xref: /freebsd/sys/netpfil/ipfw/nat64/nat64lsn_control.c (revision 5dae51da3da0cc94d17bd67b308fad304ebec7e0)
1 /*-
2  * Copyright (c) 2015 Yandex LLC
3  * Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org>
4  * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org>
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31 
32 #include <sys/param.h>
33 #include <sys/systm.h>
34 #include <sys/counter.h>
35 #include <sys/errno.h>
36 #include <sys/kernel.h>
37 #include <sys/lock.h>
38 #include <sys/malloc.h>
39 #include <sys/mbuf.h>
40 #include <sys/module.h>
41 #include <sys/rmlock.h>
42 #include <sys/rwlock.h>
43 #include <sys/socket.h>
44 #include <sys/sockopt.h>
45 #include <sys/queue.h>
46 
47 #include <net/if.h>
48 #include <net/pfil.h>
49 
50 #include <netinet/in.h>
51 #include <netinet/ip.h>
52 #include <netinet/ip_var.h>
53 #include <netinet/ip_fw.h>
54 
55 #include <netpfil/ipfw/ip_fw_private.h>
56 #include <netpfil/ipfw/nat64/ip_fw_nat64.h>
57 #include <netpfil/ipfw/nat64/nat64lsn.h>
58 #include <netinet6/ip_fw_nat64.h>
59 
60 VNET_DEFINE(uint16_t, nat64lsn_eid) = 0;
61 
62 static struct nat64lsn_cfg *
63 nat64lsn_find(struct namedobj_instance *ni, const char *name, uint8_t set)
64 {
65 	struct nat64lsn_cfg *cfg;
66 
67 	cfg = (struct nat64lsn_cfg *)ipfw_objhash_lookup_name_type(ni, set,
68 	    IPFW_TLV_NAT64LSN_NAME, name);
69 
70 	return (cfg);
71 }
72 
73 static void
74 nat64lsn_default_config(ipfw_nat64lsn_cfg *uc)
75 {
76 
77 	if (uc->max_ports == 0)
78 		uc->max_ports = NAT64LSN_MAX_PORTS;
79 	else
80 		uc->max_ports = roundup(uc->max_ports, NAT64_CHUNK_SIZE);
81 	if (uc->max_ports > NAT64_CHUNK_SIZE * NAT64LSN_MAXPGPTR)
82 		uc->max_ports = NAT64_CHUNK_SIZE * NAT64LSN_MAXPGPTR;
83 	if (uc->jmaxlen == 0)
84 		uc->jmaxlen = NAT64LSN_JMAXLEN;
85 	if (uc->jmaxlen > 65536)
86 		uc->jmaxlen = 65536;
87 	if (uc->nh_delete_delay == 0)
88 		uc->nh_delete_delay = NAT64LSN_HOST_AGE;
89 	if (uc->pg_delete_delay == 0)
90 		uc->pg_delete_delay = NAT64LSN_PG_AGE;
91 	if (uc->st_syn_ttl == 0)
92 		uc->st_syn_ttl = NAT64LSN_TCP_SYN_AGE;
93 	if (uc->st_close_ttl == 0)
94 		uc->st_close_ttl = NAT64LSN_TCP_FIN_AGE;
95 	if (uc->st_estab_ttl == 0)
96 		uc->st_estab_ttl = NAT64LSN_TCP_EST_AGE;
97 	if (uc->st_udp_ttl == 0)
98 		uc->st_udp_ttl = NAT64LSN_UDP_AGE;
99 	if (uc->st_icmp_ttl == 0)
100 		uc->st_icmp_ttl = NAT64LSN_ICMP_AGE;
101 }
102 
103 /*
104  * Creates new nat64lsn instance.
105  * Data layout (v0)(current):
106  * Request: [ ipfw_obj_lheader ipfw_nat64lsn_cfg ]
107  *
108  * Returns 0 on success
109  */
110 static int
111 nat64lsn_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
112     struct sockopt_data *sd)
113 {
114 	ipfw_obj_lheader *olh;
115 	ipfw_nat64lsn_cfg *uc;
116 	struct nat64lsn_cfg *cfg;
117 	struct namedobj_instance *ni;
118 	uint32_t addr4, mask4;
119 
120 	if (sd->valsize != sizeof(*olh) + sizeof(*uc))
121 		return (EINVAL);
122 
123 	olh = (ipfw_obj_lheader *)sd->kbuf;
124 	uc = (ipfw_nat64lsn_cfg *)(olh + 1);
125 
126 	if (ipfw_check_object_name_generic(uc->name) != 0)
127 		return (EINVAL);
128 
129 	if (uc->agg_prefix_len > 127 || uc->set >= IPFW_MAX_SETS)
130 		return (EINVAL);
131 
132 	if (uc->plen4 > 32)
133 		return (EINVAL);
134 	if (uc->plen6 > 128 || ((uc->plen6 % 8) != 0))
135 		return (EINVAL);
136 
137 	/* XXX: Check prefix4 to be global */
138 	addr4 = ntohl(uc->prefix4.s_addr);
139 	mask4 = ~((1 << (32 - uc->plen4)) - 1);
140 	if ((addr4 & mask4) != addr4)
141 		return (EINVAL);
142 
143 	/* XXX: Check prefix6 */
144 	if (uc->min_port == 0)
145 		uc->min_port = NAT64_MIN_PORT;
146 	if (uc->max_port == 0)
147 		uc->max_port = 65535;
148 	if (uc->min_port > uc->max_port)
149 		return (EINVAL);
150 	uc->min_port = roundup(uc->min_port, NAT64_CHUNK_SIZE);
151 	uc->max_port = roundup(uc->max_port, NAT64_CHUNK_SIZE);
152 
153 	nat64lsn_default_config(uc);
154 
155 	ni = CHAIN_TO_SRV(ch);
156 	IPFW_UH_RLOCK(ch);
157 	if (nat64lsn_find(ni, uc->name, uc->set) != NULL) {
158 		IPFW_UH_RUNLOCK(ch);
159 		return (EEXIST);
160 	}
161 	IPFW_UH_RUNLOCK(ch);
162 
163 	cfg = nat64lsn_init_instance(ch, 1 << (32 - uc->plen4));
164 	strlcpy(cfg->name, uc->name, sizeof(cfg->name));
165 	cfg->no.name = cfg->name;
166 	cfg->no.etlv = IPFW_TLV_NAT64LSN_NAME;
167 	cfg->no.set = uc->set;
168 
169 	cfg->prefix4 = addr4;
170 	cfg->pmask4 = addr4 | ~mask4;
171 	/* XXX: Copy 96 bits */
172 	cfg->plen6 = 96;
173 	memcpy(&cfg->prefix6, &uc->prefix6, cfg->plen6 / 8);
174 	cfg->plen4 = uc->plen4;
175 	cfg->flags = uc->flags & NAT64LSN_FLAGSMASK;
176 	cfg->max_chunks = uc->max_ports / NAT64_CHUNK_SIZE;
177 	cfg->agg_prefix_len = uc->agg_prefix_len;
178 	cfg->agg_prefix_max = uc->agg_prefix_max;
179 
180 	cfg->min_chunk = uc->min_port / NAT64_CHUNK_SIZE;
181 	cfg->max_chunk = uc->max_port / NAT64_CHUNK_SIZE;
182 
183 	cfg->jmaxlen = uc->jmaxlen;
184 	cfg->nh_delete_delay = uc->nh_delete_delay;
185 	cfg->pg_delete_delay = uc->pg_delete_delay;
186 	cfg->st_syn_ttl = uc->st_syn_ttl;
187 	cfg->st_close_ttl = uc->st_close_ttl;
188 	cfg->st_estab_ttl = uc->st_estab_ttl;
189 	cfg->st_udp_ttl = uc->st_udp_ttl;
190 	cfg->st_icmp_ttl = uc->st_icmp_ttl;
191 
192 	cfg->nomatch_verdict = IP_FW_DENY;
193 	cfg->nomatch_final = 1;	/* Exit outer loop by default */
194 
195 	IPFW_UH_WLOCK(ch);
196 
197 	if (nat64lsn_find(ni, uc->name, uc->set) != NULL) {
198 		IPFW_UH_WUNLOCK(ch);
199 		nat64lsn_destroy_instance(cfg);
200 		return (EEXIST);
201 	}
202 
203 	if (ipfw_objhash_alloc_idx(CHAIN_TO_SRV(ch), &cfg->no.kidx) != 0) {
204 		IPFW_UH_WUNLOCK(ch);
205 		nat64lsn_destroy_instance(cfg);
206 		return (ENOSPC);
207 	}
208 	ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no);
209 
210 	/* Okay, let's link data */
211 	IPFW_WLOCK(ch);
212 	SRV_OBJECT(ch, cfg->no.kidx) = cfg;
213 	IPFW_WUNLOCK(ch);
214 
215 	nat64lsn_start_instance(cfg);
216 
217 	IPFW_UH_WUNLOCK(ch);
218 	return (0);
219 }
220 
221 static void
222 nat64lsn_detach_config(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg)
223 {
224 
225 	IPFW_UH_WLOCK_ASSERT(ch);
226 
227 	ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no);
228 	ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx);
229 }
230 
231 /*
232  * Destroys nat64 instance.
233  * Data layout (v0)(current):
234  * Request: [ ipfw_obj_header ]
235  *
236  * Returns 0 on success
237  */
238 static int
239 nat64lsn_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
240     struct sockopt_data *sd)
241 {
242 	struct nat64lsn_cfg *cfg;
243 	ipfw_obj_header *oh;
244 
245 	if (sd->valsize != sizeof(*oh))
246 		return (EINVAL);
247 
248 	oh = (ipfw_obj_header *)op3;
249 
250 	IPFW_UH_WLOCK(ch);
251 	cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
252 	if (cfg == NULL) {
253 		IPFW_UH_WUNLOCK(ch);
254 		return (ESRCH);
255 	}
256 
257 	if (cfg->no.refcnt > 0) {
258 		IPFW_UH_WUNLOCK(ch);
259 		return (EBUSY);
260 	}
261 
262 	IPFW_WLOCK(ch);
263 	SRV_OBJECT(ch, cfg->no.kidx) = NULL;
264 	IPFW_WUNLOCK(ch);
265 
266 	nat64lsn_detach_config(ch, cfg);
267 	IPFW_UH_WUNLOCK(ch);
268 
269 	nat64lsn_destroy_instance(cfg);
270 	return (0);
271 }
272 
273 #define	__COPY_STAT_FIELD(_cfg, _stats, _field)	\
274 	(_stats)->_field = NAT64STAT_FETCH(&(_cfg)->stats, _field)
275 static void
276 export_stats(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg,
277     struct ipfw_nat64lsn_stats *stats)
278 {
279 
280 	__COPY_STAT_FIELD(cfg, stats, opcnt64);
281 	__COPY_STAT_FIELD(cfg, stats, opcnt46);
282 	__COPY_STAT_FIELD(cfg, stats, ofrags);
283 	__COPY_STAT_FIELD(cfg, stats, ifrags);
284 	__COPY_STAT_FIELD(cfg, stats, oerrors);
285 	__COPY_STAT_FIELD(cfg, stats, noroute4);
286 	__COPY_STAT_FIELD(cfg, stats, noroute6);
287 	__COPY_STAT_FIELD(cfg, stats, nomatch4);
288 	__COPY_STAT_FIELD(cfg, stats, noproto);
289 	__COPY_STAT_FIELD(cfg, stats, nomem);
290 	__COPY_STAT_FIELD(cfg, stats, dropped);
291 
292 	__COPY_STAT_FIELD(cfg, stats, jcalls);
293 	__COPY_STAT_FIELD(cfg, stats, jrequests);
294 	__COPY_STAT_FIELD(cfg, stats, jhostsreq);
295 	__COPY_STAT_FIELD(cfg, stats, jportreq);
296 	__COPY_STAT_FIELD(cfg, stats, jhostfails);
297 	__COPY_STAT_FIELD(cfg, stats, jportfails);
298 	__COPY_STAT_FIELD(cfg, stats, jmaxlen);
299 	__COPY_STAT_FIELD(cfg, stats, jnomem);
300 	__COPY_STAT_FIELD(cfg, stats, jreinjected);
301 	__COPY_STAT_FIELD(cfg, stats, screated);
302 	__COPY_STAT_FIELD(cfg, stats, sdeleted);
303 	__COPY_STAT_FIELD(cfg, stats, spgcreated);
304 	__COPY_STAT_FIELD(cfg, stats, spgdeleted);
305 
306 	stats->hostcount = cfg->ihcount;
307 	stats->tcpchunks = cfg->protochunks[NAT_PROTO_TCP];
308 	stats->udpchunks = cfg->protochunks[NAT_PROTO_UDP];
309 	stats->icmpchunks = cfg->protochunks[NAT_PROTO_ICMP];
310 }
311 #undef	__COPY_STAT_FIELD
312 
313 static void
314 nat64lsn_export_config(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg,
315     ipfw_nat64lsn_cfg *uc)
316 {
317 
318 	uc->flags = cfg->flags & NAT64LSN_FLAGSMASK;
319 	uc->max_ports = cfg->max_chunks * NAT64_CHUNK_SIZE;
320 	uc->agg_prefix_len = cfg->agg_prefix_len;
321 	uc->agg_prefix_max = cfg->agg_prefix_max;
322 
323 	uc->jmaxlen = cfg->jmaxlen;
324 	uc->nh_delete_delay = cfg->nh_delete_delay;
325 	uc->pg_delete_delay = cfg->pg_delete_delay;
326 	uc->st_syn_ttl = cfg->st_syn_ttl;
327 	uc->st_close_ttl = cfg->st_close_ttl;
328 	uc->st_estab_ttl = cfg->st_estab_ttl;
329 	uc->st_udp_ttl = cfg->st_udp_ttl;
330 	uc->st_icmp_ttl = cfg->st_icmp_ttl;
331 	uc->prefix4.s_addr = htonl(cfg->prefix4);
332 	uc->prefix6 = cfg->prefix6;
333 	uc->plen4 = cfg->plen4;
334 	uc->plen6 = cfg->plen6;
335 	uc->set = cfg->no.set;
336 	strlcpy(uc->name, cfg->no.name, sizeof(uc->name));
337 }
338 
339 struct nat64_dump_arg {
340 	struct ip_fw_chain *ch;
341 	struct sockopt_data *sd;
342 };
343 
344 static int
345 export_config_cb(struct namedobj_instance *ni, struct named_object *no,
346     void *arg)
347 {
348 	struct nat64_dump_arg *da = (struct nat64_dump_arg *)arg;
349 	ipfw_nat64lsn_cfg *uc;
350 
351 	uc = (struct _ipfw_nat64lsn_cfg *)ipfw_get_sopt_space(da->sd,
352 	    sizeof(*uc));
353 	nat64lsn_export_config(da->ch, (struct nat64lsn_cfg *)no, uc);
354 	return (0);
355 }
356 
357 /*
358  * Lists all nat64 lsn instances currently available in kernel.
359  * Data layout (v0)(current):
360  * Request: [ ipfw_obj_lheader ]
361  * Reply: [ ipfw_obj_lheader ipfw_nat64lsn_cfg x N ]
362  *
363  * Returns 0 on success
364  */
365 static int
366 nat64lsn_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
367     struct sockopt_data *sd)
368 {
369 	ipfw_obj_lheader *olh;
370 	struct nat64_dump_arg da;
371 
372 	/* Check minimum header size */
373 	if (sd->valsize < sizeof(ipfw_obj_lheader))
374 		return (EINVAL);
375 
376 	olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh));
377 
378 	IPFW_UH_RLOCK(ch);
379 	olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch),
380 	    IPFW_TLV_NAT64LSN_NAME);
381 	olh->objsize = sizeof(ipfw_nat64lsn_cfg);
382 	olh->size = sizeof(*olh) + olh->count * olh->objsize;
383 
384 	if (sd->valsize < olh->size) {
385 		IPFW_UH_RUNLOCK(ch);
386 		return (ENOMEM);
387 	}
388 	memset(&da, 0, sizeof(da));
389 	da.ch = ch;
390 	da.sd = sd;
391 	ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb, &da,
392 	    IPFW_TLV_NAT64LSN_NAME);
393 	IPFW_UH_RUNLOCK(ch);
394 
395 	return (0);
396 }
397 
398 /*
399  * Change existing nat64lsn instance configuration.
400  * Data layout (v0)(current):
401  * Request: [ ipfw_obj_header ipfw_nat64lsn_cfg ]
402  * Reply: [ ipfw_obj_header ipfw_nat64lsn_cfg ]
403  *
404  * Returns 0 on success
405  */
406 static int
407 nat64lsn_config(struct ip_fw_chain *ch, ip_fw3_opheader *op,
408     struct sockopt_data *sd)
409 {
410 	ipfw_obj_header *oh;
411 	ipfw_nat64lsn_cfg *uc;
412 	struct nat64lsn_cfg *cfg;
413 	struct namedobj_instance *ni;
414 
415 	if (sd->valsize != sizeof(*oh) + sizeof(*uc))
416 		return (EINVAL);
417 
418 	oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd,
419 	    sizeof(*oh) + sizeof(*uc));
420 	uc = (ipfw_nat64lsn_cfg *)(oh + 1);
421 
422 	if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
423 	    oh->ntlv.set >= IPFW_MAX_SETS)
424 		return (EINVAL);
425 
426 	ni = CHAIN_TO_SRV(ch);
427 	if (sd->sopt->sopt_dir == SOPT_GET) {
428 		IPFW_UH_RLOCK(ch);
429 		cfg = nat64lsn_find(ni, oh->ntlv.name, oh->ntlv.set);
430 		if (cfg == NULL) {
431 			IPFW_UH_RUNLOCK(ch);
432 			return (EEXIST);
433 		}
434 		nat64lsn_export_config(ch, cfg, uc);
435 		IPFW_UH_RUNLOCK(ch);
436 		return (0);
437 	}
438 
439 	nat64lsn_default_config(uc);
440 
441 	IPFW_UH_WLOCK(ch);
442 	cfg = nat64lsn_find(ni, oh->ntlv.name, oh->ntlv.set);
443 	if (cfg == NULL) {
444 		IPFW_UH_WUNLOCK(ch);
445 		return (EEXIST);
446 	}
447 
448 	/*
449 	 * For now allow to change only following values:
450 	 *  jmaxlen, nh_del_age, pg_del_age, tcp_syn_age, tcp_close_age,
451 	 *  tcp_est_age, udp_age, icmp_age, flags, max_ports.
452 	 */
453 
454 	cfg->max_chunks = uc->max_ports / NAT64_CHUNK_SIZE;
455 	cfg->jmaxlen = uc->jmaxlen;
456 	cfg->nh_delete_delay = uc->nh_delete_delay;
457 	cfg->pg_delete_delay = uc->pg_delete_delay;
458 	cfg->st_syn_ttl = uc->st_syn_ttl;
459 	cfg->st_close_ttl = uc->st_close_ttl;
460 	cfg->st_estab_ttl = uc->st_estab_ttl;
461 	cfg->st_udp_ttl = uc->st_udp_ttl;
462 	cfg->st_icmp_ttl = uc->st_icmp_ttl;
463 	cfg->flags = uc->flags & NAT64LSN_FLAGSMASK;
464 
465 	IPFW_UH_WUNLOCK(ch);
466 
467 	return (0);
468 }
469 
470 /*
471  * Get nat64lsn statistics.
472  * Data layout (v0)(current):
473  * Request: [ ipfw_obj_header ]
474  * Reply: [ ipfw_obj_header ipfw_counter_tlv ]
475  *
476  * Returns 0 on success
477  */
478 static int
479 nat64lsn_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
480     struct sockopt_data *sd)
481 {
482 	struct ipfw_nat64lsn_stats stats;
483 	struct nat64lsn_cfg *cfg;
484 	ipfw_obj_header *oh;
485 	ipfw_obj_ctlv *ctlv;
486 	size_t sz;
487 
488 	sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats);
489 	if (sd->valsize % sizeof(uint64_t))
490 		return (EINVAL);
491 	if (sd->valsize < sz)
492 		return (ENOMEM);
493 	oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
494 	if (oh == NULL)
495 		return (EINVAL);
496 	memset(&stats, 0, sizeof(stats));
497 
498 	IPFW_UH_RLOCK(ch);
499 	cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
500 	if (cfg == NULL) {
501 		IPFW_UH_RUNLOCK(ch);
502 		return (ESRCH);
503 	}
504 
505 	export_stats(ch, cfg, &stats);
506 	IPFW_UH_RUNLOCK(ch);
507 
508 	ctlv = (ipfw_obj_ctlv *)(oh + 1);
509 	memset(ctlv, 0, sizeof(*ctlv));
510 	ctlv->head.type = IPFW_TLV_COUNTERS;
511 	ctlv->head.length = sz - sizeof(ipfw_obj_header);
512 	ctlv->count = sizeof(stats) / sizeof(uint64_t);
513 	ctlv->objsize = sizeof(uint64_t);
514 	ctlv->version = IPFW_NAT64_VERSION;
515 	memcpy(ctlv + 1, &stats, sizeof(stats));
516 	return (0);
517 }
518 
519 /*
520  * Reset nat64lsn statistics.
521  * Data layout (v0)(current):
522  * Request: [ ipfw_obj_header ]
523  *
524  * Returns 0 on success
525  */
526 static int
527 nat64lsn_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
528     struct sockopt_data *sd)
529 {
530 	struct nat64lsn_cfg *cfg;
531 	ipfw_obj_header *oh;
532 
533 	if (sd->valsize != sizeof(*oh))
534 		return (EINVAL);
535 	oh = (ipfw_obj_header *)sd->kbuf;
536 	if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
537 	    oh->ntlv.set >= IPFW_MAX_SETS)
538 		return (EINVAL);
539 
540 	IPFW_UH_WLOCK(ch);
541 	cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
542 	if (cfg == NULL) {
543 		IPFW_UH_WUNLOCK(ch);
544 		return (ESRCH);
545 	}
546 	COUNTER_ARRAY_ZERO(cfg->stats.stats, NAT64STATS);
547 	IPFW_UH_WUNLOCK(ch);
548 	return (0);
549 }
550 
551 /*
552  * Reply: [ ipfw_obj_header ipfw_obj_data [ ipfw_nat64lsn_stg
553  *	ipfw_nat64lsn_state x count, ... ] ]
554  */
555 static int
556 export_pg_states(struct nat64lsn_cfg *cfg, struct nat64lsn_portgroup *pg,
557     ipfw_nat64lsn_stg *stg, struct sockopt_data *sd)
558 {
559 	ipfw_nat64lsn_state *ste;
560 	struct nat64lsn_state *st;
561 	int i, count;
562 
563 	NAT64_LOCK(pg->host);
564 	count = 0;
565 	for (i = 0; i < 64; i++) {
566 		if (PG_IS_BUSY_IDX(pg, i))
567 			count++;
568 	}
569 	DPRINTF(DP_STATE, "EXPORT PG %d, count %d", pg->idx, count);
570 
571 	if (count == 0) {
572 		stg->count = 0;
573 		NAT64_UNLOCK(pg->host);
574 		return (0);
575 	}
576 	ste = (ipfw_nat64lsn_state *)ipfw_get_sopt_space(sd,
577 	    count * sizeof(ipfw_nat64lsn_state));
578 	if (ste == NULL) {
579 		NAT64_UNLOCK(pg->host);
580 		return (1);
581 	}
582 
583 	stg->alias4.s_addr = pg->aaddr;
584 	stg->proto = nat64lsn_rproto_map[pg->nat_proto];
585 	stg->flags = 0;
586 	stg->host6 = pg->host->addr;
587 	stg->count = count;
588 	for (i = 0; i < 64; i++) {
589 		if (PG_IS_FREE_IDX(pg, i))
590 			continue;
591 		st = &pg->states[i];
592 		ste->daddr.s_addr = st->u.s.faddr;
593 		ste->dport = st->u.s.fport;
594 		ste->aport = pg->aport + i;
595 		ste->sport = st->u.s.lport;
596 		ste->flags = st->flags; /* XXX filter flags */
597 		ste->idle = GET_AGE(st->timestamp);
598 		ste++;
599 	}
600 	NAT64_UNLOCK(pg->host);
601 
602 	return (0);
603 }
604 
605 static int
606 get_next_idx(struct nat64lsn_cfg *cfg, uint32_t *addr, uint8_t *nat_proto,
607     uint16_t *port)
608 {
609 
610 	if (*port < 65536 - NAT64_CHUNK_SIZE) {
611 		*port += NAT64_CHUNK_SIZE;
612 		return (0);
613 	}
614 	*port = 0;
615 
616 	if (*nat_proto < NAT_MAX_PROTO - 1) {
617 		*nat_proto += 1;
618 		return (0);
619 	}
620 	*nat_proto = 1;
621 
622 	if (*addr < cfg->pmask4) {
623 		*addr += 1;
624 		return (0);
625 	}
626 
627 	/* End of space. */
628 	return (1);
629 }
630 
631 #define	PACK_IDX(addr, proto, port)	\
632 	((uint64_t)addr << 32) | ((uint32_t)port << 16) | (proto << 8)
633 #define	UNPACK_IDX(idx, addr, proto, port)		\
634 	(addr) = (uint32_t)((idx) >> 32);		\
635 	(port) = (uint16_t)(((idx) >> 16) & 0xFFFF);	\
636 	(proto) = (uint8_t)(((idx) >> 8) & 0xFF)
637 
638 static struct nat64lsn_portgroup *
639 get_next_pg(struct nat64lsn_cfg *cfg, uint32_t *addr, uint8_t *nat_proto,
640   uint16_t *port)
641 {
642 	struct nat64lsn_portgroup *pg;
643 	uint64_t pre_pack, post_pack;
644 
645 	pg = NULL;
646 	pre_pack = PACK_IDX(*addr, *nat_proto, *port);
647 	for (;;) {
648 		if (get_next_idx(cfg, addr, nat_proto, port) != 0) {
649 			/* End of states */
650 			return (pg);
651 		}
652 
653 		pg = GET_PORTGROUP(cfg, *addr, *nat_proto, *port);
654 		if (pg != NULL)
655 			break;
656 	}
657 
658 	post_pack = PACK_IDX(*addr, *nat_proto, *port);
659 	if (pre_pack == post_pack)
660 		DPRINTF(DP_STATE, "XXX: PACK_IDX %u %d %d",
661 		    *addr, *nat_proto, *port);
662 	return (pg);
663 }
664 
665 static NAT64NOINLINE struct nat64lsn_portgroup *
666 get_first_pg(struct nat64lsn_cfg *cfg, uint32_t *addr, uint8_t *nat_proto,
667   uint16_t *port)
668 {
669 	struct nat64lsn_portgroup *pg;
670 
671 	pg = GET_PORTGROUP(cfg, *addr, *nat_proto, *port);
672 	if (pg == NULL)
673 		pg = get_next_pg(cfg, addr, nat_proto, port);
674 
675 	return (pg);
676 }
677 
678 /*
679  * Lists nat64lsn states.
680  * Data layout (v0)(current):
681  * Request: [ ipfw_obj_header ipfw_obj_data [ uint64_t ]]
682  * Reply: [ ipfw_obj_header ipfw_obj_data [
683  *		ipfw_nat64lsn_stg ipfw_nat64lsn_state x N] ]
684  *
685  * Returns 0 on success
686  */
687 static int
688 nat64lsn_states(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
689     struct sockopt_data *sd)
690 {
691 	ipfw_obj_header *oh;
692 	ipfw_obj_data *od;
693 	ipfw_nat64lsn_stg *stg;
694 	struct nat64lsn_cfg *cfg;
695 	struct nat64lsn_portgroup *pg, *pg_next;
696 	uint64_t next_idx;
697 	size_t sz;
698 	uint32_t addr, states;
699 	uint16_t port;
700 	uint8_t nat_proto;
701 
702 	sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_data) +
703 	    sizeof(uint64_t);
704 	/* Check minimum header size */
705 	if (sd->valsize < sz)
706 		return (EINVAL);
707 
708 	oh = (ipfw_obj_header *)sd->kbuf;
709 	od = (ipfw_obj_data *)(oh + 1);
710 	if (od->head.type != IPFW_TLV_OBJDATA ||
711 	    od->head.length != sz - sizeof(ipfw_obj_header))
712 		return (EINVAL);
713 
714 	next_idx = *(uint64_t *)(od + 1);
715 	/* Translate index to the request position to start from */
716 	UNPACK_IDX(next_idx, addr, nat_proto, port);
717 	if (nat_proto >= NAT_MAX_PROTO)
718 		return (EINVAL);
719 	if (nat_proto == 0 && addr != 0)
720 		return (EINVAL);
721 
722 	IPFW_UH_RLOCK(ch);
723 	cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
724 	if (cfg == NULL) {
725 		IPFW_UH_RUNLOCK(ch);
726 		return (ESRCH);
727 	}
728 	/* Fill in starting point */
729 	if (addr == 0) {
730 		addr = cfg->prefix4;
731 		nat_proto = 1;
732 		port = 0;
733 	}
734 	if (addr < cfg->prefix4 || addr > cfg->pmask4) {
735 		IPFW_UH_RUNLOCK(ch);
736 		DPRINTF(DP_GENERIC | DP_STATE, "XXX: %ju %u %u",
737 		    (uintmax_t)next_idx, addr, cfg->pmask4);
738 		return (EINVAL);
739 	}
740 
741 	sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_data) +
742 	    sizeof(ipfw_nat64lsn_stg);
743 	if (sd->valsize < sz)
744 		return (ENOMEM);
745 	oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd, sz);
746 	od = (ipfw_obj_data *)(oh + 1);
747 	od->head.type = IPFW_TLV_OBJDATA;
748 	od->head.length = sz - sizeof(ipfw_obj_header);
749 	stg = (ipfw_nat64lsn_stg *)(od + 1);
750 
751 	pg = get_first_pg(cfg, &addr, &nat_proto, &port);
752 	if (pg == NULL) {
753 		/* No states */
754 		stg->next_idx = 0xFF;
755 		stg->count = 0;
756 		IPFW_UH_RUNLOCK(ch);
757 		return (0);
758 	}
759 	states = 0;
760 	pg_next = NULL;
761 	while (pg != NULL) {
762 		pg_next = get_next_pg(cfg, &addr, &nat_proto, &port);
763 		if (pg_next == NULL)
764 			stg->next_idx = 0xFF;
765 		else
766 			stg->next_idx = PACK_IDX(addr, nat_proto, port);
767 
768 		if (export_pg_states(cfg, pg, stg, sd) != 0) {
769 			IPFW_UH_RUNLOCK(ch);
770 			return (states == 0 ? ENOMEM: 0);
771 		}
772 		states += stg->count;
773 		od->head.length += stg->count * sizeof(ipfw_nat64lsn_state);
774 		sz += stg->count * sizeof(ipfw_nat64lsn_state);
775 		if (pg_next != NULL) {
776 			sz += sizeof(ipfw_nat64lsn_stg);
777 			if (sd->valsize < sz)
778 				break;
779 			stg = (ipfw_nat64lsn_stg *)ipfw_get_sopt_space(sd,
780 			    sizeof(ipfw_nat64lsn_stg));
781 		}
782 		pg = pg_next;
783 	}
784 	IPFW_UH_RUNLOCK(ch);
785 	return (0);
786 }
787 
788 static struct ipfw_sopt_handler	scodes[] = {
789 	{ IP_FW_NAT64LSN_CREATE, 0,	HDIR_BOTH,	nat64lsn_create },
790 	{ IP_FW_NAT64LSN_DESTROY,0,	HDIR_SET,	nat64lsn_destroy },
791 	{ IP_FW_NAT64LSN_CONFIG, 0,	HDIR_BOTH,	nat64lsn_config },
792 	{ IP_FW_NAT64LSN_LIST,	 0,	HDIR_GET,	nat64lsn_list },
793 	{ IP_FW_NAT64LSN_STATS,	 0,	HDIR_GET,	nat64lsn_stats },
794 	{ IP_FW_NAT64LSN_RESET_STATS,0,	HDIR_SET,	nat64lsn_reset_stats },
795 	{ IP_FW_NAT64LSN_LIST_STATES,0,	HDIR_GET,	nat64lsn_states },
796 };
797 
798 static int
799 nat64lsn_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
800 {
801 	ipfw_insn *icmd;
802 
803 	icmd = cmd - 1;
804 	if (icmd->opcode != O_EXTERNAL_ACTION ||
805 	    icmd->arg1 != V_nat64lsn_eid)
806 		return (1);
807 
808 	*puidx = cmd->arg1;
809 	*ptype = 0;
810 	return (0);
811 }
812 
813 static void
814 nat64lsn_update_arg1(ipfw_insn *cmd, uint16_t idx)
815 {
816 
817 	cmd->arg1 = idx;
818 }
819 
820 static int
821 nat64lsn_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
822     struct named_object **pno)
823 {
824 	int err;
825 
826 	err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti,
827 	    IPFW_TLV_NAT64LSN_NAME, pno);
828 	return (err);
829 }
830 
831 static struct named_object *
832 nat64lsn_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
833 {
834 	struct namedobj_instance *ni;
835 	struct named_object *no;
836 
837 	IPFW_UH_WLOCK_ASSERT(ch);
838 	ni = CHAIN_TO_SRV(ch);
839 	no = ipfw_objhash_lookup_kidx(ni, idx);
840 	KASSERT(no != NULL, ("NAT64LSN with index %d not found", idx));
841 
842 	return (no);
843 }
844 
845 static int
846 nat64lsn_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
847     enum ipfw_sets_cmd cmd)
848 {
849 
850 	return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64LSN_NAME,
851 	    set, new_set, cmd));
852 }
853 
854 static struct opcode_obj_rewrite opcodes[] = {
855 	{
856 		.opcode = O_EXTERNAL_INSTANCE,
857 		.etlv = IPFW_TLV_EACTION /* just show it isn't table */,
858 		.classifier = nat64lsn_classify,
859 		.update = nat64lsn_update_arg1,
860 		.find_byname = nat64lsn_findbyname,
861 		.find_bykidx = nat64lsn_findbykidx,
862 		.manage_sets = nat64lsn_manage_sets,
863 	},
864 };
865 
866 static int
867 destroy_config_cb(struct namedobj_instance *ni, struct named_object *no,
868     void *arg)
869 {
870 	struct nat64lsn_cfg *cfg;
871 	struct ip_fw_chain *ch;
872 
873 	ch = (struct ip_fw_chain *)arg;
874 	cfg = (struct nat64lsn_cfg *)SRV_OBJECT(ch, no->kidx);
875 	SRV_OBJECT(ch, no->kidx) = NULL;
876 	nat64lsn_detach_config(ch, cfg);
877 	nat64lsn_destroy_instance(cfg);
878 	return (0);
879 }
880 
881 int
882 nat64lsn_init(struct ip_fw_chain *ch, int first)
883 {
884 
885 	if (first != 0)
886 		nat64lsn_init_internal();
887 	V_nat64lsn_eid = ipfw_add_eaction(ch, ipfw_nat64lsn, "nat64lsn");
888 	if (V_nat64lsn_eid == 0)
889 		return (ENXIO);
890 	IPFW_ADD_SOPT_HANDLER(first, scodes);
891 	IPFW_ADD_OBJ_REWRITER(first, opcodes);
892 	return (0);
893 }
894 
895 void
896 nat64lsn_uninit(struct ip_fw_chain *ch, int last)
897 {
898 
899 	IPFW_DEL_OBJ_REWRITER(last, opcodes);
900 	IPFW_DEL_SOPT_HANDLER(last, scodes);
901 	ipfw_del_eaction(ch, V_nat64lsn_eid);
902 	/*
903 	 * Since we already have deregistered external action,
904 	 * our named objects become unaccessible via rules, because
905 	 * all rules were truncated by ipfw_del_eaction().
906 	 * So, we can unlink and destroy our named objects without holding
907 	 * IPFW_WLOCK().
908 	 */
909 	IPFW_UH_WLOCK(ch);
910 	ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch,
911 	    IPFW_TLV_NAT64LSN_NAME);
912 	V_nat64lsn_eid = 0;
913 	IPFW_UH_WUNLOCK(ch);
914 	if (last != 0)
915 		nat64lsn_uninit_internal();
916 }
917 
918