sys/contrib/pf/net/pf_lb.c

   1 /*      $OpenBSD: pf_lb.c,v 1.2 2009/02/12 02:13:15 sthen Exp $ */
   2
   3 /*
   4  * Copyright (c) 2001 Daniel Hartmeier
   5  * Copyright (c) 2002 - 2008 Henning Brauer
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  *    - Redistributions of source code must retain the above copyright
  13  *      notice, this list of conditions and the following disclaimer.
  14  *    - Redistributions in binary form must reproduce the above
  15  *      copyright notice, this list of conditions and the following
  16  *      disclaimer in the documentation and/or other materials provided
  17  *      with the distribution.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  20  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  21  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
  22  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
  23  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
  24  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
  25  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
  27  * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
  29  * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  30  * POSSIBILITY OF SUCH DAMAGE.
  31  *
  32  * Effort sponsored in part by the Defense Advanced Research Projects
  33  * Agency (DARPA) and Air Force Research Laboratory, Air Force
  34  * Materiel Command, USAF, under agreement number F30602-01-2-0537.
  35  *
  36  */
  37
  38 #include <sys/cdefs.h>
  39 __FBSDID("$FreeBSD$");
  40
  41 #include "opt_pf.h"
  42 #include "opt_inet.h"
  43 #include "opt_inet6.h"
  44
  45 #include <sys/param.h>
  46 #include <sys/socket.h>
  47 #include <sys/sysctl.h>
  48
  49 #include <net/if.h>
  50 #include <net/pfvar.h>
  51 #include <net/if_pflog.h>
  52 #include <net/pf_mtag.h>
  53
  54 #define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x
  55
  56 static void              pf_hash(struct pf_addr *, struct pf_addr *,
  57                             struct pf_poolhashkey *, sa_family_t);
  58 static struct pf_rule   *pf_match_translation(struct pf_pdesc *, struct mbuf *,
  59                             int, int, struct pfi_kif *,
  60                             struct pf_addr *, u_int16_t, struct pf_addr *,
  61                             u_int16_t, int);
  62 static int               pf_get_sport(sa_family_t, u_int8_t, struct pf_rule *,
  63                             struct pf_addr *, struct pf_addr *, u_int16_t,
  64                             struct pf_addr *, u_int16_t*, u_int16_t, u_int16_t,
  65                             struct pf_src_node **);
  66
  67 #define mix(a,b,c) \
  68         do {                                    \
  69                 a -= b; a -= c; a ^= (c >> 13); \
  70                 b -= c; b -= a; b ^= (a << 8);  \
  71                 c -= a; c -= b; c ^= (b >> 13); \
  72                 a -= b; a -= c; a ^= (c >> 12); \
  73                 b -= c; b -= a; b ^= (a << 16); \
  74                 c -= a; c -= b; c ^= (b >> 5);  \
  75                 a -= b; a -= c; a ^= (c >> 3);  \
  76                 b -= c; b -= a; b ^= (a << 10); \
  77                 c -= a; c -= b; c ^= (b >> 15); \
  78         } while (0)
  79
  80 /*
  81  * hash function based on bridge_hash in if_bridge.c
  82  */
  83 static void
  84 pf_hash(struct pf_addr *inaddr, struct pf_addr *hash,
  85     struct pf_poolhashkey *key, sa_family_t af)
  86 {
  87         u_int32_t       a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0];
  88
  89         switch (af) {
  90 #ifdef INET
  91         case AF_INET:
  92                 a += inaddr->addr32[0];
  93                 b += key->key32[1];
  94                 mix(a, b, c);
  95                 hash->addr32[0] = c + key->key32[2];
  96                 break;
  97 #endif /* INET */
  98 #ifdef INET6
  99         case AF_INET6:
 100                 a += inaddr->addr32[0];
 101                 b += inaddr->addr32[2];
 102                 mix(a, b, c);
 103                 hash->addr32[0] = c;
 104                 a += inaddr->addr32[1];
 105                 b += inaddr->addr32[3];
 106                 c += key->key32[1];
 107                 mix(a, b, c);
 108                 hash->addr32[1] = c;
 109                 a += inaddr->addr32[2];
 110                 b += inaddr->addr32[1];
 111                 c += key->key32[2];
 112                 mix(a, b, c);
 113                 hash->addr32[2] = c;
 114                 a += inaddr->addr32[3];
 115                 b += inaddr->addr32[0];
 116                 c += key->key32[3];
 117                 mix(a, b, c);
 118                 hash->addr32[3] = c;
 119                 break;
 120 #endif /* INET6 */
 121         }
 122 }
 123
 124 static struct pf_rule *
 125 pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
 126     int direction, struct pfi_kif *kif, struct pf_addr *saddr, u_int16_t sport,
 127     struct pf_addr *daddr, u_int16_t dport, int rs_num)
 128 {
 129         struct pf_rule          *r, *rm = NULL;
 130         struct pf_ruleset       *ruleset = NULL;
 131         int                      tag = -1;
 132         int                      rtableid = -1;
 133         int                      asd = 0;
 134
 135         r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr);
 136         while (r && rm == NULL) {
 137                 struct pf_rule_addr     *src = NULL, *dst = NULL;
 138                 struct pf_addr_wrap     *xdst = NULL;
 139
 140                 if (r->action == PF_BINAT && direction == PF_IN) {
 141                         src = &r->dst;
 142                         if (r->rpool.cur != NULL)
 143                                 xdst = &r->rpool.cur->addr;
 144                 } else {
 145                         src = &r->src;
 146                         dst = &r->dst;
 147                 }
 148
 149                 r->evaluations++;
 150                 if (pfi_kif_match(r->kif, kif) == r->ifnot)
 151                         r = r->skip[PF_SKIP_IFP].ptr;
 152                 else if (r->direction && r->direction != direction)
 153                         r = r->skip[PF_SKIP_DIR].ptr;
 154                 else if (r->af && r->af != pd->af)
 155                         r = r->skip[PF_SKIP_AF].ptr;
 156                 else if (r->proto && r->proto != pd->proto)
 157                         r = r->skip[PF_SKIP_PROTO].ptr;
 158                 else if (PF_MISMATCHAW(&src->addr, saddr, pd->af,
 159                     src->neg, kif, M_GETFIB(m)))
 160                         r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR :
 161                             PF_SKIP_DST_ADDR].ptr;
 162                 else if (src->port_op && !pf_match_port(src->port_op,
 163                     src->port[0], src->port[1], sport))
 164                         r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT :
 165                             PF_SKIP_DST_PORT].ptr;
 166                 else if (dst != NULL &&
 167                     PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->neg, NULL,
 168                     M_GETFIB(m)))
 169                         r = r->skip[PF_SKIP_DST_ADDR].ptr;
 170                 else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af,
 171                     0, NULL, M_GETFIB(m)))
 172                         r = TAILQ_NEXT(r, entries);
 173                 else if (dst != NULL && dst->port_op &&
 174                     !pf_match_port(dst->port_op, dst->port[0],
 175                     dst->port[1], dport))
 176                         r = r->skip[PF_SKIP_DST_PORT].ptr;
 177                 else if (r->match_tag && !pf_match_tag(m, r, &tag,
 178                     pd->pf_mtag ? pd->pf_mtag->tag : 0))
 179                         r = TAILQ_NEXT(r, entries);
 180                 else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto !=
 181                     IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m,
 182                     off, pd->hdr.tcp), r->os_fingerprint)))
 183                         r = TAILQ_NEXT(r, entries);
 184                 else {
 185                         if (r->tag)
 186                                 tag = r->tag;
 187                         if (r->rtableid >= 0)
 188                                 rtableid = r->rtableid;
 189                         if (r->anchor == NULL) {
 190                                 rm = r;
 191                         } else
 192                                 pf_step_into_anchor(&asd, &ruleset, rs_num,
 193                                     &r, NULL, NULL);
 194                 }
 195                 if (r == NULL)
 196                         pf_step_out_of_anchor(&asd, &ruleset, rs_num, &r,
 197                             NULL, NULL);
 198         }
 199
 200         if (tag > 0 && pf_tag_packet(m, pd, tag))
 201                 return (NULL);
 202         if (rtableid >= 0)
 203                 M_SETFIB(m, rtableid);
 204
 205         if (rm != NULL && (rm->action == PF_NONAT ||
 206             rm->action == PF_NORDR || rm->action == PF_NOBINAT))
 207                 return (NULL);
 208         return (rm);
 209 }
 210
 211 static int
 212 pf_get_sport(sa_family_t af, u_int8_t proto, struct pf_rule *r,
 213     struct pf_addr *saddr, struct pf_addr *daddr, u_int16_t dport,
 214     struct pf_addr *naddr, u_int16_t *nport, u_int16_t low, u_int16_t high,
 215     struct pf_src_node **sn)
 216 {
 217         struct pf_state_key_cmp key;
 218         struct pf_addr          init_addr;
 219         u_int16_t               cut;
 220
 221         bzero(&init_addr, sizeof(init_addr));
 222         if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn))
 223                 return (1);
 224
 225         if (proto == IPPROTO_ICMP) {
 226                 low = 1;
 227                 high = 65535;
 228         }
 229
 230         do {
 231                 key.af = af;
 232                 key.proto = proto;
 233                 PF_ACPY(&key.addr[1], daddr, key.af);
 234                 PF_ACPY(&key.addr[0], naddr, key.af);
 235                 key.port[1] = dport;
 236
 237                 /*
 238                  * port search; start random, step;
 239                  * similar 2 portloop in in_pcbbind
 240                  */
 241                 if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP ||
 242                     proto == IPPROTO_ICMP)) {
 243                         key.port[0] = dport;
 244                         if (pf_find_state_all(&key, PF_IN, NULL) == NULL)
 245                                 return (0);
 246                 } else if (low == 0 && high == 0) {
 247                         key.port[0] = *nport;
 248                         if (pf_find_state_all(&key, PF_IN, NULL) == NULL)
 249                                 return (0);
 250                 } else if (low == high) {
 251                         key.port[0] = htons(low);
 252                         if (pf_find_state_all(&key, PF_IN, NULL) == NULL) {
 253                                 *nport = htons(low);
 254                                 return (0);
 255                         }
 256                 } else {
 257                         u_int16_t tmp;
 258
 259                         if (low > high) {
 260                                 tmp = low;
 261                                 low = high;
 262                                 high = tmp;
 263                         }
 264                         /* low < high */
 265                         cut = htonl(arc4random()) % (1 + high - low) + low;
 266                         /* low <= cut <= high */
 267                         for (tmp = cut; tmp <= high; ++(tmp)) {
 268                                 key.port[0] = htons(tmp);
 269                                 if (pf_find_state_all(&key, PF_IN, NULL) ==
 270                                     NULL) {
 271                                         *nport = htons(tmp);
 272                                         return (0);
 273                                 }
 274                         }
 275                         for (tmp = cut - 1; tmp >= low; --(tmp)) {
 276                                 key.port[0] = htons(tmp);
 277                                 if (pf_find_state_all(&key, PF_IN, NULL) ==
 278                                     NULL) {
 279                                         *nport = htons(tmp);
 280                                         return (0);
 281                                 }
 282                         }
 283                 }
 284
 285                 switch (r->rpool.opts & PF_POOL_TYPEMASK) {
 286                 case PF_POOL_RANDOM:
 287                 case PF_POOL_ROUNDROBIN:
 288                         if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn))
 289                                 return (1);
 290                         break;
 291                 case PF_POOL_NONE:
 292                 case PF_POOL_SRCHASH:
 293                 case PF_POOL_BITMASK:
 294                 default:
 295                         return (1);
 296                 }
 297         } while (! PF_AEQ(&init_addr, naddr, af) );
 298         return (1);                                     /* none available */
 299 }
 300
 301 int
 302 pf_map_addr(sa_family_t af, struct pf_rule *r, struct pf_addr *saddr,
 303     struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn)
 304 {
 305         struct pf_pool          *rpool = &r->rpool;
 306         struct pf_addr          *raddr = NULL, *rmask = NULL;
 307
 308         if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR &&
 309             (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
 310                 *sn = pf_find_src_node(saddr, r, af, 0);
 311                 if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, af)) {
 312                         PF_ACPY(naddr, &(*sn)->raddr, af);
 313                         if (V_pf_status.debug >= PF_DEBUG_MISC) {
 314                                 printf("pf_map_addr: src tracking maps ");
 315                                 pf_print_host(saddr, 0, af);
 316                                 printf(" to ");
 317                                 pf_print_host(naddr, 0, af);
 318                                 printf("\n");
 319                         }
 320                         return (0);
 321                 }
 322         }
 323
 324         if (rpool->cur->addr.type == PF_ADDR_NOROUTE)
 325                 return (1);
 326         if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
 327                 switch (af) {
 328 #ifdef INET
 329                 case AF_INET:
 330                         if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 &&
 331                             (rpool->opts & PF_POOL_TYPEMASK) !=
 332                             PF_POOL_ROUNDROBIN)
 333                                 return (1);
 334                          raddr = &rpool->cur->addr.p.dyn->pfid_addr4;
 335                          rmask = &rpool->cur->addr.p.dyn->pfid_mask4;
 336                         break;
 337 #endif /* INET */
 338 #ifdef INET6
 339                 case AF_INET6:
 340                         if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 &&
 341                             (rpool->opts & PF_POOL_TYPEMASK) !=
 342                             PF_POOL_ROUNDROBIN)
 343                                 return (1);
 344                         raddr = &rpool->cur->addr.p.dyn->pfid_addr6;
 345                         rmask = &rpool->cur->addr.p.dyn->pfid_mask6;
 346                         break;
 347 #endif /* INET6 */
 348                 }
 349         } else if (rpool->cur->addr.type == PF_ADDR_TABLE) {
 350                 if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN)
 351                         return (1); /* unsupported */
 352         } else {
 353                 raddr = &rpool->cur->addr.v.a.addr;
 354                 rmask = &rpool->cur->addr.v.a.mask;
 355         }
 356
 357         switch (rpool->opts & PF_POOL_TYPEMASK) {
 358         case PF_POOL_NONE:
 359                 PF_ACPY(naddr, raddr, af);
 360                 break;
 361         case PF_POOL_BITMASK:
 362                 PF_POOLMASK(naddr, raddr, rmask, saddr, af);
 363                 break;
 364         case PF_POOL_RANDOM:
 365                 if (init_addr != NULL && PF_AZERO(init_addr, af)) {
 366                         switch (af) {
 367 #ifdef INET
 368                         case AF_INET:
 369                                 rpool->counter.addr32[0] = htonl(arc4random());
 370                                 break;
 371 #endif /* INET */
 372 #ifdef INET6
 373                         case AF_INET6:
 374                                 if (rmask->addr32[3] != 0xffffffff)
 375                                         rpool->counter.addr32[3] =
 376                                             htonl(arc4random());
 377                                 else
 378                                         break;
 379                                 if (rmask->addr32[2] != 0xffffffff)
 380                                         rpool->counter.addr32[2] =
 381                                             htonl(arc4random());
 382                                 else
 383                                         break;
 384                                 if (rmask->addr32[1] != 0xffffffff)
 385                                         rpool->counter.addr32[1] =
 386                                             htonl(arc4random());
 387                                 else
 388                                         break;
 389                                 if (rmask->addr32[0] != 0xffffffff)
 390                                         rpool->counter.addr32[0] =
 391                                             htonl(arc4random());
 392                                 break;
 393 #endif /* INET6 */
 394                         }
 395                         PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
 396                         PF_ACPY(init_addr, naddr, af);
 397
 398                 } else {
 399                         PF_AINC(&rpool->counter, af);
 400                         PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
 401                 }
 402                 break;
 403         case PF_POOL_SRCHASH:
 404             {
 405                 unsigned char hash[16];
 406
 407                 pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, af);
 408                 PF_POOLMASK(naddr, raddr, rmask, (struct pf_addr *)&hash, af);
 409                 break;
 410             }
 411         case PF_POOL_ROUNDROBIN:
 412             {
 413                 struct pf_pooladdr *acur = rpool->cur;
 414
 415                 /*
 416                  * XXXGL: in the round-robin case we need to store
 417                  * the round-robin machine state in the rule, thus
 418                  * forwarding thread needs to modify rule.
 419                  *
 420                  * This is done w/o locking, because performance is assumed
 421                  * more important than round-robin precision.
 422                  *
 423                  * In the simpliest case we just update the "rpool->cur"
 424                  * pointer. However, if pool contains tables or dynamic
 425                  * addresses, then "tblidx" is also used to store machine
 426                  * state. Since "tblidx" is int, concurrent access to it can't
 427                  * lead to inconsistence, only to lost of precision.
 428                  *
 429                  * Things get worse, if table contains not hosts, but
 430                  * prefixes. In this case counter also stores machine state,
 431                  * and for IPv6 address, counter can't be updated atomically.
 432                  * Probably, using round-robin on a table containing IPv6
 433                  * prefixes (or even IPv4) would cause a panic.
 434                  */
 435
 436                 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
 437                         if (!pfr_pool_get(rpool->cur->addr.p.tbl,
 438                             &rpool->tblidx, &rpool->counter, af))
 439                                 goto get_addr;
 440                 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
 441                         if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
 442                             &rpool->tblidx, &rpool->counter, af))
 443                                 goto get_addr;
 444                 } else if (pf_match_addr(0, raddr, rmask, &rpool->counter, af))
 445                         goto get_addr;
 446
 447         try_next:
 448                 if (TAILQ_NEXT(rpool->cur, entries) == NULL)
 449                         rpool->cur = TAILQ_FIRST(&rpool->list);
 450                 else
 451                         rpool->cur = TAILQ_NEXT(rpool->cur, entries);
 452                 if (rpool->cur->addr.type == PF_ADDR_TABLE) {
 453                         rpool->tblidx = -1;
 454                         if (pfr_pool_get(rpool->cur->addr.p.tbl,
 455                             &rpool->tblidx, &rpool->counter, af)) {
 456                                 /* table contains no address of type 'af' */
 457                                 if (rpool->cur != acur)
 458                                         goto try_next;
 459                                 return (1);
 460                         }
 461                 } else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
 462                         rpool->tblidx = -1;
 463                         if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
 464                             &rpool->tblidx, &rpool->counter, af)) {
 465                                 /* table contains no address of type 'af' */
 466                                 if (rpool->cur != acur)
 467                                         goto try_next;
 468                                 return (1);
 469                         }
 470                 } else {
 471                         raddr = &rpool->cur->addr.v.a.addr;
 472                         rmask = &rpool->cur->addr.v.a.mask;
 473                         PF_ACPY(&rpool->counter, raddr, af);
 474                 }
 475
 476         get_addr:
 477                 PF_ACPY(naddr, &rpool->counter, af);
 478                 if (init_addr != NULL && PF_AZERO(init_addr, af))
 479                         PF_ACPY(init_addr, naddr, af);
 480                 PF_AINC(&rpool->counter, af);
 481                 break;
 482             }
 483         }
 484         if (*sn != NULL)
 485                 PF_ACPY(&(*sn)->raddr, naddr, af);
 486
 487         if (V_pf_status.debug >= PF_DEBUG_MISC &&
 488             (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
 489                 printf("pf_map_addr: selected address ");
 490                 pf_print_host(naddr, 0, af);
 491                 printf("\n");
 492         }
 493
 494         return (0);
 495 }
 496
 497 struct pf_rule *
 498 pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off, int direction,
 499     struct pfi_kif *kif, struct pf_src_node **sn,
 500     struct pf_state_key **skp, struct pf_state_key **nkp,
 501     struct pf_addr *saddr, struct pf_addr *daddr,
 502     u_int16_t sport, u_int16_t dport)
 503 {
 504         struct pf_rule  *r = NULL;
 505         struct pf_addr  *naddr;
 506         uint16_t        *nport;
 507
 508         PF_RULES_RASSERT();
 509         KASSERT(*skp == NULL, ("*skp not NULL"));
 510         KASSERT(*nkp == NULL, ("*nkp not NULL"));
 511
 512         if (direction == PF_OUT) {
 513                 r = pf_match_translation(pd, m, off, direction, kif, saddr,
 514                     sport, daddr, dport, PF_RULESET_BINAT);
 515                 if (r == NULL)
 516                         r = pf_match_translation(pd, m, off, direction, kif,
 517                             saddr, sport, daddr, dport, PF_RULESET_NAT);
 518         } else {
 519                 r = pf_match_translation(pd, m, off, direction, kif, saddr,
 520                     sport, daddr, dport, PF_RULESET_RDR);
 521                 if (r == NULL)
 522                         r = pf_match_translation(pd, m, off, direction, kif,
 523                             saddr, sport, daddr, dport, PF_RULESET_BINAT);
 524         }
 525
 526         if (r == NULL)
 527                 return (NULL);
 528
 529         switch (r->action) {
 530         case PF_NONAT:
 531         case PF_NOBINAT:
 532         case PF_NORDR:
 533                 return (NULL);
 534         }
 535
 536         *skp = pf_state_key_setup(pd, saddr, daddr, sport, dport);
 537         if (*skp == NULL)
 538                 return (NULL);
 539         *nkp = pf_state_key_clone(*skp);
 540         if (*nkp == NULL) {
 541                 uma_zfree(V_pf_state_key_z, skp);
 542                 *skp = NULL;
 543                 return (NULL);
 544         }
 545
 546         /* XXX We only modify one side for now. */
 547         naddr = &(*nkp)->addr[1];
 548         nport = &(*nkp)->port[1];
 549
 550         switch (r->action) {
 551         case PF_NAT:
 552                 if (pf_get_sport(pd->af, pd->proto, r, saddr, daddr, dport,
 553                     naddr, nport, r->rpool.proxy_port[0],
 554                     r->rpool.proxy_port[1], sn)) {
 555                         DPFPRINTF(PF_DEBUG_MISC,
 556                             ("pf: NAT proxy port allocation (%u-%u) failed\n",
 557                             r->rpool.proxy_port[0], r->rpool.proxy_port[1]));
 558                         goto notrans;
 559                 }
 560                 break;
 561         case PF_BINAT:
 562                 switch (direction) {
 563                 case PF_OUT:
 564                         if (r->rpool.cur->addr.type == PF_ADDR_DYNIFTL){
 565                                 switch (pd->af) {
 566 #ifdef INET
 567                                 case AF_INET:
 568                                         if (r->rpool.cur->addr.p.dyn->
 569                                             pfid_acnt4 < 1)
 570                                                 goto notrans;
 571                                         PF_POOLMASK(naddr,
 572                                             &r->rpool.cur->addr.p.dyn->
 573                                             pfid_addr4,
 574                                             &r->rpool.cur->addr.p.dyn->
 575                                             pfid_mask4, saddr, AF_INET);
 576                                         break;
 577 #endif /* INET */
 578 #ifdef INET6
 579                                 case AF_INET6:
 580                                         if (r->rpool.cur->addr.p.dyn->
 581                                             pfid_acnt6 < 1)
 582                                                 goto notrans;
 583                                         PF_POOLMASK(naddr,
 584                                             &r->rpool.cur->addr.p.dyn->
 585                                             pfid_addr6,
 586                                             &r->rpool.cur->addr.p.dyn->
 587                                             pfid_mask6, saddr, AF_INET6);
 588                                         break;
 589 #endif /* INET6 */
 590                                 }
 591                         } else
 592                                 PF_POOLMASK(naddr,
 593                                     &r->rpool.cur->addr.v.a.addr,
 594                                     &r->rpool.cur->addr.v.a.mask, saddr,
 595                                     pd->af);
 596                         break;
 597                 case PF_IN:
 598                         if (r->src.addr.type == PF_ADDR_DYNIFTL) {
 599                                 switch (pd->af) {
 600 #ifdef INET
 601                                 case AF_INET:
 602                                         if (r->src.addr.p.dyn-> pfid_acnt4 < 1)
 603                                                 goto notrans;
 604                                         PF_POOLMASK(naddr,
 605                                             &r->src.addr.p.dyn->pfid_addr4,
 606                                             &r->src.addr.p.dyn->pfid_mask4,
 607                                             daddr, AF_INET);
 608                                         break;
 609 #endif /* INET */
 610 #ifdef INET6
 611                                 case AF_INET6:
 612                                         if (r->src.addr.p.dyn->pfid_acnt6 < 1)
 613                                                 goto notrans;
 614                                         PF_POOLMASK(naddr,
 615                                             &r->src.addr.p.dyn->pfid_addr6,
 616                                             &r->src.addr.p.dyn->pfid_mask6,
 617                                             daddr, AF_INET6);
 618                                         break;
 619 #endif /* INET6 */
 620                                 }
 621                         } else
 622                                 PF_POOLMASK(naddr, &r->src.addr.v.a.addr,
 623                                     &r->src.addr.v.a.mask, daddr, pd->af);
 624                         break;
 625                 }
 626                 break;
 627         case PF_RDR: {
 628                 if (pf_map_addr(pd->af, r, saddr, naddr, NULL, sn))
 629                         goto notrans;
 630                 if ((r->rpool.opts & PF_POOL_TYPEMASK) == PF_POOL_BITMASK)
 631                         PF_POOLMASK(naddr, naddr, &r->rpool.cur->addr.v.a.mask,
 632                             daddr, pd->af);
 633
 634                 if (r->rpool.proxy_port[1]) {
 635                         uint32_t        tmp_nport;
 636
 637                         tmp_nport = ((ntohs(dport) - ntohs(r->dst.port[0])) %
 638                             (r->rpool.proxy_port[1] - r->rpool.proxy_port[0] +
 639                             1)) + r->rpool.proxy_port[0];
 640
 641                         /* Wrap around if necessary. */
 642                         if (tmp_nport > 65535)
 643                                 tmp_nport -= 65535;
 644                         *nport = htons((uint16_t)tmp_nport);
 645                 } else if (r->rpool.proxy_port[0])
 646                         *nport = htons(r->rpool.proxy_port[0]);
 647                 break;
 648         }
 649         default:
 650                 panic("%s: unknown action %u", __func__, r->action);
 651         }
 652
 653         /* Return success only if translation really happened. */
 654         if (bcmp(*skp, *nkp, sizeof(struct pf_state_key_cmp)))
 655                 return (r);
 656
 657 notrans:
 658         uma_zfree(V_pf_state_key_z, *nkp);
 659         uma_zfree(V_pf_state_key_z, *skp);
 660         *skp = *nkp = NULL;
 661
 662         return (NULL);
 663 }