1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2015-2019 Yandex LLC 5 * Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org> 6 * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org> 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 #include <sys/param.h> 32 #include <sys/systm.h> 33 #include <sys/counter.h> 34 #include <sys/errno.h> 35 #include <sys/kernel.h> 36 #include <sys/lock.h> 37 #include <sys/malloc.h> 38 #include <sys/mbuf.h> 39 #include <sys/module.h> 40 #include <sys/rmlock.h> 41 #include <sys/rwlock.h> 42 #include <sys/socket.h> 43 #include <sys/sockopt.h> 44 #include <sys/queue.h> 45 #include <sys/syslog.h> 46 #include <sys/sysctl.h> 47 48 #include <net/if.h> 49 #include <net/if_var.h> 50 #include <net/pfil.h> 51 #include <net/route.h> 52 #include <net/vnet.h> 53 54 #include <netinet/in.h> 55 #include <netinet/ip_var.h> 56 #include <netinet/ip_fw.h> 57 #include <netinet6/in6_var.h> 58 #include <netinet6/ip6_var.h> 59 #include <netinet6/ip_fw_nat64.h> 60 61 #include <netpfil/ipfw/ip_fw_private.h> 62 63 #include "nat64stl.h" 64 65 VNET_DEFINE(uint16_t, nat64stl_eid) = 0; 66 67 static struct nat64stl_cfg *nat64stl_alloc_config(const char *name, 68 uint8_t set); 69 static void nat64stl_free_config(struct nat64stl_cfg *cfg); 70 static struct nat64stl_cfg *nat64stl_find(struct namedobj_instance *ni, 71 const char *name, uint8_t set); 72 73 static struct nat64stl_cfg * 74 nat64stl_alloc_config(const char *name, uint8_t set) 75 { 76 struct nat64stl_cfg *cfg; 77 78 cfg = malloc(sizeof(struct nat64stl_cfg), M_IPFW, M_WAITOK | M_ZERO); 79 COUNTER_ARRAY_ALLOC(cfg->base.stats.cnt, NAT64STATS, M_WAITOK); 80 cfg->no.name = cfg->name; 81 cfg->no.etlv = IPFW_TLV_NAT64STL_NAME; 82 cfg->no.set = set; 83 strlcpy(cfg->name, name, sizeof(cfg->name)); 84 return (cfg); 85 } 86 87 static void 88 nat64stl_free_config(struct nat64stl_cfg *cfg) 89 { 90 91 COUNTER_ARRAY_FREE(cfg->base.stats.cnt, NAT64STATS); 92 free(cfg, M_IPFW); 93 } 94 95 static void 96 nat64stl_export_config(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg, 97 ipfw_nat64stl_cfg *uc) 98 { 99 struct named_object *no; 100 101 uc->prefix6 = cfg->base.plat_prefix; 102 uc->plen6 = cfg->base.plat_plen; 103 uc->flags = cfg->base.flags & NAT64STL_FLAGSMASK; 104 uc->set = cfg->no.set; 105 strlcpy(uc->name, cfg->no.name, sizeof(uc->name)); 106 107 no = ipfw_objhash_lookup_table_kidx(ch, cfg->map64); 108 ipfw_export_obj_ntlv(no, &uc->ntlv6); 109 no = ipfw_objhash_lookup_table_kidx(ch, cfg->map46); 110 ipfw_export_obj_ntlv(no, &uc->ntlv4); 111 } 112 113 struct nat64stl_dump_arg { 114 struct ip_fw_chain *ch; 115 struct sockopt_data *sd; 116 }; 117 118 static int 119 export_config_cb(struct namedobj_instance *ni, struct named_object *no, 120 void *arg) 121 { 122 struct nat64stl_dump_arg *da = (struct nat64stl_dump_arg *)arg; 123 ipfw_nat64stl_cfg *uc; 124 125 uc = (ipfw_nat64stl_cfg *)ipfw_get_sopt_space(da->sd, sizeof(*uc)); 126 nat64stl_export_config(da->ch, (struct nat64stl_cfg *)no, uc); 127 return (0); 128 } 129 130 static struct nat64stl_cfg * 131 nat64stl_find(struct namedobj_instance *ni, const char *name, uint8_t set) 132 { 133 struct nat64stl_cfg *cfg; 134 135 cfg = (struct nat64stl_cfg *)ipfw_objhash_lookup_name_type(ni, set, 136 IPFW_TLV_NAT64STL_NAME, name); 137 138 return (cfg); 139 } 140 141 static int 142 nat64stl_create_internal(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg, 143 ipfw_nat64stl_cfg *i) 144 { 145 146 IPFW_UH_WLOCK_ASSERT(ch); 147 148 if (ipfw_objhash_alloc_idx(CHAIN_TO_SRV(ch), &cfg->no.kidx) != 0) 149 return (ENOSPC); 150 cfg->base.flags |= NAT64STL_KIDX; 151 152 if (ipfw_ref_table(ch, &i->ntlv4, &cfg->map46) != 0) 153 return (EINVAL); 154 cfg->base.flags |= NAT64STL_46T; 155 156 if (ipfw_ref_table(ch, &i->ntlv6, &cfg->map64) != 0) 157 return (EINVAL); 158 cfg->base.flags |= NAT64STL_64T; 159 160 ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no); 161 162 return (0); 163 } 164 165 /* 166 * Creates new nat64 instance. 167 * Data layout (v0)(current): 168 * Request: [ ipfw_obj_lheader ipfw_nat64stl_cfg ] 169 * 170 * Returns 0 on success 171 */ 172 static int 173 nat64stl_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 174 struct sockopt_data *sd) 175 { 176 ipfw_obj_lheader *olh; 177 ipfw_nat64stl_cfg *uc; 178 struct namedobj_instance *ni; 179 struct nat64stl_cfg *cfg; 180 int error; 181 182 if (sd->valsize != sizeof(*olh) + sizeof(*uc)) 183 return (EINVAL); 184 185 olh = (ipfw_obj_lheader *)sd->kbuf; 186 uc = (ipfw_nat64stl_cfg *)(olh + 1); 187 188 if (ipfw_check_object_name_generic(uc->name) != 0) 189 return (EINVAL); 190 if (uc->set >= IPFW_MAX_SETS || 191 nat64_check_prefix6(&uc->prefix6, uc->plen6) != 0) 192 return (EINVAL); 193 194 /* XXX: check types of tables */ 195 196 ni = CHAIN_TO_SRV(ch); 197 error = 0; 198 199 IPFW_UH_RLOCK(ch); 200 if (nat64stl_find(ni, uc->name, uc->set) != NULL) { 201 IPFW_UH_RUNLOCK(ch); 202 return (EEXIST); 203 } 204 IPFW_UH_RUNLOCK(ch); 205 206 cfg = nat64stl_alloc_config(uc->name, uc->set); 207 cfg->base.plat_prefix = uc->prefix6; 208 cfg->base.plat_plen = uc->plen6; 209 cfg->base.flags = (uc->flags & NAT64STL_FLAGSMASK) | NAT64_PLATPFX; 210 if (IN6_IS_ADDR_WKPFX(&cfg->base.plat_prefix)) 211 cfg->base.flags |= NAT64_WKPFX; 212 213 IPFW_UH_WLOCK(ch); 214 215 if (nat64stl_find(ni, uc->name, uc->set) != NULL) { 216 IPFW_UH_WUNLOCK(ch); 217 nat64stl_free_config(cfg); 218 return (EEXIST); 219 } 220 error = nat64stl_create_internal(ch, cfg, uc); 221 if (error == 0) { 222 /* Okay, let's link data */ 223 SRV_OBJECT(ch, cfg->no.kidx) = cfg; 224 IPFW_UH_WUNLOCK(ch); 225 return (0); 226 } 227 228 if (cfg->base.flags & NAT64STL_KIDX) 229 ipfw_objhash_free_idx(ni, cfg->no.kidx); 230 if (cfg->base.flags & NAT64STL_46T) 231 ipfw_unref_table(ch, cfg->map46); 232 if (cfg->base.flags & NAT64STL_64T) 233 ipfw_unref_table(ch, cfg->map64); 234 235 IPFW_UH_WUNLOCK(ch); 236 nat64stl_free_config(cfg); 237 return (error); 238 } 239 240 /* 241 * Change existing nat64stl instance configuration. 242 * Data layout (v0)(current): 243 * Request: [ ipfw_obj_header ipfw_nat64stl_cfg ] 244 * Reply: [ ipfw_obj_header ipfw_nat64stl_cfg ] 245 * 246 * Returns 0 on success 247 */ 248 static int 249 nat64stl_config(struct ip_fw_chain *ch, ip_fw3_opheader *op, 250 struct sockopt_data *sd) 251 { 252 ipfw_obj_header *oh; 253 ipfw_nat64stl_cfg *uc; 254 struct nat64stl_cfg *cfg; 255 struct namedobj_instance *ni; 256 257 if (sd->valsize != sizeof(*oh) + sizeof(*uc)) 258 return (EINVAL); 259 260 oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd, 261 sizeof(*oh) + sizeof(*uc)); 262 uc = (ipfw_nat64stl_cfg *)(oh + 1); 263 264 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 || 265 oh->ntlv.set >= IPFW_MAX_SETS) 266 return (EINVAL); 267 268 ni = CHAIN_TO_SRV(ch); 269 if (sd->sopt->sopt_dir == SOPT_GET) { 270 IPFW_UH_RLOCK(ch); 271 cfg = nat64stl_find(ni, oh->ntlv.name, oh->ntlv.set); 272 if (cfg == NULL) { 273 IPFW_UH_RUNLOCK(ch); 274 return (EEXIST); 275 } 276 nat64stl_export_config(ch, cfg, uc); 277 IPFW_UH_RUNLOCK(ch); 278 return (0); 279 } 280 281 IPFW_UH_WLOCK(ch); 282 cfg = nat64stl_find(ni, oh->ntlv.name, oh->ntlv.set); 283 if (cfg == NULL) { 284 IPFW_UH_WUNLOCK(ch); 285 return (EEXIST); 286 } 287 288 /* 289 * For now allow to change only following values: 290 * flags. 291 */ 292 cfg->base.flags &= ~NAT64STL_FLAGSMASK; 293 cfg->base.flags |= uc->flags & NAT64STL_FLAGSMASK; 294 295 IPFW_UH_WUNLOCK(ch); 296 return (0); 297 } 298 299 static void 300 nat64stl_detach_config(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg) 301 { 302 303 IPFW_UH_WLOCK_ASSERT(ch); 304 305 ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no); 306 ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx); 307 ipfw_unref_table(ch, cfg->map46); 308 ipfw_unref_table(ch, cfg->map64); 309 } 310 311 /* 312 * Destroys nat64 instance. 313 * Data layout (v0)(current): 314 * Request: [ ipfw_obj_header ] 315 * 316 * Returns 0 on success 317 */ 318 static int 319 nat64stl_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 320 struct sockopt_data *sd) 321 { 322 ipfw_obj_header *oh; 323 struct nat64stl_cfg *cfg; 324 325 if (sd->valsize != sizeof(*oh)) 326 return (EINVAL); 327 328 oh = (ipfw_obj_header *)sd->kbuf; 329 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0) 330 return (EINVAL); 331 332 IPFW_UH_WLOCK(ch); 333 cfg = nat64stl_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 334 if (cfg == NULL) { 335 IPFW_UH_WUNLOCK(ch); 336 return (ESRCH); 337 } 338 if (cfg->no.refcnt > 0) { 339 IPFW_UH_WUNLOCK(ch); 340 return (EBUSY); 341 } 342 343 ipfw_reset_eaction_instance(ch, V_nat64stl_eid, cfg->no.kidx); 344 SRV_OBJECT(ch, cfg->no.kidx) = NULL; 345 nat64stl_detach_config(ch, cfg); 346 IPFW_UH_WUNLOCK(ch); 347 348 nat64stl_free_config(cfg); 349 return (0); 350 } 351 352 /* 353 * Lists all nat64stl instances currently available in kernel. 354 * Data layout (v0)(current): 355 * Request: [ ipfw_obj_lheader ] 356 * Reply: [ ipfw_obj_lheader ipfw_nat64stl_cfg x N ] 357 * 358 * Returns 0 on success 359 */ 360 static int 361 nat64stl_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 362 struct sockopt_data *sd) 363 { 364 ipfw_obj_lheader *olh; 365 struct nat64stl_dump_arg da; 366 367 /* Check minimum header size */ 368 if (sd->valsize < sizeof(ipfw_obj_lheader)) 369 return (EINVAL); 370 371 olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh)); 372 373 IPFW_UH_RLOCK(ch); 374 olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch), 375 IPFW_TLV_NAT64STL_NAME); 376 olh->objsize = sizeof(ipfw_nat64stl_cfg); 377 olh->size = sizeof(*olh) + olh->count * olh->objsize; 378 379 if (sd->valsize < olh->size) { 380 IPFW_UH_RUNLOCK(ch); 381 return (ENOMEM); 382 } 383 memset(&da, 0, sizeof(da)); 384 da.ch = ch; 385 da.sd = sd; 386 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb, 387 &da, IPFW_TLV_NAT64STL_NAME); 388 IPFW_UH_RUNLOCK(ch); 389 390 return (0); 391 } 392 393 #define __COPY_STAT_FIELD(_cfg, _stats, _field) \ 394 (_stats)->_field = NAT64STAT_FETCH(&(_cfg)->base.stats, _field) 395 static void 396 export_stats(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg, 397 struct ipfw_nat64stl_stats *stats) 398 { 399 400 __COPY_STAT_FIELD(cfg, stats, opcnt64); 401 __COPY_STAT_FIELD(cfg, stats, opcnt46); 402 __COPY_STAT_FIELD(cfg, stats, ofrags); 403 __COPY_STAT_FIELD(cfg, stats, ifrags); 404 __COPY_STAT_FIELD(cfg, stats, oerrors); 405 __COPY_STAT_FIELD(cfg, stats, noroute4); 406 __COPY_STAT_FIELD(cfg, stats, noroute6); 407 __COPY_STAT_FIELD(cfg, stats, noproto); 408 __COPY_STAT_FIELD(cfg, stats, nomem); 409 __COPY_STAT_FIELD(cfg, stats, dropped); 410 } 411 412 /* 413 * Get nat64stl statistics. 414 * Data layout (v0)(current): 415 * Request: [ ipfw_obj_header ] 416 * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ]] 417 * 418 * Returns 0 on success 419 */ 420 static int 421 nat64stl_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op, 422 struct sockopt_data *sd) 423 { 424 struct ipfw_nat64stl_stats stats; 425 struct nat64stl_cfg *cfg; 426 ipfw_obj_header *oh; 427 ipfw_obj_ctlv *ctlv; 428 size_t sz; 429 430 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats); 431 if (sd->valsize % sizeof(uint64_t)) 432 return (EINVAL); 433 if (sd->valsize < sz) 434 return (ENOMEM); 435 oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 436 if (oh == NULL) 437 return (EINVAL); 438 memset(&stats, 0, sizeof(stats)); 439 440 IPFW_UH_RLOCK(ch); 441 cfg = nat64stl_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 442 if (cfg == NULL) { 443 IPFW_UH_RUNLOCK(ch); 444 return (ESRCH); 445 } 446 export_stats(ch, cfg, &stats); 447 IPFW_UH_RUNLOCK(ch); 448 449 ctlv = (ipfw_obj_ctlv *)(oh + 1); 450 memset(ctlv, 0, sizeof(*ctlv)); 451 ctlv->head.type = IPFW_TLV_COUNTERS; 452 ctlv->head.length = sz - sizeof(ipfw_obj_header); 453 ctlv->count = sizeof(stats) / sizeof(uint64_t); 454 ctlv->objsize = sizeof(uint64_t); 455 ctlv->version = IPFW_NAT64_VERSION; 456 memcpy(ctlv + 1, &stats, sizeof(stats)); 457 return (0); 458 } 459 460 /* 461 * Reset nat64stl statistics. 462 * Data layout (v0)(current): 463 * Request: [ ipfw_obj_header ] 464 * 465 * Returns 0 on success 466 */ 467 static int 468 nat64stl_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op, 469 struct sockopt_data *sd) 470 { 471 struct nat64stl_cfg *cfg; 472 ipfw_obj_header *oh; 473 474 if (sd->valsize != sizeof(*oh)) 475 return (EINVAL); 476 oh = (ipfw_obj_header *)sd->kbuf; 477 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 || 478 oh->ntlv.set >= IPFW_MAX_SETS) 479 return (EINVAL); 480 481 IPFW_UH_WLOCK(ch); 482 cfg = nat64stl_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 483 if (cfg == NULL) { 484 IPFW_UH_WUNLOCK(ch); 485 return (ESRCH); 486 } 487 COUNTER_ARRAY_ZERO(cfg->base.stats.cnt, NAT64STATS); 488 IPFW_UH_WUNLOCK(ch); 489 return (0); 490 } 491 492 static struct ipfw_sopt_handler scodes[] = { 493 { IP_FW_NAT64STL_CREATE, 0, HDIR_SET, nat64stl_create }, 494 { IP_FW_NAT64STL_DESTROY,0, HDIR_SET, nat64stl_destroy }, 495 { IP_FW_NAT64STL_CONFIG, 0, HDIR_BOTH, nat64stl_config }, 496 { IP_FW_NAT64STL_LIST, 0, HDIR_GET, nat64stl_list }, 497 { IP_FW_NAT64STL_STATS, 0, HDIR_GET, nat64stl_stats }, 498 { IP_FW_NAT64STL_RESET_STATS,0, HDIR_SET, nat64stl_reset_stats }, 499 }; 500 501 static int 502 nat64stl_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 503 { 504 ipfw_insn *icmd; 505 506 icmd = cmd - 1; 507 if (icmd->opcode != O_EXTERNAL_ACTION || 508 icmd->arg1 != V_nat64stl_eid) 509 return (1); 510 511 *puidx = cmd->arg1; 512 *ptype = 0; 513 return (0); 514 } 515 516 static void 517 nat64stl_update_arg1(ipfw_insn *cmd, uint16_t idx) 518 { 519 520 cmd->arg1 = idx; 521 } 522 523 static int 524 nat64stl_findbyname(struct ip_fw_chain *ch, struct tid_info *ti, 525 struct named_object **pno) 526 { 527 int err; 528 529 err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti, 530 IPFW_TLV_NAT64STL_NAME, pno); 531 return (err); 532 } 533 534 static struct named_object * 535 nat64stl_findbykidx(struct ip_fw_chain *ch, uint16_t idx) 536 { 537 struct namedobj_instance *ni; 538 struct named_object *no; 539 540 IPFW_UH_WLOCK_ASSERT(ch); 541 ni = CHAIN_TO_SRV(ch); 542 no = ipfw_objhash_lookup_kidx(ni, idx); 543 KASSERT(no != NULL, ("NAT with index %d not found", idx)); 544 545 return (no); 546 } 547 548 static int 549 nat64stl_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set, 550 enum ipfw_sets_cmd cmd) 551 { 552 553 return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64STL_NAME, 554 set, new_set, cmd)); 555 } 556 557 static struct opcode_obj_rewrite opcodes[] = { 558 { 559 .opcode = O_EXTERNAL_INSTANCE, 560 .etlv = IPFW_TLV_EACTION /* just show it isn't table */, 561 .classifier = nat64stl_classify, 562 .update = nat64stl_update_arg1, 563 .find_byname = nat64stl_findbyname, 564 .find_bykidx = nat64stl_findbykidx, 565 .manage_sets = nat64stl_manage_sets, 566 }, 567 }; 568 569 static int 570 destroy_config_cb(struct namedobj_instance *ni, struct named_object *no, 571 void *arg) 572 { 573 struct nat64stl_cfg *cfg; 574 struct ip_fw_chain *ch; 575 576 ch = (struct ip_fw_chain *)arg; 577 cfg = (struct nat64stl_cfg *)SRV_OBJECT(ch, no->kidx); 578 SRV_OBJECT(ch, no->kidx) = NULL; 579 nat64stl_detach_config(ch, cfg); 580 nat64stl_free_config(cfg); 581 return (0); 582 } 583 584 int 585 nat64stl_init(struct ip_fw_chain *ch, int first) 586 { 587 588 V_nat64stl_eid = ipfw_add_eaction(ch, ipfw_nat64stl, "nat64stl"); 589 if (V_nat64stl_eid == 0) 590 return (ENXIO); 591 IPFW_ADD_SOPT_HANDLER(first, scodes); 592 IPFW_ADD_OBJ_REWRITER(first, opcodes); 593 return (0); 594 } 595 596 void 597 nat64stl_uninit(struct ip_fw_chain *ch, int last) 598 { 599 600 IPFW_DEL_OBJ_REWRITER(last, opcodes); 601 IPFW_DEL_SOPT_HANDLER(last, scodes); 602 ipfw_del_eaction(ch, V_nat64stl_eid); 603 /* 604 * Since we already have deregistered external action, 605 * our named objects become unaccessible via rules, because 606 * all rules were truncated by ipfw_del_eaction(). 607 * So, we can unlink and destroy our named objects without holding 608 * IPFW_WLOCK(). 609 */ 610 IPFW_UH_WLOCK(ch); 611 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch, 612 IPFW_TLV_NAT64STL_NAME); 613 V_nat64stl_eid = 0; 614 IPFW_UH_WUNLOCK(ch); 615 } 616