nat64_translate.h revision 346210 
1/*-
2 * Copyright (c) 2015-2018 Yandex LLC
3 * Copyright (c) 2015-2018 Andrey V. Elsukov <ae@FreeBSD.org>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 *
27 * $FreeBSD: stable/11/sys/netpfil/ipfw/nat64/nat64_translate.h 346210 2019-04-14 12:34:30Z ae $
28 */
29
30#ifndef	_IP_FW_NAT64_TRANSLATE_H_
31#define	_IP_FW_NAT64_TRANSLATE_H_
32
33struct nat64_stats {
34	uint64_t	opcnt64;	/* 6to4 of packets translated */
35	uint64_t	opcnt46;	/* 4to6 of packets translated */
36	uint64_t	ofrags;		/* number of fragments generated */
37	uint64_t	ifrags;		/* number of fragments received */
38	uint64_t	oerrors;	/* number of output errors */
39	uint64_t	noroute4;
40	uint64_t	noroute6;
41	uint64_t	nomatch4;	/* No addr/port match */
42	uint64_t	noproto;	/* Protocol not supported */
43	uint64_t	nomem;		/* mbufs allocation failed */
44	uint64_t	dropped;	/* number of packets silently
45					 * dropped due to some errors/
46					 * unsupported/etc.
47					 */
48
49	uint64_t	jrequests;	/* jobs requests queued */
50	uint64_t	jcalls;		/* jobs handler calls */
51	uint64_t	jhostsreq;	/* hosts requests */
52	uint64_t	jportreq;	/* PG allocation requests */
53	uint64_t	jhostfails;	/* hosts requests failed */
54	uint64_t	jportfails;	/* PG allocation failed */
55	uint64_t	jmaxlen;
56	uint64_t	jnomem;
57	uint64_t	jreinjected;
58
59	uint64_t	screated;
60	uint64_t	sdeleted;
61	uint64_t	spgcreated;
62	uint64_t	spgdeleted;
63};
64
65#define	IPFW_NAT64_VERSION	1
66#define	NAT64STATS	(sizeof(struct nat64_stats) / sizeof(uint64_t))
67struct nat64_counters {
68	counter_u64_t		cnt[NAT64STATS];
69};
70#define	NAT64STAT_ADD(s, f, v)		\
71    counter_u64_add((s)->cnt[		\
72	offsetof(struct nat64_stats, f) / sizeof(uint64_t)], (v))
73#define	NAT64STAT_INC(s, f)	NAT64STAT_ADD(s, f, 1)
74#define	NAT64STAT_FETCH(s, f)		\
75    counter_u64_fetch((s)->cnt[	\
76	offsetof(struct nat64_stats, f) / sizeof(uint64_t)])
77
78#define	L3HDR(_ip, _t)	((_t)((uint32_t *)(_ip) + (_ip)->ip_hl))
79#define	TCP(p)		((struct tcphdr *)(p))
80#define	UDP(p)		((struct udphdr *)(p))
81#define	ICMP(p)		((struct icmphdr *)(p))
82#define	ICMP6(p)	((struct icmp6_hdr *)(p))
83
84#define	NAT64SKIP	0
85#define	NAT64RETURN	1
86#define	NAT64MFREE	-1
87
88/*
89 * According to RFC6877:
90 *  PLAT is provider-side translator (XLAT) that translates N:1 global
91 *  IPv6 addresses to global IPv4 addresses, and vice versa.
92 *
93 *  CLAT is customer-side translator (XLAT) that algorithmically
94 *  translates 1:1 private IPv4 addresses to global IPv6 addresses,
95 *  and vice versa.
96 */
97struct nat64_config {
98	struct in6_addr		clat_prefix;
99	struct in6_addr		plat_prefix;
100	uint32_t		flags;
101#define	NAT64_WKPFX		0x00010000	/* prefix is well-known */
102#define	NAT64_CLATPFX		0x00020000	/* dst prefix is configured */
103#define	NAT64_PLATPFX		0x00040000	/* src prefix is configured */
104	uint8_t			clat_plen;
105	uint8_t			plat_plen;
106
107	struct nat64_counters	stats;
108};
109
110static inline int
111nat64_check_ip6(struct in6_addr *addr)
112{
113
114	/* XXX: We should really check /8 */
115	if (addr->s6_addr16[0] == 0 || /* 0000::/8 Reserved by IETF */
116	    IN6_IS_ADDR_MULTICAST(addr) || IN6_IS_ADDR_LINKLOCAL(addr))
117		return (1);
118	return (0);
119}
120
121static inline int
122nat64_check_ip4(in_addr_t ia)
123{
124
125	/* IN_LOOPBACK */
126	if ((ia & htonl(0xff000000)) == htonl(0x7f000000))
127		return (1);
128	/* IN_LINKLOCAL */
129	if ((ia & htonl(0xffff0000)) == htonl(0xa9fe0000))
130		return (1);
131	/* IN_MULTICAST & IN_EXPERIMENTAL */
132	if ((ia & htonl(0xe0000000)) == htonl(0xe0000000))
133		return (1);
134	return (0);
135}
136
137/* Well-known prefix 64:ff9b::/96 */
138#define	IPV6_ADDR_INT32_WKPFX	htonl(0x64ff9b)
139#define	IN6_IS_ADDR_WKPFX(a)	\
140    ((a)->s6_addr32[0] == IPV6_ADDR_INT32_WKPFX && \
141	(a)->s6_addr32[1] == 0 && (a)->s6_addr32[2] == 0)
142
143int nat64_check_private_ip4(const struct nat64_config *cfg, in_addr_t ia);
144int nat64_check_prefixlen(int length);
145int nat64_check_prefix6(const struct in6_addr *prefix, int length);
146int nat64_getlasthdr(struct mbuf *m, int *offset);
147int nat64_do_handle_ip4(struct mbuf *m, struct in6_addr *saddr,
148    struct in6_addr *daddr, uint16_t lport, struct nat64_config *cfg,
149    void *logdata);
150int nat64_do_handle_ip6(struct mbuf *m, uint32_t aaddr, uint16_t aport,
151    struct nat64_config *cfg, void *logdata);
152int nat64_handle_icmp6(struct mbuf *m, int hlen, uint32_t aaddr,
153    uint16_t aport, struct nat64_config *cfg, void *logdata);
154void nat64_embed_ip4(struct in6_addr *ip6, int plen, in_addr_t ia);
155in_addr_t nat64_extract_ip4(const struct in6_addr *ip6, int plen);
156
157void nat64_set_output_method(int);
158int nat64_get_output_method(void);
159
160#endif
161
162