sys/netpfil/ipfw/nat64/nat64lsn.h

   1 /*-
   2  * Copyright (c) 2015 Yandex LLC
   3  * Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org>
   4  * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org>
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  27  *
  28  * $FreeBSD$
  29  */
  30
  31 #ifndef _IP_FW_NAT64LSN_H_
  32 #define _IP_FW_NAT64LSN_H_
  33
  34 #include "ip_fw_nat64.h"
  35 #include "nat64_translate.h"
  36
  37 #define NAT64_CHUNK_SIZE_BITS   6       /* 64 ports */
  38 #define NAT64_CHUNK_SIZE        (1 << NAT64_CHUNK_SIZE_BITS)
  39
  40 #define NAT64_MIN_PORT          1024
  41 #define NAT64_MIN_CHUNK         (NAT64_MIN_PORT >> NAT64_CHUNK_SIZE_BITS)
  42
  43 struct st_ptr {
  44         uint8_t                 idx;    /* index in nh->pg_ptr array.
  45                                          * NOTE: it starts from 1.
  46                                          */
  47         uint8_t                 off;
  48 };
  49 #define NAT64LSN_MAXPGPTR       ((1 << (sizeof(uint8_t) * NBBY)) - 1)
  50 #define NAT64LSN_PGPTRMASKBITS  (sizeof(uint64_t) * NBBY)
  51 #define NAT64LSN_PGPTRNMASK     (roundup(NAT64LSN_MAXPGPTR,     \
  52     NAT64LSN_PGPTRMASKBITS) / NAT64LSN_PGPTRMASKBITS)
  53
  54 struct nat64lsn_portgroup;
  55 /* sizeof(struct nat64lsn_host) = 64 + 64x2 + 8x8 = 256 bytes */
  56 struct nat64lsn_host {
  57         struct rwlock   h_lock;         /* Host states lock */
  58
  59         struct in6_addr addr;
  60         struct nat64lsn_host    *next;
  61         uint16_t        timestamp;      /* Last altered */
  62         uint16_t        hsize;          /* ports hash size */
  63         uint16_t        pg_used;        /* Number of portgroups used */
  64 #define NAT64LSN_REMAININGPG    8       /* Number of remaining PG before
  65                                          * requesting of new chunk of indexes.
  66                                          */
  67         uint16_t        pg_allocated;   /* Number of portgroups indexes
  68                                          * allocated.
  69                                          */
  70 #define NAT64LSN_HSIZE  64
  71         struct st_ptr   phash[NAT64LSN_HSIZE]; /* XXX: hardcoded size */
  72         /*
  73          * PG indexes are stored in chunks with 32 elements.
  74          * The maximum count is limited to 255 due to st_ptr->idx is uint8_t.
  75          */
  76 #define NAT64LSN_PGIDX_CHUNK    32
  77 #define NAT64LSN_PGNIDX         (roundup(NAT64LSN_MAXPGPTR, \
  78     NAT64LSN_PGIDX_CHUNK) / NAT64LSN_PGIDX_CHUNK)
  79         struct nat64lsn_portgroup **pg_ptr[NAT64LSN_PGNIDX]; /* PG indexes */
  80 };
  81
  82 #define NAT64_RLOCK_ASSERT(h)   rw_assert(&(h)->h_lock, RA_RLOCKED)
  83 #define NAT64_WLOCK_ASSERT(h)   rw_assert(&(h)->h_lock, RA_WLOCKED)
  84
  85 #define NAT64_RLOCK(h)          rw_rlock(&(h)->h_lock)
  86 #define NAT64_RUNLOCK(h)        rw_runlock(&(h)->h_lock)
  87 #define NAT64_WLOCK(h)          rw_wlock(&(h)->h_lock)
  88 #define NAT64_WUNLOCK(h)        rw_wunlock(&(h)->h_lock)
  89 #define NAT64_LOCK(h)           NAT64_WLOCK(h)
  90 #define NAT64_UNLOCK(h)         NAT64_WUNLOCK(h)
  91 #define NAT64_LOCK_INIT(h) do {                 \
  92         rw_init(&(h)->h_lock, "NAT64 host lock");       \
  93         } while (0)
  94
  95 #define NAT64_LOCK_DESTROY(h) do {                      \
  96         rw_destroy(&(h)->h_lock);                       \
  97         } while (0)
  98
  99 /* Internal proto index */
 100 #define NAT_PROTO_TCP   1
 101 #define NAT_PROTO_UDP   2
 102 #define NAT_PROTO_ICMP  3
 103
 104 #define NAT_MAX_PROTO   4
 105 extern uint8_t nat64lsn_rproto_map[NAT_MAX_PROTO];
 106
 107 VNET_DECLARE(uint16_t, nat64lsn_eid);
 108 #define V_nat64lsn_eid          VNET(nat64lsn_eid)
 109 #define IPFW_TLV_NAT64LSN_NAME  IPFW_TLV_EACTION_NAME(V_nat64lsn_eid)
 110
 111 /* Timestamp macro */
 112 #define _CT             ((int)time_uptime % 65536)
 113 #define SET_AGE(x)      (x) = _CT
 114 #define GET_AGE(x)      ((_CT >= (x)) ? _CT - (x) :     \
 115         (int)65536 + _CT - (x))
 116
 117 #ifdef __LP64__
 118 /* ffsl() is capable of checking 64-bit ints */
 119 #define _FFS64
 120 #endif
 121
 122 /* 16 bytes */
 123 struct nat64lsn_state {
 124         union {
 125                 struct {
 126                         in_addr_t       faddr;  /* Remote IPv4 address */
 127                         uint16_t        fport;  /* Remote IPv4 port */
 128                         uint16_t        lport;  /* Local IPv6 port */
 129                 }s;
 130                 uint64_t                hkey;
 131         } u;
 132         uint8_t         nat_proto;
 133         uint8_t         flags;
 134         uint16_t        timestamp;
 135         struct st_ptr   cur; /* Index of portgroup in nat64lsn_host */
 136         struct st_ptr   next; /* Next entry index */
 137 };
 138
 139 /*
 140  * 1024+32 bytes per 64 states, used to store state
 141  * AND for outside-in state lookup
 142  */
 143 struct nat64lsn_portgroup {
 144         struct nat64lsn_host    *host;  /* IPv6 source host info */
 145         in_addr_t               aaddr;  /* Alias addr, network format */
 146         uint16_t                aport;  /* Base port */
 147         uint16_t                timestamp;
 148         uint8_t                 nat_proto;
 149         uint8_t                 spare[3];
 150         uint32_t                idx;
 151 #ifdef _FFS64
 152         uint64_t                freemask;       /* Mask of free entries */
 153 #else
 154         uint32_t                freemask[2];    /* Mask of free entries */
 155 #endif
 156         struct nat64lsn_state   states[NAT64_CHUNK_SIZE]; /* State storage */
 157 };
 158 #ifdef _FFS64
 159 #define PG_MARK_BUSY_IDX(_pg, _idx)     (_pg)->freemask &= ~((uint64_t)1<<(_idx))
 160 #define PG_MARK_FREE_IDX(_pg, _idx)     (_pg)->freemask |= ((uint64_t)1<<(_idx))
 161 #define PG_IS_FREE_IDX(_pg, _idx)       ((_pg)->freemask & ((uint64_t)1<<(_idx)))
 162 #define PG_IS_BUSY_IDX(_pg, _idx)       (PG_IS_FREE_IDX(_pg, _idx) == 0)
 163 #define PG_GET_FREE_IDX(_pg)            (ffsll((_pg)->freemask))
 164 #define PG_IS_EMPTY(_pg)                (((_pg)->freemask + 1) == 0)
 165 #else
 166 #define PG_MARK_BUSY_IDX(_pg, _idx)     \
 167         (_pg)->freemask[(_idx) / 32] &= ~((u_long)1<<((_idx) % 32))
 168 #define PG_MARK_FREE_IDX(_pg, _idx)     \
 169         (_pg)->freemask[(_idx) / 32] |= ((u_long)1<<((_idx)  % 32))
 170 #define PG_IS_FREE_IDX(_pg, _idx)       \
 171         ((_pg)->freemask[(_idx) / 32] & ((u_long)1<<((_idx) % 32)))
 172 #define PG_IS_BUSY_IDX(_pg, _idx)       (PG_IS_FREE_IDX(_pg, _idx) == 0)
 173 #define PG_GET_FREE_IDX(_pg)            _pg_get_free_idx(_pg)
 174 #define PG_IS_EMPTY(_pg)                \
 175         ((((_pg)->freemask[0] + 1) == 0 && ((_pg)->freemask[1] + 1) == 0))
 176
 177 static inline int
 178 _pg_get_free_idx(const struct nat64lsn_portgroup *pg)
 179 {
 180         int i;
 181
 182         if ((i = ffsl(pg->freemask[0])) != 0)
 183                 return (i);
 184         if ((i = ffsl(pg->freemask[1])) != 0)
 185                 return (i + 32);
 186         return (0);
 187 }
 188
 189 #endif
 190
 191 TAILQ_HEAD(nat64lsn_job_head, nat64lsn_job_item);
 192
 193 struct nat64lsn_cfg {
 194         struct named_object     no;
 195         struct nat64lsn_portgroup       **pg;   /* XXX: array of pointers */
 196         struct nat64lsn_host    **ih;   /* Host hash */
 197         uint32_t        prefix4;        /* IPv4 prefix */
 198         uint32_t        pmask4;         /* IPv4 prefix mask */
 199         uint32_t        ihsize;         /* IPv6 host hash size */
 200         uint8_t         plen4;
 201         uint8_t         nomatch_verdict;/* What to return to ipfw on no-match */
 202
 203         uint32_t        ihcount;        /* Number of items in host hash */
 204         int             max_chunks;     /* Max chunks per client */
 205         int             agg_prefix_len; /* Prefix length to count */
 206         int             agg_prefix_max; /* Max hosts per agg prefix */
 207         uint32_t        jmaxlen;        /* Max jobqueue length */
 208         uint16_t        min_chunk;      /* Min port group # to use */
 209         uint16_t        max_chunk;      /* Max port group # to use */
 210         uint16_t        nh_delete_delay;        /* Stale host delete delay */
 211         uint16_t        pg_delete_delay;        /* Stale portgroup del delay */
 212         uint16_t        st_syn_ttl;     /* TCP syn expire */
 213         uint16_t        st_close_ttl;   /* TCP fin expire */
 214         uint16_t        st_estab_ttl;   /* TCP established expire */
 215         uint16_t        st_udp_ttl;     /* UDP expire */
 216         uint16_t        st_icmp_ttl;    /* ICMP expire */
 217         uint32_t        protochunks[NAT_MAX_PROTO];/* Number of chunks used */
 218         struct nat64_config     base;
 219 #define NAT64LSN_FLAGSMASK      (NAT64_LOG)
 220
 221         struct callout          periodic;
 222         struct callout          jcallout;
 223         struct ip_fw_chain      *ch;
 224         struct vnet             *vp;
 225         struct nat64lsn_job_head        jhead;
 226         int                     jlen;
 227         char                    name[64];       /* Nat instance name */
 228 };
 229
 230 struct nat64lsn_cfg *nat64lsn_init_instance(struct ip_fw_chain *ch,
 231     size_t numaddr);
 232 void nat64lsn_destroy_instance(struct nat64lsn_cfg *cfg);
 233 void nat64lsn_start_instance(struct nat64lsn_cfg *cfg);
 234 void nat64lsn_init_internal(void);
 235 void nat64lsn_uninit_internal(void);
 236 int ipfw_nat64lsn(struct ip_fw_chain *ch, struct ip_fw_args *args,
 237     ipfw_insn *cmd, int *done);
 238
 239 void
 240 nat64lsn_dump_state(const struct nat64lsn_cfg *cfg,
 241     const struct nat64lsn_portgroup *pg, const struct nat64lsn_state *st,
 242     const char *px, int off);
 243 /*
 244  * Portgroup layout
 245  * addr x nat_proto x port_off
 246  *
 247  */
 248
 249 #define _ADDR_PG_PROTO_COUNT    (65536 >> NAT64_CHUNK_SIZE_BITS)
 250 #define _ADDR_PG_COUNT          (_ADDR_PG_PROTO_COUNT * NAT_MAX_PROTO)
 251
 252 #define GET_ADDR_IDX(_cfg, _addr)       ((_addr) - ((_cfg)->prefix4))
 253 #define __GET_PORTGROUP_IDX(_proto, _port)      \
 254     ((_proto - 1) * _ADDR_PG_PROTO_COUNT +      \
 255         ((_port) >> NAT64_CHUNK_SIZE_BITS))
 256
 257 #define _GET_PORTGROUP_IDX(_cfg, _addr, _proto, _port)  \
 258     GET_ADDR_IDX(_cfg, _addr) * _ADDR_PG_COUNT +        \
 259         __GET_PORTGROUP_IDX(_proto, _port)
 260 #define GET_PORTGROUP(_cfg, _addr, _proto, _port)       \
 261     ((_cfg)->pg[_GET_PORTGROUP_IDX(_cfg, _addr, _proto, _port)])
 262
 263 #define PORTGROUP_CHUNK(_nh, _idx)              \
 264     ((_nh)->pg_ptr[(_idx)])
 265 #define PORTGROUP_BYSIDX(_cfg, _nh, _idx)       \
 266     (PORTGROUP_CHUNK(_nh, (_idx - 1) / NAT64LSN_PGIDX_CHUNK) \
 267         [((_idx) - 1) % NAT64LSN_PGIDX_CHUNK])
 268
 269
 270 /* Chained hash table */
 271 #define CHT_FIND(_ph, _hsize, _PX, _x, _key) do {                       \
 272         unsigned int _buck = _PX##hash(_key) & (_hsize - 1);            \
 273         _PX##lock(_ph, _buck);                                          \
 274         _x = _PX##first(_ph, _buck);                                    \
 275         for ( ; _x != NULL; _x = _PX##next(_x)) {                       \
 276                 if (_PX##cmp(_key, _PX##val(_x)))                       \
 277                         break;                                          \
 278         }                                                               \
 279         if (_x == NULL)                                                 \
 280                 _PX##unlock(_ph, _buck);                                \
 281 } while(0)
 282
 283 #define CHT_UNLOCK_BUCK(_ph, _PX, _buck)                                \
 284         _PX##unlock(_ph, _buck);
 285
 286 #define CHT_UNLOCK_KEY(_ph, _hsize, _PX, _key) do {                     \
 287         unsigned int _buck = _PX##hash(_key) & (_hsize - 1);            \
 288         _PX##unlock(_ph, _buck);                                        \
 289 } while(0)
 290
 291 #define CHT_INSERT_HEAD(_ph, _hsize, _PX, _i) do {                      \
 292         unsigned int _buck = _PX##hash(_PX##val(_i)) & (_hsize - 1);    \
 293         _PX##lock(_ph, _buck);                                          \
 294         _PX##next(_i) = _PX##first(_ph, _buck);                         \
 295         _PX##first(_ph, _buck) = _i;                                    \
 296         _PX##unlock(_ph, _buck);                                        \
 297 } while(0)
 298
 299 #define CHT_REMOVE(_ph, _hsize, _PX, _x, _tmp, _key) do {               \
 300         unsigned int _buck = _PX##hash(_key) & (_hsize - 1);            \
 301         _PX##lock(_ph, _buck);                                          \
 302         _x = _PX##first(_ph, _buck);                                    \
 303         _tmp = NULL;                                                    \
 304         for ( ; _x != NULL; _tmp = _x, _x = _PX##next(_x)) {            \
 305                 if (_PX##cmp(_key, _PX##val(_x)))                       \
 306                         break;                                          \
 307         }                                                               \
 308         if (_x != NULL) {                                               \
 309                 if (_tmp == NULL)                                       \
 310                         _PX##first(_ph, _buck) = _PX##next(_x);         \
 311                 else                                                    \
 312                         _PX##next(_tmp) = _PX##next(_x);                \
 313         }                                                               \
 314         _PX##unlock(_ph, _buck);                                        \
 315 } while(0)
 316
 317 #define CHT_FOREACH_SAFE(_ph, _hsize, _PX, _x, _tmp, _cb, _arg) do {    \
 318         for (unsigned int _i = 0; _i < _hsize; _i++) {                  \
 319                 _PX##lock(_ph, _i);                                     \
 320                 _x = _PX##first(_ph, _i);                               \
 321                 _tmp = NULL;                                            \
 322                 for (; _x != NULL; _tmp = _x, _x = _PX##next(_x)) {     \
 323                         if (_cb(_x, _arg) == 0)                         \
 324                                 continue;                               \
 325                         if (_tmp == NULL)                               \
 326                                 _PX##first(_ph, _i) = _PX##next(_x);    \
 327                         else                                            \
 328                                 _tmp = _PX##next(_x);                   \
 329                 }                                                       \
 330                 _PX##unlock(_ph, _i);                                   \
 331         }                                                               \
 332 } while(0)
 333
 334 #define CHT_RESIZE(_ph, _hsize, _nph, _nhsize, _PX, _x, _y) do {        \
 335         unsigned int _buck;                                             \
 336         for (unsigned int _i = 0; _i < _hsize; _i++) {                  \
 337                 _x = _PX##first(_ph, _i);                               \
 338                 _y = _x;                                                \
 339                 while (_y != NULL) {                                    \
 340                         _buck = _PX##hash(_PX##val(_x)) & (_nhsize - 1);\
 341                         _y = _PX##next(_x);                             \
 342                         _PX##next(_x) = _PX##first(_nph, _buck);        \
 343                         _PX##first(_nph, _buck) = _x;                   \
 344                 }                                                       \
 345         }                                                               \
 346 } while(0)
 347
 348 #endif /* _IP_FW_NAT64LSN_H_ */
 349