xref: /freebsd/sys/netpfil/ipfw/ip_fw_nat.c (revision 25408c853d9ecb2e76b9e38407338f86ecb8a55c)
1 /*-
2  * Copyright (c) 2008 Paolo Pisati
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/eventhandler.h>
33 #include <sys/malloc.h>
34 #include <sys/kernel.h>
35 #include <sys/lock.h>
36 #include <sys/module.h>
37 #include <sys/rwlock.h>
38 
39 #define        IPFW_INTERNAL   /* Access to protected data structures in ip_fw.h. */
40 
41 #include <netinet/libalias/alias.h>
42 #include <netinet/libalias/alias_local.h>
43 
44 #include <net/if.h>
45 #include <netinet/in.h>
46 #include <netinet/ip.h>
47 #include <netinet/ip_var.h>
48 #include <netinet/ip_fw.h>
49 #include <netinet/tcp.h>
50 #include <netinet/udp.h>
51 
52 #include <netpfil/ipfw/ip_fw_private.h>
53 
54 #include <machine/in_cksum.h>	/* XXX for in_cksum */
55 
56 static VNET_DEFINE(eventhandler_tag, ifaddr_event_tag);
57 #define	V_ifaddr_event_tag	VNET(ifaddr_event_tag)
58 
59 static void
60 ifaddr_change(void *arg __unused, struct ifnet *ifp)
61 {
62 	struct cfg_nat *ptr;
63 	struct ifaddr *ifa;
64 	struct ip_fw_chain *chain;
65 
66 	chain = &V_layer3_chain;
67 	IPFW_WLOCK(chain);
68 	/* Check every nat entry... */
69 	LIST_FOREACH(ptr, &chain->nat, _next) {
70 		/* ...using nic 'ifp->if_xname' as dynamic alias address. */
71 		if (strncmp(ptr->if_name, ifp->if_xname, IF_NAMESIZE) != 0)
72 			continue;
73 		if_addr_rlock(ifp);
74 		TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
75 			if (ifa->ifa_addr == NULL)
76 				continue;
77 			if (ifa->ifa_addr->sa_family != AF_INET)
78 				continue;
79 			ptr->ip = ((struct sockaddr_in *)
80 			    (ifa->ifa_addr))->sin_addr;
81 			LibAliasSetAddress(ptr->lib, ptr->ip);
82 		}
83 		if_addr_runlock(ifp);
84 	}
85 	IPFW_WUNLOCK(chain);
86 }
87 
88 /*
89  * delete the pointers for nat entry ix, or all of them if ix < 0
90  */
91 static void
92 flush_nat_ptrs(struct ip_fw_chain *chain, const int ix)
93 {
94 	int i;
95 	ipfw_insn_nat *cmd;
96 
97 	IPFW_WLOCK_ASSERT(chain);
98 	for (i = 0; i < chain->n_rules; i++) {
99 		cmd = (ipfw_insn_nat *)ACTION_PTR(chain->map[i]);
100 		/* XXX skip log and the like ? */
101 		if (cmd->o.opcode == O_NAT && cmd->nat != NULL &&
102 			    (ix < 0 || cmd->nat->id == ix))
103 			cmd->nat = NULL;
104 	}
105 }
106 
107 static void
108 del_redir_spool_cfg(struct cfg_nat *n, struct redir_chain *head)
109 {
110 	struct cfg_redir *r, *tmp_r;
111 	struct cfg_spool *s, *tmp_s;
112 	int i, num;
113 
114 	LIST_FOREACH_SAFE(r, head, _next, tmp_r) {
115 		num = 1; /* Number of alias_link to delete. */
116 		switch (r->mode) {
117 		case REDIR_PORT:
118 			num = r->pport_cnt;
119 			/* FALLTHROUGH */
120 		case REDIR_ADDR:
121 		case REDIR_PROTO:
122 			/* Delete all libalias redirect entry. */
123 			for (i = 0; i < num; i++)
124 				LibAliasRedirectDelete(n->lib, r->alink[i]);
125 			/* Del spool cfg if any. */
126 			LIST_FOREACH_SAFE(s, &r->spool_chain, _next, tmp_s) {
127 				LIST_REMOVE(s, _next);
128 				free(s, M_IPFW);
129 			}
130 			free(r->alink, M_IPFW);
131 			LIST_REMOVE(r, _next);
132 			free(r, M_IPFW);
133 			break;
134 		default:
135 			printf("unknown redirect mode: %u\n", r->mode);
136 			/* XXX - panic?!?!? */
137 			break;
138 		}
139 	}
140 }
141 
142 static void
143 add_redir_spool_cfg(char *buf, struct cfg_nat *ptr)
144 {
145 	struct cfg_redir *r, *ser_r;
146 	struct cfg_spool *s, *ser_s;
147 	int cnt, off, i;
148 
149 	for (cnt = 0, off = 0; cnt < ptr->redir_cnt; cnt++) {
150 		ser_r = (struct cfg_redir *)&buf[off];
151 		r = malloc(SOF_REDIR, M_IPFW, M_WAITOK | M_ZERO);
152 		memcpy(r, ser_r, SOF_REDIR);
153 		LIST_INIT(&r->spool_chain);
154 		off += SOF_REDIR;
155 		r->alink = malloc(sizeof(struct alias_link *) * r->pport_cnt,
156 		    M_IPFW, M_WAITOK | M_ZERO);
157 		switch (r->mode) {
158 		case REDIR_ADDR:
159 			r->alink[0] = LibAliasRedirectAddr(ptr->lib, r->laddr,
160 			    r->paddr);
161 			break;
162 		case REDIR_PORT:
163 			for (i = 0 ; i < r->pport_cnt; i++) {
164 				/* If remotePort is all ports, set it to 0. */
165 				u_short remotePortCopy = r->rport + i;
166 				if (r->rport_cnt == 1 && r->rport == 0)
167 					remotePortCopy = 0;
168 				r->alink[i] = LibAliasRedirectPort(ptr->lib,
169 				    r->laddr, htons(r->lport + i), r->raddr,
170 				    htons(remotePortCopy), r->paddr,
171 				    htons(r->pport + i), r->proto);
172 				if (r->alink[i] == NULL) {
173 					r->alink[0] = NULL;
174 					break;
175 				}
176 			}
177 			break;
178 		case REDIR_PROTO:
179 			r->alink[0] = LibAliasRedirectProto(ptr->lib ,r->laddr,
180 			    r->raddr, r->paddr, r->proto);
181 			break;
182 		default:
183 			printf("unknown redirect mode: %u\n", r->mode);
184 			break;
185 		}
186 		/* XXX perhaps return an error instead of panic ? */
187 		if (r->alink[0] == NULL)
188 			panic("LibAliasRedirect* returned NULL");
189 		/* LSNAT handling. */
190 		for (i = 0; i < r->spool_cnt; i++) {
191 			ser_s = (struct cfg_spool *)&buf[off];
192 			s = malloc(SOF_REDIR, M_IPFW, M_WAITOK | M_ZERO);
193 			memcpy(s, ser_s, SOF_SPOOL);
194 			LibAliasAddServer(ptr->lib, r->alink[0],
195 			    s->addr, htons(s->port));
196 			off += SOF_SPOOL;
197 			/* Hook spool entry. */
198 			LIST_INSERT_HEAD(&r->spool_chain, s, _next);
199 		}
200 		/* And finally hook this redir entry. */
201 		LIST_INSERT_HEAD(&ptr->redir_chain, r, _next);
202 	}
203 }
204 
205 static int
206 ipfw_nat(struct ip_fw_args *args, struct cfg_nat *t, struct mbuf *m)
207 {
208 	struct mbuf *mcl;
209 	struct ip *ip;
210 	/* XXX - libalias duct tape */
211 	int ldt, retval, found;
212 	struct ip_fw_chain *chain;
213 	char *c;
214 
215 	ldt = 0;
216 	retval = 0;
217 	mcl = m_megapullup(m, m->m_pkthdr.len);
218 	if (mcl == NULL) {
219 		args->m = NULL;
220 		return (IP_FW_DENY);
221 	}
222 	ip = mtod(mcl, struct ip *);
223 
224 	/*
225 	 * XXX - Libalias checksum offload 'duct tape':
226 	 *
227 	 * locally generated packets have only pseudo-header checksum
228 	 * calculated and libalias will break it[1], so mark them for
229 	 * later fix.  Moreover there are cases when libalias modifies
230 	 * tcp packet data[2], mark them for later fix too.
231 	 *
232 	 * [1] libalias was never meant to run in kernel, so it does
233 	 * not have any knowledge about checksum offloading, and
234 	 * expects a packet with a full internet checksum.
235 	 * Unfortunately, packets generated locally will have just the
236 	 * pseudo header calculated, and when libalias tries to adjust
237 	 * the checksum it will actually compute a wrong value.
238 	 *
239 	 * [2] when libalias modifies tcp's data content, full TCP
240 	 * checksum has to be recomputed: the problem is that
241 	 * libalias does not have any idea about checksum offloading.
242 	 * To work around this, we do not do checksumming in LibAlias,
243 	 * but only mark the packets in th_x2 field. If we receive a
244 	 * marked packet, we calculate correct checksum for it
245 	 * aware of offloading.  Why such a terrible hack instead of
246 	 * recalculating checksum for each packet?
247 	 * Because the previous checksum was not checked!
248 	 * Recalculating checksums for EVERY packet will hide ALL
249 	 * transmission errors. Yes, marked packets still suffer from
250 	 * this problem. But, sigh, natd(8) has this problem, too.
251 	 *
252 	 * TODO: -make libalias mbuf aware (so
253 	 * it can handle delayed checksum and tso)
254 	 */
255 
256 	if (mcl->m_pkthdr.rcvif == NULL &&
257 	    mcl->m_pkthdr.csum_flags & CSUM_DELAY_DATA)
258 		ldt = 1;
259 
260 	c = mtod(mcl, char *);
261 
262 	/* Check if this is 'global' instance */
263 	if (t == NULL) {
264 		if (args->oif == NULL) {
265 			/* Wrong direction, skip processing */
266 			args->m = mcl;
267 			return (IP_FW_NAT);
268 		}
269 
270 		found = 0;
271 		chain = &V_layer3_chain;
272 		IPFW_RLOCK(chain);
273 		/* Check every nat entry... */
274 		LIST_FOREACH(t, &chain->nat, _next) {
275 			if ((t->mode & PKT_ALIAS_SKIP_GLOBAL) != 0)
276 				continue;
277 			retval = LibAliasOutTry(t->lib, c,
278 			    mcl->m_len + M_TRAILINGSPACE(mcl), 0);
279 			if (retval == PKT_ALIAS_OK) {
280 				/* Nat instance recognises state */
281 				found = 1;
282 				break;
283 			}
284 		}
285 		IPFW_RUNLOCK(chain);
286 		if (found != 1) {
287 			/* No instance found, return ignore */
288 			args->m = mcl;
289 			return (IP_FW_NAT);
290 		}
291 	} else {
292 		if (args->oif == NULL)
293 			retval = LibAliasIn(t->lib, c,
294 				mcl->m_len + M_TRAILINGSPACE(mcl));
295 		else
296 			retval = LibAliasOut(t->lib, c,
297 				mcl->m_len + M_TRAILINGSPACE(mcl));
298 	}
299 
300 	/*
301 	 * We drop packet when:
302 	 * 1. libalias returns PKT_ALIAS_ERROR;
303 	 * 2. For incoming packets:
304 	 *	a) for unresolved fragments;
305 	 *	b) libalias returns PKT_ALIAS_IGNORED and
306 	 *		PKT_ALIAS_DENY_INCOMING flag is set.
307 	 */
308 	if (retval == PKT_ALIAS_ERROR ||
309 	    (args->oif == NULL && (retval == PKT_ALIAS_UNRESOLVED_FRAGMENT ||
310 	    (retval == PKT_ALIAS_IGNORED &&
311 	    (t->mode & PKT_ALIAS_DENY_INCOMING) != 0)))) {
312 		/* XXX - should i add some logging? */
313 		m_free(mcl);
314 		args->m = NULL;
315 		return (IP_FW_DENY);
316 	}
317 
318 	if (retval == PKT_ALIAS_RESPOND)
319 		mcl->m_flags |= M_SKIP_FIREWALL;
320 	mcl->m_pkthdr.len = mcl->m_len = ntohs(ip->ip_len);
321 
322 	/*
323 	 * XXX - libalias checksum offload
324 	 * 'duct tape' (see above)
325 	 */
326 
327 	if ((ip->ip_off & htons(IP_OFFMASK)) == 0 &&
328 	    ip->ip_p == IPPROTO_TCP) {
329 		struct tcphdr 	*th;
330 
331 		th = (struct tcphdr *)(ip + 1);
332 		if (th->th_x2)
333 			ldt = 1;
334 	}
335 
336 	if (ldt) {
337 		struct tcphdr 	*th;
338 		struct udphdr 	*uh;
339 		uint16_t ip_len, cksum;
340 
341 		ip_len = ntohs(ip->ip_len);
342 		cksum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
343 		    htons(ip->ip_p + ip_len - (ip->ip_hl << 2)));
344 
345 		switch (ip->ip_p) {
346 		case IPPROTO_TCP:
347 			th = (struct tcphdr *)(ip + 1);
348 			/*
349 			 * Maybe it was set in
350 			 * libalias...
351 			 */
352 			th->th_x2 = 0;
353 			th->th_sum = cksum;
354 			mcl->m_pkthdr.csum_data =
355 			    offsetof(struct tcphdr, th_sum);
356 			break;
357 		case IPPROTO_UDP:
358 			uh = (struct udphdr *)(ip + 1);
359 			uh->uh_sum = cksum;
360 			mcl->m_pkthdr.csum_data =
361 			    offsetof(struct udphdr, uh_sum);
362 			break;
363 		}
364 		/* No hw checksum offloading: do it ourselves */
365 		if ((mcl->m_pkthdr.csum_flags & CSUM_DELAY_DATA) == 0) {
366 			in_delayed_cksum(mcl);
367 			mcl->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
368 		}
369 	}
370 	args->m = mcl;
371 	return (IP_FW_NAT);
372 }
373 
374 static struct cfg_nat *
375 lookup_nat(struct nat_list *l, int nat_id)
376 {
377 	struct cfg_nat *res;
378 
379 	LIST_FOREACH(res, l, _next) {
380 		if (res->id == nat_id)
381 			break;
382 	}
383 	return res;
384 }
385 
386 static int
387 ipfw_nat_cfg(struct sockopt *sopt)
388 {
389 	struct cfg_nat *cfg, *ptr;
390 	char *buf;
391 	struct ip_fw_chain *chain = &V_layer3_chain;
392 	size_t len;
393 	int gencnt, error = 0;
394 
395 	len = sopt->sopt_valsize;
396 	buf = malloc(len, M_TEMP, M_WAITOK | M_ZERO);
397 	if ((error = sooptcopyin(sopt, buf, len, sizeof(struct cfg_nat))) != 0)
398 		goto out;
399 
400 	cfg = (struct cfg_nat *)buf;
401 	if (cfg->id < 0) {
402 		error = EINVAL;
403 		goto out;
404 	}
405 
406 	/*
407 	 * Find/create nat rule.
408 	 */
409 	IPFW_WLOCK(chain);
410 	gencnt = chain->gencnt;
411 	ptr = lookup_nat(&chain->nat, cfg->id);
412 	if (ptr == NULL) {
413 		IPFW_WUNLOCK(chain);
414 		/* New rule: allocate and init new instance. */
415 		ptr = malloc(sizeof(struct cfg_nat), M_IPFW, M_WAITOK | M_ZERO);
416 		ptr->lib = LibAliasInit(NULL);
417 		LIST_INIT(&ptr->redir_chain);
418 	} else {
419 		/* Entry already present: temporarily unhook it. */
420 		LIST_REMOVE(ptr, _next);
421 		flush_nat_ptrs(chain, cfg->id);
422 		IPFW_WUNLOCK(chain);
423 	}
424 
425 	/*
426 	 * Basic nat configuration.
427 	 */
428 	ptr->id = cfg->id;
429 	/*
430 	 * XXX - what if this rule doesn't nat any ip and just
431 	 * redirect?
432 	 * do we set aliasaddress to 0.0.0.0?
433 	 */
434 	ptr->ip = cfg->ip;
435 	ptr->redir_cnt = cfg->redir_cnt;
436 	ptr->mode = cfg->mode;
437 	LibAliasSetMode(ptr->lib, cfg->mode, cfg->mode);
438 	LibAliasSetAddress(ptr->lib, ptr->ip);
439 	memcpy(ptr->if_name, cfg->if_name, IF_NAMESIZE);
440 
441 	/*
442 	 * Redir and LSNAT configuration.
443 	 */
444 	/* Delete old cfgs. */
445 	del_redir_spool_cfg(ptr, &ptr->redir_chain);
446 	/* Add new entries. */
447 	add_redir_spool_cfg(&buf[(sizeof(struct cfg_nat))], ptr);
448 
449 	IPFW_WLOCK(chain);
450 	/* Extra check to avoid race with another ipfw_nat_cfg() */
451 	if (gencnt != chain->gencnt &&
452 	    ((cfg = lookup_nat(&chain->nat, ptr->id)) != NULL))
453 		LIST_REMOVE(cfg, _next);
454 	LIST_INSERT_HEAD(&chain->nat, ptr, _next);
455 	chain->gencnt++;
456 	IPFW_WUNLOCK(chain);
457 
458 out:
459 	free(buf, M_TEMP);
460 	return (error);
461 }
462 
463 static int
464 ipfw_nat_del(struct sockopt *sopt)
465 {
466 	struct cfg_nat *ptr;
467 	struct ip_fw_chain *chain = &V_layer3_chain;
468 	int i;
469 
470 	sooptcopyin(sopt, &i, sizeof i, sizeof i);
471 	/* XXX validate i */
472 	IPFW_WLOCK(chain);
473 	ptr = lookup_nat(&chain->nat, i);
474 	if (ptr == NULL) {
475 		IPFW_WUNLOCK(chain);
476 		return (EINVAL);
477 	}
478 	LIST_REMOVE(ptr, _next);
479 	flush_nat_ptrs(chain, i);
480 	IPFW_WUNLOCK(chain);
481 	del_redir_spool_cfg(ptr, &ptr->redir_chain);
482 	LibAliasUninit(ptr->lib);
483 	free(ptr, M_IPFW);
484 	return (0);
485 }
486 
487 static int
488 ipfw_nat_get_cfg(struct sockopt *sopt)
489 {
490 	struct ip_fw_chain *chain = &V_layer3_chain;
491 	struct cfg_nat *n;
492 	struct cfg_redir *r;
493 	struct cfg_spool *s;
494 	char *data;
495 	int gencnt, nat_cnt, len, error;
496 
497 	nat_cnt = 0;
498 	len = sizeof(nat_cnt);
499 
500 	IPFW_RLOCK(chain);
501 retry:
502 	gencnt = chain->gencnt;
503 	/* Estimate memory amount */
504 	LIST_FOREACH(n, &chain->nat, _next) {
505 		nat_cnt++;
506 		len += sizeof(struct cfg_nat);
507 		LIST_FOREACH(r, &n->redir_chain, _next) {
508 			len += sizeof(struct cfg_redir);
509 			LIST_FOREACH(s, &r->spool_chain, _next)
510 				len += sizeof(struct cfg_spool);
511 		}
512 	}
513 	IPFW_RUNLOCK(chain);
514 
515 	data = malloc(len, M_TEMP, M_WAITOK | M_ZERO);
516 	bcopy(&nat_cnt, data, sizeof(nat_cnt));
517 
518 	nat_cnt = 0;
519 	len = sizeof(nat_cnt);
520 
521 	IPFW_RLOCK(chain);
522 	if (gencnt != chain->gencnt) {
523 		free(data, M_TEMP);
524 		goto retry;
525 	}
526 	/* Serialize all the data. */
527 	LIST_FOREACH(n, &chain->nat, _next) {
528 		bcopy(n, &data[len], sizeof(struct cfg_nat));
529 		len += sizeof(struct cfg_nat);
530 		LIST_FOREACH(r, &n->redir_chain, _next) {
531 			bcopy(r, &data[len], sizeof(struct cfg_redir));
532 			len += sizeof(struct cfg_redir);
533 			LIST_FOREACH(s, &r->spool_chain, _next) {
534 				bcopy(s, &data[len], sizeof(struct cfg_spool));
535 				len += sizeof(struct cfg_spool);
536 			}
537 		}
538 	}
539 	IPFW_RUNLOCK(chain);
540 
541 	error = sooptcopyout(sopt, data, len);
542 	free(data, M_TEMP);
543 
544 	return (error);
545 }
546 
547 static int
548 ipfw_nat_get_log(struct sockopt *sopt)
549 {
550 	uint8_t *data;
551 	struct cfg_nat *ptr;
552 	int i, size;
553 	struct ip_fw_chain *chain;
554 
555 	chain = &V_layer3_chain;
556 
557 	IPFW_RLOCK(chain);
558 	/* one pass to count, one to copy the data */
559 	i = 0;
560 	LIST_FOREACH(ptr, &chain->nat, _next) {
561 		if (ptr->lib->logDesc == NULL)
562 			continue;
563 		i++;
564 	}
565 	size = i * (LIBALIAS_BUF_SIZE + sizeof(int));
566 	data = malloc(size, M_IPFW, M_NOWAIT | M_ZERO);
567 	if (data == NULL) {
568 		IPFW_RUNLOCK(chain);
569 		return (ENOSPC);
570 	}
571 	i = 0;
572 	LIST_FOREACH(ptr, &chain->nat, _next) {
573 		if (ptr->lib->logDesc == NULL)
574 			continue;
575 		bcopy(&ptr->id, &data[i], sizeof(int));
576 		i += sizeof(int);
577 		bcopy(ptr->lib->logDesc, &data[i], LIBALIAS_BUF_SIZE);
578 		i += LIBALIAS_BUF_SIZE;
579 	}
580 	IPFW_RUNLOCK(chain);
581 	sooptcopyout(sopt, data, size);
582 	free(data, M_IPFW);
583 	return(0);
584 }
585 
586 static void
587 ipfw_nat_init(void)
588 {
589 
590 	IPFW_WLOCK(&V_layer3_chain);
591 	/* init ipfw hooks */
592 	ipfw_nat_ptr = ipfw_nat;
593 	lookup_nat_ptr = lookup_nat;
594 	ipfw_nat_cfg_ptr = ipfw_nat_cfg;
595 	ipfw_nat_del_ptr = ipfw_nat_del;
596 	ipfw_nat_get_cfg_ptr = ipfw_nat_get_cfg;
597 	ipfw_nat_get_log_ptr = ipfw_nat_get_log;
598 	IPFW_WUNLOCK(&V_layer3_chain);
599 	V_ifaddr_event_tag = EVENTHANDLER_REGISTER(
600 	    ifaddr_event, ifaddr_change,
601 	    NULL, EVENTHANDLER_PRI_ANY);
602 }
603 
604 static void
605 ipfw_nat_destroy(void)
606 {
607 	struct cfg_nat *ptr, *ptr_temp;
608 	struct ip_fw_chain *chain;
609 
610 	chain = &V_layer3_chain;
611 	IPFW_WLOCK(chain);
612 	LIST_FOREACH_SAFE(ptr, &chain->nat, _next, ptr_temp) {
613 		LIST_REMOVE(ptr, _next);
614 		del_redir_spool_cfg(ptr, &ptr->redir_chain);
615 		LibAliasUninit(ptr->lib);
616 		free(ptr, M_IPFW);
617 	}
618 	EVENTHANDLER_DEREGISTER(ifaddr_event, V_ifaddr_event_tag);
619 	flush_nat_ptrs(chain, -1 /* flush all */);
620 	/* deregister ipfw_nat */
621 	ipfw_nat_ptr = NULL;
622 	lookup_nat_ptr = NULL;
623 	ipfw_nat_cfg_ptr = NULL;
624 	ipfw_nat_del_ptr = NULL;
625 	ipfw_nat_get_cfg_ptr = NULL;
626 	ipfw_nat_get_log_ptr = NULL;
627 	IPFW_WUNLOCK(chain);
628 }
629 
630 static int
631 ipfw_nat_modevent(module_t mod, int type, void *unused)
632 {
633 	int err = 0;
634 
635 	switch (type) {
636 	case MOD_LOAD:
637 		ipfw_nat_init();
638 		break;
639 
640 	case MOD_UNLOAD:
641 		ipfw_nat_destroy();
642 		break;
643 
644 	default:
645 		return EOPNOTSUPP;
646 		break;
647 	}
648 	return err;
649 }
650 
651 static moduledata_t ipfw_nat_mod = {
652 	"ipfw_nat",
653 	ipfw_nat_modevent,
654 	0
655 };
656 
657 DECLARE_MODULE(ipfw_nat, ipfw_nat_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
658 MODULE_DEPEND(ipfw_nat, libalias, 1, 1, 1);
659 MODULE_DEPEND(ipfw_nat, ipfw, 2, 2, 2);
660 MODULE_VERSION(ipfw_nat, 1);
661 /* end of file */
662