Skip to content

Commit 0eeff2e

Browse files
alexk99alexk99
committed
add nat events callbacks
1 parent a8380a9 commit 0eeff2e

File tree

6 files changed

+119
-2
lines changed

6 files changed

+119
-2
lines changed

‎src/kern/npf_conn.c

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -508,6 +508,18 @@ npf_conn_destroy(npf_t *npf, npf_conn_t *con)
508508
if (con->c_nat) {
509509
/* Release any NAT structures. */
510510
npf_nat_destroy(con->c_nat);
511+
512+
/* NAT events: execute destroy ipv4 translation callback */
513+
if (alen == NPF_IPV4_ALEN &&
514+
npf->nat_events_opts.ipv4_destroy_translation != NULL)
515+
npf->nat_events_opts.ipv4_destroy_translation(
516+
npf_conn_key_get_proto(key),
517+
npf_conn_key_ipv4_get_src_addr(key),
518+
npf_conn_key_ipv4_get_src_id(key),
519+
npf_conn_key_ipv4_get_dst_addr(key),
520+
npf_conn_key_ipv4_get_dst_id(key),
521+
npf_nat_gettrans_addr(con->c_nat)->word32[0],
522+
(uint16_t)npf_nat_gettrans_port(con->c_nat));
511523
}
512524
if (con->c_rproc) {
513525
/* Release the rule procedure. */
@@ -543,6 +555,7 @@ npf_conn_setnat(const npf_cache_t *npc, npf_conn_t *con,
543555
npf_conn_t *ret __diagused;
544556
npf_addr_t *taddr;
545557
in_port_t tport;
558+
unsigned alen;
546559

547560
KASSERT(con->c_refcnt > 0);
548561

@@ -572,7 +585,8 @@ npf_conn_setnat(const npf_cache_t *npc, npf_conn_t *con,
572585

573586
/* Remove the "backwards" key. */
574587
fw = npf_conn_getforwkey(con);
575-
bk = npf_conn_getbackkey(con, NPF_CONNKEY_ALEN(fw));
588+
alen = NPF_CONNKEY_ALEN(fw);
589+
bk = npf_conn_getbackkey(con, alen);
576590
ret = npf_conndb_remove(npf->conn_db, bk);
577591
KASSERT(ret == con);
578592

@@ -598,6 +612,19 @@ npf_conn_setnat(const npf_cache_t *npc, npf_conn_t *con,
598612
/* Associate the NAT entry and release the lock. */
599613
con->c_nat = nt;
600614
mutex_exit(&con->c_lock);
615+
616+
/* NAT events: execute create ipv4 translation callback */
617+
if (alen == NPF_IPV4_ALEN &&
618+
npf->nat_events_opts.ipv4_create_translation != NULL)
619+
npf->nat_events_opts.ipv4_create_translation(
620+
npf_conn_key_get_proto(fw),
621+
npf_conn_key_ipv4_get_src_addr(fw),
622+
npf_conn_key_ipv4_get_src_id(fw),
623+
npf_conn_key_ipv4_get_dst_addr(fw),
624+
npf_conn_key_ipv4_get_dst_id(fw),
625+
npf_nat_gettrans_addr(con->c_nat)->word32[0],
626+
(uint16_t)npf_nat_gettrans_port(con->c_nat));
627+
601628
return 0;
602629
}
603630

‎src/kern/npf_conn.h

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,9 @@ struct npf_conn {
103103
#define NPF_CONNKEY_ALEN(key) ((key)->ck_key[0] & 0xffff)
104104
#define NPF_CONNKEY_LEN(key) (8 + (NPF_CONNKEY_ALEN(key) * 2))
105105

106+
#define NPF_IPV4_ALEN 4
107+
#define NPF_IPV6_ALEN 16
108+
106109
struct npf_connkey {
107110
/* Warning: ck_key has a variable length -- see above. */
108111
uint32_t ck_key[NPF_CONNKEY_MAXWORDS];
@@ -114,6 +117,12 @@ npf_connkey_t * npf_conn_getbackkey(npf_conn_t *, unsigned);
114117
void npf_conn_adjkey(npf_connkey_t *, const npf_addr_t *,
115118
const uint16_t, const int);
116119

120+
uint16_t npf_conn_key_get_proto(const npf_connkey_t *);
121+
uint16_t npf_conn_key_ipv4_get_src_id(const npf_connkey_t *);
122+
uint16_t npf_conn_key_ipv4_get_dst_id(const npf_connkey_t *);
123+
uint32_t npf_conn_key_ipv4_get_src_addr(const npf_connkey_t *);
124+
uint32_t npf_conn_key_ipv4_get_dst_addr(const npf_connkey_t *);
125+
117126
unsigned npf_connkey_import(const nvlist_t *, npf_connkey_t *);
118127
nvlist_t * npf_connkey_export(const npf_connkey_t *);
119128
void npf_connkey_print(const npf_connkey_t *);

‎src/kern/npf_connkey.c

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,36 @@ __KERNEL_RCSID(0, "$NetBSD$");
6666
#include "npf_conn.h"
6767
#include "npf_impl.h"
6868

69+
uint16_t
70+
npf_conn_key_get_proto(const npf_connkey_t *key)
71+
{
72+
return (uint16_t) (key->ck_key[0] >> 16);
73+
}
74+
75+
uint16_t
76+
npf_conn_key_ipv4_get_src_id(const npf_connkey_t *key)
77+
{
78+
return (uint16_t) (key->ck_key[1] >> 16);
79+
}
80+
81+
uint16_t
82+
npf_conn_key_ipv4_get_dst_id(const npf_connkey_t *key)
83+
{
84+
return (uint16_t) (key->ck_key[1] & 0xFFFF);
85+
}
86+
87+
uint32_t
88+
npf_conn_key_ipv4_get_src_addr(const npf_connkey_t *key)
89+
{
90+
return key->ck_key[2];
91+
}
92+
93+
uint32_t
94+
npf_conn_key_ipv4_get_dst_addr(const npf_connkey_t *key)
95+
{
96+
return key->ck_key[3];
97+
}
98+
6999
static inline unsigned
70100
connkey_setkey(npf_connkey_t *key, uint16_t proto, const void *ipv,
71101
const uint16_t *id, unsigned alen, bool forw)

‎src/kern/npf_impl.h

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,7 @@ struct npf {
202202
/* BPF byte-code context. */
203203
bpf_ctx_t * bpfctx;
204204
const npf_mbufops_t * mbufops;
205-
205+
206206
/* Parameters. */
207207
npf_paraminfo_t * paraminfo;
208208
void * params[NPF_PARAMS_COUNT];
@@ -237,6 +237,9 @@ struct npf {
237237

238238
/* Statistics. */
239239
percpu_t * stats_percpu;
240+
241+
/* NAT events callbacks */
242+
npf_nat_events_ops_t nat_events_opts;
240243
};
241244

242245
/*
@@ -481,6 +484,8 @@ int npf_do_nat(npf_cache_t *, npf_conn_t *, const int);
481484
void npf_nat_destroy(npf_nat_t *);
482485
void npf_nat_getorig(npf_nat_t *, npf_addr_t **, in_port_t *);
483486
void npf_nat_gettrans(npf_nat_t *, npf_addr_t **, in_port_t *);
487+
const npf_addr_t * npf_nat_gettrans_addr(const npf_nat_t *);
488+
in_port_t npf_nat_gettrans_port(const npf_nat_t *);
484489
void npf_nat_setalg(npf_nat_t *, npf_alg_t *, uintptr_t);
485490

486491
void npf_nat_export(nvlist_t *, npf_nat_t *);

‎src/kern/npf_nat.c

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -709,6 +709,18 @@ npf_nat_gettrans(npf_nat_t *nt, npf_addr_t **addr, in_port_t *port)
709709
*port = nt->nt_tport;
710710
}
711711

712+
const npf_addr_t *
713+
npf_nat_gettrans_addr(const npf_nat_t *nt)
714+
{
715+
return &nt->nt_taddr;
716+
}
717+
718+
in_port_t
719+
npf_nat_gettrans_port(const npf_nat_t *nt)
720+
{
721+
return nt->nt_tport;
722+
}
723+
712724
/*
713725
* npf_nat_getorig: return original IP address and port from translation entry.
714726
*/
@@ -839,3 +851,17 @@ npf_nat_dump(const npf_nat_t *nt)
839851
}
840852

841853
#endif
854+
855+
__dso_public void
856+
npf_nat_events_set_create_ipv4_translation_cb(npf_t *npf,
857+
npf_nat_event_ipv4_create_translation_t cb)
858+
{
859+
npf->nat_events_opts.ipv4_create_translation = cb;
860+
}
861+
862+
__dso_public void
863+
npf_nat_events_set_destroy_ipv4_translation_cb(npf_t *npf,
864+
npf_nat_event_ipv4_destroy_translation_t cb)
865+
{
866+
npf->nat_events_opts.ipv4_destroy_translation = cb;
867+
}

‎src/kern/npfkern.h

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,20 @@ typedef struct {
6161
bool (*ensure_writable)(struct mbuf **, size_t);
6262
} npf_mbufops_t;
6363

64+
/* NAT event callbacks */
65+
typedef void (*npf_nat_event_ipv4_create_translation_t) (uint16_t proto,
66+
uint32_t src, uint16_t src_id, uint32_t dst, uint16_t dst_id,
67+
uint32_t tsrc, uint16_t tsrc_id);
68+
69+
typedef void (*npf_nat_event_ipv4_destroy_translation_t) (uint16_t proto,
70+
uint32_t src, uint16_t src_id, uint32_t dst, uint16_t dst_id,
71+
uint32_t tsrc, uint16_t tsrc_id);
72+
73+
typedef struct {
74+
npf_nat_event_ipv4_create_translation_t ipv4_create_translation;
75+
npf_nat_event_ipv4_destroy_translation_t ipv4_destroy_translation;
76+
} npf_nat_events_ops_t;
77+
6478
int npf_sysinit(unsigned);
6579
void npf_sysfini(void);
6680

@@ -86,4 +100,10 @@ void npf_stats_clear(npf_t *);
86100
int npf_alg_icmp_init(npf_t *);
87101
int npf_alg_icmp_fini(npf_t *);
88102

103+
/* NAT events callbacks */
104+
void npf_nat_events_set_create_ipv4_translation_cb(npf_t *,
105+
npf_nat_event_ipv4_create_translation_t);
106+
void npf_nat_events_set_destroy_ipv4_translation_cb(npf_t *,
107+
npf_nat_event_ipv4_destroy_translation_t);
108+
89109
#endif

0 commit comments

Comments
 (0)