1 /*- 2 * Copyright (c) 2015-2016 Yandex LLC 3 * Copyright (c) 2015-2016 Andrey V. Elsukov <ae@FreeBSD.org> 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26 * 27 * $FreeBSD$ 28 */ 29 30 #ifndef _IP_FW_NAT64_TRANSLATE_H_ 31 #define _IP_FW_NAT64_TRANSLATE_H_ 32 33 struct nat64_stats { 34 uint64_t opcnt64; /* 6to4 of packets translated */ 35 uint64_t opcnt46; /* 4to6 of packets translated */ 36 uint64_t ofrags; /* number of fragments generated */ 37 uint64_t ifrags; /* number of fragments received */ 38 uint64_t oerrors; /* number of output errors */ 39 uint64_t noroute4; 40 uint64_t noroute6; 41 uint64_t nomatch4; /* No addr/port match */ 42 uint64_t noproto; /* Protocol not supported */ 43 uint64_t nomem; /* mbufs allocation failed */ 44 uint64_t dropped; /* number of packets silently 45 * dropped due to some errors/ 46 * unsupported/etc. 47 */ 48 49 uint64_t jrequests; /* number of jobs requests queued */ 50 uint64_t jcalls; /* number of jobs handler calls */ 51 uint64_t jhostsreq; /* number of hosts requests */ 52 uint64_t jportreq; 53 uint64_t jhostfails; 54 uint64_t jportfails; 55 uint64_t jmaxlen; 56 uint64_t jnomem; 57 uint64_t jreinjected; 58 59 uint64_t screated; 60 uint64_t sdeleted; 61 uint64_t spgcreated; 62 uint64_t spgdeleted; 63 }; 64 65 #define IPFW_NAT64_VERSION 1 66 #define NAT64STATS (sizeof(struct nat64_stats) / sizeof(uint64_t)) 67 struct nat64_counters { 68 counter_u64_t cnt[NAT64STATS]; 69 }; 70 #define NAT64STAT_ADD(s, f, v) \ 71 counter_u64_add((s)->cnt[ \ 72 offsetof(struct nat64_stats, f) / sizeof(uint64_t)], (v)) 73 #define NAT64STAT_INC(s, f) NAT64STAT_ADD(s, f, 1) 74 #define NAT64STAT_FETCH(s, f) \ 75 counter_u64_fetch((s)->cnt[ \ 76 offsetof(struct nat64_stats, f) / sizeof(uint64_t)]) 77 78 #define L3HDR(_ip, _t) ((_t)((uint32_t *)(_ip) + (_ip)->ip_hl)) 79 #define TCP(p) ((struct tcphdr *)(p)) 80 #define UDP(p) ((struct udphdr *)(p)) 81 #define ICMP(p) ((struct icmphdr *)(p)) 82 #define ICMP6(p) ((struct icmp6_hdr *)(p)) 83 84 #define NAT64SKIP 0 85 #define NAT64RETURN 1 86 #define NAT64MFREE -1 87 88 struct nat64_config { 89 uint32_t flags; 90 #define NAT64_WKPFX 0x00010000 /* prefix6 is WKPFX */ 91 struct in6_addr prefix6; 92 uint8_t plen6; 93 94 struct nat64_counters stats; 95 }; 96 97 static inline int 98 nat64_check_ip6(struct in6_addr *addr) 99 { 100 101 /* XXX: We should really check /8 */ 102 if (addr->s6_addr16[0] == 0 || /* 0000::/8 Reserved by IETF */ 103 IN6_IS_ADDR_MULTICAST(addr) || IN6_IS_ADDR_LINKLOCAL(addr)) 104 return (1); 105 return (0); 106 } 107 108 static inline int 109 nat64_check_ip4(in_addr_t ia) 110 { 111 112 /* IN_LOOPBACK */ 113 if ((ia & htonl(0xff000000)) == htonl(0x7f000000)) 114 return (1); 115 /* IN_LINKLOCAL */ 116 if ((ia & htonl(0xffff0000)) == htonl(0xa9fe0000)) 117 return (1); 118 /* IN_MULTICAST & IN_EXPERIMENTAL */ 119 if ((ia & htonl(0xe0000000)) == htonl(0xe0000000)) 120 return (1); 121 return (0); 122 } 123 124 /* Well-known prefix 64:ff9b::/96 */ 125 #define IPV6_ADDR_INT32_WKPFX htonl(0x64ff9b) 126 #define IN6_IS_ADDR_WKPFX(a) \ 127 ((a)->s6_addr32[0] == IPV6_ADDR_INT32_WKPFX && \ 128 (a)->s6_addr32[1] == 0 && (a)->s6_addr32[2] == 0) 129 130 int nat64_check_private_ip4(const struct nat64_config *cfg, in_addr_t ia); 131 int nat64_check_prefix6(const struct in6_addr *prefix, int length); 132 int nat64_getlasthdr(struct mbuf *m, int *offset); 133 int nat64_do_handle_ip4(struct mbuf *m, struct in6_addr *saddr, 134 struct in6_addr *daddr, uint16_t lport, struct nat64_config *cfg, 135 void *logdata); 136 int nat64_do_handle_ip6(struct mbuf *m, uint32_t aaddr, uint16_t aport, 137 struct nat64_config *cfg, void *logdata); 138 int nat64_handle_icmp6(struct mbuf *m, int hlen, uint32_t aaddr, 139 uint16_t aport, struct nat64_config *cfg, void *logdata); 140 void nat64_embed_ip4(const struct nat64_config *cfg, in_addr_t ia, 141 struct in6_addr *ip6); 142 in_addr_t nat64_extract_ip4(const struct nat64_config *cfg, 143 const struct in6_addr *ip6); 144 145 #endif 146 147