1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2001 Daniel Hartmeier
5 * Copyright (c) 2002 - 2008 Henning Brauer
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * - Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * - Redistributions in binary form must reproduce the above
15 * copyright notice, this list of conditions and the following
16 * disclaimer in the documentation and/or other materials provided
17 * with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
22 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
23 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
24 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
25 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
29 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
31 *
32 * Effort sponsored in part by the Defense Advanced Research Projects
33 * Agency (DARPA) and Air Force Research Laboratory, Air Force
34 * Materiel Command, USAF, under agreement number F30602-01-2-0537.
35 *
36 * $OpenBSD: pf_lb.c,v 1.2 2009/02/12 02:13:15 sthen Exp $
37 */
38
39 #include <sys/cdefs.h>
40 #include "opt_pf.h"
41 #include "opt_inet.h"
42 #include "opt_inet6.h"
43
44 #include <sys/param.h>
45 #include <sys/lock.h>
46 #include <sys/mbuf.h>
47 #include <sys/socket.h>
48 #include <sys/sysctl.h>
49
50 #include <net/if.h>
51 #include <net/vnet.h>
52 #include <net/pfvar.h>
53 #include <net/if_pflog.h>
54
55 /*
56 * Limit the amount of work we do to find a free source port for redirects that
57 * introduce a state conflict.
58 */
59 #define V_pf_rdr_srcport_rewrite_tries VNET(pf_rdr_srcport_rewrite_tries)
60 VNET_DEFINE_STATIC(int, pf_rdr_srcport_rewrite_tries) = 16;
61
62 #define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x
63
64 static void pf_hash(struct pf_addr *, struct pf_addr *,
65 struct pf_poolhashkey *, sa_family_t);
66 static struct pf_krule *pf_match_translation(struct pf_pdesc *, struct mbuf *,
67 int, struct pfi_kkif *,
68 struct pf_addr *, u_int16_t, struct pf_addr *,
69 uint16_t, int, struct pf_kanchor_stackframe *);
70 static int pf_get_sport(sa_family_t, uint8_t, struct pf_krule *,
71 struct pf_addr *, uint16_t, struct pf_addr *, uint16_t, struct pf_addr *,
72 uint16_t *, uint16_t, uint16_t, struct pf_ksrc_node **);
73
74 #define mix(a,b,c) \
75 do { \
76 a -= b; a -= c; a ^= (c >> 13); \
77 b -= c; b -= a; b ^= (a << 8); \
78 c -= a; c -= b; c ^= (b >> 13); \
79 a -= b; a -= c; a ^= (c >> 12); \
80 b -= c; b -= a; b ^= (a << 16); \
81 c -= a; c -= b; c ^= (b >> 5); \
82 a -= b; a -= c; a ^= (c >> 3); \
83 b -= c; b -= a; b ^= (a << 10); \
84 c -= a; c -= b; c ^= (b >> 15); \
85 } while (0)
86
87 /*
88 * hash function based on bridge_hash in if_bridge.c
89 */
90 static void
pf_hash(struct pf_addr * inaddr,struct pf_addr * hash,struct pf_poolhashkey * key,sa_family_t af)91 pf_hash(struct pf_addr *inaddr, struct pf_addr *hash,
92 struct pf_poolhashkey *key, sa_family_t af)
93 {
94 u_int32_t a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0];
95
96 switch (af) {
97 #ifdef INET
98 case AF_INET:
99 a += inaddr->addr32[0];
100 b += key->key32[1];
101 mix(a, b, c);
102 hash->addr32[0] = c + key->key32[2];
103 break;
104 #endif /* INET */
105 #ifdef INET6
106 case AF_INET6:
107 a += inaddr->addr32[0];
108 b += inaddr->addr32[2];
109 mix(a, b, c);
110 hash->addr32[0] = c;
111 a += inaddr->addr32[1];
112 b += inaddr->addr32[3];
113 c += key->key32[1];
114 mix(a, b, c);
115 hash->addr32[1] = c;
116 a += inaddr->addr32[2];
117 b += inaddr->addr32[1];
118 c += key->key32[2];
119 mix(a, b, c);
120 hash->addr32[2] = c;
121 a += inaddr->addr32[3];
122 b += inaddr->addr32[0];
123 c += key->key32[3];
124 mix(a, b, c);
125 hash->addr32[3] = c;
126 break;
127 #endif /* INET6 */
128 }
129 }
130
131 static struct pf_krule *
pf_match_translation(struct pf_pdesc * pd,struct mbuf * m,int off,struct pfi_kkif * kif,struct pf_addr * saddr,u_int16_t sport,struct pf_addr * daddr,uint16_t dport,int rs_num,struct pf_kanchor_stackframe * anchor_stack)132 pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
133 struct pfi_kkif *kif, struct pf_addr *saddr, u_int16_t sport,
134 struct pf_addr *daddr, uint16_t dport, int rs_num,
135 struct pf_kanchor_stackframe *anchor_stack)
136 {
137 struct pf_krule *r, *rm = NULL;
138 struct pf_kruleset *ruleset = NULL;
139 int tag = -1;
140 int rtableid = -1;
141 int asd = 0;
142
143 r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr);
144 while (r != NULL) {
145 struct pf_rule_addr *src = NULL, *dst = NULL;
146 struct pf_addr_wrap *xdst = NULL;
147
148 if (r->action == PF_BINAT && pd->dir == PF_IN) {
149 src = &r->dst;
150 if (r->rpool.cur != NULL)
151 xdst = &r->rpool.cur->addr;
152 } else {
153 src = &r->src;
154 dst = &r->dst;
155 }
156
157 pf_counter_u64_add(&r->evaluations, 1);
158 if (pfi_kkif_match(r->kif, kif) == r->ifnot)
159 r = r->skip[PF_SKIP_IFP].ptr;
160 else if (r->direction && r->direction != pd->dir)
161 r = r->skip[PF_SKIP_DIR].ptr;
162 else if (r->af && r->af != pd->af)
163 r = r->skip[PF_SKIP_AF].ptr;
164 else if (r->proto && r->proto != pd->proto)
165 r = r->skip[PF_SKIP_PROTO].ptr;
166 else if (PF_MISMATCHAW(&src->addr, saddr, pd->af,
167 src->neg, kif, M_GETFIB(m)))
168 r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR :
169 PF_SKIP_DST_ADDR].ptr;
170 else if (src->port_op && !pf_match_port(src->port_op,
171 src->port[0], src->port[1], sport))
172 r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT :
173 PF_SKIP_DST_PORT].ptr;
174 else if (dst != NULL &&
175 PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->neg, NULL,
176 M_GETFIB(m)))
177 r = r->skip[PF_SKIP_DST_ADDR].ptr;
178 else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af,
179 0, NULL, M_GETFIB(m)))
180 r = TAILQ_NEXT(r, entries);
181 else if (dst != NULL && dst->port_op &&
182 !pf_match_port(dst->port_op, dst->port[0],
183 dst->port[1], dport))
184 r = r->skip[PF_SKIP_DST_PORT].ptr;
185 else if (r->match_tag && !pf_match_tag(m, r, &tag,
186 pd->pf_mtag ? pd->pf_mtag->tag : 0))
187 r = TAILQ_NEXT(r, entries);
188 else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto !=
189 IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m,
190 off, &pd->hdr.tcp), r->os_fingerprint)))
191 r = TAILQ_NEXT(r, entries);
192 else {
193 if (r->tag)
194 tag = r->tag;
195 if (r->rtableid >= 0)
196 rtableid = r->rtableid;
197 if (r->anchor == NULL) {
198 rm = r;
199 if (rm->action == PF_NONAT ||
200 rm->action == PF_NORDR ||
201 rm->action == PF_NOBINAT) {
202 rm = NULL;
203 }
204 break;
205 } else
206 pf_step_into_anchor(anchor_stack, &asd,
207 &ruleset, rs_num, &r, NULL, NULL);
208 }
209 if (r == NULL)
210 pf_step_out_of_anchor(anchor_stack, &asd, &ruleset,
211 rs_num, &r, NULL, NULL);
212 }
213
214 if (tag > 0 && pf_tag_packet(m, pd, tag))
215 return (NULL);
216 if (rtableid >= 0)
217 M_SETFIB(m, rtableid);
218
219 return (rm);
220 }
221
222 static int
pf_get_sport(sa_family_t af,u_int8_t proto,struct pf_krule * r,struct pf_addr * saddr,uint16_t sport,struct pf_addr * daddr,uint16_t dport,struct pf_addr * naddr,uint16_t * nport,uint16_t low,uint16_t high,struct pf_ksrc_node ** sn)223 pf_get_sport(sa_family_t af, u_int8_t proto, struct pf_krule *r,
224 struct pf_addr *saddr, uint16_t sport, struct pf_addr *daddr,
225 uint16_t dport, struct pf_addr *naddr, uint16_t *nport, uint16_t low,
226 uint16_t high, struct pf_ksrc_node **sn)
227 {
228 struct pf_state_key_cmp key;
229 struct pf_addr init_addr;
230
231 bzero(&init_addr, sizeof(init_addr));
232 if (pf_map_addr(af, r, saddr, naddr, NULL, &init_addr, sn))
233 return (1);
234
235 if (proto == IPPROTO_ICMP) {
236 if (*nport == htons(ICMP_ECHO)) {
237 low = 1;
238 high = 65535;
239 } else
240 return (0); /* Don't try to modify non-echo ICMP */
241 }
242 #ifdef INET6
243 if (proto == IPPROTO_ICMPV6) {
244 if (*nport == htons(ICMP6_ECHO_REQUEST)) {
245 low = 1;
246 high = 65535;
247 } else
248 return (0); /* Don't try to modify non-echo ICMP */
249 }
250 #endif /* INET6 */
251
252 bzero(&key, sizeof(key));
253 key.af = af;
254 key.proto = proto;
255 key.port[0] = dport;
256 PF_ACPY(&key.addr[0], daddr, key.af);
257
258 do {
259 PF_ACPY(&key.addr[1], naddr, key.af);
260
261 /*
262 * port search; start random, step;
263 * similar 2 portloop in in_pcbbind
264 */
265 if (proto == IPPROTO_SCTP) {
266 key.port[1] = sport;
267 if (!pf_find_state_all_exists(&key, PF_IN)) {
268 *nport = sport;
269 return (0);
270 } else {
271 return (1); /* Fail mapping. */
272 }
273 } else if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP ||
274 proto == IPPROTO_ICMP) || (low == 0 && high == 0)) {
275 /*
276 * XXX bug: icmp states don't use the id on both sides.
277 * (traceroute -I through nat)
278 */
279 key.port[1] = sport;
280 if (!pf_find_state_all_exists(&key, PF_IN)) {
281 *nport = sport;
282 return (0);
283 }
284 } else if (low == high) {
285 key.port[1] = htons(low);
286 if (!pf_find_state_all_exists(&key, PF_IN)) {
287 *nport = htons(low);
288 return (0);
289 }
290 } else {
291 uint32_t tmp;
292 uint16_t cut;
293
294 if (low > high) {
295 tmp = low;
296 low = high;
297 high = tmp;
298 }
299 /* low < high */
300 cut = arc4random() % (1 + high - low) + low;
301 /* low <= cut <= high */
302 for (tmp = cut; tmp <= high && tmp <= 0xffff; ++tmp) {
303 key.port[1] = htons(tmp);
304 if (!pf_find_state_all_exists(&key, PF_IN)) {
305 *nport = htons(tmp);
306 return (0);
307 }
308 }
309 tmp = cut;
310 for (tmp -= 1; tmp >= low && tmp <= 0xffff; --tmp) {
311 key.port[1] = htons(tmp);
312 if (!pf_find_state_all_exists(&key, PF_IN)) {
313 *nport = htons(tmp);
314 return (0);
315 }
316 }
317 }
318
319 switch (r->rpool.opts & PF_POOL_TYPEMASK) {
320 case PF_POOL_RANDOM:
321 case PF_POOL_ROUNDROBIN:
322 /*
323 * pick a different source address since we're out
324 * of free port choices for the current one.
325 */
326 if (pf_map_addr(af, r, saddr, naddr, NULL, &init_addr, sn))
327 return (1);
328 break;
329 case PF_POOL_NONE:
330 case PF_POOL_SRCHASH:
331 case PF_POOL_BITMASK:
332 default:
333 return (1);
334 }
335 } while (! PF_AEQ(&init_addr, naddr, af) );
336 return (1); /* none available */
337 }
338
339 static int
pf_get_mape_sport(sa_family_t af,u_int8_t proto,struct pf_krule * r,struct pf_addr * saddr,uint16_t sport,struct pf_addr * daddr,uint16_t dport,struct pf_addr * naddr,uint16_t * nport,struct pf_ksrc_node ** sn)340 pf_get_mape_sport(sa_family_t af, u_int8_t proto, struct pf_krule *r,
341 struct pf_addr *saddr, uint16_t sport, struct pf_addr *daddr,
342 uint16_t dport, struct pf_addr *naddr, uint16_t *nport,
343 struct pf_ksrc_node **sn)
344 {
345 uint16_t psmask, low, highmask;
346 uint16_t i, ahigh, cut;
347 int ashift, psidshift;
348
349 ashift = 16 - r->rpool.mape.offset;
350 psidshift = ashift - r->rpool.mape.psidlen;
351 psmask = r->rpool.mape.psid & ((1U << r->rpool.mape.psidlen) - 1);
352 psmask = psmask << psidshift;
353 highmask = (1U << psidshift) - 1;
354
355 ahigh = (1U << r->rpool.mape.offset) - 1;
356 cut = arc4random() & ahigh;
357 if (cut == 0)
358 cut = 1;
359
360 for (i = cut; i <= ahigh; i++) {
361 low = (i << ashift) | psmask;
362 if (!pf_get_sport(af, proto, r, saddr, sport, daddr, dport,
363 naddr, nport, low, low | highmask, sn))
364 return (0);
365 }
366 for (i = cut - 1; i > 0; i--) {
367 low = (i << ashift) | psmask;
368 if (!pf_get_sport(af, proto, r, saddr, sport, daddr, dport,
369 naddr, nport, low, low | highmask, sn))
370 return (0);
371 }
372 return (1);
373 }
374
375 u_short
pf_map_addr(sa_family_t af,struct pf_krule * r,struct pf_addr * saddr,struct pf_addr * naddr,struct pfi_kkif ** nkif,struct pf_addr * init_addr,struct pf_ksrc_node ** sn)376 pf_map_addr(sa_family_t af, struct pf_krule *r, struct pf_addr *saddr,
377 struct pf_addr *naddr, struct pfi_kkif **nkif, struct pf_addr *init_addr,
378 struct pf_ksrc_node **sn)
379 {
380 u_short reason = PFRES_MATCH;
381 struct pf_kpool *rpool = &r->rpool;
382 struct pf_addr *raddr = NULL, *rmask = NULL;
383 struct pf_srchash *sh = NULL;
384
385 /* Try to find a src_node if none was given and this
386 is a sticky-address rule. */
387 if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR &&
388 (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE)
389 *sn = pf_find_src_node(saddr, r, af, &sh, false);
390
391 /* If a src_node was found or explicitly given and it has a non-zero
392 route address, use this address. A zeroed address is found if the
393 src node was created just a moment ago in pf_create_state and it
394 needs to be filled in with routing decision calculated here. */
395 if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, af)) {
396 /* If the supplied address is the same as the current one we've
397 * been asked before, so tell the caller that there's no other
398 * address to be had. */
399 if (PF_AEQ(naddr, &(*sn)->raddr, af)) {
400 reason = PFRES_MAPFAILED;
401 goto done;
402 }
403
404 PF_ACPY(naddr, &(*sn)->raddr, af);
405 if (nkif)
406 *nkif = (*sn)->rkif;
407 if (V_pf_status.debug >= PF_DEBUG_NOISY) {
408 printf("pf_map_addr: src tracking maps ");
409 pf_print_host(saddr, 0, af);
410 printf(" to ");
411 pf_print_host(naddr, 0, af);
412 if (nkif)
413 printf("@%s", (*nkif)->pfik_name);
414 printf("\n");
415 }
416 goto done;
417 }
418
419 mtx_lock(&rpool->mtx);
420 /* Find the route using chosen algorithm. Store the found route
421 in src_node if it was given or found. */
422 if (rpool->cur->addr.type == PF_ADDR_NOROUTE) {
423 reason = PFRES_MAPFAILED;
424 goto done_pool_mtx;
425 }
426 if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
427 switch (af) {
428 #ifdef INET
429 case AF_INET:
430 if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 &&
431 (rpool->opts & PF_POOL_TYPEMASK) !=
432 PF_POOL_ROUNDROBIN) {
433 reason = PFRES_MAPFAILED;
434 goto done_pool_mtx;
435 }
436 raddr = &rpool->cur->addr.p.dyn->pfid_addr4;
437 rmask = &rpool->cur->addr.p.dyn->pfid_mask4;
438 break;
439 #endif /* INET */
440 #ifdef INET6
441 case AF_INET6:
442 if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 &&
443 (rpool->opts & PF_POOL_TYPEMASK) !=
444 PF_POOL_ROUNDROBIN) {
445 reason = PFRES_MAPFAILED;
446 goto done_pool_mtx;
447 }
448 raddr = &rpool->cur->addr.p.dyn->pfid_addr6;
449 rmask = &rpool->cur->addr.p.dyn->pfid_mask6;
450 break;
451 #endif /* INET6 */
452 }
453 } else if (rpool->cur->addr.type == PF_ADDR_TABLE) {
454 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN) {
455 reason = PFRES_MAPFAILED;
456 goto done_pool_mtx; /* unsupported */
457 }
458 } else {
459 raddr = &rpool->cur->addr.v.a.addr;
460 rmask = &rpool->cur->addr.v.a.mask;
461 }
462
463 switch (rpool->opts & PF_POOL_TYPEMASK) {
464 case PF_POOL_NONE:
465 PF_ACPY(naddr, raddr, af);
466 break;
467 case PF_POOL_BITMASK:
468 PF_POOLMASK(naddr, raddr, rmask, saddr, af);
469 break;
470 case PF_POOL_RANDOM:
471 if (init_addr != NULL && PF_AZERO(init_addr, af)) {
472 switch (af) {
473 #ifdef INET
474 case AF_INET:
475 rpool->counter.addr32[0] = htonl(arc4random());
476 break;
477 #endif /* INET */
478 #ifdef INET6
479 case AF_INET6:
480 if (rmask->addr32[3] != 0xffffffff)
481 rpool->counter.addr32[3] =
482 htonl(arc4random());
483 else
484 break;
485 if (rmask->addr32[2] != 0xffffffff)
486 rpool->counter.addr32[2] =
487 htonl(arc4random());
488 else
489 break;
490 if (rmask->addr32[1] != 0xffffffff)
491 rpool->counter.addr32[1] =
492 htonl(arc4random());
493 else
494 break;
495 if (rmask->addr32[0] != 0xffffffff)
496 rpool->counter.addr32[0] =
497 htonl(arc4random());
498 break;
499 #endif /* INET6 */
500 }
501 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
502 PF_ACPY(init_addr, naddr, af);
503
504 } else {
505 PF_AINC(&rpool->counter, af);
506 PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
507 }
508 break;
509 case PF_POOL_SRCHASH:
510 {
511 unsigned char hash[16];
512
513 pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, af);
514 PF_POOLMASK(naddr, raddr, rmask, (struct pf_addr *)&hash, af);
515 break;
516 }
517 case PF_POOL_ROUNDROBIN:
518 {
519 struct pf_kpooladdr *acur = rpool->cur;
520
521 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
522 if (!pfr_pool_get(rpool->cur->addr.p.tbl,
523 &rpool->tblidx, &rpool->counter, af))
524 goto get_addr;
525 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
526 if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
527 &rpool->tblidx, &rpool->counter, af))
528 goto get_addr;
529 } else if (pf_match_addr(0, raddr, rmask, &rpool->counter, af))
530 goto get_addr;
531
532 try_next:
533 if (TAILQ_NEXT(rpool->cur, entries) == NULL)
534 rpool->cur = TAILQ_FIRST(&rpool->list);
535 else
536 rpool->cur = TAILQ_NEXT(rpool->cur, entries);
537 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
538 rpool->tblidx = -1;
539 if (pfr_pool_get(rpool->cur->addr.p.tbl,
540 &rpool->tblidx, &rpool->counter, af)) {
541 /* table contains no address of type 'af' */
542 if (rpool->cur != acur)
543 goto try_next;
544 reason = PFRES_MAPFAILED;
545 goto done_pool_mtx;
546 }
547 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
548 rpool->tblidx = -1;
549 if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
550 &rpool->tblidx, &rpool->counter, af)) {
551 /* table contains no address of type 'af' */
552 if (rpool->cur != acur)
553 goto try_next;
554 reason = PFRES_MAPFAILED;
555 goto done_pool_mtx;
556 }
557 } else {
558 raddr = &rpool->cur->addr.v.a.addr;
559 rmask = &rpool->cur->addr.v.a.mask;
560 PF_ACPY(&rpool->counter, raddr, af);
561 }
562
563 get_addr:
564 PF_ACPY(naddr, &rpool->counter, af);
565 if (init_addr != NULL && PF_AZERO(init_addr, af))
566 PF_ACPY(init_addr, naddr, af);
567 PF_AINC(&rpool->counter, af);
568 break;
569 }
570 }
571
572 if (nkif)
573 *nkif = rpool->cur->kif;
574
575 if (*sn != NULL) {
576 PF_ACPY(&(*sn)->raddr, naddr, af);
577 if (nkif)
578 (*sn)->rkif = *nkif;
579 }
580
581 if (V_pf_status.debug >= PF_DEBUG_NOISY &&
582 (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
583 printf("pf_map_addr: selected address ");
584 pf_print_host(naddr, 0, af);
585 if (nkif)
586 printf("@%s", (*nkif)->pfik_name);
587 printf("\n");
588 }
589
590 done_pool_mtx:
591 mtx_unlock(&rpool->mtx);
592
593 done:
594 if (reason) {
595 counter_u64_add(V_pf_status.counters[reason], 1);
596 }
597
598 return (reason);
599 }
600
601 u_short
pf_get_translation(struct pf_pdesc * pd,struct mbuf * m,int off,struct pfi_kkif * kif,struct pf_ksrc_node ** sn,struct pf_state_key ** skp,struct pf_state_key ** nkp,struct pf_addr * saddr,struct pf_addr * daddr,uint16_t sport,uint16_t dport,struct pf_kanchor_stackframe * anchor_stack,struct pf_krule ** rp)602 pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
603 struct pfi_kkif *kif, struct pf_ksrc_node **sn,
604 struct pf_state_key **skp, struct pf_state_key **nkp,
605 struct pf_addr *saddr, struct pf_addr *daddr,
606 uint16_t sport, uint16_t dport, struct pf_kanchor_stackframe *anchor_stack,
607 struct pf_krule **rp)
608 {
609 struct pf_krule *r = NULL;
610 struct pf_addr *naddr;
611 uint16_t *nportp;
612 uint16_t low, high;
613 u_short reason;
614
615 PF_RULES_RASSERT();
616 KASSERT(*skp == NULL, ("*skp not NULL"));
617 KASSERT(*nkp == NULL, ("*nkp not NULL"));
618
619 *rp = NULL;
620
621 if (pd->dir == PF_OUT) {
622 r = pf_match_translation(pd, m, off, kif, saddr,
623 sport, daddr, dport, PF_RULESET_BINAT, anchor_stack);
624 if (r == NULL)
625 r = pf_match_translation(pd, m, off, kif,
626 saddr, sport, daddr, dport, PF_RULESET_NAT,
627 anchor_stack);
628 } else {
629 r = pf_match_translation(pd, m, off, kif, saddr,
630 sport, daddr, dport, PF_RULESET_RDR, anchor_stack);
631 if (r == NULL)
632 r = pf_match_translation(pd, m, off, kif,
633 saddr, sport, daddr, dport, PF_RULESET_BINAT,
634 anchor_stack);
635 }
636
637 if (r == NULL)
638 return (PFRES_MAX);
639
640 switch (r->action) {
641 case PF_NONAT:
642 case PF_NOBINAT:
643 case PF_NORDR:
644 return (PFRES_MAX);
645 }
646
647 *skp = pf_state_key_setup(pd, m, off, saddr, daddr, sport, dport);
648 if (*skp == NULL)
649 return (PFRES_MEMORY);
650 *nkp = pf_state_key_clone(*skp);
651 if (*nkp == NULL) {
652 uma_zfree(V_pf_state_key_z, *skp);
653 *skp = NULL;
654 return (PFRES_MEMORY);
655 }
656
657 naddr = &(*nkp)->addr[1];
658 nportp = &(*nkp)->port[1];
659
660 switch (r->action) {
661 case PF_NAT:
662 if (pd->proto == IPPROTO_ICMP) {
663 low = 1;
664 high = 65535;
665 } else {
666 low = r->rpool.proxy_port[0];
667 high = r->rpool.proxy_port[1];
668 }
669 if (r->rpool.mape.offset > 0) {
670 if (pf_get_mape_sport(pd->af, pd->proto, r, saddr,
671 sport, daddr, dport, naddr, nportp, sn)) {
672 DPFPRINTF(PF_DEBUG_MISC,
673 ("pf: MAP-E port allocation (%u/%u/%u)"
674 " failed\n",
675 r->rpool.mape.offset,
676 r->rpool.mape.psidlen,
677 r->rpool.mape.psid));
678 reason = PFRES_MAPFAILED;
679 goto notrans;
680 }
681 } else if (pf_get_sport(pd->af, pd->proto, r, saddr, sport,
682 daddr, dport, naddr, nportp, low, high, sn)) {
683 DPFPRINTF(PF_DEBUG_MISC,
684 ("pf: NAT proxy port allocation (%u-%u) failed\n",
685 r->rpool.proxy_port[0], r->rpool.proxy_port[1]));
686 reason = PFRES_MAPFAILED;
687 goto notrans;
688 }
689 break;
690 case PF_BINAT:
691 switch (pd->dir) {
692 case PF_OUT:
693 if (r->rpool.cur->addr.type == PF_ADDR_DYNIFTL){
694 switch (pd->af) {
695 #ifdef INET
696 case AF_INET:
697 if (r->rpool.cur->addr.p.dyn->
698 pfid_acnt4 < 1) {
699 reason = PFRES_MAPFAILED;
700 goto notrans;
701 }
702 PF_POOLMASK(naddr,
703 &r->rpool.cur->addr.p.dyn->
704 pfid_addr4,
705 &r->rpool.cur->addr.p.dyn->
706 pfid_mask4, saddr, AF_INET);
707 break;
708 #endif /* INET */
709 #ifdef INET6
710 case AF_INET6:
711 if (r->rpool.cur->addr.p.dyn->
712 pfid_acnt6 < 1) {
713 reason = PFRES_MAPFAILED;
714 goto notrans;
715 }
716 PF_POOLMASK(naddr,
717 &r->rpool.cur->addr.p.dyn->
718 pfid_addr6,
719 &r->rpool.cur->addr.p.dyn->
720 pfid_mask6, saddr, AF_INET6);
721 break;
722 #endif /* INET6 */
723 }
724 } else
725 PF_POOLMASK(naddr,
726 &r->rpool.cur->addr.v.a.addr,
727 &r->rpool.cur->addr.v.a.mask, saddr,
728 pd->af);
729 break;
730 case PF_IN:
731 if (r->src.addr.type == PF_ADDR_DYNIFTL) {
732 switch (pd->af) {
733 #ifdef INET
734 case AF_INET:
735 if (r->src.addr.p.dyn->pfid_acnt4 < 1) {
736 reason = PFRES_MAPFAILED;
737 goto notrans;
738 }
739 PF_POOLMASK(naddr,
740 &r->src.addr.p.dyn->pfid_addr4,
741 &r->src.addr.p.dyn->pfid_mask4,
742 daddr, AF_INET);
743 break;
744 #endif /* INET */
745 #ifdef INET6
746 case AF_INET6:
747 if (r->src.addr.p.dyn->pfid_acnt6 < 1) {
748 reason = PFRES_MAPFAILED;
749 goto notrans;
750 }
751 PF_POOLMASK(naddr,
752 &r->src.addr.p.dyn->pfid_addr6,
753 &r->src.addr.p.dyn->pfid_mask6,
754 daddr, AF_INET6);
755 break;
756 #endif /* INET6 */
757 }
758 } else
759 PF_POOLMASK(naddr, &r->src.addr.v.a.addr,
760 &r->src.addr.v.a.mask, daddr, pd->af);
761 break;
762 }
763 break;
764 case PF_RDR: {
765 struct pf_state_key_cmp key;
766 int tries;
767 uint16_t cut, low, high, nport;
768
769 reason = pf_map_addr(pd->af, r, saddr, naddr, NULL, NULL, sn);
770 if (reason != 0)
771 goto notrans;
772 if ((r->rpool.opts & PF_POOL_TYPEMASK) == PF_POOL_BITMASK)
773 PF_POOLMASK(naddr, naddr, &r->rpool.cur->addr.v.a.mask,
774 daddr, pd->af);
775
776 /* Do not change SCTP ports. */
777 if (pd->proto == IPPROTO_SCTP)
778 break;
779
780 if (r->rpool.proxy_port[1]) {
781 uint32_t tmp_nport;
782
783 tmp_nport = ((ntohs(dport) - ntohs(r->dst.port[0])) %
784 (r->rpool.proxy_port[1] - r->rpool.proxy_port[0] +
785 1)) + r->rpool.proxy_port[0];
786
787 /* Wrap around if necessary. */
788 if (tmp_nport > 65535)
789 tmp_nport -= 65535;
790 nport = htons((uint16_t)tmp_nport);
791 } else if (r->rpool.proxy_port[0])
792 nport = htons(r->rpool.proxy_port[0]);
793 else
794 nport = dport;
795
796 /*
797 * Update the destination port.
798 */
799 *nportp = nport;
800
801 /*
802 * Do we have a source port conflict in the stack state? Try to
803 * modulate the source port if so. Note that this is racy since
804 * the state lookup may not find any matches here but will once
805 * pf_create_state() actually instantiates the state.
806 */
807 bzero(&key, sizeof(key));
808 key.af = pd->af;
809 key.proto = pd->proto;
810 key.port[0] = sport;
811 PF_ACPY(&key.addr[0], saddr, key.af);
812 key.port[1] = nport;
813 PF_ACPY(&key.addr[1], naddr, key.af);
814
815 if (!pf_find_state_all_exists(&key, PF_OUT))
816 break;
817
818 tries = 0;
819
820 low = 50001; /* XXX-MJ PF_NAT_PROXY_PORT_LOW/HIGH */
821 high = 65535;
822 cut = arc4random() % (1 + high - low) + low;
823 for (uint32_t tmp = cut;
824 tmp <= high && tmp <= UINT16_MAX &&
825 tries < V_pf_rdr_srcport_rewrite_tries;
826 tmp++, tries++) {
827 key.port[0] = htons(tmp);
828 if (!pf_find_state_all_exists(&key, PF_OUT)) {
829 /* Update the source port. */
830 (*nkp)->port[0] = htons(tmp);
831 goto out;
832 }
833 }
834 for (uint32_t tmp = cut - 1;
835 tmp >= low && tries < V_pf_rdr_srcport_rewrite_tries;
836 tmp--, tries++) {
837 key.port[0] = htons(tmp);
838 if (!pf_find_state_all_exists(&key, PF_OUT)) {
839 /* Update the source port. */
840 (*nkp)->port[0] = htons(tmp);
841 goto out;
842 }
843 }
844
845 /*
846 * We failed to find a match. Push on ahead anyway, let
847 * pf_state_insert() be the arbiter of whether the state
848 * conflict is tolerable. In particular, with TCP connections
849 * the state may be reused if the TCP state is terminal.
850 */
851 DPFPRINTF(PF_DEBUG_MISC,
852 ("pf: RDR source port allocation failed\n"));
853 break;
854
855 out:
856 DPFPRINTF(PF_DEBUG_MISC,
857 ("pf: RDR source port allocation %u->%u\n",
858 ntohs(sport), ntohs((*nkp)->port[0])));
859 break;
860 }
861 default:
862 panic("%s: unknown action %u", __func__, r->action);
863 }
864
865 /* Return success only if translation really happened. */
866 if (bcmp(*skp, *nkp, sizeof(struct pf_state_key_cmp))) {
867 *rp = r;
868 return (PFRES_MATCH);
869 }
870
871 reason = PFRES_MAX;
872 notrans:
873 uma_zfree(V_pf_state_key_z, *nkp);
874 uma_zfree(V_pf_state_key_z, *skp);
875 *skp = *nkp = NULL;
876 *sn = NULL;
877
878 return (reason);
879 }
880