2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4 * Copyright (c) 2015-2019 Yandex LLC
5 * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org>
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
32 #include <sys/types.h>
33 #include <sys/socket.h>
48 #include <netinet/in.h>
49 #include <netinet/ip_fw.h>
50 #include <netinet6/ip_fw_nat64.h>
51 #include <arpa/inet.h>
53 typedef int (nat64stl_cb_t)(ipfw_nat64stl_cfg *i, const char *name,
55 static int nat64stl_foreach(nat64stl_cb_t *f, const char *name, uint8_t set,
58 static void nat64stl_create(const char *name, uint8_t set, int ac, char **av);
59 static void nat64stl_config(const char *name, uint8_t set, int ac, char **av);
60 static void nat64stl_destroy(const char *name, uint8_t set);
61 static void nat64stl_stats(const char *name, uint8_t set);
62 static void nat64stl_reset_stats(const char *name, uint8_t set);
63 static int nat64stl_show_cb(ipfw_nat64stl_cfg *cfg, const char *name,
65 static int nat64stl_destroy_cb(ipfw_nat64stl_cfg *cfg, const char *name,
68 static struct _s_x nat64cmds[] = {
69 { "create", TOK_CREATE },
70 { "config", TOK_CONFIG },
71 { "destroy", TOK_DESTROY },
74 { "stats", TOK_STATS },
78 #define IPV6_ADDR_INT32_WKPFX htonl(0x64ff9b)
79 #define IN6_IS_ADDR_WKPFX(a) \
80 ((a)->__u6_addr.__u6_addr32[0] == IPV6_ADDR_INT32_WKPFX && \
81 (a)->__u6_addr.__u6_addr32[1] == 0 && \
82 (a)->__u6_addr.__u6_addr32[2] == 0)
84 ipfw_check_nat64prefix(const struct in6_addr *prefix, int length)
93 /* Well-known prefix has 96 prefix length */
94 if (IN6_IS_ADDR_WKPFX(prefix))
98 /* Bits 64 to 71 must be set to zero */
99 if (prefix->__u6_addr.__u6_addr8[8] != 0)
101 /* XXX: looks incorrect */
102 if (IN6_IS_ADDR_MULTICAST(prefix) ||
103 IN6_IS_ADDR_UNSPECIFIED(prefix) ||
104 IN6_IS_ADDR_LOOPBACK(prefix))
111 static struct _s_x nat64statscmds[] = {
112 { "reset", TOK_RESET },
117 * This one handles all nat64stl-related commands
118 * ipfw [set N] nat64stl NAME {create | config} ...
119 * ipfw [set N] nat64stl NAME stats [reset]
120 * ipfw [set N] nat64stl {NAME | all} destroy
121 * ipfw [set N] nat64stl {NAME | all} {list | show}
123 #define nat64stl_check_name table_check_name
125 ipfw_nat64stl_handler(int ac, char *av[])
131 if (g_co.use_set != 0)
132 set = g_co.use_set - 1;
137 NEED1("nat64stl needs instance name");
139 if (nat64stl_check_name(name) != 0) {
140 if (strcmp(name, "all") == 0)
143 errx(EX_USAGE, "nat64stl instance name %s is invalid",
147 NEED1("nat64stl needs command");
149 tcmd = get_token(nat64cmds, *av, "nat64stl command");
150 if (name == NULL && tcmd != TOK_DESTROY && tcmd != TOK_LIST)
151 errx(EX_USAGE, "nat64stl instance name required");
155 nat64stl_create(name, set, ac, av);
159 nat64stl_config(name, set, ac, av);
162 nat64stl_foreach(nat64stl_show_cb, name, set, 1);
166 nat64stl_foreach(nat64stl_destroy_cb, NULL, set, 0);
168 nat64stl_destroy(name, set);
173 nat64stl_stats(name, set);
176 tcmd = get_token(nat64statscmds, *av, "stats command");
177 if (tcmd == TOK_RESET)
178 nat64stl_reset_stats(name, set);
184 nat64stl_fill_ntlv(ipfw_obj_ntlv *ntlv, const char *name, uint8_t set)
187 ntlv->head.type = IPFW_TLV_EACTION_NAME(1); /* it doesn't matter */
188 ntlv->head.length = sizeof(ipfw_obj_ntlv);
191 strlcpy(ntlv->name, name, sizeof(ntlv->name));
194 static struct _s_x nat64newcmds[] = {
195 { "table4", TOK_TABLE4 },
196 { "table6", TOK_TABLE6 },
197 { "prefix6", TOK_PREFIX6 },
199 { "-log", TOK_LOGOFF },
200 { "allow_private", TOK_PRIVATE },
201 { "-allow_private", TOK_PRIVATEOFF },
206 * Creates new nat64stl instance
207 * ipfw nat64stl <NAME> create table4 <name> table6 <name> [ prefix6 <prefix>]
208 * Request: [ ipfw_obj_lheader ipfw_nat64stl_cfg ]
210 #define NAT64STL_HAS_TABLE4 0x01
211 #define NAT64STL_HAS_TABLE6 0x02
212 #define NAT64STL_HAS_PREFIX6 0x04
214 nat64stl_create(const char *name, uint8_t set, int ac, char *av[])
216 char buf[sizeof(ipfw_obj_lheader) + sizeof(ipfw_nat64stl_cfg)];
217 ipfw_nat64stl_cfg *cfg;
218 ipfw_obj_lheader *olh;
222 memset(buf, 0, sizeof(buf));
223 olh = (ipfw_obj_lheader *)buf;
224 cfg = (ipfw_nat64stl_cfg *)(olh + 1);
226 /* Some reasonable defaults */
227 inet_pton(AF_INET6, "64:ff9b::", &cfg->prefix6);
230 flags = NAT64STL_HAS_PREFIX6;
232 tcmd = get_token(nat64newcmds, *av, "option");
237 NEED1("table name required");
238 table_fill_ntlv(&cfg->ntlv4, *av, set, 4);
239 flags |= NAT64STL_HAS_TABLE4;
243 NEED1("table name required");
244 table_fill_ntlv(&cfg->ntlv6, *av, set, 6);
245 flags |= NAT64STL_HAS_TABLE6;
249 NEED1("IPv6 prefix6 required");
250 if ((p = strchr(*av, '/')) != NULL)
254 "Prefix length required: %s", *av);
255 if (inet_pton(AF_INET6, *av, &cfg->prefix6) != 1)
257 "Bad prefix: %s", *av);
258 cfg->plen6 = strtol(p, NULL, 10);
259 if (ipfw_check_nat64prefix(&cfg->prefix6,
262 "Bad prefix length: %s", p);
263 flags |= NAT64STL_HAS_PREFIX6;
267 cfg->flags |= NAT64_LOG;
270 cfg->flags &= ~NAT64_LOG;
273 cfg->flags |= NAT64_ALLOW_PRIVATE;
276 cfg->flags &= ~NAT64_ALLOW_PRIVATE;
281 /* Check validness */
282 if ((flags & NAT64STL_HAS_TABLE4) != NAT64STL_HAS_TABLE4)
283 errx(EX_USAGE, "table4 required");
284 if ((flags & NAT64STL_HAS_TABLE6) != NAT64STL_HAS_TABLE6)
285 errx(EX_USAGE, "table6 required");
286 if ((flags & NAT64STL_HAS_PREFIX6) != NAT64STL_HAS_PREFIX6)
287 errx(EX_USAGE, "prefix6 required");
290 olh->objsize = sizeof(*cfg);
291 olh->size = sizeof(buf);
292 strlcpy(cfg->name, name, sizeof(cfg->name));
293 if (do_set3(IP_FW_NAT64STL_CREATE, &olh->opheader, sizeof(buf)) != 0)
294 err(EX_OSERR, "nat64stl instance creation failed");
298 * Configures existing nat64stl instance
299 * ipfw nat64stl <NAME> config <options>
300 * Request: [ ipfw_obj_header ipfw_nat64stl_cfg ]
303 nat64stl_config(const char *name, uint8_t set, int ac, char **av)
305 char buf[sizeof(ipfw_obj_header) + sizeof(ipfw_nat64stl_cfg)];
306 ipfw_nat64stl_cfg *cfg;
313 errx(EX_USAGE, "config options required");
314 memset(&buf, 0, sizeof(buf));
315 oh = (ipfw_obj_header *)buf;
316 cfg = (ipfw_nat64stl_cfg *)(oh + 1);
319 nat64stl_fill_ntlv(&oh->ntlv, name, set);
320 if (do_get3(IP_FW_NAT64STL_CONFIG, &oh->opheader, &sz) != 0)
321 err(EX_OSERR, "failed to get config for instance %s", name);
324 tcmd = get_token(nat64newcmds, *av, "option");
331 NEED1("table name required");
332 table_fill_ntlv(&cfg->ntlv4, *av, set, 4);
336 NEED1("table name required");
337 table_fill_ntlv(&cfg->ntlv6, *av, set, 6);
342 cfg->flags |= NAT64_LOG;
345 cfg->flags &= ~NAT64_LOG;
348 cfg->flags |= NAT64_ALLOW_PRIVATE;
351 cfg->flags &= ~NAT64_ALLOW_PRIVATE;
354 errx(EX_USAGE, "Can't change %s option", opt);
358 if (do_set3(IP_FW_NAT64STL_CONFIG, &oh->opheader, sizeof(buf)) != 0)
359 err(EX_OSERR, "nat64stl instance configuration failed");
363 * Destroys nat64stl instance.
364 * Request: [ ipfw_obj_header ]
367 nat64stl_destroy(const char *name, uint8_t set)
371 memset(&oh, 0, sizeof(oh));
372 nat64stl_fill_ntlv(&oh.ntlv, name, set);
373 if (do_set3(IP_FW_NAT64STL_DESTROY, &oh.opheader, sizeof(oh)) != 0)
374 err(EX_OSERR, "failed to destroy nat instance %s", name);
378 * Get nat64stl instance statistics.
379 * Request: [ ipfw_obj_header ]
380 * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ] ]
383 nat64stl_get_stats(const char *name, uint8_t set,
384 struct ipfw_nat64stl_stats *stats)
390 sz = sizeof(*oh) + sizeof(*oc) + sizeof(*stats);
392 nat64stl_fill_ntlv(&oh->ntlv, name, set);
393 if (do_get3(IP_FW_NAT64STL_STATS, &oh->opheader, &sz) == 0) {
394 oc = (ipfw_obj_ctlv *)(oh + 1);
395 memcpy(stats, oc + 1, sizeof(*stats));
404 nat64stl_stats(const char *name, uint8_t set)
406 struct ipfw_nat64stl_stats stats;
408 if (nat64stl_get_stats(name, set, &stats) != 0)
409 err(EX_OSERR, "Error retrieving stats");
411 if (g_co.use_set != 0 || set != 0)
412 printf("set %u ", set);
413 printf("nat64stl %s\n", name);
415 printf("\t%ju packets translated from IPv6 to IPv4\n",
416 (uintmax_t)stats.opcnt64);
417 printf("\t%ju packets translated from IPv4 to IPv6\n",
418 (uintmax_t)stats.opcnt46);
419 printf("\t%ju IPv6 fragments created\n",
420 (uintmax_t)stats.ofrags);
421 printf("\t%ju IPv4 fragments received\n",
422 (uintmax_t)stats.ifrags);
423 printf("\t%ju output packets dropped due to no bufs, etc.\n",
424 (uintmax_t)stats.oerrors);
425 printf("\t%ju output packets discarded due to no IPv4 route\n",
426 (uintmax_t)stats.noroute4);
427 printf("\t%ju output packets discarded due to no IPv6 route\n",
428 (uintmax_t)stats.noroute6);
429 printf("\t%ju packets discarded due to unsupported protocol\n",
430 (uintmax_t)stats.noproto);
431 printf("\t%ju packets discarded due to memory allocation problems\n",
432 (uintmax_t)stats.nomem);
433 printf("\t%ju packets discarded due to some errors\n",
434 (uintmax_t)stats.dropped);
438 * Reset nat64stl instance statistics specified by @oh->ntlv.
439 * Request: [ ipfw_obj_header ]
442 nat64stl_reset_stats(const char *name, uint8_t set)
446 memset(&oh, 0, sizeof(oh));
447 nat64stl_fill_ntlv(&oh.ntlv, name, set);
448 if (do_set3(IP_FW_NAT64STL_RESET_STATS, &oh.opheader, sizeof(oh)) != 0)
449 err(EX_OSERR, "failed to reset stats for instance %s", name);
453 nat64stl_show_cb(ipfw_nat64stl_cfg *cfg, const char *name, uint8_t set)
455 char abuf[INET6_ADDRSTRLEN];
457 if (name != NULL && strcmp(cfg->name, name) != 0)
460 if (g_co.use_set != 0 && cfg->set != set)
463 if (g_co.use_set != 0 || cfg->set != 0)
464 printf("set %u ", cfg->set);
466 printf("nat64stl %s table4 %s table6 %s",
467 cfg->name, cfg->ntlv4.name, cfg->ntlv6.name);
468 inet_ntop(AF_INET6, &cfg->prefix6, abuf, sizeof(abuf));
469 printf(" prefix6 %s/%u", abuf, cfg->plen6);
470 if (cfg->flags & NAT64_LOG)
472 if (cfg->flags & NAT64_ALLOW_PRIVATE)
473 printf(" allow_private");
479 nat64stl_destroy_cb(ipfw_nat64stl_cfg *cfg, const char *name __unused,
483 if (g_co.use_set != 0 && cfg->set != set)
486 nat64stl_destroy(cfg->name, cfg->set);
492 * Compare nat64stl instances names.
493 * Honor number comparison.
496 nat64name_cmp(const void *a, const void *b)
498 const ipfw_nat64stl_cfg *ca, *cb;
500 ca = (const ipfw_nat64stl_cfg *)a;
501 cb = (const ipfw_nat64stl_cfg *)b;
503 if (ca->set > cb->set)
505 else if (ca->set < cb->set)
507 return (stringnum_cmp(ca->name, cb->name));
511 * Retrieves nat64stl instance list from kernel,
512 * optionally sorts it and calls requested function for each instance.
514 * Request: [ ipfw_obj_lheader ]
515 * Reply: [ ipfw_obj_lheader ipfw_nat64stl_cfg x N ]
518 nat64stl_foreach(nat64stl_cb_t *f, const char *name, uint8_t set, int sort)
520 ipfw_obj_lheader *olh;
521 ipfw_nat64stl_cfg *cfg;
526 /* Start with reasonable default */
527 sz = sizeof(*olh) + 16 * sizeof(*cfg);
529 if ((olh = calloc(1, sz)) == NULL)
533 if (do_get3(IP_FW_NAT64STL_LIST, &olh->opheader, &sz) != 0) {
542 qsort(olh + 1, olh->count, olh->objsize,
545 cfg = (ipfw_nat64stl_cfg *)(olh + 1);
546 for (i = 0; i < olh->count; i++) {
547 error = f(cfg, name, set); /* Ignore errors for now */
548 cfg = (ipfw_nat64stl_cfg *)((caddr_t)cfg +