xref: /freebsd/sys/netpfil/ipfw/nat64/nat64lsn_control.c (revision f0cfa1b168014f56c02b83e5f28412cc5f78d117)
1 /*-
2  * Copyright (c) 2015 Yandex LLC
3  * Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org>
4  * Copyright (c) 2016 Andrey V. Elsukov <ae@FreeBSD.org>
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __FBSDID("$FreeBSD$");
31 
32 #include <sys/param.h>
33 #include <sys/systm.h>
34 #include <sys/counter.h>
35 #include <sys/errno.h>
36 #include <sys/kernel.h>
37 #include <sys/lock.h>
38 #include <sys/malloc.h>
39 #include <sys/mbuf.h>
40 #include <sys/module.h>
41 #include <sys/rmlock.h>
42 #include <sys/rwlock.h>
43 #include <sys/socket.h>
44 #include <sys/sockopt.h>
45 #include <sys/queue.h>
46 
47 #include <net/if.h>
48 #include <net/pfil.h>
49 
50 #include <netinet/in.h>
51 #include <netinet/ip.h>
52 #include <netinet/ip_var.h>
53 #include <netinet/ip_fw.h>
54 
55 #include <netpfil/ipfw/ip_fw_private.h>
56 #include <netpfil/ipfw/nat64/ip_fw_nat64.h>
57 #include <netpfil/ipfw/nat64/nat64lsn.h>
58 #include <netinet6/ip_fw_nat64.h>
59 
60 VNET_DEFINE(uint16_t, nat64lsn_eid) = 0;
61 
62 static struct nat64lsn_cfg *
63 nat64lsn_find(struct namedobj_instance *ni, const char *name, uint8_t set)
64 {
65 	struct nat64lsn_cfg *cfg;
66 
67 	cfg = (struct nat64lsn_cfg *)ipfw_objhash_lookup_name_type(ni, set,
68 	    IPFW_TLV_NAT64LSN_NAME, name);
69 
70 	return (cfg);
71 }
72 
73 static void
74 nat64lsn_default_config(ipfw_nat64lsn_cfg *uc)
75 {
76 
77 	if (uc->max_ports == 0)
78 		uc->max_ports = NAT64LSN_MAX_PORTS;
79 	else
80 		uc->max_ports = roundup(uc->max_ports, NAT64_CHUNK_SIZE);
81 	if (uc->max_ports > NAT64_CHUNK_SIZE * NAT64LSN_MAXPGPTR)
82 		uc->max_ports = NAT64_CHUNK_SIZE * NAT64LSN_MAXPGPTR;
83 	if (uc->jmaxlen == 0)
84 		uc->jmaxlen = NAT64LSN_JMAXLEN;
85 	if (uc->jmaxlen > 65536)
86 		uc->jmaxlen = 65536;
87 	if (uc->nh_delete_delay == 0)
88 		uc->nh_delete_delay = NAT64LSN_HOST_AGE;
89 	if (uc->pg_delete_delay == 0)
90 		uc->pg_delete_delay = NAT64LSN_PG_AGE;
91 	if (uc->st_syn_ttl == 0)
92 		uc->st_syn_ttl = NAT64LSN_TCP_SYN_AGE;
93 	if (uc->st_close_ttl == 0)
94 		uc->st_close_ttl = NAT64LSN_TCP_FIN_AGE;
95 	if (uc->st_estab_ttl == 0)
96 		uc->st_estab_ttl = NAT64LSN_TCP_EST_AGE;
97 	if (uc->st_udp_ttl == 0)
98 		uc->st_udp_ttl = NAT64LSN_UDP_AGE;
99 	if (uc->st_icmp_ttl == 0)
100 		uc->st_icmp_ttl = NAT64LSN_ICMP_AGE;
101 }
102 
103 /*
104  * Creates new nat64lsn instance.
105  * Data layout (v0)(current):
106  * Request: [ ipfw_obj_lheader ipfw_nat64lsn_cfg ]
107  *
108  * Returns 0 on success
109  */
110 static int
111 nat64lsn_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
112     struct sockopt_data *sd)
113 {
114 	ipfw_obj_lheader *olh;
115 	ipfw_nat64lsn_cfg *uc;
116 	struct nat64lsn_cfg *cfg;
117 	struct namedobj_instance *ni;
118 	uint32_t addr4, mask4;
119 
120 	if (sd->valsize != sizeof(*olh) + sizeof(*uc))
121 		return (EINVAL);
122 
123 	olh = (ipfw_obj_lheader *)sd->kbuf;
124 	uc = (ipfw_nat64lsn_cfg *)(olh + 1);
125 
126 	if (ipfw_check_object_name_generic(uc->name) != 0)
127 		return (EINVAL);
128 
129 	if (uc->agg_prefix_len > 127 || uc->set >= IPFW_MAX_SETS)
130 		return (EINVAL);
131 
132 	if (uc->plen4 > 32)
133 		return (EINVAL);
134 	if (uc->plen6 > 128 || ((uc->plen6 % 8) != 0))
135 		return (EINVAL);
136 
137 	/* XXX: Check prefix4 to be global */
138 	addr4 = ntohl(uc->prefix4.s_addr);
139 	mask4 = ~((1 << (32 - uc->plen4)) - 1);
140 	if ((addr4 & mask4) != addr4)
141 		return (EINVAL);
142 
143 	/* XXX: Check prefix6 */
144 	if (uc->min_port == 0)
145 		uc->min_port = NAT64_MIN_PORT;
146 	if (uc->max_port == 0)
147 		uc->max_port = 65535;
148 	if (uc->min_port > uc->max_port)
149 		return (EINVAL);
150 	uc->min_port = roundup(uc->min_port, NAT64_CHUNK_SIZE);
151 	uc->max_port = roundup(uc->max_port, NAT64_CHUNK_SIZE);
152 
153 	nat64lsn_default_config(uc);
154 
155 	ni = CHAIN_TO_SRV(ch);
156 	IPFW_UH_RLOCK(ch);
157 	if (nat64lsn_find(ni, uc->name, uc->set) != NULL) {
158 		IPFW_UH_RUNLOCK(ch);
159 		return (EEXIST);
160 	}
161 	IPFW_UH_RUNLOCK(ch);
162 
163 	cfg = nat64lsn_init_instance(ch, 1 << (32 - uc->plen4));
164 	strlcpy(cfg->name, uc->name, sizeof(cfg->name));
165 	cfg->no.name = cfg->name;
166 	cfg->no.etlv = IPFW_TLV_NAT64LSN_NAME;
167 	cfg->no.set = uc->set;
168 
169 	cfg->prefix4 = addr4;
170 	cfg->pmask4 = addr4 | ~mask4;
171 	/* XXX: Copy 96 bits */
172 	cfg->plen6 = 96;
173 	memcpy(&cfg->prefix6, &uc->prefix6, cfg->plen6 / 8);
174 	cfg->plen4 = uc->plen4;
175 	cfg->flags = uc->flags & NAT64LSN_FLAGSMASK;
176 	cfg->max_chunks = uc->max_ports / NAT64_CHUNK_SIZE;
177 	cfg->agg_prefix_len = uc->agg_prefix_len;
178 	cfg->agg_prefix_max = uc->agg_prefix_max;
179 
180 	cfg->min_chunk = uc->min_port / NAT64_CHUNK_SIZE;
181 	cfg->max_chunk = uc->max_port / NAT64_CHUNK_SIZE;
182 
183 	cfg->jmaxlen = uc->jmaxlen;
184 	cfg->nh_delete_delay = uc->nh_delete_delay;
185 	cfg->pg_delete_delay = uc->pg_delete_delay;
186 	cfg->st_syn_ttl = uc->st_syn_ttl;
187 	cfg->st_close_ttl = uc->st_close_ttl;
188 	cfg->st_estab_ttl = uc->st_estab_ttl;
189 	cfg->st_udp_ttl = uc->st_udp_ttl;
190 	cfg->st_icmp_ttl = uc->st_icmp_ttl;
191 
192 	cfg->nomatch_verdict = IP_FW_DENY;
193 	cfg->nomatch_final = 1;	/* Exit outer loop by default */
194 
195 	IPFW_UH_WLOCK(ch);
196 
197 	if (nat64lsn_find(ni, uc->name, uc->set) != NULL) {
198 		IPFW_UH_WUNLOCK(ch);
199 		nat64lsn_destroy_instance(cfg);
200 		return (EEXIST);
201 	}
202 
203 	if (ipfw_objhash_alloc_idx(CHAIN_TO_SRV(ch), &cfg->no.kidx) != 0) {
204 		IPFW_UH_WUNLOCK(ch);
205 		nat64lsn_destroy_instance(cfg);
206 		return (ENOSPC);
207 	}
208 	ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no);
209 
210 	/* Okay, let's link data */
211 	SRV_OBJECT(ch, cfg->no.kidx) = cfg;
212 	nat64lsn_start_instance(cfg);
213 
214 	IPFW_UH_WUNLOCK(ch);
215 	return (0);
216 }
217 
218 static void
219 nat64lsn_detach_config(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg)
220 {
221 
222 	IPFW_UH_WLOCK_ASSERT(ch);
223 
224 	ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no);
225 	ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx);
226 }
227 
228 /*
229  * Destroys nat64 instance.
230  * Data layout (v0)(current):
231  * Request: [ ipfw_obj_header ]
232  *
233  * Returns 0 on success
234  */
235 static int
236 nat64lsn_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
237     struct sockopt_data *sd)
238 {
239 	struct nat64lsn_cfg *cfg;
240 	ipfw_obj_header *oh;
241 
242 	if (sd->valsize != sizeof(*oh))
243 		return (EINVAL);
244 
245 	oh = (ipfw_obj_header *)op3;
246 
247 	IPFW_UH_WLOCK(ch);
248 	cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
249 	if (cfg == NULL) {
250 		IPFW_UH_WUNLOCK(ch);
251 		return (ESRCH);
252 	}
253 
254 	if (cfg->no.refcnt > 0) {
255 		IPFW_UH_WUNLOCK(ch);
256 		return (EBUSY);
257 	}
258 
259 	SRV_OBJECT(ch, cfg->no.kidx) = NULL;
260 	nat64lsn_detach_config(ch, cfg);
261 	IPFW_UH_WUNLOCK(ch);
262 
263 	nat64lsn_destroy_instance(cfg);
264 	return (0);
265 }
266 
267 #define	__COPY_STAT_FIELD(_cfg, _stats, _field)	\
268 	(_stats)->_field = NAT64STAT_FETCH(&(_cfg)->stats, _field)
269 static void
270 export_stats(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg,
271     struct ipfw_nat64lsn_stats *stats)
272 {
273 
274 	__COPY_STAT_FIELD(cfg, stats, opcnt64);
275 	__COPY_STAT_FIELD(cfg, stats, opcnt46);
276 	__COPY_STAT_FIELD(cfg, stats, ofrags);
277 	__COPY_STAT_FIELD(cfg, stats, ifrags);
278 	__COPY_STAT_FIELD(cfg, stats, oerrors);
279 	__COPY_STAT_FIELD(cfg, stats, noroute4);
280 	__COPY_STAT_FIELD(cfg, stats, noroute6);
281 	__COPY_STAT_FIELD(cfg, stats, nomatch4);
282 	__COPY_STAT_FIELD(cfg, stats, noproto);
283 	__COPY_STAT_FIELD(cfg, stats, nomem);
284 	__COPY_STAT_FIELD(cfg, stats, dropped);
285 
286 	__COPY_STAT_FIELD(cfg, stats, jcalls);
287 	__COPY_STAT_FIELD(cfg, stats, jrequests);
288 	__COPY_STAT_FIELD(cfg, stats, jhostsreq);
289 	__COPY_STAT_FIELD(cfg, stats, jportreq);
290 	__COPY_STAT_FIELD(cfg, stats, jhostfails);
291 	__COPY_STAT_FIELD(cfg, stats, jportfails);
292 	__COPY_STAT_FIELD(cfg, stats, jmaxlen);
293 	__COPY_STAT_FIELD(cfg, stats, jnomem);
294 	__COPY_STAT_FIELD(cfg, stats, jreinjected);
295 	__COPY_STAT_FIELD(cfg, stats, screated);
296 	__COPY_STAT_FIELD(cfg, stats, sdeleted);
297 	__COPY_STAT_FIELD(cfg, stats, spgcreated);
298 	__COPY_STAT_FIELD(cfg, stats, spgdeleted);
299 
300 	stats->hostcount = cfg->ihcount;
301 	stats->tcpchunks = cfg->protochunks[NAT_PROTO_TCP];
302 	stats->udpchunks = cfg->protochunks[NAT_PROTO_UDP];
303 	stats->icmpchunks = cfg->protochunks[NAT_PROTO_ICMP];
304 }
305 #undef	__COPY_STAT_FIELD
306 
307 static void
308 nat64lsn_export_config(struct ip_fw_chain *ch, struct nat64lsn_cfg *cfg,
309     ipfw_nat64lsn_cfg *uc)
310 {
311 
312 	uc->flags = cfg->flags & NAT64LSN_FLAGSMASK;
313 	uc->max_ports = cfg->max_chunks * NAT64_CHUNK_SIZE;
314 	uc->agg_prefix_len = cfg->agg_prefix_len;
315 	uc->agg_prefix_max = cfg->agg_prefix_max;
316 
317 	uc->jmaxlen = cfg->jmaxlen;
318 	uc->nh_delete_delay = cfg->nh_delete_delay;
319 	uc->pg_delete_delay = cfg->pg_delete_delay;
320 	uc->st_syn_ttl = cfg->st_syn_ttl;
321 	uc->st_close_ttl = cfg->st_close_ttl;
322 	uc->st_estab_ttl = cfg->st_estab_ttl;
323 	uc->st_udp_ttl = cfg->st_udp_ttl;
324 	uc->st_icmp_ttl = cfg->st_icmp_ttl;
325 	uc->prefix4.s_addr = htonl(cfg->prefix4);
326 	uc->prefix6 = cfg->prefix6;
327 	uc->plen4 = cfg->plen4;
328 	uc->plen6 = cfg->plen6;
329 	uc->set = cfg->no.set;
330 	strlcpy(uc->name, cfg->no.name, sizeof(uc->name));
331 }
332 
333 struct nat64_dump_arg {
334 	struct ip_fw_chain *ch;
335 	struct sockopt_data *sd;
336 };
337 
338 static int
339 export_config_cb(struct namedobj_instance *ni, struct named_object *no,
340     void *arg)
341 {
342 	struct nat64_dump_arg *da = (struct nat64_dump_arg *)arg;
343 	ipfw_nat64lsn_cfg *uc;
344 
345 	uc = (struct _ipfw_nat64lsn_cfg *)ipfw_get_sopt_space(da->sd,
346 	    sizeof(*uc));
347 	nat64lsn_export_config(da->ch, (struct nat64lsn_cfg *)no, uc);
348 	return (0);
349 }
350 
351 /*
352  * Lists all nat64 lsn instances currently available in kernel.
353  * Data layout (v0)(current):
354  * Request: [ ipfw_obj_lheader ]
355  * Reply: [ ipfw_obj_lheader ipfw_nat64lsn_cfg x N ]
356  *
357  * Returns 0 on success
358  */
359 static int
360 nat64lsn_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
361     struct sockopt_data *sd)
362 {
363 	ipfw_obj_lheader *olh;
364 	struct nat64_dump_arg da;
365 
366 	/* Check minimum header size */
367 	if (sd->valsize < sizeof(ipfw_obj_lheader))
368 		return (EINVAL);
369 
370 	olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh));
371 
372 	IPFW_UH_RLOCK(ch);
373 	olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch),
374 	    IPFW_TLV_NAT64LSN_NAME);
375 	olh->objsize = sizeof(ipfw_nat64lsn_cfg);
376 	olh->size = sizeof(*olh) + olh->count * olh->objsize;
377 
378 	if (sd->valsize < olh->size) {
379 		IPFW_UH_RUNLOCK(ch);
380 		return (ENOMEM);
381 	}
382 	memset(&da, 0, sizeof(da));
383 	da.ch = ch;
384 	da.sd = sd;
385 	ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb, &da,
386 	    IPFW_TLV_NAT64LSN_NAME);
387 	IPFW_UH_RUNLOCK(ch);
388 
389 	return (0);
390 }
391 
392 /*
393  * Change existing nat64lsn instance configuration.
394  * Data layout (v0)(current):
395  * Request: [ ipfw_obj_header ipfw_nat64lsn_cfg ]
396  * Reply: [ ipfw_obj_header ipfw_nat64lsn_cfg ]
397  *
398  * Returns 0 on success
399  */
400 static int
401 nat64lsn_config(struct ip_fw_chain *ch, ip_fw3_opheader *op,
402     struct sockopt_data *sd)
403 {
404 	ipfw_obj_header *oh;
405 	ipfw_nat64lsn_cfg *uc;
406 	struct nat64lsn_cfg *cfg;
407 	struct namedobj_instance *ni;
408 
409 	if (sd->valsize != sizeof(*oh) + sizeof(*uc))
410 		return (EINVAL);
411 
412 	oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd,
413 	    sizeof(*oh) + sizeof(*uc));
414 	uc = (ipfw_nat64lsn_cfg *)(oh + 1);
415 
416 	if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
417 	    oh->ntlv.set >= IPFW_MAX_SETS)
418 		return (EINVAL);
419 
420 	ni = CHAIN_TO_SRV(ch);
421 	if (sd->sopt->sopt_dir == SOPT_GET) {
422 		IPFW_UH_RLOCK(ch);
423 		cfg = nat64lsn_find(ni, oh->ntlv.name, oh->ntlv.set);
424 		if (cfg == NULL) {
425 			IPFW_UH_RUNLOCK(ch);
426 			return (EEXIST);
427 		}
428 		nat64lsn_export_config(ch, cfg, uc);
429 		IPFW_UH_RUNLOCK(ch);
430 		return (0);
431 	}
432 
433 	nat64lsn_default_config(uc);
434 
435 	IPFW_UH_WLOCK(ch);
436 	cfg = nat64lsn_find(ni, oh->ntlv.name, oh->ntlv.set);
437 	if (cfg == NULL) {
438 		IPFW_UH_WUNLOCK(ch);
439 		return (EEXIST);
440 	}
441 
442 	/*
443 	 * For now allow to change only following values:
444 	 *  jmaxlen, nh_del_age, pg_del_age, tcp_syn_age, tcp_close_age,
445 	 *  tcp_est_age, udp_age, icmp_age, flags, max_ports.
446 	 */
447 
448 	cfg->max_chunks = uc->max_ports / NAT64_CHUNK_SIZE;
449 	cfg->jmaxlen = uc->jmaxlen;
450 	cfg->nh_delete_delay = uc->nh_delete_delay;
451 	cfg->pg_delete_delay = uc->pg_delete_delay;
452 	cfg->st_syn_ttl = uc->st_syn_ttl;
453 	cfg->st_close_ttl = uc->st_close_ttl;
454 	cfg->st_estab_ttl = uc->st_estab_ttl;
455 	cfg->st_udp_ttl = uc->st_udp_ttl;
456 	cfg->st_icmp_ttl = uc->st_icmp_ttl;
457 	cfg->flags = uc->flags & NAT64LSN_FLAGSMASK;
458 
459 	IPFW_UH_WUNLOCK(ch);
460 
461 	return (0);
462 }
463 
464 /*
465  * Get nat64lsn statistics.
466  * Data layout (v0)(current):
467  * Request: [ ipfw_obj_header ]
468  * Reply: [ ipfw_obj_header ipfw_counter_tlv ]
469  *
470  * Returns 0 on success
471  */
472 static int
473 nat64lsn_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
474     struct sockopt_data *sd)
475 {
476 	struct ipfw_nat64lsn_stats stats;
477 	struct nat64lsn_cfg *cfg;
478 	ipfw_obj_header *oh;
479 	ipfw_obj_ctlv *ctlv;
480 	size_t sz;
481 
482 	sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats);
483 	if (sd->valsize % sizeof(uint64_t))
484 		return (EINVAL);
485 	if (sd->valsize < sz)
486 		return (ENOMEM);
487 	oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
488 	if (oh == NULL)
489 		return (EINVAL);
490 	memset(&stats, 0, sizeof(stats));
491 
492 	IPFW_UH_RLOCK(ch);
493 	cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
494 	if (cfg == NULL) {
495 		IPFW_UH_RUNLOCK(ch);
496 		return (ESRCH);
497 	}
498 
499 	export_stats(ch, cfg, &stats);
500 	IPFW_UH_RUNLOCK(ch);
501 
502 	ctlv = (ipfw_obj_ctlv *)(oh + 1);
503 	memset(ctlv, 0, sizeof(*ctlv));
504 	ctlv->head.type = IPFW_TLV_COUNTERS;
505 	ctlv->head.length = sz - sizeof(ipfw_obj_header);
506 	ctlv->count = sizeof(stats) / sizeof(uint64_t);
507 	ctlv->objsize = sizeof(uint64_t);
508 	ctlv->version = IPFW_NAT64_VERSION;
509 	memcpy(ctlv + 1, &stats, sizeof(stats));
510 	return (0);
511 }
512 
513 /*
514  * Reset nat64lsn statistics.
515  * Data layout (v0)(current):
516  * Request: [ ipfw_obj_header ]
517  *
518  * Returns 0 on success
519  */
520 static int
521 nat64lsn_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
522     struct sockopt_data *sd)
523 {
524 	struct nat64lsn_cfg *cfg;
525 	ipfw_obj_header *oh;
526 
527 	if (sd->valsize != sizeof(*oh))
528 		return (EINVAL);
529 	oh = (ipfw_obj_header *)sd->kbuf;
530 	if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
531 	    oh->ntlv.set >= IPFW_MAX_SETS)
532 		return (EINVAL);
533 
534 	IPFW_UH_WLOCK(ch);
535 	cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
536 	if (cfg == NULL) {
537 		IPFW_UH_WUNLOCK(ch);
538 		return (ESRCH);
539 	}
540 	COUNTER_ARRAY_ZERO(cfg->stats.stats, NAT64STATS);
541 	IPFW_UH_WUNLOCK(ch);
542 	return (0);
543 }
544 
545 /*
546  * Reply: [ ipfw_obj_header ipfw_obj_data [ ipfw_nat64lsn_stg
547  *	ipfw_nat64lsn_state x count, ... ] ]
548  */
549 static int
550 export_pg_states(struct nat64lsn_cfg *cfg, struct nat64lsn_portgroup *pg,
551     ipfw_nat64lsn_stg *stg, struct sockopt_data *sd)
552 {
553 	ipfw_nat64lsn_state *ste;
554 	struct nat64lsn_state *st;
555 	int i, count;
556 
557 	NAT64_LOCK(pg->host);
558 	count = 0;
559 	for (i = 0; i < 64; i++) {
560 		if (PG_IS_BUSY_IDX(pg, i))
561 			count++;
562 	}
563 	DPRINTF(DP_STATE, "EXPORT PG %d, count %d", pg->idx, count);
564 
565 	if (count == 0) {
566 		stg->count = 0;
567 		NAT64_UNLOCK(pg->host);
568 		return (0);
569 	}
570 	ste = (ipfw_nat64lsn_state *)ipfw_get_sopt_space(sd,
571 	    count * sizeof(ipfw_nat64lsn_state));
572 	if (ste == NULL) {
573 		NAT64_UNLOCK(pg->host);
574 		return (1);
575 	}
576 
577 	stg->alias4.s_addr = pg->aaddr;
578 	stg->proto = nat64lsn_rproto_map[pg->nat_proto];
579 	stg->flags = 0;
580 	stg->host6 = pg->host->addr;
581 	stg->count = count;
582 	for (i = 0; i < 64; i++) {
583 		if (PG_IS_FREE_IDX(pg, i))
584 			continue;
585 		st = &pg->states[i];
586 		ste->daddr.s_addr = st->u.s.faddr;
587 		ste->dport = st->u.s.fport;
588 		ste->aport = pg->aport + i;
589 		ste->sport = st->u.s.lport;
590 		ste->flags = st->flags; /* XXX filter flags */
591 		ste->idle = GET_AGE(st->timestamp);
592 		ste++;
593 	}
594 	NAT64_UNLOCK(pg->host);
595 
596 	return (0);
597 }
598 
599 static int
600 get_next_idx(struct nat64lsn_cfg *cfg, uint32_t *addr, uint8_t *nat_proto,
601     uint16_t *port)
602 {
603 
604 	if (*port < 65536 - NAT64_CHUNK_SIZE) {
605 		*port += NAT64_CHUNK_SIZE;
606 		return (0);
607 	}
608 	*port = 0;
609 
610 	if (*nat_proto < NAT_MAX_PROTO - 1) {
611 		*nat_proto += 1;
612 		return (0);
613 	}
614 	*nat_proto = 1;
615 
616 	if (*addr < cfg->pmask4) {
617 		*addr += 1;
618 		return (0);
619 	}
620 
621 	/* End of space. */
622 	return (1);
623 }
624 
625 #define	PACK_IDX(addr, proto, port)	\
626 	((uint64_t)addr << 32) | ((uint32_t)port << 16) | (proto << 8)
627 #define	UNPACK_IDX(idx, addr, proto, port)		\
628 	(addr) = (uint32_t)((idx) >> 32);		\
629 	(port) = (uint16_t)(((idx) >> 16) & 0xFFFF);	\
630 	(proto) = (uint8_t)(((idx) >> 8) & 0xFF)
631 
632 static struct nat64lsn_portgroup *
633 get_next_pg(struct nat64lsn_cfg *cfg, uint32_t *addr, uint8_t *nat_proto,
634   uint16_t *port)
635 {
636 	struct nat64lsn_portgroup *pg;
637 	uint64_t pre_pack, post_pack;
638 
639 	pg = NULL;
640 	pre_pack = PACK_IDX(*addr, *nat_proto, *port);
641 	for (;;) {
642 		if (get_next_idx(cfg, addr, nat_proto, port) != 0) {
643 			/* End of states */
644 			return (pg);
645 		}
646 
647 		pg = GET_PORTGROUP(cfg, *addr, *nat_proto, *port);
648 		if (pg != NULL)
649 			break;
650 	}
651 
652 	post_pack = PACK_IDX(*addr, *nat_proto, *port);
653 	if (pre_pack == post_pack)
654 		DPRINTF(DP_STATE, "XXX: PACK_IDX %u %d %d",
655 		    *addr, *nat_proto, *port);
656 	return (pg);
657 }
658 
659 static NAT64NOINLINE struct nat64lsn_portgroup *
660 get_first_pg(struct nat64lsn_cfg *cfg, uint32_t *addr, uint8_t *nat_proto,
661   uint16_t *port)
662 {
663 	struct nat64lsn_portgroup *pg;
664 
665 	pg = GET_PORTGROUP(cfg, *addr, *nat_proto, *port);
666 	if (pg == NULL)
667 		pg = get_next_pg(cfg, addr, nat_proto, port);
668 
669 	return (pg);
670 }
671 
672 /*
673  * Lists nat64lsn states.
674  * Data layout (v0)(current):
675  * Request: [ ipfw_obj_header ipfw_obj_data [ uint64_t ]]
676  * Reply: [ ipfw_obj_header ipfw_obj_data [
677  *		ipfw_nat64lsn_stg ipfw_nat64lsn_state x N] ]
678  *
679  * Returns 0 on success
680  */
681 static int
682 nat64lsn_states(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
683     struct sockopt_data *sd)
684 {
685 	ipfw_obj_header *oh;
686 	ipfw_obj_data *od;
687 	ipfw_nat64lsn_stg *stg;
688 	struct nat64lsn_cfg *cfg;
689 	struct nat64lsn_portgroup *pg, *pg_next;
690 	uint64_t next_idx;
691 	size_t sz;
692 	uint32_t addr, states;
693 	uint16_t port;
694 	uint8_t nat_proto;
695 
696 	sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_data) +
697 	    sizeof(uint64_t);
698 	/* Check minimum header size */
699 	if (sd->valsize < sz)
700 		return (EINVAL);
701 
702 	oh = (ipfw_obj_header *)sd->kbuf;
703 	od = (ipfw_obj_data *)(oh + 1);
704 	if (od->head.type != IPFW_TLV_OBJDATA ||
705 	    od->head.length != sz - sizeof(ipfw_obj_header))
706 		return (EINVAL);
707 
708 	next_idx = *(uint64_t *)(od + 1);
709 	/* Translate index to the request position to start from */
710 	UNPACK_IDX(next_idx, addr, nat_proto, port);
711 	if (nat_proto >= NAT_MAX_PROTO)
712 		return (EINVAL);
713 	if (nat_proto == 0 && addr != 0)
714 		return (EINVAL);
715 
716 	IPFW_UH_RLOCK(ch);
717 	cfg = nat64lsn_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
718 	if (cfg == NULL) {
719 		IPFW_UH_RUNLOCK(ch);
720 		return (ESRCH);
721 	}
722 	/* Fill in starting point */
723 	if (addr == 0) {
724 		addr = cfg->prefix4;
725 		nat_proto = 1;
726 		port = 0;
727 	}
728 	if (addr < cfg->prefix4 || addr > cfg->pmask4) {
729 		IPFW_UH_RUNLOCK(ch);
730 		DPRINTF(DP_GENERIC | DP_STATE, "XXX: %ju %u %u",
731 		    (uintmax_t)next_idx, addr, cfg->pmask4);
732 		return (EINVAL);
733 	}
734 
735 	sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_data) +
736 	    sizeof(ipfw_nat64lsn_stg);
737 	if (sd->valsize < sz)
738 		return (ENOMEM);
739 	oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd, sz);
740 	od = (ipfw_obj_data *)(oh + 1);
741 	od->head.type = IPFW_TLV_OBJDATA;
742 	od->head.length = sz - sizeof(ipfw_obj_header);
743 	stg = (ipfw_nat64lsn_stg *)(od + 1);
744 
745 	pg = get_first_pg(cfg, &addr, &nat_proto, &port);
746 	if (pg == NULL) {
747 		/* No states */
748 		stg->next_idx = 0xFF;
749 		stg->count = 0;
750 		IPFW_UH_RUNLOCK(ch);
751 		return (0);
752 	}
753 	states = 0;
754 	pg_next = NULL;
755 	while (pg != NULL) {
756 		pg_next = get_next_pg(cfg, &addr, &nat_proto, &port);
757 		if (pg_next == NULL)
758 			stg->next_idx = 0xFF;
759 		else
760 			stg->next_idx = PACK_IDX(addr, nat_proto, port);
761 
762 		if (export_pg_states(cfg, pg, stg, sd) != 0) {
763 			IPFW_UH_RUNLOCK(ch);
764 			return (states == 0 ? ENOMEM: 0);
765 		}
766 		states += stg->count;
767 		od->head.length += stg->count * sizeof(ipfw_nat64lsn_state);
768 		sz += stg->count * sizeof(ipfw_nat64lsn_state);
769 		if (pg_next != NULL) {
770 			sz += sizeof(ipfw_nat64lsn_stg);
771 			if (sd->valsize < sz)
772 				break;
773 			stg = (ipfw_nat64lsn_stg *)ipfw_get_sopt_space(sd,
774 			    sizeof(ipfw_nat64lsn_stg));
775 		}
776 		pg = pg_next;
777 	}
778 	IPFW_UH_RUNLOCK(ch);
779 	return (0);
780 }
781 
782 static struct ipfw_sopt_handler	scodes[] = {
783 	{ IP_FW_NAT64LSN_CREATE, 0,	HDIR_BOTH,	nat64lsn_create },
784 	{ IP_FW_NAT64LSN_DESTROY,0,	HDIR_SET,	nat64lsn_destroy },
785 	{ IP_FW_NAT64LSN_CONFIG, 0,	HDIR_BOTH,	nat64lsn_config },
786 	{ IP_FW_NAT64LSN_LIST,	 0,	HDIR_GET,	nat64lsn_list },
787 	{ IP_FW_NAT64LSN_STATS,	 0,	HDIR_GET,	nat64lsn_stats },
788 	{ IP_FW_NAT64LSN_RESET_STATS,0,	HDIR_SET,	nat64lsn_reset_stats },
789 	{ IP_FW_NAT64LSN_LIST_STATES,0,	HDIR_GET,	nat64lsn_states },
790 };
791 
792 static int
793 nat64lsn_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
794 {
795 	ipfw_insn *icmd;
796 
797 	icmd = cmd - 1;
798 	if (icmd->opcode != O_EXTERNAL_ACTION ||
799 	    icmd->arg1 != V_nat64lsn_eid)
800 		return (1);
801 
802 	*puidx = cmd->arg1;
803 	*ptype = 0;
804 	return (0);
805 }
806 
807 static void
808 nat64lsn_update_arg1(ipfw_insn *cmd, uint16_t idx)
809 {
810 
811 	cmd->arg1 = idx;
812 }
813 
814 static int
815 nat64lsn_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
816     struct named_object **pno)
817 {
818 	int err;
819 
820 	err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti,
821 	    IPFW_TLV_NAT64LSN_NAME, pno);
822 	return (err);
823 }
824 
825 static struct named_object *
826 nat64lsn_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
827 {
828 	struct namedobj_instance *ni;
829 	struct named_object *no;
830 
831 	IPFW_UH_WLOCK_ASSERT(ch);
832 	ni = CHAIN_TO_SRV(ch);
833 	no = ipfw_objhash_lookup_kidx(ni, idx);
834 	KASSERT(no != NULL, ("NAT64LSN with index %d not found", idx));
835 
836 	return (no);
837 }
838 
839 static int
840 nat64lsn_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
841     enum ipfw_sets_cmd cmd)
842 {
843 
844 	return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64LSN_NAME,
845 	    set, new_set, cmd));
846 }
847 
848 static struct opcode_obj_rewrite opcodes[] = {
849 	{
850 		.opcode = O_EXTERNAL_INSTANCE,
851 		.etlv = IPFW_TLV_EACTION /* just show it isn't table */,
852 		.classifier = nat64lsn_classify,
853 		.update = nat64lsn_update_arg1,
854 		.find_byname = nat64lsn_findbyname,
855 		.find_bykidx = nat64lsn_findbykidx,
856 		.manage_sets = nat64lsn_manage_sets,
857 	},
858 };
859 
860 static int
861 destroy_config_cb(struct namedobj_instance *ni, struct named_object *no,
862     void *arg)
863 {
864 	struct nat64lsn_cfg *cfg;
865 	struct ip_fw_chain *ch;
866 
867 	ch = (struct ip_fw_chain *)arg;
868 	cfg = (struct nat64lsn_cfg *)SRV_OBJECT(ch, no->kidx);
869 	SRV_OBJECT(ch, no->kidx) = NULL;
870 	nat64lsn_detach_config(ch, cfg);
871 	nat64lsn_destroy_instance(cfg);
872 	return (0);
873 }
874 
875 int
876 nat64lsn_init(struct ip_fw_chain *ch, int first)
877 {
878 
879 	if (first != 0)
880 		nat64lsn_init_internal();
881 	V_nat64lsn_eid = ipfw_add_eaction(ch, ipfw_nat64lsn, "nat64lsn");
882 	if (V_nat64lsn_eid == 0)
883 		return (ENXIO);
884 	IPFW_ADD_SOPT_HANDLER(first, scodes);
885 	IPFW_ADD_OBJ_REWRITER(first, opcodes);
886 	return (0);
887 }
888 
889 void
890 nat64lsn_uninit(struct ip_fw_chain *ch, int last)
891 {
892 
893 	IPFW_DEL_OBJ_REWRITER(last, opcodes);
894 	IPFW_DEL_SOPT_HANDLER(last, scodes);
895 	ipfw_del_eaction(ch, V_nat64lsn_eid);
896 	/*
897 	 * Since we already have deregistered external action,
898 	 * our named objects become unaccessible via rules, because
899 	 * all rules were truncated by ipfw_del_eaction().
900 	 * So, we can unlink and destroy our named objects without holding
901 	 * IPFW_WLOCK().
902 	 */
903 	IPFW_UH_WLOCK(ch);
904 	ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch,
905 	    IPFW_TLV_NAT64LSN_NAME);
906 	V_nat64lsn_eid = 0;
907 	IPFW_UH_WUNLOCK(ch);
908 	if (last != 0)
909 		nat64lsn_uninit_internal();
910 }
911 
912