/*-
 * Copyright (c) 2014-2020 Mindaugas Rasiukevicius <rmind at netbsd org>
 * Copyright (c) 2010-2014 The NetBSD Foundation, Inc.
 * All rights reserved.
 *
 * This material is based upon work partially supported by The
 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 */

/*
 * Connection key -- is an n-tuple structure encoding the address length,
 * layer 3 protocol, source and destination addresses and ports (or other
 * protocol IDs) and some configurable elements (see below).
 *
 * Key layout
 *
 *      The single key is formed out of 32-bit integers.  The layout is
 *      as follows (first row -- fields, second row -- number of bits):
 *
 *      | alen | proto |  ckey  | src-id | dst-id | src-addr | dst-addr |
 *      +------+-------+--------+--------+--------+----------+----------+
 *      |   4  |   8   |   20   |   16   |   16   |  32-128  |  32-128  |
 *
 *      The source and destination are inverted if the key is for the
 *      backwards stream (NPF_FLOW_BACK).  The address length depends on
 *      the 'alen' field.  The length is in words and is either 1 or 4,
 *      meaning 4 or 16 in bytes.
 *
 *      The 20-bit configurable key area ('ckey') is for the optional
 *      elements which may be included or excluded by the user.  It has
 *      the following layout:
 *
 *      | direction | interface-id |
 *      +-----------+--------------+
 *      |     2     |      18      |
 *
 *      Note: neither direction nor interface ID cannot be zero; we rely
 *      on this by reserving the zero 'ckey' value to for the case when
 *      these checks are not applicable.
 *
 * Embedding in the connection structure (npf_conn_t)
 *
 *      Two keys are stored in the npf_conn_t::c_keys[] array, which is
 *      variable-length, depending on whether the keys store IPv4 or IPv6
 *      addresses.  The length of the first key determines the position
 *      of the second key.
 *
 * WARNING: the keys must be immutable while they are in conndb.
 */

#ifdef _KERNEL
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: npf_connkey.c,v 1.2 2020/05/30 14:16:56 rmind Exp $");

#include <sys/param.h>
#include <sys/types.h>
#endif

#define __NPF_CONN_PRIVATE
#include "npf_conn.h"
#include "npf_impl.h"

unsigned
npf_connkey_setkey(npf_connkey_t *key, unsigned alen, unsigned proto,
    const void *ipv, const uint16_t *id, const npf_flow_t flow)
{
        const npf_addr_t * const *ips = ipv;
        uint32_t *k = key->ck_key;
        unsigned isrc, idst;

        if (__predict_true(flow == NPF_FLOW_FORW)) {
                isrc = NPF_SRC, idst = NPF_DST;
        } else {
                isrc = NPF_DST, idst = NPF_SRC;
        }

        /*
         * See the key layout explanation above.
         */
        KASSERT((alen >> 2) <= 0xf && proto <= 0xff);
        k[0] = ((uint32_t)(alen >> 2) << 28) | (proto << 20);
        k[1] = ((uint32_t)id[isrc] << 16) | id[idst];

        if (__predict_true(alen == sizeof(in_addr_t))) {
                k[2] = ips[isrc]->word32[0];
                k[3] = ips[idst]->word32[0];
                return 4 * sizeof(uint32_t);
        } else {
                const unsigned nwords = alen >> 2;
                memcpy(&k[2], ips[isrc], alen);
                memcpy(&k[2 + nwords], ips[idst], alen);
                return (2 + (nwords * 2)) * sizeof(uint32_t);
        }
}

void
npf_connkey_getkey(const npf_connkey_t *key, unsigned *alen, unsigned *proto,
    npf_addr_t *ips, uint16_t *id)
{
        const uint32_t *k = key->ck_key;

        /*
         * See the key layout explanation above.
         */

        *alen = (k[0] >> 28) << 2;
        *proto = (k[0] >> 16) & 0xff;
        id[NPF_SRC] = k[1] >> 16;
        id[NPF_DST] = k[1] & 0xffff;

        switch (*alen) {
        case sizeof(struct in6_addr):
        case sizeof(struct in_addr):
                memcpy(&ips[NPF_SRC], &k[2], *alen);
                memcpy(&ips[NPF_DST], &k[2 + ((unsigned)*alen >> 2)], *alen);
                return;
        default:
                KASSERT(0);
        }
}

static inline void
npf_connkey_setckey(npf_connkey_t *key, unsigned ifid, unsigned di)
{
        if (ifid) {
                /*
                 * Interface ID: the lower 18 bits of the 20-bit 'ckey'.
                 * Note: the interface ID cannot be zero.
                 */
                CTASSERT(NPF_MAX_IFMAP < (1U << 18));
                key->ck_key[0] |= ifid;
        }
        if (di) {
                /*
                 * Direction: The highest 2 bits of the 20-bit 'ckey'.
                 * Note: we rely on PFIL_IN and PFIL_OUT definitions.
                 */
                CTASSERT(PFIL_IN == 0x1 || PFIL_OUT == 0x2);
                KASSERT((di & ~PFIL_ALL) == 0);
                key->ck_key[0] |= ((uint32_t)di << 18);
        }
}

static void
npf_connkey_getckey(const npf_connkey_t *key, unsigned *ifid, unsigned *di)
{
        const uint32_t * const k = key->ck_key;

        *ifid = k[0] & ((1U << 20) - 1);
        *di = (k[0] >> 18) & PFIL_ALL;
}

/*
 * npf_conn_adjkey: adjust the connection key by setting the address/port.
 *
 * => The 'which' must either be NPF_SRC or NPF_DST.
 */
void
npf_conn_adjkey(npf_connkey_t *key, const npf_addr_t *naddr,
    const uint16_t id, const unsigned which)
{
        const unsigned alen = NPF_CONNKEY_ALEN(key);
        uint32_t * const k = key->ck_key;
        uint32_t *addr = &k[2 + ((alen >> 2) * which)];

        KASSERT(which == NPF_SRC || which == NPF_DST);
        KASSERT(alen > 0);
        memcpy(addr, naddr, alen);

        if (id) {
                const uint32_t oid = k[1];
                const unsigned shift = 16 * !which;
                const uint32_t mask = 0xffff0000 >> shift;
                k[1] = ((uint32_t)id << shift) | (oid & mask);
        }
}

static unsigned
npf_connkey_copy(const npf_connkey_t *skey, npf_connkey_t *dkey, bool invert)
{
        const unsigned klen = NPF_CONNKEY_LEN(skey);
        const uint32_t *sk = skey->ck_key;
        uint32_t *dk = dkey->ck_key;

        if (invert) {
                const unsigned alen = NPF_CONNKEY_ALEN(skey);
                const unsigned nwords = alen >> 2;

                dk[0] = sk[1];
                dk[1] = (sk[1] >> 16) | (sk[1] << 16);
                memcpy(&dk[2], &sk[2 + nwords], alen);
                memcpy(&dk[2 + nwords], &sk[2], alen);
        } else {
                memcpy(dk, sk, klen);
        }
        return klen;
}

/*
 * npf_conn_conkey: construct a key for the connection lookup.
 *
 * => Returns the key length in bytes or zero on failure.
 */
unsigned
npf_conn_conkey(const npf_cache_t *npc, npf_connkey_t *key,
    const unsigned di, const npf_flow_t flow)
{
        const npf_conn_params_t *params = npc->npc_ctx->params[NPF_PARAMS_CONN];
        const nbuf_t *nbuf = npc->npc_nbuf;
        const unsigned proto = npc->npc_proto;
        const unsigned alen = npc->npc_alen;
        const struct tcphdr *th;
        const struct udphdr *uh;
        uint16_t id[2] = { 0, 0 };
        unsigned ret;

        if (npc->npc_ckey) {
                /*
                 * Request to override the connection key.
                 */
                const bool invert = flow != NPF_FLOW_FORW;
                return npf_connkey_copy(npc->npc_ckey, key, invert);
        }

        switch (proto) {
        case IPPROTO_TCP:
                KASSERT(npf_iscached(npc, NPC_TCP));
                th = npc->npc_l4.tcp;
                id[NPF_SRC] = th->th_sport;
                id[NPF_DST] = th->th_dport;
                break;
        case IPPROTO_UDP:
                KASSERT(npf_iscached(npc, NPC_UDP));
                uh = npc->npc_l4.udp;
                id[NPF_SRC] = uh->uh_sport;
                id[NPF_DST] = uh->uh_dport;
                break;
        case IPPROTO_ICMP:
                if (npf_iscached(npc, NPC_ICMP_ID)) {
                        const struct icmp *ic = npc->npc_l4.icmp;
                        id[NPF_SRC] = ic->icmp_id;
                        id[NPF_DST] = ic->icmp_id;
                        break;
                }
                return 0;
        case IPPROTO_ICMPV6:
                if (npf_iscached(npc, NPC_ICMP_ID)) {
                        const struct icmp6_hdr *ic6 = npc->npc_l4.icmp6;
                        id[NPF_SRC] = ic6->icmp6_id;
                        id[NPF_DST] = ic6->icmp6_id;
                        break;
                }
                return 0;
        default:
                /* Unsupported protocol. */
                return 0;
        }

        ret = npf_connkey_setkey(key, alen, proto, npc->npc_ips, id, flow);
        npf_connkey_setckey(key,
            params->connkey_interface ? nbuf->nb_ifid : 0,
            params->connkey_direction ? (di & PFIL_ALL) : 0);
        return ret;
}

/*
 * npf_conn_getforwkey: get the address to the "forwards" key.
 */
npf_connkey_t *
npf_conn_getforwkey(npf_conn_t *conn)
{
        return (void *)&conn->c_keys[0];
}

/*
 * npf_conn_getbackkey: get the address to the "backwards" key.
 *
 * => It depends on the address length.
 */
npf_connkey_t *
npf_conn_getbackkey(npf_conn_t *conn, unsigned alen)
{
        const unsigned off = 2 + ((alen * 2) >> 2);
        KASSERT(off == NPF_CONNKEY_V4WORDS || off == NPF_CONNKEY_V6WORDS);
        return (void *)&conn->c_keys[off];
}

/*
 * Connection key exporting/importing.
 */

nvlist_t *
npf_connkey_export(npf_t *npf, const npf_connkey_t *key)
{
        unsigned alen, proto, ifid, di;
        npf_addr_t ips[2];
        uint16_t ids[2];
        nvlist_t *key_nv;

        key_nv = nvlist_create(0);

        npf_connkey_getkey(key, &alen, &proto, ips, ids);
        nvlist_add_number(key_nv, "proto", proto);
        nvlist_add_number(key_nv, "sport", ids[NPF_SRC]);
        nvlist_add_number(key_nv, "dport", ids[NPF_DST]);
        nvlist_add_binary(key_nv, "saddr", &ips[NPF_SRC], alen);
        nvlist_add_binary(key_nv, "daddr", &ips[NPF_DST], alen);

        npf_connkey_getckey(key, &ifid, &di);
        if (ifid) {
                char ifname[IFNAMSIZ];
                npf_ifmap_copyname(npf, ifid, ifname, sizeof(ifname));
                nvlist_add_string(key_nv, "ifname", ifname);
        }
        if (di) {
                nvlist_add_number(key_nv, "di", di);
        }

        return key_nv;
}

unsigned
npf_connkey_import(npf_t *npf, const nvlist_t *key_nv, npf_connkey_t *key)
{
        npf_addr_t const * ips[2];
        size_t alen1, alen2, proto;
        unsigned ret, di, ifid = 0;
        const char *ifname;
        uint16_t ids[2];

        proto = dnvlist_get_number(key_nv, "proto", 0);
        if (proto >= IPPROTO_MAX) {
                return 0;
        }
        ids[NPF_SRC] = dnvlist_get_number(key_nv, "sport", 0);
        ids[NPF_DST] = dnvlist_get_number(key_nv, "dport", 0);
        ips[NPF_SRC] = dnvlist_get_binary(key_nv, "saddr", &alen1, NULL, 0);
        ips[NPF_DST] = dnvlist_get_binary(key_nv, "daddr", &alen2, NULL, 0);
        if (alen1 == 0 || alen1 > sizeof(npf_addr_t) || alen1 != alen2) {
                return 0;
        }
        ret = npf_connkey_setkey(key, alen1, proto, ips, ids, NPF_FLOW_FORW);
        if (ret == 0) {
                return 0;
        }

        ifname = dnvlist_get_string(key_nv, "ifname", NULL);
        if (ifname && (ifid = npf_ifmap_register(npf, ifname)) == 0) {
                return 0;
        }
        di = dnvlist_get_number(key_nv, "di", 0) & PFIL_ALL;
        npf_connkey_setckey(key, ifid, di);

        return ret;
}

#if defined(DDB) || defined(_NPF_TESTING)

void
npf_connkey_print(const npf_connkey_t *key)
{
        unsigned alen, proto, ifid, di;
        npf_addr_t ips[2];
        uint16_t ids[2];

        npf_connkey_getkey(key, &alen, &proto, ips, ids);
        npf_connkey_getckey(key, &ifid, &di);
        printf("\tkey (ifid %u, di %x)\t", ifid, di);
        printf("%s:%u", npf_addr_dump(&ips[0], alen), ids[0]);
        printf("-> %s:%u\n", npf_addr_dump(&ips[1], alen), ids[1]);
}

#endif