xref: /freebsd/sys/netpfil/ipfw/nat64/nat64lsn_control.c (revision af23369a6deaaeb612ab266eb88b8bb8d560c322)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3  *
4  * Copyright (c) 2015-2019 Yandex LLC
5  * Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org>
6  * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org>
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28  */
29 
30 #include <sys/cdefs.h>
31 __FBSDID("$FreeBSD$");
32 
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/counter.h>
36 #include <sys/ck.h>
37 #include <sys/epoch.h>
38 #include <sys/errno.h>
39 #include <sys/kernel.h>
40 #include <sys/lock.h>
41 #include <sys/malloc.h>
42 #include <sys/mbuf.h>
43 #include <sys/module.h>
44 #include <sys/rmlock.h>
45 #include <sys/rwlock.h>
46 #include <sys/socket.h>
47 #include <sys/sockopt.h>
48 
49 #include <net/if.h>
50 
51 #include <netinet/in.h>
52 #include <netinet/ip.h>
53 #include <netinet/ip_var.h>
54 #include <netinet/ip_fw.h>
55 #include <netinet6/ip_fw_nat64.h>
56 
57 #include <netpfil/ipfw/ip_fw_private.h>
58 
59 #include "nat64lsn.h"
60 
61 VNET_DEFINE(uint16_t, nat64lsn_eid) = 0;
62 
63 static struct nat64lsn_cfg *
64 nat64lsn_find(struct namedobj_instance *ni, const char *name, uint8_t set)
65 {
66 	struct nat64lsn_cfg *cfg;
67 
68 	cfg = (struct nat64lsn_cfg *)ipfw_objhash_lookup_name_type(ni, set,
69 	    IPFW_TLV_NAT64LSN_NAME, name);
70 
71 	return (cfg);
72 }
73 
74 static void
75 nat64lsn_default_config(ipfw_nat64lsn_cfg *uc)
76 {
77 
78 	if (uc->jmaxlen == 0)
79 		uc->jmaxlen = NAT64LSN_JMAXLEN;
80 	if (uc->jmaxlen > 65536)
81 		uc->jmaxlen = 65536;
82 	if (uc->nh_delete_delay == 0)
83 		uc->nh_delete_delay = NAT64LSN_HOST_AGE;
84 	if (uc->pg_delete_delay == 0)
85 		uc->pg_delete_delay = NAT64LSN_PG_AGE;
86 	if (uc->st_syn_ttl == 0)
87 		uc->st_syn_ttl = NAT64LSN_TCP_SYN_AGE;
88 	if (uc->st_close_ttl == 0)
89 		uc->st_close_ttl = NAT64LSN_TCP_FIN_AGE;
90 	if (uc->st_estab_ttl == 0)
91 		uc->st_estab_ttl = NAT64LSN_TCP_EST_AGE;
92 	if (uc->st_udp_ttl == 0)
93 		uc->st_udp_ttl = NAT64LSN_UDP_AGE;
94 	if (uc->st_icmp_ttl == 0)
95 		uc->st_icmp_ttl = NAT64LSN_ICMP_AGE;
96 
97 	if (uc->states_chunks == 0)
98 		uc->states_chunks = 1;
99 	else if (uc->states_chunks >= 128)
100 		uc->states_chunks = 128;
101 	else if (!powerof2(uc->states_chunks))
102 		uc->states_chunks = 1 << fls(uc->states_chunks);
103 }
104 
105 /*
106  * Creates new nat64lsn instance.
107  * Data layout (v0)(current):
108  * Request: [ ipfw_obj_lheader ipfw_nat64lsn_cfg ]
109  *
110  * Returns 0 on success
111  */
112 static int
113 nat64lsn_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
114     struct sockopt_data *sd)
115 {
116 	ipfw_obj_lheader *olh;
117 	ipfw_nat64lsn_cfg *uc;
118 	struct nat64lsn_cfg *cfg;
119 	struct namedobj_instance *ni;
120 	uint32_t addr4, mask4;
121 
122 	if (sd->valsize != sizeof(*olh) + sizeof(*uc))
123 		return (EINVAL);
124 
125 	olh = (ipfw_obj_lheader *)sd->kbuf;
126 	uc = (ipfw_nat64lsn_cfg *)(olh + 1);
127 
128 	if (ipfw_check_object_name_generic(uc->name) != 0)
129 		return (EINVAL);
130 
131 	if (uc->set >= IPFW_MAX_SETS)
132 		return (EINVAL);
133 
134 	if (uc->plen4 > 32)
135 		return (EINVAL);
136 
137 	/*
138 	 * Unspecified address has special meaning. But it must
139 	 * have valid prefix length. This length will be used to
140 	 * correctly extract and embedd IPv4 address into IPv6.
141 	 */
142 	if (nat64_check_prefix6(&uc->prefix6, uc->plen6) != 0 &&
143 	    IN6_IS_ADDR_UNSPECIFIED(&uc->prefix6) &&
144 	    nat64_check_prefixlen(uc->plen6) != 0)
145 		return (EINVAL);
146 
147 	/* XXX: Check prefix4 to be global */
148 	addr4 = ntohl(uc->prefix4.s_addr);
149 	mask4 = ~((1 << (32 - uc->plen4)) - 1);
150 	if ((addr4 & mask4) != addr4)
151 		return (EINVAL);
152 
153 	nat64lsn_default_config(uc);
154 
155 	ni = CHAIN_TO_SRV(ch);
156 	IPFW_UH_RLOCK(ch);
157 	if (nat64lsn_find(ni, uc->name, uc->set) != NULL) {
158 		IPFW_UH_RUNLOCK(ch);
159 		return (EEXIST);
160 	}
161 	IPFW_UH_RUNLOCK(ch);
162 
163 	cfg = nat64lsn_init_instance(ch, addr4, uc->plen4);
164 	strlcpy(cfg->name, uc->name, sizeof(cfg->name));
165 	cfg->no.name = cfg->name;
166 	cfg->no.etlv = IPFW_TLV_NAT64LSN_NAME;
167 	cfg->no.set = uc->set;
168 
169 	cfg->base.plat_prefix = uc->prefix6;
170 	cfg->base.plat_plen = uc->plen6;
171 	cfg->base.flags = (uc->flags & NAT64LSN_FLAGSMASK) | NAT64_PLATPFX;
172 	if (IN6_IS_ADDR_WKPFX(&cfg->base.plat_prefix))
173 		cfg->base.flags |= NAT64_WKPFX;
174 	else if (IN6_IS_ADDR_UNSPECIFIED(&cfg->base.plat_prefix))
175 		cfg->base.flags |= NAT64LSN_ANYPREFIX;
176 
177 	cfg->states_chunks = uc->states_chunks;
178 	cfg->jmaxlen = uc->jmaxlen;
179 	cfg->host_delete_delay = uc->nh_delete_delay;
180 	cfg->pg_delete_delay = uc->pg_delete_delay;
181 	cfg->st_syn_ttl = uc->st_syn_ttl;
182 	cfg->st_close_ttl = uc->st_close_ttl;
183 	cfg->st_estab_ttl = uc->st_estab_ttl;
184 	cfg->st_udp_ttl = uc->st_udp_ttl;
185 	cfg->st_icmp_ttl = uc->st_icmp_ttl;
186 
187 	cfg->nomatch_verdict = IP_FW_DENY;
188 
189 	IPFW_UH_WLOCK(ch);
190 
191 	if (nat64lsn_find(ni, uc->name, uc->set) != NULL) {
192 		IPFW_UH_WUNLOCK(ch);
193 		nat64lsn_destroy_instance(cfg);
194 		return (EEXIST);
195 	}
196 
197 	if (ipfw_objhash_alloc_idx(CHAIN_TO_SRV(ch), &cfg->no.kidx) != 0) {
198 		IPFW_UH_WUNLOCK(ch);
199 		nat64lsn_destroy_instance(cfg);
200 		return (ENOSPC);
201 	}
202 	ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no);
203 
204 	/* Okay, let's link data */
205 	SRV_OBJECT(ch, cfg->no.kidx) = cfg;
206 	nat64lsn_start_instance(cfg);
207 
208 	IPFW_UH_WUNLOCK(ch);
209 	return (0);
210 }
211 
212 static void
213 nat64lsn_detach_config(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg)
214 {
215 
216 	IPFW_UH_WLOCK_ASSERT(ch);
217 
218 	ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no);
219 	ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx);
220 }
221 
222 /*
223  * Destroys nat64 instance.
224  * Data layout (v0)(current):
225  * Request: [ ipfw_obj_header ]
226  *
227  * Returns 0 on success
228  */
229 static int
230 nat64lsn_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
231     struct sockopt_data *sd)
232 {
233 	struct nat64lsn_cfg *cfg;
234 	ipfw_obj_header *oh;
235 
236 	if (sd->valsize != sizeof(*oh))
237 		return (EINVAL);
238 
239 	oh = (ipfw_obj_header *)op3;
240 
241 	IPFW_UH_WLOCK(ch);
242 	cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
243 	if (cfg == NULL) {
244 		IPFW_UH_WUNLOCK(ch);
245 		return (ENOENT);
246 	}
247 
248 	if (cfg->no.refcnt > 0) {
249 		IPFW_UH_WUNLOCK(ch);
250 		return (EBUSY);
251 	}
252 
253 	ipfw_reset_eaction_instance(ch, V_nat64lsn_eid, cfg->no.kidx);
254 	SRV_OBJECT(ch, cfg->no.kidx) = NULL;
255 	nat64lsn_detach_config(ch, cfg);
256 	IPFW_UH_WUNLOCK(ch);
257 
258 	nat64lsn_destroy_instance(cfg);
259 	return (0);
260 }
261 
262 #define	__COPY_STAT_FIELD(_cfg, _stats, _field)	\
263 	(_stats)->_field = NAT64STAT_FETCH(&(_cfg)->base.stats, _field)
264 static void
265 export_stats(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg,
266     struct ipfw_nat64lsn_stats *stats)
267 {
268 	struct nat64lsn_alias *alias;
269 	int i, j;
270 
271 	__COPY_STAT_FIELD(cfg, stats, opcnt64);
272 	__COPY_STAT_FIELD(cfg, stats, opcnt46);
273 	__COPY_STAT_FIELD(cfg, stats, ofrags);
274 	__COPY_STAT_FIELD(cfg, stats, ifrags);
275 	__COPY_STAT_FIELD(cfg, stats, oerrors);
276 	__COPY_STAT_FIELD(cfg, stats, noroute4);
277 	__COPY_STAT_FIELD(cfg, stats, noroute6);
278 	__COPY_STAT_FIELD(cfg, stats, nomatch4);
279 	__COPY_STAT_FIELD(cfg, stats, noproto);
280 	__COPY_STAT_FIELD(cfg, stats, nomem);
281 	__COPY_STAT_FIELD(cfg, stats, dropped);
282 
283 	__COPY_STAT_FIELD(cfg, stats, jcalls);
284 	__COPY_STAT_FIELD(cfg, stats, jrequests);
285 	__COPY_STAT_FIELD(cfg, stats, jhostsreq);
286 	__COPY_STAT_FIELD(cfg, stats, jportreq);
287 	__COPY_STAT_FIELD(cfg, stats, jhostfails);
288 	__COPY_STAT_FIELD(cfg, stats, jportfails);
289 	__COPY_STAT_FIELD(cfg, stats, jmaxlen);
290 	__COPY_STAT_FIELD(cfg, stats, jnomem);
291 	__COPY_STAT_FIELD(cfg, stats, jreinjected);
292 	__COPY_STAT_FIELD(cfg, stats, screated);
293 	__COPY_STAT_FIELD(cfg, stats, sdeleted);
294 	__COPY_STAT_FIELD(cfg, stats, spgcreated);
295 	__COPY_STAT_FIELD(cfg, stats, spgdeleted);
296 
297 	stats->hostcount = cfg->hosts_count;
298 	for (i = 0; i < (1 << (32 - cfg->plen4)); i++) {
299 		alias = &cfg->aliases[i];
300 		for (j = 0; j < 32 && ISSET32(alias->tcp_chunkmask, j); j++)
301 			stats->tcpchunks += bitcount32(alias->tcp_pgmask[j]);
302 		for (j = 0; j < 32 && ISSET32(alias->udp_chunkmask, j); j++)
303 			stats->udpchunks += bitcount32(alias->udp_pgmask[j]);
304 		for (j = 0; j < 32 && ISSET32(alias->icmp_chunkmask, j); j++)
305 			stats->icmpchunks += bitcount32(alias->icmp_pgmask[j]);
306 	}
307 }
308 #undef	__COPY_STAT_FIELD
309 
310 static void
311 nat64lsn_export_config(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg,
312     ipfw_nat64lsn_cfg *uc)
313 {
314 
315 	uc->flags = cfg->base.flags & NAT64LSN_FLAGSMASK;
316 	uc->states_chunks = cfg->states_chunks;
317 	uc->jmaxlen = cfg->jmaxlen;
318 	uc->nh_delete_delay = cfg->host_delete_delay;
319 	uc->pg_delete_delay = cfg->pg_delete_delay;
320 	uc->st_syn_ttl = cfg->st_syn_ttl;
321 	uc->st_close_ttl = cfg->st_close_ttl;
322 	uc->st_estab_ttl = cfg->st_estab_ttl;
323 	uc->st_udp_ttl = cfg->st_udp_ttl;
324 	uc->st_icmp_ttl = cfg->st_icmp_ttl;
325 	uc->prefix4.s_addr = htonl(cfg->prefix4);
326 	uc->prefix6 = cfg->base.plat_prefix;
327 	uc->plen4 = cfg->plen4;
328 	uc->plen6 = cfg->base.plat_plen;
329 	uc->set = cfg->no.set;
330 	strlcpy(uc->name, cfg->no.name, sizeof(uc->name));
331 }
332 
333 struct nat64_dump_arg {
334 	struct ip_fw_chain *ch;
335 	struct sockopt_data *sd;
336 };
337 
338 static int
339 export_config_cb(struct namedobj_instance *ni, struct named_object *no,
340     void *arg)
341 {
342 	struct nat64_dump_arg *da = (struct nat64_dump_arg *)arg;
343 	ipfw_nat64lsn_cfg *uc;
344 
345 	uc = (struct _ipfw_nat64lsn_cfg *)ipfw_get_sopt_space(da->sd,
346 	    sizeof(*uc));
347 	nat64lsn_export_config(da->ch, (struct nat64lsn_cfg *)no, uc);
348 	return (0);
349 }
350 
351 /*
352  * Lists all nat64 lsn instances currently available in kernel.
353  * Data layout (v0)(current):
354  * Request: [ ipfw_obj_lheader ]
355  * Reply: [ ipfw_obj_lheader ipfw_nat64lsn_cfg x N ]
356  *
357  * Returns 0 on success
358  */
359 static int
360 nat64lsn_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
361     struct sockopt_data *sd)
362 {
363 	ipfw_obj_lheader *olh;
364 	struct nat64_dump_arg da;
365 
366 	/* Check minimum header size */
367 	if (sd->valsize < sizeof(ipfw_obj_lheader))
368 		return (EINVAL);
369 
370 	olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh));
371 
372 	IPFW_UH_RLOCK(ch);
373 	olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch),
374 	    IPFW_TLV_NAT64LSN_NAME);
375 	olh->objsize = sizeof(ipfw_nat64lsn_cfg);
376 	olh->size = sizeof(*olh) + olh->count * olh->objsize;
377 
378 	if (sd->valsize < olh->size) {
379 		IPFW_UH_RUNLOCK(ch);
380 		return (ENOMEM);
381 	}
382 	memset(&da, 0, sizeof(da));
383 	da.ch = ch;
384 	da.sd = sd;
385 	ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb, &da,
386 	    IPFW_TLV_NAT64LSN_NAME);
387 	IPFW_UH_RUNLOCK(ch);
388 
389 	return (0);
390 }
391 
392 /*
393  * Change existing nat64lsn instance configuration.
394  * Data layout (v0)(current):
395  * Request: [ ipfw_obj_header ipfw_nat64lsn_cfg ]
396  * Reply: [ ipfw_obj_header ipfw_nat64lsn_cfg ]
397  *
398  * Returns 0 on success
399  */
400 static int
401 nat64lsn_config(struct ip_fw_chain *ch, ip_fw3_opheader *op,
402     struct sockopt_data *sd)
403 {
404 	ipfw_obj_header *oh;
405 	ipfw_nat64lsn_cfg *uc;
406 	struct nat64lsn_cfg *cfg;
407 	struct namedobj_instance *ni;
408 
409 	if (sd->valsize != sizeof(*oh) + sizeof(*uc))
410 		return (EINVAL);
411 
412 	oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd,
413 	    sizeof(*oh) + sizeof(*uc));
414 	uc = (ipfw_nat64lsn_cfg *)(oh + 1);
415 
416 	if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
417 	    oh->ntlv.set >= IPFW_MAX_SETS)
418 		return (EINVAL);
419 
420 	ni = CHAIN_TO_SRV(ch);
421 	if (sd->sopt->sopt_dir == SOPT_GET) {
422 		IPFW_UH_RLOCK(ch);
423 		cfg = nat64lsn_find(ni, oh->ntlv.name, oh->ntlv.set);
424 		if (cfg == NULL) {
425 			IPFW_UH_RUNLOCK(ch);
426 			return (ENOENT);
427 		}
428 		nat64lsn_export_config(ch, cfg, uc);
429 		IPFW_UH_RUNLOCK(ch);
430 		return (0);
431 	}
432 
433 	nat64lsn_default_config(uc);
434 
435 	IPFW_UH_WLOCK(ch);
436 	cfg = nat64lsn_find(ni, oh->ntlv.name, oh->ntlv.set);
437 	if (cfg == NULL) {
438 		IPFW_UH_WUNLOCK(ch);
439 		return (ENOENT);
440 	}
441 
442 	/*
443 	 * For now allow to change only following values:
444 	 *  jmaxlen, nh_del_age, pg_del_age, tcp_syn_age, tcp_close_age,
445 	 *  tcp_est_age, udp_age, icmp_age, flags, states_chunks.
446 	 */
447 
448 	cfg->states_chunks = uc->states_chunks;
449 	cfg->jmaxlen = uc->jmaxlen;
450 	cfg->host_delete_delay = uc->nh_delete_delay;
451 	cfg->pg_delete_delay = uc->pg_delete_delay;
452 	cfg->st_syn_ttl = uc->st_syn_ttl;
453 	cfg->st_close_ttl = uc->st_close_ttl;
454 	cfg->st_estab_ttl = uc->st_estab_ttl;
455 	cfg->st_udp_ttl = uc->st_udp_ttl;
456 	cfg->st_icmp_ttl = uc->st_icmp_ttl;
457 	cfg->base.flags &= ~NAT64LSN_FLAGSMASK;
458 	cfg->base.flags |= uc->flags & NAT64LSN_FLAGSMASK;
459 
460 	IPFW_UH_WUNLOCK(ch);
461 
462 	return (0);
463 }
464 
465 /*
466  * Get nat64lsn statistics.
467  * Data layout (v0)(current):
468  * Request: [ ipfw_obj_header ]
469  * Reply: [ ipfw_obj_header ipfw_counter_tlv ]
470  *
471  * Returns 0 on success
472  */
473 static int
474 nat64lsn_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
475     struct sockopt_data *sd)
476 {
477 	struct ipfw_nat64lsn_stats stats;
478 	struct nat64lsn_cfg *cfg;
479 	ipfw_obj_header *oh;
480 	ipfw_obj_ctlv *ctlv;
481 	size_t sz;
482 
483 	sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats);
484 	if (sd->valsize % sizeof(uint64_t))
485 		return (EINVAL);
486 	if (sd->valsize < sz)
487 		return (ENOMEM);
488 	oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
489 	if (oh == NULL)
490 		return (EINVAL);
491 	memset(&stats, 0, sizeof(stats));
492 
493 	IPFW_UH_RLOCK(ch);
494 	cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
495 	if (cfg == NULL) {
496 		IPFW_UH_RUNLOCK(ch);
497 		return (ENOENT);
498 	}
499 
500 	export_stats(ch, cfg, &stats);
501 	IPFW_UH_RUNLOCK(ch);
502 
503 	ctlv = (ipfw_obj_ctlv *)(oh + 1);
504 	memset(ctlv, 0, sizeof(*ctlv));
505 	ctlv->head.type = IPFW_TLV_COUNTERS;
506 	ctlv->head.length = sz - sizeof(ipfw_obj_header);
507 	ctlv->count = sizeof(stats) / sizeof(uint64_t);
508 	ctlv->objsize = sizeof(uint64_t);
509 	ctlv->version = IPFW_NAT64_VERSION;
510 	memcpy(ctlv + 1, &stats, sizeof(stats));
511 	return (0);
512 }
513 
514 /*
515  * Reset nat64lsn statistics.
516  * Data layout (v0)(current):
517  * Request: [ ipfw_obj_header ]
518  *
519  * Returns 0 on success
520  */
521 static int
522 nat64lsn_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
523     struct sockopt_data *sd)
524 {
525 	struct nat64lsn_cfg *cfg;
526 	ipfw_obj_header *oh;
527 
528 	if (sd->valsize != sizeof(*oh))
529 		return (EINVAL);
530 	oh = (ipfw_obj_header *)sd->kbuf;
531 	if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
532 	    oh->ntlv.set >= IPFW_MAX_SETS)
533 		return (EINVAL);
534 
535 	IPFW_UH_WLOCK(ch);
536 	cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
537 	if (cfg == NULL) {
538 		IPFW_UH_WUNLOCK(ch);
539 		return (ENOENT);
540 	}
541 	COUNTER_ARRAY_ZERO(cfg->base.stats.cnt, NAT64STATS);
542 	IPFW_UH_WUNLOCK(ch);
543 	return (0);
544 }
545 
546 #ifdef __LP64__
547 #define	FREEMASK_COPY(pg, n, out)	(out) = *FREEMASK_CHUNK((pg), (n))
548 #else
549 #define	FREEMASK_COPY(pg, n, out)	(out) = *FREEMASK_CHUNK((pg), (n)) | \
550     ((uint64_t)*(FREEMASK_CHUNK((pg), (n)) + 1) << 32)
551 #endif
552 /*
553  * Reply: [ ipfw_obj_header ipfw_obj_data [ ipfw_nat64lsn_stg
554  *	ipfw_nat64lsn_state x count, ... ] ]
555  */
556 static int
557 nat64lsn_export_states_v1(struct nat64lsn_cfg *cfg, union nat64lsn_pgidx *idx,
558     struct nat64lsn_pg *pg, struct sockopt_data *sd, uint32_t *ret_count)
559 {
560 	ipfw_nat64lsn_state_v1 *s;
561 	struct nat64lsn_state *state;
562 	uint64_t freemask;
563 	uint32_t i, count;
564 
565 	/* validate user input */
566 	if (idx->chunk > pg->chunks_count - 1)
567 		return (EINVAL);
568 
569 	FREEMASK_COPY(pg, idx->chunk, freemask);
570 	count = 64 - bitcount64(freemask);
571 	if (count == 0)
572 		return (0);	/* Try next PG/chunk */
573 
574 	DPRINTF(DP_STATE, "EXPORT PG 0x%16jx, count %d",
575 	    (uintmax_t)idx->index, count);
576 
577 	s = (ipfw_nat64lsn_state_v1 *)ipfw_get_sopt_space(sd,
578 	    count * sizeof(ipfw_nat64lsn_state_v1));
579 	if (s == NULL)
580 		return (ENOMEM);
581 
582 	for (i = 0; i < 64; i++) {
583 		if (ISSET64(freemask, i))
584 			continue;
585 		state = pg->chunks_count == 1 ? &pg->states->state[i] :
586 		    &pg->states_chunk[idx->chunk]->state[i];
587 
588 		s->host6 = state->host->addr;
589 		s->daddr.s_addr = htonl(state->ip_dst);
590 		s->dport = state->dport;
591 		s->sport = state->sport;
592 		s->aport = state->aport;
593 		s->flags = (uint8_t)(state->flags & 7);
594 		s->proto = state->proto;
595 		s->idle = GET_AGE(state->timestamp);
596 		s++;
597 	}
598 	*ret_count = count;
599 	return (0);
600 }
601 
602 #define	LAST_IDX	0xFF
603 static int
604 nat64lsn_next_pgidx(struct nat64lsn_cfg *cfg, struct nat64lsn_pg *pg,
605     union nat64lsn_pgidx *idx)
606 {
607 
608 	/* First iterate over chunks */
609 	if (pg != NULL) {
610 		if (idx->chunk < pg->chunks_count - 1) {
611 			idx->chunk++;
612 			return (0);
613 		}
614 	}
615 	idx->chunk = 0;
616 	/* Then over PGs */
617 	if (idx->port < UINT16_MAX - 64) {
618 		idx->port += 64;
619 		return (0);
620 	}
621 	idx->port = NAT64_MIN_PORT;
622 	/* Then over supported protocols */
623 	switch (idx->proto) {
624 	case IPPROTO_ICMP:
625 		idx->proto = IPPROTO_TCP;
626 		return (0);
627 	case IPPROTO_TCP:
628 		idx->proto = IPPROTO_UDP;
629 		return (0);
630 	default:
631 		idx->proto = IPPROTO_ICMP;
632 	}
633 	/* And then over IPv4 alias addresses */
634 	if (idx->addr < cfg->pmask4) {
635 		idx->addr++;
636 		return (1);	/* New states group is needed */
637 	}
638 	idx->index = LAST_IDX;
639 	return (-1);		/* No more states */
640 }
641 
642 static struct nat64lsn_pg*
643 nat64lsn_get_pg_byidx(struct nat64lsn_cfg *cfg, union nat64lsn_pgidx *idx)
644 {
645 	struct nat64lsn_alias *alias;
646 	int pg_idx;
647 
648 	alias = &cfg->aliases[idx->addr & ((1 << (32 - cfg->plen4)) - 1)];
649 	MPASS(alias->addr == idx->addr);
650 
651 	pg_idx = (idx->port - NAT64_MIN_PORT) / 64;
652 	switch (idx->proto) {
653 	case IPPROTO_ICMP:
654 		if (ISSET32(alias->icmp_pgmask[pg_idx / 32], pg_idx % 32))
655 			return (alias->icmp[pg_idx / 32]->pgptr[pg_idx % 32]);
656 		break;
657 	case IPPROTO_TCP:
658 		if (ISSET32(alias->tcp_pgmask[pg_idx / 32], pg_idx % 32))
659 			return (alias->tcp[pg_idx / 32]->pgptr[pg_idx % 32]);
660 		break;
661 	case IPPROTO_UDP:
662 		if (ISSET32(alias->udp_pgmask[pg_idx / 32], pg_idx % 32))
663 			return (alias->udp[pg_idx / 32]->pgptr[pg_idx % 32]);
664 		break;
665 	}
666 	return (NULL);
667 }
668 
669 /*
670  * Lists nat64lsn states.
671  * Data layout (v0):
672  * Request: [ ipfw_obj_header ipfw_obj_data [ uint64_t ]]
673  * Reply: [ ipfw_obj_header ipfw_obj_data [
674  *		ipfw_nat64lsn_stg ipfw_nat64lsn_state x N] ]
675  *
676  * Returns 0 on success
677  */
678 static int
679 nat64lsn_states_v0(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
680     struct sockopt_data *sd)
681 {
682 
683 	/* TODO: implement states listing for old ipfw(8) binaries  */
684 	return (EOPNOTSUPP);
685 }
686 
687 /*
688  * Lists nat64lsn states.
689  * Data layout (v1)(current):
690  * Request: [ ipfw_obj_header ipfw_obj_data [ uint64_t ]]
691  * Reply: [ ipfw_obj_header ipfw_obj_data [
692  *		ipfw_nat64lsn_stg_v1 ipfw_nat64lsn_state_v1 x N] ]
693  *
694  * Returns 0 on success
695  */
696 static int
697 nat64lsn_states_v1(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
698     struct sockopt_data *sd)
699 {
700 	ipfw_obj_header *oh;
701 	ipfw_obj_data *od;
702 	ipfw_nat64lsn_stg_v1 *stg;
703 	struct nat64lsn_cfg *cfg;
704 	struct nat64lsn_pg *pg;
705 	union nat64lsn_pgidx idx;
706 	size_t sz;
707 	uint32_t count, total;
708 	int ret;
709 
710 	sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_data) +
711 	    sizeof(uint64_t);
712 	/* Check minimum header size */
713 	if (sd->valsize < sz)
714 		return (EINVAL);
715 
716 	oh = (ipfw_obj_header *)sd->kbuf;
717 	od = (ipfw_obj_data *)(oh + 1);
718 	if (od->head.type != IPFW_TLV_OBJDATA ||
719 	    od->head.length != sz - sizeof(ipfw_obj_header))
720 		return (EINVAL);
721 
722 	idx.index = *(uint64_t *)(od + 1);
723 	if (idx.index != 0 && idx.proto != IPPROTO_ICMP &&
724 	    idx.proto != IPPROTO_TCP && idx.proto != IPPROTO_UDP)
725 		return (EINVAL);
726 	if (idx.index == LAST_IDX)
727 		return (EINVAL);
728 
729 	IPFW_UH_RLOCK(ch);
730 	cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
731 	if (cfg == NULL) {
732 		IPFW_UH_RUNLOCK(ch);
733 		return (ENOENT);
734 	}
735 	if (idx.index == 0) {	/* Fill in starting point */
736 		idx.addr = cfg->prefix4;
737 		idx.proto = IPPROTO_ICMP;
738 		idx.port = NAT64_MIN_PORT;
739 	}
740 	if (idx.addr < cfg->prefix4 || idx.addr > cfg->pmask4 ||
741 	    idx.port < NAT64_MIN_PORT) {
742 		IPFW_UH_RUNLOCK(ch);
743 		return (EINVAL);
744 	}
745 	sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_data) +
746 	    sizeof(ipfw_nat64lsn_stg_v1);
747 	if (sd->valsize < sz) {
748 		IPFW_UH_RUNLOCK(ch);
749 		return (ENOMEM);
750 	}
751 	oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd, sz);
752 	od = (ipfw_obj_data *)(oh + 1);
753 	od->head.type = IPFW_TLV_OBJDATA;
754 	od->head.length = sz - sizeof(ipfw_obj_header);
755 	stg = (ipfw_nat64lsn_stg_v1 *)(od + 1);
756 	stg->count = total = 0;
757 	stg->next.index = idx.index;
758 	/*
759 	 * Acquire CALLOUT_LOCK to avoid races with expiration code.
760 	 * Thus states, hosts and PGs will not expire while we hold it.
761 	 */
762 	CALLOUT_LOCK(cfg);
763 	ret = 0;
764 	do {
765 		pg = nat64lsn_get_pg_byidx(cfg, &idx);
766 		if (pg != NULL) {
767 			count = 0;
768 			ret = nat64lsn_export_states_v1(cfg, &idx, pg,
769 			    sd, &count);
770 			if (ret != 0)
771 				break;
772 			if (count > 0) {
773 				stg->count += count;
774 				total += count;
775 				/* Update total size of reply */
776 				od->head.length +=
777 				    count * sizeof(ipfw_nat64lsn_state_v1);
778 				sz += count * sizeof(ipfw_nat64lsn_state_v1);
779 			}
780 			stg->alias4.s_addr = htonl(idx.addr);
781 		}
782 		/* Determine new index */
783 		switch (nat64lsn_next_pgidx(cfg, pg, &idx)) {
784 		case -1:
785 			ret = ENOENT; /* End of search */
786 			break;
787 		case 1: /*
788 			 * Next alias address, new group may be needed.
789 			 * If states count is zero, use this group.
790 			 */
791 			if (stg->count == 0)
792 				continue;
793 			/* Otherwise try to create new group */
794 			sz += sizeof(ipfw_nat64lsn_stg_v1);
795 			if (sd->valsize < sz) {
796 				ret = ENOMEM;
797 				break;
798 			}
799 			/* Save next index in current group */
800 			stg->next.index = idx.index;
801 			stg = (ipfw_nat64lsn_stg_v1 *)ipfw_get_sopt_space(sd,
802 			    sizeof(ipfw_nat64lsn_stg_v1));
803 			od->head.length += sizeof(ipfw_nat64lsn_stg_v1);
804 			stg->count = 0;
805 			break;
806 		}
807 		stg->next.index = idx.index;
808 	} while (ret == 0);
809 	CALLOUT_UNLOCK(cfg);
810 	IPFW_UH_RUNLOCK(ch);
811 	return ((total > 0 || idx.index == LAST_IDX) ? 0: ret);
812 }
813 
814 static struct ipfw_sopt_handler	scodes[] = {
815 	{ IP_FW_NAT64LSN_CREATE, 0,	HDIR_BOTH,	nat64lsn_create },
816 	{ IP_FW_NAT64LSN_DESTROY,0,	HDIR_SET,	nat64lsn_destroy },
817 	{ IP_FW_NAT64LSN_CONFIG, 0,	HDIR_BOTH,	nat64lsn_config },
818 	{ IP_FW_NAT64LSN_LIST,	 0,	HDIR_GET,	nat64lsn_list },
819 	{ IP_FW_NAT64LSN_STATS,	 0,	HDIR_GET,	nat64lsn_stats },
820 	{ IP_FW_NAT64LSN_RESET_STATS,0,	HDIR_SET,	nat64lsn_reset_stats },
821 	{ IP_FW_NAT64LSN_LIST_STATES,0,	HDIR_GET,	nat64lsn_states_v0 },
822 	{ IP_FW_NAT64LSN_LIST_STATES,1,	HDIR_GET,	nat64lsn_states_v1 },
823 };
824 
825 static int
826 nat64lsn_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
827 {
828 	ipfw_insn *icmd;
829 
830 	icmd = cmd - 1;
831 	if (icmd->opcode != O_EXTERNAL_ACTION ||
832 	    icmd->arg1 != V_nat64lsn_eid)
833 		return (1);
834 
835 	*puidx = cmd->arg1;
836 	*ptype = 0;
837 	return (0);
838 }
839 
840 static void
841 nat64lsn_update_arg1(ipfw_insn *cmd, uint16_t idx)
842 {
843 
844 	cmd->arg1 = idx;
845 }
846 
847 static int
848 nat64lsn_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
849     struct named_object **pno)
850 {
851 	int err;
852 
853 	err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti,
854 	    IPFW_TLV_NAT64LSN_NAME, pno);
855 	return (err);
856 }
857 
858 static struct named_object *
859 nat64lsn_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
860 {
861 	struct namedobj_instance *ni;
862 	struct named_object *no;
863 
864 	IPFW_UH_WLOCK_ASSERT(ch);
865 	ni = CHAIN_TO_SRV(ch);
866 	no = ipfw_objhash_lookup_kidx(ni, idx);
867 	KASSERT(no != NULL, ("NAT64LSN with index %d not found", idx));
868 
869 	return (no);
870 }
871 
872 static int
873 nat64lsn_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
874     enum ipfw_sets_cmd cmd)
875 {
876 
877 	return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64LSN_NAME,
878 	    set, new_set, cmd));
879 }
880 
881 static struct opcode_obj_rewrite opcodes[] = {
882 	{
883 		.opcode = O_EXTERNAL_INSTANCE,
884 		.etlv = IPFW_TLV_EACTION /* just show it isn't table */,
885 		.classifier = nat64lsn_classify,
886 		.update = nat64lsn_update_arg1,
887 		.find_byname = nat64lsn_findbyname,
888 		.find_bykidx = nat64lsn_findbykidx,
889 		.manage_sets = nat64lsn_manage_sets,
890 	},
891 };
892 
893 static int
894 destroy_config_cb(struct namedobj_instance *ni, struct named_object *no,
895     void *arg)
896 {
897 	struct nat64lsn_cfg *cfg;
898 	struct ip_fw_chain *ch;
899 
900 	ch = (struct ip_fw_chain *)arg;
901 	cfg = (struct nat64lsn_cfg *)SRV_OBJECT(ch, no->kidx);
902 	SRV_OBJECT(ch, no->kidx) = NULL;
903 	nat64lsn_detach_config(ch, cfg);
904 	nat64lsn_destroy_instance(cfg);
905 	return (0);
906 }
907 
908 int
909 nat64lsn_init(struct ip_fw_chain *ch, int first)
910 {
911 
912 	if (first != 0)
913 		nat64lsn_init_internal();
914 	V_nat64lsn_eid = ipfw_add_eaction(ch, ipfw_nat64lsn, "nat64lsn");
915 	if (V_nat64lsn_eid == 0)
916 		return (ENXIO);
917 	IPFW_ADD_SOPT_HANDLER(first, scodes);
918 	IPFW_ADD_OBJ_REWRITER(first, opcodes);
919 	return (0);
920 }
921 
922 void
923 nat64lsn_uninit(struct ip_fw_chain *ch, int last)
924 {
925 
926 	IPFW_DEL_OBJ_REWRITER(last, opcodes);
927 	IPFW_DEL_SOPT_HANDLER(last, scodes);
928 	ipfw_del_eaction(ch, V_nat64lsn_eid);
929 	/*
930 	 * Since we already have deregistered external action,
931 	 * our named objects become unaccessible via rules, because
932 	 * all rules were truncated by ipfw_del_eaction().
933 	 * So, we can unlink and destroy our named objects without holding
934 	 * IPFW_WLOCK().
935 	 */
936 	IPFW_UH_WLOCK(ch);
937 	ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch,
938 	    IPFW_TLV_NAT64LSN_NAME);
939 	V_nat64lsn_eid = 0;
940 	IPFW_UH_WUNLOCK(ch);
941 	if (last != 0)
942 		nat64lsn_uninit_internal();
943 }
944