From nobody Tue Dec 17 10:07:45 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4YCCDK4dNhz5h0hX; Tue, 17 Dec 2024 10:07:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4YCCDK3YxTz49MN; Tue, 17 Dec 2024 10:07:45 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1734430065; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BwFKE9cmXt+s7xesuNXPGJkAjV1uuIyJd0aNsUTRKz0=; b=Aqg+SGXiy45pocRGK6mWqfvqurjzpvs0BZB/kMVv+5ua/xRqsXf2cxlX4NgNPFYyT91/+N V2LguN68CsBrCHUWDmz35nl6mL/BaoBWFVcE+BVCSIDs0VaWD/2EEmhFr19imzHfgXYyRL 7ynVj5atRQ1A+aVFbPIU7TZ5cv8ra4ihQTFZveDM2A1X0DAkmnG+vT9w135M4Oh44KQIyn sR/shFe6+dW4MSqNEZyXVpl694TdMGomVleDDAraWUmuBrjllCCZjqSS6tOqHBnVvcOld1 PWoTIUi7/xKhQkxILuBBeTumv6NU7cw4pcwl81y/OTOyzu8noPT93JcJt+00zw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1734430065; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=BwFKE9cmXt+s7xesuNXPGJkAjV1uuIyJd0aNsUTRKz0=; b=Y33Dk4pvvX9QCxeSPS/QAByY40rVeKKTS4R687budNGhvRTM6J1rbpsgVX8EVKUHaVhgS7 OSYu6vJyxjlWlvc/H3rIVGylCbTM89hMSAeEjjLRRBQ9Oo20JQP5m1QI+b3QptywwxbXe8 yBEFyRiQ5yVy09KZ9nbhPQ7eicH81BvKwhw5WSm771kz7KhvT7bSzmfEQzokYf3UZYxyRd 2mGD38EQ5lbyt0m30H734KJ9RMkvOO80yuvzO2fFxdHWPHr8Ba+DUXEF6qggRjb6JMod75 +UoGwp07OH7t2b4bVBiJQf0BEIsn3rUcoQIIzgj2FYbxY0dZI1uEJOnt4xTOMg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1734430065; a=rsa-sha256; cv=none; b=LTl6D/xe/Jt33Ucj5RpOcnxAJF5Gsi71cm41iU9QbLoXne2b0c9YsjqE2Q4/aMqCm/iVq3 aHJEWzSkho+Y0i9DKGvGAFlmCmRHAO2VWb9kWBfIP01OyruKBQJjfh27KXMQnRyFuv8OAm oAzsLNOhCNyN4LmP/xrVX6a0QKqSa1YEMa9J5lB21VJ6YcXiE+Zxw4qPNXMIb7kEKr2KGx H/NdM8tBkcvmz7ZWtTFSDVxw/rFlKTgXFIKtIWoMsIVsVD8A3eMddokBPgFhFG6ZvD1lRG D+UmS5xc+gEi8p+wLUS3Q8pgGB951aVFGAQkAzb05FpcKPGA6dk7wwjv/T+6wA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4YCCDK3723zJtv; Tue, 17 Dec 2024 10:07:45 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 4BHA7jVG023479; Tue, 17 Dec 2024 10:07:45 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 4BHA7j9f023476; Tue, 17 Dec 2024 10:07:45 GMT (envelope-from git) Date: Tue, 17 Dec 2024 10:07:45 GMT Message-Id: <202412171007.4BHA7j9f023476@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: ea9113be3f19 - main - pf: extra route lookup in pf_route(6)() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: ea9113be3f19db02d7108ebb207c2d5ca87e6a76 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=ea9113be3f19db02d7108ebb207c2d5ca87e6a76 commit ea9113be3f19db02d7108ebb207c2d5ca87e6a76 Author: Kristof Provost AuthorDate: 2024-10-28 13:18:30 +0000 Commit: Kristof Provost CommitDate: 2024-12-17 10:07:13 +0000 pf: extra route lookup in pf_route(6)() In the NAT64 case we use pf_route(6)() to emit the translated packet. This requires a new route lookup, so perform this, but only in the NAT64/NAT46 case. Update the destination sockaddr to send packets to the gateway if appropriate. Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D47788 --- sys/netpfil/pf/pf.c | 69 ++++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 52 insertions(+), 17 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 860f9a8fce64..36bb0e1975fa 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -8648,14 +8648,13 @@ pf_route(struct mbuf **m, struct pf_krule *r, struct ifnet *oifp, struct mbuf *m0, *m1, *md; struct sockaddr_in dst; struct ip *ip; - struct ifnet *ifp; + struct ifnet *ifp = NULL; int error = 0; uint16_t ip_len, ip_off; uint16_t tmp; int r_dir; - KASSERT(m && *m && r && oifp && pd->act.rt_kif, - ("%s: invalid parameters", __func__)); + KASSERT(m && *m && r && oifp, ("%s: invalid parameters", __func__)); SDT_PROBE4(pf, ip, route_to, entry, *m, pd, s, oifp); @@ -8678,12 +8677,8 @@ pf_route(struct mbuf **m, struct pf_krule *r, struct ifnet *oifp, goto bad_locked; } - if ((ifp = pd->act.rt_kif->pfik_ifp) == NULL) { - m0 = *m; - *m = NULL; - SDT_PROBE1(pf, ip, route_to, drop, __LINE__); - goto bad_locked; - } + if (pd->act.rt_kif != NULL) + ifp = pd->act.rt_kif->pfik_ifp; if (pd->act.rt == PF_DUPTO) { if ((pd->pf_mtag->flags & PF_MTAG_FLAG_DUPLICATED)) { @@ -8733,9 +8728,31 @@ pf_route(struct mbuf **m, struct pf_krule *r, struct ifnet *oifp, s->orig_kif = oifp->if_pf_kif; } + if (ifp == NULL && (pd->af != pd->naf)) { + /* We're in the AFTO case. Do a route lookup. */ + struct nhop_object *nh; + nh = fib4_lookup(M_GETFIB(*m), ip->ip_dst, 0, NHR_NONE, 0); + if (nh) { + ifp = nh->nh_ifp; + + /* Use the gateway if needed. */ + if (nh->nh_flags & NHF_GATEWAY) + dst.sin_addr = nh->gw4_sa.sin_addr; + else + dst.sin_addr = ip->ip_dst; + } + } + PF_STATE_UNLOCK(s); } + if (ifp == NULL) { + m0 = *m; + *m = NULL; + SDT_PROBE1(pf, ip, route_to, drop, __LINE__); + goto bad; + } + if (pd->dir == PF_IN) { if (pf_test(AF_INET, PF_OUT, PFIL_FWD, ifp, &m0, inp, &pd->act) != PF_PASS) { @@ -8887,8 +8904,7 @@ pf_route6(struct mbuf **m, struct pf_krule *r, struct ifnet *oifp, struct ifnet *ifp = NULL; int r_dir; - KASSERT(m && *m && r && oifp && pd->act.rt_kif, - ("%s: invalid parameters", __func__)); + KASSERT(m && *m && r && oifp, ("%s: invalid parameters", __func__)); SDT_PROBE4(pf, ip6, route_to, entry, *m, pd, s, oifp); @@ -8911,12 +8927,8 @@ pf_route6(struct mbuf **m, struct pf_krule *r, struct ifnet *oifp, goto bad_locked; } - if ((ifp = pd->act.rt_kif->pfik_ifp) == NULL) { - m0 = *m; - *m = NULL; - SDT_PROBE1(pf, ip6, route_to, drop, __LINE__); - goto bad_locked; - } + if (pd->act.rt_kif != NULL) + ifp = pd->act.rt_kif->pfik_ifp; if (pd->act.rt == PF_DUPTO) { if ((pd->pf_mtag->flags & PF_MTAG_FLAG_DUPLICATED)) { @@ -8965,9 +8977,32 @@ pf_route6(struct mbuf **m, struct pf_krule *r, struct ifnet *oifp, s->kif = pd->act.rt_kif; s->orig_kif = oifp->if_pf_kif; } + + if (ifp == NULL && (pd->af != pd->naf)) { + struct nhop_object *nh; + nh = fib6_lookup(M_GETFIB(*m), &ip6->ip6_dst, 0, NHR_NONE, 0); + if (nh) { + ifp = nh->nh_ifp; + + /* Use the gateway if needed. */ + if (nh->nh_flags & NHF_GATEWAY) + bcopy(&dst.sin6_addr, &nh->gw6_sa.sin6_addr, + sizeof(dst.sin6_addr)); + else + dst.sin6_addr = ip6->ip6_dst; + } + } + PF_STATE_UNLOCK(s); } + if (ifp == NULL) { + m0 = *m; + *m = NULL; + SDT_PROBE1(pf, ip6, route_to, drop, __LINE__); + goto bad; + } + if (pd->dir == PF_IN) { if (pf_test(AF_INET6, PF_OUT, PFIL_FWD | PF_PFIL_NOREFRAGMENT, ifp, &m0, inp, &pd->act) != PF_PASS) {