2 * Copyright (c) 2015-2016 Yandex LLC
3 * Copyright (c) 2015-2016 Andrey V. Elsukov <ae@FreeBSD.org>
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
31 #include <sys/types.h>
32 #include <sys/socket.h>
47 #include <netinet/in.h>
48 #include <netinet/ip_fw.h>
49 #include <netinet6/ip_fw_nat64.h>
50 #include <arpa/inet.h>
52 typedef int (nat64stl_cb_t)(ipfw_nat64stl_cfg *i, const char *name,
54 static int nat64stl_foreach(nat64stl_cb_t *f, const char *name, uint8_t set,
57 static void nat64stl_create(const char *name, uint8_t set, int ac, char **av);
58 static void nat64stl_config(const char *name, uint8_t set, int ac, char **av);
59 static void nat64stl_destroy(const char *name, uint8_t set);
60 static void nat64stl_stats(const char *name, uint8_t set);
61 static void nat64stl_reset_stats(const char *name, uint8_t set);
62 static int nat64stl_show_cb(ipfw_nat64stl_cfg *cfg, const char *name,
64 static int nat64stl_destroy_cb(ipfw_nat64stl_cfg *cfg, const char *name,
67 static struct _s_x nat64cmds[] = {
68 { "create", TOK_CREATE },
69 { "config", TOK_CONFIG },
70 { "destroy", TOK_DESTROY },
73 { "stats", TOK_STATS },
77 #define IPV6_ADDR_INT32_WKPFX htonl(0x64ff9b)
78 #define IN6_IS_ADDR_WKPFX(a) \
79 ((a)->__u6_addr.__u6_addr32[0] == IPV6_ADDR_INT32_WKPFX && \
80 (a)->__u6_addr.__u6_addr32[1] == 0 && \
81 (a)->__u6_addr.__u6_addr32[2] == 0)
83 ipfw_check_nat64prefix(const struct in6_addr *prefix, int length)
92 /* Well-known prefix has 96 prefix length */
93 if (IN6_IS_ADDR_WKPFX(prefix))
97 /* Bits 64 to 71 must be set to zero */
98 if (prefix->__u6_addr.__u6_addr8[8] != 0)
100 /* XXX: looks incorrect */
101 if (IN6_IS_ADDR_MULTICAST(prefix) ||
102 IN6_IS_ADDR_UNSPECIFIED(prefix) ||
103 IN6_IS_ADDR_LOOPBACK(prefix))
110 static struct _s_x nat64statscmds[] = {
111 { "reset", TOK_RESET },
116 * This one handles all nat64stl-related commands
117 * ipfw [set N] nat64stl NAME {create | config} ...
118 * ipfw [set N] nat64stl NAME stats [reset]
119 * ipfw [set N] nat64stl {NAME | all} destroy
120 * ipfw [set N] nat64stl {NAME | all} {list | show}
122 #define nat64stl_check_name table_check_name
124 ipfw_nat64stl_handler(int ac, char *av[])
131 set = co.use_set - 1;
136 NEED1("nat64stl needs instance name");
138 if (nat64stl_check_name(name) != 0) {
139 if (strcmp(name, "all") == 0)
142 errx(EX_USAGE, "nat64stl instance name %s is invalid",
146 NEED1("nat64stl needs command");
148 tcmd = get_token(nat64cmds, *av, "nat64stl command");
149 if (name == NULL && tcmd != TOK_DESTROY && tcmd != TOK_LIST)
150 errx(EX_USAGE, "nat64stl instance name required");
154 nat64stl_create(name, set, ac, av);
158 nat64stl_config(name, set, ac, av);
161 nat64stl_foreach(nat64stl_show_cb, name, set, 1);
165 nat64stl_foreach(nat64stl_destroy_cb, NULL, set, 0);
167 nat64stl_destroy(name, set);
172 nat64stl_stats(name, set);
175 tcmd = get_token(nat64statscmds, *av, "stats command");
176 if (tcmd == TOK_RESET)
177 nat64stl_reset_stats(name, set);
183 nat64stl_fill_ntlv(ipfw_obj_ntlv *ntlv, const char *name, uint8_t set)
186 ntlv->head.type = IPFW_TLV_EACTION_NAME(1); /* it doesn't matter */
187 ntlv->head.length = sizeof(ipfw_obj_ntlv);
190 strlcpy(ntlv->name, name, sizeof(ntlv->name));
193 static struct _s_x nat64newcmds[] = {
194 { "table4", TOK_TABLE4 },
195 { "table6", TOK_TABLE6 },
196 { "prefix6", TOK_PREFIX6 },
198 { "-log", TOK_LOGOFF },
203 * Creates new nat64stl instance
204 * ipfw nat64stl <NAME> create table4 <name> table6 <name> [ prefix6 <prefix>]
205 * Request: [ ipfw_obj_lheader ipfw_nat64stl_cfg ]
207 #define NAT64STL_HAS_TABLE4 0x01
208 #define NAT64STL_HAS_TABLE6 0x02
209 #define NAT64STL_HAS_PREFIX6 0x04
211 nat64stl_create(const char *name, uint8_t set, int ac, char *av[])
213 char buf[sizeof(ipfw_obj_lheader) + sizeof(ipfw_nat64stl_cfg)];
214 ipfw_nat64stl_cfg *cfg;
215 ipfw_obj_lheader *olh;
219 memset(buf, 0, sizeof(buf));
220 olh = (ipfw_obj_lheader *)buf;
221 cfg = (ipfw_nat64stl_cfg *)(olh + 1);
223 /* Some reasonable defaults */
224 inet_pton(AF_INET6, "64:ff9b::", &cfg->prefix6);
227 flags = NAT64STL_HAS_PREFIX6;
229 tcmd = get_token(nat64newcmds, *av, "option");
234 NEED1("table name required");
235 table_fill_ntlv(&cfg->ntlv4, *av, set, 4);
236 flags |= NAT64STL_HAS_TABLE4;
240 NEED1("table name required");
241 table_fill_ntlv(&cfg->ntlv6, *av, set, 6);
242 flags |= NAT64STL_HAS_TABLE6;
246 NEED1("IPv6 prefix6 required");
247 if ((p = strchr(*av, '/')) != NULL)
249 if (inet_pton(AF_INET6, *av, &cfg->prefix6) != 1)
251 "Bad prefix: %s", *av);
252 cfg->plen6 = strtol(p, NULL, 10);
253 if (ipfw_check_nat64prefix(&cfg->prefix6,
256 "Bad prefix length: %s", p);
257 flags |= NAT64STL_HAS_PREFIX6;
261 cfg->flags |= NAT64_LOG;
264 cfg->flags &= ~NAT64_LOG;
269 /* Check validness */
270 if ((flags & NAT64STL_HAS_TABLE4) != NAT64STL_HAS_TABLE4)
271 errx(EX_USAGE, "table4 required");
272 if ((flags & NAT64STL_HAS_TABLE6) != NAT64STL_HAS_TABLE6)
273 errx(EX_USAGE, "table6 required");
274 if ((flags & NAT64STL_HAS_PREFIX6) != NAT64STL_HAS_PREFIX6)
275 errx(EX_USAGE, "prefix6 required");
278 olh->objsize = sizeof(*cfg);
279 olh->size = sizeof(buf);
280 strlcpy(cfg->name, name, sizeof(cfg->name));
281 if (do_set3(IP_FW_NAT64STL_CREATE, &olh->opheader, sizeof(buf)) != 0)
282 err(EX_OSERR, "nat64stl instance creation failed");
286 * Configures existing nat64stl instance
287 * ipfw nat64stl <NAME> config <options>
288 * Request: [ ipfw_obj_header ipfw_nat64stl_cfg ]
291 nat64stl_config(const char *name, uint8_t set, int ac, char **av)
293 char buf[sizeof(ipfw_obj_header) + sizeof(ipfw_nat64stl_cfg)];
294 ipfw_nat64stl_cfg *cfg;
301 errx(EX_USAGE, "config options required");
302 memset(&buf, 0, sizeof(buf));
303 oh = (ipfw_obj_header *)buf;
304 cfg = (ipfw_nat64stl_cfg *)(oh + 1);
307 nat64stl_fill_ntlv(&oh->ntlv, name, set);
308 if (do_get3(IP_FW_NAT64STL_CONFIG, &oh->opheader, &sz) != 0)
309 err(EX_OSERR, "failed to get config for instance %s", name);
312 tcmd = get_token(nat64newcmds, *av, "option");
319 NEED1("table name required");
320 table_fill_ntlv(&cfg->ntlv4, *av, set, 4);
324 NEED1("table name required");
325 table_fill_ntlv(&cfg->ntlv6, *av, set, 6);
330 cfg->flags |= NAT64_LOG;
333 cfg->flags &= ~NAT64_LOG;
336 errx(EX_USAGE, "Can't change %s option", opt);
340 if (do_set3(IP_FW_NAT64STL_CONFIG, &oh->opheader, sizeof(buf)) != 0)
341 err(EX_OSERR, "nat64stl instance configuration failed");
345 * Destroys nat64stl instance.
346 * Request: [ ipfw_obj_header ]
349 nat64stl_destroy(const char *name, uint8_t set)
353 memset(&oh, 0, sizeof(oh));
354 nat64stl_fill_ntlv(&oh.ntlv, name, set);
355 if (do_set3(IP_FW_NAT64STL_DESTROY, &oh.opheader, sizeof(oh)) != 0)
356 err(EX_OSERR, "failed to destroy nat instance %s", name);
360 * Get nat64stl instance statistics.
361 * Request: [ ipfw_obj_header ]
362 * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ] ]
365 nat64stl_get_stats(const char *name, uint8_t set,
366 struct ipfw_nat64stl_stats *stats)
372 sz = sizeof(*oh) + sizeof(*oc) + sizeof(*stats);
374 nat64stl_fill_ntlv(&oh->ntlv, name, set);
375 if (do_get3(IP_FW_NAT64STL_STATS, &oh->opheader, &sz) == 0) {
376 oc = (ipfw_obj_ctlv *)(oh + 1);
377 memcpy(stats, oc + 1, sizeof(*stats));
386 nat64stl_stats(const char *name, uint8_t set)
388 struct ipfw_nat64stl_stats stats;
390 if (nat64stl_get_stats(name, set, &stats) != 0)
391 err(EX_OSERR, "Error retrieving stats");
393 if (co.use_set != 0 || set != 0)
394 printf("set %u ", set);
395 printf("nat64stl %s\n", name);
397 printf("\t%ju packets translated from IPv6 to IPv4\n",
398 (uintmax_t)stats.opcnt64);
399 printf("\t%ju packets translated from IPv4 to IPv6\n",
400 (uintmax_t)stats.opcnt46);
401 printf("\t%ju IPv6 fragments created\n",
402 (uintmax_t)stats.ofrags);
403 printf("\t%ju IPv4 fragments received\n",
404 (uintmax_t)stats.ifrags);
405 printf("\t%ju output packets dropped due to no bufs, etc.\n",
406 (uintmax_t)stats.oerrors);
407 printf("\t%ju output packets discarded due to no IPv4 route\n",
408 (uintmax_t)stats.noroute4);
409 printf("\t%ju output packets discarded due to no IPv6 route\n",
410 (uintmax_t)stats.noroute6);
411 printf("\t%ju packets discarded due to unsupported protocol\n",
412 (uintmax_t)stats.noproto);
413 printf("\t%ju packets discarded due to memory allocation problems\n",
414 (uintmax_t)stats.nomem);
415 printf("\t%ju packets discarded due to some errors\n",
416 (uintmax_t)stats.dropped);
420 * Reset nat64stl instance statistics specified by @oh->ntlv.
421 * Request: [ ipfw_obj_header ]
424 nat64stl_reset_stats(const char *name, uint8_t set)
428 memset(&oh, 0, sizeof(oh));
429 nat64stl_fill_ntlv(&oh.ntlv, name, set);
430 if (do_set3(IP_FW_NAT64STL_RESET_STATS, &oh.opheader, sizeof(oh)) != 0)
431 err(EX_OSERR, "failed to reset stats for instance %s", name);
435 nat64stl_show_cb(ipfw_nat64stl_cfg *cfg, const char *name, uint8_t set)
437 char abuf[INET6_ADDRSTRLEN];
439 if (name != NULL && strcmp(cfg->name, name) != 0)
442 if (co.use_set != 0 && cfg->set != set)
445 if (co.use_set != 0 || cfg->set != 0)
446 printf("set %u ", cfg->set);
448 printf("nat64stl %s table4 %s table6 %s",
449 cfg->name, cfg->ntlv4.name, cfg->ntlv6.name);
450 inet_ntop(AF_INET6, &cfg->prefix6, abuf, sizeof(abuf));
451 printf(" prefix6 %s/%u", abuf, cfg->plen6);
452 if (cfg->flags & NAT64_LOG)
459 nat64stl_destroy_cb(ipfw_nat64stl_cfg *cfg, const char *name, uint8_t set)
462 if (co.use_set != 0 && cfg->set != set)
465 nat64stl_destroy(cfg->name, cfg->set);
471 * Compare nat64stl instances names.
472 * Honor number comparison.
475 nat64name_cmp(const void *a, const void *b)
477 ipfw_nat64stl_cfg *ca, *cb;
479 ca = (ipfw_nat64stl_cfg *)a;
480 cb = (ipfw_nat64stl_cfg *)b;
482 if (ca->set > cb->set)
484 else if (ca->set < cb->set)
486 return (stringnum_cmp(ca->name, cb->name));
490 * Retrieves nat64stl instance list from kernel,
491 * optionally sorts it and calls requested function for each instance.
493 * Request: [ ipfw_obj_lheader ]
494 * Reply: [ ipfw_obj_lheader ipfw_nat64stl_cfg x N ]
497 nat64stl_foreach(nat64stl_cb_t *f, const char *name, uint8_t set, int sort)
499 ipfw_obj_lheader *olh;
500 ipfw_nat64stl_cfg *cfg;
504 /* Start with reasonable default */
505 sz = sizeof(*olh) + 16 * sizeof(*cfg);
507 if ((olh = calloc(1, sz)) == NULL)
511 if (do_get3(IP_FW_NAT64STL_LIST, &olh->opheader, &sz) != 0) {
520 qsort(olh + 1, olh->count, olh->objsize,
523 cfg = (ipfw_nat64stl_cfg *)(olh + 1);
524 for (i = 0; i < olh->count; i++) {
525 error = f(cfg, name, set); /* Ignore errors for now */
526 cfg = (ipfw_nat64stl_cfg *)((caddr_t)cfg +