1 /*- 2 * Copyright (c) 2015-2016 Yandex LLC 3 * Copyright (c) 2015-2016 Andrey V. Elsukov <ae@FreeBSD.org> 4 * Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __FBSDID("$FreeBSD$"); 31 32 #include <sys/param.h> 33 #include <sys/systm.h> 34 #include <sys/counter.h> 35 #include <sys/errno.h> 36 #include <sys/kernel.h> 37 #include <sys/lock.h> 38 #include <sys/malloc.h> 39 #include <sys/mbuf.h> 40 #include <sys/module.h> 41 #include <sys/rmlock.h> 42 #include <sys/rwlock.h> 43 #include <sys/socket.h> 44 #include <sys/sockopt.h> 45 #include <sys/queue.h> 46 #include <sys/syslog.h> 47 #include <sys/sysctl.h> 48 49 #include <net/if.h> 50 #include <net/if_var.h> 51 #include <net/pfil.h> 52 #include <net/route.h> 53 #include <net/vnet.h> 54 55 #include <netinet/in.h> 56 #include <netinet/ip_var.h> 57 #include <netinet/ip_fw.h> 58 #include <netinet6/in6_var.h> 59 #include <netinet6/ip6_var.h> 60 #include <netinet6/ip_fw_nat64.h> 61 62 #include <netpfil/ipfw/ip_fw_private.h> 63 64 #include "nat64stl.h" 65 66 VNET_DEFINE(uint16_t, nat64stl_eid) = 0; 67 68 static struct nat64stl_cfg *nat64stl_alloc_config(const char *name, 69 uint8_t set); 70 static void nat64stl_free_config(struct nat64stl_cfg *cfg); 71 static struct nat64stl_cfg *nat64stl_find(struct namedobj_instance *ni, 72 const char *name, uint8_t set); 73 74 static struct nat64stl_cfg * 75 nat64stl_alloc_config(const char *name, uint8_t set) 76 { 77 struct nat64stl_cfg *cfg; 78 79 cfg = malloc(sizeof(struct nat64stl_cfg), M_IPFW, M_WAITOK | M_ZERO); 80 COUNTER_ARRAY_ALLOC(cfg->base.stats.cnt, NAT64STATS, M_WAITOK); 81 cfg->no.name = cfg->name; 82 cfg->no.etlv = IPFW_TLV_NAT64STL_NAME; 83 cfg->no.set = set; 84 strlcpy(cfg->name, name, sizeof(cfg->name)); 85 return (cfg); 86 } 87 88 static void 89 nat64stl_free_config(struct nat64stl_cfg *cfg) 90 { 91 92 COUNTER_ARRAY_FREE(cfg->base.stats.cnt, NAT64STATS); 93 free(cfg, M_IPFW); 94 } 95 96 static void 97 nat64stl_export_config(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg, 98 ipfw_nat64stl_cfg *uc) 99 { 100 struct named_object *no; 101 102 uc->prefix6 = cfg->base.prefix6; 103 uc->plen6 = cfg->base.plen6; 104 uc->flags = cfg->base.flags & NAT64STL_FLAGSMASK; 105 uc->set = cfg->no.set; 106 strlcpy(uc->name, cfg->no.name, sizeof(uc->name)); 107 108 no = ipfw_objhash_lookup_table_kidx(ch, cfg->map64); 109 ipfw_export_obj_ntlv(no, &uc->ntlv6); 110 no = ipfw_objhash_lookup_table_kidx(ch, cfg->map46); 111 ipfw_export_obj_ntlv(no, &uc->ntlv4); 112 } 113 114 struct nat64stl_dump_arg { 115 struct ip_fw_chain *ch; 116 struct sockopt_data *sd; 117 }; 118 119 static int 120 export_config_cb(struct namedobj_instance *ni, struct named_object *no, 121 void *arg) 122 { 123 struct nat64stl_dump_arg *da = (struct nat64stl_dump_arg *)arg; 124 ipfw_nat64stl_cfg *uc; 125 126 uc = (ipfw_nat64stl_cfg *)ipfw_get_sopt_space(da->sd, sizeof(*uc)); 127 nat64stl_export_config(da->ch, (struct nat64stl_cfg *)no, uc); 128 return (0); 129 } 130 131 static struct nat64stl_cfg * 132 nat64stl_find(struct namedobj_instance *ni, const char *name, uint8_t set) 133 { 134 struct nat64stl_cfg *cfg; 135 136 cfg = (struct nat64stl_cfg *)ipfw_objhash_lookup_name_type(ni, set, 137 IPFW_TLV_NAT64STL_NAME, name); 138 139 return (cfg); 140 } 141 142 143 static int 144 nat64stl_create_internal(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg, 145 ipfw_nat64stl_cfg *i) 146 { 147 148 IPFW_UH_WLOCK_ASSERT(ch); 149 150 if (ipfw_objhash_alloc_idx(CHAIN_TO_SRV(ch), &cfg->no.kidx) != 0) 151 return (ENOSPC); 152 cfg->base.flags |= NAT64STL_KIDX; 153 154 if (ipfw_ref_table(ch, &i->ntlv4, &cfg->map46) != 0) 155 return (EINVAL); 156 cfg->base.flags |= NAT64STL_46T; 157 158 if (ipfw_ref_table(ch, &i->ntlv6, &cfg->map64) != 0) 159 return (EINVAL); 160 cfg->base.flags |= NAT64STL_64T; 161 162 ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no); 163 164 return (0); 165 } 166 167 /* 168 * Creates new nat64 instance. 169 * Data layout (v0)(current): 170 * Request: [ ipfw_obj_lheader ipfw_nat64stl_cfg ] 171 * 172 * Returns 0 on success 173 */ 174 static int 175 nat64stl_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 176 struct sockopt_data *sd) 177 { 178 ipfw_obj_lheader *olh; 179 ipfw_nat64stl_cfg *uc; 180 struct namedobj_instance *ni; 181 struct nat64stl_cfg *cfg; 182 int error; 183 184 if (sd->valsize != sizeof(*olh) + sizeof(*uc)) 185 return (EINVAL); 186 187 olh = (ipfw_obj_lheader *)sd->kbuf; 188 uc = (ipfw_nat64stl_cfg *)(olh + 1); 189 190 if (ipfw_check_object_name_generic(uc->name) != 0) 191 return (EINVAL); 192 if (uc->set >= IPFW_MAX_SETS || 193 nat64_check_prefix6(&uc->prefix6, uc->plen6) != 0) 194 return (EINVAL); 195 196 /* XXX: check types of tables */ 197 198 ni = CHAIN_TO_SRV(ch); 199 error = 0; 200 201 IPFW_UH_RLOCK(ch); 202 if (nat64stl_find(ni, uc->name, uc->set) != NULL) { 203 IPFW_UH_RUNLOCK(ch); 204 return (EEXIST); 205 } 206 IPFW_UH_RUNLOCK(ch); 207 208 cfg = nat64stl_alloc_config(uc->name, uc->set); 209 cfg->base.prefix6 = uc->prefix6; 210 cfg->base.plen6 = uc->plen6; 211 cfg->base.flags = uc->flags & NAT64STL_FLAGSMASK; 212 if (IN6_IS_ADDR_WKPFX(&cfg->base.prefix6)) 213 cfg->base.flags |= NAT64_WKPFX; 214 215 IPFW_UH_WLOCK(ch); 216 217 if (nat64stl_find(ni, uc->name, uc->set) != NULL) { 218 IPFW_UH_WUNLOCK(ch); 219 nat64stl_free_config(cfg); 220 return (EEXIST); 221 } 222 error = nat64stl_create_internal(ch, cfg, uc); 223 if (error == 0) { 224 /* Okay, let's link data */ 225 SRV_OBJECT(ch, cfg->no.kidx) = cfg; 226 IPFW_UH_WUNLOCK(ch); 227 return (0); 228 } 229 230 if (cfg->base.flags & NAT64STL_KIDX) 231 ipfw_objhash_free_idx(ni, cfg->no.kidx); 232 if (cfg->base.flags & NAT64STL_46T) 233 ipfw_unref_table(ch, cfg->map46); 234 if (cfg->base.flags & NAT64STL_64T) 235 ipfw_unref_table(ch, cfg->map64); 236 237 IPFW_UH_WUNLOCK(ch); 238 nat64stl_free_config(cfg); 239 return (error); 240 } 241 242 /* 243 * Change existing nat64stl instance configuration. 244 * Data layout (v0)(current): 245 * Request: [ ipfw_obj_header ipfw_nat64stl_cfg ] 246 * Reply: [ ipfw_obj_header ipfw_nat64stl_cfg ] 247 * 248 * Returns 0 on success 249 */ 250 static int 251 nat64stl_config(struct ip_fw_chain *ch, ip_fw3_opheader *op, 252 struct sockopt_data *sd) 253 { 254 ipfw_obj_header *oh; 255 ipfw_nat64stl_cfg *uc; 256 struct nat64stl_cfg *cfg; 257 struct namedobj_instance *ni; 258 259 if (sd->valsize != sizeof(*oh) + sizeof(*uc)) 260 return (EINVAL); 261 262 oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd, 263 sizeof(*oh) + sizeof(*uc)); 264 uc = (ipfw_nat64stl_cfg *)(oh + 1); 265 266 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 || 267 oh->ntlv.set >= IPFW_MAX_SETS) 268 return (EINVAL); 269 270 ni = CHAIN_TO_SRV(ch); 271 if (sd->sopt->sopt_dir == SOPT_GET) { 272 IPFW_UH_RLOCK(ch); 273 cfg = nat64stl_find(ni, oh->ntlv.name, oh->ntlv.set); 274 if (cfg == NULL) { 275 IPFW_UH_RUNLOCK(ch); 276 return (EEXIST); 277 } 278 nat64stl_export_config(ch, cfg, uc); 279 IPFW_UH_RUNLOCK(ch); 280 return (0); 281 } 282 283 IPFW_UH_WLOCK(ch); 284 cfg = nat64stl_find(ni, oh->ntlv.name, oh->ntlv.set); 285 if (cfg == NULL) { 286 IPFW_UH_WUNLOCK(ch); 287 return (EEXIST); 288 } 289 290 /* 291 * For now allow to change only following values: 292 * flags. 293 */ 294 cfg->base.flags &= ~NAT64STL_FLAGSMASK; 295 cfg->base.flags |= uc->flags & NAT64STL_FLAGSMASK; 296 297 IPFW_UH_WUNLOCK(ch); 298 return (0); 299 } 300 301 static void 302 nat64stl_detach_config(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg) 303 { 304 305 IPFW_UH_WLOCK_ASSERT(ch); 306 307 ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no); 308 ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx); 309 ipfw_unref_table(ch, cfg->map46); 310 ipfw_unref_table(ch, cfg->map64); 311 } 312 313 /* 314 * Destroys nat64 instance. 315 * Data layout (v0)(current): 316 * Request: [ ipfw_obj_header ] 317 * 318 * Returns 0 on success 319 */ 320 static int 321 nat64stl_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 322 struct sockopt_data *sd) 323 { 324 ipfw_obj_header *oh; 325 struct nat64stl_cfg *cfg; 326 327 if (sd->valsize != sizeof(*oh)) 328 return (EINVAL); 329 330 oh = (ipfw_obj_header *)sd->kbuf; 331 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0) 332 return (EINVAL); 333 334 IPFW_UH_WLOCK(ch); 335 cfg = nat64stl_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 336 if (cfg == NULL) { 337 IPFW_UH_WUNLOCK(ch); 338 return (ESRCH); 339 } 340 if (cfg->no.refcnt > 0) { 341 IPFW_UH_WUNLOCK(ch); 342 return (EBUSY); 343 } 344 345 ipfw_reset_eaction_instance(ch, V_nat64stl_eid, cfg->no.kidx); 346 SRV_OBJECT(ch, cfg->no.kidx) = NULL; 347 nat64stl_detach_config(ch, cfg); 348 IPFW_UH_WUNLOCK(ch); 349 350 nat64stl_free_config(cfg); 351 return (0); 352 } 353 354 /* 355 * Lists all nat64stl instances currently available in kernel. 356 * Data layout (v0)(current): 357 * Request: [ ipfw_obj_lheader ] 358 * Reply: [ ipfw_obj_lheader ipfw_nat64stl_cfg x N ] 359 * 360 * Returns 0 on success 361 */ 362 static int 363 nat64stl_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 364 struct sockopt_data *sd) 365 { 366 ipfw_obj_lheader *olh; 367 struct nat64stl_dump_arg da; 368 369 /* Check minimum header size */ 370 if (sd->valsize < sizeof(ipfw_obj_lheader)) 371 return (EINVAL); 372 373 olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh)); 374 375 IPFW_UH_RLOCK(ch); 376 olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch), 377 IPFW_TLV_NAT64STL_NAME); 378 olh->objsize = sizeof(ipfw_nat64stl_cfg); 379 olh->size = sizeof(*olh) + olh->count * olh->objsize; 380 381 if (sd->valsize < olh->size) { 382 IPFW_UH_RUNLOCK(ch); 383 return (ENOMEM); 384 } 385 memset(&da, 0, sizeof(da)); 386 da.ch = ch; 387 da.sd = sd; 388 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb, 389 &da, IPFW_TLV_NAT64STL_NAME); 390 IPFW_UH_RUNLOCK(ch); 391 392 return (0); 393 } 394 395 #define __COPY_STAT_FIELD(_cfg, _stats, _field) \ 396 (_stats)->_field = NAT64STAT_FETCH(&(_cfg)->base.stats, _field) 397 static void 398 export_stats(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg, 399 struct ipfw_nat64stl_stats *stats) 400 { 401 402 __COPY_STAT_FIELD(cfg, stats, opcnt64); 403 __COPY_STAT_FIELD(cfg, stats, opcnt46); 404 __COPY_STAT_FIELD(cfg, stats, ofrags); 405 __COPY_STAT_FIELD(cfg, stats, ifrags); 406 __COPY_STAT_FIELD(cfg, stats, oerrors); 407 __COPY_STAT_FIELD(cfg, stats, noroute4); 408 __COPY_STAT_FIELD(cfg, stats, noroute6); 409 __COPY_STAT_FIELD(cfg, stats, noproto); 410 __COPY_STAT_FIELD(cfg, stats, nomem); 411 __COPY_STAT_FIELD(cfg, stats, dropped); 412 } 413 414 /* 415 * Get nat64stl statistics. 416 * Data layout (v0)(current): 417 * Request: [ ipfw_obj_header ] 418 * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ]] 419 * 420 * Returns 0 on success 421 */ 422 static int 423 nat64stl_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op, 424 struct sockopt_data *sd) 425 { 426 struct ipfw_nat64stl_stats stats; 427 struct nat64stl_cfg *cfg; 428 ipfw_obj_header *oh; 429 ipfw_obj_ctlv *ctlv; 430 size_t sz; 431 432 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats); 433 if (sd->valsize % sizeof(uint64_t)) 434 return (EINVAL); 435 if (sd->valsize < sz) 436 return (ENOMEM); 437 oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 438 if (oh == NULL) 439 return (EINVAL); 440 memset(&stats, 0, sizeof(stats)); 441 442 IPFW_UH_RLOCK(ch); 443 cfg = nat64stl_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 444 if (cfg == NULL) { 445 IPFW_UH_RUNLOCK(ch); 446 return (ESRCH); 447 } 448 export_stats(ch, cfg, &stats); 449 IPFW_UH_RUNLOCK(ch); 450 451 ctlv = (ipfw_obj_ctlv *)(oh + 1); 452 memset(ctlv, 0, sizeof(*ctlv)); 453 ctlv->head.type = IPFW_TLV_COUNTERS; 454 ctlv->head.length = sz - sizeof(ipfw_obj_header); 455 ctlv->count = sizeof(stats) / sizeof(uint64_t); 456 ctlv->objsize = sizeof(uint64_t); 457 ctlv->version = IPFW_NAT64_VERSION; 458 memcpy(ctlv + 1, &stats, sizeof(stats)); 459 return (0); 460 } 461 462 /* 463 * Reset nat64stl statistics. 464 * Data layout (v0)(current): 465 * Request: [ ipfw_obj_header ] 466 * 467 * Returns 0 on success 468 */ 469 static int 470 nat64stl_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op, 471 struct sockopt_data *sd) 472 { 473 struct nat64stl_cfg *cfg; 474 ipfw_obj_header *oh; 475 476 if (sd->valsize != sizeof(*oh)) 477 return (EINVAL); 478 oh = (ipfw_obj_header *)sd->kbuf; 479 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 || 480 oh->ntlv.set >= IPFW_MAX_SETS) 481 return (EINVAL); 482 483 IPFW_UH_WLOCK(ch); 484 cfg = nat64stl_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 485 if (cfg == NULL) { 486 IPFW_UH_WUNLOCK(ch); 487 return (ESRCH); 488 } 489 COUNTER_ARRAY_ZERO(cfg->base.stats.cnt, NAT64STATS); 490 IPFW_UH_WUNLOCK(ch); 491 return (0); 492 } 493 494 static struct ipfw_sopt_handler scodes[] = { 495 496 { IP_FW_NAT64STL_CREATE, 0, HDIR_SET, nat64stl_create }, 497 { IP_FW_NAT64STL_DESTROY,0, HDIR_SET, nat64stl_destroy }, 498 { IP_FW_NAT64STL_CONFIG, 0, HDIR_BOTH, nat64stl_config }, 499 { IP_FW_NAT64STL_LIST, 0, HDIR_GET, nat64stl_list }, 500 { IP_FW_NAT64STL_STATS, 0, HDIR_GET, nat64stl_stats }, 501 { IP_FW_NAT64STL_RESET_STATS,0, HDIR_SET, nat64stl_reset_stats }, 502 }; 503 504 static int 505 nat64stl_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 506 { 507 ipfw_insn *icmd; 508 509 icmd = cmd - 1; 510 if (icmd->opcode != O_EXTERNAL_ACTION || 511 icmd->arg1 != V_nat64stl_eid) 512 return (1); 513 514 *puidx = cmd->arg1; 515 *ptype = 0; 516 return (0); 517 } 518 519 static void 520 nat64stl_update_arg1(ipfw_insn *cmd, uint16_t idx) 521 { 522 523 cmd->arg1 = idx; 524 } 525 526 static int 527 nat64stl_findbyname(struct ip_fw_chain *ch, struct tid_info *ti, 528 struct named_object **pno) 529 { 530 int err; 531 532 err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti, 533 IPFW_TLV_NAT64STL_NAME, pno); 534 return (err); 535 } 536 537 static struct named_object * 538 nat64stl_findbykidx(struct ip_fw_chain *ch, uint16_t idx) 539 { 540 struct namedobj_instance *ni; 541 struct named_object *no; 542 543 IPFW_UH_WLOCK_ASSERT(ch); 544 ni = CHAIN_TO_SRV(ch); 545 no = ipfw_objhash_lookup_kidx(ni, idx); 546 KASSERT(no != NULL, ("NAT with index %d not found", idx)); 547 548 return (no); 549 } 550 551 static int 552 nat64stl_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set, 553 enum ipfw_sets_cmd cmd) 554 { 555 556 return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64STL_NAME, 557 set, new_set, cmd)); 558 } 559 560 static struct opcode_obj_rewrite opcodes[] = { 561 { 562 .opcode = O_EXTERNAL_INSTANCE, 563 .etlv = IPFW_TLV_EACTION /* just show it isn't table */, 564 .classifier = nat64stl_classify, 565 .update = nat64stl_update_arg1, 566 .find_byname = nat64stl_findbyname, 567 .find_bykidx = nat64stl_findbykidx, 568 .manage_sets = nat64stl_manage_sets, 569 }, 570 }; 571 572 static int 573 destroy_config_cb(struct namedobj_instance *ni, struct named_object *no, 574 void *arg) 575 { 576 struct nat64stl_cfg *cfg; 577 struct ip_fw_chain *ch; 578 579 ch = (struct ip_fw_chain *)arg; 580 cfg = (struct nat64stl_cfg *)SRV_OBJECT(ch, no->kidx); 581 SRV_OBJECT(ch, no->kidx) = NULL; 582 nat64stl_detach_config(ch, cfg); 583 nat64stl_free_config(cfg); 584 return (0); 585 } 586 587 int 588 nat64stl_init(struct ip_fw_chain *ch, int first) 589 { 590 591 V_nat64stl_eid = ipfw_add_eaction(ch, ipfw_nat64stl, "nat64stl"); 592 if (V_nat64stl_eid == 0) 593 return (ENXIO); 594 IPFW_ADD_SOPT_HANDLER(first, scodes); 595 IPFW_ADD_OBJ_REWRITER(first, opcodes); 596 return (0); 597 } 598 599 void 600 nat64stl_uninit(struct ip_fw_chain *ch, int last) 601 { 602 603 IPFW_DEL_OBJ_REWRITER(last, opcodes); 604 IPFW_DEL_SOPT_HANDLER(last, scodes); 605 ipfw_del_eaction(ch, V_nat64stl_eid); 606 /* 607 * Since we already have deregistered external action, 608 * our named objects become unaccessible via rules, because 609 * all rules were truncated by ipfw_del_eaction(). 610 * So, we can unlink and destroy our named objects without holding 611 * IPFW_WLOCK(). 612 */ 613 IPFW_UH_WLOCK(ch); 614 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch, 615 IPFW_TLV_NAT64STL_NAME); 616 V_nat64stl_eid = 0; 617 IPFW_UH_WUNLOCK(ch); 618 } 619 620