xref: /freebsd/sys/netpfil/ipfw/nat64/nat64_translate.h (revision 9f23cbd6cae82fd77edfad7173432fa8dccd0a95)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2015-2019 Yandex LLC
5  * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org>
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  *
28  * $FreeBSD$
29  */
30 
31 #ifndef	_IP_FW_NAT64_TRANSLATE_H_
32 #define	_IP_FW_NAT64_TRANSLATE_H_
33 
34 struct nat64_stats {
35 	uint64_t	opcnt64;	/* 6to4 of packets translated */
36 	uint64_t	opcnt46;	/* 4to6 of packets translated */
37 	uint64_t	ofrags;		/* number of fragments generated */
38 	uint64_t	ifrags;		/* number of fragments received */
39 	uint64_t	oerrors;	/* number of output errors */
40 	uint64_t	noroute4;
41 	uint64_t	noroute6;
42 	uint64_t	nomatch4;	/* No addr/port match */
43 	uint64_t	noproto;	/* Protocol not supported */
44 	uint64_t	nomem;		/* mbufs allocation failed */
45 	uint64_t	dropped;	/* number of packets silently
46 					 * dropped due to some errors/
47 					 * unsupported/etc.
48 					 */
49 
50 	uint64_t	jrequests;	/* jobs requests queued */
51 	uint64_t	jcalls;		/* jobs handler calls */
52 	uint64_t	jhostsreq;	/* hosts requests */
53 	uint64_t	jportreq;	/* PG allocation requests */
54 	uint64_t	jhostfails;	/* hosts requests failed */
55 	uint64_t	jportfails;	/* PG allocation failed */
56 	uint64_t	jmaxlen;
57 	uint64_t	jnomem;
58 	uint64_t	jreinjected;
59 
60 	uint64_t	screated;
61 	uint64_t	sdeleted;
62 	uint64_t	spgcreated;
63 	uint64_t	spgdeleted;
64 };
65 
66 #define	IPFW_NAT64_VERSION	1
67 #define	NAT64STATS	(sizeof(struct nat64_stats) / sizeof(uint64_t))
68 struct nat64_counters {
69 	counter_u64_t		cnt[NAT64STATS];
70 };
71 #define	NAT64STAT_ADD(s, f, v)		\
72     counter_u64_add((s)->cnt[		\
73 	offsetof(struct nat64_stats, f) / sizeof(uint64_t)], (v))
74 #define	NAT64STAT_INC(s, f)	NAT64STAT_ADD(s, f, 1)
75 #define	NAT64STAT_FETCH(s, f)		\
76     counter_u64_fetch((s)->cnt[	\
77 	offsetof(struct nat64_stats, f) / sizeof(uint64_t)])
78 
79 #define	L3HDR(_ip, _t)	((_t)((uint32_t *)(_ip) + (_ip)->ip_hl))
80 #define	TCP(p)		((struct tcphdr *)(p))
81 #define	UDP(p)		((struct udphdr *)(p))
82 #define	ICMP(p)		((struct icmphdr *)(p))
83 #define	ICMP6(p)	((struct icmp6_hdr *)(p))
84 
85 #define	NAT64SKIP	0
86 #define	NAT64RETURN	1
87 #define	NAT64MFREE	-1
88 
89 /*
90  * According to RFC6877:
91  *  PLAT is provider-side translator (XLAT) that translates N:1 global
92  *  IPv6 addresses to global IPv4 addresses, and vice versa.
93  *
94  *  CLAT is customer-side translator (XLAT) that algorithmically
95  *  translates 1:1 private IPv4 addresses to global IPv6 addresses,
96  *  and vice versa.
97  */
98 struct nat64_config {
99 	struct in6_addr		clat_prefix;
100 	struct in6_addr		plat_prefix;
101 	uint32_t		flags;
102 #define	NAT64_WKPFX		0x00010000	/* prefix is well-known */
103 #define	NAT64_CLATPFX		0x00020000	/* dst prefix is configured */
104 #define	NAT64_PLATPFX		0x00040000	/* src prefix is configured */
105 	uint8_t			clat_plen;
106 	uint8_t			plat_plen;
107 
108 	struct nat64_counters	stats;
109 };
110 
111 static inline int
112 nat64_check_ip6(struct in6_addr *addr)
113 {
114 
115 	/* XXX: We should really check /8 */
116 	if (addr->s6_addr16[0] == 0 || /* 0000::/8 Reserved by IETF */
117 	    IN6_IS_ADDR_MULTICAST(addr) || IN6_IS_ADDR_LINKLOCAL(addr))
118 		return (1);
119 	return (0);
120 }
121 
122 static inline int
123 nat64_check_ip4(in_addr_t ia)
124 {
125 
126 	/* These checks are ordered from most likely to least */
127 	if (IN_MULTICAST(ntohl(ia)) || IN_LOOPBACK(ntohl(ia)) ||
128 	    IN_LINKLOCAL(ntohl(ia)) || IN_EXPERIMENTAL(ntohl(ia)))
129 		return (1);
130 	return (0);
131 }
132 
133 /* Well-known prefix 64:ff9b::/96 */
134 #define	IPV6_ADDR_INT32_WKPFX	htonl(0x64ff9b)
135 #define	IN6_IS_ADDR_WKPFX(a)	\
136     ((a)->s6_addr32[0] == IPV6_ADDR_INT32_WKPFX && \
137 	(a)->s6_addr32[1] == 0 && (a)->s6_addr32[2] == 0)
138 
139 int nat64_check_private_ip4(const struct nat64_config *cfg, in_addr_t ia);
140 int nat64_check_prefixlen(int length);
141 int nat64_check_prefix6(const struct in6_addr *prefix, int length);
142 int nat64_getlasthdr(struct mbuf *m, int *offset);
143 int nat64_do_handle_ip4(struct mbuf *m, struct in6_addr *saddr,
144     struct in6_addr *daddr, uint16_t lport, struct nat64_config *cfg,
145     void *logdata);
146 int nat64_do_handle_ip6(struct mbuf *m, uint32_t aaddr, uint16_t aport,
147     struct nat64_config *cfg, void *logdata);
148 int nat64_handle_icmp6(struct mbuf *m, int hlen, uint32_t aaddr,
149     uint16_t aport, struct nat64_config *cfg, void *logdata);
150 void nat64_embed_ip4(struct in6_addr *ip6, int plen, in_addr_t ia);
151 in_addr_t nat64_extract_ip4(const struct in6_addr *ip6, int plen);
152 
153 void nat64_set_output_method(int);
154 int nat64_get_output_method(void);
155 
156 #endif
157