nat64stl_control.c revision 316446
1/*- 2 * Copyright (c) 2015-2016 Yandex LLC 3 * Copyright (c) 2015-2016 Andrey V. Elsukov <ae@FreeBSD.org> 4 * Copyright (c) 2015 Alexander V. Chernikov <melifaro@FreeBSD.org> 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29#include <sys/cdefs.h> 30__FBSDID("$FreeBSD: stable/11/sys/netpfil/ipfw/nat64/nat64stl_control.c 304046 2016-08-13 16:09:49Z ae $"); 31 32#include <sys/param.h> 33#include <sys/systm.h> 34#include <sys/counter.h> 35#include <sys/errno.h> 36#include <sys/kernel.h> 37#include <sys/lock.h> 38#include <sys/malloc.h> 39#include <sys/mbuf.h> 40#include <sys/module.h> 41#include <sys/rmlock.h> 42#include <sys/rwlock.h> 43#include <sys/socket.h> 44#include <sys/sockopt.h> 45#include <sys/queue.h> 46#include <sys/syslog.h> 47#include <sys/sysctl.h> 48 49#include <net/if.h> 50#include <net/if_var.h> 51#include <net/pfil.h> 52#include <net/route.h> 53#include <net/vnet.h> 54 55#include <netinet/in.h> 56#include <netinet/ip_var.h> 57#include <netinet/ip_fw.h> 58#include <netinet6/in6_var.h> 59#include <netinet6/ip6_var.h> 60 61#include <netpfil/ipfw/ip_fw_private.h> 62#include <netpfil/ipfw/nat64/ip_fw_nat64.h> 63#include <netpfil/ipfw/nat64/nat64stl.h> 64#include <netinet6/ip_fw_nat64.h> 65 66VNET_DEFINE(uint16_t, nat64stl_eid) = 0; 67 68static struct nat64stl_cfg *nat64stl_alloc_config(const char *name, uint8_t set); 69static void nat64stl_free_config(struct nat64stl_cfg *cfg); 70static struct nat64stl_cfg *nat64stl_find(struct namedobj_instance *ni, 71 const char *name, uint8_t set); 72 73static struct nat64stl_cfg * 74nat64stl_alloc_config(const char *name, uint8_t set) 75{ 76 struct nat64stl_cfg *cfg; 77 78 cfg = malloc(sizeof(struct nat64stl_cfg), M_IPFW, M_WAITOK | M_ZERO); 79 COUNTER_ARRAY_ALLOC(cfg->stats.stats, NAT64STATS, M_WAITOK); 80 cfg->no.name = cfg->name; 81 cfg->no.etlv = IPFW_TLV_NAT64STL_NAME; 82 cfg->no.set = set; 83 strlcpy(cfg->name, name, sizeof(cfg->name)); 84 return (cfg); 85} 86 87static void 88nat64stl_free_config(struct nat64stl_cfg *cfg) 89{ 90 91 COUNTER_ARRAY_FREE(cfg->stats.stats, NAT64STATS); 92 free(cfg, M_IPFW); 93} 94 95static void 96nat64stl_export_config(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg, 97 ipfw_nat64stl_cfg *uc) 98{ 99 struct named_object *no; 100 101 uc->prefix6 = cfg->prefix6; 102 uc->plen6 = cfg->plen6; 103 uc->flags = cfg->flags & NAT64STL_FLAGSMASK; 104 uc->set = cfg->no.set; 105 strlcpy(uc->name, cfg->no.name, sizeof(uc->name)); 106 107 no = ipfw_objhash_lookup_table_kidx(ch, cfg->map64); 108 ipfw_export_obj_ntlv(no, &uc->ntlv6); 109 no = ipfw_objhash_lookup_table_kidx(ch, cfg->map46); 110 ipfw_export_obj_ntlv(no, &uc->ntlv4); 111} 112 113struct nat64stl_dump_arg { 114 struct ip_fw_chain *ch; 115 struct sockopt_data *sd; 116}; 117 118static int 119export_config_cb(struct namedobj_instance *ni, struct named_object *no, 120 void *arg) 121{ 122 struct nat64stl_dump_arg *da = (struct nat64stl_dump_arg *)arg; 123 ipfw_nat64stl_cfg *uc; 124 125 uc = (ipfw_nat64stl_cfg *)ipfw_get_sopt_space(da->sd, sizeof(*uc)); 126 nat64stl_export_config(da->ch, (struct nat64stl_cfg *)no, uc); 127 return (0); 128} 129 130static struct nat64stl_cfg * 131nat64stl_find(struct namedobj_instance *ni, const char *name, uint8_t set) 132{ 133 struct nat64stl_cfg *cfg; 134 135 cfg = (struct nat64stl_cfg *)ipfw_objhash_lookup_name_type(ni, set, 136 IPFW_TLV_NAT64STL_NAME, name); 137 138 return (cfg); 139} 140 141 142static int 143nat64stl_create_internal(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg, 144 ipfw_nat64stl_cfg *i) 145{ 146 147 IPFW_UH_WLOCK_ASSERT(ch); 148 149 if (ipfw_objhash_alloc_idx(CHAIN_TO_SRV(ch), &cfg->no.kidx) != 0) 150 return (ENOSPC); 151 cfg->flags |= NAT64STL_KIDX; 152 153 if (ipfw_ref_table(ch, &i->ntlv4, &cfg->map46) != 0) 154 return (EINVAL); 155 cfg->flags |= NAT64STL_46T; 156 157 if (ipfw_ref_table(ch, &i->ntlv6, &cfg->map64) != 0) 158 return (EINVAL); 159 cfg->flags |= NAT64STL_64T; 160 161 ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no); 162 163 return (0); 164} 165 166/* 167 * Creates new nat64 instance. 168 * Data layout (v0)(current): 169 * Request: [ ipfw_obj_lheader ipfw_nat64stl_cfg ] 170 * 171 * Returns 0 on success 172 */ 173static int 174nat64stl_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 175 struct sockopt_data *sd) 176{ 177 ipfw_obj_lheader *olh; 178 ipfw_nat64stl_cfg *uc; 179 struct namedobj_instance *ni; 180 struct nat64stl_cfg *cfg; 181 int error; 182 183 if (sd->valsize != sizeof(*olh) + sizeof(*uc)) 184 return (EINVAL); 185 186 olh = (ipfw_obj_lheader *)sd->kbuf; 187 uc = (ipfw_nat64stl_cfg *)(olh + 1); 188 189 if (ipfw_check_object_name_generic(uc->name) != 0) 190 return (EINVAL); 191 if (!IN6_IS_ADDR_WKPFX(&uc->prefix6)) 192 return (EINVAL); 193 if (uc->plen6 != 96 || uc->set >= IPFW_MAX_SETS) 194 return (EINVAL); 195 196 /* XXX: check types of tables */ 197 198 ni = CHAIN_TO_SRV(ch); 199 error = 0; 200 201 IPFW_UH_RLOCK(ch); 202 if (nat64stl_find(ni, uc->name, uc->set) != NULL) { 203 IPFW_UH_RUNLOCK(ch); 204 return (EEXIST); 205 } 206 IPFW_UH_RUNLOCK(ch); 207 208 cfg = nat64stl_alloc_config(uc->name, uc->set); 209 cfg->prefix6 = uc->prefix6; 210 cfg->plen6 = uc->plen6; 211 cfg->flags = uc->flags & NAT64STL_FLAGSMASK; 212 213 IPFW_UH_WLOCK(ch); 214 215 if (nat64stl_find(ni, uc->name, uc->set) != NULL) { 216 IPFW_UH_WUNLOCK(ch); 217 nat64stl_free_config(cfg); 218 return (EEXIST); 219 } 220 error = nat64stl_create_internal(ch, cfg, uc); 221 if (error == 0) { 222 /* Okay, let's link data */ 223 IPFW_WLOCK(ch); 224 SRV_OBJECT(ch, cfg->no.kidx) = cfg; 225 IPFW_WUNLOCK(ch); 226 227 IPFW_UH_WUNLOCK(ch); 228 return (0); 229 } 230 231 if (cfg->flags & NAT64STL_KIDX) 232 ipfw_objhash_free_idx(ni, cfg->no.kidx); 233 if (cfg->flags & NAT64STL_46T) 234 ipfw_unref_table(ch, cfg->map46); 235 if (cfg->flags & NAT64STL_64T) 236 ipfw_unref_table(ch, cfg->map64); 237 238 IPFW_UH_WUNLOCK(ch); 239 nat64stl_free_config(cfg); 240 return (error); 241} 242 243/* 244 * Change existing nat64stl instance configuration. 245 * Data layout (v0)(current): 246 * Request: [ ipfw_obj_header ipfw_nat64stl_cfg ] 247 * Reply: [ ipfw_obj_header ipfw_nat64stl_cfg ] 248 * 249 * Returns 0 on success 250 */ 251static int 252nat64stl_config(struct ip_fw_chain *ch, ip_fw3_opheader *op, 253 struct sockopt_data *sd) 254{ 255 ipfw_obj_header *oh; 256 ipfw_nat64stl_cfg *uc; 257 struct nat64stl_cfg *cfg; 258 struct namedobj_instance *ni; 259 260 if (sd->valsize != sizeof(*oh) + sizeof(*uc)) 261 return (EINVAL); 262 263 oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd, 264 sizeof(*oh) + sizeof(*uc)); 265 uc = (ipfw_nat64stl_cfg *)(oh + 1); 266 267 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 || 268 oh->ntlv.set >= IPFW_MAX_SETS) 269 return (EINVAL); 270 271 ni = CHAIN_TO_SRV(ch); 272 if (sd->sopt->sopt_dir == SOPT_GET) { 273 IPFW_UH_RLOCK(ch); 274 cfg = nat64stl_find(ni, oh->ntlv.name, oh->ntlv.set); 275 if (cfg == NULL) { 276 IPFW_UH_RUNLOCK(ch); 277 return (EEXIST); 278 } 279 nat64stl_export_config(ch, cfg, uc); 280 IPFW_UH_RUNLOCK(ch); 281 return (0); 282 } 283 284 IPFW_UH_WLOCK(ch); 285 cfg = nat64stl_find(ni, oh->ntlv.name, oh->ntlv.set); 286 if (cfg == NULL) { 287 IPFW_UH_WUNLOCK(ch); 288 return (EEXIST); 289 } 290 291 /* 292 * For now allow to change only following values: 293 * flags. 294 */ 295 296 cfg->flags = uc->flags & NAT64STL_FLAGSMASK; 297 IPFW_UH_WUNLOCK(ch); 298 return (0); 299} 300 301static void 302nat64stl_detach_config(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg) 303{ 304 305 IPFW_UH_WLOCK_ASSERT(ch); 306 307 ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no); 308 ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx); 309 ipfw_unref_table(ch, cfg->map46); 310 ipfw_unref_table(ch, cfg->map64); 311} 312 313/* 314 * Destroys nat64 instance. 315 * Data layout (v0)(current): 316 * Request: [ ipfw_obj_header ] 317 * 318 * Returns 0 on success 319 */ 320static int 321nat64stl_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 322 struct sockopt_data *sd) 323{ 324 ipfw_obj_header *oh; 325 struct nat64stl_cfg *cfg; 326 327 if (sd->valsize != sizeof(*oh)) 328 return (EINVAL); 329 330 oh = (ipfw_obj_header *)sd->kbuf; 331 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0) 332 return (EINVAL); 333 334 IPFW_UH_WLOCK(ch); 335 cfg = nat64stl_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 336 if (cfg == NULL) { 337 IPFW_UH_WUNLOCK(ch); 338 return (ESRCH); 339 } 340 if (cfg->no.refcnt > 0) { 341 IPFW_UH_WUNLOCK(ch); 342 return (EBUSY); 343 } 344 345 IPFW_WLOCK(ch); 346 SRV_OBJECT(ch, cfg->no.kidx) = NULL; 347 IPFW_WUNLOCK(ch); 348 349 nat64stl_detach_config(ch, cfg); 350 IPFW_UH_WUNLOCK(ch); 351 352 nat64stl_free_config(cfg); 353 return (0); 354} 355 356/* 357 * Lists all nat64stl instances currently available in kernel. 358 * Data layout (v0)(current): 359 * Request: [ ipfw_obj_lheader ] 360 * Reply: [ ipfw_obj_lheader ipfw_nat64stl_cfg x N ] 361 * 362 * Returns 0 on success 363 */ 364static int 365nat64stl_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3, 366 struct sockopt_data *sd) 367{ 368 ipfw_obj_lheader *olh; 369 struct nat64stl_dump_arg da; 370 371 /* Check minimum header size */ 372 if (sd->valsize < sizeof(ipfw_obj_lheader)) 373 return (EINVAL); 374 375 olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh)); 376 377 IPFW_UH_RLOCK(ch); 378 olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch), 379 IPFW_TLV_NAT64STL_NAME); 380 olh->objsize = sizeof(ipfw_nat64stl_cfg); 381 olh->size = sizeof(*olh) + olh->count * olh->objsize; 382 383 if (sd->valsize < olh->size) { 384 IPFW_UH_RUNLOCK(ch); 385 return (ENOMEM); 386 } 387 memset(&da, 0, sizeof(da)); 388 da.ch = ch; 389 da.sd = sd; 390 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb, 391 &da, IPFW_TLV_NAT64STL_NAME); 392 IPFW_UH_RUNLOCK(ch); 393 394 return (0); 395} 396 397#define __COPY_STAT_FIELD(_cfg, _stats, _field) \ 398 (_stats)->_field = NAT64STAT_FETCH(&(_cfg)->stats, _field) 399static void 400export_stats(struct ip_fw_chain *ch, struct nat64stl_cfg *cfg, 401 struct ipfw_nat64stl_stats *stats) 402{ 403 404 __COPY_STAT_FIELD(cfg, stats, opcnt64); 405 __COPY_STAT_FIELD(cfg, stats, opcnt46); 406 __COPY_STAT_FIELD(cfg, stats, ofrags); 407 __COPY_STAT_FIELD(cfg, stats, ifrags); 408 __COPY_STAT_FIELD(cfg, stats, oerrors); 409 __COPY_STAT_FIELD(cfg, stats, noroute4); 410 __COPY_STAT_FIELD(cfg, stats, noroute6); 411 __COPY_STAT_FIELD(cfg, stats, noproto); 412 __COPY_STAT_FIELD(cfg, stats, nomem); 413 __COPY_STAT_FIELD(cfg, stats, dropped); 414} 415 416/* 417 * Get nat64stl statistics. 418 * Data layout (v0)(current): 419 * Request: [ ipfw_obj_header ] 420 * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ]] 421 * 422 * Returns 0 on success 423 */ 424static int 425nat64stl_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op, 426 struct sockopt_data *sd) 427{ 428 struct ipfw_nat64stl_stats stats; 429 struct nat64stl_cfg *cfg; 430 ipfw_obj_header *oh; 431 ipfw_obj_ctlv *ctlv; 432 size_t sz; 433 434 sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats); 435 if (sd->valsize % sizeof(uint64_t)) 436 return (EINVAL); 437 if (sd->valsize < sz) 438 return (ENOMEM); 439 oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); 440 if (oh == NULL) 441 return (EINVAL); 442 memset(&stats, 0, sizeof(stats)); 443 444 IPFW_UH_RLOCK(ch); 445 cfg = nat64stl_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 446 if (cfg == NULL) { 447 IPFW_UH_RUNLOCK(ch); 448 return (ESRCH); 449 } 450 export_stats(ch, cfg, &stats); 451 IPFW_UH_RUNLOCK(ch); 452 453 ctlv = (ipfw_obj_ctlv *)(oh + 1); 454 memset(ctlv, 0, sizeof(*ctlv)); 455 ctlv->head.type = IPFW_TLV_COUNTERS; 456 ctlv->head.length = sz - sizeof(ipfw_obj_header); 457 ctlv->count = sizeof(stats) / sizeof(uint64_t); 458 ctlv->objsize = sizeof(uint64_t); 459 ctlv->version = IPFW_NAT64_VERSION; 460 memcpy(ctlv + 1, &stats, sizeof(stats)); 461 return (0); 462} 463 464/* 465 * Reset nat64stl statistics. 466 * Data layout (v0)(current): 467 * Request: [ ipfw_obj_header ] 468 * 469 * Returns 0 on success 470 */ 471static int 472nat64stl_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op, 473 struct sockopt_data *sd) 474{ 475 struct nat64stl_cfg *cfg; 476 ipfw_obj_header *oh; 477 478 if (sd->valsize != sizeof(*oh)) 479 return (EINVAL); 480 oh = (ipfw_obj_header *)sd->kbuf; 481 if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 || 482 oh->ntlv.set >= IPFW_MAX_SETS) 483 return (EINVAL); 484 485 IPFW_UH_WLOCK(ch); 486 cfg = nat64stl_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); 487 if (cfg == NULL) { 488 IPFW_UH_WUNLOCK(ch); 489 return (ESRCH); 490 } 491 COUNTER_ARRAY_ZERO(cfg->stats.stats, NAT64STATS); 492 IPFW_UH_WUNLOCK(ch); 493 return (0); 494} 495 496static struct ipfw_sopt_handler scodes[] = { 497 498 { IP_FW_NAT64STL_CREATE, 0, HDIR_SET, nat64stl_create }, 499 { IP_FW_NAT64STL_DESTROY,0, HDIR_SET, nat64stl_destroy }, 500 { IP_FW_NAT64STL_CONFIG, 0, HDIR_BOTH, nat64stl_config }, 501 { IP_FW_NAT64STL_LIST, 0, HDIR_GET, nat64stl_list }, 502 { IP_FW_NAT64STL_STATS, 0, HDIR_GET, nat64stl_stats }, 503 { IP_FW_NAT64STL_RESET_STATS,0, HDIR_SET, nat64stl_reset_stats }, 504}; 505 506static int 507nat64stl_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) 508{ 509 ipfw_insn *icmd; 510 511 icmd = cmd - 1; 512 if (icmd->opcode != O_EXTERNAL_ACTION || 513 icmd->arg1 != V_nat64stl_eid) 514 return (1); 515 516 *puidx = cmd->arg1; 517 *ptype = 0; 518 return (0); 519} 520 521static void 522nat64stl_update_arg1(ipfw_insn *cmd, uint16_t idx) 523{ 524 525 cmd->arg1 = idx; 526} 527 528static int 529nat64stl_findbyname(struct ip_fw_chain *ch, struct tid_info *ti, 530 struct named_object **pno) 531{ 532 int err; 533 534 err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti, 535 IPFW_TLV_NAT64STL_NAME, pno); 536 return (err); 537} 538 539static struct named_object * 540nat64stl_findbykidx(struct ip_fw_chain *ch, uint16_t idx) 541{ 542 struct namedobj_instance *ni; 543 struct named_object *no; 544 545 IPFW_UH_WLOCK_ASSERT(ch); 546 ni = CHAIN_TO_SRV(ch); 547 no = ipfw_objhash_lookup_kidx(ni, idx); 548 KASSERT(no != NULL, ("NAT with index %d not found", idx)); 549 550 return (no); 551} 552 553static int 554nat64stl_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set, 555 enum ipfw_sets_cmd cmd) 556{ 557 558 return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64STL_NAME, 559 set, new_set, cmd)); 560} 561 562static struct opcode_obj_rewrite opcodes[] = { 563 { 564 .opcode = O_EXTERNAL_INSTANCE, 565 .etlv = IPFW_TLV_EACTION /* just show it isn't table */, 566 .classifier = nat64stl_classify, 567 .update = nat64stl_update_arg1, 568 .find_byname = nat64stl_findbyname, 569 .find_bykidx = nat64stl_findbykidx, 570 .manage_sets = nat64stl_manage_sets, 571 }, 572}; 573 574static int 575destroy_config_cb(struct namedobj_instance *ni, struct named_object *no, 576 void *arg) 577{ 578 struct nat64stl_cfg *cfg; 579 struct ip_fw_chain *ch; 580 581 ch = (struct ip_fw_chain *)arg; 582 cfg = (struct nat64stl_cfg *)SRV_OBJECT(ch, no->kidx); 583 SRV_OBJECT(ch, no->kidx) = NULL; 584 nat64stl_detach_config(ch, cfg); 585 nat64stl_free_config(cfg); 586 return (0); 587} 588 589int 590nat64stl_init(struct ip_fw_chain *ch, int first) 591{ 592 593 V_nat64stl_eid = ipfw_add_eaction(ch, ipfw_nat64stl, "nat64stl"); 594 if (V_nat64stl_eid == 0) 595 return (ENXIO); 596 IPFW_ADD_SOPT_HANDLER(first, scodes); 597 IPFW_ADD_OBJ_REWRITER(first, opcodes); 598 return (0); 599} 600 601void 602nat64stl_uninit(struct ip_fw_chain *ch, int last) 603{ 604 605 IPFW_DEL_OBJ_REWRITER(last, opcodes); 606 IPFW_DEL_SOPT_HANDLER(last, scodes); 607 ipfw_del_eaction(ch, V_nat64stl_eid); 608 /* 609 * Since we already have deregistered external action, 610 * our named objects become unaccessible via rules, because 611 * all rules were truncated by ipfw_del_eaction(). 612 * So, we can unlink and destroy our named objects without holding 613 * IPFW_WLOCK(). 614 */ 615 IPFW_UH_WLOCK(ch); 616 ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch, 617 IPFW_TLV_NAT64STL_NAME); 618 V_nat64stl_eid = 0; 619 IPFW_UH_WUNLOCK(ch); 620} 621 622