1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2015-2019 Yandex LLC 5 * Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org> 6 * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org> 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 #ifndef _NETINET6_IP_FW_NAT64_H_ 31 #define _NETINET6_IP_FW_NAT64_H_ 32 33 struct ipfw_nat64stl_stats { 34 uint64_t opcnt64; /* 6to4 of packets translated */ 35 uint64_t opcnt46; /* 4to6 of packets translated */ 36 uint64_t ofrags; /* number of fragments generated */ 37 uint64_t ifrags; /* number of fragments received */ 38 uint64_t oerrors; /* number of output errors */ 39 uint64_t noroute4; 40 uint64_t noroute6; 41 uint64_t noproto; /* Protocol not supported */ 42 uint64_t nomem; /* mbuf allocation failed */ 43 uint64_t dropped; /* dropped due to some errors */ 44 }; 45 46 struct ipfw_nat64clat_stats { 47 uint64_t opcnt64; /* 6to4 of packets translated */ 48 uint64_t opcnt46; /* 4to6 of packets translated */ 49 uint64_t ofrags; /* number of fragments generated */ 50 uint64_t ifrags; /* number of fragments received */ 51 uint64_t oerrors; /* number of output errors */ 52 uint64_t noroute4; 53 uint64_t noroute6; 54 uint64_t noproto; /* Protocol not supported */ 55 uint64_t nomem; /* mbuf allocation failed */ 56 uint64_t dropped; /* dropped due to some errors */ 57 }; 58 59 struct ipfw_nat64lsn_stats { 60 uint64_t opcnt64; /* 6to4 of packets translated */ 61 uint64_t opcnt46; /* 4to6 of packets translated */ 62 uint64_t ofrags; /* number of fragments generated */ 63 uint64_t ifrags; /* number of fragments received */ 64 uint64_t oerrors; /* number of output errors */ 65 uint64_t noroute4; 66 uint64_t noroute6; 67 uint64_t noproto; /* Protocol not supported */ 68 uint64_t nomem; /* mbuf allocation failed */ 69 uint64_t dropped; /* dropped due to some errors */ 70 71 uint64_t nomatch4; /* No addr/port match */ 72 uint64_t jcalls; /* Number of job handler calls */ 73 uint64_t jrequests; /* Number of job requests */ 74 uint64_t jhostsreq; /* Number of job host requests */ 75 uint64_t jportreq; /* Number of portgroup requests */ 76 uint64_t jhostfails; /* Number of failed host allocs */ 77 uint64_t jportfails; /* Number of failed portgroup allocs */ 78 uint64_t jreinjected; /* Number of packets reinjected to q */ 79 uint64_t jmaxlen; /* Max queue length reached */ 80 uint64_t jnomem; /* No memory to alloc queue item */ 81 82 uint64_t screated; /* Number of states created */ 83 uint64_t sdeleted; /* Number of states deleted */ 84 uint64_t spgcreated; /* Number of portgroups created */ 85 uint64_t spgdeleted; /* Number of portgroups deleted */ 86 uint64_t hostcount; /* Number of hosts */ 87 uint64_t tcpchunks; /* Number of TCP portgroups */ 88 uint64_t udpchunks; /* Number of UDP portgroups */ 89 uint64_t icmpchunks; /* Number of ICMP portgroups */ 90 91 uint64_t _reserved[4]; 92 }; 93 94 #define NAT64_LOG 0x0001 /* Enable logging via BPF */ 95 #define NAT64_ALLOW_PRIVATE 0x0002 /* Allow private IPv4 address 96 * translation 97 */ 98 #define NAT64LSN_ALLOW_SWAPCONF 0x0004 /* Allow configuration exchange 99 * between NAT64LSN instances 100 * during the sets swapping. 101 */ 102 typedef struct _ipfw_nat64stl_cfg { 103 char name[64]; /* NAT name */ 104 ipfw_obj_ntlv ntlv6; /* object name tlv */ 105 ipfw_obj_ntlv ntlv4; /* object name tlv */ 106 struct in6_addr prefix6; /* NAT64 prefix */ 107 uint8_t plen6; /* Prefix length */ 108 uint8_t set; /* Named instance set [0..31] */ 109 uint8_t spare[2]; 110 uint32_t flags; 111 } ipfw_nat64stl_cfg; 112 113 typedef struct _ipfw_nat64clat_cfg { 114 char name[64]; /* NAT name */ 115 struct in6_addr plat_prefix; /* NAT64 (PLAT) prefix */ 116 struct in6_addr clat_prefix; /* Client (CLAT) prefix */ 117 uint8_t plat_plen; /* PLAT Prefix length */ 118 uint8_t clat_plen; /* CLAT Prefix length */ 119 uint8_t set; /* Named instance set [0..31] */ 120 uint8_t spare; 121 uint32_t flags; 122 } ipfw_nat64clat_cfg; 123 124 /* 125 * NAT64LSN default configuration values 126 */ 127 #define NAT64LSN_MAX_PORTS 2048 /* Unused */ 128 #define NAT64LSN_JMAXLEN 2048 /* Max outstanding requests. */ 129 #define NAT64LSN_TCP_SYN_AGE 10 /* State's TTL after SYN received. */ 130 #define NAT64LSN_TCP_EST_AGE (2 * 3600) /* TTL for established connection */ 131 #define NAT64LSN_TCP_FIN_AGE 180 /* State's TTL after FIN/RST received */ 132 #define NAT64LSN_UDP_AGE 120 /* TTL for UDP states */ 133 #define NAT64LSN_ICMP_AGE 60 /* TTL for ICMP states */ 134 #define NAT64LSN_HOST_AGE 3600 /* TTL for stale host entry */ 135 #define NAT64LSN_PG_AGE 900 /* TTL for stale ports groups */ 136 137 typedef struct _ipfw_nat64lsn_cfg { 138 char name[64]; /* NAT name */ 139 uint32_t flags; 140 141 uint32_t max_ports; /* Unused */ 142 uint32_t agg_prefix_len; /* Unused */ 143 uint32_t agg_prefix_max; /* Unused */ 144 145 struct in_addr prefix4; 146 uint16_t plen4; /* Prefix length */ 147 uint16_t plen6; /* Prefix length */ 148 struct in6_addr prefix6; /* NAT64 prefix */ 149 uint32_t jmaxlen; /* Max jobqueue length */ 150 151 uint16_t min_port; /* Unused */ 152 uint16_t max_port; /* Unused */ 153 154 uint16_t nh_delete_delay;/* Stale host delete delay */ 155 uint16_t pg_delete_delay;/* Stale portgroup delete delay */ 156 uint16_t st_syn_ttl; /* TCP syn expire */ 157 uint16_t st_close_ttl; /* TCP fin expire */ 158 uint16_t st_estab_ttl; /* TCP established expire */ 159 uint16_t st_udp_ttl; /* UDP expire */ 160 uint16_t st_icmp_ttl; /* ICMP expire */ 161 uint8_t set; /* Named instance set [0..31] */ 162 uint8_t states_chunks; /* Number of states chunks per PG */ 163 } ipfw_nat64lsn_cfg; 164 165 typedef struct _ipfw_nat64lsn_state { 166 struct in_addr daddr; /* Remote IPv4 address */ 167 uint16_t dport; /* Remote destination port */ 168 uint16_t aport; /* Local alias port */ 169 uint16_t sport; /* Source port */ 170 uint8_t flags; /* State flags */ 171 uint8_t spare[3]; 172 uint16_t idle; /* Last used time */ 173 } ipfw_nat64lsn_state; 174 175 typedef struct _ipfw_nat64lsn_stg { 176 uint64_t next_idx; /* next state index */ 177 struct in_addr alias4; /* IPv4 alias address */ 178 uint8_t proto; /* protocol */ 179 uint8_t flags; 180 uint16_t spare; 181 struct in6_addr host6; /* Bound IPv6 host */ 182 uint32_t count; /* Number of states */ 183 uint32_t spare2; 184 } ipfw_nat64lsn_stg; 185 186 typedef struct _ipfw_nat64lsn_state_v1 { 187 struct in6_addr host6; /* Bound IPv6 host */ 188 struct in_addr daddr; /* Remote IPv4 address */ 189 uint16_t dport; /* Remote destination port */ 190 uint16_t aport; /* Local alias port */ 191 uint16_t sport; /* Source port */ 192 uint16_t spare; 193 uint16_t idle; /* Last used time */ 194 uint8_t flags; /* State flags */ 195 uint8_t proto; /* protocol */ 196 } ipfw_nat64lsn_state_v1; 197 198 typedef struct _ipfw_nat64lsn_stg_v1 { 199 union nat64lsn_pgidx { 200 uint64_t index; 201 struct { 202 uint8_t chunk; /* states chunk */ 203 uint8_t proto; /* protocol */ 204 uint16_t port; /* base port */ 205 in_addr_t addr; /* alias address */ 206 }; 207 } next; /* next state index */ 208 struct in_addr alias4; /* IPv4 alias address */ 209 uint32_t count; /* Number of states */ 210 } ipfw_nat64lsn_stg_v1; 211 212 #endif /* _NETINET6_IP_FW_NAT64_H_ */ 213