1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2015-2019 Yandex LLC 5 * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org> 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 * 28 * $FreeBSD$ 29 */ 30 31 #ifndef _IP_FW_NAT64_TRANSLATE_H_ 32 #define _IP_FW_NAT64_TRANSLATE_H_ 33 34 struct nat64_stats { 35 uint64_t opcnt64; /* 6to4 of packets translated */ 36 uint64_t opcnt46; /* 4to6 of packets translated */ 37 uint64_t ofrags; /* number of fragments generated */ 38 uint64_t ifrags; /* number of fragments received */ 39 uint64_t oerrors; /* number of output errors */ 40 uint64_t noroute4; 41 uint64_t noroute6; 42 uint64_t nomatch4; /* No addr/port match */ 43 uint64_t noproto; /* Protocol not supported */ 44 uint64_t nomem; /* mbufs allocation failed */ 45 uint64_t dropped; /* number of packets silently 46 * dropped due to some errors/ 47 * unsupported/etc. 48 */ 49 50 uint64_t jrequests; /* jobs requests queued */ 51 uint64_t jcalls; /* jobs handler calls */ 52 uint64_t jhostsreq; /* hosts requests */ 53 uint64_t jportreq; /* PG allocation requests */ 54 uint64_t jhostfails; /* hosts requests failed */ 55 uint64_t jportfails; /* PG allocation failed */ 56 uint64_t jmaxlen; 57 uint64_t jnomem; 58 uint64_t jreinjected; 59 60 uint64_t screated; 61 uint64_t sdeleted; 62 uint64_t spgcreated; 63 uint64_t spgdeleted; 64 }; 65 66 #define IPFW_NAT64_VERSION 1 67 #define NAT64STATS (sizeof(struct nat64_stats) / sizeof(uint64_t)) 68 struct nat64_counters { 69 counter_u64_t cnt[NAT64STATS]; 70 }; 71 #define NAT64STAT_ADD(s, f, v) \ 72 counter_u64_add((s)->cnt[ \ 73 offsetof(struct nat64_stats, f) / sizeof(uint64_t)], (v)) 74 #define NAT64STAT_INC(s, f) NAT64STAT_ADD(s, f, 1) 75 #define NAT64STAT_FETCH(s, f) \ 76 counter_u64_fetch((s)->cnt[ \ 77 offsetof(struct nat64_stats, f) / sizeof(uint64_t)]) 78 79 #define L3HDR(_ip, _t) ((_t)((uint32_t *)(_ip) + (_ip)->ip_hl)) 80 #define TCP(p) ((struct tcphdr *)(p)) 81 #define UDP(p) ((struct udphdr *)(p)) 82 #define ICMP(p) ((struct icmphdr *)(p)) 83 #define ICMP6(p) ((struct icmp6_hdr *)(p)) 84 85 #define NAT64SKIP 0 86 #define NAT64RETURN 1 87 #define NAT64MFREE -1 88 89 /* 90 * According to RFC6877: 91 * PLAT is provider-side translator (XLAT) that translates N:1 global 92 * IPv6 addresses to global IPv4 addresses, and vice versa. 93 * 94 * CLAT is customer-side translator (XLAT) that algorithmically 95 * translates 1:1 private IPv4 addresses to global IPv6 addresses, 96 * and vice versa. 97 */ 98 struct nat64_config { 99 struct in6_addr clat_prefix; 100 struct in6_addr plat_prefix; 101 uint32_t flags; 102 #define NAT64_WKPFX 0x00010000 /* prefix is well-known */ 103 #define NAT64_CLATPFX 0x00020000 /* dst prefix is configured */ 104 #define NAT64_PLATPFX 0x00040000 /* src prefix is configured */ 105 uint8_t clat_plen; 106 uint8_t plat_plen; 107 108 struct nat64_counters stats; 109 }; 110 111 static inline int 112 nat64_check_ip6(struct in6_addr *addr) 113 { 114 115 /* XXX: We should really check /8 */ 116 if (addr->s6_addr16[0] == 0 || /* 0000::/8 Reserved by IETF */ 117 IN6_IS_ADDR_MULTICAST(addr) || IN6_IS_ADDR_LINKLOCAL(addr)) 118 return (1); 119 return (0); 120 } 121 122 static inline int 123 nat64_check_ip4(in_addr_t ia) 124 { 125 126 /* These checks are ordered from most likely to least */ 127 if (IN_MULTICAST(ntohl(ia)) || IN_LOOPBACK(ntohl(ia)) || 128 IN_LINKLOCAL(ntohl(ia)) || IN_EXPERIMENTAL(ntohl(ia))) 129 return (1); 130 return (0); 131 } 132 133 /* Well-known prefix 64:ff9b::/96 */ 134 #define IPV6_ADDR_INT32_WKPFX htonl(0x64ff9b) 135 #define IN6_IS_ADDR_WKPFX(a) \ 136 ((a)->s6_addr32[0] == IPV6_ADDR_INT32_WKPFX && \ 137 (a)->s6_addr32[1] == 0 && (a)->s6_addr32[2] == 0) 138 139 int nat64_check_private_ip4(const struct nat64_config *cfg, in_addr_t ia); 140 int nat64_check_prefixlen(int length); 141 int nat64_check_prefix6(const struct in6_addr *prefix, int length); 142 int nat64_getlasthdr(struct mbuf *m, int *offset); 143 int nat64_do_handle_ip4(struct mbuf *m, struct in6_addr *saddr, 144 struct in6_addr *daddr, uint16_t lport, struct nat64_config *cfg, 145 void *logdata); 146 int nat64_do_handle_ip6(struct mbuf *m, uint32_t aaddr, uint16_t aport, 147 struct nat64_config *cfg, void *logdata); 148 int nat64_handle_icmp6(struct mbuf *m, int hlen, uint32_t aaddr, 149 uint16_t aport, struct nat64_config *cfg, void *logdata); 150 void nat64_embed_ip4(struct in6_addr *ip6, int plen, in_addr_t ia); 151 in_addr_t nat64_extract_ip4(const struct in6_addr *ip6, int plen); 152 153 void nat64_set_output_method(int); 154 int nat64_get_output_method(void); 155 156 #endif 157