xref: /freebsd/sys/netpfil/ipfw/nat64/nat64lsn.h (revision a25896ca1270e25b657ceaa8d47d5699515f5c25)
1 /*-
2  * Copyright (c) 2015 Yandex LLC
3  * Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org>
4  * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org>
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  *
28  * $FreeBSD$
29  */
30 
31 #ifndef	_IP_FW_NAT64LSN_H_
32 #define	_IP_FW_NAT64LSN_H_
33 
34 #include "ip_fw_nat64.h"
35 #include "nat64_translate.h"
36 
37 #define	NAT64_CHUNK_SIZE_BITS	6	/* 64 ports */
38 #define	NAT64_CHUNK_SIZE	(1 << NAT64_CHUNK_SIZE_BITS)
39 
40 #define	NAT64_MIN_PORT		1024
41 #define	NAT64_MIN_CHUNK		(NAT64_MIN_PORT >> NAT64_CHUNK_SIZE_BITS)
42 
43 struct st_ptr {
44 	uint8_t			idx;	/* index in nh->pg_ptr array.
45 					 * NOTE: it starts from 1.
46 					 */
47 	uint8_t			off;
48 };
49 #define	NAT64LSN_MAXPGPTR	((1 << (sizeof(uint8_t) * NBBY)) - 1)
50 #define	NAT64LSN_PGPTRMASKBITS	(sizeof(uint64_t) * NBBY)
51 #define	NAT64LSN_PGPTRNMASK	(roundup(NAT64LSN_MAXPGPTR,	\
52     NAT64LSN_PGPTRMASKBITS) / NAT64LSN_PGPTRMASKBITS)
53 
54 struct nat64lsn_portgroup;
55 /* sizeof(struct nat64lsn_host) = 64 + 64x2 + 8x8 = 256 bytes */
56 struct nat64lsn_host {
57 	struct rwlock	h_lock;		/* Host states lock */
58 
59 	struct in6_addr	addr;
60 	struct nat64lsn_host	*next;
61 	uint16_t	timestamp;	/* Last altered */
62 	uint16_t	hsize;		/* ports hash size */
63 	uint16_t	pg_used;	/* Number of portgroups used */
64 #define	NAT64LSN_REMAININGPG	8	/* Number of remaining PG before
65 					 * requesting of new chunk of indexes.
66 					 */
67 	uint16_t	pg_allocated;	/* Number of portgroups indexes
68 					 * allocated.
69 					 */
70 #define	NAT64LSN_HSIZE	64
71 	struct st_ptr	phash[NAT64LSN_HSIZE]; /* XXX: hardcoded size */
72 	/*
73 	 * PG indexes are stored in chunks with 32 elements.
74 	 * The maximum count is limited to 255 due to st_ptr->idx is uint8_t.
75 	 */
76 #define	NAT64LSN_PGIDX_CHUNK	32
77 #define	NAT64LSN_PGNIDX		(roundup(NAT64LSN_MAXPGPTR, \
78     NAT64LSN_PGIDX_CHUNK) / NAT64LSN_PGIDX_CHUNK)
79 	struct nat64lsn_portgroup **pg_ptr[NAT64LSN_PGNIDX]; /* PG indexes */
80 };
81 
82 #define	NAT64_RLOCK_ASSERT(h)	rw_assert(&(h)->h_lock, RA_RLOCKED)
83 #define	NAT64_WLOCK_ASSERT(h)	rw_assert(&(h)->h_lock, RA_WLOCKED)
84 
85 #define	NAT64_RLOCK(h)		rw_rlock(&(h)->h_lock)
86 #define	NAT64_RUNLOCK(h)	rw_runlock(&(h)->h_lock)
87 #define	NAT64_WLOCK(h)		rw_wlock(&(h)->h_lock)
88 #define	NAT64_WUNLOCK(h)	rw_wunlock(&(h)->h_lock)
89 #define	NAT64_LOCK(h)		NAT64_WLOCK(h)
90 #define	NAT64_UNLOCK(h)		NAT64_WUNLOCK(h)
91 #define	NAT64_LOCK_INIT(h) do {			\
92 	rw_init(&(h)->h_lock, "NAT64 host lock");	\
93 	} while (0)
94 
95 #define	NAT64_LOCK_DESTROY(h) do {			\
96 	rw_destroy(&(h)->h_lock);			\
97 	} while (0)
98 
99 /* Internal proto index */
100 #define	NAT_PROTO_TCP	1
101 #define	NAT_PROTO_UDP	2
102 #define	NAT_PROTO_ICMP	3
103 
104 #define	NAT_MAX_PROTO	4
105 extern uint8_t nat64lsn_rproto_map[NAT_MAX_PROTO];
106 
107 VNET_DECLARE(uint16_t, nat64lsn_eid);
108 #define	V_nat64lsn_eid		VNET(nat64lsn_eid)
109 #define	IPFW_TLV_NAT64LSN_NAME	IPFW_TLV_EACTION_NAME(V_nat64lsn_eid)
110 
111 /* Timestamp macro */
112 #define	_CT		((int)time_uptime % 65536)
113 #define	SET_AGE(x)	(x) = _CT
114 #define	GET_AGE(x)	((_CT >= (x)) ? _CT - (x) :	\
115 	(int)65536 + _CT - (x))
116 
117 #ifdef __LP64__
118 /* ffsl() is capable of checking 64-bit ints */
119 #define	_FFS64
120 #endif
121 
122 /* 16 bytes */
123 struct nat64lsn_state {
124 	union {
125 		struct {
126 			in_addr_t	faddr;	/* Remote IPv4 address */
127 			uint16_t	fport;	/* Remote IPv4 port */
128 			uint16_t	lport;	/* Local IPv6 port */
129 		}s;
130 		uint64_t		hkey;
131 	} u;
132 	uint8_t		nat_proto;
133 	uint8_t		flags;
134 	uint16_t	timestamp;
135 	struct st_ptr	cur; /* Index of portgroup in nat64lsn_host */
136 	struct st_ptr	next; /* Next entry index */
137 };
138 
139 /*
140  * 1024+32 bytes per 64 states, used to store state
141  * AND for outside-in state lookup
142  */
143 struct nat64lsn_portgroup {
144 	struct nat64lsn_host	*host;	/* IPv6 source host info */
145 	in_addr_t		aaddr;	/* Alias addr, network format */
146 	uint16_t		aport;	/* Base port */
147 	uint16_t		timestamp;
148 	uint8_t			nat_proto;
149 	uint8_t			spare[3];
150 	uint32_t		idx;
151 #ifdef _FFS64
152 	uint64_t		freemask;	/* Mask of free entries */
153 #else
154 	uint32_t		freemask[2];	/* Mask of free entries */
155 #endif
156 	struct nat64lsn_state	states[NAT64_CHUNK_SIZE]; /* State storage */
157 };
158 #ifdef _FFS64
159 #define	PG_MARK_BUSY_IDX(_pg, _idx)	(_pg)->freemask &= ~((uint64_t)1<<(_idx))
160 #define	PG_MARK_FREE_IDX(_pg, _idx)	(_pg)->freemask |= ((uint64_t)1<<(_idx))
161 #define	PG_IS_FREE_IDX(_pg, _idx)	((_pg)->freemask & ((uint64_t)1<<(_idx)))
162 #define	PG_IS_BUSY_IDX(_pg, _idx)	(PG_IS_FREE_IDX(_pg, _idx) == 0)
163 #define	PG_GET_FREE_IDX(_pg)		(ffsll((_pg)->freemask))
164 #define	PG_IS_EMPTY(_pg)		(((_pg)->freemask + 1) == 0)
165 #else
166 #define	PG_MARK_BUSY_IDX(_pg, _idx)	\
167 	(_pg)->freemask[(_idx) / 32] &= ~((u_long)1<<((_idx) % 32))
168 #define	PG_MARK_FREE_IDX(_pg, _idx)	\
169 	(_pg)->freemask[(_idx) / 32] |= ((u_long)1<<((_idx)  % 32))
170 #define	PG_IS_FREE_IDX(_pg, _idx)	\
171 	((_pg)->freemask[(_idx) / 32] & ((u_long)1<<((_idx) % 32)))
172 #define	PG_IS_BUSY_IDX(_pg, _idx)	(PG_IS_FREE_IDX(_pg, _idx) == 0)
173 #define	PG_GET_FREE_IDX(_pg)		_pg_get_free_idx(_pg)
174 #define	PG_IS_EMPTY(_pg)		\
175 	((((_pg)->freemask[0] + 1) == 0 && ((_pg)->freemask[1] + 1) == 0))
176 
177 static inline int
178 _pg_get_free_idx(const struct nat64lsn_portgroup *pg)
179 {
180 	int i;
181 
182 	if ((i = ffsl(pg->freemask[0])) != 0)
183 		return (i);
184 	if ((i = ffsl(pg->freemask[1])) != 0)
185 		return (i + 32);
186 	return (0);
187 }
188 
189 #endif
190 
191 TAILQ_HEAD(nat64lsn_job_head, nat64lsn_job_item);
192 
193 struct nat64lsn_cfg {
194 	struct named_object	no;
195 	struct nat64lsn_portgroup	**pg;	/* XXX: array of pointers */
196 	struct nat64lsn_host	**ih;	/* Host hash */
197 	uint32_t	prefix4;	/* IPv4 prefix */
198 	uint32_t	pmask4;		/* IPv4 prefix mask */
199 	uint32_t	ihsize;		/* IPv6 host hash size */
200 	uint8_t		plen4;
201 	uint8_t		nomatch_verdict;/* What to return to ipfw on no-match */
202 
203 	uint32_t	ihcount;	/* Number of items in host hash */
204 	int		max_chunks;	/* Max chunks per client */
205 	int		agg_prefix_len;	/* Prefix length to count */
206 	int		agg_prefix_max;	/* Max hosts per agg prefix */
207 	uint32_t	jmaxlen;	/* Max jobqueue length */
208 	uint16_t	min_chunk;	/* Min port group # to use */
209 	uint16_t	max_chunk;	/* Max port group # to use */
210 	uint16_t	nh_delete_delay;	/* Stale host delete delay */
211 	uint16_t	pg_delete_delay;	/* Stale portgroup del delay */
212 	uint16_t	st_syn_ttl;	/* TCP syn expire */
213 	uint16_t	st_close_ttl;	/* TCP fin expire */
214 	uint16_t	st_estab_ttl;	/* TCP established expire */
215 	uint16_t	st_udp_ttl;	/* UDP expire */
216 	uint16_t	st_icmp_ttl;	/* ICMP expire */
217 	uint32_t	protochunks[NAT_MAX_PROTO];/* Number of chunks used */
218 	struct nat64_config	base;
219 #define	NAT64LSN_FLAGSMASK	(NAT64_LOG)
220 
221 	struct callout		periodic;
222 	struct callout		jcallout;
223 	struct ip_fw_chain	*ch;
224 	struct vnet		*vp;
225 	struct nat64lsn_job_head	jhead;
226 	int			jlen;
227 	char			name[64];	/* Nat instance name */
228 };
229 
230 struct nat64lsn_cfg *nat64lsn_init_instance(struct ip_fw_chain *ch,
231     size_t numaddr);
232 void nat64lsn_destroy_instance(struct nat64lsn_cfg *cfg);
233 void nat64lsn_start_instance(struct nat64lsn_cfg *cfg);
234 void nat64lsn_init_internal(void);
235 void nat64lsn_uninit_internal(void);
236 int ipfw_nat64lsn(struct ip_fw_chain *ch, struct ip_fw_args *args,
237     ipfw_insn *cmd, int *done);
238 
239 void
240 nat64lsn_dump_state(const struct nat64lsn_cfg *cfg,
241     const struct nat64lsn_portgroup *pg, const struct nat64lsn_state *st,
242     const char *px, int off);
243 /*
244  * Portgroup layout
245  * addr x nat_proto x port_off
246  *
247  */
248 
249 #define	_ADDR_PG_PROTO_COUNT	(65536 >> NAT64_CHUNK_SIZE_BITS)
250 #define	_ADDR_PG_COUNT		(_ADDR_PG_PROTO_COUNT * NAT_MAX_PROTO)
251 
252 #define	GET_ADDR_IDX(_cfg, _addr)	((_addr) - ((_cfg)->prefix4))
253 #define	__GET_PORTGROUP_IDX(_proto, _port)	\
254     ((_proto - 1) * _ADDR_PG_PROTO_COUNT +	\
255 	((_port) >> NAT64_CHUNK_SIZE_BITS))
256 
257 #define	_GET_PORTGROUP_IDX(_cfg, _addr, _proto, _port)	\
258     GET_ADDR_IDX(_cfg, _addr) * _ADDR_PG_COUNT +	\
259 	__GET_PORTGROUP_IDX(_proto, _port)
260 #define	GET_PORTGROUP(_cfg, _addr, _proto, _port)	\
261     ((_cfg)->pg[_GET_PORTGROUP_IDX(_cfg, _addr, _proto, _port)])
262 
263 #define	PORTGROUP_CHUNK(_nh, _idx)		\
264     ((_nh)->pg_ptr[(_idx)])
265 #define	PORTGROUP_BYSIDX(_cfg, _nh, _idx)	\
266     (PORTGROUP_CHUNK(_nh, (_idx - 1) / NAT64LSN_PGIDX_CHUNK) \
267 	[((_idx) - 1) % NAT64LSN_PGIDX_CHUNK])
268 
269 
270 /* Chained hash table */
271 #define CHT_FIND(_ph, _hsize, _PX, _x, _key) do {			\
272 	unsigned int _buck = _PX##hash(_key) & (_hsize - 1);		\
273 	_PX##lock(_ph, _buck);						\
274 	_x = _PX##first(_ph, _buck);					\
275 	for ( ; _x != NULL; _x = _PX##next(_x)) {			\
276 		if (_PX##cmp(_key, _PX##val(_x)))			\
277 			break;						\
278 	}								\
279 	if (_x == NULL)							\
280 		_PX##unlock(_ph, _buck);				\
281 } while(0)
282 
283 #define	CHT_UNLOCK_BUCK(_ph, _PX, _buck)				\
284 	_PX##unlock(_ph, _buck);
285 
286 #define	CHT_UNLOCK_KEY(_ph, _hsize, _PX, _key) do {			\
287 	unsigned int _buck = _PX##hash(_key) & (_hsize - 1);		\
288 	_PX##unlock(_ph, _buck);					\
289 } while(0)
290 
291 #define	CHT_INSERT_HEAD(_ph, _hsize, _PX, _i) do {			\
292 	unsigned int _buck = _PX##hash(_PX##val(_i)) & (_hsize - 1);	\
293 	_PX##lock(_ph, _buck);						\
294 	_PX##next(_i) = _PX##first(_ph, _buck);				\
295 	_PX##first(_ph, _buck) = _i;					\
296 	_PX##unlock(_ph, _buck);					\
297 } while(0)
298 
299 #define	CHT_REMOVE(_ph, _hsize, _PX, _x, _tmp, _key) do {		\
300 	unsigned int _buck = _PX##hash(_key) & (_hsize - 1);		\
301 	_PX##lock(_ph, _buck);						\
302 	_x = _PX##first(_ph, _buck);					\
303 	_tmp = NULL;							\
304 	for ( ; _x != NULL; _tmp = _x, _x = _PX##next(_x)) {		\
305 		if (_PX##cmp(_key, _PX##val(_x)))			\
306 			break;						\
307 	}								\
308 	if (_x != NULL) {						\
309 		if (_tmp == NULL)					\
310 			_PX##first(_ph, _buck) = _PX##next(_x);		\
311 		else							\
312 			_PX##next(_tmp) = _PX##next(_x);		\
313 	}								\
314 	_PX##unlock(_ph, _buck);					\
315 } while(0)
316 
317 #define	CHT_FOREACH_SAFE(_ph, _hsize, _PX, _x, _tmp, _cb, _arg) do {	\
318 	for (unsigned int _i = 0; _i < _hsize; _i++) {			\
319 		_PX##lock(_ph, _i);					\
320 		_x = _PX##first(_ph, _i);				\
321 		_tmp = NULL;						\
322 		for (; _x != NULL; _tmp = _x, _x = _PX##next(_x)) {	\
323 			if (_cb(_x, _arg) == 0)				\
324 				continue;				\
325 			if (_tmp == NULL)				\
326 				_PX##first(_ph, _i) = _PX##next(_x);	\
327 			else						\
328 				_tmp = _PX##next(_x);			\
329 		}							\
330 		_PX##unlock(_ph, _i);					\
331 	}								\
332 } while(0)
333 
334 #define	CHT_RESIZE(_ph, _hsize, _nph, _nhsize, _PX, _x, _y) do {	\
335 	unsigned int _buck;						\
336 	for (unsigned int _i = 0; _i < _hsize; _i++) {			\
337 		_x = _PX##first(_ph, _i);				\
338 		_y = _x;						\
339 		while (_y != NULL) {					\
340 			_buck = _PX##hash(_PX##val(_x)) & (_nhsize - 1);\
341 			_y = _PX##next(_x);				\
342 			_PX##next(_x) = _PX##first(_nph, _buck);	\
343 			_PX##first(_nph, _buck) = _x;			\
344 		}							\
345 	}								\
346 } while(0)
347 
348 #endif /* _IP_FW_NAT64LSN_H_ */
349 
350