflect ICMP id translation in the cksum */
888 		icmp6->icmp6_cksum = cksum_adjust(icmp6->icmp6_cksum,
889 		    old, id);
890 	}
891 	/* Reflect IPv6 pseudo header in the cksum */
892 	icmp6->icmp6_cksum = ~in6_cksum_pseudo(ip6, ntohs(ip6->ip6_plen),
893 	    IPPROTO_ICMPV6, ~icmp6->icmp6_cksum);
894 }
895 
896 static NAT64NOINLINE struct mbuf *
nat64_icmp_translate(struct mbuf * m,struct ip6_hdr * ip6,uint16_t icmpid,int offset,struct nat64_config * cfg)897 nat64_icmp_translate(struct mbuf *m, struct ip6_hdr *ip6, uint16_t icmpid,
898     int offset, struct nat64_config *cfg)
899 {
900 	struct ip ip;
901 	struct icmp *icmp;
902 	struct tcphdr *tcp;
903 	struct udphdr *udp;
904 	struct ip6_hdr *eip6;
905 	struct mbuf *n;
906 	uint32_t mtu;
907 	int len, hlen, plen;
908 	uint8_t type, code;
909 
910 	if (m->m_len < offset + ICMP_MINLEN)
911 		m = m_pullup(m, offset + ICMP_MINLEN);
912 	if (m == NULL) {
913 		NAT64STAT_INC(&cfg->stats, nomem);
914 		return (m);
915 	}
916 	mtu = 0;
917 	icmp = mtodo(m, offset);
918 	/* RFC 7915 p4.2 */
919 	switch (icmp->icmp_type) {
920 	case ICMP_ECHOREPLY:
921 		type = ICMP6_ECHO_REPLY;
922 		code = 0;
923 		break;
924 	case ICMP_UNREACH:
925 		type = ICMP6_DST_UNREACH;
926 		switch (icmp->icmp_code) {
927 		case ICMP_UNREACH_NET:
928 		case ICMP_UNREACH_HOST:
929 		case ICMP_UNREACH_SRCFAIL:
930 		case ICMP_UNREACH_NET_UNKNOWN:
931 		case ICMP_UNREACH_HOST_UNKNOWN:
932 		case ICMP_UNREACH_TOSNET:
933 		case ICMP_UNREACH_TOSHOST:
934 			code = ICMP6_DST_UNREACH_NOROUTE;
935 			break;
936 		case ICMP_UNREACH_PROTOCOL:
937 			type = ICMP6_PARAM_PROB;
938 			code = ICMP6_PARAMPROB_NEXTHEADER;
939 			break;
940 		case ICMP_UNREACH_PORT:
941 			code = ICMP6_DST_UNREACH_NOPORT;
942 			break;
943 		case ICMP_UNREACH_NEEDFRAG:
944 			type = ICMP6_PACKET_TOO_BIG;
945 			code = 0;
946 			/* XXX: needs an additional look */
947 			mtu = max(IPV6_MMTU, ntohs(icmp->icmp_nextmtu) + 20);
948 			break;
949 		case ICMP_UNREACH_NET_PROHIB:
950 		case ICMP_UNREACH_HOST_PROHIB:
951 		case ICMP_UNREACH_FILTER_PROHIB:
952 		case ICMP_UNREACH_PRECEDENCE_CUTOFF:
953 			code = ICMP6_DST_UNREACH_ADMIN;
954 			break;
955 		default:
956 			DPRINTF(DP_DROPS, "Unsupported ICMP type %d, code %d",
957 			    icmp->icmp_type, icmp->icmp_code);
958 			goto freeit;
959 		}
960 		break;
961 	case ICMP_TIMXCEED:
962 		type = ICMP6_TIME_EXCEEDED;
963 		code = icmp->icmp_code;
964 		break;
965 	case ICMP_ECHO:
966 		type = ICMP6_ECHO_REQUEST;
967 		code = 0;
968 		break;
969 	case ICMP_PARAMPROB:
970 		type = ICMP6_PARAM_PROB;
971 		switch (icmp->icmp_code) {
972 		case ICMP_PARAMPROB_ERRATPTR:
973 		case ICMP_PARAMPROB_LENGTH:
974 			code = ICMP6_PARAMPROB_HEADER;
975 			switch (icmp->icmp_pptr) {
976 			case 0: /* Version/IHL */
977 			case 1: /* Type Of Service */
978 				mtu = icmp->icmp_pptr;
979 				break;
980 			case 2: /* Total Length */
981 			case 3: mtu = 4; /* Payload Length */
982 				break;
983 			case 8: /* Time to Live */
984 				mtu = 7; /* Hop Limit */
985 				break;
986 			case 9: /* Protocol */
987 				mtu = 6; /* Next Header */
988 				break;
989 			case 12: /* Source address */
990 			case 13:
991 			case 14:
992 			case 15:
993 				mtu = 8;
994 				break;
995 			case 16: /* Destination address */
996 			case 17:
997 			case 18:
998 			case 19:
999 				mtu = 24;
1000 				break;
1001 			default: /* Silently drop */
1002 				DPRINTF(DP_DROPS, "Unsupported ICMP type %d,"
1003 				    " code %d, pptr %d", icmp->icmp_type,
1004 				    icmp->icmp_code, icmp->icmp_pptr);
1005 				goto freeit;
1006 			}
1007 			break;
1008 		default:
1009 			DPRINTF(DP_DROPS, "Unsupported ICMP type %d,"
1010 			    " code %d, pptr %d", icmp->icmp_type,
1011 			    icmp->icmp_code, icmp->icmp_pptr);
1012 			goto freeit;
1013 		}
1014 		break;
1015 	default:
1016 		DPRINTF(DP_DROPS, "Unsupported ICMP type %d, code %d",
1017 		    icmp->icmp_type, icmp->icmp_code);
1018 		goto freeit;
1019 	}
1020 	/*
1021 	 * For echo request/reply we can use original payload,
1022 	 * but we need adjust icmp_cksum, because ICMPv6 cksum covers
1023 	 * IPv6 pseudo header and ICMPv6 types differs from ICMPv4.
1024 	 */
1025 	if (type == ICMP6_ECHO_REQUEST || type == ICMP6_ECHO_REPLY) {
1026 		nat64_icmp_handle_echo(ip6, ICMP6(icmp), icmpid, type);
1027 		return (m);
1028 	}
1029 	/*
1030 	 * For other types of ICMP messages we need to translate inner
1031 	 * IPv4 header to IPv6 header.
1032 	 * Assume ICMP src is the same as payload dst
1033 	 * E.g. we have ( GWsrc1 , NATIP1 ) in outer header
1034 	 * and          ( NATIP1, Hostdst1 ) in ICMP copy header.
1035 	 * In that case, we already have map for NATIP1 and GWsrc1.
1036 	 * The only thing we need is to copy IPv6 map prefix to
1037 	 * Hostdst1.
1038 	 */
1039 	hlen = offset + ICMP_MINLEN;
1040 	if (m->m_pkthdr.len < hlen + sizeof(struct ip) + ICMP_MINLEN) {
1041 		DPRINTF(DP_DROPS, "Message is too short %d",
1042 		    m->m_pkthdr.len);
1043 		goto freeit;
1044 	}
1045 	m_copydata(m, hlen, sizeof(struct ip), (char *)&ip);
1046 	if (ip.ip_v != IPVERSION) {
1047 		DPRINTF(DP_DROPS, "Wrong IP version %d", ip.ip_v);
1048 		goto freeit;
1049 	}
1050 	hlen += ip.ip_hl << 2; /* Skip inner IP header */
1051 	if (nat64_check_ip4(ip.ip_src.s_addr) != 0 ||
1052 	    nat64_check_ip4(ip.ip_dst.s_addr) != 0 ||
1053 	    nat64_check_private_ip4(cfg, ip.ip_src.s_addr) != 0 ||
1054 	    nat64_check_private_ip4(cfg, ip.ip_dst.s_addr) != 0) {
1055 		DPRINTF(DP_DROPS, "IP addresses checks failed %04x -> %04x",
1056 		    ntohl(ip.ip_src.s_addr), ntohl(ip.ip_dst.s_addr));
1057 		goto freeit;
1058 	}
1059 	if (m->m_pkthdr.len < hlen + ICMP_MINLEN) {
1060 		DPRINTF(DP_DROPS, "Message is too short %d",
1061 		    m->m_pkthdr.len);
1062 		goto freeit;
1063 	}
1064 #if 0
1065 	/*
1066 	 * Check that inner source matches the outer destination.
1067 	 * XXX: We need some method to convert IPv4 into IPv6 address here,
1068 	 *	and compare IPv6 addresses.
1069 	 */
1070 	if (ip.ip_src.s_addr != nat64_get_ip4(&ip6->ip6_dst)) {
1071 		DPRINTF(DP_GENERIC, "Inner source doesn't match destination ",
1072 		    "%04x vs %04x", ip.ip_src.s_addr,
1073 		    nat64_get_ip4(&ip6->ip6_dst));
1074 		goto freeit;
1075 	}
1076 #endif
1077 	/*
1078 	 * Create new mbuf for ICMPv6 datagram.
1079 	 * NOTE: len is data length just after inner IP header.
1080 	 */
1081 	len = m->m_pkthdr.len - hlen;
1082 	if (sizeof(struct ip6_hdr) +
1083 	    sizeof(struct icmp6_hdr) + len > NAT64_ICMP6_PLEN)
1084 		len = NAT64_ICMP6_PLEN - sizeof(struct icmp6_hdr) -
1085 		    sizeof(struct ip6_hdr);
1086 	plen = sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr) + len;
1087 	n = m_get2(offset + plen + max_hdr, M_NOWAIT, MT_HEADER, M_PKTHDR);
1088 	if (n == NULL) {
1089 		NAT64STAT_INC(&cfg->stats, nomem);
1090 		m_freem(m);
1091 		return (NULL);
1092 	}
1093 	m_move_pkthdr(n, m);
1094 	M_ALIGN(n, offset + plen + max_hdr);
1095 	n->m_len = n->m_pkthdr.len = offset + plen;
1096 	/* Adjust ip6_plen in outer header */
1097 	ip6->ip6_plen = htons(plen);
1098 	/* Construct new inner IPv6 header */
1099 	eip6 = mtodo(n, offset + sizeof(struct icmp6_hdr));
1100 	eip6->ip6_src = ip6->ip6_dst;
1101 
1102 	/* Use the same prefix that we have in outer header */
1103 	eip6->ip6_dst = ip6->ip6_src;
1104 	MPASS(cfg->flags & NAT64_PLATPFX);
1105 	nat64_embed_ip4(&eip6->ip6_dst, cfg->plat_plen, ip.ip_dst.s_addr);
1106 
1107 	eip6->ip6_flow = htonl(ip.ip_tos << 20);
1108 	eip6->ip6_vfc |= IPV6_VERSION;
1109 	eip6->ip6_hlim = ip.ip_ttl;
1110 	eip6->ip6_plen = htons(ntohs(ip.ip_len) - (ip.ip_hl << 2));
1111 	eip6->ip6_nxt = (ip.ip_p == IPPROTO_ICMP) ? IPPROTO_ICMPV6: ip.ip_p;
1112 	m_copydata(m, hlen, len, (char *)(eip6 + 1));
1113 	/*
1114 	 * We need to translate source port in the inner ULP header,
1115 	 * and adjust ULP checksum.
1116 	 */
1117 	switch (ip.ip_p) {
1118 	case IPPROTO_TCP:
1119 		if (len < offsetof(struct tcphdr, th_sum))
1120 			break;
1121 		tcp = TCP(eip6 + 1);
1122 		if (icmpid != 0) {
1123 			tcp->th_sum = cksum_adjust(tcp->th_sum,
1124 			    tcp->th_sport, icmpid);
1125 			tcp->th_sport = icmpid;
1126 		}
1127 		tcp->th_sum = cksum_add(tcp->th_sum,
1128 		    ~nat64_cksum_convert(eip6, &ip));
1129 		break;
1130 	case IPPROTO_UDP:
1131 		if (len < offsetof(struct udphdr, uh_sum))
1132 			break;
1133 		udp = UDP(eip6 + 1);
1134 		if (icmpid != 0) {
1135 			udp->uh_sum = cksum_adjust(udp->uh_sum,
1136 			    udp->uh_sport, icmpid);
1137 			udp->uh_sport = icmpid;
1138 		}
1139 		udp->uh_sum = cksum_add(udp->uh_sum,
1140 		    ~nat64_cksum_convert(eip6, &ip));
1141 		break;
1142 	case IPPROTO_ICMP:
1143 		/*
1144 		 * Check if this is an ICMP error message for echo request
1145 		 * that we sent. I.e. ULP in the data containing invoking
1146 		 * packet is IPPROTO_ICMP and its type is ICMP_ECHO.
1147 		 */
1148 		icmp = (struct icmp *)(eip6 + 1);
1149 		if (icmp->icmp_type != ICMP_ECHO) {
1150 			m_freem(n);
1151 			goto freeit;
1152 		}
1153 		/*
1154 		 * For our client this original datagram should looks
1155 		 * like it was ICMPv6 datagram with type ICMP6_ECHO_REQUEST.
1156 		 * Thus we need adjust icmp_cksum and convert type from
1157 		 * ICMP_ECHO to ICMP6_ECHO_REQUEST.
1158 		 */
1159 		nat64_icmp_handle_echo(eip6, ICMP6(icmp), icmpid,
1160 		    ICMP6_ECHO_REQUEST);
1161 	}
1162 	m_freem(m);
1163 	/* Convert ICMPv4 into ICMPv6 header */
1164 	icmp = mtodo(n, offset);
1165 	ICMP6(icmp)->icmp6_type = type;
1166 	ICMP6(icmp)->icmp6_code = code;
1167 	ICMP6(icmp)->icmp6_mtu = htonl(mtu);
1168 	ICMP6(icmp)->icmp6_cksum = 0;
1169 	ICMP6(icmp)->icmp6_cksum = cksum_add(
1170 	    ~in6_cksum_pseudo(ip6, plen, IPPROTO_ICMPV6, 0),
1171 	    in_cksum_skip(n, n->m_pkthdr.len, offset));
1172 	return (n);
1173 freeit:
1174 	m_freem(m);
1175 	NAT64STAT_INC(&cfg->stats, dropped);
1176 	return (NULL);
1177 }
1178 
1179 int
nat64_getlasthdr(struct mbuf * m,int * offset)1180 nat64_getlasthdr(struct mbuf *m, int *offset)
1181 {
1182 	struct ip6_hdr *ip6;
1183 	struct ip6_hbh *hbh;
1184 	int proto, hlen;
1185 
1186 	if (offset != NULL)
1187 		hlen = *offset;
1188 	else
1189 		hlen = 0;
1190 
1191 	if (m->m_len < hlen + sizeof(*ip6))
1192 		return (-1);
1193 
1194 	ip6 = mtodo(m, hlen);
1195 	hlen += sizeof(*ip6);
1196 	proto = ip6->ip6_nxt;
1197 	/* Skip extension headers */
1198 	while (proto == IPPROTO_HOPOPTS || proto == IPPROTO_ROUTING ||
1199 	    proto == IPPROTO_DSTOPTS) {
1200 		hbh = mtodo(m, hlen);
1201 		/*
1202 		 * We expect mbuf has contigious data up to
1203 		 * upper level header.
1204 		 */
1205 		if (m->m_len < hlen)
1206 			return (-1);
1207 		/*
1208 		 * We doesn't support Jumbo payload option,
1209 		 * so return error.
1210 		 */
1211 		if (proto == IPPROTO_HOPOPTS && ip6->ip6_plen == 0)
1212 			return (-1);
1213 		proto = hbh->ip6h_nxt;
1214 		hlen += (hbh->ip6h_len + 1) << 3;
1215 	}
1216 	if (offset != NULL)
1217 		*offset = hlen;
1218 	return (proto);
1219 }
1220 
1221 int
nat64_do_handle_ip4(struct mbuf * m,struct in6_addr * saddr,struct in6_addr * daddr,uint16_t lport,struct nat64_config * cfg,void * logdata)1222 nat64_do_handle_ip4(struct mbuf *m, struct in6_addr *saddr,
1223     struct in6_addr *daddr, uint16_t lport, struct nat64_config *cfg,
1224     void *logdata)
1225 {
1226 	struct nhop_object *nh;
1227 	struct ip6_hdr ip6;
1228 	struct sockaddr_in6 dst;
1229 	struct ip *ip;
1230 	struct mbufq mq;
1231 	uint16_t ip_id, ip_off;
1232 	uint16_t *csum;
1233 	int plen, hlen;
1234 	uint8_t proto;
1235 
1236 	ip = mtod(m, struct ip*);
1237 
1238 	if (*V_nat64ipstealth == 0 && ip->ip_ttl <= IPTTLDEC) {
1239 		nat64_icmp_reflect(m, ICMP_TIMXCEED,
1240 		    ICMP_TIMXCEED_INTRANS, 0, &cfg->stats, logdata);
1241 		return (NAT64RETURN);
1242 	}
1243 
1244 	ip6.ip6_dst = *daddr;
1245 	ip6.ip6_src = *saddr;
1246 
1247 	hlen = ip->ip_hl << 2;
1248 	plen = ntohs(ip->ip_len) - hlen;
1249 	proto = ip->ip_p;
1250 
1251 	/* Save ip_id and ip_off, both are in network byte order */
1252 	ip_id = ip->ip_id;
1253 	ip_off = ip->ip_off & htons(IP_OFFMASK | IP_MF);
1254 
1255 	/* Fragment length must be multiple of 8 octets */
1256 	if ((ip->ip_off & htons(IP_MF)) != 0 && (plen & 0x7) != 0) {
1257 		nat64_icmp_reflect(m, ICMP_PARAMPROB,
1258 		    ICMP_PARAMPROB_LENGTH, 0, &cfg->stats, logdata);
1259 		return (NAT64RETURN);
1260 	}
1261 	/* Fragmented ICMP is unsupported */
1262 	if (proto == IPPROTO_ICMP && ip_off != 0) {
1263 		DPRINTF(DP_DROPS, "dropped due to fragmented ICMP");
1264 		NAT64STAT_INC(&cfg->stats, dropped);
1265 		return (NAT64MFREE);
1266 	}
1267 
1268 	dst.sin6_addr = ip6.ip6_dst;
1269 	nh = nat64_find_route6(&dst, m);
1270 	if (nh == NULL) {
1271 		NAT64STAT_INC(&cfg->stats, noroute6);
1272 		nat64_icmp_reflect(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0,
1273 		    &cfg->stats, logdata);
1274 		return (NAT64RETURN);
1275 	}
1276 	if (nh->nh_mtu < plen + sizeof(ip6) &&
1277 	    (ip->ip_off & htons(IP_DF)) != 0) {
1278 		nat64_icmp_reflect(m, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG,
1279 		    FRAGSZ(nh->nh_mtu) + sizeof(struct ip), &cfg->stats, logdata);
1280 		return (NAT64RETURN);
1281 	}
1282 
1283 	ip6.ip6_flow = htonl(ip->ip_tos << 20);
1284 	ip6.ip6_vfc |= IPV6_VERSION;
1285 	ip6.ip6_hlim = ip->ip_ttl;
1286 	if (*V_nat64ipstealth == 0)
1287 		ip6.ip6_hlim -= IPTTLDEC;
1288 	ip6.ip6_plen = htons(plen);
1289 	ip6.ip6_nxt = (proto == IPPROTO_ICMP) ? IPPROTO_ICMPV6: proto;
1290 
1291 	/* Handle delayed checksums if needed. */
1292 	if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
1293 		in_delayed_cksum(m);
1294 		m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
1295 	}
1296 	/* Convert checksums. */
1297 	switch (proto) {
1298 	case IPPROTO_TCP:
1299 		csum = &TCP(mtodo(m, hlen))->th_sum;
1300 		if (lport != 0) {
1301 			struct tcphdr *tcp = TCP(mtodo(m, hlen));
1302 			*csum = cksum_adjust(*csum, tcp->th_dport, lport);
1303 			tcp->th_dport = lport;
1304 		}
1305 		*csum = cksum_add(*csum, ~nat64_cksum_convert(&ip6, ip));
1306 		break;
1307 	case IPPROTO_UDP:
1308 		csum = &UDP(mtodo(m, hlen))->uh_sum;
1309 		if (lport != 0) {
1310 			struct udphdr *udp = UDP(mtodo(m, hlen));
1311 			*csum = cksum_adjust(*csum, udp->uh_dport, lport);
1312 			udp->uh_dport = lport;
1313 		}
1314 		*csum = cksum_add(*csum, ~nat64_cksum_convert(&ip6, ip));
1315 		break;
1316 	case IPPROTO_ICMP:
1317 		m = nat64_icmp_translate(m, &ip6, lport, hlen, cfg);
1318 		if (m == NULL)	/* stats already accounted */
1319 			return (NAT64RETURN);
1320 	}
1321 
1322 	m_adj(m, hlen);
1323 	mbufq_init(&mq, 255);
1324 	nat64_fragment6(&cfg->stats, &ip6, &mq, m, nh->nh_mtu, ip_id, ip_off);
1325 	while ((m = mbufq_dequeue(&mq)) != NULL) {
1326 		if (V_nat64out->output(nh->nh_ifp, m, (struct sockaddr *)&dst,
1327 		    &cfg->stats, logdata) != 0)
1328 			break;
1329 		NAT64STAT_INC(&cfg->stats, opcnt46);
1330 	}
1331 	mbufq_drain(&mq);
1332 	return (NAT64RETURN);
1333 }
1334 
1335 int
nat64_handle_icmp6(struct mbuf * m,int hlen,uint32_t aaddr,uint16_t aport,struct nat64_config * cfg,void * logdata)1336 nat64_handle_icmp6(struct mbuf *m, int hlen, uint32_t aaddr, uint16_t aport,
1337     struct nat64_config *cfg, void *logdata)
1338 {
1339 	struct ip ip;
1340 	struct icmp6_hdr *icmp6;
1341 	struct ip6_frag *ip6f;
1342 	struct ip6_hdr *ip6, *ip6i;
1343 	uint32_t mtu;
1344 	int plen, proto;
1345 	uint8_t type, code;
1346 
1347 	if (hlen == 0) {
1348 		ip6 = mtod(m, struct ip6_hdr *);
1349 		if (nat64_check_ip6(&ip6->ip6_src) != 0 ||
1350 		    nat64_check_ip6(&ip6->ip6_dst) != 0)
1351 			return (NAT64SKIP);
1352 
1353 		proto = nat64_getlasthdr(m, &hlen);
1354 		if (proto != IPPROTO_ICMPV6) {
1355 			DPRINTF(DP_DROPS,
1356 			    "dropped due to mbuf isn't contigious");
1357 			NAT64STAT_INC(&cfg->stats, dropped);
1358 			return (NAT64MFREE);
1359 		}
1360 	}
1361 
1362 	/*
1363 	 * Translate ICMPv6 type and code to ICMPv4 (RFC7915).
1364 	 * NOTE: ICMPv6 echo handled by nat64_do_handle_ip6().
1365 	 */
1366 	icmp6 = mtodo(m, hlen);
1367 	mtu = 0;
1368 	switch (icmp6->icmp6_type) {
1369 	case ICMP6_DST_UNREACH:
1370 		type = ICMP_UNREACH;
1371 		switch (icmp6->icmp6_code) {
1372 		case ICMP6_DST_UNREACH_NOROUTE:
1373 		case ICMP6_DST_UNREACH_BEYONDSCOPE:
1374 		case ICMP6_DST_UNREACH_ADDR:
1375 			code = ICMP_UNREACH_HOST;
1376 			break;
1377 		case ICMP6_DST_UNREACH_ADMIN:
1378 			code = ICMP_UNREACH_HOST_PROHIB;
1379 			break;
1380 		case ICMP6_DST_UNREACH_NOPORT:
1381 			code = ICMP_UNREACH_PORT;
1382 			break;
1383 		default:
1384 			DPRINTF(DP_DROPS, "Unsupported ICMPv6 type %d,"
1385 			    " code %d", icmp6->icmp6_type,
1386 			    icmp6->icmp6_code);
1387 			NAT64STAT_INC(&cfg->stats, dropped);
1388 			return (NAT64MFREE);
1389 		}
1390 		break;
1391 	case ICMP6_PACKET_TOO_BIG:
1392 		type = ICMP_UNREACH;
1393 		code = ICMP_UNREACH_NEEDFRAG;
1394 		mtu = ntohl(icmp6->icmp6_mtu);
1395 		if (mtu < IPV6_MMTU) {
1396 			DPRINTF(DP_DROPS, "Wrong MTU %d in ICMPv6 type %d,"
1397 			    " code %d", mtu, icmp6->icmp6_type,
1398 			    icmp6->icmp6_code);
1399 			NAT64STAT_INC(&cfg->stats, dropped);
1400 			return (NAT64MFREE);
1401 		}
1402 		/*
1403 		 * Adjust MTU to reflect difference between
1404 		 * IPv6 an IPv4 headers.
1405 		 */
1406 		mtu -= sizeof(struct ip6_hdr) - sizeof(struct ip);
1407 		break;
1408 	case ICMP6_TIME_EXCEEDED:
1409 		type = ICMP_TIMXCEED;
1410 		code = icmp6->icmp6_code;
1411 		break;
1412 	case ICMP6_PARAM_PROB:
1413 		switch (icmp6->icmp6_code) {
1414 		case ICMP6_PARAMPROB_HEADER:
1415 			type = ICMP_PARAMPROB;
1416 			code = ICMP_PARAMPROB_ERRATPTR;
1417 			mtu = ntohl(icmp6->icmp6_pptr);
1418 			switch (mtu) {
1419 			case 0: /* Version/Traffic Class */
1420 			case 1: /* Traffic Class/Flow Label */
1421 				break;
1422 			case 4: /* Payload Length */
1423 			case 5:
1424 				mtu = 2;
1425 				break;
1426 			case 6: /* Next Header */
1427 				mtu = 9;
1428 				break;
1429 			case 7: /* Hop Limit */
1430 				mtu = 8;
1431 				break;
1432 			default:
1433 				if (mtu >= 8 && mtu <= 23) {
1434 					mtu = 12; /* Source address */
1435 					break;
1436 				}
1437 				if (mtu >= 24 && mtu <= 39) {
1438 					mtu = 16; /* Destination address */
1439 					break;
1440 				}
1441 				DPRINTF(DP_DROPS, "Unsupported ICMPv6 type %d,"
1442 				    " code %d, pptr %d", icmp6->icmp6_type,
1443 				    icmp6->icmp6_code, mtu);
1444 				NAT64STAT_INC(&cfg->stats, dropped);
1445 				return (NAT64MFREE);
1446 			}
1447 		case ICMP6_PARAMPROB_NEXTHEADER:
1448 			type = ICMP_UNREACH;
1449 			code = ICMP_UNREACH_PROTOCOL;
1450 			break;
1451 		default:
1452 			DPRINTF(DP_DROPS, "Unsupported ICMPv6 type %d,"
1453 			    " code %d, pptr %d", icmp6->icmp6_type,
1454 			    icmp6->icmp6_code, ntohl(icmp6->icmp6_pptr));
1455 			NAT64STAT_INC(&cfg->stats, dropped);
1456 			return (NAT64MFREE);
1457 		}
1458 		break;
1459 	default:
1460 		DPRINTF(DP_DROPS, "Unsupported ICMPv6 type %d, code %d",
1461 		    icmp6->icmp6_type, icmp6->icmp6_code);
1462 		NAT64STAT_INC(&cfg->stats, dropped);
1463 		return (NAT64MFREE);
1464 	}
1465 
1466 	hlen += sizeof(struct icmp6_hdr);
1467 	if (m->m_pkthdr.len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN) {
1468 		NAT64STAT_INC(&cfg->stats, dropped);
1469 		DPRINTF(DP_DROPS, "Message is too short %d",
1470 		    m->m_pkthdr.len);
1471 		return (NAT64MFREE);
1472 	}
1473 	/*
1474 	 * We need at least ICMP_MINLEN bytes of original datagram payload
1475 	 * to generate ICMP message. It is nice that ICMP_MINLEN is equal
1476 	 * to sizeof(struct ip6_frag). So, if embedded datagram had a fragment
1477 	 * header we will not have to do m_pullup() again.
1478 	 *
1479 	 * What we have here:
1480 	 * Outer header: (IPv6iGW, v4mapPRefix+v4exthost)
1481 	 * Inner header: (v4mapPRefix+v4host, IPv6iHost) [sport, dport]
1482 	 * We need to translate it to:
1483 	 *
1484 	 * Outer header: (alias_host, v4exthost)
1485 	 * Inner header: (v4exthost, alias_host) [sport, alias_port]
1486 	 *
1487 	 * Assume caller function has checked if v4mapPRefix+v4host
1488 	 * matches configured prefix.
1489 	 * The only two things we should be provided with are mapping between
1490 	 * IPv6iHost <> alias_host and between dport and alias_port.
1491 	 */
1492 	if (m->m_len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN)
1493 		m = m_pullup(m, hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN);
1494 	if (m == NULL) {
1495 		NAT64STAT_INC(&cfg->stats, nomem);
1496 		return (NAT64RETURN);
1497 	}
1498 	ip6 = mtod(m, struct ip6_hdr *);
1499 	ip6i = mtodo(m, hlen);
1500 	ip6f = NULL;
1501 	proto = ip6i->ip6_nxt;
1502 	plen = ntohs(ip6i->ip6_plen);
1503 	hlen += sizeof(struct ip6_hdr);
1504 	if (proto == IPPROTO_FRAGMENT) {
1505 		if (m->m_pkthdr.len < hlen + sizeof(struct ip6_frag) +
1506 		    ICMP_MINLEN)
1507 			goto fail;
1508 		ip6f = mtodo(m, hlen);
1509 		proto = ip6f->ip6f_nxt;
1510 		plen -= sizeof(struct ip6_frag);
1511 		hlen += sizeof(struct ip6_frag);
1512 		/* Ajust MTU to reflect frag header size */
1513 		if (type == ICMP_UNREACH && code == ICMP_UNREACH_NEEDFRAG)
1514 			mtu -= sizeof(struct ip6_frag);
1515 	}
1516 	if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) {
1517 		DPRINTF(DP_DROPS, "Unsupported proto %d in the inner header",
1518 		    proto);
1519 		goto fail;
1520 	}
1521 	if (nat64_check_ip6(&ip6i->ip6_src) != 0 ||
1522 	    nat64_check_ip6(&ip6i->ip6_dst) != 0) {
1523 		DPRINTF(DP_DROPS, "Inner addresses do not passes the check");
1524 		goto fail;
1525 	}
1526 	/* Check if outer dst is the same as inner src */
1527 	if (!IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &ip6i->ip6_src)) {
1528 		DPRINTF(DP_DROPS, "Inner src doesn't match outer dst");
1529 		goto fail;
1530 	}
1531 
1532 	/* Now we need to make a fake IPv4 packet to generate ICMP message */
1533 	ip.ip_dst.s_addr = aaddr;
1534 	ip.ip_src.s_addr = nat64_extract_ip4(&ip6i->ip6_src, cfg->plat_plen);
1535 	if (ip.ip_src.s_addr == 0)
1536 		goto fail;
1537 	/* XXX: Make fake ulp header */
1538 	if (V_nat64out == &nat64_direct) /* init_ip4hdr will decrement it */
1539 		ip6i->ip6_hlim += IPV6_HLIMDEC;
1540 	nat64_init_ip4hdr(ip6i, ip6f, plen, proto, &ip);
1541 	m_adj(m, hlen - sizeof(struct ip));
1542 	bcopy(&ip, mtod(m, void *), sizeof(ip));
1543 	nat64_icmp_reflect(m, type, code, (uint16_t)mtu, &cfg->stats,
1544 	    logdata);
1545 	return (NAT64RETURN);
1546 fail:
1547 	/*
1548 	 * We must call m_freem() because mbuf pointer could be
1549 	 * changed with m_pullup().
1550 	 */
1551 	m_freem(m);
1552 	NAT64STAT_INC(&cfg->stats, dropped);
1553 	return (NAT64RETURN);
1554 }
1555 
1556 int
nat64_do_handle_ip6(struct mbuf * m,uint32_t aaddr,uint16_t aport,struct nat64_config * cfg,void * logdata)1557 nat64_do_handle_ip6(struct mbuf *m, uint32_t aaddr, uint16_t aport,
1558     struct nat64_config *cfg, void *logdata)
1559 {
1560 	struct ip ip;
1561 	struct nhop_object *nh;
1562 	struct sockaddr_in dst;
1563 	struct ip6_frag *frag;
1564 	struct ip6_hdr *ip6;
1565 	struct icmp6_hdr *icmp6;
1566 	uint16_t *csum;
1567 	int plen, hlen, proto;
1568 
1569 	/*
1570 	 * XXX: we expect ipfw_chk() did m_pullup() up to upper level
1571 	 * protocol's headers. Also we skip some checks, that ip6_input(),
1572 	 * ip6_forward(), ip6_fastfwd() and ipfw_chk() already did.
1573 	 */
1574 	ip6 = mtod(m, struct ip6_hdr *);
1575 	if (nat64_check_ip6(&ip6->ip6_src) != 0 ||
1576 	    nat64_check_ip6(&ip6->ip6_dst) != 0) {
1577 		return (NAT64SKIP);
1578 	}
1579 
1580 	/* Starting from this point we must not return zero */
1581 	ip.ip_src.s_addr = aaddr;
1582 	if (nat64_check_ip4(ip.ip_src.s_addr) != 0) {
1583 		DPRINTF(DP_GENERIC | DP_DROPS, "invalid source address: %08x",
1584 		    ip.ip_src.s_addr);
1585 		NAT64STAT_INC(&cfg->stats, dropped);
1586 		return (NAT64MFREE);
1587 	}
1588 
1589 	ip.ip_dst.s_addr = nat64_extract_ip4(&ip6->ip6_dst, cfg->plat_plen);
1590 	if (ip.ip_dst.s_addr == 0) {
1591 		NAT64STAT_INC(&cfg->stats, dropped);
1592 		return (NAT64MFREE);
1593 	}
1594 
1595 	if (*V_nat64ip6stealth == 0 && ip6->ip6_hlim <= IPV6_HLIMDEC) {
1596 		nat64_icmp6_reflect(m, ICMP6_TIME_EXCEEDED,
1597 		    ICMP6_TIME_EXCEED_TRANSIT, 0, &cfg->stats, logdata);
1598 		return (NAT64RETURN);
1599 	}
1600 
1601 	hlen = 0;
1602 	plen = ntohs(ip6->ip6_plen);
1603 	proto = nat64_getlasthdr(m, &hlen);
1604 	if (proto < 0) {
1605 		DPRINTF(DP_DROPS, "dropped due to mbuf isn't contigious");
1606 		NAT64STAT_INC(&cfg->stats, dropped);
1607 		return (NAT64MFREE);
1608 	}
1609 	frag = NULL;
1610 	if (proto == IPPROTO_FRAGMENT) {
1611 		/* ipfw_chk should m_pullup up to frag header */
1612 		if (m->m_len < hlen + sizeof(*frag)) {
1613 			DPRINTF(DP_DROPS,
1614 			    "dropped due to mbuf isn't contigious");
1615 			NAT64STAT_INC(&cfg->stats, dropped);
1616 			return (NAT64MFREE);
1617 		}
1618 		frag = mtodo(m, hlen);
1619 		proto = frag->ip6f_nxt;
1620 		hlen += sizeof(*frag);
1621 		/* Fragmented ICMPv6 is unsupported */
1622 		if (proto == IPPROTO_ICMPV6) {
1623 			DPRINTF(DP_DROPS, "dropped due to fragmented ICMPv6");
1624 			NAT64STAT_INC(&cfg->stats, dropped);
1625 			return (NAT64MFREE);
1626 		}
1627 		/* Fragment length must be multiple of 8 octets */
1628 		if ((frag->ip6f_offlg & IP6F_MORE_FRAG) != 0 &&
1629 		    ((plen + sizeof(struct ip6_hdr) - hlen) & 0x7) != 0) {
1630 			nat64_icmp6_reflect(m, ICMP6_PARAM_PROB,
1631 			    ICMP6_PARAMPROB_HEADER,
1632 			    offsetof(struct ip6_hdr, ip6_plen), &cfg->stats,
1633 			    logdata);
1634 			return (NAT64RETURN);
1635 		}
1636 	}
1637 	plen -= hlen - sizeof(struct ip6_hdr);
1638 	if (plen < 0 || m->m_pkthdr.len < plen + hlen) {
1639 		DPRINTF(DP_DROPS, "plen %d, pkthdr.len %d, hlen %d",
1640 		    plen, m->m_pkthdr.len, hlen);
1641 		NAT64STAT_INC(&cfg->stats, dropped);
1642 		return (NAT64MFREE);
1643 	}
1644 
1645 	icmp6 = NULL;	/* Make gcc happy */
1646 	if (proto == IPPROTO_ICMPV6) {
1647 		icmp6 = mtodo(m, hlen);
1648 		if (icmp6->icmp6_type != ICMP6_ECHO_REQUEST &&
1649 		    icmp6->icmp6_type != ICMP6_ECHO_REPLY)
1650 			return (nat64_handle_icmp6(m, hlen, aaddr, aport,
1651 			    cfg, logdata));
1652 	}
1653 	dst.sin_addr.s_addr = ip.ip_dst.s_addr;
1654 	nh = nat64_find_route4(&dst, m);
1655 	if (nh == NULL) {
1656 		NAT64STAT_INC(&cfg->stats, noroute4);
1657 		nat64_icmp6_reflect(m, ICMP6_DST_UNREACH,
1658 		    ICMP6_DST_UNREACH_NOROUTE, 0, &cfg->stats, logdata);
1659 		return (NAT64RETURN);
1660 	}
1661 	if (nh->nh_mtu < plen + sizeof(ip)) {
1662 		nat64_icmp6_reflect(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu,
1663 		    &cfg->stats, logdata);
1664 		return (NAT64RETURN);
1665 	}
1666 	nat64_init_ip4hdr(ip6, frag, plen, proto, &ip);
1667 
1668 	/* Handle delayed checksums if needed. */
1669 	if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6) {
1670 		in6_delayed_cksum(m, plen, hlen);
1671 		m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
1672 	}
1673 	/* Convert checksums. */
1674 	switch (proto) {
1675 	case IPPROTO_TCP:
1676 		csum = &TCP(mtodo(m, hlen))->th_sum;
1677 		if (aport != 0) {
1678 			struct tcphdr *tcp = TCP(mtodo(m, hlen));
1679 			*csum = cksum_adjust(*csum, tcp->th_sport, aport);
1680 			tcp->th_sport = aport;
1681 		}
1682 		*csum = cksum_add(*csum, nat64_cksum_convert(ip6, &ip));
1683 		break;
1684 	case IPPROTO_UDP:
1685 		csum = &UDP(mtodo(m, hlen))->uh_sum;
1686 		if (aport != 0) {
1687 			struct udphdr *udp = UDP(mtodo(m, hlen));
1688 			*csum = cksum_adjust(*csum, udp->uh_sport, aport);
1689 			udp->uh_sport = aport;
1690 		}
1691 		*csum = cksum_add(*csum, nat64_cksum_convert(ip6, &ip));
1692 		break;
1693 	case IPPROTO_ICMPV6:
1694 		/* Checksum in ICMPv6 covers pseudo header */
1695 		csum = &icmp6->icmp6_cksum;
1696 		*csum = cksum_add(*csum, in6_cksum_pseudo(ip6, plen,
1697 		    IPPROTO_ICMPV6, 0));
1698 		/* Convert ICMPv6 types to ICMP */
1699 		proto = *(uint16_t *)icmp6; /* save old word for cksum_adjust */
1700 		if (icmp6->icmp6_type == ICMP6_ECHO_REQUEST)
1701 			icmp6->icmp6_type = ICMP_ECHO;
1702 		else /* ICMP6_ECHO_REPLY */
1703 			icmp6->icmp6_type = ICMP_ECHOREPLY;
1704 		*csum = cksum_adjust(*csum, (uint16_t)proto,
1705 		    *(uint16_t *)icmp6);
1706 		if (aport != 0) {
1707 			uint16_t old_id = icmp6->icmp6_id;
1708 			icmp6->icmp6_id = aport;
1709 			*csum = cksum_adjust(*csum, old_id, aport);
1710 		}
1711 		break;
1712 	};
1713 
1714 	m_adj(m, hlen - sizeof(ip));
1715 	bcopy(&ip, mtod(m, void *), sizeof(ip));
1716 	if (V_nat64out->output(nh->nh_ifp, m, (struct sockaddr *)&dst,
1717 	    &cfg->stats, logdata) == 0)
1718 		NAT64STAT_INC(&cfg->stats, opcnt64);
1719 	return (NAT64RETURN);
1720 }
1721