en Copyright 2015 Java http://172.16.0.5:8080/history/freebsd-12.1/sys/modules/ipfw_nat64/Makefile#ad3a2004 MFC r345293: Update NAT64LSN implementation: o most of data structures and relations were modified to be able support large number of translation states. Now each supported protocol can use full ports range. Ports groups now are belong to IPv4 alias addresses, not hosts. Each ports group can keep several states chunks. This is controlled with new `states_chunks` config option. States chunks allow to have several translation states for single alias address and port, but for different destination addresses. o by default all hash tables now use jenkins hash. o ConcurrencyKit and epoch(9) is used to make NAT64LSN lockless on fast path. o one NAT64LSN instance now can be used to handle several IPv6 prefixes, special prefix "::" value should be used for this purpose when instance is created. o due to modified internal data structures relations, the socket opcode that does states listing was changed. Obtained from: Yandex LLC Sponsored by: Yandex LLCMFC r345294: Remove extra spaces. List of files: /freebsd-12.1/sys/modules/ipfw_nat64/Makefile Sun, 14 Apr 2019 13:08:18 +0000 Andrey V. Elsukov <ae@FreeBSD.org> http://172.16.0.5:8080/history/freebsd-12.1/sys/modules/ipfw_nat64/Makefile#5ba983e0 MFC r345264: Add NAT64 CLAT implementation as defined in RFC6877. CLAT is customer-side translator that algorithmically translates 1:1 private IPv4 addresses to global IPv6 addresses, and vice versa. It is implemented as part of ipfw_nat64 kernel module. When module is loaded or compiled into the kernel, it registers "nat64clat" external action. External action named instance can be created using `create` command and then used in ipfw rules. The create command accepts two IPv6 prefixes `plat_prefix` and `clat_prefix`. If plat_prefix is ommitted, IPv6 NAT64 Well-Known prefix 64:ff9b::/96 will be used. # ipfw nat64clat CLAT create clat_prefix SRC_PFX plat_prefix DST_PFX # ipfw add nat64clat CLAT ip4 from IPv4_PFX to any out # ipfw add nat64clat CLAT ip6 from DST_PFX to SRC_PFX in Obtained from: Yandex LLC Submitted by: Boris N. Lytochkin Relnotes: yes Sponsored by: Yandex LLC List of files: /freebsd-12.1/sys/modules/ipfw_nat64/Makefile Sun, 14 Apr 2019 10:44:06 +0000 Andrey V. Elsukov <ae@FreeBSD.org> http://172.16.0.5:8080/history/freebsd-12.1/sys/modules/ipfw_nat64/Makefile#f273cd52 MFC r339542: Retire IPFIREWALL_NAT64_DIRECT_OUTPUT kernel option. And add ability to switch the output method in run-time. Also document some sysctl variables that can by changed for NAT64 module. NAT64 had compile time option IPFIREWALL_NAT64_DIRECT_OUTPUT to use if_output directly from nat64 module. By default is used netisr based output method. Now both methods can be used, but they require different handling by rules. Obtained from: Yandex LLC Sponsored by: Yandex LLC Differential Revision: https://reviews.freebsd.org/D16647 List of files: /freebsd-12.1/sys/modules/ipfw_nat64/Makefile Sat, 17 Nov 2018 23:52:56 +0000 Andrey V. Elsukov <ae@FreeBSD.org> http://172.16.0.5:8080/history/freebsd-12.1/sys/modules/ipfw_nat64/Makefile#782360de Bring in some last changes in NAT64 implementation:o Modify ipfw(8) to be able set any prefix6 not just Well-Known, and also show configured prefix6;o relocate some definitions and macros into proper place;o convert nat64_debug and nat64_allow_private variables to be VNET-compatible;o add struct nat64_config that keeps generic configuration needed to NAT64 code;o add nat64_check_prefix6() function to check validness of specified by user IPv6 prefix according to RFC6052;o use nat64_check_private_ip4() and nat64_embed_ip4() functions instead of nat64_get_ip4() and nat64_set_ip4() macros. This allows to use any configured IPv6 prefixes that are allowed by RFC6052;o introduce NAT64_WKPFX flag, that is set when IPv6 prefix is Well-Known IPv6 prefix. It is used to reduce overhead to check this;o modify nat64lsn_cfg and nat64stl_cfg structures to use nat64_config structure. And respectivelly modify the rest of code;o remove now unused ro argument from nat64_output() function;o remove __FreeBSD_version ifdef, NAT64 was not merged to older versions;o add commented -DIPFIREWALL_NAT64_DIRECT_OUTPUT flag to module's Makefile as example.Obtained from: Yandex LLCMFC after: 1 monthSponsored by: Yandex LLC List of files: /freebsd-12.1/sys/modules/ipfw_nat64/Makefile Wed, 09 May 2018 11:59:24 +0000 Andrey V. Elsukov <ae@FreeBSD.org> http://172.16.0.5:8080/history/freebsd-12.1/sys/modules/ipfw_nat64/Makefile#193d9e76 sys/modules: normalize .CURDIR-relative paths to SRCTOPThis simplifies make output/logicTested with: `cd sys/modules; make ALL_MODULES=` on amd64MFC after: 1 monthSponsored by: Dell EMC Isilon List of files: /freebsd-12.1/sys/modules/ipfw_nat64/Makefile Sat, 04 Mar 2017 10:10:17 +0000 Enji Cooper <ngie@FreeBSD.org> http://172.16.0.5:8080/history/freebsd-12.1/sys/modules/ipfw_nat64/Makefile#d8caf56e Add ipfw_nat64 module that implements stateless and stateful NAT64.The module works together with ipfw(4) and implemented as its externalaction module.Stateless NAT64 registers external action with name nat64stl. Thiskeyword should be used to create NAT64 instance and to address thisinstance in rules. Stateless NAT64 uses two lookup tables with mappedIPv4->IPv6 and IPv6->IPv4 addresses to perform translation.A configuration of instance should looks like this: 1. Create lookup tables: # ipfw table T46 create type addr valtype ipv6 # ipfw table T64 create type addr valtype ipv4 2. Fill T46 and T64 tables. 3. Add rule to allow neighbor solicitation and advertisement: # ipfw add allow icmp6 from any to any icmp6types 135,136 4. Create NAT64 instance: # ipfw nat64stl NAT create table4 T46 table6 T64 5. Add rules that matches the traffic: # ipfw add nat64stl NAT ip from any to table(T46) # ipfw add nat64stl NAT ip from table(T64) to 64:ff9b::/96 6. Configure DNS64 for IPv6 clients and add route to 64:ff9b::/96 via NAT64 host.Stateful NAT64 registers external action with name nat64lsn. The onlyone option required to create nat64lsn instance - prefix4. It definesthe pool of IPv4 addresses used for translation.A configuration of instance should looks like this: 1. Add rule to allow neighbor solicitation and advertisement: # ipfw add allow icmp6 from any to any icmp6types 135,136 2. Create NAT64 instance: # ipfw nat64lsn NAT create prefix4 A.B.C.D/28 3. Add rules that matches the traffic: # ipfw add nat64lsn NAT ip from any to A.B.C.D/28 # ipfw add nat64lsn NAT ip6 from any to 64:ff9b::/96 4. Configure DNS64 for IPv6 clients and add route to 64:ff9b::/96 via NAT64 host.Obtained from: Yandex LLCRelnotes: yesSponsored by: Yandex LLCDifferential Revision: https://reviews.freebsd.org/D6434 List of files: /freebsd-12.1/sys/modules/ipfw_nat64/Makefile Sat, 13 Aug 2016 16:09:49 +0000 Andrey V. Elsukov <ae@FreeBSD.org>