MFC r304041:

  Move logging via BPF support into separate file.

  * make interface cloner VNET-aware;
  * simplify cloner code and use if_clone_simple();
  * migrate LOGIF_LOCK() to rmlock;
  * add ipfw_bpf_mtap2() function to pass mbuf to BPF;
  * introduce new additional ipfwlog0 pseudo interface. It differs from
    ipfw0 by DLT type used in bpfattach. This interface is intended to
    used by ipfw modules to dump packets with additional info attached.
    Currently pflog format is used. ipfw_bpf_mtap2() function uses second
    argument to determine which interface use for dumping. If dlen is equal
    to ETHER_HDR_LEN it uses old ipfw0 interface, if dlen is equal to
    PFLOG_HDRLEN - ipfwlog0 will be used.

  Obtained from:	Yandex LLC
  Sponsored by:	Yandex LLC

MFC r304043:
  Add three helper function to manage tables from external modules.

  ipfw_objhash_lookup_table_kidx does lookup kernel index of table;
  ipfw_ref_table/ipfw_unref_table takes and releases reference to table.

  Obtained from:	Yandex LLC
  Sponsored by:	Yandex LLC

MFC r304046, 304108:
  Add ipfw_nat64 module that implements stateless and stateful NAT64.

  The module works together with ipfw(4) and implemented as its external
  action module.

  Stateless NAT64 registers external action with name nat64stl. This
  keyword should be used to create NAT64 instance and to address this
  instance in rules. Stateless NAT64 uses two lookup tables with mapped
  IPv4->IPv6 and IPv6->IPv4 addresses to perform translation.

  A configuration of instance should looks like this:
   1. Create lookup tables:
   # ipfw table T46 create type addr valtype ipv6
   # ipfw table T64 create type addr valtype ipv4
   2. Fill T46 and T64 tables.
   3. Add rule to allow neighbor solicitation and advertisement:
   # ipfw add allow icmp6 from any to any icmp6types 135,136
   4. Create NAT64 instance:
   # ipfw nat64stl NAT create table4 T46 table6 T64
   5. Add rules that matches the traffic:
   # ipfw add nat64stl NAT ip from any to table(T46)
   # ipfw add nat64stl NAT ip from table(T64) to 64:ff9b::/96
   6. Configure DNS64 for IPv6 clients and add route to 64:ff9b::/96
      via NAT64 host.

  Stateful NAT64 registers external action with name nat64lsn. The only
  one option required to create nat64lsn instance - prefix4. It defines
  the pool of IPv4 addresses used for translation.

  A configuration of instance should looks like this:
   1. Add rule to allow neighbor solicitation and advertisement:
   # ipfw add allow icmp6 from any to any icmp6types 135,136
   2. Create NAT64 instance:
   # ipfw nat64lsn NAT create prefix4 A.B.C.D/28
   3. Add rules that matches the traffic:
   # ipfw add nat64lsn NAT ip from any to A.B.C.D/28
   # ipfw add nat64lsn NAT ip6 from any to 64:ff9b::/96
   4. Configure DNS64 for IPv6 clients and add route to 64:ff9b::/96
      via NAT64 host.

  Obtained from:	Yandex LLC
  Relnotes:	yes
  Sponsored by:	Yandex LLC
  Differential Revision:	https://reviews.freebsd.org/D6434

MFC r304048:
  Replace __noinline with special debug macro NAT64NOINLINE.

MFC r304061:
  Use %ju to print unsigned 64-bit value.

MFC r304076:
  Make statistics nat64lsn, nat64stl an nptv6 output netstat-like:
  "@value @description" and fix build due to -Wformat errors.

MFC r304378 (by bz):
  Try to fix gcc compilation errors (which are right).
  nat64_getlasthdr() returns an int, which can be -1 in case of error,
  storing the result in an uint8_t and then comparing to < 0 is not
  helpful.  Do what is done in the rest of the code and make proto an
  int here as well.

MFC r309187:
  Fix ICMPv6 Time Exceeded error message translation.

MFC r314718:
  Use new ipfw_lookup_table() in the nat64 too.

MFC r315204,315233:
  Use memset with structure size.

(cherry picked from commit 1f5f6e71571eeaab683b65e91887222f4a6ece97)

1 files changed, 28 insertions, 0 deletions

diff --git a/sbin/ipfw/ipfw2.h b/sbin/ipfw/ipfw2.h
index 39b7dd9..a311458 100644
--- a/sbin/ipfw/ipfw2.h
+++ b/sbin/ipfw/ipfw2.h
@@ -254,7 +254,30 @@ enum tokens {
 	TOK_UNLOCK,
 	TOK_VLIST,
 	TOK_OLIST,
+
+	/* NAT64 tokens */
+	TOK_NAT64STL,
+	TOK_NAT64LSN,
 	TOK_STATS,
+	TOK_STATES,
+	TOK_CONFIG,
+	TOK_TABLE4,
+	TOK_TABLE6,
+	TOK_PREFIX4,
+	TOK_PREFIX6,
+	TOK_AGG_LEN,
+	TOK_AGG_COUNT,
+	TOK_MAX_PORTS,
+	TOK_JMAXLEN,
+	TOK_PORT_RANGE,
+	TOK_HOST_DEL_AGE,
+	TOK_PG_DEL_AGE,
+	TOK_TCP_SYN_AGE,
+	TOK_TCP_CLOSE_AGE,
+	TOK_TCP_EST_AGE,
+	TOK_UDP_AGE,
+	TOK_ICMP_AGE,
+	TOK_LOGOFF,
 
 	/* NPTv6 tokens */
 	TOK_NPTV6,
@@ -349,6 +372,8 @@ void ipfw_flush(int force);
 void ipfw_zero(int ac, char *av[], int optname);
 void ipfw_list(int ac, char *av[], int show_counters);
 void ipfw_internal_handler(int ac, char *av[]);
+void ipfw_nat64lsn_handler(int ac, char *av[]);
+void ipfw_nat64stl_handler(int ac, char *av[]);
 void ipfw_nptv6_handler(int ac, char *av[]);
 int ipfw_check_object_name(const char *name);
 
@@ -386,7 +411,10 @@ void bp_flush(struct buf_pr *b);
 
 /* tables.c */
 struct _ipfw_obj_ctlv;
+struct _ipfw_obj_ntlv;
 int table_check_name(const char *tablename);
 void ipfw_list_ta(int ac, char *av[]);
 void ipfw_list_values(int ac, char *av[]);
+void table_fill_ntlv(struct _ipfw_obj_ntlv *ntlv, const char *name,
+    uint8_t set, uint16_t uidx);