1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2019 Yandex LLC
5 * Copyright (c) 2019 Andrey V. Elsukov <ae@FreeBSD.org>
6 * Copyright (c) 2019 Boris N. Lytochkin <lytboris@gmail.com>
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 *    notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 *    notice, this list of conditions and the following disclaimer in the
16 *    documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 */
29
30#include <sys/param.h>
31#include <sys/systm.h>
32#include <sys/counter.h>
33#include <sys/errno.h>
34#include <sys/kernel.h>
35#include <sys/lock.h>
36#include <sys/malloc.h>
37#include <sys/mbuf.h>
38#include <sys/module.h>
39#include <sys/rmlock.h>
40#include <sys/rwlock.h>
41#include <sys/socket.h>
42#include <sys/sockopt.h>
43#include <sys/syslog.h>
44#include <sys/sysctl.h>
45
46#include <net/if.h>
47#include <net/if_var.h>
48#include <net/route.h>
49#include <net/vnet.h>
50
51#include <netinet/in.h>
52#include <netinet/ip_var.h>
53#include <netinet/ip_fw.h>
54#include <netinet6/in6_var.h>
55#include <netinet6/ip6_var.h>
56#include <netinet6/ip_fw_nat64.h>
57
58#include <netpfil/ipfw/ip_fw_private.h>
59
60#include "nat64clat.h"
61
62VNET_DEFINE(uint16_t, nat64clat_eid) = 0;
63
64static struct nat64clat_cfg *nat64clat_alloc_config(const char *name,
65    uint8_t set);
66static void nat64clat_free_config(struct nat64clat_cfg *cfg);
67static struct nat64clat_cfg *nat64clat_find(struct namedobj_instance *ni,
68    const char *name, uint8_t set);
69
70static struct nat64clat_cfg *
71nat64clat_alloc_config(const char *name, uint8_t set)
72{
73	struct nat64clat_cfg *cfg;
74
75	cfg = malloc(sizeof(struct nat64clat_cfg), M_IPFW, M_WAITOK | M_ZERO);
76	COUNTER_ARRAY_ALLOC(cfg->base.stats.cnt, NAT64STATS, M_WAITOK);
77	cfg->no.name = cfg->name;
78	cfg->no.etlv = IPFW_TLV_NAT64CLAT_NAME;
79	cfg->no.set = set;
80	strlcpy(cfg->name, name, sizeof(cfg->name));
81	return (cfg);
82}
83
84static void
85nat64clat_free_config(struct nat64clat_cfg *cfg)
86{
87
88	COUNTER_ARRAY_FREE(cfg->base.stats.cnt, NAT64STATS);
89	free(cfg, M_IPFW);
90}
91
92static void
93nat64clat_export_config(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg,
94    ipfw_nat64clat_cfg *uc)
95{
96	uc->plat_prefix = cfg->base.plat_prefix;
97	uc->plat_plen = cfg->base.plat_plen;
98	uc->clat_prefix = cfg->base.clat_prefix;
99	uc->clat_plen = cfg->base.clat_plen;
100	uc->flags = cfg->base.flags & NAT64CLAT_FLAGSMASK;
101	uc->set = cfg->no.set;
102	strlcpy(uc->name, cfg->no.name, sizeof(uc->name));
103}
104
105struct nat64clat_dump_arg {
106	struct ip_fw_chain *ch;
107	struct sockopt_data *sd;
108};
109
110static int
111export_config_cb(struct namedobj_instance *ni, struct named_object *no,
112    void *arg)
113{
114	struct nat64clat_dump_arg *da = (struct nat64clat_dump_arg *)arg;
115	ipfw_nat64clat_cfg *uc;
116
117	uc = (ipfw_nat64clat_cfg *)ipfw_get_sopt_space(da->sd, sizeof(*uc));
118	nat64clat_export_config(da->ch, (struct nat64clat_cfg *)no, uc);
119	return (0);
120}
121
122static struct nat64clat_cfg *
123nat64clat_find(struct namedobj_instance *ni, const char *name, uint8_t set)
124{
125	struct nat64clat_cfg *cfg;
126
127	cfg = (struct nat64clat_cfg *)ipfw_objhash_lookup_name_type(ni, set,
128	    IPFW_TLV_NAT64CLAT_NAME, name);
129
130	return (cfg);
131}
132
133/*
134 * Creates new consumer-side nat64 translator instance.
135 * Data layout (v0)(current):
136 * Request: [ ipfw_obj_lheader ipfw_nat64clat_cfg ]
137 *
138 * Returns 0 on success
139 */
140static int
141nat64clat_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
142    struct sockopt_data *sd)
143{
144	ipfw_obj_lheader *olh;
145	ipfw_nat64clat_cfg *uc;
146	struct namedobj_instance *ni;
147	struct nat64clat_cfg *cfg;
148
149	if (sd->valsize != sizeof(*olh) + sizeof(*uc))
150		return (EINVAL);
151
152	olh = (ipfw_obj_lheader *)sd->kbuf;
153	uc = (ipfw_nat64clat_cfg *)(olh + 1);
154
155	if (ipfw_check_object_name_generic(uc->name) != 0)
156		return (EINVAL);
157
158	if (uc->set >= IPFW_MAX_SETS ||
159	    nat64_check_prefix6(&uc->plat_prefix, uc->plat_plen) != 0 ||
160	    nat64_check_prefix6(&uc->clat_prefix, uc->clat_plen) != 0)
161		return (EINVAL);
162
163	ni = CHAIN_TO_SRV(ch);
164
165	IPFW_UH_RLOCK(ch);
166	if (nat64clat_find(ni, uc->name, uc->set) != NULL) {
167		IPFW_UH_RUNLOCK(ch);
168		return (EEXIST);
169	}
170	IPFW_UH_RUNLOCK(ch);
171
172	cfg = nat64clat_alloc_config(uc->name, uc->set);
173	cfg->base.plat_prefix = uc->plat_prefix;
174	cfg->base.plat_plen = uc->plat_plen;
175	cfg->base.clat_prefix = uc->clat_prefix;
176	cfg->base.clat_plen = uc->clat_plen;
177	cfg->base.flags = (uc->flags & NAT64CLAT_FLAGSMASK) |
178	    NAT64_CLATPFX | NAT64_PLATPFX;
179	if (IN6_IS_ADDR_WKPFX(&cfg->base.plat_prefix))
180		cfg->base.flags |= NAT64_WKPFX;
181
182	IPFW_UH_WLOCK(ch);
183
184	if (nat64clat_find(ni, uc->name, uc->set) != NULL) {
185		IPFW_UH_WUNLOCK(ch);
186		nat64clat_free_config(cfg);
187		return (EEXIST);
188	}
189
190	if (ipfw_objhash_alloc_idx(ni, &cfg->no.kidx) != 0) {
191		IPFW_UH_WUNLOCK(ch);
192		nat64clat_free_config(cfg);
193		return (ENOSPC);
194	}
195	ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no);
196	/* Okay, let's link data */
197	SRV_OBJECT(ch, cfg->no.kidx) = cfg;
198	IPFW_UH_WUNLOCK(ch);
199
200	return (0);
201}
202
203/*
204 * Change existing nat64clat instance configuration.
205 * Data layout (v0)(current):
206 * Request: [ ipfw_obj_header ipfw_nat64clat_cfg ]
207 * Reply: [ ipfw_obj_header ipfw_nat64clat_cfg ]
208 *
209 * Returns 0 on success
210 */
211static int
212nat64clat_config(struct ip_fw_chain *ch, ip_fw3_opheader *op,
213    struct sockopt_data *sd)
214{
215	ipfw_obj_header *oh;
216	ipfw_nat64clat_cfg *uc;
217	struct nat64clat_cfg *cfg;
218	struct namedobj_instance *ni;
219	uint32_t flags;
220
221	if (sd->valsize != sizeof(*oh) + sizeof(*uc))
222		return (EINVAL);
223
224	oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd,
225	    sizeof(*oh) + sizeof(*uc));
226	uc = (ipfw_nat64clat_cfg *)(oh + 1);
227
228	if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
229	    oh->ntlv.set >= IPFW_MAX_SETS)
230		return (EINVAL);
231
232	ni = CHAIN_TO_SRV(ch);
233	if (sd->sopt->sopt_dir == SOPT_GET) {
234		IPFW_UH_RLOCK(ch);
235		cfg = nat64clat_find(ni, oh->ntlv.name, oh->ntlv.set);
236		if (cfg == NULL) {
237			IPFW_UH_RUNLOCK(ch);
238			return (ENOENT);
239		}
240		nat64clat_export_config(ch, cfg, uc);
241		IPFW_UH_RUNLOCK(ch);
242		return (0);
243	}
244
245	IPFW_UH_WLOCK(ch);
246	cfg = nat64clat_find(ni, oh->ntlv.name, oh->ntlv.set);
247	if (cfg == NULL) {
248		IPFW_UH_WUNLOCK(ch);
249		return (ENOENT);
250	}
251
252	/*
253	 * For now allow to change only following values:
254	 *  plat_prefix, plat_plen, clat_prefix, clat_plen, flags.
255	 */
256	flags = 0;
257	if (uc->plat_plen != cfg->base.plat_plen ||
258	    !IN6_ARE_ADDR_EQUAL(&uc->plat_prefix, &cfg->base.plat_prefix)) {
259		if (nat64_check_prefix6(&uc->plat_prefix, uc->plat_plen) != 0) {
260			IPFW_UH_WUNLOCK(ch);
261			return (EINVAL);
262		}
263		flags |= NAT64_PLATPFX;
264	}
265
266	if (uc->clat_plen != cfg->base.clat_plen ||
267	    !IN6_ARE_ADDR_EQUAL(&uc->clat_prefix, &cfg->base.clat_prefix)) {
268		if (nat64_check_prefix6(&uc->clat_prefix, uc->clat_plen) != 0) {
269			IPFW_UH_WUNLOCK(ch);
270			return (EINVAL);
271		}
272		flags |= NAT64_CLATPFX;
273	}
274
275	if (flags != 0) {
276		IPFW_WLOCK(ch);
277		if (flags & NAT64_PLATPFX) {
278			cfg->base.plat_prefix = uc->plat_prefix;
279			cfg->base.plat_plen = uc->plat_plen;
280		}
281		if (flags & NAT64_CLATPFX) {
282			cfg->base.clat_prefix = uc->clat_prefix;
283			cfg->base.clat_plen = uc->clat_plen;
284		}
285		IPFW_WUNLOCK(ch);
286	}
287
288	cfg->base.flags &= ~NAT64CLAT_FLAGSMASK;
289	cfg->base.flags |= uc->flags & NAT64CLAT_FLAGSMASK;
290
291	IPFW_UH_WUNLOCK(ch);
292	return (0);
293}
294
295static void
296nat64clat_detach_config(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg)
297{
298
299	IPFW_UH_WLOCK_ASSERT(ch);
300
301	ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no);
302	ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx);
303}
304
305/*
306 * Destroys nat64 instance.
307 * Data layout (v0)(current):
308 * Request: [ ipfw_obj_header ]
309 *
310 * Returns 0 on success
311 */
312static int
313nat64clat_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
314    struct sockopt_data *sd)
315{
316	ipfw_obj_header *oh;
317	struct nat64clat_cfg *cfg;
318
319	if (sd->valsize != sizeof(*oh))
320		return (EINVAL);
321
322	oh = (ipfw_obj_header *)sd->kbuf;
323	if (ipfw_check_object_name_generic(oh->ntlv.name) != 0)
324		return (EINVAL);
325
326	IPFW_UH_WLOCK(ch);
327	cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
328	if (cfg == NULL) {
329		IPFW_UH_WUNLOCK(ch);
330		return (ENOENT);
331	}
332	if (cfg->no.refcnt > 0) {
333		IPFW_UH_WUNLOCK(ch);
334		return (EBUSY);
335	}
336
337	ipfw_reset_eaction_instance(ch, V_nat64clat_eid, cfg->no.kidx);
338	SRV_OBJECT(ch, cfg->no.kidx) = NULL;
339	nat64clat_detach_config(ch, cfg);
340	IPFW_UH_WUNLOCK(ch);
341
342	nat64clat_free_config(cfg);
343	return (0);
344}
345
346/*
347 * Lists all nat64clat instances currently available in kernel.
348 * Data layout (v0)(current):
349 * Request: [ ipfw_obj_lheader ]
350 * Reply: [ ipfw_obj_lheader ipfw_nat64clat_cfg x N ]
351 *
352 * Returns 0 on success
353 */
354static int
355nat64clat_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3,
356    struct sockopt_data *sd)
357{
358	ipfw_obj_lheader *olh;
359	struct nat64clat_dump_arg da;
360
361	/* Check minimum header size */
362	if (sd->valsize < sizeof(ipfw_obj_lheader))
363		return (EINVAL);
364
365	olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh));
366
367	IPFW_UH_RLOCK(ch);
368	olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch),
369	    IPFW_TLV_NAT64CLAT_NAME);
370	olh->objsize = sizeof(ipfw_nat64clat_cfg);
371	olh->size = sizeof(*olh) + olh->count * olh->objsize;
372
373	if (sd->valsize < olh->size) {
374		IPFW_UH_RUNLOCK(ch);
375		return (ENOMEM);
376	}
377	memset(&da, 0, sizeof(da));
378	da.ch = ch;
379	da.sd = sd;
380	ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb,
381	    &da, IPFW_TLV_NAT64CLAT_NAME);
382	IPFW_UH_RUNLOCK(ch);
383
384	return (0);
385}
386
387#define	__COPY_STAT_FIELD(_cfg, _stats, _field)	\
388	(_stats)->_field = NAT64STAT_FETCH(&(_cfg)->base.stats, _field)
389static void
390export_stats(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg,
391    struct ipfw_nat64clat_stats *stats)
392{
393
394	__COPY_STAT_FIELD(cfg, stats, opcnt64);
395	__COPY_STAT_FIELD(cfg, stats, opcnt46);
396	__COPY_STAT_FIELD(cfg, stats, ofrags);
397	__COPY_STAT_FIELD(cfg, stats, ifrags);
398	__COPY_STAT_FIELD(cfg, stats, oerrors);
399	__COPY_STAT_FIELD(cfg, stats, noroute4);
400	__COPY_STAT_FIELD(cfg, stats, noroute6);
401	__COPY_STAT_FIELD(cfg, stats, noproto);
402	__COPY_STAT_FIELD(cfg, stats, nomem);
403	__COPY_STAT_FIELD(cfg, stats, dropped);
404}
405
406/*
407 * Get nat64clat statistics.
408 * Data layout (v0)(current):
409 * Request: [ ipfw_obj_header ]
410 * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ]]
411 *
412 * Returns 0 on success
413 */
414static int
415nat64clat_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
416    struct sockopt_data *sd)
417{
418	struct ipfw_nat64clat_stats stats;
419	struct nat64clat_cfg *cfg;
420	ipfw_obj_header *oh;
421	ipfw_obj_ctlv *ctlv;
422	size_t sz;
423
424	sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats);
425	if (sd->valsize % sizeof(uint64_t))
426		return (EINVAL);
427	if (sd->valsize < sz)
428		return (ENOMEM);
429	oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz);
430	if (oh == NULL)
431		return (EINVAL);
432	memset(&stats, 0, sizeof(stats));
433
434	IPFW_UH_RLOCK(ch);
435	cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
436	if (cfg == NULL) {
437		IPFW_UH_RUNLOCK(ch);
438		return (ENOENT);
439	}
440	export_stats(ch, cfg, &stats);
441	IPFW_UH_RUNLOCK(ch);
442
443	ctlv = (ipfw_obj_ctlv *)(oh + 1);
444	memset(ctlv, 0, sizeof(*ctlv));
445	ctlv->head.type = IPFW_TLV_COUNTERS;
446	ctlv->head.length = sz - sizeof(ipfw_obj_header);
447	ctlv->count = sizeof(stats) / sizeof(uint64_t);
448	ctlv->objsize = sizeof(uint64_t);
449	ctlv->version = IPFW_NAT64_VERSION;
450	memcpy(ctlv + 1, &stats, sizeof(stats));
451	return (0);
452}
453
454/*
455 * Reset nat64clat statistics.
456 * Data layout (v0)(current):
457 * Request: [ ipfw_obj_header ]
458 *
459 * Returns 0 on success
460 */
461static int
462nat64clat_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op,
463    struct sockopt_data *sd)
464{
465	struct nat64clat_cfg *cfg;
466	ipfw_obj_header *oh;
467
468	if (sd->valsize != sizeof(*oh))
469		return (EINVAL);
470	oh = (ipfw_obj_header *)sd->kbuf;
471	if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 ||
472	    oh->ntlv.set >= IPFW_MAX_SETS)
473		return (EINVAL);
474
475	IPFW_UH_WLOCK(ch);
476	cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set);
477	if (cfg == NULL) {
478		IPFW_UH_WUNLOCK(ch);
479		return (ENOENT);
480	}
481	COUNTER_ARRAY_ZERO(cfg->base.stats.cnt, NAT64STATS);
482	IPFW_UH_WUNLOCK(ch);
483	return (0);
484}
485
486static struct ipfw_sopt_handler	scodes[] = {
487	{ IP_FW_NAT64CLAT_CREATE, 0,	HDIR_SET,	nat64clat_create },
488	{ IP_FW_NAT64CLAT_DESTROY,0,	HDIR_SET,	nat64clat_destroy },
489	{ IP_FW_NAT64CLAT_CONFIG, 0,	HDIR_BOTH,	nat64clat_config },
490	{ IP_FW_NAT64CLAT_LIST,   0,	HDIR_GET,	nat64clat_list },
491	{ IP_FW_NAT64CLAT_STATS,  0,	HDIR_GET,	nat64clat_stats },
492	{ IP_FW_NAT64CLAT_RESET_STATS,0,	HDIR_SET,	nat64clat_reset_stats },
493};
494
495static int
496nat64clat_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype)
497{
498	ipfw_insn *icmd;
499
500	icmd = cmd - 1;
501	if (icmd->opcode != O_EXTERNAL_ACTION ||
502	    icmd->arg1 != V_nat64clat_eid)
503		return (1);
504
505	*puidx = cmd->arg1;
506	*ptype = 0;
507	return (0);
508}
509
510static void
511nat64clat_update_arg1(ipfw_insn *cmd, uint16_t idx)
512{
513
514	cmd->arg1 = idx;
515}
516
517static int
518nat64clat_findbyname(struct ip_fw_chain *ch, struct tid_info *ti,
519    struct named_object **pno)
520{
521	int err;
522
523	err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti,
524	    IPFW_TLV_NAT64CLAT_NAME, pno);
525	return (err);
526}
527
528static struct named_object *
529nat64clat_findbykidx(struct ip_fw_chain *ch, uint16_t idx)
530{
531	struct namedobj_instance *ni;
532	struct named_object *no;
533
534	IPFW_UH_WLOCK_ASSERT(ch);
535	ni = CHAIN_TO_SRV(ch);
536	no = ipfw_objhash_lookup_kidx(ni, idx);
537	KASSERT(no != NULL, ("NAT with index %d not found", idx));
538
539	return (no);
540}
541
542static int
543nat64clat_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set,
544    enum ipfw_sets_cmd cmd)
545{
546
547	return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64CLAT_NAME,
548	    set, new_set, cmd));
549}
550
551static struct opcode_obj_rewrite opcodes[] = {
552	{
553		.opcode = O_EXTERNAL_INSTANCE,
554		.etlv = IPFW_TLV_EACTION /* just show it isn't table */,
555		.classifier = nat64clat_classify,
556		.update = nat64clat_update_arg1,
557		.find_byname = nat64clat_findbyname,
558		.find_bykidx = nat64clat_findbykidx,
559		.manage_sets = nat64clat_manage_sets,
560	},
561};
562
563static int
564destroy_config_cb(struct namedobj_instance *ni, struct named_object *no,
565    void *arg)
566{
567	struct nat64clat_cfg *cfg;
568	struct ip_fw_chain *ch;
569
570	ch = (struct ip_fw_chain *)arg;
571	cfg = (struct nat64clat_cfg *)SRV_OBJECT(ch, no->kidx);
572	SRV_OBJECT(ch, no->kidx) = NULL;
573	nat64clat_detach_config(ch, cfg);
574	nat64clat_free_config(cfg);
575	return (0);
576}
577
578int
579nat64clat_init(struct ip_fw_chain *ch, int first)
580{
581
582	V_nat64clat_eid = ipfw_add_eaction(ch, ipfw_nat64clat, "nat64clat");
583	if (V_nat64clat_eid == 0)
584		return (ENXIO);
585	IPFW_ADD_SOPT_HANDLER(first, scodes);
586	IPFW_ADD_OBJ_REWRITER(first, opcodes);
587	return (0);
588}
589
590void
591nat64clat_uninit(struct ip_fw_chain *ch, int last)
592{
593
594	IPFW_DEL_OBJ_REWRITER(last, opcodes);
595	IPFW_DEL_SOPT_HANDLER(last, scodes);
596	ipfw_del_eaction(ch, V_nat64clat_eid);
597	/*
598	 * Since we already have deregistered external action,
599	 * our named objects become unaccessible via rules, because
600	 * all rules were truncated by ipfw_del_eaction().
601	 * So, we can unlink and destroy our named objects without holding
602	 * IPFW_WLOCK().
603	 */
604	IPFW_UH_WLOCK(ch);
605	ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch,
606	    IPFW_TLV_NAT64CLAT_NAME);
607	V_nat64clat_eid = 0;
608	IPFW_UH_WUNLOCK(ch);
609}
610