2 * Copyright (c) 2015 Yandex LLC
3 * Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org>
4 * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org>
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
32 #include <sys/param.h>
33 #include <sys/systm.h>
34 #include <sys/counter.h>
35 #include <sys/errno.h>
36 #include <sys/kernel.h>
38 #include <sys/malloc.h>
40 #include <sys/module.h>
41 #include <sys/rmlock.h>
42 #include <sys/rwlock.h>
43 #include <sys/socket.h>
44 #include <sys/sockopt.h>
45 #include <sys/queue.h>
50 #include <netinet/in.h>
51 #include <netinet/ip.h>
52 #include <netinet/ip_var.h>
53 #include <netinet/ip_fw.h>
54 #include <netinet6/ip_fw_nat64.h>
56 #include <netpfil/ipfw/ip_fw_private.h>
60 VNET_DEFINE(uint16_t, nat64lsn_eid) = 0;
62 static struct nat64lsn_cfg *
63 nat64lsn_find(struct namedobj_instance *ni, const char *name, uint8_t set)
65 struct nat64lsn_cfg *cfg;
67 cfg = (struct nat64lsn_cfg *)ipfw_objhash_lookup_name_type(ni, set,
68 IPFW_TLV_NAT64LSN_NAME, name);
74 nat64lsn_default_config(ipfw_nat64lsn_cfg *uc)
77 if (uc->max_ports == 0)
78 uc->max_ports = NAT64LSN_MAX_PORTS;
80 uc->max_ports = roundup(uc->max_ports, NAT64_CHUNK_SIZE);
81 if (uc->max_ports > NAT64_CHUNK_SIZE * NAT64LSN_MAXPGPTR)
82 uc->max_ports = NAT64_CHUNK_SIZE * NAT64LSN_MAXPGPTR;
84 uc->jmaxlen = NAT64LSN_JMAXLEN;
85 if (uc->jmaxlen > 65536)
87 if (uc->nh_delete_delay == 0)
88 uc->nh_delete_delay = NAT64LSN_HOST_AGE;
89 if (uc->pg_delete_delay == 0)
90 uc->pg_delete_delay = NAT64LSN_PG_AGE;
91 if (uc->st_syn_ttl == 0)
92 uc->st_syn_ttl = NAT64LSN_TCP_SYN_AGE;
93 if (uc->st_close_ttl == 0)
94 uc->st_close_ttl = NAT64LSN_TCP_FIN_AGE;
95 if (uc->st_estab_ttl == 0)
96 uc->st_estab_ttl = NAT64LSN_TCP_EST_AGE;
97 if (uc->st_udp_ttl == 0)
98 uc->st_udp_ttl = NAT64LSN_UDP_AGE;
99 if (uc->st_icmp_ttl == 0)
100 uc->st_icmp_ttl = NAT64LSN_ICMP_AGE;
104 * Creates new nat64lsn instance.
105 * Data layout (v0)(current):
106 * Request: [ ipfw_obj_lheader ipfw_nat64lsn_cfg ]
108 * Returns 0 on success
111 nat64lsn_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
112 struct sockopt_data *sd)
114 ipfw_obj_lheader *olh;
115 ipfw_nat64lsn_cfg *uc;
116 struct nat64lsn_cfg *cfg;
117 struct namedobj_instance *ni;
118 uint32_t addr4, mask4;
120 if (sd->valsize != sizeof(*olh) + sizeof(*uc))
123 olh = (ipfw_obj_lheader *)sd->kbuf;
124 uc = (ipfw_nat64lsn_cfg *)(olh + 1);
126 if (ipfw_check_object_name_generic(uc->name) != 0)
129 if (uc->agg_prefix_len > 127 || uc->set >= IPFW_MAX_SETS)
134 if (nat64_check_prefix6(&uc->prefix6, uc->plen6) != 0)
137 /* XXX: Check prefix4 to be global */
138 addr4 = ntohl(uc->prefix4.s_addr);
139 mask4 = ~((1 << (32 - uc->plen4)) - 1);
140 if ((addr4 & mask4) != addr4)
142 if (uc->min_port == 0)
143 uc->min_port = NAT64_MIN_PORT;
144 if (uc->max_port == 0)
145 uc->max_port = 65535;
146 if (uc->min_port > uc->max_port)
148 uc->min_port = roundup(uc->min_port, NAT64_CHUNK_SIZE);
149 uc->max_port = roundup(uc->max_port, NAT64_CHUNK_SIZE);
151 nat64lsn_default_config(uc);
153 ni = CHAIN_TO_SRV(ch);
155 if (nat64lsn_find(ni, uc->name, uc->set) != NULL) {
161 cfg = nat64lsn_init_instance(ch, 1 << (32 - uc->plen4));
162 strlcpy(cfg->name, uc->name, sizeof(cfg->name));
163 cfg->no.name = cfg->name;
164 cfg->no.etlv = IPFW_TLV_NAT64LSN_NAME;
165 cfg->no.set = uc->set;
167 cfg->base.plat_prefix = uc->prefix6;
168 cfg->base.plat_plen = uc->plen6;
169 cfg->base.flags = (uc->flags & NAT64LSN_FLAGSMASK) | NAT64_PLATPFX;
170 if (IN6_IS_ADDR_WKPFX(&cfg->base.plat_prefix))
171 cfg->base.flags |= NAT64_WKPFX;
173 cfg->prefix4 = addr4;
174 cfg->pmask4 = addr4 | ~mask4;
175 cfg->plen4 = uc->plen4;
177 cfg->max_chunks = uc->max_ports / NAT64_CHUNK_SIZE;
178 cfg->agg_prefix_len = uc->agg_prefix_len;
179 cfg->agg_prefix_max = uc->agg_prefix_max;
181 cfg->min_chunk = uc->min_port / NAT64_CHUNK_SIZE;
182 cfg->max_chunk = uc->max_port / NAT64_CHUNK_SIZE;
184 cfg->jmaxlen = uc->jmaxlen;
185 cfg->nh_delete_delay = uc->nh_delete_delay;
186 cfg->pg_delete_delay = uc->pg_delete_delay;
187 cfg->st_syn_ttl = uc->st_syn_ttl;
188 cfg->st_close_ttl = uc->st_close_ttl;
189 cfg->st_estab_ttl = uc->st_estab_ttl;
190 cfg->st_udp_ttl = uc->st_udp_ttl;
191 cfg->st_icmp_ttl = uc->st_icmp_ttl;
193 cfg->nomatch_verdict = IP_FW_DENY;
197 if (nat64lsn_find(ni, uc->name, uc->set) != NULL) {
199 nat64lsn_destroy_instance(cfg);
203 if (ipfw_objhash_alloc_idx(CHAIN_TO_SRV(ch), &cfg->no.kidx) != 0) {
205 nat64lsn_destroy_instance(cfg);
208 ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no);
210 /* Okay, let's link data */
211 SRV_OBJECT(ch, cfg->no.kidx) = cfg;
212 nat64lsn_start_instance(cfg);
219 nat64lsn_detach_config(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg)
222 IPFW_UH_WLOCK_ASSERT(ch);
224 ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no);
225 ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx);
229 * Destroys nat64 instance.
230 * Data layout (v0)(current):
231 * Request: [ ipfw_obj_header ]
233 * Returns 0 on success
236 nat64lsn_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
237 struct sockopt_data *sd)
239 struct nat64lsn_cfg *cfg;
242 if (sd->valsize != sizeof(*oh))
245 oh = (ipfw_obj_header *)op3;
248 cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
254 if (cfg->no.refcnt > 0) {
259 ipfw_reset_eaction_instance(ch, V_nat64lsn_eid, cfg->no.kidx);
260 SRV_OBJECT(ch, cfg->no.kidx) = NULL;
261 nat64lsn_detach_config(ch, cfg);
264 nat64lsn_destroy_instance(cfg);
268 #define __COPY_STAT_FIELD(_cfg, _stats, _field) \
269 (_stats)->_field = NAT64STAT_FETCH(&(_cfg)->base.stats, _field)
271 export_stats(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg,
272 struct ipfw_nat64lsn_stats *stats)
275 __COPY_STAT_FIELD(cfg, stats, opcnt64);
276 __COPY_STAT_FIELD(cfg, stats, opcnt46);
277 __COPY_STAT_FIELD(cfg, stats, ofrags);
278 __COPY_STAT_FIELD(cfg, stats, ifrags);
279 __COPY_STAT_FIELD(cfg, stats, oerrors);
280 __COPY_STAT_FIELD(cfg, stats, noroute4);
281 __COPY_STAT_FIELD(cfg, stats, noroute6);
282 __COPY_STAT_FIELD(cfg, stats, nomatch4);
283 __COPY_STAT_FIELD(cfg, stats, noproto);
284 __COPY_STAT_FIELD(cfg, stats, nomem);
285 __COPY_STAT_FIELD(cfg, stats, dropped);
287 __COPY_STAT_FIELD(cfg, stats, jcalls);
288 __COPY_STAT_FIELD(cfg, stats, jrequests);
289 __COPY_STAT_FIELD(cfg, stats, jhostsreq);
290 __COPY_STAT_FIELD(cfg, stats, jportreq);
291 __COPY_STAT_FIELD(cfg, stats, jhostfails);
292 __COPY_STAT_FIELD(cfg, stats, jportfails);
293 __COPY_STAT_FIELD(cfg, stats, jmaxlen);
294 __COPY_STAT_FIELD(cfg, stats, jnomem);
295 __COPY_STAT_FIELD(cfg, stats, jreinjected);
296 __COPY_STAT_FIELD(cfg, stats, screated);
297 __COPY_STAT_FIELD(cfg, stats, sdeleted);
298 __COPY_STAT_FIELD(cfg, stats, spgcreated);
299 __COPY_STAT_FIELD(cfg, stats, spgdeleted);
301 stats->hostcount = cfg->ihcount;
302 stats->tcpchunks = cfg->protochunks[NAT_PROTO_TCP];
303 stats->udpchunks = cfg->protochunks[NAT_PROTO_UDP];
304 stats->icmpchunks = cfg->protochunks[NAT_PROTO_ICMP];
306 #undef __COPY_STAT_FIELD
309 nat64lsn_export_config(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg,
310 ipfw_nat64lsn_cfg *uc)
313 uc->flags = cfg->base.flags & NAT64LSN_FLAGSMASK;
314 uc->max_ports = cfg->max_chunks * NAT64_CHUNK_SIZE;
315 uc->agg_prefix_len = cfg->agg_prefix_len;
316 uc->agg_prefix_max = cfg->agg_prefix_max;
318 uc->jmaxlen = cfg->jmaxlen;
319 uc->nh_delete_delay = cfg->nh_delete_delay;
320 uc->pg_delete_delay = cfg->pg_delete_delay;
321 uc->st_syn_ttl = cfg->st_syn_ttl;
322 uc->st_close_ttl = cfg->st_close_ttl;
323 uc->st_estab_ttl = cfg->st_estab_ttl;
324 uc->st_udp_ttl = cfg->st_udp_ttl;
325 uc->st_icmp_ttl = cfg->st_icmp_ttl;
326 uc->prefix4.s_addr = htonl(cfg->prefix4);
327 uc->prefix6 = cfg->base.plat_prefix;
328 uc->plen4 = cfg->plen4;
329 uc->plen6 = cfg->base.plat_plen;
330 uc->set = cfg->no.set;
331 strlcpy(uc->name, cfg->no.name, sizeof(uc->name));
334 struct nat64_dump_arg {
335 struct ip_fw_chain *ch;
336 struct sockopt_data *sd;
340 export_config_cb(struct namedobj_instance *ni, struct named_object *no,
343 struct nat64_dump_arg *da = (struct nat64_dump_arg *)arg;
344 ipfw_nat64lsn_cfg *uc;
346 uc = (struct _ipfw_nat64lsn_cfg *)ipfw_get_sopt_space(da->sd,
348 nat64lsn_export_config(da->ch, (struct nat64lsn_cfg *)no, uc);
353 * Lists all nat64 lsn instances currently available in kernel.
354 * Data layout (v0)(current):
355 * Request: [ ipfw_obj_lheader ]
356 * Reply: [ ipfw_obj_lheader ipfw_nat64lsn_cfg x N ]
358 * Returns 0 on success
361 nat64lsn_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
362 struct sockopt_data *sd)
364 ipfw_obj_lheader *olh;
365 struct nat64_dump_arg da;
367 /* Check minimum header size */
368 if (sd->valsize < sizeof(ipfw_obj_lheader))
371 olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh));
374 olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch),
375 IPFW_TLV_NAT64LSN_NAME);
376 olh->objsize = sizeof(ipfw_nat64lsn_cfg);
377 olh->size = sizeof(*olh) + olh->count * olh->objsize;
379 if (sd->valsize < olh->size) {
383 memset(&da, 0, sizeof(da));
386 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb, &da,
387 IPFW_TLV_NAT64LSN_NAME);
394 * Change existing nat64lsn instance configuration.
395 * Data layout (v0)(current):
396 * Request: [ ipfw_obj_header ipfw_nat64lsn_cfg ]
397 * Reply: [ ipfw_obj_header ipfw_nat64lsn_cfg ]
399 * Returns 0 on success
402 nat64lsn_config(struct ip_fw_chain *ch, ip_fw3_opheader *op,
403 struct sockopt_data *sd)
406 ipfw_nat64lsn_cfg *uc;
407 struct nat64lsn_cfg *cfg;
408 struct namedobj_instance *ni;
410 if (sd->valsize != sizeof(*oh) + sizeof(*uc))
413 oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd,
414 sizeof(*oh) + sizeof(*uc));
415 uc = (ipfw_nat64lsn_cfg *)(oh + 1);
417 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
418 oh->ntlv.set >= IPFW_MAX_SETS)
421 ni = CHAIN_TO_SRV(ch);
422 if (sd->sopt->sopt_dir == SOPT_GET) {
424 cfg = nat64lsn_find(ni, oh->ntlv.name, oh->ntlv.set);
429 nat64lsn_export_config(ch, cfg, uc);
434 nat64lsn_default_config(uc);
437 cfg = nat64lsn_find(ni, oh->ntlv.name, oh->ntlv.set);
444 * For now allow to change only following values:
445 * jmaxlen, nh_del_age, pg_del_age, tcp_syn_age, tcp_close_age,
446 * tcp_est_age, udp_age, icmp_age, flags, max_ports.
449 cfg->max_chunks = uc->max_ports / NAT64_CHUNK_SIZE;
450 cfg->jmaxlen = uc->jmaxlen;
451 cfg->nh_delete_delay = uc->nh_delete_delay;
452 cfg->pg_delete_delay = uc->pg_delete_delay;
453 cfg->st_syn_ttl = uc->st_syn_ttl;
454 cfg->st_close_ttl = uc->st_close_ttl;
455 cfg->st_estab_ttl = uc->st_estab_ttl;
456 cfg->st_udp_ttl = uc->st_udp_ttl;
457 cfg->st_icmp_ttl = uc->st_icmp_ttl;
458 cfg->base.flags &= ~NAT64LSN_FLAGSMASK;
459 cfg->base.flags |= uc->flags & NAT64LSN_FLAGSMASK;
467 * Get nat64lsn statistics.
468 * Data layout (v0)(current):
469 * Request: [ ipfw_obj_header ]
470 * Reply: [ ipfw_obj_header ipfw_counter_tlv ]
472 * Returns 0 on success
475 nat64lsn_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
476 struct sockopt_data *sd)
478 struct ipfw_nat64lsn_stats stats;
479 struct nat64lsn_cfg *cfg;
484 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats);
485 if (sd->valsize % sizeof(uint64_t))
487 if (sd->valsize < sz)
489 oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
492 memset(&stats, 0, sizeof(stats));
495 cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
501 export_stats(ch, cfg, &stats);
504 ctlv = (ipfw_obj_ctlv *)(oh + 1);
505 memset(ctlv, 0, sizeof(*ctlv));
506 ctlv->head.type = IPFW_TLV_COUNTERS;
507 ctlv->head.length = sz - sizeof(ipfw_obj_header);
508 ctlv->count = sizeof(stats) / sizeof(uint64_t);
509 ctlv->objsize = sizeof(uint64_t);
510 ctlv->version = IPFW_NAT64_VERSION;
511 memcpy(ctlv + 1, &stats, sizeof(stats));
516 * Reset nat64lsn statistics.
517 * Data layout (v0)(current):
518 * Request: [ ipfw_obj_header ]
520 * Returns 0 on success
523 nat64lsn_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
524 struct sockopt_data *sd)
526 struct nat64lsn_cfg *cfg;
529 if (sd->valsize != sizeof(*oh))
531 oh = (ipfw_obj_header *)sd->kbuf;
532 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
533 oh->ntlv.set >= IPFW_MAX_SETS)
537 cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
542 COUNTER_ARRAY_ZERO(cfg->base.stats.cnt, NAT64STATS);
548 * Reply: [ ipfw_obj_header ipfw_obj_data [ ipfw_nat64lsn_stg
549 * ipfw_nat64lsn_state x count, ... ] ]
552 export_pg_states(struct nat64lsn_cfg *cfg, struct nat64lsn_portgroup *pg,
553 ipfw_nat64lsn_stg *stg, struct sockopt_data *sd)
555 ipfw_nat64lsn_state *ste;
556 struct nat64lsn_state *st;
559 NAT64_LOCK(pg->host);
561 for (i = 0; i < 64; i++) {
562 if (PG_IS_BUSY_IDX(pg, i))
565 DPRINTF(DP_STATE, "EXPORT PG %d, count %d", pg->idx, count);
569 NAT64_UNLOCK(pg->host);
572 ste = (ipfw_nat64lsn_state *)ipfw_get_sopt_space(sd,
573 count * sizeof(ipfw_nat64lsn_state));
575 NAT64_UNLOCK(pg->host);
579 stg->alias4.s_addr = pg->aaddr;
580 stg->proto = nat64lsn_rproto_map[pg->nat_proto];
582 stg->host6 = pg->host->addr;
584 for (i = 0; i < 64; i++) {
585 if (PG_IS_FREE_IDX(pg, i))
588 ste->daddr.s_addr = st->u.s.faddr;
589 ste->dport = st->u.s.fport;
590 ste->aport = pg->aport + i;
591 ste->sport = st->u.s.lport;
592 ste->flags = st->flags; /* XXX filter flags */
593 ste->idle = GET_AGE(st->timestamp);
596 NAT64_UNLOCK(pg->host);
602 get_next_idx(struct nat64lsn_cfg *cfg, uint32_t *addr, uint8_t *nat_proto,
606 if (*port < 65536 - NAT64_CHUNK_SIZE) {
607 *port += NAT64_CHUNK_SIZE;
612 if (*nat_proto < NAT_MAX_PROTO - 1) {
618 if (*addr < cfg->pmask4) {
627 #define PACK_IDX(addr, proto, port) \
628 ((uint64_t)addr << 32) | ((uint32_t)port << 16) | (proto << 8)
629 #define UNPACK_IDX(idx, addr, proto, port) \
630 (addr) = (uint32_t)((idx) >> 32); \
631 (port) = (uint16_t)(((idx) >> 16) & 0xFFFF); \
632 (proto) = (uint8_t)(((idx) >> 8) & 0xFF)
634 static struct nat64lsn_portgroup *
635 get_next_pg(struct nat64lsn_cfg *cfg, uint32_t *addr, uint8_t *nat_proto,
638 struct nat64lsn_portgroup *pg;
639 uint64_t pre_pack, post_pack;
642 pre_pack = PACK_IDX(*addr, *nat_proto, *port);
644 if (get_next_idx(cfg, addr, nat_proto, port) != 0) {
649 pg = GET_PORTGROUP(cfg, *addr, *nat_proto, *port);
654 post_pack = PACK_IDX(*addr, *nat_proto, *port);
655 if (pre_pack == post_pack)
656 DPRINTF(DP_STATE, "XXX: PACK_IDX %u %d %d",
657 *addr, *nat_proto, *port);
661 static NAT64NOINLINE struct nat64lsn_portgroup *
662 get_first_pg(struct nat64lsn_cfg *cfg, uint32_t *addr, uint8_t *nat_proto,
665 struct nat64lsn_portgroup *pg;
667 pg = GET_PORTGROUP(cfg, *addr, *nat_proto, *port);
669 pg = get_next_pg(cfg, addr, nat_proto, port);
675 * Lists nat64lsn states.
676 * Data layout (v0)(current):
677 * Request: [ ipfw_obj_header ipfw_obj_data [ uint64_t ]]
678 * Reply: [ ipfw_obj_header ipfw_obj_data [
679 * ipfw_nat64lsn_stg ipfw_nat64lsn_state x N] ]
681 * Returns 0 on success
684 nat64lsn_states(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
685 struct sockopt_data *sd)
689 ipfw_nat64lsn_stg *stg;
690 struct nat64lsn_cfg *cfg;
691 struct nat64lsn_portgroup *pg, *pg_next;
694 uint32_t addr, states;
698 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_data) +
700 /* Check minimum header size */
701 if (sd->valsize < sz)
704 oh = (ipfw_obj_header *)sd->kbuf;
705 od = (ipfw_obj_data *)(oh + 1);
706 if (od->head.type != IPFW_TLV_OBJDATA ||
707 od->head.length != sz - sizeof(ipfw_obj_header))
710 next_idx = *(uint64_t *)(od + 1);
711 /* Translate index to the request position to start from */
712 UNPACK_IDX(next_idx, addr, nat_proto, port);
713 if (nat_proto >= NAT_MAX_PROTO)
715 if (nat_proto == 0 && addr != 0)
719 cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
724 /* Fill in starting point */
730 if (addr < cfg->prefix4 || addr > cfg->pmask4) {
732 DPRINTF(DP_GENERIC | DP_STATE, "XXX: %ju %u %u",
733 (uintmax_t)next_idx, addr, cfg->pmask4);
737 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_data) +
738 sizeof(ipfw_nat64lsn_stg);
739 if (sd->valsize < sz)
741 oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd, sz);
742 od = (ipfw_obj_data *)(oh + 1);
743 od->head.type = IPFW_TLV_OBJDATA;
744 od->head.length = sz - sizeof(ipfw_obj_header);
745 stg = (ipfw_nat64lsn_stg *)(od + 1);
747 pg = get_first_pg(cfg, &addr, &nat_proto, &port);
750 stg->next_idx = 0xFF;
758 pg_next = get_next_pg(cfg, &addr, &nat_proto, &port);
760 stg->next_idx = 0xFF;
762 stg->next_idx = PACK_IDX(addr, nat_proto, port);
764 if (export_pg_states(cfg, pg, stg, sd) != 0) {
766 return (states == 0 ? ENOMEM: 0);
768 states += stg->count;
769 od->head.length += stg->count * sizeof(ipfw_nat64lsn_state);
770 sz += stg->count * sizeof(ipfw_nat64lsn_state);
771 if (pg_next != NULL) {
772 sz += sizeof(ipfw_nat64lsn_stg);
773 if (sd->valsize < sz)
775 stg = (ipfw_nat64lsn_stg *)ipfw_get_sopt_space(sd,
776 sizeof(ipfw_nat64lsn_stg));
784 static struct ipfw_sopt_handler scodes[] = {
785 { IP_FW_NAT64LSN_CREATE, 0, HDIR_BOTH, nat64lsn_create },
786 { IP_FW_NAT64LSN_DESTROY,0, HDIR_SET, nat64lsn_destroy },
787 { IP_FW_NAT64LSN_CONFIG, 0, HDIR_BOTH, nat64lsn_config },
788 { IP_FW_NAT64LSN_LIST, 0, HDIR_GET, nat64lsn_list },
789 { IP_FW_NAT64LSN_STATS, 0, HDIR_GET, nat64lsn_stats },
790 { IP_FW_NAT64LSN_RESET_STATS,0, HDIR_SET, nat64lsn_reset_stats },
791 { IP_FW_NAT64LSN_LIST_STATES,0, HDIR_GET, nat64lsn_states },
795 nat64lsn_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
800 if (icmd->opcode != O_EXTERNAL_ACTION ||
801 icmd->arg1 != V_nat64lsn_eid)
810 nat64lsn_update_arg1(ipfw_insn *cmd, uint16_t idx)
817 nat64lsn_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
818 struct named_object **pno)
822 err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti,
823 IPFW_TLV_NAT64LSN_NAME, pno);
827 static struct named_object *
828 nat64lsn_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
830 struct namedobj_instance *ni;
831 struct named_object *no;
833 IPFW_UH_WLOCK_ASSERT(ch);
834 ni = CHAIN_TO_SRV(ch);
835 no = ipfw_objhash_lookup_kidx(ni, idx);
836 KASSERT(no != NULL, ("NAT64LSN with index %d not found", idx));
842 nat64lsn_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
843 enum ipfw_sets_cmd cmd)
846 return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64LSN_NAME,
850 static struct opcode_obj_rewrite opcodes[] = {
852 .opcode = O_EXTERNAL_INSTANCE,
853 .etlv = IPFW_TLV_EACTION /* just show it isn't table */,
854 .classifier = nat64lsn_classify,
855 .update = nat64lsn_update_arg1,
856 .find_byname = nat64lsn_findbyname,
857 .find_bykidx = nat64lsn_findbykidx,
858 .manage_sets = nat64lsn_manage_sets,
863 destroy_config_cb(struct namedobj_instance *ni, struct named_object *no,
866 struct nat64lsn_cfg *cfg;
867 struct ip_fw_chain *ch;
869 ch = (struct ip_fw_chain *)arg;
870 cfg = (struct nat64lsn_cfg *)SRV_OBJECT(ch, no->kidx);
871 SRV_OBJECT(ch, no->kidx) = NULL;
872 nat64lsn_detach_config(ch, cfg);
873 nat64lsn_destroy_instance(cfg);
878 nat64lsn_init(struct ip_fw_chain *ch, int first)
882 nat64lsn_init_internal();
883 V_nat64lsn_eid = ipfw_add_eaction(ch, ipfw_nat64lsn, "nat64lsn");
884 if (V_nat64lsn_eid == 0)
886 IPFW_ADD_SOPT_HANDLER(first, scodes);
887 IPFW_ADD_OBJ_REWRITER(first, opcodes);
892 nat64lsn_uninit(struct ip_fw_chain *ch, int last)
895 IPFW_DEL_OBJ_REWRITER(last, opcodes);
896 IPFW_DEL_SOPT_HANDLER(last, scodes);
897 ipfw_del_eaction(ch, V_nat64lsn_eid);
899 * Since we already have deregistered external action,
900 * our named objects become unaccessible via rules, because
901 * all rules were truncated by ipfw_del_eaction().
902 * So, we can unlink and destroy our named objects without holding
906 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch,
907 IPFW_TLV_NAT64LSN_NAME);
911 nat64lsn_uninit_internal();