1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2015-2019 Yandex LLC 5 * Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org> 6 * Copyright (c) 2015-2019 Andrey V. Elsukov <ae@FreeBSD.org> 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 #include <sys/cdefs.h> 31 __FBSDID("$FreeBSD$"); 32 33 #include <sys/param.h> 34 #include <sys/systm.h> 35 #include <sys/counter.h> 36 #include <sys/errno.h> 37 #include <sys/kernel.h> 38 #include <sys/lock.h> 39 #include <sys/malloc.h> 40 #include <sys/mbuf.h> 41 #include <sys/module.h> 42 #include <sys/rmlock.h> 43 #include <sys/rwlock.h> 44 #include <sys/socket.h> 45 #include <sys/sockopt.h> 46 #include <sys/queue.h> 47 #include <sys/syslog.h> 48 #include <sys/sysctl.h> 49 50 #include <net/if.h> 51 #include <net/if_var.h> 52 #include <net/pfil.h> 53 #include <net/route.h> 54 #include <net/vnet.h> 55 56 #include <netinet/in.h> 57 #include <netinet/ip_var.h> 58 #include <netinet/ip_fw.h> 59 #include <netinet6/in6_var.h> 60 #include <netinet6/ip6_var.h> 61 #include <netinet6/ip_fw_nat64.h> 62 63 #include <netpfil/ipfw/ip_fw_private.h> 64 65 #include "nat64stl.h" 66 67 VNET_DEFINE(uint16_t, nat64stl_eid) = 0; 68 69 static struct nat64stl_cfg *nat64stl_alloc_config(const char *name, 70 uint8_t set); 71 static void nat64stl_free_config(struct nat64stl_cfg *cfg); 72 static struct nat64stl_cfg *nat64stl_find(struct namedobj_instance *ni, 73 const char *name, uint8_t set); 74 75 static struct nat64stl_cfg * 76 nat64stl_alloc_config(const char *name, uint8_t set) 77 { 78 struct nat64stl_cfg *cfg; 79 80 cfg = malloc(sizeof(struct nat64stl_cfg), M_IPFW, M_WAITOK | M_ZERO); 81 COUNTER_ARRAY_ALLOC(cfg->base.stats.cnt, NAT64STATS, M_WAITOK); 82 cfg->no.name = cfg->name; 83 cfg->no.etlv = IPFW_TLV_NAT64STL_NAME; 84 cfg->no.set = set; 85 strlcpy(cfg->name, name, sizeof(cfg->name)); 86 return (cfg); 87 } 88 89 static void 90 nat64stl_free_config(struct nat64stl_cfg *cfg) 91 { 92 93 COUNTER_ARRAY_FREE(cfg->base.stats.cnt, NAT64STATS); 94 free(cfg, M_IPFW); 95 } 96 97 static void 98 nat64stl_export_config(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg, 99 ipfw_nat64stl_cfg *uc) 100 { 101 struct named_object *no; 102 103 uc->prefix6 = cfg->base.plat_prefix; 104 uc->plen6 = cfg->base.plat_plen; 105 uc->flags = cfg->base.flags & NAT64STL_FLAGSMASK; 106 uc->set = cfg->no.set; 107 strlcpy(uc->name, cfg->no.name, sizeof(uc->name)); 108 109 no = ipfw_objhash_lookup_table_kidx(ch, cfg->map64); 110 ipfw_export_obj_ntlv(no, &uc->ntlv6); 111 no = ipfw_objhash_lookup_table_kidx(ch, cfg->map46); 112 ipfw_export_obj_ntlv(no, &uc->ntlv4); 113 } 114 115 struct nat64stl_dump_arg { 116 struct ip_fw_chain *ch; 117 struct sockopt_data *sd; 118 }; 119 120 static int 121 export_config_cb(struct namedobj_instance *ni, struct named_object *no, 122 void *arg) 123 { 124 struct nat64stl_dump_arg *da = (struct nat64stl_dump_arg *)arg; 125 ipfw_nat64stl_cfg *uc; 126 127 uc = (ipfw_nat64stl_cfg *)ipfw_get_sopt_space(da->sd, sizeof(*uc)); 128 nat64stl_export_config(da->ch, (struct nat64stl_cfg *)no, uc); 129 return (0); 130 } 131 132 static struct nat64stl_cfg * 133 nat64stl_find(struct namedobj_instance *ni, const char *name, uint8_t set) 134 { 135 struct nat64stl_cfg *cfg; 136 137 cfg = (struct nat64stl_cfg *)ipfw_objhash_lookup_name_type(ni, set, 138 IPFW_TLV_NAT64STL_NAME, name); 139 140 return (cfg); 141 } 142 143 144 static int 145 nat64stl_create_internal(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg, 146 ipfw_nat64stl_cfg *i) 147 { 148 149 IPFW_UH_WLOCK_ASSERT(ch); 150 151 if (ipfw_objhash_alloc_idx(CHAIN_TO_SRV(ch), &cfg->no.kidx) != 0) 152 return (ENOSPC); 153 cfg->base.flags |= NAT64STL_KIDX; 154 155 if (ipfw_ref_table(ch, &i->ntlv4, &cfg->map46) != 0) 156 return (EINVAL); 157 cfg->base.flags |= NAT64STL_46T; 158 159 if (ipfw_ref_table(ch, &i->ntlv6, &cfg->map64) != 0) 160 return (EINVAL); 161 cfg->base.flags |= NAT64STL_64T; 162 163 ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no); 164 165 return (0); 166 } 167 168 /* 169 * Creates new nat64 instance. 170 * Data layout (v0)(current): 171 * Request: [ ipfw_obj_lheader ipfw_nat64stl_cfg ] 172 * 173 * Returns 0 on success 174 */ 175 static int 176 nat64stl_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 177 struct sockopt_data *sd) 178 { 179 ipfw_obj_lheader *olh; 180 ipfw_nat64stl_cfg *uc; 181 struct namedobj_instance *ni; 182 struct nat64stl_cfg *cfg; 183 int error; 184 185 if (sd->valsize != sizeof(*olh) + sizeof(*uc)) 186 return (EINVAL); 187 188 olh = (ipfw_obj_lheader *)sd->kbuf; 189 uc = (ipfw_nat64stl_cfg *)(olh + 1); 190 191 if (ipfw_check_object_name_generic(uc->name) != 0) 192 return (EINVAL); 193 if (uc->set >= IPFW_MAX_SETS || 194 nat64_check_prefix6(&uc->prefix6, uc->plen6) != 0) 195 return (EINVAL); 196 197 /* XXX: check types of tables */ 198 199 ni = CHAIN_TO_SRV(ch); 200 error = 0; 201 202 IPFW_UH_RLOCK(ch); 203 if (nat64stl_find(ni, uc->name, uc->set) != NULL) { 204 IPFW_UH_RUNLOCK(ch); 205 return (EEXIST); 206 } 207 IPFW_UH_RUNLOCK(ch); 208 209 cfg = nat64stl_alloc_config(uc->name, uc->set); 210 cfg->base.plat_prefix = uc->prefix6; 211 cfg->base.plat_plen = uc->plen6; 212 cfg->base.flags = (uc->flags & NAT64STL_FLAGSMASK) | NAT64_PLATPFX; 213 if (IN6_IS_ADDR_WKPFX(&cfg->base.plat_prefix)) 214 cfg->base.flags |= NAT64_WKPFX; 215 216 IPFW_UH_WLOCK(ch); 217 218 if (nat64stl_find(ni, uc->name, uc->set) != NULL) { 219 IPFW_UH_WUNLOCK(ch); 220 nat64stl_free_config(cfg); 221 return (EEXIST); 222 } 223 error = nat64stl_create_internal(ch, cfg, uc); 224 if (error == 0) { 225 /* Okay, let's link data */ 226 SRV_OBJECT(ch, cfg->no.kidx) = cfg; 227 IPFW_UH_WUNLOCK(ch); 228 return (0); 229 } 230 231 if (cfg->base.flags & NAT64STL_KIDX) 232 ipfw_objhash_free_idx(ni, cfg->no.kidx); 233 if (cfg->base.flags & NAT64STL_46T) 234 ipfw_unref_table(ch, cfg->map46); 235 if (cfg->base.flags & NAT64STL_64T) 236 ipfw_unref_table(ch, cfg->map64); 237 238 IPFW_UH_WUNLOCK(ch); 239 nat64stl_free_config(cfg); 240 return (error); 241 } 242 243 /* 244 * Change existing nat64stl instance configuration. 245 * Data layout (v0)(current): 246 * Request: [ ipfw_obj_header ipfw_nat64stl_cfg ] 247 * Reply: [ ipfw_obj_header ipfw_nat64stl_cfg ] 248 * 249 * Returns 0 on success 250 */ 251 static int 252 nat64stl_config(struct ip_fw_chain *ch, ip_fw3_opheader *op, 253 struct sockopt_data *sd) 254 { 255 ipfw_obj_header *oh; 256 ipfw_nat64stl_cfg *uc; 257 struct nat64stl_cfg *cfg; 258 struct namedobj_instance *ni; 259 260 if (sd->valsize != sizeof(*oh) + sizeof(*uc)) 261 return (EINVAL); 262 263 oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd, 264 sizeof(*oh) + sizeof(*uc)); 265 uc = (ipfw_nat64stl_cfg *)(oh + 1); 266 267 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 || 268 oh->ntlv.set >= IPFW_MAX_SETS) 269 return (EINVAL); 270 271 ni = CHAIN_TO_SRV(ch); 272 if (sd->sopt->sopt_dir == SOPT_GET) { 273 IPFW_UH_RLOCK(ch); 274 cfg = nat64stl_find(ni, oh->ntlv.name, oh->ntlv.set); 275 if (cfg == NULL) { 276 IPFW_UH_RUNLOCK(ch); 277 return (EEXIST); 278 } 279 nat64stl_export_config(ch, cfg, uc); 280 IPFW_UH_RUNLOCK(ch); 281 return (0); 282 } 283 284 IPFW_UH_WLOCK(ch); 285 cfg = nat64stl_find(ni, oh->ntlv.name, oh->ntlv.set); 286 if (cfg == NULL) { 287 IPFW_UH_WUNLOCK(ch); 288 return (EEXIST); 289 } 290 291 /* 292 * For now allow to change only following values: 293 * flags. 294 */ 295 cfg->base.flags &= ~NAT64STL_FLAGSMASK; 296 cfg->base.flags |= uc->flags & NAT64STL_FLAGSMASK; 297 298 IPFW_UH_WUNLOCK(ch); 299 return (0); 300 } 301 302 static void 303 nat64stl_detach_config(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg) 304 { 305 306 IPFW_UH_WLOCK_ASSERT(ch); 307 308 ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no); 309 ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx); 310 ipfw_unref_table(ch, cfg->map46); 311 ipfw_unref_table(ch, cfg->map64); 312 } 313 314 /* 315 * Destroys nat64 instance. 316 * Data layout (v0)(current): 317 * Request: [ ipfw_obj_header ] 318 * 319 * Returns 0 on success 320 */ 321 static int 322 nat64stl_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 323 struct sockopt_data *sd) 324 { 325 ipfw_obj_header *oh; 326 struct nat64stl_cfg *cfg; 327 328 if (sd->valsize != sizeof(*oh)) 329 return (EINVAL); 330 331 oh = (ipfw_obj_header *)sd->kbuf; 332 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0) 333 return (EINVAL); 334 335 IPFW_UH_WLOCK(ch); 336 cfg = nat64stl_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 337 if (cfg == NULL) { 338 IPFW_UH_WUNLOCK(ch); 339 return (ESRCH); 340 } 341 if (cfg->no.refcnt > 0) { 342 IPFW_UH_WUNLOCK(ch); 343 return (EBUSY); 344 } 345 346 ipfw_reset_eaction_instance(ch, V_nat64stl_eid, cfg->no.kidx); 347 SRV_OBJECT(ch, cfg->no.kidx) = NULL; 348 nat64stl_detach_config(ch, cfg); 349 IPFW_UH_WUNLOCK(ch); 350 351 nat64stl_free_config(cfg); 352 return (0); 353 } 354 355 /* 356 * Lists all nat64stl instances currently available in kernel. 357 * Data layout (v0)(current): 358 * Request: [ ipfw_obj_lheader ] 359 * Reply: [ ipfw_obj_lheader ipfw_nat64stl_cfg x N ] 360 * 361 * Returns 0 on success 362 */ 363 static int 364 nat64stl_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 365 struct sockopt_data *sd) 366 { 367 ipfw_obj_lheader *olh; 368 struct nat64stl_dump_arg da; 369 370 /* Check minimum header size */ 371 if (sd->valsize < sizeof(ipfw_obj_lheader)) 372 return (EINVAL); 373 374 olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh)); 375 376 IPFW_UH_RLOCK(ch); 377 olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch), 378 IPFW_TLV_NAT64STL_NAME); 379 olh->objsize = sizeof(ipfw_nat64stl_cfg); 380 olh->size = sizeof(*olh) + olh->count * olh->objsize; 381 382 if (sd->valsize < olh->size) { 383 IPFW_UH_RUNLOCK(ch); 384 return (ENOMEM); 385 } 386 memset(&da, 0, sizeof(da)); 387 da.ch = ch; 388 da.sd = sd; 389 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb, 390 &da, IPFW_TLV_NAT64STL_NAME); 391 IPFW_UH_RUNLOCK(ch); 392 393 return (0); 394 } 395 396 #define __COPY_STAT_FIELD(_cfg, _stats, _field) \ 397 (_stats)->_field = NAT64STAT_FETCH(&(_cfg)->base.stats, _field) 398 static void 399 export_stats(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg, 400 struct ipfw_nat64stl_stats *stats) 401 { 402 403 __COPY_STAT_FIELD(cfg, stats, opcnt64); 404 __COPY_STAT_FIELD(cfg, stats, opcnt46); 405 __COPY_STAT_FIELD(cfg, stats, ofrags); 406 __COPY_STAT_FIELD(cfg, stats, ifrags); 407 __COPY_STAT_FIELD(cfg, stats, oerrors); 408 __COPY_STAT_FIELD(cfg, stats, noroute4); 409 __COPY_STAT_FIELD(cfg, stats, noroute6); 410 __COPY_STAT_FIELD(cfg, stats, noproto); 411 __COPY_STAT_FIELD(cfg, stats, nomem); 412 __COPY_STAT_FIELD(cfg, stats, dropped); 413 } 414 415 /* 416 * Get nat64stl statistics. 417 * Data layout (v0)(current): 418 * Request: [ ipfw_obj_header ] 419 * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ]] 420 * 421 * Returns 0 on success 422 */ 423 static int 424 nat64stl_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op, 425 struct sockopt_data *sd) 426 { 427 struct ipfw_nat64stl_stats stats; 428 struct nat64stl_cfg *cfg; 429 ipfw_obj_header *oh; 430 ipfw_obj_ctlv *ctlv; 431 size_t sz; 432 433 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats); 434 if (sd->valsize % sizeof(uint64_t)) 435 return (EINVAL); 436 if (sd->valsize < sz) 437 return (ENOMEM); 438 oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 439 if (oh == NULL) 440 return (EINVAL); 441 memset(&stats, 0, sizeof(stats)); 442 443 IPFW_UH_RLOCK(ch); 444 cfg = nat64stl_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 445 if (cfg == NULL) { 446 IPFW_UH_RUNLOCK(ch); 447 return (ESRCH); 448 } 449 export_stats(ch, cfg, &stats); 450 IPFW_UH_RUNLOCK(ch); 451 452 ctlv = (ipfw_obj_ctlv *)(oh + 1); 453 memset(ctlv, 0, sizeof(*ctlv)); 454 ctlv->head.type = IPFW_TLV_COUNTERS; 455 ctlv->head.length = sz - sizeof(ipfw_obj_header); 456 ctlv->count = sizeof(stats) / sizeof(uint64_t); 457 ctlv->objsize = sizeof(uint64_t); 458 ctlv->version = IPFW_NAT64_VERSION; 459 memcpy(ctlv + 1, &stats, sizeof(stats)); 460 return (0); 461 } 462 463 /* 464 * Reset nat64stl statistics. 465 * Data layout (v0)(current): 466 * Request: [ ipfw_obj_header ] 467 * 468 * Returns 0 on success 469 */ 470 static int 471 nat64stl_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op, 472 struct sockopt_data *sd) 473 { 474 struct nat64stl_cfg *cfg; 475 ipfw_obj_header *oh; 476 477 if (sd->valsize != sizeof(*oh)) 478 return (EINVAL); 479 oh = (ipfw_obj_header *)sd->kbuf; 480 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 || 481 oh->ntlv.set >= IPFW_MAX_SETS) 482 return (EINVAL); 483 484 IPFW_UH_WLOCK(ch); 485 cfg = nat64stl_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 486 if (cfg == NULL) { 487 IPFW_UH_WUNLOCK(ch); 488 return (ESRCH); 489 } 490 COUNTER_ARRAY_ZERO(cfg->base.stats.cnt, NAT64STATS); 491 IPFW_UH_WUNLOCK(ch); 492 return (0); 493 } 494 495 static struct ipfw_sopt_handler scodes[] = { 496 497 { IP_FW_NAT64STL_CREATE, 0, HDIR_SET, nat64stl_create }, 498 { IP_FW_NAT64STL_DESTROY,0, HDIR_SET, nat64stl_destroy }, 499 { IP_FW_NAT64STL_CONFIG, 0, HDIR_BOTH, nat64stl_config }, 500 { IP_FW_NAT64STL_LIST, 0, HDIR_GET, nat64stl_list }, 501 { IP_FW_NAT64STL_STATS, 0, HDIR_GET, nat64stl_stats }, 502 { IP_FW_NAT64STL_RESET_STATS,0, HDIR_SET, nat64stl_reset_stats }, 503 }; 504 505 static int 506 nat64stl_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 507 { 508 ipfw_insn *icmd; 509 510 icmd = cmd - 1; 511 if (icmd->opcode != O_EXTERNAL_ACTION || 512 icmd->arg1 != V_nat64stl_eid) 513 return (1); 514 515 *puidx = cmd->arg1; 516 *ptype = 0; 517 return (0); 518 } 519 520 static void 521 nat64stl_update_arg1(ipfw_insn *cmd, uint16_t idx) 522 { 523 524 cmd->arg1 = idx; 525 } 526 527 static int 528 nat64stl_findbyname(struct ip_fw_chain *ch, struct tid_info *ti, 529 struct named_object **pno) 530 { 531 int err; 532 533 err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti, 534 IPFW_TLV_NAT64STL_NAME, pno); 535 return (err); 536 } 537 538 static struct named_object * 539 nat64stl_findbykidx(struct ip_fw_chain *ch, uint16_t idx) 540 { 541 struct namedobj_instance *ni; 542 struct named_object *no; 543 544 IPFW_UH_WLOCK_ASSERT(ch); 545 ni = CHAIN_TO_SRV(ch); 546 no = ipfw_objhash_lookup_kidx(ni, idx); 547 KASSERT(no != NULL, ("NAT with index %d not found", idx)); 548 549 return (no); 550 } 551 552 static int 553 nat64stl_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set, 554 enum ipfw_sets_cmd cmd) 555 { 556 557 return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64STL_NAME, 558 set, new_set, cmd)); 559 } 560 561 static struct opcode_obj_rewrite opcodes[] = { 562 { 563 .opcode = O_EXTERNAL_INSTANCE, 564 .etlv = IPFW_TLV_EACTION /* just show it isn't table */, 565 .classifier = nat64stl_classify, 566 .update = nat64stl_update_arg1, 567 .find_byname = nat64stl_findbyname, 568 .find_bykidx = nat64stl_findbykidx, 569 .manage_sets = nat64stl_manage_sets, 570 }, 571 }; 572 573 static int 574 destroy_config_cb(struct namedobj_instance *ni, struct named_object *no, 575 void *arg) 576 { 577 struct nat64stl_cfg *cfg; 578 struct ip_fw_chain *ch; 579 580 ch = (struct ip_fw_chain *)arg; 581 cfg = (struct nat64stl_cfg *)SRV_OBJECT(ch, no->kidx); 582 SRV_OBJECT(ch, no->kidx) = NULL; 583 nat64stl_detach_config(ch, cfg); 584 nat64stl_free_config(cfg); 585 return (0); 586 } 587 588 int 589 nat64stl_init(struct ip_fw_chain *ch, int first) 590 { 591 592 V_nat64stl_eid = ipfw_add_eaction(ch, ipfw_nat64stl, "nat64stl"); 593 if (V_nat64stl_eid == 0) 594 return (ENXIO); 595 IPFW_ADD_SOPT_HANDLER(first, scodes); 596 IPFW_ADD_OBJ_REWRITER(first, opcodes); 597 return (0); 598 } 599 600 void 601 nat64stl_uninit(struct ip_fw_chain *ch, int last) 602 { 603 604 IPFW_DEL_OBJ_REWRITER(last, opcodes); 605 IPFW_DEL_SOPT_HANDLER(last, scodes); 606 ipfw_del_eaction(ch, V_nat64stl_eid); 607 /* 608 * Since we already have deregistered external action, 609 * our named objects become unaccessible via rules, because 610 * all rules were truncated by ipfw_del_eaction(). 611 * So, we can unlink and destroy our named objects without holding 612 * IPFW_WLOCK(). 613 */ 614 IPFW_UH_WLOCK(ch); 615 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch, 616 IPFW_TLV_NAT64STL_NAME); 617 V_nat64stl_eid = 0; 618 IPFW_UH_WUNLOCK(ch); 619 } 620 621