2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4 * Copyright (c) 2015-2019 Yandex LLC
5 * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org>
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
32 #include <sys/types.h>
33 #include <sys/socket.h>
48 #include <netinet/in.h>
49 #include <netinet/ip_fw.h>
50 #include <netinet6/ip_fw_nat64.h>
51 #include <arpa/inet.h>
53 typedef int (nat64stl_cb_t)(ipfw_nat64stl_cfg *i, const char *name,
55 static int nat64stl_foreach(nat64stl_cb_t *f, const char *name, uint8_t set,
58 static void nat64stl_create(const char *name, uint8_t set, int ac, char **av);
59 static void nat64stl_config(const char *name, uint8_t set, int ac, char **av);
60 static void nat64stl_destroy(const char *name, uint8_t set);
61 static void nat64stl_stats(const char *name, uint8_t set);
62 static void nat64stl_reset_stats(const char *name, uint8_t set);
63 static int nat64stl_show_cb(ipfw_nat64stl_cfg *cfg, const char *name,
65 static int nat64stl_destroy_cb(ipfw_nat64stl_cfg *cfg, const char *name,
68 static struct _s_x nat64cmds[] = {
69 { "create", TOK_CREATE },
70 { "config", TOK_CONFIG },
71 { "destroy", TOK_DESTROY },
74 { "stats", TOK_STATS },
78 #define IPV6_ADDR_INT32_WKPFX htonl(0x64ff9b)
79 #define IN6_IS_ADDR_WKPFX(a) \
80 ((a)->__u6_addr.__u6_addr32[0] == IPV6_ADDR_INT32_WKPFX && \
81 (a)->__u6_addr.__u6_addr32[1] == 0 && \
82 (a)->__u6_addr.__u6_addr32[2] == 0)
84 ipfw_check_nat64prefix(const struct in6_addr *prefix, int length)
93 /* Well-known prefix has 96 prefix length */
94 if (IN6_IS_ADDR_WKPFX(prefix))
98 /* Bits 64 to 71 must be set to zero */
99 if (prefix->__u6_addr.__u6_addr8[8] != 0)
101 /* XXX: looks incorrect */
102 if (IN6_IS_ADDR_MULTICAST(prefix) ||
103 IN6_IS_ADDR_UNSPECIFIED(prefix) ||
104 IN6_IS_ADDR_LOOPBACK(prefix))
111 static struct _s_x nat64statscmds[] = {
112 { "reset", TOK_RESET },
117 * This one handles all nat64stl-related commands
118 * ipfw [set N] nat64stl NAME {create | config} ...
119 * ipfw [set N] nat64stl NAME stats [reset]
120 * ipfw [set N] nat64stl {NAME | all} destroy
121 * ipfw [set N] nat64stl {NAME | all} {list | show}
123 #define nat64stl_check_name table_check_name
125 ipfw_nat64stl_handler(int ac, char *av[])
132 set = co.use_set - 1;
137 NEED1("nat64stl needs instance name");
139 if (nat64stl_check_name(name) != 0) {
140 if (strcmp(name, "all") == 0)
143 errx(EX_USAGE, "nat64stl instance name %s is invalid",
147 NEED1("nat64stl needs command");
149 tcmd = get_token(nat64cmds, *av, "nat64stl command");
150 if (name == NULL && tcmd != TOK_DESTROY && tcmd != TOK_LIST)
151 errx(EX_USAGE, "nat64stl instance name required");
155 nat64stl_create(name, set, ac, av);
159 nat64stl_config(name, set, ac, av);
162 nat64stl_foreach(nat64stl_show_cb, name, set, 1);
166 nat64stl_foreach(nat64stl_destroy_cb, NULL, set, 0);
168 nat64stl_destroy(name, set);
173 nat64stl_stats(name, set);
176 tcmd = get_token(nat64statscmds, *av, "stats command");
177 if (tcmd == TOK_RESET)
178 nat64stl_reset_stats(name, set);
184 nat64stl_fill_ntlv(ipfw_obj_ntlv *ntlv, const char *name, uint8_t set)
187 ntlv->head.type = IPFW_TLV_EACTION_NAME(1); /* it doesn't matter */
188 ntlv->head.length = sizeof(ipfw_obj_ntlv);
191 strlcpy(ntlv->name, name, sizeof(ntlv->name));
194 static struct _s_x nat64newcmds[] = {
195 { "table4", TOK_TABLE4 },
196 { "table6", TOK_TABLE6 },
197 { "prefix6", TOK_PREFIX6 },
199 { "-log", TOK_LOGOFF },
200 { "allow_private", TOK_PRIVATE },
201 { "-allow_private", TOK_PRIVATEOFF },
206 * Creates new nat64stl instance
207 * ipfw nat64stl <NAME> create table4 <name> table6 <name> [ prefix6 <prefix>]
208 * Request: [ ipfw_obj_lheader ipfw_nat64stl_cfg ]
210 #define NAT64STL_HAS_TABLE4 0x01
211 #define NAT64STL_HAS_TABLE6 0x02
212 #define NAT64STL_HAS_PREFIX6 0x04
214 nat64stl_create(const char *name, uint8_t set, int ac, char *av[])
216 char buf[sizeof(ipfw_obj_lheader) + sizeof(ipfw_nat64stl_cfg)];
217 ipfw_nat64stl_cfg *cfg;
218 ipfw_obj_lheader *olh;
222 memset(buf, 0, sizeof(buf));
223 olh = (ipfw_obj_lheader *)buf;
224 cfg = (ipfw_nat64stl_cfg *)(olh + 1);
226 /* Some reasonable defaults */
227 inet_pton(AF_INET6, "64:ff9b::", &cfg->prefix6);
230 flags = NAT64STL_HAS_PREFIX6;
232 tcmd = get_token(nat64newcmds, *av, "option");
237 NEED1("table name required");
238 table_fill_ntlv(&cfg->ntlv4, *av, set, 4);
239 flags |= NAT64STL_HAS_TABLE4;
243 NEED1("table name required");
244 table_fill_ntlv(&cfg->ntlv6, *av, set, 6);
245 flags |= NAT64STL_HAS_TABLE6;
249 NEED1("IPv6 prefix6 required");
250 if ((p = strchr(*av, '/')) != NULL)
252 if (inet_pton(AF_INET6, *av, &cfg->prefix6) != 1)
254 "Bad prefix: %s", *av);
255 cfg->plen6 = strtol(p, NULL, 10);
256 if (ipfw_check_nat64prefix(&cfg->prefix6,
259 "Bad prefix length: %s", p);
260 flags |= NAT64STL_HAS_PREFIX6;
264 cfg->flags |= NAT64_LOG;
267 cfg->flags &= ~NAT64_LOG;
270 cfg->flags |= NAT64_ALLOW_PRIVATE;
273 cfg->flags &= ~NAT64_ALLOW_PRIVATE;
278 /* Check validness */
279 if ((flags & NAT64STL_HAS_TABLE4) != NAT64STL_HAS_TABLE4)
280 errx(EX_USAGE, "table4 required");
281 if ((flags & NAT64STL_HAS_TABLE6) != NAT64STL_HAS_TABLE6)
282 errx(EX_USAGE, "table6 required");
283 if ((flags & NAT64STL_HAS_PREFIX6) != NAT64STL_HAS_PREFIX6)
284 errx(EX_USAGE, "prefix6 required");
287 olh->objsize = sizeof(*cfg);
288 olh->size = sizeof(buf);
289 strlcpy(cfg->name, name, sizeof(cfg->name));
290 if (do_set3(IP_FW_NAT64STL_CREATE, &olh->opheader, sizeof(buf)) != 0)
291 err(EX_OSERR, "nat64stl instance creation failed");
295 * Configures existing nat64stl instance
296 * ipfw nat64stl <NAME> config <options>
297 * Request: [ ipfw_obj_header ipfw_nat64stl_cfg ]
300 nat64stl_config(const char *name, uint8_t set, int ac, char **av)
302 char buf[sizeof(ipfw_obj_header) + sizeof(ipfw_nat64stl_cfg)];
303 ipfw_nat64stl_cfg *cfg;
310 errx(EX_USAGE, "config options required");
311 memset(&buf, 0, sizeof(buf));
312 oh = (ipfw_obj_header *)buf;
313 cfg = (ipfw_nat64stl_cfg *)(oh + 1);
316 nat64stl_fill_ntlv(&oh->ntlv, name, set);
317 if (do_get3(IP_FW_NAT64STL_CONFIG, &oh->opheader, &sz) != 0)
318 err(EX_OSERR, "failed to get config for instance %s", name);
321 tcmd = get_token(nat64newcmds, *av, "option");
328 NEED1("table name required");
329 table_fill_ntlv(&cfg->ntlv4, *av, set, 4);
333 NEED1("table name required");
334 table_fill_ntlv(&cfg->ntlv6, *av, set, 6);
339 cfg->flags |= NAT64_LOG;
342 cfg->flags &= ~NAT64_LOG;
345 cfg->flags |= NAT64_ALLOW_PRIVATE;
348 cfg->flags &= ~NAT64_ALLOW_PRIVATE;
351 errx(EX_USAGE, "Can't change %s option", opt);
355 if (do_set3(IP_FW_NAT64STL_CONFIG, &oh->opheader, sizeof(buf)) != 0)
356 err(EX_OSERR, "nat64stl instance configuration failed");
360 * Destroys nat64stl instance.
361 * Request: [ ipfw_obj_header ]
364 nat64stl_destroy(const char *name, uint8_t set)
368 memset(&oh, 0, sizeof(oh));
369 nat64stl_fill_ntlv(&oh.ntlv, name, set);
370 if (do_set3(IP_FW_NAT64STL_DESTROY, &oh.opheader, sizeof(oh)) != 0)
371 err(EX_OSERR, "failed to destroy nat instance %s", name);
375 * Get nat64stl instance statistics.
376 * Request: [ ipfw_obj_header ]
377 * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ] ]
380 nat64stl_get_stats(const char *name, uint8_t set,
381 struct ipfw_nat64stl_stats *stats)
387 sz = sizeof(*oh) + sizeof(*oc) + sizeof(*stats);
389 nat64stl_fill_ntlv(&oh->ntlv, name, set);
390 if (do_get3(IP_FW_NAT64STL_STATS, &oh->opheader, &sz) == 0) {
391 oc = (ipfw_obj_ctlv *)(oh + 1);
392 memcpy(stats, oc + 1, sizeof(*stats));
401 nat64stl_stats(const char *name, uint8_t set)
403 struct ipfw_nat64stl_stats stats;
405 if (nat64stl_get_stats(name, set, &stats) != 0)
406 err(EX_OSERR, "Error retrieving stats");
408 if (co.use_set != 0 || set != 0)
409 printf("set %u ", set);
410 printf("nat64stl %s\n", name);
412 printf("\t%ju packets translated from IPv6 to IPv4\n",
413 (uintmax_t)stats.opcnt64);
414 printf("\t%ju packets translated from IPv4 to IPv6\n",
415 (uintmax_t)stats.opcnt46);
416 printf("\t%ju IPv6 fragments created\n",
417 (uintmax_t)stats.ofrags);
418 printf("\t%ju IPv4 fragments received\n",
419 (uintmax_t)stats.ifrags);
420 printf("\t%ju output packets dropped due to no bufs, etc.\n",
421 (uintmax_t)stats.oerrors);
422 printf("\t%ju output packets discarded due to no IPv4 route\n",
423 (uintmax_t)stats.noroute4);
424 printf("\t%ju output packets discarded due to no IPv6 route\n",
425 (uintmax_t)stats.noroute6);
426 printf("\t%ju packets discarded due to unsupported protocol\n",
427 (uintmax_t)stats.noproto);
428 printf("\t%ju packets discarded due to memory allocation problems\n",
429 (uintmax_t)stats.nomem);
430 printf("\t%ju packets discarded due to some errors\n",
431 (uintmax_t)stats.dropped);
435 * Reset nat64stl instance statistics specified by @oh->ntlv.
436 * Request: [ ipfw_obj_header ]
439 nat64stl_reset_stats(const char *name, uint8_t set)
443 memset(&oh, 0, sizeof(oh));
444 nat64stl_fill_ntlv(&oh.ntlv, name, set);
445 if (do_set3(IP_FW_NAT64STL_RESET_STATS, &oh.opheader, sizeof(oh)) != 0)
446 err(EX_OSERR, "failed to reset stats for instance %s", name);
450 nat64stl_show_cb(ipfw_nat64stl_cfg *cfg, const char *name, uint8_t set)
452 char abuf[INET6_ADDRSTRLEN];
454 if (name != NULL && strcmp(cfg->name, name) != 0)
457 if (co.use_set != 0 && cfg->set != set)
460 if (co.use_set != 0 || cfg->set != 0)
461 printf("set %u ", cfg->set);
463 printf("nat64stl %s table4 %s table6 %s",
464 cfg->name, cfg->ntlv4.name, cfg->ntlv6.name);
465 inet_ntop(AF_INET6, &cfg->prefix6, abuf, sizeof(abuf));
466 printf(" prefix6 %s/%u", abuf, cfg->plen6);
467 if (cfg->flags & NAT64_LOG)
469 if (cfg->flags & NAT64_ALLOW_PRIVATE)
470 printf(" allow_private");
476 nat64stl_destroy_cb(ipfw_nat64stl_cfg *cfg, const char *name, uint8_t set)
479 if (co.use_set != 0 && cfg->set != set)
482 nat64stl_destroy(cfg->name, cfg->set);
488 * Compare nat64stl instances names.
489 * Honor number comparison.
492 nat64name_cmp(const void *a, const void *b)
494 ipfw_nat64stl_cfg *ca, *cb;
496 ca = (ipfw_nat64stl_cfg *)a;
497 cb = (ipfw_nat64stl_cfg *)b;
499 if (ca->set > cb->set)
501 else if (ca->set < cb->set)
503 return (stringnum_cmp(ca->name, cb->name));
507 * Retrieves nat64stl instance list from kernel,
508 * optionally sorts it and calls requested function for each instance.
510 * Request: [ ipfw_obj_lheader ]
511 * Reply: [ ipfw_obj_lheader ipfw_nat64stl_cfg x N ]
514 nat64stl_foreach(nat64stl_cb_t *f, const char *name, uint8_t set, int sort)
516 ipfw_obj_lheader *olh;
517 ipfw_nat64stl_cfg *cfg;
521 /* Start with reasonable default */
522 sz = sizeof(*olh) + 16 * sizeof(*cfg);
524 if ((olh = calloc(1, sz)) == NULL)
528 if (do_get3(IP_FW_NAT64STL_LIST, &olh->opheader, &sz) != 0) {
537 qsort(olh + 1, olh->count, olh->objsize,
540 cfg = (ipfw_nat64stl_cfg *)(olh + 1);
541 for (i = 0; i < olh->count; i++) {
542 error = f(cfg, name, set); /* Ignore errors for now */
543 cfg = (ipfw_nat64stl_cfg *)((caddr_t)cfg +