sys/netpfil/ipfw/nat64/nat64lsn_control.c

   1 /*-
   2  * Copyright (c) 2015 Yandex LLC
   3  * Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org>
   4  * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org>
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  27  */
  28
  29 #include <sys/cdefs.h>
  30 __FBSDID("$FreeBSD$");
  31
  32 #include <sys/param.h>
  33 #include <sys/systm.h>
  34 #include <sys/counter.h>
  35 #include <sys/errno.h>
  36 #include <sys/kernel.h>
  37 #include <sys/lock.h>
  38 #include <sys/malloc.h>
  39 #include <sys/mbuf.h>
  40 #include <sys/module.h>
  41 #include <sys/rmlock.h>
  42 #include <sys/rwlock.h>
  43 #include <sys/socket.h>
  44 #include <sys/sockopt.h>
  45 #include <sys/queue.h>
  46
  47 #include <net/if.h>
  48 #include <net/pfil.h>
  49
  50 #include <netinet/in.h>
  51 #include <netinet/ip.h>
  52 #include <netinet/ip_var.h>
  53 #include <netinet/ip_fw.h>
  54
  55 #include <netpfil/ipfw/ip_fw_private.h>
  56 #include <netpfil/ipfw/nat64/ip_fw_nat64.h>
  57 #include <netpfil/ipfw/nat64/nat64lsn.h>
  58 #include <netinet6/ip_fw_nat64.h>
  59
  60 VNET_DEFINE(uint16_t, nat64lsn_eid) = 0;
  61
  62 static struct nat64lsn_cfg *
  63 nat64lsn_find(struct namedobj_instance *ni, const char *name, uint8_t set)
  64 {
  65         struct nat64lsn_cfg *cfg;
  66
  67         cfg = (struct nat64lsn_cfg *)ipfw_objhash_lookup_name_type(ni, set,
  68             IPFW_TLV_NAT64LSN_NAME, name);
  69
  70         return (cfg);
  71 }
  72
  73 static void
  74 nat64lsn_default_config(ipfw_nat64lsn_cfg *uc)
  75 {
  76
  77         if (uc->max_ports == 0)
  78                 uc->max_ports = NAT64LSN_MAX_PORTS;
  79         else
  80                 uc->max_ports = roundup(uc->max_ports, NAT64_CHUNK_SIZE);
  81         if (uc->max_ports > NAT64_CHUNK_SIZE * NAT64LSN_MAXPGPTR)
  82                 uc->max_ports = NAT64_CHUNK_SIZE * NAT64LSN_MAXPGPTR;
  83         if (uc->jmaxlen == 0)
  84                 uc->jmaxlen = NAT64LSN_JMAXLEN;
  85         if (uc->jmaxlen > 65536)
  86                 uc->jmaxlen = 65536;
  87         if (uc->nh_delete_delay == 0)
  88                 uc->nh_delete_delay = NAT64LSN_HOST_AGE;
  89         if (uc->pg_delete_delay == 0)
  90                 uc->pg_delete_delay = NAT64LSN_PG_AGE;
  91         if (uc->st_syn_ttl == 0)
  92                 uc->st_syn_ttl = NAT64LSN_TCP_SYN_AGE;
  93         if (uc->st_close_ttl == 0)
  94                 uc->st_close_ttl = NAT64LSN_TCP_FIN_AGE;
  95         if (uc->st_estab_ttl == 0)
  96                 uc->st_estab_ttl = NAT64LSN_TCP_EST_AGE;
  97         if (uc->st_udp_ttl == 0)
  98                 uc->st_udp_ttl = NAT64LSN_UDP_AGE;
  99         if (uc->st_icmp_ttl == 0)
 100                 uc->st_icmp_ttl = NAT64LSN_ICMP_AGE;
 101 }
 102
 103 /*
 104  * Creates new nat64lsn instance.
 105  * Data layout (v0)(current):
 106  * Request: [ ipfw_obj_lheader ipfw_nat64lsn_cfg ]
 107  *
 108  * Returns 0 on success
 109  */
 110 static int
 111 nat64lsn_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
 112     struct sockopt_data *sd)
 113 {
 114         ipfw_obj_lheader *olh;
 115         ipfw_nat64lsn_cfg *uc;
 116         struct nat64lsn_cfg *cfg;
 117         struct namedobj_instance *ni;
 118         uint32_t addr4, mask4;
 119
 120         if (sd->valsize != sizeof(*olh) + sizeof(*uc))
 121                 return (EINVAL);
 122
 123         olh = (ipfw_obj_lheader *)sd->kbuf;
 124         uc = (ipfw_nat64lsn_cfg *)(olh + 1);
 125
 126         if (ipfw_check_object_name_generic(uc->name) != 0)
 127                 return (EINVAL);
 128
 129         if (uc->agg_prefix_len > 127 || uc->set >= IPFW_MAX_SETS)
 130                 return (EINVAL);
 131
 132         if (uc->plen4 > 32)
 133                 return (EINVAL);
 134         if (uc->plen6 > 128 || ((uc->plen6 % 8) != 0))
 135                 return (EINVAL);
 136
 137         /* XXX: Check prefix4 to be global */
 138         addr4 = ntohl(uc->prefix4.s_addr);
 139         mask4 = ~((1 << (32 - uc->plen4)) - 1);
 140         if ((addr4 & mask4) != addr4)
 141                 return (EINVAL);
 142
 143         /* XXX: Check prefix6 */
 144         if (uc->min_port == 0)
 145                 uc->min_port = NAT64_MIN_PORT;
 146         if (uc->max_port == 0)
 147                 uc->max_port = 65535;
 148         if (uc->min_port > uc->max_port)
 149                 return (EINVAL);
 150         uc->min_port = roundup(uc->min_port, NAT64_CHUNK_SIZE);
 151         uc->max_port = roundup(uc->max_port, NAT64_CHUNK_SIZE);
 152
 153         nat64lsn_default_config(uc);
 154
 155         ni = CHAIN_TO_SRV(ch);
 156         IPFW_UH_RLOCK(ch);
 157         if (nat64lsn_find(ni, uc->name, uc->set) != NULL) {
 158                 IPFW_UH_RUNLOCK(ch);
 159                 return (EEXIST);
 160         }
 161         IPFW_UH_RUNLOCK(ch);
 162
 163         cfg = nat64lsn_init_instance(ch, 1 << (32 - uc->plen4));
 164         strlcpy(cfg->name, uc->name, sizeof(cfg->name));
 165         cfg->no.name = cfg->name;
 166         cfg->no.etlv = IPFW_TLV_NAT64LSN_NAME;
 167         cfg->no.set = uc->set;
 168
 169         cfg->prefix4 = addr4;
 170         cfg->pmask4 = addr4 | ~mask4;
 171         /* XXX: Copy 96 bits */
 172         cfg->plen6 = 96;
 173         memcpy(&cfg->prefix6, &uc->prefix6, cfg->plen6 / 8);
 174         cfg->plen4 = uc->plen4;
 175         cfg->flags = uc->flags & NAT64LSN_FLAGSMASK;
 176         cfg->max_chunks = uc->max_ports / NAT64_CHUNK_SIZE;
 177         cfg->agg_prefix_len = uc->agg_prefix_len;
 178         cfg->agg_prefix_max = uc->agg_prefix_max;
 179
 180         cfg->min_chunk = uc->min_port / NAT64_CHUNK_SIZE;
 181         cfg->max_chunk = uc->max_port / NAT64_CHUNK_SIZE;
 182
 183         cfg->jmaxlen = uc->jmaxlen;
 184         cfg->nh_delete_delay = uc->nh_delete_delay;
 185         cfg->pg_delete_delay = uc->pg_delete_delay;
 186         cfg->st_syn_ttl = uc->st_syn_ttl;
 187         cfg->st_close_ttl = uc->st_close_ttl;
 188         cfg->st_estab_ttl = uc->st_estab_ttl;
 189         cfg->st_udp_ttl = uc->st_udp_ttl;
 190         cfg->st_icmp_ttl = uc->st_icmp_ttl;
 191
 192         cfg->nomatch_verdict = IP_FW_DENY;
 193         cfg->nomatch_final = 1; /* Exit outer loop by default */
 194
 195         IPFW_UH_WLOCK(ch);
 196
 197         if (nat64lsn_find(ni, uc->name, uc->set) != NULL) {
 198                 IPFW_UH_WUNLOCK(ch);
 199                 nat64lsn_destroy_instance(cfg);
 200                 return (EEXIST);
 201         }
 202
 203         if (ipfw_objhash_alloc_idx(CHAIN_TO_SRV(ch), &cfg->no.kidx) != 0) {
 204                 IPFW_UH_WUNLOCK(ch);
 205                 nat64lsn_destroy_instance(cfg);
 206                 return (ENOSPC);
 207         }
 208         ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no);
 209
 210         /* Okay, let's link data */
 211         IPFW_WLOCK(ch);
 212         SRV_OBJECT(ch, cfg->no.kidx) = cfg;
 213         IPFW_WUNLOCK(ch);
 214
 215         nat64lsn_start_instance(cfg);
 216
 217         IPFW_UH_WUNLOCK(ch);
 218         return (0);
 219 }
 220
 221 static void
 222 nat64lsn_detach_config(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg)
 223 {
 224
 225         IPFW_UH_WLOCK_ASSERT(ch);
 226
 227         ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no);
 228         ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx);
 229 }
 230
 231 /*
 232  * Destroys nat64 instance.
 233  * Data layout (v0)(current):
 234  * Request: [ ipfw_obj_header ]
 235  *
 236  * Returns 0 on success
 237  */
 238 static int
 239 nat64lsn_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
 240     struct sockopt_data *sd)
 241 {
 242         struct nat64lsn_cfg *cfg;
 243         ipfw_obj_header *oh;
 244
 245         if (sd->valsize != sizeof(*oh))
 246                 return (EINVAL);
 247
 248         oh = (ipfw_obj_header *)op3;
 249
 250         IPFW_UH_WLOCK(ch);
 251         cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
 252         if (cfg == NULL) {
 253                 IPFW_UH_WUNLOCK(ch);
 254                 return (ESRCH);
 255         }
 256
 257         if (cfg->no.refcnt > 0) {
 258                 IPFW_UH_WUNLOCK(ch);
 259                 return (EBUSY);
 260         }
 261
 262         IPFW_WLOCK(ch);
 263         SRV_OBJECT(ch, cfg->no.kidx) = NULL;
 264         IPFW_WUNLOCK(ch);
 265
 266         nat64lsn_detach_config(ch, cfg);
 267         IPFW_UH_WUNLOCK(ch);
 268
 269         nat64lsn_destroy_instance(cfg);
 270         return (0);
 271 }
 272
 273 #define __COPY_STAT_FIELD(_cfg, _stats, _field) \
 274         (_stats)->_field = NAT64STAT_FETCH(&(_cfg)->stats, _field)
 275 static void
 276 export_stats(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg,
 277     struct ipfw_nat64lsn_stats *stats)
 278 {
 279
 280         __COPY_STAT_FIELD(cfg, stats, opcnt64);
 281         __COPY_STAT_FIELD(cfg, stats, opcnt46);
 282         __COPY_STAT_FIELD(cfg, stats, ofrags);
 283         __COPY_STAT_FIELD(cfg, stats, ifrags);
 284         __COPY_STAT_FIELD(cfg, stats, oerrors);
 285         __COPY_STAT_FIELD(cfg, stats, noroute4);
 286         __COPY_STAT_FIELD(cfg, stats, noroute6);
 287         __COPY_STAT_FIELD(cfg, stats, nomatch4);
 288         __COPY_STAT_FIELD(cfg, stats, noproto);
 289         __COPY_STAT_FIELD(cfg, stats, nomem);
 290         __COPY_STAT_FIELD(cfg, stats, dropped);
 291
 292         __COPY_STAT_FIELD(cfg, stats, jcalls);
 293         __COPY_STAT_FIELD(cfg, stats, jrequests);
 294         __COPY_STAT_FIELD(cfg, stats, jhostsreq);
 295         __COPY_STAT_FIELD(cfg, stats, jportreq);
 296         __COPY_STAT_FIELD(cfg, stats, jhostfails);
 297         __COPY_STAT_FIELD(cfg, stats, jportfails);
 298         __COPY_STAT_FIELD(cfg, stats, jmaxlen);
 299         __COPY_STAT_FIELD(cfg, stats, jnomem);
 300         __COPY_STAT_FIELD(cfg, stats, jreinjected);
 301         __COPY_STAT_FIELD(cfg, stats, screated);
 302         __COPY_STAT_FIELD(cfg, stats, sdeleted);
 303         __COPY_STAT_FIELD(cfg, stats, spgcreated);
 304         __COPY_STAT_FIELD(cfg, stats, spgdeleted);
 305
 306         stats->hostcount = cfg->ihcount;
 307         stats->tcpchunks = cfg->protochunks[NAT_PROTO_TCP];
 308         stats->udpchunks = cfg->protochunks[NAT_PROTO_UDP];
 309         stats->icmpchunks = cfg->protochunks[NAT_PROTO_ICMP];
 310 }
 311 #undef  __COPY_STAT_FIELD
 312
 313 static void
 314 nat64lsn_export_config(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg,
 315     ipfw_nat64lsn_cfg *uc)
 316 {
 317
 318         uc->flags = cfg->flags & NAT64LSN_FLAGSMASK;
 319         uc->max_ports = cfg->max_chunks * NAT64_CHUNK_SIZE;
 320         uc->agg_prefix_len = cfg->agg_prefix_len;
 321         uc->agg_prefix_max = cfg->agg_prefix_max;
 322
 323         uc->jmaxlen = cfg->jmaxlen;
 324         uc->nh_delete_delay = cfg->nh_delete_delay;
 325         uc->pg_delete_delay = cfg->pg_delete_delay;
 326         uc->st_syn_ttl = cfg->st_syn_ttl;
 327         uc->st_close_ttl = cfg->st_close_ttl;
 328         uc->st_estab_ttl = cfg->st_estab_ttl;
 329         uc->st_udp_ttl = cfg->st_udp_ttl;
 330         uc->st_icmp_ttl = cfg->st_icmp_ttl;
 331         uc->prefix4.s_addr = htonl(cfg->prefix4);
 332         uc->prefix6 = cfg->prefix6;
 333         uc->plen4 = cfg->plen4;
 334         uc->plen6 = cfg->plen6;
 335         uc->set = cfg->no.set;
 336         strlcpy(uc->name, cfg->no.name, sizeof(uc->name));
 337 }
 338
 339 struct nat64_dump_arg {
 340         struct ip_fw_chain *ch;
 341         struct sockopt_data *sd;
 342 };
 343
 344 static int
 345 export_config_cb(struct namedobj_instance *ni, struct named_object *no,
 346     void *arg)
 347 {
 348         struct nat64_dump_arg *da = (struct nat64_dump_arg *)arg;
 349         ipfw_nat64lsn_cfg *uc;
 350
 351         uc = (struct _ipfw_nat64lsn_cfg *)ipfw_get_sopt_space(da->sd,
 352             sizeof(*uc));
 353         nat64lsn_export_config(da->ch, (struct nat64lsn_cfg *)no, uc);
 354         return (0);
 355 }
 356
 357 /*
 358  * Lists all nat64 lsn instances currently available in kernel.
 359  * Data layout (v0)(current):
 360  * Request: [ ipfw_obj_lheader ]
 361  * Reply: [ ipfw_obj_lheader ipfw_nat64lsn_cfg x N ]
 362  *
 363  * Returns 0 on success
 364  */
 365 static int
 366 nat64lsn_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
 367     struct sockopt_data *sd)
 368 {
 369         ipfw_obj_lheader *olh;
 370         struct nat64_dump_arg da;
 371
 372         /* Check minimum header size */
 373         if (sd->valsize < sizeof(ipfw_obj_lheader))
 374                 return (EINVAL);
 375
 376         olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh));
 377
 378         IPFW_UH_RLOCK(ch);
 379         olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch),
 380             IPFW_TLV_NAT64LSN_NAME);
 381         olh->objsize = sizeof(ipfw_nat64lsn_cfg);
 382         olh->size = sizeof(*olh) + olh->count * olh->objsize;
 383
 384         if (sd->valsize < olh->size) {
 385                 IPFW_UH_RUNLOCK(ch);
 386                 return (ENOMEM);
 387         }
 388         memset(&da, 0, sizeof(da));
 389         da.ch = ch;
 390         da.sd = sd;
 391         ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb, &da,
 392             IPFW_TLV_NAT64LSN_NAME);
 393         IPFW_UH_RUNLOCK(ch);
 394
 395         return (0);
 396 }
 397
 398 /*
 399  * Change existing nat64lsn instance configuration.
 400  * Data layout (v0)(current):
 401  * Request: [ ipfw_obj_header ipfw_nat64lsn_cfg ]
 402  * Reply: [ ipfw_obj_header ipfw_nat64lsn_cfg ]
 403  *
 404  * Returns 0 on success
 405  */
 406 static int
 407 nat64lsn_config(struct ip_fw_chain *ch, ip_fw3_opheader *op,
 408     struct sockopt_data *sd)
 409 {
 410         ipfw_obj_header *oh;
 411         ipfw_nat64lsn_cfg *uc;
 412         struct nat64lsn_cfg *cfg;
 413         struct namedobj_instance *ni;
 414
 415         if (sd->valsize != sizeof(*oh) + sizeof(*uc))
 416                 return (EINVAL);
 417
 418         oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd,
 419             sizeof(*oh) + sizeof(*uc));
 420         uc = (ipfw_nat64lsn_cfg *)(oh + 1);
 421
 422         if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
 423             oh->ntlv.set >= IPFW_MAX_SETS)
 424                 return (EINVAL);
 425
 426         ni = CHAIN_TO_SRV(ch);
 427         if (sd->sopt->sopt_dir == SOPT_GET) {
 428                 IPFW_UH_RLOCK(ch);
 429                 cfg = nat64lsn_find(ni, oh->ntlv.name, oh->ntlv.set);
 430                 if (cfg == NULL) {
 431                         IPFW_UH_RUNLOCK(ch);
 432                         return (EEXIST);
 433                 }
 434                 nat64lsn_export_config(ch, cfg, uc);
 435                 IPFW_UH_RUNLOCK(ch);
 436                 return (0);
 437         }
 438
 439         nat64lsn_default_config(uc);
 440
 441         IPFW_UH_WLOCK(ch);
 442         cfg = nat64lsn_find(ni, oh->ntlv.name, oh->ntlv.set);
 443         if (cfg == NULL) {
 444                 IPFW_UH_WUNLOCK(ch);
 445                 return (EEXIST);
 446         }
 447
 448         /*
 449          * For now allow to change only following values:
 450          *  jmaxlen, nh_del_age, pg_del_age, tcp_syn_age, tcp_close_age,
 451          *  tcp_est_age, udp_age, icmp_age, flags, max_ports.
 452          */
 453
 454         cfg->max_chunks = uc->max_ports / NAT64_CHUNK_SIZE;
 455         cfg->jmaxlen = uc->jmaxlen;
 456         cfg->nh_delete_delay = uc->nh_delete_delay;
 457         cfg->pg_delete_delay = uc->pg_delete_delay;
 458         cfg->st_syn_ttl = uc->st_syn_ttl;
 459         cfg->st_close_ttl = uc->st_close_ttl;
 460         cfg->st_estab_ttl = uc->st_estab_ttl;
 461         cfg->st_udp_ttl = uc->st_udp_ttl;
 462         cfg->st_icmp_ttl = uc->st_icmp_ttl;
 463         cfg->flags = uc->flags & NAT64LSN_FLAGSMASK;
 464
 465         IPFW_UH_WUNLOCK(ch);
 466
 467         return (0);
 468 }
 469
 470 /*
 471  * Get nat64lsn statistics.
 472  * Data layout (v0)(current):
 473  * Request: [ ipfw_obj_header ]
 474  * Reply: [ ipfw_obj_header ipfw_counter_tlv ]
 475  *
 476  * Returns 0 on success
 477  */
 478 static int
 479 nat64lsn_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
 480     struct sockopt_data *sd)
 481 {
 482         struct ipfw_nat64lsn_stats stats;
 483         struct nat64lsn_cfg *cfg;
 484         ipfw_obj_header *oh;
 485         ipfw_obj_ctlv *ctlv;
 486         size_t sz;
 487
 488         sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats);
 489         if (sd->valsize % sizeof(uint64_t))
 490                 return (EINVAL);
 491         if (sd->valsize < sz)
 492                 return (ENOMEM);
 493         oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
 494         if (oh == NULL)
 495                 return (EINVAL);
 496         memset(&stats, 0, sizeof(stats));
 497
 498         IPFW_UH_RLOCK(ch);
 499         cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
 500         if (cfg == NULL) {
 501                 IPFW_UH_RUNLOCK(ch);
 502                 return (ESRCH);
 503         }
 504
 505         export_stats(ch, cfg, &stats);
 506         IPFW_UH_RUNLOCK(ch);
 507
 508         ctlv = (ipfw_obj_ctlv *)(oh + 1);
 509         memset(ctlv, 0, sizeof(*ctlv));
 510         ctlv->head.type = IPFW_TLV_COUNTERS;
 511         ctlv->head.length = sz - sizeof(ipfw_obj_header);
 512         ctlv->count = sizeof(stats) / sizeof(uint64_t);
 513         ctlv->objsize = sizeof(uint64_t);
 514         ctlv->version = IPFW_NAT64_VERSION;
 515         memcpy(ctlv + 1, &stats, sizeof(stats));
 516         return (0);
 517 }
 518
 519 /*
 520  * Reset nat64lsn statistics.
 521  * Data layout (v0)(current):
 522  * Request: [ ipfw_obj_header ]
 523  *
 524  * Returns 0 on success
 525  */
 526 static int
 527 nat64lsn_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
 528     struct sockopt_data *sd)
 529 {
 530         struct nat64lsn_cfg *cfg;
 531         ipfw_obj_header *oh;
 532
 533         if (sd->valsize != sizeof(*oh))
 534                 return (EINVAL);
 535         oh = (ipfw_obj_header *)sd->kbuf;
 536         if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
 537             oh->ntlv.set >= IPFW_MAX_SETS)
 538                 return (EINVAL);
 539
 540         IPFW_UH_WLOCK(ch);
 541         cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
 542         if (cfg == NULL) {
 543                 IPFW_UH_WUNLOCK(ch);
 544                 return (ESRCH);
 545         }
 546         COUNTER_ARRAY_ZERO(cfg->stats.stats, NAT64STATS);
 547         IPFW_UH_WUNLOCK(ch);
 548         return (0);
 549 }
 550
 551 /*
 552  * Reply: [ ipfw_obj_header ipfw_obj_data [ ipfw_nat64lsn_stg
 553  *      ipfw_nat64lsn_state x count, ... ] ]
 554  */
 555 static int
 556 export_pg_states(struct nat64lsn_cfg *cfg, struct nat64lsn_portgroup *pg,
 557     ipfw_nat64lsn_stg *stg, struct sockopt_data *sd)
 558 {
 559         ipfw_nat64lsn_state *ste;
 560         struct nat64lsn_state *st;
 561         int i, count;
 562
 563         NAT64_LOCK(pg->host);
 564         count = 0;
 565         for (i = 0; i < 64; i++) {
 566                 if (PG_IS_BUSY_IDX(pg, i))
 567                         count++;
 568         }
 569         DPRINTF(DP_STATE, "EXPORT PG %d, count %d", pg->idx, count);
 570
 571         if (count == 0) {
 572                 stg->count = 0;
 573                 NAT64_UNLOCK(pg->host);
 574                 return (0);
 575         }
 576         ste = (ipfw_nat64lsn_state *)ipfw_get_sopt_space(sd,
 577             count * sizeof(ipfw_nat64lsn_state));
 578         if (ste == NULL) {
 579                 NAT64_UNLOCK(pg->host);
 580                 return (1);
 581         }
 582
 583         stg->alias4.s_addr = pg->aaddr;
 584         stg->proto = nat64lsn_rproto_map[pg->nat_proto];
 585         stg->flags = 0;
 586         stg->host6 = pg->host->addr;
 587         stg->count = count;
 588         for (i = 0; i < 64; i++) {
 589                 if (PG_IS_FREE_IDX(pg, i))
 590                         continue;
 591                 st = &pg->states[i];
 592                 ste->daddr.s_addr = st->u.s.faddr;
 593                 ste->dport = st->u.s.fport;
 594                 ste->aport = pg->aport + i;
 595                 ste->sport = st->u.s.lport;
 596                 ste->flags = st->flags; /* XXX filter flags */
 597                 ste->idle = GET_AGE(st->timestamp);
 598                 ste++;
 599         }
 600         NAT64_UNLOCK(pg->host);
 601
 602         return (0);
 603 }
 604
 605 static int
 606 get_next_idx(struct nat64lsn_cfg *cfg, uint32_t *addr, uint8_t *nat_proto,
 607     uint16_t *port)
 608 {
 609
 610         if (*port < 65536 - NAT64_CHUNK_SIZE) {
 611                 *port += NAT64_CHUNK_SIZE;
 612                 return (0);
 613         }
 614         *port = 0;
 615
 616         if (*nat_proto < NAT_MAX_PROTO - 1) {
 617                 *nat_proto += 1;
 618                 return (0);
 619         }
 620         *nat_proto = 1;
 621
 622         if (*addr < cfg->pmask4) {
 623                 *addr += 1;
 624                 return (0);
 625         }
 626
 627         /* End of space. */
 628         return (1);
 629 }
 630
 631 #define PACK_IDX(addr, proto, port)     \
 632         ((uint64_t)addr << 32) | ((uint32_t)port << 16) | (proto << 8)
 633 #define UNPACK_IDX(idx, addr, proto, port)              \
 634         (addr) = (uint32_t)((idx) >> 32);               \
 635         (port) = (uint16_t)(((idx) >> 16) & 0xFFFF);    \
 636         (proto) = (uint8_t)(((idx) >> 8) & 0xFF)
 637
 638 static struct nat64lsn_portgroup *
 639 get_next_pg(struct nat64lsn_cfg *cfg, uint32_t *addr, uint8_t *nat_proto,
 640   uint16_t *port)
 641 {
 642         struct nat64lsn_portgroup *pg;
 643         uint64_t pre_pack, post_pack;
 644
 645         pg = NULL;
 646         pre_pack = PACK_IDX(*addr, *nat_proto, *port);
 647         for (;;) {
 648                 if (get_next_idx(cfg, addr, nat_proto, port) != 0) {
 649                         /* End of states */
 650                         return (pg);
 651                 }
 652
 653                 pg = GET_PORTGROUP(cfg, *addr, *nat_proto, *port);
 654                 if (pg != NULL)
 655                         break;
 656         }
 657
 658         post_pack = PACK_IDX(*addr, *nat_proto, *port);
 659         if (pre_pack == post_pack)
 660                 DPRINTF(DP_STATE, "XXX: PACK_IDX %u %d %d",
 661                     *addr, *nat_proto, *port);
 662         return (pg);
 663 }
 664
 665 static NAT64NOINLINE struct nat64lsn_portgroup *
 666 get_first_pg(struct nat64lsn_cfg *cfg, uint32_t *addr, uint8_t *nat_proto,
 667   uint16_t *port)
 668 {
 669         struct nat64lsn_portgroup *pg;
 670
 671         pg = GET_PORTGROUP(cfg, *addr, *nat_proto, *port);
 672         if (pg == NULL)
 673                 pg = get_next_pg(cfg, addr, nat_proto, port);
 674
 675         return (pg);
 676 }
 677
 678 /*
 679  * Lists nat64lsn states.
 680  * Data layout (v0)(current):
 681  * Request: [ ipfw_obj_header ipfw_obj_data [ uint64_t ]]
 682  * Reply: [ ipfw_obj_header ipfw_obj_data [
 683  *              ipfw_nat64lsn_stg ipfw_nat64lsn_state x N] ]
 684  *
 685  * Returns 0 on success
 686  */
 687 static int
 688 nat64lsn_states(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
 689     struct sockopt_data *sd)
 690 {
 691         ipfw_obj_header *oh;
 692         ipfw_obj_data *od;
 693         ipfw_nat64lsn_stg *stg;
 694         struct nat64lsn_cfg *cfg;
 695         struct nat64lsn_portgroup *pg, *pg_next;
 696         uint64_t next_idx;
 697         size_t sz;
 698         uint32_t addr, states;
 699         uint16_t port;
 700         uint8_t nat_proto;
 701
 702         sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_data) +
 703             sizeof(uint64_t);
 704         /* Check minimum header size */
 705         if (sd->valsize < sz)
 706                 return (EINVAL);
 707
 708         oh = (ipfw_obj_header *)sd->kbuf;
 709         od = (ipfw_obj_data *)(oh + 1);
 710         if (od->head.type != IPFW_TLV_OBJDATA ||
 711             od->head.length != sz - sizeof(ipfw_obj_header))
 712                 return (EINVAL);
 713
 714         next_idx = *(uint64_t *)(od + 1);
 715         /* Translate index to the request position to start from */
 716         UNPACK_IDX(next_idx, addr, nat_proto, port);
 717         if (nat_proto >= NAT_MAX_PROTO)
 718                 return (EINVAL);
 719         if (nat_proto == 0 && addr != 0)
 720                 return (EINVAL);
 721
 722         IPFW_UH_RLOCK(ch);
 723         cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
 724         if (cfg == NULL) {
 725                 IPFW_UH_RUNLOCK(ch);
 726                 return (ESRCH);
 727         }
 728         /* Fill in starting point */
 729         if (addr == 0) {
 730                 addr = cfg->prefix4;
 731                 nat_proto = 1;
 732                 port = 0;
 733         }
 734         if (addr < cfg->prefix4 || addr > cfg->pmask4) {
 735                 IPFW_UH_RUNLOCK(ch);
 736                 DPRINTF(DP_GENERIC | DP_STATE, "XXX: %ju %u %u",
 737                     (uintmax_t)next_idx, addr, cfg->pmask4);
 738                 return (EINVAL);
 739         }
 740
 741         sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_data) +
 742             sizeof(ipfw_nat64lsn_stg);
 743         if (sd->valsize < sz)
 744                 return (ENOMEM);
 745         oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd, sz);
 746         od = (ipfw_obj_data *)(oh + 1);
 747         od->head.type = IPFW_TLV_OBJDATA;
 748         od->head.length = sz - sizeof(ipfw_obj_header);
 749         stg = (ipfw_nat64lsn_stg *)(od + 1);
 750
 751         pg = get_first_pg(cfg, &addr, &nat_proto, &port);
 752         if (pg == NULL) {
 753                 /* No states */
 754                 stg->next_idx = 0xFF;
 755                 stg->count = 0;
 756                 IPFW_UH_RUNLOCK(ch);
 757                 return (0);
 758         }
 759         states = 0;
 760         pg_next = NULL;
 761         while (pg != NULL) {
 762                 pg_next = get_next_pg(cfg, &addr, &nat_proto, &port);
 763                 if (pg_next == NULL)
 764                         stg->next_idx = 0xFF;
 765                 else
 766                         stg->next_idx = PACK_IDX(addr, nat_proto, port);
 767
 768                 if (export_pg_states(cfg, pg, stg, sd) != 0) {
 769                         IPFW_UH_RUNLOCK(ch);
 770                         return (states == 0 ? ENOMEM: 0);
 771                 }
 772                 states += stg->count;
 773                 od->head.length += stg->count * sizeof(ipfw_nat64lsn_state);
 774                 sz += stg->count * sizeof(ipfw_nat64lsn_state);
 775                 if (pg_next != NULL) {
 776                         sz += sizeof(ipfw_nat64lsn_stg);
 777                         if (sd->valsize < sz)
 778                                 break;
 779                         stg = (ipfw_nat64lsn_stg *)ipfw_get_sopt_space(sd,
 780                             sizeof(ipfw_nat64lsn_stg));
 781                 }
 782                 pg = pg_next;
 783         }
 784         IPFW_UH_RUNLOCK(ch);
 785         return (0);
 786 }
 787
 788 static struct ipfw_sopt_handler scodes[] = {
 789         { IP_FW_NAT64LSN_CREATE, 0,     HDIR_BOTH,      nat64lsn_create },
 790         { IP_FW_NAT64LSN_DESTROY,0,     HDIR_SET,       nat64lsn_destroy },
 791         { IP_FW_NAT64LSN_CONFIG, 0,     HDIR_BOTH,      nat64lsn_config },
 792         { IP_FW_NAT64LSN_LIST,   0,     HDIR_GET,       nat64lsn_list },
 793         { IP_FW_NAT64LSN_STATS,  0,     HDIR_GET,       nat64lsn_stats },
 794         { IP_FW_NAT64LSN_RESET_STATS,0, HDIR_SET,       nat64lsn_reset_stats },
 795         { IP_FW_NAT64LSN_LIST_STATES,0, HDIR_GET,       nat64lsn_states },
 796 };
 797
 798 static int
 799 nat64lsn_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
 800 {
 801         ipfw_insn *icmd;
 802
 803         icmd = cmd - 1;
 804         if (icmd->opcode != O_EXTERNAL_ACTION ||
 805             icmd->arg1 != V_nat64lsn_eid)
 806                 return (1);
 807
 808         *puidx = cmd->arg1;
 809         *ptype = 0;
 810         return (0);
 811 }
 812
 813 static void
 814 nat64lsn_update_arg1(ipfw_insn *cmd, uint16_t idx)
 815 {
 816
 817         cmd->arg1 = idx;
 818 }
 819
 820 static int
 821 nat64lsn_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
 822     struct named_object **pno)
 823 {
 824         int err;
 825
 826         err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti,
 827             IPFW_TLV_NAT64LSN_NAME, pno);
 828         return (err);
 829 }
 830
 831 static struct named_object *
 832 nat64lsn_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
 833 {
 834         struct namedobj_instance *ni;
 835         struct named_object *no;
 836
 837         IPFW_UH_WLOCK_ASSERT(ch);
 838         ni = CHAIN_TO_SRV(ch);
 839         no = ipfw_objhash_lookup_kidx(ni, idx);
 840         KASSERT(no != NULL, ("NAT64LSN with index %d not found", idx));
 841
 842         return (no);
 843 }
 844
 845 static int
 846 nat64lsn_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
 847     enum ipfw_sets_cmd cmd)
 848 {
 849
 850         return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64LSN_NAME,
 851             set, new_set, cmd));
 852 }
 853
 854 static struct opcode_obj_rewrite opcodes[] = {
 855         {
 856                 .opcode = O_EXTERNAL_INSTANCE,
 857                 .etlv = IPFW_TLV_EACTION /* just show it isn't table */,
 858                 .classifier = nat64lsn_classify,
 859                 .update = nat64lsn_update_arg1,
 860                 .find_byname = nat64lsn_findbyname,
 861                 .find_bykidx = nat64lsn_findbykidx,
 862                 .manage_sets = nat64lsn_manage_sets,
 863         },
 864 };
 865
 866 static int
 867 destroy_config_cb(struct namedobj_instance *ni, struct named_object *no,
 868     void *arg)
 869 {
 870         struct nat64lsn_cfg *cfg;
 871         struct ip_fw_chain *ch;
 872
 873         ch = (struct ip_fw_chain *)arg;
 874         cfg = (struct nat64lsn_cfg *)SRV_OBJECT(ch, no->kidx);
 875         SRV_OBJECT(ch, no->kidx) = NULL;
 876         nat64lsn_detach_config(ch, cfg);
 877         nat64lsn_destroy_instance(cfg);
 878         return (0);
 879 }
 880
 881 int
 882 nat64lsn_init(struct ip_fw_chain *ch, int first)
 883 {
 884
 885         if (first != 0)
 886                 nat64lsn_init_internal();
 887         V_nat64lsn_eid = ipfw_add_eaction(ch, ipfw_nat64lsn, "nat64lsn");
 888         if (V_nat64lsn_eid == 0)
 889                 return (ENXIO);
 890         IPFW_ADD_SOPT_HANDLER(first, scodes);
 891         IPFW_ADD_OBJ_REWRITER(first, opcodes);
 892         return (0);
 893 }
 894
 895 void
 896 nat64lsn_uninit(struct ip_fw_chain *ch, int last)
 897 {
 898
 899         IPFW_DEL_OBJ_REWRITER(last, opcodes);
 900         IPFW_DEL_SOPT_HANDLER(last, scodes);
 901         ipfw_del_eaction(ch, V_nat64lsn_eid);
 902         /*
 903          * Since we already have deregistered external action,
 904          * our named objects become unaccessible via rules, because
 905          * all rules were truncated by ipfw_del_eaction().
 906          * So, we can unlink and destroy our named objects without holding
 907          * IPFW_WLOCK().
 908          */
 909         IPFW_UH_WLOCK(ch);
 910         ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch,
 911             IPFW_TLV_NAT64LSN_NAME);
 912         V_nat64lsn_eid = 0;
 913         IPFW_UH_WUNLOCK(ch);
 914         if (last != 0)
 915                 nat64lsn_uninit_internal();
 916 }
 917