xref: /freebsd/sys/netinet6/ip_fw_nat64.h (revision 002cae78daca2488aa423f13036a2c9dca5b134b)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2015-2019 Yandex LLC
5  * Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org>
6  * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org>
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28  *
29  * $FreeBSD$
30  */
31 
32 #ifndef	_NETINET6_IP_FW_NAT64_H_
33 #define	_NETINET6_IP_FW_NAT64_H_
34 
35 struct ipfw_nat64stl_stats {
36 	uint64_t	opcnt64;	/* 6to4 of packets translated */
37 	uint64_t	opcnt46;	/* 4to6 of packets translated */
38 	uint64_t	ofrags;		/* number of fragments generated */
39 	uint64_t	ifrags;		/* number of fragments received */
40 	uint64_t	oerrors;	/* number of output errors */
41 	uint64_t	noroute4;
42 	uint64_t	noroute6;
43 	uint64_t	noproto;	/* Protocol not supported */
44 	uint64_t	nomem;		/* mbuf allocation failed */
45 	uint64_t	dropped;	/* dropped due to some errors */
46 };
47 
48 struct ipfw_nat64lsn_stats {
49 	uint64_t	opcnt64;	/* 6to4 of packets translated */
50 	uint64_t	opcnt46;	/* 4to6 of packets translated */
51 	uint64_t	ofrags;		/* number of fragments generated */
52 	uint64_t	ifrags;		/* number of fragments received */
53 	uint64_t	oerrors;	/* number of output errors */
54 	uint64_t	noroute4;
55 	uint64_t	noroute6;
56 	uint64_t	noproto;	/* Protocol not supported */
57 	uint64_t	nomem;		/* mbuf allocation failed */
58 	uint64_t	dropped;	/* dropped due to some errors */
59 
60 	uint64_t	nomatch4;	/* No addr/port match */
61 	uint64_t	jcalls;		/* Number of job handler calls */
62 	uint64_t	jrequests;	/* Number of job requests */
63 	uint64_t	jhostsreq;	/* Number of job host requests */
64 	uint64_t	jportreq;	/* Number of portgroup requests */
65 	uint64_t	jhostfails;	/* Number of failed host allocs */
66 	uint64_t	jportfails;	/* Number of failed portgroup allocs */
67 	uint64_t	jreinjected;	/* Number of packets reinjected to q */
68 	uint64_t	jmaxlen;	/* Max queue length reached */
69 	uint64_t	jnomem;		/* No memory to alloc queue item */
70 
71 	uint64_t	screated;	/* Number of states created */
72 	uint64_t	sdeleted;	/* Number of states deleted */
73 	uint64_t	spgcreated;	/* Number of portgroups created */
74 	uint64_t	spgdeleted;	/* Number of portgroups deleted */
75 	uint64_t	hostcount;	/* Number of hosts  */
76 	uint64_t	tcpchunks;	/* Number of TCP chunks */
77 	uint64_t	udpchunks;	/* Number of UDP chunks */
78 	uint64_t	icmpchunks;	/* Number of ICMP chunks */
79 
80 	uint64_t	_reserved[4];
81 };
82 
83 #define	NAT64_LOG		0x0001	/* Enable logging via BPF */
84 #define	NAT64_ALLOW_PRIVATE	0x0002	/* Allow private IPv4 address
85 					 * translation
86 					 */
87 typedef struct _ipfw_nat64stl_cfg {
88 	char		name[64];	/* NAT name			*/
89 	ipfw_obj_ntlv	ntlv6;		/* object name tlv		*/
90 	ipfw_obj_ntlv	ntlv4;		/* object name tlv		*/
91 	struct in6_addr	prefix6;	/* NAT64 prefix */
92 	uint8_t		plen6;		/* Prefix length */
93 	uint8_t		set;		/* Named instance set [0..31] */
94 	uint8_t		spare[2];
95 	uint32_t	flags;
96 } ipfw_nat64stl_cfg;
97 
98 /*
99  * NAT64LSN default configuration values
100  */
101 #define	NAT64LSN_MAX_PORTS	2048	/* Max number of ports per host */
102 #define	NAT64LSN_JMAXLEN	2048	/* Max outstanding requests. */
103 #define	NAT64LSN_TCP_SYN_AGE	10	/* State's TTL after SYN received. */
104 #define	NAT64LSN_TCP_EST_AGE	(2 * 3600) /* TTL for established connection */
105 #define	NAT64LSN_TCP_FIN_AGE	180	/* State's TTL after FIN/RST received */
106 #define	NAT64LSN_UDP_AGE	120	/* TTL for UDP states */
107 #define	NAT64LSN_ICMP_AGE	60	/* TTL for ICMP states */
108 #define	NAT64LSN_HOST_AGE	3600	/* TTL for stale host entry */
109 #define	NAT64LSN_PG_AGE		900	/* TTL for stale ports groups */
110 
111 typedef struct _ipfw_nat64lsn_cfg {
112 	char		name[64];	/* NAT name			*/
113 	uint32_t	flags;
114 	uint32_t	max_ports;	/* Max ports per client */
115 	uint32_t	agg_prefix_len;	/* Prefix length to count */
116 	uint32_t	agg_prefix_max;	/* Max hosts per agg prefix */
117 	struct in_addr	prefix4;
118 	uint16_t	plen4;		/* Prefix length */
119 	uint16_t	plen6;		/* Prefix length */
120 	struct in6_addr	prefix6;	/* NAT64 prefix */
121 	uint32_t	jmaxlen;	/* Max jobqueue length */
122 	uint16_t	min_port;	/* Min port group # to use */
123 	uint16_t	max_port;	/* Max port group # to use */
124 	uint16_t	nh_delete_delay;/* Stale host delete delay */
125 	uint16_t	pg_delete_delay;/* Stale portgroup delete delay */
126 	uint16_t	st_syn_ttl;	/* TCP syn expire */
127 	uint16_t	st_close_ttl;	/* TCP fin expire */
128 	uint16_t	st_estab_ttl;	/* TCP established expire */
129 	uint16_t	st_udp_ttl;	/* UDP expire */
130 	uint16_t	st_icmp_ttl;	/* ICMP expire */
131 	uint8_t		set;		/* Named instance set [0..31] */
132 	uint8_t		spare;
133 } ipfw_nat64lsn_cfg;
134 
135 typedef struct _ipfw_nat64lsn_state {
136 	struct in_addr	daddr;		/* Remote IPv4 address */
137 	uint16_t	dport;		/* Remote destination port */
138 	uint16_t	aport;		/* Local alias port */
139 	uint16_t	sport;		/* Source port */
140 	uint8_t		flags;		/* State flags */
141 	uint8_t		spare[3];
142 	uint16_t	idle;		/* Last used time */
143 } ipfw_nat64lsn_state;
144 
145 typedef struct _ipfw_nat64lsn_stg {
146 	uint64_t	next_idx;	/* next state index */
147 	struct in_addr	alias4;		/* IPv4 alias address */
148 	uint8_t		proto;		/* protocol */
149 	uint8_t		flags;
150 	uint16_t	spare;
151 	struct in6_addr	host6;		/* Bound IPv6 host */
152 	uint32_t	count;		/* Number of states */
153 	uint32_t	spare2;
154 } ipfw_nat64lsn_stg;
155 
156 #endif /* _NETINET6_IP_FW_NAT64_H_ */
157 
158