1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2019 Yandex LLC 5 * Copyright (c) 2019 Andrey V. Elsukov <ae@FreeBSD.org> 6 * Copyright (c) 2019 Boris N. Lytochkin <lytboris@gmail.com> 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include <sys/param.h> 34 #include <sys/systm.h> 35 #include <sys/counter.h> 36 #include <sys/errno.h> 37 #include <sys/kernel.h> 38 #include <sys/lock.h> 39 #include <sys/malloc.h> 40 #include <sys/mbuf.h> 41 #include <sys/module.h> 42 #include <sys/rmlock.h> 43 #include <sys/rwlock.h> 44 #include <sys/socket.h> 45 #include <sys/sockopt.h> 46 #include <sys/syslog.h> 47 #include <sys/sysctl.h> 48 49 #include <net/if.h> 50 #include <net/if_var.h> 51 #include <net/route.h> 52 #include <net/vnet.h> 53 54 #include <netinet/in.h> 55 #include <netinet/ip_var.h> 56 #include <netinet/ip_fw.h> 57 #include <netinet6/in6_var.h> 58 #include <netinet6/ip6_var.h> 59 #include <netinet6/ip_fw_nat64.h> 60 61 #include <netpfil/ipfw/ip_fw_private.h> 62 63 #include "nat64clat.h" 64 65 VNET_DEFINE(uint16_t, nat64clat_eid) = 0; 66 67 static struct nat64clat_cfg *nat64clat_alloc_config(const char *name, 68 uint8_t set); 69 static void nat64clat_free_config(struct nat64clat_cfg *cfg); 70 static struct nat64clat_cfg *nat64clat_find(struct namedobj_instance *ni, 71 const char *name, uint8_t set); 72 73 static struct nat64clat_cfg * 74 nat64clat_alloc_config(const char *name, uint8_t set) 75 { 76 struct nat64clat_cfg *cfg; 77 78 cfg = malloc(sizeof(struct nat64clat_cfg), M_IPFW, M_WAITOK | M_ZERO); 79 COUNTER_ARRAY_ALLOC(cfg->base.stats.cnt, NAT64STATS, M_WAITOK); 80 cfg->no.name = cfg->name; 81 cfg->no.etlv = IPFW_TLV_NAT64CLAT_NAME; 82 cfg->no.set = set; 83 strlcpy(cfg->name, name, sizeof(cfg->name)); 84 return (cfg); 85 } 86 87 static void 88 nat64clat_free_config(struct nat64clat_cfg *cfg) 89 { 90 91 COUNTER_ARRAY_FREE(cfg->base.stats.cnt, NAT64STATS); 92 free(cfg, M_IPFW); 93 } 94 95 static void 96 nat64clat_export_config(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg, 97 ipfw_nat64clat_cfg *uc) 98 { 99 uc->plat_prefix = cfg->base.plat_prefix; 100 uc->plat_plen = cfg->base.plat_plen; 101 uc->clat_prefix = cfg->base.clat_prefix; 102 uc->clat_plen = cfg->base.clat_plen; 103 uc->flags = cfg->base.flags & NAT64CLAT_FLAGSMASK; 104 uc->set = cfg->no.set; 105 strlcpy(uc->name, cfg->no.name, sizeof(uc->name)); 106 } 107 108 struct nat64clat_dump_arg { 109 struct ip_fw_chain *ch; 110 struct sockopt_data *sd; 111 }; 112 113 static int 114 export_config_cb(struct namedobj_instance *ni, struct named_object *no, 115 void *arg) 116 { 117 struct nat64clat_dump_arg *da = (struct nat64clat_dump_arg *)arg; 118 ipfw_nat64clat_cfg *uc; 119 120 uc = (ipfw_nat64clat_cfg *)ipfw_get_sopt_space(da->sd, sizeof(*uc)); 121 nat64clat_export_config(da->ch, (struct nat64clat_cfg *)no, uc); 122 return (0); 123 } 124 125 static struct nat64clat_cfg * 126 nat64clat_find(struct namedobj_instance *ni, const char *name, uint8_t set) 127 { 128 struct nat64clat_cfg *cfg; 129 130 cfg = (struct nat64clat_cfg *)ipfw_objhash_lookup_name_type(ni, set, 131 IPFW_TLV_NAT64CLAT_NAME, name); 132 133 return (cfg); 134 } 135 136 /* 137 * Creates new consumer-side nat64 translator instance. 138 * Data layout (v0)(current): 139 * Request: [ ipfw_obj_lheader ipfw_nat64clat_cfg ] 140 * 141 * Returns 0 on success 142 */ 143 static int 144 nat64clat_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 145 struct sockopt_data *sd) 146 { 147 ipfw_obj_lheader *olh; 148 ipfw_nat64clat_cfg *uc; 149 struct namedobj_instance *ni; 150 struct nat64clat_cfg *cfg; 151 152 if (sd->valsize != sizeof(*olh) + sizeof(*uc)) 153 return (EINVAL); 154 155 olh = (ipfw_obj_lheader *)sd->kbuf; 156 uc = (ipfw_nat64clat_cfg *)(olh + 1); 157 158 if (ipfw_check_object_name_generic(uc->name) != 0) 159 return (EINVAL); 160 161 if (uc->set >= IPFW_MAX_SETS || 162 nat64_check_prefix6(&uc->plat_prefix, uc->plat_plen) != 0 || 163 nat64_check_prefix6(&uc->clat_prefix, uc->clat_plen) != 0) 164 return (EINVAL); 165 166 ni = CHAIN_TO_SRV(ch); 167 168 IPFW_UH_RLOCK(ch); 169 if (nat64clat_find(ni, uc->name, uc->set) != NULL) { 170 IPFW_UH_RUNLOCK(ch); 171 return (EEXIST); 172 } 173 IPFW_UH_RUNLOCK(ch); 174 175 cfg = nat64clat_alloc_config(uc->name, uc->set); 176 cfg->base.plat_prefix = uc->plat_prefix; 177 cfg->base.plat_plen = uc->plat_plen; 178 cfg->base.clat_prefix = uc->clat_prefix; 179 cfg->base.clat_plen = uc->clat_plen; 180 cfg->base.flags = (uc->flags & NAT64CLAT_FLAGSMASK) | 181 NAT64_CLATPFX | NAT64_PLATPFX; 182 if (IN6_IS_ADDR_WKPFX(&cfg->base.plat_prefix)) 183 cfg->base.flags |= NAT64_WKPFX; 184 185 IPFW_UH_WLOCK(ch); 186 187 if (nat64clat_find(ni, uc->name, uc->set) != NULL) { 188 IPFW_UH_WUNLOCK(ch); 189 nat64clat_free_config(cfg); 190 return (EEXIST); 191 } 192 193 if (ipfw_objhash_alloc_idx(ni, &cfg->no.kidx) != 0) { 194 IPFW_UH_WUNLOCK(ch); 195 nat64clat_free_config(cfg); 196 return (ENOSPC); 197 } 198 ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no); 199 /* Okay, let's link data */ 200 SRV_OBJECT(ch, cfg->no.kidx) = cfg; 201 IPFW_UH_WUNLOCK(ch); 202 203 return (0); 204 } 205 206 /* 207 * Change existing nat64clat instance configuration. 208 * Data layout (v0)(current): 209 * Request: [ ipfw_obj_header ipfw_nat64clat_cfg ] 210 * Reply: [ ipfw_obj_header ipfw_nat64clat_cfg ] 211 * 212 * Returns 0 on success 213 */ 214 static int 215 nat64clat_config(struct ip_fw_chain *ch, ip_fw3_opheader *op, 216 struct sockopt_data *sd) 217 { 218 ipfw_obj_header *oh; 219 ipfw_nat64clat_cfg *uc; 220 struct nat64clat_cfg *cfg; 221 struct namedobj_instance *ni; 222 uint32_t flags; 223 224 if (sd->valsize != sizeof(*oh) + sizeof(*uc)) 225 return (EINVAL); 226 227 oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd, 228 sizeof(*oh) + sizeof(*uc)); 229 uc = (ipfw_nat64clat_cfg *)(oh + 1); 230 231 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 || 232 oh->ntlv.set >= IPFW_MAX_SETS) 233 return (EINVAL); 234 235 ni = CHAIN_TO_SRV(ch); 236 if (sd->sopt->sopt_dir == SOPT_GET) { 237 IPFW_UH_RLOCK(ch); 238 cfg = nat64clat_find(ni, oh->ntlv.name, oh->ntlv.set); 239 if (cfg == NULL) { 240 IPFW_UH_RUNLOCK(ch); 241 return (ENOENT); 242 } 243 nat64clat_export_config(ch, cfg, uc); 244 IPFW_UH_RUNLOCK(ch); 245 return (0); 246 } 247 248 IPFW_UH_WLOCK(ch); 249 cfg = nat64clat_find(ni, oh->ntlv.name, oh->ntlv.set); 250 if (cfg == NULL) { 251 IPFW_UH_WUNLOCK(ch); 252 return (ENOENT); 253 } 254 255 /* 256 * For now allow to change only following values: 257 * plat_prefix, plat_plen, clat_prefix, clat_plen, flags. 258 */ 259 flags = 0; 260 if (uc->plat_plen != cfg->base.plat_plen || 261 !IN6_ARE_ADDR_EQUAL(&uc->plat_prefix, &cfg->base.plat_prefix)) { 262 if (nat64_check_prefix6(&uc->plat_prefix, uc->plat_plen) != 0) { 263 IPFW_UH_WUNLOCK(ch); 264 return (EINVAL); 265 } 266 flags |= NAT64_PLATPFX; 267 } 268 269 if (uc->clat_plen != cfg->base.clat_plen || 270 !IN6_ARE_ADDR_EQUAL(&uc->clat_prefix, &cfg->base.clat_prefix)) { 271 if (nat64_check_prefix6(&uc->clat_prefix, uc->clat_plen) != 0) { 272 IPFW_UH_WUNLOCK(ch); 273 return (EINVAL); 274 } 275 flags |= NAT64_CLATPFX; 276 } 277 278 if (flags != 0) { 279 IPFW_WLOCK(ch); 280 if (flags & NAT64_PLATPFX) { 281 cfg->base.plat_prefix = uc->plat_prefix; 282 cfg->base.plat_plen = uc->plat_plen; 283 } 284 if (flags & NAT64_CLATPFX) { 285 cfg->base.clat_prefix = uc->clat_prefix; 286 cfg->base.clat_plen = uc->clat_plen; 287 } 288 IPFW_WUNLOCK(ch); 289 } 290 291 cfg->base.flags &= ~NAT64CLAT_FLAGSMASK; 292 cfg->base.flags |= uc->flags & NAT64CLAT_FLAGSMASK; 293 294 IPFW_UH_WUNLOCK(ch); 295 return (0); 296 } 297 298 static void 299 nat64clat_detach_config(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg) 300 { 301 302 IPFW_UH_WLOCK_ASSERT(ch); 303 304 ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no); 305 ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx); 306 } 307 308 /* 309 * Destroys nat64 instance. 310 * Data layout (v0)(current): 311 * Request: [ ipfw_obj_header ] 312 * 313 * Returns 0 on success 314 */ 315 static int 316 nat64clat_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 317 struct sockopt_data *sd) 318 { 319 ipfw_obj_header *oh; 320 struct nat64clat_cfg *cfg; 321 322 if (sd->valsize != sizeof(*oh)) 323 return (EINVAL); 324 325 oh = (ipfw_obj_header *)sd->kbuf; 326 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0) 327 return (EINVAL); 328 329 IPFW_UH_WLOCK(ch); 330 cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 331 if (cfg == NULL) { 332 IPFW_UH_WUNLOCK(ch); 333 return (ENOENT); 334 } 335 if (cfg->no.refcnt > 0) { 336 IPFW_UH_WUNLOCK(ch); 337 return (EBUSY); 338 } 339 340 ipfw_reset_eaction_instance(ch, V_nat64clat_eid, cfg->no.kidx); 341 SRV_OBJECT(ch, cfg->no.kidx) = NULL; 342 nat64clat_detach_config(ch, cfg); 343 IPFW_UH_WUNLOCK(ch); 344 345 nat64clat_free_config(cfg); 346 return (0); 347 } 348 349 /* 350 * Lists all nat64clat instances currently available in kernel. 351 * Data layout (v0)(current): 352 * Request: [ ipfw_obj_lheader ] 353 * Reply: [ ipfw_obj_lheader ipfw_nat64clat_cfg x N ] 354 * 355 * Returns 0 on success 356 */ 357 static int 358 nat64clat_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 359 struct sockopt_data *sd) 360 { 361 ipfw_obj_lheader *olh; 362 struct nat64clat_dump_arg da; 363 364 /* Check minimum header size */ 365 if (sd->valsize < sizeof(ipfw_obj_lheader)) 366 return (EINVAL); 367 368 olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh)); 369 370 IPFW_UH_RLOCK(ch); 371 olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch), 372 IPFW_TLV_NAT64CLAT_NAME); 373 olh->objsize = sizeof(ipfw_nat64clat_cfg); 374 olh->size = sizeof(*olh) + olh->count * olh->objsize; 375 376 if (sd->valsize < olh->size) { 377 IPFW_UH_RUNLOCK(ch); 378 return (ENOMEM); 379 } 380 memset(&da, 0, sizeof(da)); 381 da.ch = ch; 382 da.sd = sd; 383 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb, 384 &da, IPFW_TLV_NAT64CLAT_NAME); 385 IPFW_UH_RUNLOCK(ch); 386 387 return (0); 388 } 389 390 #define __COPY_STAT_FIELD(_cfg, _stats, _field) \ 391 (_stats)->_field = NAT64STAT_FETCH(&(_cfg)->base.stats, _field) 392 static void 393 export_stats(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg, 394 struct ipfw_nat64clat_stats *stats) 395 { 396 397 __COPY_STAT_FIELD(cfg, stats, opcnt64); 398 __COPY_STAT_FIELD(cfg, stats, opcnt46); 399 __COPY_STAT_FIELD(cfg, stats, ofrags); 400 __COPY_STAT_FIELD(cfg, stats, ifrags); 401 __COPY_STAT_FIELD(cfg, stats, oerrors); 402 __COPY_STAT_FIELD(cfg, stats, noroute4); 403 __COPY_STAT_FIELD(cfg, stats, noroute6); 404 __COPY_STAT_FIELD(cfg, stats, noproto); 405 __COPY_STAT_FIELD(cfg, stats, nomem); 406 __COPY_STAT_FIELD(cfg, stats, dropped); 407 } 408 409 /* 410 * Get nat64clat statistics. 411 * Data layout (v0)(current): 412 * Request: [ ipfw_obj_header ] 413 * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ]] 414 * 415 * Returns 0 on success 416 */ 417 static int 418 nat64clat_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op, 419 struct sockopt_data *sd) 420 { 421 struct ipfw_nat64clat_stats stats; 422 struct nat64clat_cfg *cfg; 423 ipfw_obj_header *oh; 424 ipfw_obj_ctlv *ctlv; 425 size_t sz; 426 427 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats); 428 if (sd->valsize % sizeof(uint64_t)) 429 return (EINVAL); 430 if (sd->valsize < sz) 431 return (ENOMEM); 432 oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 433 if (oh == NULL) 434 return (EINVAL); 435 memset(&stats, 0, sizeof(stats)); 436 437 IPFW_UH_RLOCK(ch); 438 cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 439 if (cfg == NULL) { 440 IPFW_UH_RUNLOCK(ch); 441 return (ENOENT); 442 } 443 export_stats(ch, cfg, &stats); 444 IPFW_UH_RUNLOCK(ch); 445 446 ctlv = (ipfw_obj_ctlv *)(oh + 1); 447 memset(ctlv, 0, sizeof(*ctlv)); 448 ctlv->head.type = IPFW_TLV_COUNTERS; 449 ctlv->head.length = sz - sizeof(ipfw_obj_header); 450 ctlv->count = sizeof(stats) / sizeof(uint64_t); 451 ctlv->objsize = sizeof(uint64_t); 452 ctlv->version = IPFW_NAT64_VERSION; 453 memcpy(ctlv + 1, &stats, sizeof(stats)); 454 return (0); 455 } 456 457 /* 458 * Reset nat64clat statistics. 459 * Data layout (v0)(current): 460 * Request: [ ipfw_obj_header ] 461 * 462 * Returns 0 on success 463 */ 464 static int 465 nat64clat_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op, 466 struct sockopt_data *sd) 467 { 468 struct nat64clat_cfg *cfg; 469 ipfw_obj_header *oh; 470 471 if (sd->valsize != sizeof(*oh)) 472 return (EINVAL); 473 oh = (ipfw_obj_header *)sd->kbuf; 474 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 || 475 oh->ntlv.set >= IPFW_MAX_SETS) 476 return (EINVAL); 477 478 IPFW_UH_WLOCK(ch); 479 cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 480 if (cfg == NULL) { 481 IPFW_UH_WUNLOCK(ch); 482 return (ENOENT); 483 } 484 COUNTER_ARRAY_ZERO(cfg->base.stats.cnt, NAT64STATS); 485 IPFW_UH_WUNLOCK(ch); 486 return (0); 487 } 488 489 static struct ipfw_sopt_handler scodes[] = { 490 491 { IP_FW_NAT64CLAT_CREATE, 0, HDIR_SET, nat64clat_create }, 492 { IP_FW_NAT64CLAT_DESTROY,0, HDIR_SET, nat64clat_destroy }, 493 { IP_FW_NAT64CLAT_CONFIG, 0, HDIR_BOTH, nat64clat_config }, 494 { IP_FW_NAT64CLAT_LIST, 0, HDIR_GET, nat64clat_list }, 495 { IP_FW_NAT64CLAT_STATS, 0, HDIR_GET, nat64clat_stats }, 496 { IP_FW_NAT64CLAT_RESET_STATS,0, HDIR_SET, nat64clat_reset_stats }, 497 }; 498 499 static int 500 nat64clat_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 501 { 502 ipfw_insn *icmd; 503 504 icmd = cmd - 1; 505 if (icmd->opcode != O_EXTERNAL_ACTION || 506 icmd->arg1 != V_nat64clat_eid) 507 return (1); 508 509 *puidx = cmd->arg1; 510 *ptype = 0; 511 return (0); 512 } 513 514 static void 515 nat64clat_update_arg1(ipfw_insn *cmd, uint16_t idx) 516 { 517 518 cmd->arg1 = idx; 519 } 520 521 static int 522 nat64clat_findbyname(struct ip_fw_chain *ch, struct tid_info *ti, 523 struct named_object **pno) 524 { 525 int err; 526 527 err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti, 528 IPFW_TLV_NAT64CLAT_NAME, pno); 529 return (err); 530 } 531 532 static struct named_object * 533 nat64clat_findbykidx(struct ip_fw_chain *ch, uint16_t idx) 534 { 535 struct namedobj_instance *ni; 536 struct named_object *no; 537 538 IPFW_UH_WLOCK_ASSERT(ch); 539 ni = CHAIN_TO_SRV(ch); 540 no = ipfw_objhash_lookup_kidx(ni, idx); 541 KASSERT(no != NULL, ("NAT with index %d not found", idx)); 542 543 return (no); 544 } 545 546 static int 547 nat64clat_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set, 548 enum ipfw_sets_cmd cmd) 549 { 550 551 return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64CLAT_NAME, 552 set, new_set, cmd)); 553 } 554 555 static struct opcode_obj_rewrite opcodes[] = { 556 { 557 .opcode = O_EXTERNAL_INSTANCE, 558 .etlv = IPFW_TLV_EACTION /* just show it isn't table */, 559 .classifier = nat64clat_classify, 560 .update = nat64clat_update_arg1, 561 .find_byname = nat64clat_findbyname, 562 .find_bykidx = nat64clat_findbykidx, 563 .manage_sets = nat64clat_manage_sets, 564 }, 565 }; 566 567 static int 568 destroy_config_cb(struct namedobj_instance *ni, struct named_object *no, 569 void *arg) 570 { 571 struct nat64clat_cfg *cfg; 572 struct ip_fw_chain *ch; 573 574 ch = (struct ip_fw_chain *)arg; 575 cfg = (struct nat64clat_cfg *)SRV_OBJECT(ch, no->kidx); 576 SRV_OBJECT(ch, no->kidx) = NULL; 577 nat64clat_detach_config(ch, cfg); 578 nat64clat_free_config(cfg); 579 return (0); 580 } 581 582 int 583 nat64clat_init(struct ip_fw_chain *ch, int first) 584 { 585 586 V_nat64clat_eid = ipfw_add_eaction(ch, ipfw_nat64clat, "nat64clat"); 587 if (V_nat64clat_eid == 0) 588 return (ENXIO); 589 IPFW_ADD_SOPT_HANDLER(first, scodes); 590 IPFW_ADD_OBJ_REWRITER(first, opcodes); 591 return (0); 592 } 593 594 void 595 nat64clat_uninit(struct ip_fw_chain *ch, int last) 596 { 597 598 IPFW_DEL_OBJ_REWRITER(last, opcodes); 599 IPFW_DEL_SOPT_HANDLER(last, scodes); 600 ipfw_del_eaction(ch, V_nat64clat_eid); 601 /* 602 * Since we already have deregistered external action, 603 * our named objects become unaccessible via rules, because 604 * all rules were truncated by ipfw_del_eaction(). 605 * So, we can unlink and destroy our named objects without holding 606 * IPFW_WLOCK(). 607 */ 608 IPFW_UH_WLOCK(ch); 609 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch, 610 IPFW_TLV_NAT64CLAT_NAME); 611 V_nat64clat_eid = 0; 612 IPFW_UH_WUNLOCK(ch); 613 } 614 615