xref: /freebsd/sys/netpfil/ipfw/nat64/nat64_translate.h (revision f1951fd745b894fe6586c298874af98544a5e272)
1 /*-
2  * Copyright (c) 2015-2016 Yandex LLC
3  * Copyright (c) 2015-2016 Andrey V. Elsukov <ae@FreeBSD.org>
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  *
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26  *
27  * $FreeBSD$
28  */
29 
30 #ifndef	_IP_FW_NAT64_TRANSLATE_H_
31 #define	_IP_FW_NAT64_TRANSLATE_H_
32 
33 struct nat64_stats {
34 	uint64_t	opcnt64;	/* 6to4 of packets translated */
35 	uint64_t	opcnt46;	/* 4to6 of packets translated */
36 	uint64_t	ofrags;		/* number of fragments generated */
37 	uint64_t	ifrags;		/* number of fragments received */
38 	uint64_t	oerrors;	/* number of output errors */
39 	uint64_t	noroute4;
40 	uint64_t	noroute6;
41 	uint64_t	nomatch4;	/* No addr/port match */
42 	uint64_t	noproto;	/* Protocol not supported */
43 	uint64_t	nomem;		/* mbufs allocation failed */
44 	uint64_t	dropped;	/* number of packets silently
45 					 * dropped due to some errors/
46 					 * unsupported/etc.
47 					 */
48 
49 	uint64_t	jrequests;	/* number of jobs requests queued */
50 	uint64_t	jcalls;		/* number of jobs handler calls */
51 	uint64_t	jhostsreq;	/* number of hosts requests */
52 	uint64_t	jportreq;
53 	uint64_t	jhostfails;
54 	uint64_t	jportfails;
55 	uint64_t	jmaxlen;
56 	uint64_t	jnomem;
57 	uint64_t	jreinjected;
58 
59 	uint64_t	screated;
60 	uint64_t	sdeleted;
61 	uint64_t	spgcreated;
62 	uint64_t	spgdeleted;
63 };
64 
65 #define	IPFW_NAT64_VERSION	1
66 #define	NAT64STATS	(sizeof(struct nat64_stats) / sizeof(uint64_t))
67 struct nat64_counters {
68 	counter_u64_t		cnt[NAT64STATS];
69 };
70 #define	NAT64STAT_ADD(s, f, v)		\
71     counter_u64_add((s)->cnt[		\
72 	offsetof(struct nat64_stats, f) / sizeof(uint64_t)], (v))
73 #define	NAT64STAT_INC(s, f)	NAT64STAT_ADD(s, f, 1)
74 #define	NAT64STAT_FETCH(s, f)		\
75     counter_u64_fetch((s)->cnt[	\
76 	offsetof(struct nat64_stats, f) / sizeof(uint64_t)])
77 
78 #define	L3HDR(_ip, _t)	((_t)((uint32_t *)(_ip) + (_ip)->ip_hl))
79 #define	TCP(p)		((struct tcphdr *)(p))
80 #define	UDP(p)		((struct udphdr *)(p))
81 #define	ICMP(p)		((struct icmphdr *)(p))
82 #define	ICMP6(p)	((struct icmp6_hdr *)(p))
83 
84 #define	NAT64SKIP	0
85 #define	NAT64RETURN	1
86 #define	NAT64MFREE	-1
87 
88 struct nat64_config {
89 	uint32_t		flags;
90 #define	NAT64_WKPFX		0x00010000	/* prefix6 is WKPFX */
91 	struct in6_addr		prefix6;
92 	uint8_t			plen6;
93 
94 	struct nat64_counters	stats;
95 };
96 
97 static inline int
98 nat64_check_ip6(struct in6_addr *addr)
99 {
100 
101 	/* XXX: We should really check /8 */
102 	if (addr->s6_addr16[0] == 0 || /* 0000::/8 Reserved by IETF */
103 	    IN6_IS_ADDR_MULTICAST(addr) || IN6_IS_ADDR_LINKLOCAL(addr))
104 		return (1);
105 	return (0);
106 }
107 
108 static inline int
109 nat64_check_ip4(in_addr_t ia)
110 {
111 
112 	/* IN_LOOPBACK */
113 	if ((ia & htonl(0xff000000)) == htonl(0x7f000000))
114 		return (1);
115 	/* IN_LINKLOCAL */
116 	if ((ia & htonl(0xffff0000)) == htonl(0xa9fe0000))
117 		return (1);
118 	/* IN_MULTICAST & IN_EXPERIMENTAL */
119 	if ((ia & htonl(0xe0000000)) == htonl(0xe0000000))
120 		return (1);
121 	return (0);
122 }
123 
124 /* Well-known prefix 64:ff9b::/96 */
125 #define	IPV6_ADDR_INT32_WKPFX	htonl(0x64ff9b)
126 #define	IN6_IS_ADDR_WKPFX(a)	\
127     ((a)->s6_addr32[0] == IPV6_ADDR_INT32_WKPFX && \
128 	(a)->s6_addr32[1] == 0 && (a)->s6_addr32[2] == 0)
129 
130 int nat64_check_private_ip4(const struct nat64_config *cfg, in_addr_t ia);
131 int nat64_check_prefix6(const struct in6_addr *prefix, int length);
132 int nat64_getlasthdr(struct mbuf *m, int *offset);
133 int nat64_do_handle_ip4(struct mbuf *m, struct in6_addr *saddr,
134     struct in6_addr *daddr, uint16_t lport, struct nat64_config *cfg,
135     void *logdata);
136 int nat64_do_handle_ip6(struct mbuf *m, uint32_t aaddr, uint16_t aport,
137     struct nat64_config *cfg, void *logdata);
138 int nat64_handle_icmp6(struct mbuf *m, int hlen, uint32_t aaddr,
139     uint16_t aport, struct nat64_config *cfg, void *logdata);
140 void nat64_embed_ip4(const struct nat64_config *cfg, in_addr_t ia,
141     struct in6_addr *ip6);
142 in_addr_t nat64_extract_ip4(const struct nat64_config *cfg,
143     const struct in6_addr *ip6);
144 
145 #endif
146 
147