1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2019 Yandex LLC
5 * Copyright (c) 2019 Andrey V. Elsukov <ae@FreeBSD.org>
6 * Copyright (c) 2019 Boris N. Lytochkin <lytboris@gmail.com>
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 */
29
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/counter.h>
33 #include <sys/errno.h>
34 #include <sys/kernel.h>
35 #include <sys/lock.h>
36 #include <sys/malloc.h>
37 #include <sys/mbuf.h>
38 #include <sys/module.h>
39 #include <sys/rmlock.h>
40 #include <sys/rwlock.h>
41 #include <sys/socket.h>
42 #include <sys/sockopt.h>
43 #include <sys/syslog.h>
44 #include <sys/sysctl.h>
45
46 #include <net/if.h>
47 #include <net/if_var.h>
48 #include <net/route.h>
49 #include <net/vnet.h>
50
51 #include <netinet/in.h>
52 #include <netinet/ip_var.h>
53 #include <netinet/ip_fw.h>
54 #include <netinet6/in6_var.h>
55 #include <netinet6/ip6_var.h>
56 #include <netinet6/ip_fw_nat64.h>
57
58 #include <netpfil/ipfw/ip_fw_private.h>
59
60 #include "nat64clat.h"
61
62 VNET_DEFINE(uint16_t, nat64clat_eid) = 0;
63
64 static struct nat64clat_cfg *nat64clat_alloc_config(const char *name,
65 uint8_t set);
66 static void nat64clat_free_config(struct nat64clat_cfg *cfg);
67 static struct nat64clat_cfg *nat64clat_find(struct namedobj_instance *ni,
68 const char *name, uint8_t set);
69
70 static struct nat64clat_cfg *
nat64clat_alloc_config(const char * name,uint8_t set)71 nat64clat_alloc_config(const char *name, uint8_t set)
72 {
73 struct nat64clat_cfg *cfg;
74
75 cfg = malloc(sizeof(struct nat64clat_cfg), M_IPFW, M_WAITOK | M_ZERO);
76 COUNTER_ARRAY_ALLOC(cfg->base.stats.cnt, NAT64STATS, M_WAITOK);
77 cfg->no.name = cfg->name;
78 cfg->no.etlv = IPFW_TLV_NAT64CLAT_NAME;
79 cfg->no.set = set;
80 strlcpy(cfg->name, name, sizeof(cfg->name));
81 return (cfg);
82 }
83
84 static void
nat64clat_free_config(struct nat64clat_cfg * cfg)85 nat64clat_free_config(struct nat64clat_cfg *cfg)
86 {
87
88 COUNTER_ARRAY_FREE(cfg->base.stats.cnt, NAT64STATS);
89 free(cfg, M_IPFW);
90 }
91
92 static void
nat64clat_export_config(struct ip_fw_chain * ch,struct nat64clat_cfg * cfg,ipfw_nat64clat_cfg * uc)93 nat64clat_export_config(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg,
94 ipfw_nat64clat_cfg *uc)
95 {
96 uc->plat_prefix = cfg->base.plat_prefix;
97 uc->plat_plen = cfg->base.plat_plen;
98 uc->clat_prefix = cfg->base.clat_prefix;
99 uc->clat_plen = cfg->base.clat_plen;
100 uc->flags = cfg->base.flags & NAT64CLAT_FLAGSMASK;
101 uc->set = cfg->no.set;
102 strlcpy(uc->name, cfg->no.name, sizeof(uc->name));
103 }
104
105 struct nat64clat_dump_arg {
106 struct ip_fw_chain *ch;
107 struct sockopt_data *sd;
108 };
109
110 static int
export_config_cb(struct namedobj_instance * ni,struct named_object * no,void * arg)111 export_config_cb(struct namedobj_instance *ni, struct named_object *no,
112 void *arg)
113 {
114 struct nat64clat_dump_arg *da = (struct nat64clat_dump_arg *)arg;
115 ipfw_nat64clat_cfg *uc;
116
117 uc = (ipfw_nat64clat_cfg *)ipfw_get_sopt_space(da->sd, sizeof(*uc));
118 nat64clat_export_config(da->ch, (struct nat64clat_cfg *)no, uc);
119 return (0);
120 }
121
122 static struct nat64clat_cfg *
nat64clat_find(struct namedobj_instance * ni,const char * name,uint8_t set)123 nat64clat_find(struct namedobj_instance *ni, const char *name, uint8_t set)
124 {
125 struct nat64clat_cfg *cfg;
126
127 cfg = (struct nat64clat_cfg *)ipfw_objhash_lookup_name_type(ni, set,
128 IPFW_TLV_NAT64CLAT_NAME, name);
129
130 return (cfg);
131 }
132
133 /*
134 * Creates new consumer-side nat64 translator instance.
135 * Data layout (v0)(current):
136 * Request: [ ipfw_obj_lheader ipfw_nat64clat_cfg ]
137 *
138 * Returns 0 on success
139 */
140 static int
nat64clat_create(struct ip_fw_chain * ch,ip_fw3_opheader * op3,struct sockopt_data * sd)141 nat64clat_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
142 struct sockopt_data *sd)
143 {
144 ipfw_obj_lheader *olh;
145 ipfw_nat64clat_cfg *uc;
146 struct namedobj_instance *ni;
147 struct nat64clat_cfg *cfg;
148
149 if (sd->valsize != sizeof(*olh) + sizeof(*uc))
150 return (EINVAL);
151
152 olh = (ipfw_obj_lheader *)sd->kbuf;
153 uc = (ipfw_nat64clat_cfg *)(olh + 1);
154
155 if (ipfw_check_object_name_generic(uc->name) != 0)
156 return (EINVAL);
157
158 if (uc->set >= IPFW_MAX_SETS ||
159 nat64_check_prefix6(&uc->plat_prefix, uc->plat_plen) != 0 ||
160 nat64_check_prefix6(&uc->clat_prefix, uc->clat_plen) != 0)
161 return (EINVAL);
162
163 ni = CHAIN_TO_SRV(ch);
164
165 IPFW_UH_RLOCK(ch);
166 if (nat64clat_find(ni, uc->name, uc->set) != NULL) {
167 IPFW_UH_RUNLOCK(ch);
168 return (EEXIST);
169 }
170 IPFW_UH_RUNLOCK(ch);
171
172 cfg = nat64clat_alloc_config(uc->name, uc->set);
173 cfg->base.plat_prefix = uc->plat_prefix;
174 cfg->base.plat_plen = uc->plat_plen;
175 cfg->base.clat_prefix = uc->clat_prefix;
176 cfg->base.clat_plen = uc->clat_plen;
177 cfg->base.flags = (uc->flags & NAT64CLAT_FLAGSMASK) |
178 NAT64_CLATPFX | NAT64_PLATPFX;
179 if (IN6_IS_ADDR_WKPFX(&cfg->base.plat_prefix))
180 cfg->base.flags |= NAT64_WKPFX;
181
182 IPFW_UH_WLOCK(ch);
183
184 if (nat64clat_find(ni, uc->name, uc->set) != NULL) {
185 IPFW_UH_WUNLOCK(ch);
186 nat64clat_free_config(cfg);
187 return (EEXIST);
188 }
189
190 if (ipfw_objhash_alloc_idx(ni, &cfg->no.kidx) != 0) {
191 IPFW_UH_WUNLOCK(ch);
192 nat64clat_free_config(cfg);
193 return (ENOSPC);
194 }
195 ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no);
196 /* Okay, let's link data */
197 SRV_OBJECT(ch, cfg->no.kidx) = cfg;
198 IPFW_UH_WUNLOCK(ch);
199
200 return (0);
201 }
202
203 /*
204 * Change existing nat64clat instance configuration.
205 * Data layout (v0)(current):
206 * Request: [ ipfw_obj_header ipfw_nat64clat_cfg ]
207 * Reply: [ ipfw_obj_header ipfw_nat64clat_cfg ]
208 *
209 * Returns 0 on success
210 */
211 static int
nat64clat_config(struct ip_fw_chain * ch,ip_fw3_opheader * op,struct sockopt_data * sd)212 nat64clat_config(struct ip_fw_chain *ch, ip_fw3_opheader *op,
213 struct sockopt_data *sd)
214 {
215 ipfw_obj_header *oh;
216 ipfw_nat64clat_cfg *uc;
217 struct nat64clat_cfg *cfg;
218 struct namedobj_instance *ni;
219 uint32_t flags;
220
221 if (sd->valsize != sizeof(*oh) + sizeof(*uc))
222 return (EINVAL);
223
224 oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd,
225 sizeof(*oh) + sizeof(*uc));
226 uc = (ipfw_nat64clat_cfg *)(oh + 1);
227
228 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
229 oh->ntlv.set >= IPFW_MAX_SETS)
230 return (EINVAL);
231
232 ni = CHAIN_TO_SRV(ch);
233 if (sd->sopt->sopt_dir == SOPT_GET) {
234 IPFW_UH_RLOCK(ch);
235 cfg = nat64clat_find(ni, oh->ntlv.name, oh->ntlv.set);
236 if (cfg == NULL) {
237 IPFW_UH_RUNLOCK(ch);
238 return (ENOENT);
239 }
240 nat64clat_export_config(ch, cfg, uc);
241 IPFW_UH_RUNLOCK(ch);
242 return (0);
243 }
244
245 IPFW_UH_WLOCK(ch);
246 cfg = nat64clat_find(ni, oh->ntlv.name, oh->ntlv.set);
247 if (cfg == NULL) {
248 IPFW_UH_WUNLOCK(ch);
249 return (ENOENT);
250 }
251
252 /*
253 * For now allow to change only following values:
254 * plat_prefix, plat_plen, clat_prefix, clat_plen, flags.
255 */
256 flags = 0;
257 if (uc->plat_plen != cfg->base.plat_plen ||
258 !IN6_ARE_ADDR_EQUAL(&uc->plat_prefix, &cfg->base.plat_prefix)) {
259 if (nat64_check_prefix6(&uc->plat_prefix, uc->plat_plen) != 0) {
260 IPFW_UH_WUNLOCK(ch);
261 return (EINVAL);
262 }
263 flags |= NAT64_PLATPFX;
264 }
265
266 if (uc->clat_plen != cfg->base.clat_plen ||
267 !IN6_ARE_ADDR_EQUAL(&uc->clat_prefix, &cfg->base.clat_prefix)) {
268 if (nat64_check_prefix6(&uc->clat_prefix, uc->clat_plen) != 0) {
269 IPFW_UH_WUNLOCK(ch);
270 return (EINVAL);
271 }
272 flags |= NAT64_CLATPFX;
273 }
274
275 if (flags != 0) {
276 IPFW_WLOCK(ch);
277 if (flags & NAT64_PLATPFX) {
278 cfg->base.plat_prefix = uc->plat_prefix;
279 cfg->base.plat_plen = uc->plat_plen;
280 }
281 if (flags & NAT64_CLATPFX) {
282 cfg->base.clat_prefix = uc->clat_prefix;
283 cfg->base.clat_plen = uc->clat_plen;
284 }
285 IPFW_WUNLOCK(ch);
286 }
287
288 cfg->base.flags &= ~NAT64CLAT_FLAGSMASK;
289 cfg->base.flags |= uc->flags & NAT64CLAT_FLAGSMASK;
290
291 IPFW_UH_WUNLOCK(ch);
292 return (0);
293 }
294
295 static void
nat64clat_detach_config(struct ip_fw_chain * ch,struct nat64clat_cfg * cfg)296 nat64clat_detach_config(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg)
297 {
298
299 IPFW_UH_WLOCK_ASSERT(ch);
300
301 ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no);
302 ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx);
303 }
304
305 /*
306 * Destroys nat64 instance.
307 * Data layout (v0)(current):
308 * Request: [ ipfw_obj_header ]
309 *
310 * Returns 0 on success
311 */
312 static int
nat64clat_destroy(struct ip_fw_chain * ch,ip_fw3_opheader * op3,struct sockopt_data * sd)313 nat64clat_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
314 struct sockopt_data *sd)
315 {
316 ipfw_obj_header *oh;
317 struct nat64clat_cfg *cfg;
318
319 if (sd->valsize != sizeof(*oh))
320 return (EINVAL);
321
322 oh = (ipfw_obj_header *)sd->kbuf;
323 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0)
324 return (EINVAL);
325
326 IPFW_UH_WLOCK(ch);
327 cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
328 if (cfg == NULL) {
329 IPFW_UH_WUNLOCK(ch);
330 return (ENOENT);
331 }
332 if (cfg->no.refcnt > 0) {
333 IPFW_UH_WUNLOCK(ch);
334 return (EBUSY);
335 }
336
337 ipfw_reset_eaction_instance(ch, V_nat64clat_eid, cfg->no.kidx);
338 SRV_OBJECT(ch, cfg->no.kidx) = NULL;
339 nat64clat_detach_config(ch, cfg);
340 IPFW_UH_WUNLOCK(ch);
341
342 nat64clat_free_config(cfg);
343 return (0);
344 }
345
346 /*
347 * Lists all nat64clat instances currently available in kernel.
348 * Data layout (v0)(current):
349 * Request: [ ipfw_obj_lheader ]
350 * Reply: [ ipfw_obj_lheader ipfw_nat64clat_cfg x N ]
351 *
352 * Returns 0 on success
353 */
354 static int
nat64clat_list(struct ip_fw_chain * ch,ip_fw3_opheader * op3,struct sockopt_data * sd)355 nat64clat_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
356 struct sockopt_data *sd)
357 {
358 ipfw_obj_lheader *olh;
359 struct nat64clat_dump_arg da;
360
361 /* Check minimum header size */
362 if (sd->valsize < sizeof(ipfw_obj_lheader))
363 return (EINVAL);
364
365 olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh));
366
367 IPFW_UH_RLOCK(ch);
368 olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch),
369 IPFW_TLV_NAT64CLAT_NAME);
370 olh->objsize = sizeof(ipfw_nat64clat_cfg);
371 olh->size = sizeof(*olh) + olh->count * olh->objsize;
372
373 if (sd->valsize < olh->size) {
374 IPFW_UH_RUNLOCK(ch);
375 return (ENOMEM);
376 }
377 memset(&da, 0, sizeof(da));
378 da.ch = ch;
379 da.sd = sd;
380 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb,
381 &da, IPFW_TLV_NAT64CLAT_NAME);
382 IPFW_UH_RUNLOCK(ch);
383
384 return (0);
385 }
386
387 #define __COPY_STAT_FIELD(_cfg, _stats, _field) \
388 (_stats)->_field = NAT64STAT_FETCH(&(_cfg)->base.stats, _field)
389 static void
export_stats(struct ip_fw_chain * ch,struct nat64clat_cfg * cfg,struct ipfw_nat64clat_stats * stats)390 export_stats(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg,
391 struct ipfw_nat64clat_stats *stats)
392 {
393
394 __COPY_STAT_FIELD(cfg, stats, opcnt64);
395 __COPY_STAT_FIELD(cfg, stats, opcnt46);
396 __COPY_STAT_FIELD(cfg, stats, ofrags);
397 __COPY_STAT_FIELD(cfg, stats, ifrags);
398 __COPY_STAT_FIELD(cfg, stats, oerrors);
399 __COPY_STAT_FIELD(cfg, stats, noroute4);
400 __COPY_STAT_FIELD(cfg, stats, noroute6);
401 __COPY_STAT_FIELD(cfg, stats, noproto);
402 __COPY_STAT_FIELD(cfg, stats, nomem);
403 __COPY_STAT_FIELD(cfg, stats, dropped);
404 }
405
406 /*
407 * Get nat64clat statistics.
408 * Data layout (v0)(current):
409 * Request: [ ipfw_obj_header ]
410 * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ]]
411 *
412 * Returns 0 on success
413 */
414 static int
nat64clat_stats(struct ip_fw_chain * ch,ip_fw3_opheader * op,struct sockopt_data * sd)415 nat64clat_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
416 struct sockopt_data *sd)
417 {
418 struct ipfw_nat64clat_stats stats;
419 struct nat64clat_cfg *cfg;
420 ipfw_obj_header *oh;
421 ipfw_obj_ctlv *ctlv;
422 size_t sz;
423
424 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats);
425 if (sd->valsize % sizeof(uint64_t))
426 return (EINVAL);
427 if (sd->valsize < sz)
428 return (ENOMEM);
429 oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
430 if (oh == NULL)
431 return (EINVAL);
432 memset(&stats, 0, sizeof(stats));
433
434 IPFW_UH_RLOCK(ch);
435 cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
436 if (cfg == NULL) {
437 IPFW_UH_RUNLOCK(ch);
438 return (ENOENT);
439 }
440 export_stats(ch, cfg, &stats);
441 IPFW_UH_RUNLOCK(ch);
442
443 ctlv = (ipfw_obj_ctlv *)(oh + 1);
444 memset(ctlv, 0, sizeof(*ctlv));
445 ctlv->head.type = IPFW_TLV_COUNTERS;
446 ctlv->head.length = sz - sizeof(ipfw_obj_header);
447 ctlv->count = sizeof(stats) / sizeof(uint64_t);
448 ctlv->objsize = sizeof(uint64_t);
449 ctlv->version = IPFW_NAT64_VERSION;
450 memcpy(ctlv + 1, &stats, sizeof(stats));
451 return (0);
452 }
453
454 /*
455 * Reset nat64clat statistics.
456 * Data layout (v0)(current):
457 * Request: [ ipfw_obj_header ]
458 *
459 * Returns 0 on success
460 */
461 static int
nat64clat_reset_stats(struct ip_fw_chain * ch,ip_fw3_opheader * op,struct sockopt_data * sd)462 nat64clat_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
463 struct sockopt_data *sd)
464 {
465 struct nat64clat_cfg *cfg;
466 ipfw_obj_header *oh;
467
468 if (sd->valsize != sizeof(*oh))
469 return (EINVAL);
470 oh = (ipfw_obj_header *)sd->kbuf;
471 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
472 oh->ntlv.set >= IPFW_MAX_SETS)
473 return (EINVAL);
474
475 IPFW_UH_WLOCK(ch);
476 cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
477 if (cfg == NULL) {
478 IPFW_UH_WUNLOCK(ch);
479 return (ENOENT);
480 }
481 COUNTER_ARRAY_ZERO(cfg->base.stats.cnt, NAT64STATS);
482 IPFW_UH_WUNLOCK(ch);
483 return (0);
484 }
485
486 static struct ipfw_sopt_handler scodes[] = {
487 { IP_FW_NAT64CLAT_CREATE, 0, HDIR_SET, nat64clat_create },
488 { IP_FW_NAT64CLAT_DESTROY,0, HDIR_SET, nat64clat_destroy },
489 { IP_FW_NAT64CLAT_CONFIG, 0, HDIR_BOTH, nat64clat_config },
490 { IP_FW_NAT64CLAT_LIST, 0, HDIR_GET, nat64clat_list },
491 { IP_FW_NAT64CLAT_STATS, 0, HDIR_GET, nat64clat_stats },
492 { IP_FW_NAT64CLAT_RESET_STATS,0, HDIR_SET, nat64clat_reset_stats },
493 };
494
495 static int
nat64clat_classify(ipfw_insn * cmd,uint16_t * puidx,uint8_t * ptype)496 nat64clat_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
497 {
498 ipfw_insn *icmd;
499
500 icmd = cmd - 1;
501 if (icmd->opcode != O_EXTERNAL_ACTION ||
502 icmd->arg1 != V_nat64clat_eid)
503 return (1);
504
505 *puidx = cmd->arg1;
506 *ptype = 0;
507 return (0);
508 }
509
510 static void
nat64clat_update_arg1(ipfw_insn * cmd,uint16_t idx)511 nat64clat_update_arg1(ipfw_insn *cmd, uint16_t idx)
512 {
513
514 cmd->arg1 = idx;
515 }
516
517 static int
nat64clat_findbyname(struct ip_fw_chain * ch,struct tid_info * ti,struct named_object ** pno)518 nat64clat_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
519 struct named_object **pno)
520 {
521 int err;
522
523 err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti,
524 IPFW_TLV_NAT64CLAT_NAME, pno);
525 return (err);
526 }
527
528 static struct named_object *
nat64clat_findbykidx(struct ip_fw_chain * ch,uint16_t idx)529 nat64clat_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
530 {
531 struct namedobj_instance *ni;
532 struct named_object *no;
533
534 IPFW_UH_WLOCK_ASSERT(ch);
535 ni = CHAIN_TO_SRV(ch);
536 no = ipfw_objhash_lookup_kidx(ni, idx);
537 KASSERT(no != NULL, ("NAT with index %d not found", idx));
538
539 return (no);
540 }
541
542 static int
nat64clat_manage_sets(struct ip_fw_chain * ch,uint16_t set,uint8_t new_set,enum ipfw_sets_cmd cmd)543 nat64clat_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
544 enum ipfw_sets_cmd cmd)
545 {
546
547 return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64CLAT_NAME,
548 set, new_set, cmd));
549 }
550
551 static struct opcode_obj_rewrite opcodes[] = {
552 {
553 .opcode = O_EXTERNAL_INSTANCE,
554 .etlv = IPFW_TLV_EACTION /* just show it isn't table */,
555 .classifier = nat64clat_classify,
556 .update = nat64clat_update_arg1,
557 .find_byname = nat64clat_findbyname,
558 .find_bykidx = nat64clat_findbykidx,
559 .manage_sets = nat64clat_manage_sets,
560 },
561 };
562
563 static int
destroy_config_cb(struct namedobj_instance * ni,struct named_object * no,void * arg)564 destroy_config_cb(struct namedobj_instance *ni, struct named_object *no,
565 void *arg)
566 {
567 struct nat64clat_cfg *cfg;
568 struct ip_fw_chain *ch;
569
570 ch = (struct ip_fw_chain *)arg;
571 cfg = (struct nat64clat_cfg *)SRV_OBJECT(ch, no->kidx);
572 SRV_OBJECT(ch, no->kidx) = NULL;
573 nat64clat_detach_config(ch, cfg);
574 nat64clat_free_config(cfg);
575 return (0);
576 }
577
578 int
nat64clat_init(struct ip_fw_chain * ch,int first)579 nat64clat_init(struct ip_fw_chain *ch, int first)
580 {
581
582 V_nat64clat_eid = ipfw_add_eaction(ch, ipfw_nat64clat, "nat64clat");
583 if (V_nat64clat_eid == 0)
584 return (ENXIO);
585 IPFW_ADD_SOPT_HANDLER(first, scodes);
586 IPFW_ADD_OBJ_REWRITER(first, opcodes);
587 return (0);
588 }
589
590 void
nat64clat_uninit(struct ip_fw_chain * ch,int last)591 nat64clat_uninit(struct ip_fw_chain *ch, int last)
592 {
593
594 IPFW_DEL_OBJ_REWRITER(last, opcodes);
595 IPFW_DEL_SOPT_HANDLER(last, scodes);
596 ipfw_del_eaction(ch, V_nat64clat_eid);
597 /*
598 * Since we already have deregistered external action,
599 * our named objects become unaccessible via rules, because
600 * all rules were truncated by ipfw_del_eaction().
601 * So, we can unlink and destroy our named objects without holding
602 * IPFW_WLOCK().
603 */
604 IPFW_UH_WLOCK(ch);
605 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch,
606 IPFW_TLV_NAT64CLAT_NAME);
607 V_nat64clat_eid = 0;
608 IPFW_UH_WUNLOCK(ch);
609 }
610