xref: /freebsd-14-stable/sys/netpfil/pf/pf_lb.c (revision 0e290388cb17b76d3e79ee5f405405bf0a1169ee)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2001 Daniel Hartmeier
5  * Copyright (c) 2002 - 2008 Henning Brauer
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  *    - Redistributions of source code must retain the above copyright
13  *      notice, this list of conditions and the following disclaimer.
14  *    - Redistributions in binary form must reproduce the above
15  *      copyright notice, this list of conditions and the following
16  *      disclaimer in the documentation and/or other materials provided
17  *      with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  *
32  * Effort sponsored in part by the Defense Advanced Research Projects
33  * Agency (DARPA) and Air Force Research Laboratory, Air Force
34  * Materiel Command, USAF, under agreement number F30602-01-2-0537.
35  *
36  *	$OpenBSD: pf_lb.c,v 1.2 2009/02/12 02:13:15 sthen Exp $
37  */
38 
39 #include <sys/cdefs.h>
40 #include "opt_pf.h"
41 #include "opt_inet.h"
42 #include "opt_inet6.h"
43 
44 #include <sys/param.h>
45 #include <sys/lock.h>
46 #include <sys/mbuf.h>
47 #include <sys/socket.h>
48 #include <sys/sysctl.h>
49 
50 #include <net/if.h>
51 #include <net/vnet.h>
52 #include <net/pfvar.h>
53 #include <net/if_pflog.h>
54 
55 /*
56  * Limit the amount of work we do to find a free source port for redirects that
57  * introduce a state conflict.
58  */
59 #define	V_pf_rdr_srcport_rewrite_tries	VNET(pf_rdr_srcport_rewrite_tries)
60 VNET_DEFINE_STATIC(int, pf_rdr_srcport_rewrite_tries) = 16;
61 
62 #define DPFPRINTF(n, x)	if (V_pf_status.debug >= (n)) printf x
63 
64 static void		 pf_hash(struct pf_addr *, struct pf_addr *,
65 			    struct pf_poolhashkey *, sa_family_t);
66 static struct pf_krule	*pf_match_translation(struct pf_pdesc *, struct mbuf *,
67 			    int, struct pfi_kkif *,
68 			    struct pf_addr *, u_int16_t, struct pf_addr *,
69 			    uint16_t, int, struct pf_kanchor_stackframe *);
70 static int pf_get_sport(sa_family_t, uint8_t, struct pf_krule *,
71     struct pf_addr *, uint16_t, struct pf_addr *, uint16_t, struct pf_addr *,
72     uint16_t *, uint16_t, uint16_t, struct pf_ksrc_node **);
73 
74 #define mix(a,b,c) \
75 	do {					\
76 		a -= b; a -= c; a ^= (c >> 13);	\
77 		b -= c; b -= a; b ^= (a << 8);	\
78 		c -= a; c -= b; c ^= (b >> 13);	\
79 		a -= b; a -= c; a ^= (c >> 12);	\
80 		b -= c; b -= a; b ^= (a << 16);	\
81 		c -= a; c -= b; c ^= (b >> 5);	\
82 		a -= b; a -= c; a ^= (c >> 3);	\
83 		b -= c; b -= a; b ^= (a << 10);	\
84 		c -= a; c -= b; c ^= (b >> 15);	\
85 	} while (0)
86 
87 /*
88  * hash function based on bridge_hash in if_bridge.c
89  */
90 static void
pf_hash(struct pf_addr * inaddr,struct pf_addr * hash,struct pf_poolhashkey * key,sa_family_t af)91 pf_hash(struct pf_addr *inaddr, struct pf_addr *hash,
92     struct pf_poolhashkey *key, sa_family_t af)
93 {
94 	u_int32_t	a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0];
95 
96 	switch (af) {
97 #ifdef INET
98 	case AF_INET:
99 		a += inaddr->addr32[0];
100 		b += key->key32[1];
101 		mix(a, b, c);
102 		hash->addr32[0] = c + key->key32[2];
103 		break;
104 #endif /* INET */
105 #ifdef INET6
106 	case AF_INET6:
107 		a += inaddr->addr32[0];
108 		b += inaddr->addr32[2];
109 		mix(a, b, c);
110 		hash->addr32[0] = c;
111 		a += inaddr->addr32[1];
112 		b += inaddr->addr32[3];
113 		c += key->key32[1];
114 		mix(a, b, c);
115 		hash->addr32[1] = c;
116 		a += inaddr->addr32[2];
117 		b += inaddr->addr32[1];
118 		c += key->key32[2];
119 		mix(a, b, c);
120 		hash->addr32[2] = c;
121 		a += inaddr->addr32[3];
122 		b += inaddr->addr32[0];
123 		c += key->key32[3];
124 		mix(a, b, c);
125 		hash->addr32[3] = c;
126 		break;
127 #endif /* INET6 */
128 	}
129 }
130 
131 static struct pf_krule *
pf_match_translation(struct pf_pdesc * pd,struct mbuf * m,int off,struct pfi_kkif * kif,struct pf_addr * saddr,u_int16_t sport,struct pf_addr * daddr,uint16_t dport,int rs_num,struct pf_kanchor_stackframe * anchor_stack)132 pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
133     struct pfi_kkif *kif, struct pf_addr *saddr, u_int16_t sport,
134     struct pf_addr *daddr, uint16_t dport, int rs_num,
135     struct pf_kanchor_stackframe *anchor_stack)
136 {
137 	struct pf_krule		*r, *rm = NULL;
138 	struct pf_kruleset	*ruleset = NULL;
139 	int			 tag = -1;
140 	int			 rtableid = -1;
141 	int			 asd = 0;
142 
143 	r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr);
144 	while (r != NULL) {
145 		struct pf_rule_addr	*src = NULL, *dst = NULL;
146 		struct pf_addr_wrap	*xdst = NULL;
147 
148 		if (r->action == PF_BINAT && pd->dir == PF_IN) {
149 			src = &r->dst;
150 			if (r->rpool.cur != NULL)
151 				xdst = &r->rpool.cur->addr;
152 		} else {
153 			src = &r->src;
154 			dst = &r->dst;
155 		}
156 
157 		pf_counter_u64_add(&r->evaluations, 1);
158 		if (pfi_kkif_match(r->kif, kif) == r->ifnot)
159 			r = r->skip[PF_SKIP_IFP].ptr;
160 		else if (r->direction && r->direction != pd->dir)
161 			r = r->skip[PF_SKIP_DIR].ptr;
162 		else if (r->af && r->af != pd->af)
163 			r = r->skip[PF_SKIP_AF].ptr;
164 		else if (r->proto && r->proto != pd->proto)
165 			r = r->skip[PF_SKIP_PROTO].ptr;
166 		else if (PF_MISMATCHAW(&src->addr, saddr, pd->af,
167 		    src->neg, kif, M_GETFIB(m)))
168 			r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR :
169 			    PF_SKIP_DST_ADDR].ptr;
170 		else if (src->port_op && !pf_match_port(src->port_op,
171 		    src->port[0], src->port[1], sport))
172 			r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT :
173 			    PF_SKIP_DST_PORT].ptr;
174 		else if (dst != NULL &&
175 		    PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->neg, NULL,
176 		    M_GETFIB(m)))
177 			r = r->skip[PF_SKIP_DST_ADDR].ptr;
178 		else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af,
179 		    0, NULL, M_GETFIB(m)))
180 			r = TAILQ_NEXT(r, entries);
181 		else if (dst != NULL && dst->port_op &&
182 		    !pf_match_port(dst->port_op, dst->port[0],
183 		    dst->port[1], dport))
184 			r = r->skip[PF_SKIP_DST_PORT].ptr;
185 		else if (r->match_tag && !pf_match_tag(m, r, &tag,
186 		    pd->pf_mtag ? pd->pf_mtag->tag : 0))
187 			r = TAILQ_NEXT(r, entries);
188 		else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto !=
189 		    IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m,
190 		    off, &pd->hdr.tcp), r->os_fingerprint)))
191 			r = TAILQ_NEXT(r, entries);
192 		else {
193 			if (r->tag)
194 				tag = r->tag;
195 			if (r->rtableid >= 0)
196 				rtableid = r->rtableid;
197 			if (r->anchor == NULL) {
198 				rm = r;
199 				if (rm->action == PF_NONAT ||
200 				    rm->action == PF_NORDR ||
201 				    rm->action == PF_NOBINAT) {
202 					rm = NULL;
203 				}
204 				break;
205 			} else
206 				pf_step_into_anchor(anchor_stack, &asd,
207 				    &ruleset, rs_num, &r, NULL, NULL);
208 		}
209 		if (r == NULL)
210 			pf_step_out_of_anchor(anchor_stack, &asd, &ruleset,
211 			    rs_num, &r, NULL, NULL);
212 	}
213 
214 	if (tag > 0 && pf_tag_packet(m, pd, tag))
215 		return (NULL);
216 	if (rtableid >= 0)
217 		M_SETFIB(m, rtableid);
218 
219 	return (rm);
220 }
221 
222 static int
pf_get_sport(sa_family_t af,u_int8_t proto,struct pf_krule * r,struct pf_addr * saddr,uint16_t sport,struct pf_addr * daddr,uint16_t dport,struct pf_addr * naddr,uint16_t * nport,uint16_t low,uint16_t high,struct pf_ksrc_node ** sn)223 pf_get_sport(sa_family_t af, u_int8_t proto, struct pf_krule *r,
224     struct pf_addr *saddr, uint16_t sport, struct pf_addr *daddr,
225     uint16_t dport, struct pf_addr *naddr, uint16_t *nport, uint16_t low,
226     uint16_t high, struct pf_ksrc_node **sn)
227 {
228 	struct pf_state_key_cmp	key;
229 	struct pf_addr		init_addr;
230 
231 	bzero(&init_addr, sizeof(init_addr));
232 	if (pf_map_addr(af, r, saddr, naddr, NULL, &init_addr, sn))
233 		return (1);
234 
235 	if (proto == IPPROTO_ICMP) {
236 		if (*nport == htons(ICMP_ECHO)) {
237 			low = 1;
238 			high = 65535;
239 		} else
240 			return (0);	/* Don't try to modify non-echo ICMP */
241 	}
242 #ifdef INET6
243 	if (proto == IPPROTO_ICMPV6) {
244 		if (*nport == htons(ICMP6_ECHO_REQUEST)) {
245 			low = 1;
246 			high = 65535;
247 		} else
248 			return (0);	/* Don't try to modify non-echo ICMP */
249 	}
250 #endif /* INET6 */
251 
252 	bzero(&key, sizeof(key));
253 	key.af = af;
254 	key.proto = proto;
255 	key.port[0] = dport;
256 	PF_ACPY(&key.addr[0], daddr, key.af);
257 
258 	do {
259 		PF_ACPY(&key.addr[1], naddr, key.af);
260 
261 		/*
262 		 * port search; start random, step;
263 		 * similar 2 portloop in in_pcbbind
264 		 */
265 		if (proto == IPPROTO_SCTP) {
266 			key.port[1] = sport;
267 			if (!pf_find_state_all_exists(&key, PF_IN)) {
268 				*nport = sport;
269 				return (0);
270 			} else {
271 				return (1); /* Fail mapping. */
272 			}
273 		} else if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP ||
274 		    proto == IPPROTO_ICMP) || (low == 0 && high == 0)) {
275 			/*
276 			 * XXX bug: icmp states don't use the id on both sides.
277 			 * (traceroute -I through nat)
278 			 */
279 			key.port[1] = sport;
280 			if (!pf_find_state_all_exists(&key, PF_IN)) {
281 				*nport = sport;
282 				return (0);
283 			}
284 		} else if (low == high) {
285 			key.port[1] = htons(low);
286 			if (!pf_find_state_all_exists(&key, PF_IN)) {
287 				*nport = htons(low);
288 				return (0);
289 			}
290 		} else {
291 			uint32_t tmp;
292 			uint16_t cut;
293 
294 			if (low > high) {
295 				tmp = low;
296 				low = high;
297 				high = tmp;
298 			}
299 			/* low < high */
300 			cut = arc4random() % (1 + high - low) + low;
301 			/* low <= cut <= high */
302 			for (tmp = cut; tmp <= high && tmp <= 0xffff; ++tmp) {
303 				key.port[1] = htons(tmp);
304 				if (!pf_find_state_all_exists(&key, PF_IN)) {
305 					*nport = htons(tmp);
306 					return (0);
307 				}
308 			}
309 			tmp = cut;
310 			for (tmp -= 1; tmp >= low && tmp <= 0xffff; --tmp) {
311 				key.port[1] = htons(tmp);
312 				if (!pf_find_state_all_exists(&key, PF_IN)) {
313 					*nport = htons(tmp);
314 					return (0);
315 				}
316 			}
317 		}
318 
319 		switch (r->rpool.opts & PF_POOL_TYPEMASK) {
320 		case PF_POOL_RANDOM:
321 		case PF_POOL_ROUNDROBIN:
322 			/*
323 			 * pick a different source address since we're out
324 			 * of free port choices for the current one.
325 			 */
326 			if (pf_map_addr(af, r, saddr, naddr, NULL, &init_addr, sn))
327 				return (1);
328 			break;
329 		case PF_POOL_NONE:
330 		case PF_POOL_SRCHASH:
331 		case PF_POOL_BITMASK:
332 		default:
333 			return (1);
334 		}
335 	} while (! PF_AEQ(&init_addr, naddr, af) );
336 	return (1);					/* none available */
337 }
338 
339 static int
pf_get_mape_sport(sa_family_t af,u_int8_t proto,struct pf_krule * r,struct pf_addr * saddr,uint16_t sport,struct pf_addr * daddr,uint16_t dport,struct pf_addr * naddr,uint16_t * nport,struct pf_ksrc_node ** sn)340 pf_get_mape_sport(sa_family_t af, u_int8_t proto, struct pf_krule *r,
341     struct pf_addr *saddr, uint16_t sport, struct pf_addr *daddr,
342     uint16_t dport, struct pf_addr *naddr, uint16_t *nport,
343     struct pf_ksrc_node **sn)
344 {
345 	uint16_t psmask, low, highmask;
346 	uint16_t i, ahigh, cut;
347 	int ashift, psidshift;
348 
349 	ashift = 16 - r->rpool.mape.offset;
350 	psidshift = ashift - r->rpool.mape.psidlen;
351 	psmask = r->rpool.mape.psid & ((1U << r->rpool.mape.psidlen) - 1);
352 	psmask = psmask << psidshift;
353 	highmask = (1U << psidshift) - 1;
354 
355 	ahigh = (1U << r->rpool.mape.offset) - 1;
356 	cut = arc4random() & ahigh;
357 	if (cut == 0)
358 		cut = 1;
359 
360 	for (i = cut; i <= ahigh; i++) {
361 		low = (i << ashift) | psmask;
362 		if (!pf_get_sport(af, proto, r, saddr, sport, daddr, dport,
363 		    naddr, nport, low, low | highmask, sn))
364 			return (0);
365 	}
366 	for (i = cut - 1; i > 0; i--) {
367 		low = (i << ashift) | psmask;
368 		if (!pf_get_sport(af, proto, r, saddr, sport, daddr, dport,
369 		    naddr, nport, low, low | highmask, sn))
370 			return (0);
371 	}
372 	return (1);
373 }
374 
375 u_short
pf_map_addr(sa_family_t af,struct pf_krule * r,struct pf_addr * saddr,struct pf_addr * naddr,struct pfi_kkif ** nkif,struct pf_addr * init_addr,struct pf_ksrc_node ** sn)376 pf_map_addr(sa_family_t af, struct pf_krule *r, struct pf_addr *saddr,
377     struct pf_addr *naddr, struct pfi_kkif **nkif, struct pf_addr *init_addr,
378     struct pf_ksrc_node **sn)
379 {
380 	u_short			 reason = PFRES_MATCH;
381 	struct pf_kpool		*rpool = &r->rpool;
382 	struct pf_addr		*raddr = NULL, *rmask = NULL;
383 	struct pf_srchash	*sh = NULL;
384 
385 	/* Try to find a src_node if none was given and this
386 	   is a sticky-address rule. */
387 	if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR &&
388 	    (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE)
389 		*sn = pf_find_src_node(saddr, r, af, &sh, false);
390 
391 	/* If a src_node was found or explicitly given and it has a non-zero
392 	   route address, use this address. A zeroed address is found if the
393 	   src node was created just a moment ago in pf_create_state and it
394 	   needs to be filled in with routing decision calculated here. */
395 	if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, af)) {
396 		/* If the supplied address is the same as the current one we've
397 		 * been asked before, so tell the caller that there's no other
398 		 * address to be had. */
399 		if (PF_AEQ(naddr, &(*sn)->raddr, af)) {
400 			reason = PFRES_MAPFAILED;
401 			goto done;
402 		}
403 
404 		PF_ACPY(naddr, &(*sn)->raddr, af);
405 		if (nkif)
406 			*nkif = (*sn)->rkif;
407 		if (V_pf_status.debug >= PF_DEBUG_NOISY) {
408 			printf("pf_map_addr: src tracking maps ");
409 			pf_print_host(saddr, 0, af);
410 			printf(" to ");
411 			pf_print_host(naddr, 0, af);
412 			if (nkif)
413 				printf("@%s", (*nkif)->pfik_name);
414 			printf("\n");
415 		}
416 		goto done;
417 	}
418 
419 	mtx_lock(&rpool->mtx);
420 	/* Find the route using chosen algorithm. Store the found route
421 	   in src_node if it was given or found. */
422 	if (rpool->cur->addr.type == PF_ADDR_NOROUTE) {
423 		reason = PFRES_MAPFAILED;
424 		goto done_pool_mtx;
425 	}
426 	if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
427 		switch (af) {
428 #ifdef INET
429 		case AF_INET:
430 			if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 &&
431 			    (rpool->opts & PF_POOL_TYPEMASK) !=
432 			    PF_POOL_ROUNDROBIN) {
433 				reason = PFRES_MAPFAILED;
434 				goto done_pool_mtx;
435 			}
436 			raddr = &rpool->cur->addr.p.dyn->pfid_addr4;
437 			rmask = &rpool->cur->addr.p.dyn->pfid_mask4;
438 			break;
439 #endif /* INET */
440 #ifdef INET6
441 		case AF_INET6:
442 			if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 &&
443 			    (rpool->opts & PF_POOL_TYPEMASK) !=
444 			    PF_POOL_ROUNDROBIN) {
445 				reason = PFRES_MAPFAILED;
446 				goto done_pool_mtx;
447 			}
448 			raddr = &rpool->cur->addr.p.dyn->pfid_addr6;
449 			rmask = &rpool->cur->addr.p.dyn->pfid_mask6;
450 			break;
451 #endif /* INET6 */
452 		}
453 	} else if (rpool->cur->addr.type == PF_ADDR_TABLE) {
454 		if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN) {
455 			reason = PFRES_MAPFAILED;
456 			goto done_pool_mtx; /* unsupported */
457 		}
458 	} else {
459 		raddr = &rpool->cur->addr.v.a.addr;
460 		rmask = &rpool->cur->addr.v.a.mask;
461 	}
462 
463 	switch (rpool->opts & PF_POOL_TYPEMASK) {
464 	case PF_POOL_NONE:
465 		PF_ACPY(naddr, raddr, af);
466 		break;
467 	case PF_POOL_BITMASK:
468 		PF_POOLMASK(naddr, raddr, rmask, saddr, af);
469 		break;
470 	case PF_POOL_RANDOM:
471 		if (init_addr != NULL && PF_AZERO(init_addr, af)) {
472 			switch (af) {
473 #ifdef INET
474 			case AF_INET:
475 				rpool->counter.addr32[0] = htonl(arc4random());
476 				break;
477 #endif /* INET */
478 #ifdef INET6
479 			case AF_INET6:
480 				if (rmask->addr32[3] != 0xffffffff)
481 					rpool->counter.addr32[3] =
482 					    htonl(arc4random());
483 				else
484 					break;
485 				if (rmask->addr32[2] != 0xffffffff)
486 					rpool->counter.addr32[2] =
487 					    htonl(arc4random());
488 				else
489 					break;
490 				if (rmask->addr32[1] != 0xffffffff)
491 					rpool->counter.addr32[1] =
492 					    htonl(arc4random());
493 				else
494 					break;
495 				if (rmask->addr32[0] != 0xffffffff)
496 					rpool->counter.addr32[0] =
497 					    htonl(arc4random());
498 				break;
499 #endif /* INET6 */
500 			}
501 			PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
502 			PF_ACPY(init_addr, naddr, af);
503 
504 		} else {
505 			PF_AINC(&rpool->counter, af);
506 			PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
507 		}
508 		break;
509 	case PF_POOL_SRCHASH:
510 	    {
511 		unsigned char hash[16];
512 
513 		pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, af);
514 		PF_POOLMASK(naddr, raddr, rmask, (struct pf_addr *)&hash, af);
515 		break;
516 	    }
517 	case PF_POOL_ROUNDROBIN:
518 	    {
519 		struct pf_kpooladdr *acur = rpool->cur;
520 
521 		if (rpool->cur->addr.type == PF_ADDR_TABLE) {
522 			if (!pfr_pool_get(rpool->cur->addr.p.tbl,
523 			    &rpool->tblidx, &rpool->counter, af))
524 				goto get_addr;
525 		} else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
526 			if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
527 			    &rpool->tblidx, &rpool->counter, af))
528 				goto get_addr;
529 		} else if (pf_match_addr(0, raddr, rmask, &rpool->counter, af))
530 			goto get_addr;
531 
532 	try_next:
533 		if (TAILQ_NEXT(rpool->cur, entries) == NULL)
534 			rpool->cur = TAILQ_FIRST(&rpool->list);
535 		else
536 			rpool->cur = TAILQ_NEXT(rpool->cur, entries);
537 		if (rpool->cur->addr.type == PF_ADDR_TABLE) {
538 			rpool->tblidx = -1;
539 			if (pfr_pool_get(rpool->cur->addr.p.tbl,
540 			    &rpool->tblidx, &rpool->counter, af)) {
541 				/* table contains no address of type 'af' */
542 				if (rpool->cur != acur)
543 					goto try_next;
544 				reason = PFRES_MAPFAILED;
545 				goto done_pool_mtx;
546 			}
547 		} else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
548 			rpool->tblidx = -1;
549 			if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
550 			    &rpool->tblidx, &rpool->counter, af)) {
551 				/* table contains no address of type 'af' */
552 				if (rpool->cur != acur)
553 					goto try_next;
554 				reason = PFRES_MAPFAILED;
555 				goto done_pool_mtx;
556 			}
557 		} else {
558 			raddr = &rpool->cur->addr.v.a.addr;
559 			rmask = &rpool->cur->addr.v.a.mask;
560 			PF_ACPY(&rpool->counter, raddr, af);
561 		}
562 
563 	get_addr:
564 		PF_ACPY(naddr, &rpool->counter, af);
565 		if (init_addr != NULL && PF_AZERO(init_addr, af))
566 			PF_ACPY(init_addr, naddr, af);
567 		PF_AINC(&rpool->counter, af);
568 		break;
569 	    }
570 	}
571 
572 	if (nkif)
573 		*nkif = rpool->cur->kif;
574 
575 	if (*sn != NULL) {
576 		PF_ACPY(&(*sn)->raddr, naddr, af);
577 		if (nkif)
578 			(*sn)->rkif = *nkif;
579 	}
580 
581 	if (V_pf_status.debug >= PF_DEBUG_NOISY &&
582 	    (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
583 		printf("pf_map_addr: selected address ");
584 		pf_print_host(naddr, 0, af);
585 		if (nkif)
586 			printf("@%s", (*nkif)->pfik_name);
587 		printf("\n");
588 	}
589 
590 done_pool_mtx:
591 	mtx_unlock(&rpool->mtx);
592 
593 done:
594 	if (reason) {
595 		counter_u64_add(V_pf_status.counters[reason], 1);
596 	}
597 
598 	return (reason);
599 }
600 
601 u_short
pf_get_translation(struct pf_pdesc * pd,struct mbuf * m,int off,struct pfi_kkif * kif,struct pf_ksrc_node ** sn,struct pf_state_key ** skp,struct pf_state_key ** nkp,struct pf_addr * saddr,struct pf_addr * daddr,uint16_t sport,uint16_t dport,struct pf_kanchor_stackframe * anchor_stack,struct pf_krule ** rp)602 pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
603     struct pfi_kkif *kif, struct pf_ksrc_node **sn,
604     struct pf_state_key **skp, struct pf_state_key **nkp,
605     struct pf_addr *saddr, struct pf_addr *daddr,
606     uint16_t sport, uint16_t dport, struct pf_kanchor_stackframe *anchor_stack,
607     struct pf_krule **rp)
608 {
609 	struct pf_krule	*r = NULL;
610 	struct pf_addr	*naddr;
611 	uint16_t	*nportp;
612 	uint16_t	 low, high;
613 	u_short		 reason;
614 
615 	PF_RULES_RASSERT();
616 	KASSERT(*skp == NULL, ("*skp not NULL"));
617 	KASSERT(*nkp == NULL, ("*nkp not NULL"));
618 
619 	*rp = NULL;
620 
621 	if (pd->dir == PF_OUT) {
622 		r = pf_match_translation(pd, m, off, kif, saddr,
623 		    sport, daddr, dport, PF_RULESET_BINAT, anchor_stack);
624 		if (r == NULL)
625 			r = pf_match_translation(pd, m, off, kif,
626 			    saddr, sport, daddr, dport, PF_RULESET_NAT,
627 			    anchor_stack);
628 	} else {
629 		r = pf_match_translation(pd, m, off, kif, saddr,
630 		    sport, daddr, dport, PF_RULESET_RDR, anchor_stack);
631 		if (r == NULL)
632 			r = pf_match_translation(pd, m, off, kif,
633 			    saddr, sport, daddr, dport, PF_RULESET_BINAT,
634 			    anchor_stack);
635 	}
636 
637 	if (r == NULL)
638 		return (PFRES_MAX);
639 
640 	switch (r->action) {
641 	case PF_NONAT:
642 	case PF_NOBINAT:
643 	case PF_NORDR:
644 		return (PFRES_MAX);
645 	}
646 
647 	*skp = pf_state_key_setup(pd, m, off, saddr, daddr, sport, dport);
648 	if (*skp == NULL)
649 		return (PFRES_MEMORY);
650 	*nkp = pf_state_key_clone(*skp);
651 	if (*nkp == NULL) {
652 		uma_zfree(V_pf_state_key_z, *skp);
653 		*skp = NULL;
654 		return (PFRES_MEMORY);
655 	}
656 
657 	naddr = &(*nkp)->addr[1];
658 	nportp = &(*nkp)->port[1];
659 
660 	switch (r->action) {
661 	case PF_NAT:
662 		if (pd->proto == IPPROTO_ICMP) {
663 			low = 1;
664 			high = 65535;
665 		} else {
666 			low  = r->rpool.proxy_port[0];
667 			high = r->rpool.proxy_port[1];
668 		}
669 		if (r->rpool.mape.offset > 0) {
670 			if (pf_get_mape_sport(pd->af, pd->proto, r, saddr,
671 			    sport, daddr, dport, naddr, nportp, sn)) {
672 				DPFPRINTF(PF_DEBUG_MISC,
673 				    ("pf: MAP-E port allocation (%u/%u/%u)"
674 				    " failed\n",
675 				    r->rpool.mape.offset,
676 				    r->rpool.mape.psidlen,
677 				    r->rpool.mape.psid));
678 				reason = PFRES_MAPFAILED;
679 				goto notrans;
680 			}
681 		} else if (pf_get_sport(pd->af, pd->proto, r, saddr, sport,
682 		    daddr, dport, naddr, nportp, low, high, sn)) {
683 			DPFPRINTF(PF_DEBUG_MISC,
684 			    ("pf: NAT proxy port allocation (%u-%u) failed\n",
685 			    r->rpool.proxy_port[0], r->rpool.proxy_port[1]));
686 			reason = PFRES_MAPFAILED;
687 			goto notrans;
688 		}
689 		break;
690 	case PF_BINAT:
691 		switch (pd->dir) {
692 		case PF_OUT:
693 			if (r->rpool.cur->addr.type == PF_ADDR_DYNIFTL){
694 				switch (pd->af) {
695 #ifdef INET
696 				case AF_INET:
697 					if (r->rpool.cur->addr.p.dyn->
698 					    pfid_acnt4 < 1) {
699 						reason = PFRES_MAPFAILED;
700 						goto notrans;
701 					}
702 					PF_POOLMASK(naddr,
703 					    &r->rpool.cur->addr.p.dyn->
704 					    pfid_addr4,
705 					    &r->rpool.cur->addr.p.dyn->
706 					    pfid_mask4, saddr, AF_INET);
707 					break;
708 #endif /* INET */
709 #ifdef INET6
710 				case AF_INET6:
711 					if (r->rpool.cur->addr.p.dyn->
712 					    pfid_acnt6 < 1) {
713 						reason = PFRES_MAPFAILED;
714 						goto notrans;
715 					}
716 					PF_POOLMASK(naddr,
717 					    &r->rpool.cur->addr.p.dyn->
718 					    pfid_addr6,
719 					    &r->rpool.cur->addr.p.dyn->
720 					    pfid_mask6, saddr, AF_INET6);
721 					break;
722 #endif /* INET6 */
723 				}
724 			} else
725 				PF_POOLMASK(naddr,
726 				    &r->rpool.cur->addr.v.a.addr,
727 				    &r->rpool.cur->addr.v.a.mask, saddr,
728 				    pd->af);
729 			break;
730 		case PF_IN:
731 			if (r->src.addr.type == PF_ADDR_DYNIFTL) {
732 				switch (pd->af) {
733 #ifdef INET
734 				case AF_INET:
735 					if (r->src.addr.p.dyn->pfid_acnt4 < 1) {
736 						reason = PFRES_MAPFAILED;
737 						goto notrans;
738 					}
739 					PF_POOLMASK(naddr,
740 					    &r->src.addr.p.dyn->pfid_addr4,
741 					    &r->src.addr.p.dyn->pfid_mask4,
742 					    daddr, AF_INET);
743 					break;
744 #endif /* INET */
745 #ifdef INET6
746 				case AF_INET6:
747 					if (r->src.addr.p.dyn->pfid_acnt6 < 1) {
748 						reason = PFRES_MAPFAILED;
749 						goto notrans;
750 					}
751 					PF_POOLMASK(naddr,
752 					    &r->src.addr.p.dyn->pfid_addr6,
753 					    &r->src.addr.p.dyn->pfid_mask6,
754 					    daddr, AF_INET6);
755 					break;
756 #endif /* INET6 */
757 				}
758 			} else
759 				PF_POOLMASK(naddr, &r->src.addr.v.a.addr,
760 				    &r->src.addr.v.a.mask, daddr, pd->af);
761 			break;
762 		}
763 		break;
764 	case PF_RDR: {
765 		struct pf_state_key_cmp key;
766 		int tries;
767 		uint16_t cut, low, high, nport;
768 
769 		reason = pf_map_addr(pd->af, r, saddr, naddr, NULL, NULL, sn);
770 		if (reason != 0)
771 			goto notrans;
772 		if ((r->rpool.opts & PF_POOL_TYPEMASK) == PF_POOL_BITMASK)
773 			PF_POOLMASK(naddr, naddr, &r->rpool.cur->addr.v.a.mask,
774 			    daddr, pd->af);
775 
776 		/* Do not change SCTP ports. */
777 		if (pd->proto == IPPROTO_SCTP)
778 			break;
779 
780 		if (r->rpool.proxy_port[1]) {
781 			uint32_t	tmp_nport;
782 
783 			tmp_nport = ((ntohs(dport) - ntohs(r->dst.port[0])) %
784 			    (r->rpool.proxy_port[1] - r->rpool.proxy_port[0] +
785 			    1)) + r->rpool.proxy_port[0];
786 
787 			/* Wrap around if necessary. */
788 			if (tmp_nport > 65535)
789 				tmp_nport -= 65535;
790 			nport = htons((uint16_t)tmp_nport);
791 		} else if (r->rpool.proxy_port[0])
792 			nport = htons(r->rpool.proxy_port[0]);
793 		else
794 			nport = dport;
795 
796 		/*
797 		 * Update the destination port.
798 		 */
799 		*nportp = nport;
800 
801 		/*
802 		 * Do we have a source port conflict in the stack state?  Try to
803 		 * modulate the source port if so.  Note that this is racy since
804 		 * the state lookup may not find any matches here but will once
805 		 * pf_create_state() actually instantiates the state.
806 		 */
807 		bzero(&key, sizeof(key));
808 		key.af = pd->af;
809 		key.proto = pd->proto;
810 		key.port[0] = sport;
811 		PF_ACPY(&key.addr[0], saddr, key.af);
812 		key.port[1] = nport;
813 		PF_ACPY(&key.addr[1], naddr, key.af);
814 
815 		if (!pf_find_state_all_exists(&key, PF_OUT))
816 			break;
817 
818 		tries = 0;
819 
820 		low = 50001;	/* XXX-MJ PF_NAT_PROXY_PORT_LOW/HIGH */
821 		high = 65535;
822 		cut = arc4random() % (1 + high - low) + low;
823 		for (uint32_t tmp = cut;
824 		    tmp <= high && tmp <= UINT16_MAX &&
825 		    tries < V_pf_rdr_srcport_rewrite_tries;
826 		    tmp++, tries++) {
827 			key.port[0] = htons(tmp);
828 			if (!pf_find_state_all_exists(&key, PF_OUT)) {
829 				/* Update the source port. */
830 				(*nkp)->port[0] = htons(tmp);
831 				goto out;
832 			}
833 		}
834 		for (uint32_t tmp = cut - 1;
835 		    tmp >= low && tries < V_pf_rdr_srcport_rewrite_tries;
836 		    tmp--, tries++) {
837 			key.port[0] = htons(tmp);
838 			if (!pf_find_state_all_exists(&key, PF_OUT)) {
839 				/* Update the source port. */
840 				(*nkp)->port[0] = htons(tmp);
841 				goto out;
842 			}
843 		}
844 
845 		/*
846 		 * We failed to find a match.  Push on ahead anyway, let
847 		 * pf_state_insert() be the arbiter of whether the state
848 		 * conflict is tolerable.  In particular, with TCP connections
849 		 * the state may be reused if the TCP state is terminal.
850 		 */
851 		DPFPRINTF(PF_DEBUG_MISC,
852 		    ("pf: RDR source port allocation failed\n"));
853 		break;
854 
855 out:
856 		DPFPRINTF(PF_DEBUG_MISC,
857 		    ("pf: RDR source port allocation %u->%u\n",
858 		    ntohs(sport), ntohs((*nkp)->port[0])));
859 		break;
860 	}
861 	default:
862 		panic("%s: unknown action %u", __func__, r->action);
863 	}
864 
865 	/* Return success only if translation really happened. */
866 	if (bcmp(*skp, *nkp, sizeof(struct pf_state_key_cmp))) {
867 		*rp = r;
868 		return (PFRES_MATCH);
869 	}
870 
871 	reason = PFRES_MAX;
872 notrans:
873 	uma_zfree(V_pf_state_key_z, *nkp);
874 	uma_zfree(V_pf_state_key_z, *skp);
875 	*skp = *nkp = NULL;
876 	*sn = NULL;
877 
878 	return (reason);
879 }
880