Changes in Makefile

031beb4e - sys: Remove $FreeBSD$: one-line sh pattern

Wed, 16 Aug 2023 17:54:58 +0000

sys: Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/ List of files: /freebsd-14.2/sys/modules/ipfw_nat64/Makefile

28739809 - Follow RFC 4443 p2.2 and always use own addresses for reflected ICMPv6

Thu, 12 Dec 2019 13:28:46 +0000

Follow RFC 4443 p2.2 and always use own addresses for reflected ICMPv6datagrams.Previously destination address from original datagram was used. Thatlooked confusing, especially in the traceroute6 output.Also honor IPSTEALTH kernel option and do TTL/HLIM decrementing onlywhen stealth mode is disabled.Reported by: Marco van Tol Reviewed by: melifaroMFC after: 2 weeksSponsored by: Yandex LLCDifferential Revision: https://reviews.freebsd.org/D22631 List of files: /freebsd-14.2/sys/modules/ipfw_nat64/Makefile

d18c1f26 - Reapply r345274 with build fixes for 32-bit architectures.

Tue, 19 Mar 2019 10:57:03 +0000

Reapply r345274 with build fixes for 32-bit architectures. Update NAT64LSN implementation: o most of data structures and relations were modified to be able support large number of translation states. Now each supported protocol can use full ports range. Ports groups now are belongs to IPv4 alias addresses, not hosts. Each ports group can keep several states chunks. This is controlled with new `states_chunks` config option. States chunks allow to have several translation states for single alias address and port, but for different destination addresses. o by default all hash tables now use jenkins hash. o ConcurrencyKit and epoch(9) is used to make NAT64LSN lockless on fast path. o one NAT64LSN instance now can be used to handle several IPv6 prefixes, special prefix "::" value should be used for this purpose when instance is created. o due to modified internal data structures relations, the socket opcode that does states listing was changed.Obtained from: Yandex LLCMFC after: 1 monthSponsored by: Yandex LLC List of files: /freebsd-14.2/sys/modules/ipfw_nat64/Makefile

d6369c2d - Revert r345274. It appears that not all 32-bit architectures have

Mon, 18 Mar 2019 14:00:19 +0000

Revert r345274. It appears that not all 32-bit architectures havenecessary CK primitives. List of files: /freebsd-14.2/sys/modules/ipfw_nat64/Makefile

d7a1cf06 - Update NAT64LSN implementation:

Mon, 18 Mar 2019 12:59:08 +0000

Update NAT64LSN implementation:o most of data structures and relations were modified to be able support large number of translation states. Now each supported protocol can use full ports range. Ports groups now are belongs to IPv4 alias addresses, not hosts. Each ports group can keep several states chunks. This is controlled with new `states_chunks` config option. States chunks allow to have several translation states for single alias address and port, but for different destination addresses.o by default all hash tables now use jenkins hash.o ConcurrencyKit and epoch(9) is used to make NAT64LSN lockless on fast path.o one NAT64LSN instance now can be used to handle several IPv6 prefixes, special prefix "::" value should be used for this purpose when instance is created.o due to modified internal data structures relations, the socket opcode that does states listing was changed.Obtained from: Yandex LLCMFC after: 1 monthSponsored by: Yandex LLC List of files: /freebsd-14.2/sys/modules/ipfw_nat64/Makefile

5c04f73e - Add NAT64 CLAT implementation as defined in RFC6877.

Mon, 18 Mar 2019 11:44:53 +0000

Add NAT64 CLAT implementation as defined in RFC6877.CLAT is customer-side translator that algorithmically translates 1:1private IPv4 addresses to global IPv6 addresses, and vice versa.It is implemented as part of ipfw_nat64 kernel module. When moduleis loaded or compiled into the kernel, it registers "nat64clat" externalaction. External action named instance can be created using `create`command and then used in ipfw rules. The create command accepts twoIPv6 prefixes `plat_prefix` and `clat_prefix`. If plat_prefix is ommitted,IPv6 NAT64 Well-Known prefix 64:ff9b::/96 will be used. # ipfw nat64clat CLAT create clat_prefix SRC_PFX plat_prefix DST_PFX # ipfw add nat64clat CLAT ip4 from IPv4_PFX to any out # ipfw add nat64clat CLAT ip6 from DST_PFX to SRC_PFX inObtained from: Yandex LLCSubmitted by: Boris N. LytochkinMFC after: 1 monthRelnotes: yesSponsored by: Yandex LLC List of files: /freebsd-14.2/sys/modules/ipfw_nat64/Makefile

aa271561 - Retire IPFIREWALL_NAT64_DIRECT_OUTPUT kernel option. And add ability

Sun, 21 Oct 2018 16:29:12 +0000

Retire IPFIREWALL_NAT64_DIRECT_OUTPUT kernel option. And add abilityto switch the output method in run-time. Also document some sysctlvariables that can by changed for NAT64 module.NAT64 had compile time option IPFIREWALL_NAT64_DIRECT_OUTPUT to useif_output directly from nat64 module. By default is used netisr basedoutput method. Now both methods can be used, but they require differenthandling by rules.Obtained from: Yandex LLCMFC after: 3 weeksSponsored by: Yandex LLCDifferential Revision: https://reviews.freebsd.org/D16647 List of files: /freebsd-14.2/sys/modules/ipfw_nat64/Makefile

782360de - Bring in some last changes in NAT64 implementation:

Wed, 09 May 2018 11:59:24 +0000

Bring in some last changes in NAT64 implementation:o Modify ipfw(8) to be able set any prefix6 not just Well-Known, and also show configured prefix6;o relocate some definitions and macros into proper place;o convert nat64_debug and nat64_allow_private variables to be VNET-compatible;o add struct nat64_config that keeps generic configuration needed to NAT64 code;o add nat64_check_prefix6() function to check validness of specified by user IPv6 prefix according to RFC6052;o use nat64_check_private_ip4() and nat64_embed_ip4() functions instead of nat64_get_ip4() and nat64_set_ip4() macros. This allows to use any configured IPv6 prefixes that are allowed by RFC6052;o introduce NAT64_WKPFX flag, that is set when IPv6 prefix is Well-Known IPv6 prefix. It is used to reduce overhead to check this;o modify nat64lsn_cfg and nat64stl_cfg structures to use nat64_config structure. And respectivelly modify the rest of code;o remove now unused ro argument from nat64_output() function;o remove __FreeBSD_version ifdef, NAT64 was not merged to older versions;o add commented -DIPFIREWALL_NAT64_DIRECT_OUTPUT flag to module's Makefile as example.Obtained from: Yandex LLCMFC after: 1 monthSponsored by: Yandex LLC List of files: /freebsd-14.2/sys/modules/ipfw_nat64/Makefile

193d9e76 - sys/modules: normalize .CURDIR-relative paths to SRCTOP

Sat, 04 Mar 2017 10:10:17 +0000

sys/modules: normalize .CURDIR-relative paths to SRCTOPThis simplifies make output/logicTested with: `cd sys/modules; make ALL_MODULES=` on amd64MFC after: 1 monthSponsored by: Dell EMC Isilon List of files: /freebsd-14.2/sys/modules/ipfw_nat64/Makefile

d8caf56e - Add ipfw_nat64 module that implements stateless and stateful NAT64.

Sat, 13 Aug 2016 16:09:49 +0000

Add ipfw_nat64 module that implements stateless and stateful NAT64.The module works together with ipfw(4) and implemented as its externalaction module.Stateless NAT64 registers external action with name nat64stl. Thiskeyword should be used to create NAT64 instance and to address thisinstance in rules. Stateless NAT64 uses two lookup tables with mappedIPv4->IPv6 and IPv6->IPv4 addresses to perform translation.A configuration of instance should looks like this: 1. Create lookup tables: # ipfw table T46 create type addr valtype ipv6 # ipfw table T64 create type addr valtype ipv4 2. Fill T46 and T64 tables. 3. Add rule to allow neighbor solicitation and advertisement: # ipfw add allow icmp6 from any to any icmp6types 135,136 4. Create NAT64 instance: # ipfw nat64stl NAT create table4 T46 table6 T64 5. Add rules that matches the traffic: # ipfw add nat64stl NAT ip from any to table(T46) # ipfw add nat64stl NAT ip from table(T64) to 64:ff9b::/96 6. Configure DNS64 for IPv6 clients and add route to 64:ff9b::/96 via NAT64 host.Stateful NAT64 registers external action with name nat64lsn. The onlyone option required to create nat64lsn instance - prefix4. It definesthe pool of IPv4 addresses used for translation.A configuration of instance should looks like this: 1. Add rule to allow neighbor solicitation and advertisement: # ipfw add allow icmp6 from any to any icmp6types 135,136 2. Create NAT64 instance: # ipfw nat64lsn NAT create prefix4 A.B.C.D/28 3. Add rules that matches the traffic: # ipfw add nat64lsn NAT ip from any to A.B.C.D/28 # ipfw add nat64lsn NAT ip6 from any to 64:ff9b::/96 4. Configure DNS64 for IPv6 clients and add route to 64:ff9b::/96 via NAT64 host.Obtained from: Yandex LLCRelnotes: yesSponsored by: Yandex LLCDifferential Revision: https://reviews.freebsd.org/D6434 List of files: /freebsd-14.2/sys/modules/ipfw_nat64/Makefile