xref: /freebsd/sys/netpfil/ipfw/nat64/nat64clat_control.c (revision 22cf89c938886d14f5796fc49f9f020c23ea8eaf) 
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2019 Yandex LLC
5  * Copyright (c) 2019 Andrey V. Elsukov <ae@FreeBSD.org>
6  * Copyright (c) 2019 Boris N. Lytochkin <lytboris@gmail.com>
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28  */
29 
30 #include <sys/cdefs.h>
31 #include <sys/param.h>
32 #include <sys/systm.h>
33 #include <sys/counter.h>
34 #include <sys/errno.h>
35 #include <sys/kernel.h>
36 #include <sys/lock.h>
37 #include <sys/malloc.h>
38 #include <sys/mbuf.h>
39 #include <sys/module.h>
40 #include <sys/rmlock.h>
41 #include <sys/rwlock.h>
42 #include <sys/socket.h>
43 #include <sys/sockopt.h>
44 #include <sys/syslog.h>
45 #include <sys/sysctl.h>
46 
47 #include <net/if.h>
48 #include <net/if_var.h>
49 #include <net/route.h>
50 #include <net/vnet.h>
51 
52 #include <netinet/in.h>
53 #include <netinet/ip_var.h>
54 #include <netinet/ip_fw.h>
55 #include <netinet6/in6_var.h>
56 #include <netinet6/ip6_var.h>
57 #include <netinet6/ip_fw_nat64.h>
58 
59 #include <netpfil/ipfw/ip_fw_private.h>
60 
61 #include "nat64clat.h"
62 
63 VNET_DEFINE(uint16_t, nat64clat_eid) = 0;
64 
65 static struct nat64clat_cfg *nat64clat_alloc_config(const char *name,
66     uint8_t set);
67 static void nat64clat_free_config(struct nat64clat_cfg *cfg);
68 static struct nat64clat_cfg *nat64clat_find(struct namedobj_instance *ni,
69     const char *name, uint8_t set);
70 
71 static struct nat64clat_cfg *
72 nat64clat_alloc_config(const char *name, uint8_t set)
73 {
74 	struct nat64clat_cfg *cfg;
75 
76 	cfg = malloc(sizeof(struct nat64clat_cfg), M_IPFW, M_WAITOK | M_ZERO);
77 	COUNTER_ARRAY_ALLOC(cfg->base.stats.cnt, NAT64STATS, M_WAITOK);
78 	cfg->no.name = cfg->name;
79 	cfg->no.etlv = IPFW_TLV_NAT64CLAT_NAME;
80 	cfg->no.set = set;
81 	strlcpy(cfg->name, name, sizeof(cfg->name));
82 	return (cfg);
83 }
84 
85 static void
86 nat64clat_free_config(struct nat64clat_cfg *cfg)
87 {
88 
89 	COUNTER_ARRAY_FREE(cfg->base.stats.cnt, NAT64STATS);
90 	free(cfg, M_IPFW);
91 }
92 
93 static void
94 nat64clat_export_config(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg,
95     ipfw_nat64clat_cfg *uc)
96 {
97 	uc->plat_prefix = cfg->base.plat_prefix;
98 	uc->plat_plen = cfg->base.plat_plen;
99 	uc->clat_prefix = cfg->base.clat_prefix;
100 	uc->clat_plen = cfg->base.clat_plen;
101 	uc->flags = cfg->base.flags & NAT64CLAT_FLAGSMASK;
102 	uc->set = cfg->no.set;
103 	strlcpy(uc->name, cfg->no.name, sizeof(uc->name));
104 }
105 
106 struct nat64clat_dump_arg {
107 	struct ip_fw_chain *ch;
108 	struct sockopt_data *sd;
109 };
110 
111 static int
112 export_config_cb(struct namedobj_instance *ni, struct named_object *no,
113     void *arg)
114 {
115 	struct nat64clat_dump_arg *da = (struct nat64clat_dump_arg *)arg;
116 	ipfw_nat64clat_cfg *uc;
117 
118 	uc = (ipfw_nat64clat_cfg *)ipfw_get_sopt_space(da->sd, sizeof(*uc));
119 	nat64clat_export_config(da->ch, (struct nat64clat_cfg *)no, uc);
120 	return (0);
121 }
122 
123 static struct nat64clat_cfg *
124 nat64clat_find(struct namedobj_instance *ni, const char *name, uint8_t set)
125 {
126 	struct nat64clat_cfg *cfg;
127 
128 	cfg = (struct nat64clat_cfg *)ipfw_objhash_lookup_name_type(ni, set,
129 	    IPFW_TLV_NAT64CLAT_NAME, name);
130 
131 	return (cfg);
132 }
133 
134 /*
135  * Creates new consumer-side nat64 translator instance.
136  * Data layout (v0)(current):
137  * Request: [ ipfw_obj_lheader ipfw_nat64clat_cfg ]
138  *
139  * Returns 0 on success
140  */
141 static int
142 nat64clat_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
143     struct sockopt_data *sd)
144 {
145 	ipfw_obj_lheader *olh;
146 	ipfw_nat64clat_cfg *uc;
147 	struct namedobj_instance *ni;
148 	struct nat64clat_cfg *cfg;
149 
150 	if (sd->valsize != sizeof(*olh) + sizeof(*uc))
151 		return (EINVAL);
152 
153 	olh = (ipfw_obj_lheader *)sd->kbuf;
154 	uc = (ipfw_nat64clat_cfg *)(olh + 1);
155 
156 	if (ipfw_check_object_name_generic(uc->name) != 0)
157 		return (EINVAL);
158 
159 	if (uc->set >= IPFW_MAX_SETS ||
160 	    nat64_check_prefix6(&uc->plat_prefix, uc->plat_plen) != 0 ||
161 	    nat64_check_prefix6(&uc->clat_prefix, uc->clat_plen) != 0)
162 		return (EINVAL);
163 
164 	ni = CHAIN_TO_SRV(ch);
165 
166 	IPFW_UH_RLOCK(ch);
167 	if (nat64clat_find(ni, uc->name, uc->set) != NULL) {
168 		IPFW_UH_RUNLOCK(ch);
169 		return (EEXIST);
170 	}
171 	IPFW_UH_RUNLOCK(ch);
172 
173 	cfg = nat64clat_alloc_config(uc->name, uc->set);
174 	cfg->base.plat_prefix = uc->plat_prefix;
175 	cfg->base.plat_plen = uc->plat_plen;
176 	cfg->base.clat_prefix = uc->clat_prefix;
177 	cfg->base.clat_plen = uc->clat_plen;
178 	cfg->base.flags = (uc->flags & NAT64CLAT_FLAGSMASK) |
179 	    NAT64_CLATPFX | NAT64_PLATPFX;
180 	if (IN6_IS_ADDR_WKPFX(&cfg->base.plat_prefix))
181 		cfg->base.flags |= NAT64_WKPFX;
182 
183 	IPFW_UH_WLOCK(ch);
184 
185 	if (nat64clat_find(ni, uc->name, uc->set) != NULL) {
186 		IPFW_UH_WUNLOCK(ch);
187 		nat64clat_free_config(cfg);
188 		return (EEXIST);
189 	}
190 
191 	if (ipfw_objhash_alloc_idx(ni, &cfg->no.kidx) != 0) {
192 		IPFW_UH_WUNLOCK(ch);
193 		nat64clat_free_config(cfg);
194 		return (ENOSPC);
195 	}
196 	ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no);
197 	/* Okay, let's link data */
198 	SRV_OBJECT(ch, cfg->no.kidx) = cfg;
199 	IPFW_UH_WUNLOCK(ch);
200 
201 	return (0);
202 }
203 
204 /*
205  * Change existing nat64clat instance configuration.
206  * Data layout (v0)(current):
207  * Request: [ ipfw_obj_header ipfw_nat64clat_cfg ]
208  * Reply: [ ipfw_obj_header ipfw_nat64clat_cfg ]
209  *
210  * Returns 0 on success
211  */
212 static int
213 nat64clat_config(struct ip_fw_chain *ch, ip_fw3_opheader *op,
214     struct sockopt_data *sd)
215 {
216 	ipfw_obj_header *oh;
217 	ipfw_nat64clat_cfg *uc;
218 	struct nat64clat_cfg *cfg;
219 	struct namedobj_instance *ni;
220 	uint32_t flags;
221 
222 	if (sd->valsize != sizeof(*oh) + sizeof(*uc))
223 		return (EINVAL);
224 
225 	oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd,
226 	    sizeof(*oh) + sizeof(*uc));
227 	uc = (ipfw_nat64clat_cfg *)(oh + 1);
228 
229 	if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
230 	    oh->ntlv.set >= IPFW_MAX_SETS)
231 		return (EINVAL);
232 
233 	ni = CHAIN_TO_SRV(ch);
234 	if (sd->sopt->sopt_dir == SOPT_GET) {
235 		IPFW_UH_RLOCK(ch);
236 		cfg = nat64clat_find(ni, oh->ntlv.name, oh->ntlv.set);
237 		if (cfg == NULL) {
238 			IPFW_UH_RUNLOCK(ch);
239 			return (ENOENT);
240 		}
241 		nat64clat_export_config(ch, cfg, uc);
242 		IPFW_UH_RUNLOCK(ch);
243 		return (0);
244 	}
245 
246 	IPFW_UH_WLOCK(ch);
247 	cfg = nat64clat_find(ni, oh->ntlv.name, oh->ntlv.set);
248 	if (cfg == NULL) {
249 		IPFW_UH_WUNLOCK(ch);
250 		return (ENOENT);
251 	}
252 
253 	/*
254 	 * For now allow to change only following values:
255 	 *  plat_prefix, plat_plen, clat_prefix, clat_plen, flags.
256 	 */
257 	flags = 0;
258 	if (uc->plat_plen != cfg->base.plat_plen ||
259 	    !IN6_ARE_ADDR_EQUAL(&uc->plat_prefix, &cfg->base.plat_prefix)) {
260 		if (nat64_check_prefix6(&uc->plat_prefix, uc->plat_plen) != 0) {
261 			IPFW_UH_WUNLOCK(ch);
262 			return (EINVAL);
263 		}
264 		flags |= NAT64_PLATPFX;
265 	}
266 
267 	if (uc->clat_plen != cfg->base.clat_plen ||
268 	    !IN6_ARE_ADDR_EQUAL(&uc->clat_prefix, &cfg->base.clat_prefix)) {
269 		if (nat64_check_prefix6(&uc->clat_prefix, uc->clat_plen) != 0) {
270 			IPFW_UH_WUNLOCK(ch);
271 			return (EINVAL);
272 		}
273 		flags |= NAT64_CLATPFX;
274 	}
275 
276 	if (flags != 0) {
277 		IPFW_WLOCK(ch);
278 		if (flags & NAT64_PLATPFX) {
279 			cfg->base.plat_prefix = uc->plat_prefix;
280 			cfg->base.plat_plen = uc->plat_plen;
281 		}
282 		if (flags & NAT64_CLATPFX) {
283 			cfg->base.clat_prefix = uc->clat_prefix;
284 			cfg->base.clat_plen = uc->clat_plen;
285 		}
286 		IPFW_WUNLOCK(ch);
287 	}
288 
289 	cfg->base.flags &= ~NAT64CLAT_FLAGSMASK;
290 	cfg->base.flags |= uc->flags & NAT64CLAT_FLAGSMASK;
291 
292 	IPFW_UH_WUNLOCK(ch);
293 	return (0);
294 }
295 
296 static void
297 nat64clat_detach_config(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg)
298 {
299 
300 	IPFW_UH_WLOCK_ASSERT(ch);
301 
302 	ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no);
303 	ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx);
304 }
305 
306 /*
307  * Destroys nat64 instance.
308  * Data layout (v0)(current):
309  * Request: [ ipfw_obj_header ]
310  *
311  * Returns 0 on success
312  */
313 static int
314 nat64clat_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
315     struct sockopt_data *sd)
316 {
317 	ipfw_obj_header *oh;
318 	struct nat64clat_cfg *cfg;
319 
320 	if (sd->valsize != sizeof(*oh))
321 		return (EINVAL);
322 
323 	oh = (ipfw_obj_header *)sd->kbuf;
324 	if (ipfw_check_object_name_generic(oh->ntlv.name) != 0)
325 		return (EINVAL);
326 
327 	IPFW_UH_WLOCK(ch);
328 	cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
329 	if (cfg == NULL) {
330 		IPFW_UH_WUNLOCK(ch);
331 		return (ENOENT);
332 	}
333 	if (cfg->no.refcnt > 0) {
334 		IPFW_UH_WUNLOCK(ch);
335 		return (EBUSY);
336 	}
337 
338 	ipfw_reset_eaction_instance(ch, V_nat64clat_eid, cfg->no.kidx);
339 	SRV_OBJECT(ch, cfg->no.kidx) = NULL;
340 	nat64clat_detach_config(ch, cfg);
341 	IPFW_UH_WUNLOCK(ch);
342 
343 	nat64clat_free_config(cfg);
344 	return (0);
345 }
346 
347 /*
348  * Lists all nat64clat instances currently available in kernel.
349  * Data layout (v0)(current):
350  * Request: [ ipfw_obj_lheader ]
351  * Reply: [ ipfw_obj_lheader ipfw_nat64clat_cfg x N ]
352  *
353  * Returns 0 on success
354  */
355 static int
356 nat64clat_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
357     struct sockopt_data *sd)
358 {
359 	ipfw_obj_lheader *olh;
360 	struct nat64clat_dump_arg da;
361 
362 	/* Check minimum header size */
363 	if (sd->valsize < sizeof(ipfw_obj_lheader))
364 		return (EINVAL);
365 
366 	olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh));
367 
368 	IPFW_UH_RLOCK(ch);
369 	olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch),
370 	    IPFW_TLV_NAT64CLAT_NAME);
371 	olh->objsize = sizeof(ipfw_nat64clat_cfg);
372 	olh->size = sizeof(*olh) + olh->count * olh->objsize;
373 
374 	if (sd->valsize < olh->size) {
375 		IPFW_UH_RUNLOCK(ch);
376 		return (ENOMEM);
377 	}
378 	memset(&da, 0, sizeof(da));
379 	da.ch = ch;
380 	da.sd = sd;
381 	ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb,
382 	    &da, IPFW_TLV_NAT64CLAT_NAME);
383 	IPFW_UH_RUNLOCK(ch);
384 
385 	return (0);
386 }
387 
388 #define	__COPY_STAT_FIELD(_cfg, _stats, _field)	\
389 	(_stats)->_field = NAT64STAT_FETCH(&(_cfg)->base.stats, _field)
390 static void
391 export_stats(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg,
392     struct ipfw_nat64clat_stats *stats)
393 {
394 
395 	__COPY_STAT_FIELD(cfg, stats, opcnt64);
396 	__COPY_STAT_FIELD(cfg, stats, opcnt46);
397 	__COPY_STAT_FIELD(cfg, stats, ofrags);
398 	__COPY_STAT_FIELD(cfg, stats, ifrags);
399 	__COPY_STAT_FIELD(cfg, stats, oerrors);
400 	__COPY_STAT_FIELD(cfg, stats, noroute4);
401 	__COPY_STAT_FIELD(cfg, stats, noroute6);
402 	__COPY_STAT_FIELD(cfg, stats, noproto);
403 	__COPY_STAT_FIELD(cfg, stats, nomem);
404 	__COPY_STAT_FIELD(cfg, stats, dropped);
405 }
406 
407 /*
408  * Get nat64clat statistics.
409  * Data layout (v0)(current):
410  * Request: [ ipfw_obj_header ]
411  * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ]]
412  *
413  * Returns 0 on success
414  */
415 static int
416 nat64clat_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
417     struct sockopt_data *sd)
418 {
419 	struct ipfw_nat64clat_stats stats;
420 	struct nat64clat_cfg *cfg;
421 	ipfw_obj_header *oh;
422 	ipfw_obj_ctlv *ctlv;
423 	size_t sz;
424 
425 	sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats);
426 	if (sd->valsize % sizeof(uint64_t))
427 		return (EINVAL);
428 	if (sd->valsize < sz)
429 		return (ENOMEM);
430 	oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
431 	if (oh == NULL)
432 		return (EINVAL);
433 	memset(&stats, 0, sizeof(stats));
434 
435 	IPFW_UH_RLOCK(ch);
436 	cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
437 	if (cfg == NULL) {
438 		IPFW_UH_RUNLOCK(ch);
439 		return (ENOENT);
440 	}
441 	export_stats(ch, cfg, &stats);
442 	IPFW_UH_RUNLOCK(ch);
443 
444 	ctlv = (ipfw_obj_ctlv *)(oh + 1);
445 	memset(ctlv, 0, sizeof(*ctlv));
446 	ctlv->head.type = IPFW_TLV_COUNTERS;
447 	ctlv->head.length = sz - sizeof(ipfw_obj_header);
448 	ctlv->count = sizeof(stats) / sizeof(uint64_t);
449 	ctlv->objsize = sizeof(uint64_t);
450 	ctlv->version = IPFW_NAT64_VERSION;
451 	memcpy(ctlv + 1, &stats, sizeof(stats));
452 	return (0);
453 }
454 
455 /*
456  * Reset nat64clat statistics.
457  * Data layout (v0)(current):
458  * Request: [ ipfw_obj_header ]
459  *
460  * Returns 0 on success
461  */
462 static int
463 nat64clat_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
464     struct sockopt_data *sd)
465 {
466 	struct nat64clat_cfg *cfg;
467 	ipfw_obj_header *oh;
468 
469 	if (sd->valsize != sizeof(*oh))
470 		return (EINVAL);
471 	oh = (ipfw_obj_header *)sd->kbuf;
472 	if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
473 	    oh->ntlv.set >= IPFW_MAX_SETS)
474 		return (EINVAL);
475 
476 	IPFW_UH_WLOCK(ch);
477 	cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
478 	if (cfg == NULL) {
479 		IPFW_UH_WUNLOCK(ch);
480 		return (ENOENT);
481 	}
482 	COUNTER_ARRAY_ZERO(cfg->base.stats.cnt, NAT64STATS);
483 	IPFW_UH_WUNLOCK(ch);
484 	return (0);
485 }
486 
487 static struct ipfw_sopt_handler	scodes[] = {
488 	{ IP_FW_NAT64CLAT_CREATE, 0,	HDIR_SET,	nat64clat_create },
489 	{ IP_FW_NAT64CLAT_DESTROY,0,	HDIR_SET,	nat64clat_destroy },
490 	{ IP_FW_NAT64CLAT_CONFIG, 0,	HDIR_BOTH,	nat64clat_config },
491 	{ IP_FW_NAT64CLAT_LIST,   0,	HDIR_GET,	nat64clat_list },
492 	{ IP_FW_NAT64CLAT_STATS,  0,	HDIR_GET,	nat64clat_stats },
493 	{ IP_FW_NAT64CLAT_RESET_STATS,0,	HDIR_SET,	nat64clat_reset_stats },
494 };
495 
496 static int
497 nat64clat_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
498 {
499 	ipfw_insn *icmd;
500 
501 	icmd = cmd - 1;
502 	if (icmd->opcode != O_EXTERNAL_ACTION ||
503 	    icmd->arg1 != V_nat64clat_eid)
504 		return (1);
505 
506 	*puidx = cmd->arg1;
507 	*ptype = 0;
508 	return (0);
509 }
510 
511 static void
512 nat64clat_update_arg1(ipfw_insn *cmd, uint16_t idx)
513 {
514 
515 	cmd->arg1 = idx;
516 }
517 
518 static int
519 nat64clat_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
520     struct named_object **pno)
521 {
522 	int err;
523 
524 	err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti,
525 	    IPFW_TLV_NAT64CLAT_NAME, pno);
526 	return (err);
527 }
528 
529 static struct named_object *
530 nat64clat_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
531 {
532 	struct namedobj_instance *ni;
533 	struct named_object *no;
534 
535 	IPFW_UH_WLOCK_ASSERT(ch);
536 	ni = CHAIN_TO_SRV(ch);
537 	no = ipfw_objhash_lookup_kidx(ni, idx);
538 	KASSERT(no != NULL, ("NAT with index %d not found", idx));
539 
540 	return (no);
541 }
542 
543 static int
544 nat64clat_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
545     enum ipfw_sets_cmd cmd)
546 {
547 
548 	return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64CLAT_NAME,
549 	    set, new_set, cmd));
550 }
551 
552 static struct opcode_obj_rewrite opcodes[] = {
553 	{
554 		.opcode = O_EXTERNAL_INSTANCE,
555 		.etlv = IPFW_TLV_EACTION /* just show it isn't table */,
556 		.classifier = nat64clat_classify,
557 		.update = nat64clat_update_arg1,
558 		.find_byname = nat64clat_findbyname,
559 		.find_bykidx = nat64clat_findbykidx,
560 		.manage_sets = nat64clat_manage_sets,
561 	},
562 };
563 
564 static int
565 destroy_config_cb(struct namedobj_instance *ni, struct named_object *no,
566     void *arg)
567 {
568 	struct nat64clat_cfg *cfg;
569 	struct ip_fw_chain *ch;
570 
571 	ch = (struct ip_fw_chain *)arg;
572 	cfg = (struct nat64clat_cfg *)SRV_OBJECT(ch, no->kidx);
573 	SRV_OBJECT(ch, no->kidx) = NULL;
574 	nat64clat_detach_config(ch, cfg);
575 	nat64clat_free_config(cfg);
576 	return (0);
577 }
578 
579 int
580 nat64clat_init(struct ip_fw_chain *ch, int first)
581 {
582 
583 	V_nat64clat_eid = ipfw_add_eaction(ch, ipfw_nat64clat, "nat64clat");
584 	if (V_nat64clat_eid == 0)
585 		return (ENXIO);
586 	IPFW_ADD_SOPT_HANDLER(first, scodes);
587 	IPFW_ADD_OBJ_REWRITER(first, opcodes);
588 	return (0);
589 }
590 
591 void
592 nat64clat_uninit(struct ip_fw_chain *ch, int last)
593 {
594 
595 	IPFW_DEL_OBJ_REWRITER(last, opcodes);
596 	IPFW_DEL_SOPT_HANDLER(last, scodes);
597 	ipfw_del_eaction(ch, V_nat64clat_eid);
598 	/*
599 	 * Since we already have deregistered external action,
600 	 * our named objects become unaccessible via rules, because
601 	 * all rules were truncated by ipfw_del_eaction().
602 	 * So, we can unlink and destroy our named objects without holding
603 	 * IPFW_WLOCK().
604 	 */
605 	IPFW_UH_WLOCK(ch);
606 	ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch,
607 	    IPFW_TLV_NAT64CLAT_NAME);
608 	V_nat64clat_eid = 0;
609 	IPFW_UH_WUNLOCK(ch);
610 }
611