sbin/ipfw/nat64lsn.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
   3  *
   4  * Copyright (c) 2015-2019 Yandex LLC
   5  * Copyright (c) 2015-2016 Alexander V. Chernikov <melifaro@FreeBSD.org>
   6  * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org>
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  */
  29
  30 #include <sys/cdefs.h>
  31 __FBSDID("$FreeBSD$");
  32
  33 #include <sys/types.h>
  34 #include <sys/socket.h>
  35
  36 #include "ipfw2.h"
  37
  38 #include <ctype.h>
  39 #include <err.h>
  40 #include <errno.h>
  41 #include <inttypes.h>
  42 #include <netdb.h>
  43 #include <stdio.h>
  44 #include <stdlib.h>
  45 #include <string.h>
  46 #include <sysexits.h>
  47
  48 #include <net/if.h>
  49 #include <netinet/in.h>
  50 #include <netinet/ip_fw.h>
  51 #include <netinet6/ip_fw_nat64.h>
  52 #include <arpa/inet.h>
  53
  54 static void nat64lsn_fill_ntlv(ipfw_obj_ntlv *ntlv, const char *name,
  55     uint8_t set);
  56 typedef int (nat64lsn_cb_t)(ipfw_nat64lsn_cfg *cfg, const char *name,
  57     uint8_t set);
  58 static int nat64lsn_foreach(nat64lsn_cb_t *f, const char *name, uint8_t set,
  59     int sort);
  60
  61 static void nat64lsn_create(const char *name, uint8_t set, int ac, char **av);
  62 static void nat64lsn_config(const char *name, uint8_t set, int ac, char **av);
  63 static void nat64lsn_destroy(const char *name, uint8_t set);
  64 static void nat64lsn_stats(const char *name, uint8_t set);
  65 static void nat64lsn_reset_stats(const char *name, uint8_t set);
  66 static int nat64lsn_show_cb(ipfw_nat64lsn_cfg *cfg, const char *name,
  67     uint8_t set);
  68 static int nat64lsn_destroy_cb(ipfw_nat64lsn_cfg *cfg, const char *name,
  69     uint8_t set);
  70 static int nat64lsn_states_cb(ipfw_nat64lsn_cfg *cfg, const char *name,
  71     uint8_t set);
  72
  73 static struct _s_x nat64cmds[] = {
  74       { "create",       TOK_CREATE },
  75       { "config",       TOK_CONFIG },
  76       { "destroy",      TOK_DESTROY },
  77       { "list",         TOK_LIST },
  78       { "show",         TOK_LIST },
  79       { "stats",        TOK_STATS },
  80       { NULL, 0 }
  81 };
  82
  83 static uint64_t
  84 nat64lsn_print_states(void *buf)
  85 {
  86         char s[INET6_ADDRSTRLEN], a[INET_ADDRSTRLEN], f[INET_ADDRSTRLEN];
  87         const char *proto;
  88         char sflags[4], *sf;
  89         ipfw_obj_header *oh;
  90         ipfw_obj_data *od;
  91         ipfw_nat64lsn_stg_v1 *stg;
  92         ipfw_nat64lsn_state_v1 *ste;
  93         uint64_t next_idx;
  94         uint32_t i;
  95         int sz;
  96
  97         oh = (ipfw_obj_header *)buf;
  98         od = (ipfw_obj_data *)(oh + 1);
  99         stg = (ipfw_nat64lsn_stg_v1 *)(od + 1);
 100         sz = od->head.length - sizeof(*od);
 101         next_idx = 0;
 102         proto = NULL;
 103         while (sz > 0 && next_idx != 0xFF) {
 104                 next_idx = stg->next.index;
 105                 sz -= sizeof(*stg);
 106                 if (stg->count == 0) {
 107                         stg++;
 108                         continue;
 109                 }
 110                 /*
 111                  * NOTE: addresses are in network byte order,
 112                  * ports are in host byte order.
 113                  */
 114                 inet_ntop(AF_INET, &stg->alias4, a, sizeof(a));
 115                 ste = (ipfw_nat64lsn_state_v1 *)(stg + 1);
 116                 for (i = 0; i < stg->count && sz > 0; i++) {
 117                         sf = sflags;
 118                         inet_ntop(AF_INET6, &ste->host6, s, sizeof(s));
 119                         inet_ntop(AF_INET, &ste->daddr, f, sizeof(f));
 120                         switch (ste->proto) {
 121                         case IPPROTO_TCP:
 122                                 proto = "TCP";
 123                                 if (ste->flags & 0x02)
 124                                         *sf++ = 'S';
 125                                 if (ste->flags & 0x04)
 126                                         *sf++ = 'E';
 127                                 if (ste->flags & 0x01)
 128                                         *sf++ = 'F';
 129                                 break;
 130                         case IPPROTO_UDP:
 131                                 proto = "UDP";
 132                                 break;
 133                         case IPPROTO_ICMP:
 134                                 proto = "ICMPv6";
 135                                 break;
 136                         }
 137                         *sf = '\0';
 138                         switch (ste->proto) {
 139                         case IPPROTO_TCP:
 140                         case IPPROTO_UDP:
 141                                 printf("%s:%d\t%s:%d\t%s\t%s\t%d\t%s:%d\n",
 142                                     s, ste->sport, a, ste->aport, proto,
 143                                     sflags, ste->idle, f, ste->dport);
 144                                 break;
 145                         case IPPROTO_ICMP:
 146                                 printf("%s\t%s\t%s\t\t%d\t%s\n",
 147                                     s, a, proto, ste->idle, f);
 148                                 break;
 149                         default:
 150                                 printf("%s\t%s\t%d\t\t%d\t%s\n",
 151                                     s, a, ste->proto, ste->idle, f);
 152                         }
 153                         ste++;
 154                         sz -= sizeof(*ste);
 155                 }
 156                 stg = (ipfw_nat64lsn_stg_v1 *)ste;
 157         }
 158         return (next_idx);
 159 }
 160
 161 static int
 162 nat64lsn_states_cb(ipfw_nat64lsn_cfg *cfg, const char *name, uint8_t set)
 163 {
 164         ipfw_obj_header *oh;
 165         ipfw_obj_data *od;
 166         void *buf;
 167         uint64_t next_idx;
 168         size_t sz;
 169
 170         if (name != NULL && strcmp(cfg->name, name) != 0)
 171                 return (ESRCH);
 172
 173         if (set != 0 && cfg->set != set)
 174                 return (ESRCH);
 175
 176         next_idx = 0;
 177         sz = 4096;
 178         if ((buf = calloc(1, sz)) == NULL)
 179                 err(EX_OSERR, NULL);
 180         do {
 181                 oh = (ipfw_obj_header *)buf;
 182                 oh->opheader.version = 1; /* Force using ov new API */
 183                 od = (ipfw_obj_data *)(oh + 1);
 184                 nat64lsn_fill_ntlv(&oh->ntlv, cfg->name, set);
 185                 od->head.type = IPFW_TLV_OBJDATA;
 186                 od->head.length = sizeof(*od) + sizeof(next_idx);
 187                 *((uint64_t *)(od + 1)) = next_idx;
 188                 if (do_get3(IP_FW_NAT64LSN_LIST_STATES, &oh->opheader, &sz))
 189                         err(EX_OSERR, "Error reading nat64lsn states");
 190                 next_idx = nat64lsn_print_states(buf);
 191                 sz = 4096;
 192                 memset(buf, 0, sz);
 193         } while (next_idx != 0xFF);
 194
 195         free(buf);
 196         return (0);
 197 }
 198
 199 static struct _s_x nat64statscmds[] = {
 200       { "reset",        TOK_RESET },
 201       { NULL, 0 }
 202 };
 203
 204 static void
 205 ipfw_nat64lsn_stats_handler(const char *name, uint8_t set, int ac, char *av[])
 206 {
 207         int tcmd;
 208
 209         if (ac == 0) {
 210                 nat64lsn_stats(name, set);
 211                 return;
 212         }
 213         NEED1("nat64lsn stats needs command");
 214         tcmd = get_token(nat64statscmds, *av, "nat64lsn stats command");
 215         switch (tcmd) {
 216         case TOK_RESET:
 217                 nat64lsn_reset_stats(name, set);
 218         }
 219 }
 220
 221 static struct _s_x nat64listcmds[] = {
 222       { "states",       TOK_STATES },
 223       { "config",       TOK_CONFIG },
 224       { NULL, 0 }
 225 };
 226
 227 static void
 228 ipfw_nat64lsn_list_handler(const char *name, uint8_t set, int ac, char *av[])
 229 {
 230         int tcmd;
 231
 232         if (ac == 0) {
 233                 nat64lsn_foreach(nat64lsn_show_cb, name, set, 1);
 234                 return;
 235         }
 236         NEED1("nat64lsn list needs command");
 237         tcmd = get_token(nat64listcmds, *av, "nat64lsn list command");
 238         switch (tcmd) {
 239         case TOK_STATES:
 240                 nat64lsn_foreach(nat64lsn_states_cb, name, set, 1);
 241                 break;
 242         case TOK_CONFIG:
 243                 nat64lsn_foreach(nat64lsn_show_cb, name, set, 1);
 244         }
 245 }
 246
 247 /*
 248  * This one handles all nat64lsn-related commands
 249  *      ipfw [set N] nat64lsn NAME {create | config} ...
 250  *      ipfw [set N] nat64lsn NAME stats
 251  *      ipfw [set N] nat64lsn {NAME | all} destroy
 252  *      ipfw [set N] nat64lsn {NAME | all} {list | show} [config | states]
 253  */
 254 #define nat64lsn_check_name     table_check_name
 255 void
 256 ipfw_nat64lsn_handler(int ac, char *av[])
 257 {
 258         const char *name;
 259         int tcmd;
 260         uint8_t set;
 261
 262         if (g_co.use_set != 0)
 263                 set = g_co.use_set - 1;
 264         else
 265                 set = 0;
 266         ac--; av++;
 267
 268         NEED1("nat64lsn needs instance name");
 269         name = *av;
 270         if (nat64lsn_check_name(name) != 0) {
 271                 if (strcmp(name, "all") == 0)
 272                         name = NULL;
 273                 else
 274                         errx(EX_USAGE, "nat64lsn instance name %s is invalid",
 275                             name);
 276         }
 277         ac--; av++;
 278         NEED1("nat64lsn needs command");
 279
 280         tcmd = get_token(nat64cmds, *av, "nat64lsn command");
 281         if (name == NULL && tcmd != TOK_DESTROY && tcmd != TOK_LIST)
 282                 errx(EX_USAGE, "nat64lsn instance name required");
 283         switch (tcmd) {
 284         case TOK_CREATE:
 285                 ac--; av++;
 286                 nat64lsn_create(name, set, ac, av);
 287                 break;
 288         case TOK_CONFIG:
 289                 ac--; av++;
 290                 nat64lsn_config(name, set, ac, av);
 291                 break;
 292         case TOK_LIST:
 293                 ac--; av++;
 294                 ipfw_nat64lsn_list_handler(name, set, ac, av);
 295                 break;
 296         case TOK_DESTROY:
 297                 if (name == NULL)
 298                         nat64lsn_foreach(nat64lsn_destroy_cb, NULL, set, 0);
 299                 else
 300                         nat64lsn_destroy(name, set);
 301                 break;
 302         case TOK_STATS:
 303                 ac--; av++;
 304                 ipfw_nat64lsn_stats_handler(name, set, ac, av);
 305         }
 306 }
 307
 308 static void
 309 nat64lsn_fill_ntlv(ipfw_obj_ntlv *ntlv, const char *name, uint8_t set)
 310 {
 311
 312         ntlv->head.type = IPFW_TLV_EACTION_NAME(1); /* it doesn't matter */
 313         ntlv->head.length = sizeof(ipfw_obj_ntlv);
 314         ntlv->idx = 1;
 315         ntlv->set = set;
 316         strlcpy(ntlv->name, name, sizeof(ntlv->name));
 317 }
 318
 319 static void
 320 nat64lsn_apply_mask(int af, void *prefix, uint16_t plen)
 321 {
 322         struct in6_addr mask6, *p6;
 323         struct in_addr mask4, *p4;
 324
 325         if (af == AF_INET) {
 326                 p4 = (struct in_addr *)prefix;
 327                 mask4.s_addr = htonl(~((1 << (32 - plen)) - 1));
 328                 p4->s_addr &= mask4.s_addr;
 329         } else if (af == AF_INET6) {
 330                 p6 = (struct in6_addr *)prefix;
 331                 n2mask(&mask6, plen);
 332                 APPLY_MASK(p6, &mask6);
 333         }
 334 }
 335
 336 static void
 337 nat64lsn_parse_prefix(const char *arg, int af, void *prefix, uint16_t *plen)
 338 {
 339         char *p, *l;
 340
 341         p = strdup(arg);
 342         if (p == NULL)
 343                 err(EX_OSERR, NULL);
 344         if ((l = strchr(p, '/')) != NULL)
 345                 *l++ = '\0';
 346         if (l == NULL)
 347                 errx(EX_USAGE, "Prefix length required");
 348         if (inet_pton(af, p, prefix) != 1)
 349                 errx(EX_USAGE, "Bad prefix: %s", p);
 350         *plen = (uint16_t)strtol(l, &l, 10);
 351         if (*l != '\0' || *plen == 0 || (af == AF_INET && *plen > 32) ||
 352             (af == AF_INET6 && *plen > 96))
 353                 errx(EX_USAGE, "Bad prefix length: %s", arg);
 354         nat64lsn_apply_mask(af, prefix, *plen);
 355         free(p);
 356 }
 357
 358 static uint32_t
 359 nat64lsn_parse_int(const char *arg, const char *desc)
 360 {
 361         char *p;
 362         uint32_t val;
 363
 364         val = (uint32_t)strtol(arg, &p, 10);
 365         if (*p != '\0')
 366                 errx(EX_USAGE, "Invalid %s value: %s\n", desc, arg);
 367         return (val);
 368 }
 369
 370 static struct _s_x nat64newcmds[] = {
 371       { "prefix6",      TOK_PREFIX6 },
 372       { "jmaxlen",      TOK_JMAXLEN },
 373       { "prefix4",      TOK_PREFIX4 },
 374       { "host_del_age", TOK_HOST_DEL_AGE },
 375       { "pg_del_age",   TOK_PG_DEL_AGE },
 376       { "tcp_syn_age",  TOK_TCP_SYN_AGE },
 377       { "tcp_close_age",TOK_TCP_CLOSE_AGE },
 378       { "tcp_est_age",  TOK_TCP_EST_AGE },
 379       { "udp_age",      TOK_UDP_AGE },
 380       { "icmp_age",     TOK_ICMP_AGE },
 381       { "states_chunks",TOK_STATES_CHUNKS },
 382       { "log",          TOK_LOG },
 383       { "-log",         TOK_LOGOFF },
 384       { "allow_private", TOK_PRIVATE },
 385       { "-allow_private", TOK_PRIVATEOFF },
 386       /* for compatibility with old configurations */
 387       { "max_ports",    TOK_MAX_PORTS },        /* unused */
 388       { NULL, 0 }
 389 };
 390
 391 /*
 392  * Creates new nat64lsn instance
 393  * ipfw nat64lsn <NAME> create
 394  *     [ max_ports <N> ]
 395  * Request: [ ipfw_obj_lheader ipfw_nat64lsn_cfg ]
 396  */
 397 #define NAT64LSN_HAS_PREFIX4    0x01
 398 #define NAT64LSN_HAS_PREFIX6    0x02
 399 static void
 400 nat64lsn_create(const char *name, uint8_t set, int ac, char **av)
 401 {
 402         char buf[sizeof(ipfw_obj_lheader) + sizeof(ipfw_nat64lsn_cfg)];
 403         ipfw_nat64lsn_cfg *cfg;
 404         ipfw_obj_lheader *olh;
 405         int tcmd, flags;
 406         char *opt;
 407
 408         memset(&buf, 0, sizeof(buf));
 409         olh = (ipfw_obj_lheader *)buf;
 410         cfg = (ipfw_nat64lsn_cfg *)(olh + 1);
 411
 412         /* Some reasonable defaults */
 413         inet_pton(AF_INET6, "64:ff9b::", &cfg->prefix6);
 414         cfg->plen6 = 96;
 415         cfg->set = set;
 416         cfg->max_ports = NAT64LSN_MAX_PORTS;
 417         cfg->jmaxlen = NAT64LSN_JMAXLEN;
 418         cfg->nh_delete_delay = NAT64LSN_HOST_AGE;
 419         cfg->pg_delete_delay = NAT64LSN_PG_AGE;
 420         cfg->st_syn_ttl = NAT64LSN_TCP_SYN_AGE;
 421         cfg->st_estab_ttl = NAT64LSN_TCP_EST_AGE;
 422         cfg->st_close_ttl = NAT64LSN_TCP_FIN_AGE;
 423         cfg->st_udp_ttl = NAT64LSN_UDP_AGE;
 424         cfg->st_icmp_ttl = NAT64LSN_ICMP_AGE;
 425         flags = NAT64LSN_HAS_PREFIX6;
 426         while (ac > 0) {
 427                 tcmd = get_token(nat64newcmds, *av, "option");
 428                 opt = *av;
 429                 ac--; av++;
 430
 431                 switch (tcmd) {
 432                 case TOK_PREFIX4:
 433                         NEED1("IPv4 prefix required");
 434                         nat64lsn_parse_prefix(*av, AF_INET, &cfg->prefix4,
 435                             &cfg->plen4);
 436                         flags |= NAT64LSN_HAS_PREFIX4;
 437                         ac--; av++;
 438                         break;
 439                 case TOK_PREFIX6:
 440                         NEED1("IPv6 prefix required");
 441                         nat64lsn_parse_prefix(*av, AF_INET6, &cfg->prefix6,
 442                             &cfg->plen6);
 443                         if (ipfw_check_nat64prefix(&cfg->prefix6,
 444                             cfg->plen6) != 0 &&
 445                             !IN6_IS_ADDR_UNSPECIFIED(&cfg->prefix6))
 446                                 errx(EX_USAGE, "Bad prefix6 %s", *av);
 447
 448                         ac--; av++;
 449                         break;
 450                 case TOK_JMAXLEN:
 451                         NEED1("job queue length required");
 452                         cfg->jmaxlen = nat64lsn_parse_int(*av, opt);
 453                         ac--; av++;
 454                         break;
 455                 case TOK_MAX_PORTS:
 456                         NEED1("Max per-user ports required");
 457                         cfg->max_ports = nat64lsn_parse_int(*av, opt);
 458                         ac--; av++;
 459                         break;
 460                 case TOK_HOST_DEL_AGE:
 461                         NEED1("host delete delay required");
 462                         cfg->nh_delete_delay = (uint16_t)nat64lsn_parse_int(
 463                             *av, opt);
 464                         ac--; av++;
 465                         break;
 466                 case TOK_PG_DEL_AGE:
 467                         NEED1("portgroup delete delay required");
 468                         cfg->pg_delete_delay = (uint16_t)nat64lsn_parse_int(
 469                             *av, opt);
 470                         ac--; av++;
 471                         break;
 472                 case TOK_TCP_SYN_AGE:
 473                         NEED1("tcp syn age required");
 474                         cfg->st_syn_ttl = (uint16_t)nat64lsn_parse_int(
 475                             *av, opt);
 476                         ac--; av++;
 477                         break;
 478                 case TOK_TCP_CLOSE_AGE:
 479                         NEED1("tcp close age required");
 480                         cfg->st_close_ttl = (uint16_t)nat64lsn_parse_int(
 481                             *av, opt);
 482                         ac--; av++;
 483                         break;
 484                 case TOK_TCP_EST_AGE:
 485                         NEED1("tcp est age required");
 486                         cfg->st_estab_ttl = (uint16_t)nat64lsn_parse_int(
 487                             *av, opt);
 488                         ac--; av++;
 489                         break;
 490                 case TOK_UDP_AGE:
 491                         NEED1("udp age required");
 492                         cfg->st_udp_ttl = (uint16_t)nat64lsn_parse_int(
 493                             *av, opt);
 494                         ac--; av++;
 495                         break;
 496                 case TOK_ICMP_AGE:
 497                         NEED1("icmp age required");
 498                         cfg->st_icmp_ttl = (uint16_t)nat64lsn_parse_int(
 499                             *av, opt);
 500                         ac--; av++;
 501                         break;
 502                 case TOK_STATES_CHUNKS:
 503                         NEED1("number of chunks required");
 504                         cfg->states_chunks = (uint8_t)nat64lsn_parse_int(
 505                             *av, opt);
 506                         ac--; av++;
 507                         break;
 508                 case TOK_LOG:
 509                         cfg->flags |= NAT64_LOG;
 510                         break;
 511                 case TOK_LOGOFF:
 512                         cfg->flags &= ~NAT64_LOG;
 513                         break;
 514                 case TOK_PRIVATE:
 515                         cfg->flags |= NAT64_ALLOW_PRIVATE;
 516                         break;
 517                 case TOK_PRIVATEOFF:
 518                         cfg->flags &= ~NAT64_ALLOW_PRIVATE;
 519                         break;
 520                 }
 521         }
 522
 523         /* Check validness */
 524         if ((flags & NAT64LSN_HAS_PREFIX4) != NAT64LSN_HAS_PREFIX4)
 525                 errx(EX_USAGE, "prefix4 required");
 526
 527         olh->count = 1;
 528         olh->objsize = sizeof(*cfg);
 529         olh->size = sizeof(buf);
 530         strlcpy(cfg->name, name, sizeof(cfg->name));
 531         if (do_set3(IP_FW_NAT64LSN_CREATE, &olh->opheader, sizeof(buf)) != 0)
 532                 err(EX_OSERR, "nat64lsn instance creation failed");
 533 }
 534
 535 /*
 536  * Configures existing nat64lsn instance
 537  * ipfw nat64lsn <NAME> config <options>
 538  * Request: [ ipfw_obj_header ipfw_nat64lsn_cfg ]
 539  */
 540 static void
 541 nat64lsn_config(const char *name, uint8_t set, int ac, char **av)
 542 {
 543         char buf[sizeof(ipfw_obj_header) + sizeof(ipfw_nat64lsn_cfg)];
 544         ipfw_nat64lsn_cfg *cfg;
 545         ipfw_obj_header *oh;
 546         size_t sz;
 547         char *opt;
 548         int tcmd;
 549
 550         if (ac == 0)
 551                 errx(EX_USAGE, "config options required");
 552         memset(&buf, 0, sizeof(buf));
 553         oh = (ipfw_obj_header *)buf;
 554         cfg = (ipfw_nat64lsn_cfg *)(oh + 1);
 555         sz = sizeof(buf);
 556
 557         nat64lsn_fill_ntlv(&oh->ntlv, name, set);
 558         if (do_get3(IP_FW_NAT64LSN_CONFIG, &oh->opheader, &sz) != 0)
 559                 err(EX_OSERR, "failed to get config for instance %s", name);
 560
 561         while (ac > 0) {
 562                 tcmd = get_token(nat64newcmds, *av, "option");
 563                 opt = *av;
 564                 ac--; av++;
 565
 566                 switch (tcmd) {
 567                 case TOK_MAX_PORTS:
 568                         NEED1("Max per-user ports required");
 569                         cfg->max_ports = nat64lsn_parse_int(*av, opt);
 570                         ac--; av++;
 571                         break;
 572                 case TOK_JMAXLEN:
 573                         NEED1("job queue length required");
 574                         cfg->jmaxlen = nat64lsn_parse_int(*av, opt);
 575                         ac--; av++;
 576                         break;
 577                 case TOK_HOST_DEL_AGE:
 578                         NEED1("host delete delay required");
 579                         cfg->nh_delete_delay = (uint16_t)nat64lsn_parse_int(
 580                             *av, opt);
 581                         ac--; av++;
 582                         break;
 583                 case TOK_PG_DEL_AGE:
 584                         NEED1("portgroup delete delay required");
 585                         cfg->pg_delete_delay = (uint16_t)nat64lsn_parse_int(
 586                             *av, opt);
 587                         ac--; av++;
 588                         break;
 589                 case TOK_TCP_SYN_AGE:
 590                         NEED1("tcp syn age required");
 591                         cfg->st_syn_ttl = (uint16_t)nat64lsn_parse_int(
 592                             *av, opt);
 593                         ac--; av++;
 594                         break;
 595                 case TOK_TCP_CLOSE_AGE:
 596                         NEED1("tcp close age required");
 597                         cfg->st_close_ttl = (uint16_t)nat64lsn_parse_int(
 598                             *av, opt);
 599                         ac--; av++;
 600                         break;
 601                 case TOK_TCP_EST_AGE:
 602                         NEED1("tcp est age required");
 603                         cfg->st_estab_ttl = (uint16_t)nat64lsn_parse_int(
 604                             *av, opt);
 605                         ac--; av++;
 606                         break;
 607                 case TOK_UDP_AGE:
 608                         NEED1("udp age required");
 609                         cfg->st_udp_ttl = (uint16_t)nat64lsn_parse_int(
 610                             *av, opt);
 611                         ac--; av++;
 612                         break;
 613                 case TOK_ICMP_AGE:
 614                         NEED1("icmp age required");
 615                         cfg->st_icmp_ttl = (uint16_t)nat64lsn_parse_int(
 616                             *av, opt);
 617                         ac--; av++;
 618                         break;
 619                 case TOK_STATES_CHUNKS:
 620                         NEED1("number of chunks required");
 621                         cfg->states_chunks = (uint8_t)nat64lsn_parse_int(
 622                             *av, opt);
 623                         ac--; av++;
 624                         break;
 625                 case TOK_LOG:
 626                         cfg->flags |= NAT64_LOG;
 627                         break;
 628                 case TOK_LOGOFF:
 629                         cfg->flags &= ~NAT64_LOG;
 630                         break;
 631                 case TOK_PRIVATE:
 632                         cfg->flags |= NAT64_ALLOW_PRIVATE;
 633                         break;
 634                 case TOK_PRIVATEOFF:
 635                         cfg->flags &= ~NAT64_ALLOW_PRIVATE;
 636                         break;
 637                 default:
 638                         errx(EX_USAGE, "Can't change %s option", opt);
 639                 }
 640         }
 641
 642         if (do_set3(IP_FW_NAT64LSN_CONFIG, &oh->opheader, sizeof(buf)) != 0)
 643                 err(EX_OSERR, "nat64lsn instance configuration failed");
 644 }
 645
 646 /*
 647  * Reset nat64lsn instance statistics specified by @oh->ntlv.
 648  * Request: [ ipfw_obj_header ]
 649  */
 650 static void
 651 nat64lsn_reset_stats(const char *name, uint8_t set)
 652 {
 653         ipfw_obj_header oh;
 654
 655         memset(&oh, 0, sizeof(oh));
 656         nat64lsn_fill_ntlv(&oh.ntlv, name, set);
 657         if (do_set3(IP_FW_NAT64LSN_RESET_STATS, &oh.opheader, sizeof(oh)) != 0)
 658                 err(EX_OSERR, "failed to reset stats for instance %s", name);
 659 }
 660
 661 /*
 662  * Destroys nat64lsn instance specified by @oh->ntlv.
 663  * Request: [ ipfw_obj_header ]
 664  */
 665 static void
 666 nat64lsn_destroy(const char *name, uint8_t set)
 667 {
 668         ipfw_obj_header oh;
 669
 670         memset(&oh, 0, sizeof(oh));
 671         nat64lsn_fill_ntlv(&oh.ntlv, name, set);
 672         if (do_set3(IP_FW_NAT64LSN_DESTROY, &oh.opheader, sizeof(oh)) != 0)
 673                 err(EX_OSERR, "failed to destroy nat instance %s", name);
 674 }
 675
 676 /*
 677  * Get nat64lsn instance statistics.
 678  * Request: [ ipfw_obj_header ]
 679  * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ] ]
 680  */
 681 static int
 682 nat64lsn_get_stats(const char *name, uint8_t set,
 683     struct ipfw_nat64lsn_stats *stats)
 684 {
 685         ipfw_obj_header *oh;
 686         ipfw_obj_ctlv *oc;
 687         size_t sz;
 688
 689         sz = sizeof(*oh) + sizeof(*oc) + sizeof(*stats);
 690         oh = calloc(1, sz);
 691         nat64lsn_fill_ntlv(&oh->ntlv, name, set);
 692         if (do_get3(IP_FW_NAT64LSN_STATS, &oh->opheader, &sz) == 0) {
 693                 oc = (ipfw_obj_ctlv *)(oh + 1);
 694                 memcpy(stats, oc + 1, sizeof(*stats));
 695                 free(oh);
 696                 return (0);
 697         }
 698         free(oh);
 699         return (-1);
 700 }
 701
 702 static void
 703 nat64lsn_stats(const char *name, uint8_t set)
 704 {
 705         struct ipfw_nat64lsn_stats stats;
 706
 707         if (nat64lsn_get_stats(name, set, &stats) != 0)
 708                 err(EX_OSERR, "Error retrieving stats");
 709
 710         if (g_co.use_set != 0 || set != 0)
 711                 printf("set %u ", set);
 712         printf("nat64lsn %s\n", name);
 713         printf("\t%ju packets translated from IPv6 to IPv4\n",
 714             (uintmax_t)stats.opcnt64);
 715         printf("\t%ju packets translated from IPv4 to IPv6\n",
 716             (uintmax_t)stats.opcnt46);
 717         printf("\t%ju IPv6 fragments created\n",
 718             (uintmax_t)stats.ofrags);
 719         printf("\t%ju IPv4 fragments received\n",
 720             (uintmax_t)stats.ifrags);
 721         printf("\t%ju output packets dropped due to no bufs, etc.\n",
 722             (uintmax_t)stats.oerrors);
 723         printf("\t%ju output packets discarded due to no IPv4 route\n",
 724             (uintmax_t)stats.noroute4);
 725         printf("\t%ju output packets discarded due to no IPv6 route\n",
 726             (uintmax_t)stats.noroute6);
 727         printf("\t%ju packets discarded due to unsupported protocol\n",
 728             (uintmax_t)stats.noproto);
 729         printf("\t%ju packets discarded due to memory allocation problems\n",
 730             (uintmax_t)stats.nomem);
 731         printf("\t%ju packets discarded due to some errors\n",
 732             (uintmax_t)stats.dropped);
 733         printf("\t%ju packets not matched with IPv4 prefix\n",
 734             (uintmax_t)stats.nomatch4);
 735
 736         printf("\t%ju mbufs queued for post processing\n",
 737             (uintmax_t)stats.jreinjected);
 738         printf("\t%ju times the job queue was processed\n",
 739             (uintmax_t)stats.jcalls);
 740         printf("\t%ju job requests queued\n",
 741             (uintmax_t)stats.jrequests);
 742         printf("\t%ju job requests queue limit reached\n",
 743             (uintmax_t)stats.jmaxlen);
 744         printf("\t%ju job requests failed due to memory allocation problems\n",
 745             (uintmax_t)stats.jnomem);
 746
 747         printf("\t%ju hosts allocated\n", (uintmax_t)stats.hostcount);
 748         printf("\t%ju hosts requested\n", (uintmax_t)stats.jhostsreq);
 749         printf("\t%ju host requests failed\n", (uintmax_t)stats.jhostfails);
 750
 751         printf("\t%ju portgroups requested\n", (uintmax_t)stats.jportreq);
 752         printf("\t%ju portgroups allocated\n", (uintmax_t)stats.spgcreated);
 753         printf("\t%ju portgroups deleted\n", (uintmax_t)stats.spgdeleted);
 754         printf("\t%ju portgroup requests failed\n",
 755             (uintmax_t)stats.jportfails);
 756         printf("\t%ju portgroups allocated for TCP\n",
 757             (uintmax_t)stats.tcpchunks);
 758         printf("\t%ju portgroups allocated for UDP\n",
 759             (uintmax_t)stats.udpchunks);
 760         printf("\t%ju portgroups allocated for ICMP\n",
 761             (uintmax_t)stats.icmpchunks);
 762
 763         printf("\t%ju states created\n", (uintmax_t)stats.screated);
 764         printf("\t%ju states deleted\n", (uintmax_t)stats.sdeleted);
 765 }
 766
 767 static int
 768 nat64lsn_show_cb(ipfw_nat64lsn_cfg *cfg, const char *name, uint8_t set)
 769 {
 770         char abuf[INET6_ADDRSTRLEN];
 771
 772         if (name != NULL && strcmp(cfg->name, name) != 0)
 773                 return (ESRCH);
 774
 775         if (g_co.use_set != 0 && cfg->set != set)
 776                 return (ESRCH);
 777
 778         if (g_co.use_set != 0 || cfg->set != 0)
 779                 printf("set %u ", cfg->set);
 780         inet_ntop(AF_INET, &cfg->prefix4, abuf, sizeof(abuf));
 781         printf("nat64lsn %s prefix4 %s/%u", cfg->name, abuf, cfg->plen4);
 782         inet_ntop(AF_INET6, &cfg->prefix6, abuf, sizeof(abuf));
 783         printf(" prefix6 %s/%u", abuf, cfg->plen6);
 784         if (g_co.verbose || cfg->states_chunks > 1)
 785                 printf(" states_chunks %u", cfg->states_chunks);
 786         if (g_co.verbose || cfg->nh_delete_delay != NAT64LSN_HOST_AGE)
 787                 printf(" host_del_age %u", cfg->nh_delete_delay);
 788         if (g_co.verbose || cfg->pg_delete_delay != NAT64LSN_PG_AGE)
 789                 printf(" pg_del_age %u", cfg->pg_delete_delay);
 790         if (g_co.verbose || cfg->st_syn_ttl != NAT64LSN_TCP_SYN_AGE)
 791                 printf(" tcp_syn_age %u", cfg->st_syn_ttl);
 792         if (g_co.verbose || cfg->st_close_ttl != NAT64LSN_TCP_FIN_AGE)
 793                 printf(" tcp_close_age %u", cfg->st_close_ttl);
 794         if (g_co.verbose || cfg->st_estab_ttl != NAT64LSN_TCP_EST_AGE)
 795                 printf(" tcp_est_age %u", cfg->st_estab_ttl);
 796         if (g_co.verbose || cfg->st_udp_ttl != NAT64LSN_UDP_AGE)
 797                 printf(" udp_age %u", cfg->st_udp_ttl);
 798         if (g_co.verbose || cfg->st_icmp_ttl != NAT64LSN_ICMP_AGE)
 799                 printf(" icmp_age %u", cfg->st_icmp_ttl);
 800         if (g_co.verbose || cfg->jmaxlen != NAT64LSN_JMAXLEN)
 801                 printf(" jmaxlen %u", cfg->jmaxlen);
 802         if (cfg->flags & NAT64_LOG)
 803                 printf(" log");
 804         if (cfg->flags & NAT64_ALLOW_PRIVATE)
 805                 printf(" allow_private");
 806         printf("\n");
 807         return (0);
 808 }
 809
 810 static int
 811 nat64lsn_destroy_cb(ipfw_nat64lsn_cfg *cfg, const char *name __unused,
 812     uint8_t set)
 813 {
 814
 815         if (g_co.use_set != 0 && cfg->set != set)
 816                 return (ESRCH);
 817
 818         nat64lsn_destroy(cfg->name, cfg->set);
 819         return (0);
 820 }
 821
 822
 823 /*
 824  * Compare nat64lsn instances names.
 825  * Honor number comparison.
 826  */
 827 static int
 828 nat64name_cmp(const void *a, const void *b)
 829 {
 830         const ipfw_nat64lsn_cfg *ca, *cb;
 831
 832         ca = (const ipfw_nat64lsn_cfg *)a;
 833         cb = (const ipfw_nat64lsn_cfg *)b;
 834
 835         if (ca->set > cb->set)
 836                 return (1);
 837         else if (ca->set < cb->set)
 838                 return (-1);
 839         return (stringnum_cmp(ca->name, cb->name));
 840 }
 841
 842 /*
 843  * Retrieves nat64lsn instance list from kernel,
 844  * optionally sorts it and calls requested function for each instance.
 845  *
 846  * Request: [ ipfw_obj_lheader ]
 847  * Reply: [ ipfw_obj_lheader ipfw_nat64lsn_cfg x N ]
 848  */
 849 static int
 850 nat64lsn_foreach(nat64lsn_cb_t *f, const char *name, uint8_t set,  int sort)
 851 {
 852         ipfw_obj_lheader *olh;
 853         ipfw_nat64lsn_cfg *cfg;
 854         size_t sz;
 855         uint32_t i;
 856         int error;
 857
 858         /* Start with reasonable default */
 859         sz = sizeof(*olh) + 16 * sizeof(ipfw_nat64lsn_cfg);
 860
 861         for (;;) {
 862                 if ((olh = calloc(1, sz)) == NULL)
 863                         return (ENOMEM);
 864
 865                 olh->size = sz;
 866                 if (do_get3(IP_FW_NAT64LSN_LIST, &olh->opheader, &sz) != 0) {
 867                         sz = olh->size;
 868                         free(olh);
 869                         if (errno != ENOMEM)
 870                                 return (errno);
 871                         continue;
 872                 }
 873
 874                 if (sort != 0)
 875                         qsort(olh + 1, olh->count, olh->objsize,
 876                             nat64name_cmp);
 877
 878                 cfg = (ipfw_nat64lsn_cfg *)(olh + 1);
 879                 for (i = 0; i < olh->count; i++) {
 880                         error = f(cfg, name, set); /* Ignore errors for now */
 881                         cfg = (ipfw_nat64lsn_cfg *)((caddr_t)cfg +
 882                             olh->objsize);
 883                 }
 884                 free(olh);
 885                 break;
 886         }
 887         return (0);
 888 }
 889