2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4 * Copyright (c) 2019 Yandex LLC
5 * Copyright (c) 2019 Andrey V. Elsukov <ae@FreeBSD.org>
6 * Copyright (c) 2019 Boris N. Lytochkin <lytboris@gmail.com>
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/counter.h>
36 #include <sys/errno.h>
37 #include <sys/kernel.h>
39 #include <sys/malloc.h>
41 #include <sys/module.h>
42 #include <sys/rmlock.h>
43 #include <sys/rwlock.h>
44 #include <sys/socket.h>
45 #include <sys/sockopt.h>
46 #include <sys/syslog.h>
47 #include <sys/sysctl.h>
50 #include <net/if_var.h>
51 #include <net/route.h>
54 #include <netinet/in.h>
55 #include <netinet/ip_var.h>
56 #include <netinet/ip_fw.h>
57 #include <netinet6/in6_var.h>
58 #include <netinet6/ip6_var.h>
59 #include <netinet6/ip_fw_nat64.h>
61 #include <netpfil/ipfw/ip_fw_private.h>
63 #include "nat64clat.h"
65 VNET_DEFINE(uint16_t, nat64clat_eid) = 0;
67 static struct nat64clat_cfg *nat64clat_alloc_config(const char *name,
69 static void nat64clat_free_config(struct nat64clat_cfg *cfg);
70 static struct nat64clat_cfg *nat64clat_find(struct namedobj_instance *ni,
71 const char *name, uint8_t set);
73 static struct nat64clat_cfg *
74 nat64clat_alloc_config(const char *name, uint8_t set)
76 struct nat64clat_cfg *cfg;
78 cfg = malloc(sizeof(struct nat64clat_cfg), M_IPFW, M_WAITOK | M_ZERO);
79 COUNTER_ARRAY_ALLOC(cfg->base.stats.cnt, NAT64STATS, M_WAITOK);
80 cfg->no.name = cfg->name;
81 cfg->no.etlv = IPFW_TLV_NAT64CLAT_NAME;
83 strlcpy(cfg->name, name, sizeof(cfg->name));
88 nat64clat_free_config(struct nat64clat_cfg *cfg)
91 COUNTER_ARRAY_FREE(cfg->base.stats.cnt, NAT64STATS);
96 nat64clat_export_config(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg,
97 ipfw_nat64clat_cfg *uc)
99 uc->plat_prefix = cfg->base.plat_prefix;
100 uc->plat_plen = cfg->base.plat_plen;
101 uc->clat_prefix = cfg->base.clat_prefix;
102 uc->clat_plen = cfg->base.clat_plen;
103 uc->flags = cfg->base.flags & NAT64CLAT_FLAGSMASK;
104 uc->set = cfg->no.set;
105 strlcpy(uc->name, cfg->no.name, sizeof(uc->name));
108 struct nat64clat_dump_arg {
109 struct ip_fw_chain *ch;
110 struct sockopt_data *sd;
114 export_config_cb(struct namedobj_instance *ni, struct named_object *no,
117 struct nat64clat_dump_arg *da = (struct nat64clat_dump_arg *)arg;
118 ipfw_nat64clat_cfg *uc;
120 uc = (ipfw_nat64clat_cfg *)ipfw_get_sopt_space(da->sd, sizeof(*uc));
121 nat64clat_export_config(da->ch, (struct nat64clat_cfg *)no, uc);
125 static struct nat64clat_cfg *
126 nat64clat_find(struct namedobj_instance *ni, const char *name, uint8_t set)
128 struct nat64clat_cfg *cfg;
130 cfg = (struct nat64clat_cfg *)ipfw_objhash_lookup_name_type(ni, set,
131 IPFW_TLV_NAT64CLAT_NAME, name);
137 * Creates new consumer-side nat64 translator instance.
138 * Data layout (v0)(current):
139 * Request: [ ipfw_obj_lheader ipfw_nat64clat_cfg ]
141 * Returns 0 on success
144 nat64clat_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
145 struct sockopt_data *sd)
147 ipfw_obj_lheader *olh;
148 ipfw_nat64clat_cfg *uc;
149 struct namedobj_instance *ni;
150 struct nat64clat_cfg *cfg;
152 if (sd->valsize != sizeof(*olh) + sizeof(*uc))
155 olh = (ipfw_obj_lheader *)sd->kbuf;
156 uc = (ipfw_nat64clat_cfg *)(olh + 1);
158 if (ipfw_check_object_name_generic(uc->name) != 0)
161 if (uc->set >= IPFW_MAX_SETS ||
162 nat64_check_prefix6(&uc->plat_prefix, uc->plat_plen) != 0 ||
163 nat64_check_prefix6(&uc->clat_prefix, uc->clat_plen) != 0)
166 ni = CHAIN_TO_SRV(ch);
169 if (nat64clat_find(ni, uc->name, uc->set) != NULL) {
175 cfg = nat64clat_alloc_config(uc->name, uc->set);
176 cfg->base.plat_prefix = uc->plat_prefix;
177 cfg->base.plat_plen = uc->plat_plen;
178 cfg->base.clat_prefix = uc->clat_prefix;
179 cfg->base.clat_plen = uc->clat_plen;
180 cfg->base.flags = (uc->flags & NAT64CLAT_FLAGSMASK) |
181 NAT64_CLATPFX | NAT64_PLATPFX;
182 if (IN6_IS_ADDR_WKPFX(&cfg->base.plat_prefix))
183 cfg->base.flags |= NAT64_WKPFX;
187 if (nat64clat_find(ni, uc->name, uc->set) != NULL) {
189 nat64clat_free_config(cfg);
193 if (ipfw_objhash_alloc_idx(ni, &cfg->no.kidx) != 0) {
195 nat64clat_free_config(cfg);
198 ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no);
199 /* Okay, let's link data */
200 SRV_OBJECT(ch, cfg->no.kidx) = cfg;
207 * Change existing nat64clat instance configuration.
208 * Data layout (v0)(current):
209 * Request: [ ipfw_obj_header ipfw_nat64clat_cfg ]
210 * Reply: [ ipfw_obj_header ipfw_nat64clat_cfg ]
212 * Returns 0 on success
215 nat64clat_config(struct ip_fw_chain *ch, ip_fw3_opheader *op,
216 struct sockopt_data *sd)
219 ipfw_nat64clat_cfg *uc;
220 struct nat64clat_cfg *cfg;
221 struct namedobj_instance *ni;
224 if (sd->valsize != sizeof(*oh) + sizeof(*uc))
227 oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd,
228 sizeof(*oh) + sizeof(*uc));
229 uc = (ipfw_nat64clat_cfg *)(oh + 1);
231 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
232 oh->ntlv.set >= IPFW_MAX_SETS)
235 ni = CHAIN_TO_SRV(ch);
236 if (sd->sopt->sopt_dir == SOPT_GET) {
238 cfg = nat64clat_find(ni, oh->ntlv.name, oh->ntlv.set);
243 nat64clat_export_config(ch, cfg, uc);
249 cfg = nat64clat_find(ni, oh->ntlv.name, oh->ntlv.set);
256 * For now allow to change only following values:
257 * plat_prefix, plat_plen, clat_prefix, clat_plen, flags.
260 if (uc->plat_plen != cfg->base.plat_plen ||
261 !IN6_ARE_ADDR_EQUAL(&uc->plat_prefix, &cfg->base.plat_prefix)) {
262 if (nat64_check_prefix6(&uc->plat_prefix, uc->plat_plen) != 0) {
266 flags |= NAT64_PLATPFX;
269 if (uc->clat_plen != cfg->base.clat_plen ||
270 !IN6_ARE_ADDR_EQUAL(&uc->clat_prefix, &cfg->base.clat_prefix)) {
271 if (nat64_check_prefix6(&uc->clat_prefix, uc->clat_plen) != 0) {
275 flags |= NAT64_CLATPFX;
280 if (flags & NAT64_PLATPFX) {
281 cfg->base.plat_prefix = uc->plat_prefix;
282 cfg->base.plat_plen = uc->plat_plen;
284 if (flags & NAT64_CLATPFX) {
285 cfg->base.clat_prefix = uc->clat_prefix;
286 cfg->base.clat_plen = uc->clat_plen;
291 cfg->base.flags &= ~NAT64CLAT_FLAGSMASK;
292 cfg->base.flags |= uc->flags & NAT64CLAT_FLAGSMASK;
299 nat64clat_detach_config(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg)
302 IPFW_UH_WLOCK_ASSERT(ch);
304 ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no);
305 ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx);
309 * Destroys nat64 instance.
310 * Data layout (v0)(current):
311 * Request: [ ipfw_obj_header ]
313 * Returns 0 on success
316 nat64clat_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
317 struct sockopt_data *sd)
320 struct nat64clat_cfg *cfg;
322 if (sd->valsize != sizeof(*oh))
325 oh = (ipfw_obj_header *)sd->kbuf;
326 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0)
330 cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
335 if (cfg->no.refcnt > 0) {
340 ipfw_reset_eaction_instance(ch, V_nat64clat_eid, cfg->no.kidx);
341 SRV_OBJECT(ch, cfg->no.kidx) = NULL;
342 nat64clat_detach_config(ch, cfg);
345 nat64clat_free_config(cfg);
350 * Lists all nat64clat instances currently available in kernel.
351 * Data layout (v0)(current):
352 * Request: [ ipfw_obj_lheader ]
353 * Reply: [ ipfw_obj_lheader ipfw_nat64clat_cfg x N ]
355 * Returns 0 on success
358 nat64clat_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
359 struct sockopt_data *sd)
361 ipfw_obj_lheader *olh;
362 struct nat64clat_dump_arg da;
364 /* Check minimum header size */
365 if (sd->valsize < sizeof(ipfw_obj_lheader))
368 olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh));
371 olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch),
372 IPFW_TLV_NAT64CLAT_NAME);
373 olh->objsize = sizeof(ipfw_nat64clat_cfg);
374 olh->size = sizeof(*olh) + olh->count * olh->objsize;
376 if (sd->valsize < olh->size) {
380 memset(&da, 0, sizeof(da));
383 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb,
384 &da, IPFW_TLV_NAT64CLAT_NAME);
390 #define __COPY_STAT_FIELD(_cfg, _stats, _field) \
391 (_stats)->_field = NAT64STAT_FETCH(&(_cfg)->base.stats, _field)
393 export_stats(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg,
394 struct ipfw_nat64clat_stats *stats)
397 __COPY_STAT_FIELD(cfg, stats, opcnt64);
398 __COPY_STAT_FIELD(cfg, stats, opcnt46);
399 __COPY_STAT_FIELD(cfg, stats, ofrags);
400 __COPY_STAT_FIELD(cfg, stats, ifrags);
401 __COPY_STAT_FIELD(cfg, stats, oerrors);
402 __COPY_STAT_FIELD(cfg, stats, noroute4);
403 __COPY_STAT_FIELD(cfg, stats, noroute6);
404 __COPY_STAT_FIELD(cfg, stats, noproto);
405 __COPY_STAT_FIELD(cfg, stats, nomem);
406 __COPY_STAT_FIELD(cfg, stats, dropped);
410 * Get nat64clat statistics.
411 * Data layout (v0)(current):
412 * Request: [ ipfw_obj_header ]
413 * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ]]
415 * Returns 0 on success
418 nat64clat_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
419 struct sockopt_data *sd)
421 struct ipfw_nat64clat_stats stats;
422 struct nat64clat_cfg *cfg;
427 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats);
428 if (sd->valsize % sizeof(uint64_t))
430 if (sd->valsize < sz)
432 oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
435 memset(&stats, 0, sizeof(stats));
438 cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
443 export_stats(ch, cfg, &stats);
446 ctlv = (ipfw_obj_ctlv *)(oh + 1);
447 memset(ctlv, 0, sizeof(*ctlv));
448 ctlv->head.type = IPFW_TLV_COUNTERS;
449 ctlv->head.length = sz - sizeof(ipfw_obj_header);
450 ctlv->count = sizeof(stats) / sizeof(uint64_t);
451 ctlv->objsize = sizeof(uint64_t);
452 ctlv->version = IPFW_NAT64_VERSION;
453 memcpy(ctlv + 1, &stats, sizeof(stats));
458 * Reset nat64clat statistics.
459 * Data layout (v0)(current):
460 * Request: [ ipfw_obj_header ]
462 * Returns 0 on success
465 nat64clat_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
466 struct sockopt_data *sd)
468 struct nat64clat_cfg *cfg;
471 if (sd->valsize != sizeof(*oh))
473 oh = (ipfw_obj_header *)sd->kbuf;
474 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
475 oh->ntlv.set >= IPFW_MAX_SETS)
479 cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
484 COUNTER_ARRAY_ZERO(cfg->base.stats.cnt, NAT64STATS);
489 static struct ipfw_sopt_handler scodes[] = {
490 { IP_FW_NAT64CLAT_CREATE, 0, HDIR_SET, nat64clat_create },
491 { IP_FW_NAT64CLAT_DESTROY,0, HDIR_SET, nat64clat_destroy },
492 { IP_FW_NAT64CLAT_CONFIG, 0, HDIR_BOTH, nat64clat_config },
493 { IP_FW_NAT64CLAT_LIST, 0, HDIR_GET, nat64clat_list },
494 { IP_FW_NAT64CLAT_STATS, 0, HDIR_GET, nat64clat_stats },
495 { IP_FW_NAT64CLAT_RESET_STATS,0, HDIR_SET, nat64clat_reset_stats },
499 nat64clat_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
504 if (icmd->opcode != O_EXTERNAL_ACTION ||
505 icmd->arg1 != V_nat64clat_eid)
514 nat64clat_update_arg1(ipfw_insn *cmd, uint16_t idx)
521 nat64clat_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
522 struct named_object **pno)
526 err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti,
527 IPFW_TLV_NAT64CLAT_NAME, pno);
531 static struct named_object *
532 nat64clat_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
534 struct namedobj_instance *ni;
535 struct named_object *no;
537 IPFW_UH_WLOCK_ASSERT(ch);
538 ni = CHAIN_TO_SRV(ch);
539 no = ipfw_objhash_lookup_kidx(ni, idx);
540 KASSERT(no != NULL, ("NAT with index %d not found", idx));
546 nat64clat_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
547 enum ipfw_sets_cmd cmd)
550 return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64CLAT_NAME,
554 static struct opcode_obj_rewrite opcodes[] = {
556 .opcode = O_EXTERNAL_INSTANCE,
557 .etlv = IPFW_TLV_EACTION /* just show it isn't table */,
558 .classifier = nat64clat_classify,
559 .update = nat64clat_update_arg1,
560 .find_byname = nat64clat_findbyname,
561 .find_bykidx = nat64clat_findbykidx,
562 .manage_sets = nat64clat_manage_sets,
567 destroy_config_cb(struct namedobj_instance *ni, struct named_object *no,
570 struct nat64clat_cfg *cfg;
571 struct ip_fw_chain *ch;
573 ch = (struct ip_fw_chain *)arg;
574 cfg = (struct nat64clat_cfg *)SRV_OBJECT(ch, no->kidx);
575 SRV_OBJECT(ch, no->kidx) = NULL;
576 nat64clat_detach_config(ch, cfg);
577 nat64clat_free_config(cfg);
582 nat64clat_init(struct ip_fw_chain *ch, int first)
585 V_nat64clat_eid = ipfw_add_eaction(ch, ipfw_nat64clat, "nat64clat");
586 if (V_nat64clat_eid == 0)
588 IPFW_ADD_SOPT_HANDLER(first, scodes);
589 IPFW_ADD_OBJ_REWRITER(first, opcodes);
594 nat64clat_uninit(struct ip_fw_chain *ch, int last)
597 IPFW_DEL_OBJ_REWRITER(last, opcodes);
598 IPFW_DEL_SOPT_HANDLER(last, scodes);
599 ipfw_del_eaction(ch, V_nat64clat_eid);
601 * Since we already have deregistered external action,
602 * our named objects become unaccessible via rules, because
603 * all rules were truncated by ipfw_del_eaction().
604 * So, we can unlink and destroy our named objects without holding
608 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch,
609 IPFW_TLV_NAT64CLAT_NAME);