sbin/ipfw/nat64lsn.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-2-Clause
   3  *
   4  * Copyright (c) 2015-2019 Yandex LLC
   5  * Copyright (c) 2015-2016 Alexander V. Chernikov <melifaro@FreeBSD.org>
   6  * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org>
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  */
  29
  30 #include <sys/cdefs.h>
  31 #include <sys/types.h>
  32 #include <sys/socket.h>
  33
  34 #include "ipfw2.h"
  35
  36 #include <ctype.h>
  37 #include <err.h>
  38 #include <errno.h>
  39 #include <inttypes.h>
  40 #include <netdb.h>
  41 #include <stdio.h>
  42 #include <stdlib.h>
  43 #include <string.h>
  44 #include <sysexits.h>
  45
  46 #include <net/if.h>
  47 #include <netinet/in.h>
  48 #include <netinet/ip_fw.h>
  49 #include <netinet6/ip_fw_nat64.h>
  50 #include <arpa/inet.h>
  51
  52 static void nat64lsn_fill_ntlv(ipfw_obj_ntlv *ntlv, const char *name,
  53     uint8_t set);
  54 typedef int (nat64lsn_cb_t)(ipfw_nat64lsn_cfg *cfg, const char *name,
  55     uint8_t set);
  56 static int nat64lsn_foreach(nat64lsn_cb_t *f, const char *name, uint8_t set,
  57     int sort);
  58
  59 static void nat64lsn_create(const char *name, uint8_t set, int ac, char **av);
  60 static void nat64lsn_config(const char *name, uint8_t set, int ac, char **av);
  61 static void nat64lsn_destroy(const char *name, uint8_t set);
  62 static void nat64lsn_stats(const char *name, uint8_t set);
  63 static void nat64lsn_reset_stats(const char *name, uint8_t set);
  64 static int nat64lsn_show_cb(ipfw_nat64lsn_cfg *cfg, const char *name,
  65     uint8_t set);
  66 static int nat64lsn_destroy_cb(ipfw_nat64lsn_cfg *cfg, const char *name,
  67     uint8_t set);
  68 static int nat64lsn_states_cb(ipfw_nat64lsn_cfg *cfg, const char *name,
  69     uint8_t set);
  70
  71 static struct _s_x nat64cmds[] = {
  72       { "create",       TOK_CREATE },
  73       { "config",       TOK_CONFIG },
  74       { "destroy",      TOK_DESTROY },
  75       { "list",         TOK_LIST },
  76       { "show",         TOK_LIST },
  77       { "stats",        TOK_STATS },
  78       { NULL, 0 }
  79 };
  80
  81 static uint64_t
  82 nat64lsn_print_states(void *buf)
  83 {
  84         char s[INET6_ADDRSTRLEN], a[INET_ADDRSTRLEN], f[INET_ADDRSTRLEN];
  85         const char *proto;
  86         char sflags[4], *sf;
  87         ipfw_obj_header *oh;
  88         ipfw_obj_data *od;
  89         ipfw_nat64lsn_stg_v1 *stg;
  90         ipfw_nat64lsn_state_v1 *ste;
  91         uint64_t next_idx;
  92         uint32_t i;
  93         int sz;
  94
  95         oh = (ipfw_obj_header *)buf;
  96         od = (ipfw_obj_data *)(oh + 1);
  97         stg = (ipfw_nat64lsn_stg_v1 *)(od + 1);
  98         sz = od->head.length - sizeof(*od);
  99         next_idx = 0;
 100         proto = NULL;
 101         while (sz > 0 && next_idx != 0xFF) {
 102                 next_idx = stg->next.index;
 103                 sz -= sizeof(*stg);
 104                 if (stg->count == 0) {
 105                         stg++;
 106                         continue;
 107                 }
 108                 /*
 109                  * NOTE: addresses are in network byte order,
 110                  * ports are in host byte order.
 111                  */
 112                 inet_ntop(AF_INET, &stg->alias4, a, sizeof(a));
 113                 ste = (ipfw_nat64lsn_state_v1 *)(stg + 1);
 114                 for (i = 0; i < stg->count && sz > 0; i++) {
 115                         sf = sflags;
 116                         inet_ntop(AF_INET6, &ste->host6, s, sizeof(s));
 117                         inet_ntop(AF_INET, &ste->daddr, f, sizeof(f));
 118                         switch (ste->proto) {
 119                         case IPPROTO_TCP:
 120                                 proto = "TCP";
 121                                 if (ste->flags & 0x02)
 122                                         *sf++ = 'S';
 123                                 if (ste->flags & 0x04)
 124                                         *sf++ = 'E';
 125                                 if (ste->flags & 0x01)
 126                                         *sf++ = 'F';
 127                                 break;
 128                         case IPPROTO_UDP:
 129                                 proto = "UDP";
 130                                 break;
 131                         case IPPROTO_ICMP:
 132                                 proto = "ICMPv6";
 133                                 break;
 134                         }
 135                         *sf = '\0';
 136                         switch (ste->proto) {
 137                         case IPPROTO_TCP:
 138                         case IPPROTO_UDP:
 139                                 printf("%s:%d\t%s:%d\t%s\t%s\t%d\t%s:%d\n",
 140                                     s, ste->sport, a, ste->aport, proto,
 141                                     sflags, ste->idle, f, ste->dport);
 142                                 break;
 143                         case IPPROTO_ICMP:
 144                                 printf("%s\t%s\t%s\t\t%d\t%s\n",
 145                                     s, a, proto, ste->idle, f);
 146                                 break;
 147                         default:
 148                                 printf("%s\t%s\t%d\t\t%d\t%s\n",
 149                                     s, a, ste->proto, ste->idle, f);
 150                         }
 151                         ste++;
 152                         sz -= sizeof(*ste);
 153                 }
 154                 stg = (ipfw_nat64lsn_stg_v1 *)ste;
 155         }
 156         return (next_idx);
 157 }
 158
 159 static int
 160 nat64lsn_states_cb(ipfw_nat64lsn_cfg *cfg, const char *name, uint8_t set)
 161 {
 162         ipfw_obj_header *oh;
 163         ipfw_obj_data *od;
 164         void *buf;
 165         uint64_t next_idx;
 166         size_t sz;
 167
 168         if (name != NULL && strcmp(cfg->name, name) != 0)
 169                 return (ESRCH);
 170
 171         if (set != 0 && cfg->set != set)
 172                 return (ESRCH);
 173
 174         next_idx = 0;
 175         sz = 4096;
 176         if ((buf = calloc(1, sz)) == NULL)
 177                 err(EX_OSERR, NULL);
 178         do {
 179                 oh = (ipfw_obj_header *)buf;
 180                 oh->opheader.version = 1; /* Force using ov new API */
 181                 od = (ipfw_obj_data *)(oh + 1);
 182                 nat64lsn_fill_ntlv(&oh->ntlv, cfg->name, set);
 183                 od->head.type = IPFW_TLV_OBJDATA;
 184                 od->head.length = sizeof(*od) + sizeof(next_idx);
 185                 *((uint64_t *)(od + 1)) = next_idx;
 186                 if (do_get3(IP_FW_NAT64LSN_LIST_STATES, &oh->opheader, &sz))
 187                         err(EX_OSERR, "Error reading nat64lsn states");
 188                 next_idx = nat64lsn_print_states(buf);
 189                 sz = 4096;
 190                 memset(buf, 0, sz);
 191         } while (next_idx != 0xFF);
 192
 193         free(buf);
 194         return (0);
 195 }
 196
 197 static struct _s_x nat64statscmds[] = {
 198       { "reset",        TOK_RESET },
 199       { NULL, 0 }
 200 };
 201
 202 static void
 203 ipfw_nat64lsn_stats_handler(const char *name, uint8_t set, int ac, char *av[])
 204 {
 205         int tcmd;
 206
 207         if (ac == 0) {
 208                 nat64lsn_stats(name, set);
 209                 return;
 210         }
 211         NEED1("nat64lsn stats needs command");
 212         tcmd = get_token(nat64statscmds, *av, "nat64lsn stats command");
 213         switch (tcmd) {
 214         case TOK_RESET:
 215                 nat64lsn_reset_stats(name, set);
 216         }
 217 }
 218
 219 static struct _s_x nat64listcmds[] = {
 220       { "states",       TOK_STATES },
 221       { "config",       TOK_CONFIG },
 222       { NULL, 0 }
 223 };
 224
 225 static void
 226 ipfw_nat64lsn_list_handler(const char *name, uint8_t set, int ac, char *av[])
 227 {
 228         int tcmd;
 229
 230         if (ac == 0) {
 231                 nat64lsn_foreach(nat64lsn_show_cb, name, set, 1);
 232                 return;
 233         }
 234         NEED1("nat64lsn list needs command");
 235         tcmd = get_token(nat64listcmds, *av, "nat64lsn list command");
 236         switch (tcmd) {
 237         case TOK_STATES:
 238                 nat64lsn_foreach(nat64lsn_states_cb, name, set, 1);
 239                 break;
 240         case TOK_CONFIG:
 241                 nat64lsn_foreach(nat64lsn_show_cb, name, set, 1);
 242         }
 243 }
 244
 245 /*
 246  * This one handles all nat64lsn-related commands
 247  *      ipfw [set N] nat64lsn NAME {create | config} ...
 248  *      ipfw [set N] nat64lsn NAME stats
 249  *      ipfw [set N] nat64lsn {NAME | all} destroy
 250  *      ipfw [set N] nat64lsn {NAME | all} {list | show} [config | states]
 251  */
 252 #define nat64lsn_check_name     table_check_name
 253 void
 254 ipfw_nat64lsn_handler(int ac, char *av[])
 255 {
 256         const char *name;
 257         int tcmd;
 258         uint8_t set;
 259
 260         if (g_co.use_set != 0)
 261                 set = g_co.use_set - 1;
 262         else
 263                 set = 0;
 264         ac--; av++;
 265
 266         NEED1("nat64lsn needs instance name");
 267         name = *av;
 268         if (nat64lsn_check_name(name) != 0) {
 269                 if (strcmp(name, "all") == 0)
 270                         name = NULL;
 271                 else
 272                         errx(EX_USAGE, "nat64lsn instance name %s is invalid",
 273                             name);
 274         }
 275         ac--; av++;
 276         NEED1("nat64lsn needs command");
 277
 278         tcmd = get_token(nat64cmds, *av, "nat64lsn command");
 279         if (name == NULL && tcmd != TOK_DESTROY && tcmd != TOK_LIST)
 280                 errx(EX_USAGE, "nat64lsn instance name required");
 281         switch (tcmd) {
 282         case TOK_CREATE:
 283                 ac--; av++;
 284                 nat64lsn_create(name, set, ac, av);
 285                 break;
 286         case TOK_CONFIG:
 287                 ac--; av++;
 288                 nat64lsn_config(name, set, ac, av);
 289                 break;
 290         case TOK_LIST:
 291                 ac--; av++;
 292                 ipfw_nat64lsn_list_handler(name, set, ac, av);
 293                 break;
 294         case TOK_DESTROY:
 295                 if (name == NULL)
 296                         nat64lsn_foreach(nat64lsn_destroy_cb, NULL, set, 0);
 297                 else
 298                         nat64lsn_destroy(name, set);
 299                 break;
 300         case TOK_STATS:
 301                 ac--; av++;
 302                 ipfw_nat64lsn_stats_handler(name, set, ac, av);
 303         }
 304 }
 305
 306 static void
 307 nat64lsn_fill_ntlv(ipfw_obj_ntlv *ntlv, const char *name, uint8_t set)
 308 {
 309
 310         ntlv->head.type = IPFW_TLV_EACTION_NAME(1); /* it doesn't matter */
 311         ntlv->head.length = sizeof(ipfw_obj_ntlv);
 312         ntlv->idx = 1;
 313         ntlv->set = set;
 314         strlcpy(ntlv->name, name, sizeof(ntlv->name));
 315 }
 316
 317 static void
 318 nat64lsn_apply_mask(int af, void *prefix, uint16_t plen)
 319 {
 320         struct in6_addr mask6, *p6;
 321         struct in_addr mask4, *p4;
 322
 323         if (af == AF_INET) {
 324                 p4 = (struct in_addr *)prefix;
 325                 mask4.s_addr = htonl(~((1 << (32 - plen)) - 1));
 326                 p4->s_addr &= mask4.s_addr;
 327         } else if (af == AF_INET6) {
 328                 p6 = (struct in6_addr *)prefix;
 329                 n2mask(&mask6, plen);
 330                 APPLY_MASK(p6, &mask6);
 331         }
 332 }
 333
 334 static void
 335 nat64lsn_parse_prefix(const char *arg, int af, void *prefix, uint16_t *plen)
 336 {
 337         char *p, *l;
 338
 339         p = strdup(arg);
 340         if (p == NULL)
 341                 err(EX_OSERR, NULL);
 342         if ((l = strchr(p, '/')) != NULL)
 343                 *l++ = '\0';
 344         if (l == NULL)
 345                 errx(EX_USAGE, "Prefix length required");
 346         if (inet_pton(af, p, prefix) != 1)
 347                 errx(EX_USAGE, "Bad prefix: %s", p);
 348         *plen = (uint16_t)strtol(l, &l, 10);
 349         if (*l != '\0' || *plen == 0 || (af == AF_INET && *plen > 32) ||
 350             (af == AF_INET6 && *plen > 96))
 351                 errx(EX_USAGE, "Bad prefix length: %s", arg);
 352         nat64lsn_apply_mask(af, prefix, *plen);
 353         free(p);
 354 }
 355
 356 static uint32_t
 357 nat64lsn_parse_int(const char *arg, const char *desc)
 358 {
 359         char *p;
 360         uint32_t val;
 361
 362         val = (uint32_t)strtol(arg, &p, 10);
 363         if (*p != '\0')
 364                 errx(EX_USAGE, "Invalid %s value: %s\n", desc, arg);
 365         return (val);
 366 }
 367
 368 static struct _s_x nat64newcmds[] = {
 369       { "prefix6",      TOK_PREFIX6 },
 370       { "jmaxlen",      TOK_JMAXLEN },
 371       { "prefix4",      TOK_PREFIX4 },
 372       { "host_del_age", TOK_HOST_DEL_AGE },
 373       { "pg_del_age",   TOK_PG_DEL_AGE },
 374       { "tcp_syn_age",  TOK_TCP_SYN_AGE },
 375       { "tcp_close_age",TOK_TCP_CLOSE_AGE },
 376       { "tcp_est_age",  TOK_TCP_EST_AGE },
 377       { "udp_age",      TOK_UDP_AGE },
 378       { "icmp_age",     TOK_ICMP_AGE },
 379       { "states_chunks",TOK_STATES_CHUNKS },
 380       { "log",          TOK_LOG },
 381       { "-log",         TOK_LOGOFF },
 382       { "allow_private", TOK_PRIVATE },
 383       { "-allow_private", TOK_PRIVATEOFF },
 384       /* for compatibility with old configurations */
 385       { "max_ports",    TOK_MAX_PORTS },        /* unused */
 386       { NULL, 0 }
 387 };
 388
 389 /*
 390  * Creates new nat64lsn instance
 391  * ipfw nat64lsn <NAME> create
 392  *     [ max_ports <N> ]
 393  * Request: [ ipfw_obj_lheader ipfw_nat64lsn_cfg ]
 394  */
 395 #define NAT64LSN_HAS_PREFIX4    0x01
 396 #define NAT64LSN_HAS_PREFIX6    0x02
 397 static void
 398 nat64lsn_create(const char *name, uint8_t set, int ac, char **av)
 399 {
 400         char buf[sizeof(ipfw_obj_lheader) + sizeof(ipfw_nat64lsn_cfg)];
 401         ipfw_nat64lsn_cfg *cfg;
 402         ipfw_obj_lheader *olh;
 403         int tcmd, flags;
 404         char *opt;
 405
 406         memset(&buf, 0, sizeof(buf));
 407         olh = (ipfw_obj_lheader *)buf;
 408         cfg = (ipfw_nat64lsn_cfg *)(olh + 1);
 409
 410         /* Some reasonable defaults */
 411         inet_pton(AF_INET6, "64:ff9b::", &cfg->prefix6);
 412         cfg->plen6 = 96;
 413         cfg->set = set;
 414         cfg->max_ports = NAT64LSN_MAX_PORTS;
 415         cfg->jmaxlen = NAT64LSN_JMAXLEN;
 416         cfg->nh_delete_delay = NAT64LSN_HOST_AGE;
 417         cfg->pg_delete_delay = NAT64LSN_PG_AGE;
 418         cfg->st_syn_ttl = NAT64LSN_TCP_SYN_AGE;
 419         cfg->st_estab_ttl = NAT64LSN_TCP_EST_AGE;
 420         cfg->st_close_ttl = NAT64LSN_TCP_FIN_AGE;
 421         cfg->st_udp_ttl = NAT64LSN_UDP_AGE;
 422         cfg->st_icmp_ttl = NAT64LSN_ICMP_AGE;
 423         flags = NAT64LSN_HAS_PREFIX6;
 424         while (ac > 0) {
 425                 tcmd = get_token(nat64newcmds, *av, "option");
 426                 opt = *av;
 427                 ac--; av++;
 428
 429                 switch (tcmd) {
 430                 case TOK_PREFIX4:
 431                         NEED1("IPv4 prefix required");
 432                         nat64lsn_parse_prefix(*av, AF_INET, &cfg->prefix4,
 433                             &cfg->plen4);
 434                         flags |= NAT64LSN_HAS_PREFIX4;
 435                         ac--; av++;
 436                         break;
 437                 case TOK_PREFIX6:
 438                         NEED1("IPv6 prefix required");
 439                         nat64lsn_parse_prefix(*av, AF_INET6, &cfg->prefix6,
 440                             &cfg->plen6);
 441                         if (ipfw_check_nat64prefix(&cfg->prefix6,
 442                             cfg->plen6) != 0 &&
 443                             !IN6_IS_ADDR_UNSPECIFIED(&cfg->prefix6))
 444                                 errx(EX_USAGE, "Bad prefix6 %s", *av);
 445
 446                         ac--; av++;
 447                         break;
 448                 case TOK_JMAXLEN:
 449                         NEED1("job queue length required");
 450                         cfg->jmaxlen = nat64lsn_parse_int(*av, opt);
 451                         ac--; av++;
 452                         break;
 453                 case TOK_MAX_PORTS:
 454                         NEED1("Max per-user ports required");
 455                         cfg->max_ports = nat64lsn_parse_int(*av, opt);
 456                         ac--; av++;
 457                         break;
 458                 case TOK_HOST_DEL_AGE:
 459                         NEED1("host delete delay required");
 460                         cfg->nh_delete_delay = (uint16_t)nat64lsn_parse_int(
 461                             *av, opt);
 462                         ac--; av++;
 463                         break;
 464                 case TOK_PG_DEL_AGE:
 465                         NEED1("portgroup delete delay required");
 466                         cfg->pg_delete_delay = (uint16_t)nat64lsn_parse_int(
 467                             *av, opt);
 468                         ac--; av++;
 469                         break;
 470                 case TOK_TCP_SYN_AGE:
 471                         NEED1("tcp syn age required");
 472                         cfg->st_syn_ttl = (uint16_t)nat64lsn_parse_int(
 473                             *av, opt);
 474                         ac--; av++;
 475                         break;
 476                 case TOK_TCP_CLOSE_AGE:
 477                         NEED1("tcp close age required");
 478                         cfg->st_close_ttl = (uint16_t)nat64lsn_parse_int(
 479                             *av, opt);
 480                         ac--; av++;
 481                         break;
 482                 case TOK_TCP_EST_AGE:
 483                         NEED1("tcp est age required");
 484                         cfg->st_estab_ttl = (uint16_t)nat64lsn_parse_int(
 485                             *av, opt);
 486                         ac--; av++;
 487                         break;
 488                 case TOK_UDP_AGE:
 489                         NEED1("udp age required");
 490                         cfg->st_udp_ttl = (uint16_t)nat64lsn_parse_int(
 491                             *av, opt);
 492                         ac--; av++;
 493                         break;
 494                 case TOK_ICMP_AGE:
 495                         NEED1("icmp age required");
 496                         cfg->st_icmp_ttl = (uint16_t)nat64lsn_parse_int(
 497                             *av, opt);
 498                         ac--; av++;
 499                         break;
 500                 case TOK_STATES_CHUNKS:
 501                         NEED1("number of chunks required");
 502                         cfg->states_chunks = (uint8_t)nat64lsn_parse_int(
 503                             *av, opt);
 504                         ac--; av++;
 505                         break;
 506                 case TOK_LOG:
 507                         cfg->flags |= NAT64_LOG;
 508                         break;
 509                 case TOK_LOGOFF:
 510                         cfg->flags &= ~NAT64_LOG;
 511                         break;
 512                 case TOK_PRIVATE:
 513                         cfg->flags |= NAT64_ALLOW_PRIVATE;
 514                         break;
 515                 case TOK_PRIVATEOFF:
 516                         cfg->flags &= ~NAT64_ALLOW_PRIVATE;
 517                         break;
 518                 }
 519         }
 520
 521         /* Check validness */
 522         if ((flags & NAT64LSN_HAS_PREFIX4) != NAT64LSN_HAS_PREFIX4)
 523                 errx(EX_USAGE, "prefix4 required");
 524
 525         olh->count = 1;
 526         olh->objsize = sizeof(*cfg);
 527         olh->size = sizeof(buf);
 528         strlcpy(cfg->name, name, sizeof(cfg->name));
 529         if (do_set3(IP_FW_NAT64LSN_CREATE, &olh->opheader, sizeof(buf)) != 0)
 530                 err(EX_OSERR, "nat64lsn instance creation failed");
 531 }
 532
 533 /*
 534  * Configures existing nat64lsn instance
 535  * ipfw nat64lsn <NAME> config <options>
 536  * Request: [ ipfw_obj_header ipfw_nat64lsn_cfg ]
 537  */
 538 static void
 539 nat64lsn_config(const char *name, uint8_t set, int ac, char **av)
 540 {
 541         char buf[sizeof(ipfw_obj_header) + sizeof(ipfw_nat64lsn_cfg)];
 542         ipfw_nat64lsn_cfg *cfg;
 543         ipfw_obj_header *oh;
 544         size_t sz;
 545         char *opt;
 546         int tcmd;
 547
 548         if (ac == 0)
 549                 errx(EX_USAGE, "config options required");
 550         memset(&buf, 0, sizeof(buf));
 551         oh = (ipfw_obj_header *)buf;
 552         cfg = (ipfw_nat64lsn_cfg *)(oh + 1);
 553         sz = sizeof(buf);
 554
 555         nat64lsn_fill_ntlv(&oh->ntlv, name, set);
 556         if (do_get3(IP_FW_NAT64LSN_CONFIG, &oh->opheader, &sz) != 0)
 557                 err(EX_OSERR, "failed to get config for instance %s", name);
 558
 559         while (ac > 0) {
 560                 tcmd = get_token(nat64newcmds, *av, "option");
 561                 opt = *av;
 562                 ac--; av++;
 563
 564                 switch (tcmd) {
 565                 case TOK_MAX_PORTS:
 566                         NEED1("Max per-user ports required");
 567                         cfg->max_ports = nat64lsn_parse_int(*av, opt);
 568                         ac--; av++;
 569                         break;
 570                 case TOK_JMAXLEN:
 571                         NEED1("job queue length required");
 572                         cfg->jmaxlen = nat64lsn_parse_int(*av, opt);
 573                         ac--; av++;
 574                         break;
 575                 case TOK_HOST_DEL_AGE:
 576                         NEED1("host delete delay required");
 577                         cfg->nh_delete_delay = (uint16_t)nat64lsn_parse_int(
 578                             *av, opt);
 579                         ac--; av++;
 580                         break;
 581                 case TOK_PG_DEL_AGE:
 582                         NEED1("portgroup delete delay required");
 583                         cfg->pg_delete_delay = (uint16_t)nat64lsn_parse_int(
 584                             *av, opt);
 585                         ac--; av++;
 586                         break;
 587                 case TOK_TCP_SYN_AGE:
 588                         NEED1("tcp syn age required");
 589                         cfg->st_syn_ttl = (uint16_t)nat64lsn_parse_int(
 590                             *av, opt);
 591                         ac--; av++;
 592                         break;
 593                 case TOK_TCP_CLOSE_AGE:
 594                         NEED1("tcp close age required");
 595                         cfg->st_close_ttl = (uint16_t)nat64lsn_parse_int(
 596                             *av, opt);
 597                         ac--; av++;
 598                         break;
 599                 case TOK_TCP_EST_AGE:
 600                         NEED1("tcp est age required");
 601                         cfg->st_estab_ttl = (uint16_t)nat64lsn_parse_int(
 602                             *av, opt);
 603                         ac--; av++;
 604                         break;
 605                 case TOK_UDP_AGE:
 606                         NEED1("udp age required");
 607                         cfg->st_udp_ttl = (uint16_t)nat64lsn_parse_int(
 608                             *av, opt);
 609                         ac--; av++;
 610                         break;
 611                 case TOK_ICMP_AGE:
 612                         NEED1("icmp age required");
 613                         cfg->st_icmp_ttl = (uint16_t)nat64lsn_parse_int(
 614                             *av, opt);
 615                         ac--; av++;
 616                         break;
 617                 case TOK_STATES_CHUNKS:
 618                         NEED1("number of chunks required");
 619                         cfg->states_chunks = (uint8_t)nat64lsn_parse_int(
 620                             *av, opt);
 621                         ac--; av++;
 622                         break;
 623                 case TOK_LOG:
 624                         cfg->flags |= NAT64_LOG;
 625                         break;
 626                 case TOK_LOGOFF:
 627                         cfg->flags &= ~NAT64_LOG;
 628                         break;
 629                 case TOK_PRIVATE:
 630                         cfg->flags |= NAT64_ALLOW_PRIVATE;
 631                         break;
 632                 case TOK_PRIVATEOFF:
 633                         cfg->flags &= ~NAT64_ALLOW_PRIVATE;
 634                         break;
 635                 default:
 636                         errx(EX_USAGE, "Can't change %s option", opt);
 637                 }
 638         }
 639
 640         if (do_set3(IP_FW_NAT64LSN_CONFIG, &oh->opheader, sizeof(buf)) != 0)
 641                 err(EX_OSERR, "nat64lsn instance configuration failed");
 642 }
 643
 644 /*
 645  * Reset nat64lsn instance statistics specified by @oh->ntlv.
 646  * Request: [ ipfw_obj_header ]
 647  */
 648 static void
 649 nat64lsn_reset_stats(const char *name, uint8_t set)
 650 {
 651         ipfw_obj_header oh;
 652
 653         memset(&oh, 0, sizeof(oh));
 654         nat64lsn_fill_ntlv(&oh.ntlv, name, set);
 655         if (do_set3(IP_FW_NAT64LSN_RESET_STATS, &oh.opheader, sizeof(oh)) != 0)
 656                 err(EX_OSERR, "failed to reset stats for instance %s", name);
 657 }
 658
 659 /*
 660  * Destroys nat64lsn instance specified by @oh->ntlv.
 661  * Request: [ ipfw_obj_header ]
 662  */
 663 static void
 664 nat64lsn_destroy(const char *name, uint8_t set)
 665 {
 666         ipfw_obj_header oh;
 667
 668         memset(&oh, 0, sizeof(oh));
 669         nat64lsn_fill_ntlv(&oh.ntlv, name, set);
 670         if (do_set3(IP_FW_NAT64LSN_DESTROY, &oh.opheader, sizeof(oh)) != 0)
 671                 err(EX_OSERR, "failed to destroy nat instance %s", name);
 672 }
 673
 674 /*
 675  * Get nat64lsn instance statistics.
 676  * Request: [ ipfw_obj_header ]
 677  * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ] ]
 678  */
 679 static int
 680 nat64lsn_get_stats(const char *name, uint8_t set,
 681     struct ipfw_nat64lsn_stats *stats)
 682 {
 683         ipfw_obj_header *oh;
 684         ipfw_obj_ctlv *oc;
 685         size_t sz;
 686
 687         sz = sizeof(*oh) + sizeof(*oc) + sizeof(*stats);
 688         oh = calloc(1, sz);
 689         nat64lsn_fill_ntlv(&oh->ntlv, name, set);
 690         if (do_get3(IP_FW_NAT64LSN_STATS, &oh->opheader, &sz) == 0) {
 691                 oc = (ipfw_obj_ctlv *)(oh + 1);
 692                 memcpy(stats, oc + 1, sizeof(*stats));
 693                 free(oh);
 694                 return (0);
 695         }
 696         free(oh);
 697         return (-1);
 698 }
 699
 700 static void
 701 nat64lsn_stats(const char *name, uint8_t set)
 702 {
 703         struct ipfw_nat64lsn_stats stats;
 704
 705         if (nat64lsn_get_stats(name, set, &stats) != 0)
 706                 err(EX_OSERR, "Error retrieving stats");
 707
 708         if (g_co.use_set != 0 || set != 0)
 709                 printf("set %u ", set);
 710         printf("nat64lsn %s\n", name);
 711         printf("\t%ju packets translated from IPv6 to IPv4\n",
 712             (uintmax_t)stats.opcnt64);
 713         printf("\t%ju packets translated from IPv4 to IPv6\n",
 714             (uintmax_t)stats.opcnt46);
 715         printf("\t%ju IPv6 fragments created\n",
 716             (uintmax_t)stats.ofrags);
 717         printf("\t%ju IPv4 fragments received\n",
 718             (uintmax_t)stats.ifrags);
 719         printf("\t%ju output packets dropped due to no bufs, etc.\n",
 720             (uintmax_t)stats.oerrors);
 721         printf("\t%ju output packets discarded due to no IPv4 route\n",
 722             (uintmax_t)stats.noroute4);
 723         printf("\t%ju output packets discarded due to no IPv6 route\n",
 724             (uintmax_t)stats.noroute6);
 725         printf("\t%ju packets discarded due to unsupported protocol\n",
 726             (uintmax_t)stats.noproto);
 727         printf("\t%ju packets discarded due to memory allocation problems\n",
 728             (uintmax_t)stats.nomem);
 729         printf("\t%ju packets discarded due to some errors\n",
 730             (uintmax_t)stats.dropped);
 731         printf("\t%ju packets not matched with IPv4 prefix\n",
 732             (uintmax_t)stats.nomatch4);
 733
 734         printf("\t%ju mbufs queued for post processing\n",
 735             (uintmax_t)stats.jreinjected);
 736         printf("\t%ju times the job queue was processed\n",
 737             (uintmax_t)stats.jcalls);
 738         printf("\t%ju job requests queued\n",
 739             (uintmax_t)stats.jrequests);
 740         printf("\t%ju job requests queue limit reached\n",
 741             (uintmax_t)stats.jmaxlen);
 742         printf("\t%ju job requests failed due to memory allocation problems\n",
 743             (uintmax_t)stats.jnomem);
 744
 745         printf("\t%ju hosts allocated\n", (uintmax_t)stats.hostcount);
 746         printf("\t%ju hosts requested\n", (uintmax_t)stats.jhostsreq);
 747         printf("\t%ju host requests failed\n", (uintmax_t)stats.jhostfails);
 748
 749         printf("\t%ju portgroups requested\n", (uintmax_t)stats.jportreq);
 750         printf("\t%ju portgroups allocated\n", (uintmax_t)stats.spgcreated);
 751         printf("\t%ju portgroups deleted\n", (uintmax_t)stats.spgdeleted);
 752         printf("\t%ju portgroup requests failed\n",
 753             (uintmax_t)stats.jportfails);
 754         printf("\t%ju portgroups allocated for TCP\n",
 755             (uintmax_t)stats.tcpchunks);
 756         printf("\t%ju portgroups allocated for UDP\n",
 757             (uintmax_t)stats.udpchunks);
 758         printf("\t%ju portgroups allocated for ICMP\n",
 759             (uintmax_t)stats.icmpchunks);
 760
 761         printf("\t%ju states created\n", (uintmax_t)stats.screated);
 762         printf("\t%ju states deleted\n", (uintmax_t)stats.sdeleted);
 763 }
 764
 765 static int
 766 nat64lsn_show_cb(ipfw_nat64lsn_cfg *cfg, const char *name, uint8_t set)
 767 {
 768         char abuf[INET6_ADDRSTRLEN];
 769
 770         if (name != NULL && strcmp(cfg->name, name) != 0)
 771                 return (ESRCH);
 772
 773         if (g_co.use_set != 0 && cfg->set != set)
 774                 return (ESRCH);
 775
 776         if (g_co.use_set != 0 || cfg->set != 0)
 777                 printf("set %u ", cfg->set);
 778         inet_ntop(AF_INET, &cfg->prefix4, abuf, sizeof(abuf));
 779         printf("nat64lsn %s prefix4 %s/%u", cfg->name, abuf, cfg->plen4);
 780         inet_ntop(AF_INET6, &cfg->prefix6, abuf, sizeof(abuf));
 781         printf(" prefix6 %s/%u", abuf, cfg->plen6);
 782         if (g_co.verbose || cfg->states_chunks > 1)
 783                 printf(" states_chunks %u", cfg->states_chunks);
 784         if (g_co.verbose || cfg->nh_delete_delay != NAT64LSN_HOST_AGE)
 785                 printf(" host_del_age %u", cfg->nh_delete_delay);
 786         if (g_co.verbose || cfg->pg_delete_delay != NAT64LSN_PG_AGE)
 787                 printf(" pg_del_age %u", cfg->pg_delete_delay);
 788         if (g_co.verbose || cfg->st_syn_ttl != NAT64LSN_TCP_SYN_AGE)
 789                 printf(" tcp_syn_age %u", cfg->st_syn_ttl);
 790         if (g_co.verbose || cfg->st_close_ttl != NAT64LSN_TCP_FIN_AGE)
 791                 printf(" tcp_close_age %u", cfg->st_close_ttl);
 792         if (g_co.verbose || cfg->st_estab_ttl != NAT64LSN_TCP_EST_AGE)
 793                 printf(" tcp_est_age %u", cfg->st_estab_ttl);
 794         if (g_co.verbose || cfg->st_udp_ttl != NAT64LSN_UDP_AGE)
 795                 printf(" udp_age %u", cfg->st_udp_ttl);
 796         if (g_co.verbose || cfg->st_icmp_ttl != NAT64LSN_ICMP_AGE)
 797                 printf(" icmp_age %u", cfg->st_icmp_ttl);
 798         if (g_co.verbose || cfg->jmaxlen != NAT64LSN_JMAXLEN)
 799                 printf(" jmaxlen %u", cfg->jmaxlen);
 800         if (cfg->flags & NAT64_LOG)
 801                 printf(" log");
 802         if (cfg->flags & NAT64_ALLOW_PRIVATE)
 803                 printf(" allow_private");
 804         printf("\n");
 805         return (0);
 806 }
 807
 808 static int
 809 nat64lsn_destroy_cb(ipfw_nat64lsn_cfg *cfg, const char *name __unused,
 810     uint8_t set)
 811 {
 812
 813         if (g_co.use_set != 0 && cfg->set != set)
 814                 return (ESRCH);
 815
 816         nat64lsn_destroy(cfg->name, cfg->set);
 817         return (0);
 818 }
 819
 820
 821 /*
 822  * Compare nat64lsn instances names.
 823  * Honor number comparison.
 824  */
 825 static int
 826 nat64name_cmp(const void *a, const void *b)
 827 {
 828         const ipfw_nat64lsn_cfg *ca, *cb;
 829
 830         ca = (const ipfw_nat64lsn_cfg *)a;
 831         cb = (const ipfw_nat64lsn_cfg *)b;
 832
 833         if (ca->set > cb->set)
 834                 return (1);
 835         else if (ca->set < cb->set)
 836                 return (-1);
 837         return (stringnum_cmp(ca->name, cb->name));
 838 }
 839
 840 /*
 841  * Retrieves nat64lsn instance list from kernel,
 842  * optionally sorts it and calls requested function for each instance.
 843  *
 844  * Request: [ ipfw_obj_lheader ]
 845  * Reply: [ ipfw_obj_lheader ipfw_nat64lsn_cfg x N ]
 846  */
 847 static int
 848 nat64lsn_foreach(nat64lsn_cb_t *f, const char *name, uint8_t set,  int sort)
 849 {
 850         ipfw_obj_lheader *olh;
 851         ipfw_nat64lsn_cfg *cfg;
 852         size_t sz;
 853         uint32_t i;
 854
 855         /* Start with reasonable default */
 856         sz = sizeof(*olh) + 16 * sizeof(ipfw_nat64lsn_cfg);
 857
 858         for (;;) {
 859                 if ((olh = calloc(1, sz)) == NULL)
 860                         return (ENOMEM);
 861
 862                 olh->size = sz;
 863                 if (do_get3(IP_FW_NAT64LSN_LIST, &olh->opheader, &sz) != 0) {
 864                         sz = olh->size;
 865                         free(olh);
 866                         if (errno != ENOMEM)
 867                                 return (errno);
 868                         continue;
 869                 }
 870
 871                 if (sort != 0)
 872                         qsort(olh + 1, olh->count, olh->objsize,
 873                             nat64name_cmp);
 874
 875                 cfg = (ipfw_nat64lsn_cfg *)(olh + 1);
 876                 for (i = 0; i < olh->count; i++) {
 877                         (void)f(cfg, name, set); /* Ignore errors for now */
 878                         cfg = (ipfw_nat64lsn_cfg *)((caddr_t)cfg +
 879                             olh->objsize);
 880                 }
 881                 free(olh);
 882                 break;
 883         }
 884         return (0);
 885 }
 886