From nobody Thu Jan 23 12:58:31 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Yf1GH4ln8z5kvQS; Thu, 23 Jan 2025 12:58:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Yf1GH3pmtz3VwM; Thu, 23 Jan 2025 12:58:31 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1737637111; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OYGwskPS6Sye15IhwBXXX9pIAuzDe4DWMcsugCsEUtQ=; b=WhUEBessWl4xE8kJ1rTXnEfh9Wd5bD/qRp4E4YsM/5YfiuvHNuVsaekS6LFnjFXNLMKcOs vNjyCnvEDldtq93Z900ntvpJ8EpEu7Gg1iURBYMA57XCZMWir++9+cQWFl0J2ClAzb+Yo9 3tJTgIWdqEHLdqylzwxifyvdfRiTRgquQ3h6jydwf3oNf9seozGQNYkJkmDEtHCdFXq4B+ fro5z0HAcHEvE90hjwFQNlsByigUacMDpjeEicqKu+MWNdi6+ayeK+ztI2fdEpujLhVRGU wnOLIvqUxpRyuh0tre+FBp8wu5V6R90X+s3XyzxTlD1+9CkoY1USQ9i534tPMQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1737637111; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OYGwskPS6Sye15IhwBXXX9pIAuzDe4DWMcsugCsEUtQ=; b=J5jv1ZgtrOHcf/UHeG68wGcMP57dvBCfM5mwdoIER+H1/3cyEttGuawzVvZHVux7L5lMcu ABxZqN0oyi2zBog7aqb/UuPiJXRvQMTvydLYt4NId/fYsEpjtxKOhsiMi4zfnEm3l79PcK s5M57X3k2MNO/gUcMHVf5hxLMuGuIJL76TuAu7MIN25LMx2VRdwpS4sPZUXhaofNs8Se9t IvK1Xy8o0V4/Z4v7SYChIzHnM9/l17eenVHEnFOBTl+hDOUohpPooy9yl7DykqkQm+hJ9d Y0LRYQU/apdgCXJzmBG7QsVjMtYEgeDqzKxJXIvPbQelFxyGKuP6CzLIb8yFpg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1737637111; a=rsa-sha256; cv=none; b=M4jh2PkLmaZ7gLxY7M0zDTdxosDQtWE01hXuq3o/znPzEi8S2UQSLQ9j7lVaTs8jk3BF/L zRDw65bB+GWU6Y2Mdt+Me/8xsDVWQWbXTOX227DYOF0BUlCQ6fs9CV6pxlhV3I1TD4tHCQ gCiqKpSHqLtQpCVgg0p0MWqDdrkoLQqUIys74y7Ec/v7unPGJxOwfbL5S/V76CpeTDlvgV DRtVsjvdLOp/geQkQsWvov3ff7Ptf2QLEfbHoaXJkpD9cldFryOHNmEEO2vvbIZ8R/t7C9 wuajtog4gHa+F854YoDF9upFkTUyhGj8re142wRSfDffHtXrRTUgLsp6bfFNUQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Yf1GH3LBbzgRd; Thu, 23 Jan 2025 12:58:31 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 50NCwV1I014336; Thu, 23 Jan 2025 12:58:31 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 50NCwVRh014333; Thu, 23 Jan 2025 12:58:31 GMT (envelope-from git) Date: Thu, 23 Jan 2025 12:58:31 GMT Message-Id: <202501231258.50NCwVRh014333@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Kristof Provost Subject: git: 697c1568b75a - main - pf: fix IPv6 route lookup for nat64 List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 697c1568b75a0053e422782dd7c0d9d1e28a67e8 Auto-Submitted: auto-generated The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=697c1568b75a0053e422782dd7c0d9d1e28a67e8 commit 697c1568b75a0053e422782dd7c0d9d1e28a67e8 Author: Kristof Provost AuthorDate: 2025-01-23 09:53:55 +0000 Commit: Kristof Provost CommitDate: 2025-01-23 12:53:18 +0000 pf: fix IPv6 route lookup for nat64 The route lookup in pf_route6() (for the nat64 case) had the src/dst for bcopy() swapped around, so any nat64 setup that passed via a gateway on the IPv6 side was broken. Fix this, add 'const' to make this error actually fail to compile and add a test case. Sponsored by: Rubicon Communications, LLC ("Netgate") --- sys/netpfil/pf/pf.c | 6 ++--- tests/sys/netpfil/pf/nat64.sh | 63 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 66 insertions(+), 3 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 3b9c71296a2b..83eca735d2bb 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -8961,7 +8961,7 @@ pf_route(struct mbuf **m, struct pf_krule *r, struct ifnet *oifp, if (ifp == NULL && (pd->af != pd->naf)) { /* We're in the AFTO case. Do a route lookup. */ - struct nhop_object *nh; + const struct nhop_object *nh; nh = fib4_lookup(M_GETFIB(*m), ip->ip_dst, 0, NHR_NONE, 0); if (nh) { ifp = nh->nh_ifp; @@ -9220,14 +9220,14 @@ pf_route6(struct mbuf **m, struct pf_krule *r, struct ifnet *oifp, } if (ifp == NULL && (pd->af != pd->naf)) { - struct nhop_object *nh; + const struct nhop_object *nh; nh = fib6_lookup(M_GETFIB(*m), &ip6->ip6_dst, 0, NHR_NONE, 0); if (nh) { ifp = nh->nh_ifp; /* Use the gateway if needed. */ if (nh->nh_flags & NHF_GATEWAY) - bcopy(&dst.sin6_addr, &nh->gw6_sa.sin6_addr, + bcopy(&nh->gw6_sa.sin6_addr, &dst.sin6_addr, sizeof(dst.sin6_addr)); else dst.sin6_addr = ip6->ip6_dst; diff --git a/tests/sys/netpfil/pf/nat64.sh b/tests/sys/netpfil/pf/nat64.sh index 79fa0c99a311..913f90480e5d 100644 --- a/tests/sys/netpfil/pf/nat64.sh +++ b/tests/sys/netpfil/pf/nat64.sh @@ -609,6 +609,68 @@ dummynet_cleanup() pft_cleanup } +atf_test_case "gateway6" "cleanup" +gateway6_head() +{ + atf_set descr 'NAT64 with a routing hop on the v6 side' + atf_set require.user root +} + +gateway6_body() +{ + pft_init + + epair_lan_link=$(vnet_mkepair) + epair_link=$(vnet_mkepair) + epair=$(vnet_mkepair) + + ifconfig ${epair}a inet6 2001:db8:1::2/64 up no_dad + route -6 add default 2001:db8:1::1 + + vnet_mkjail lan_rtr ${epair}b ${epair_lan_link}a + jexec lan_rtr ifconfig ${epair}b inet6 2001:db8:1::1/64 up no_dad + jexec lan_rtr ifconfig ${epair_lan_link}a inet6 2001:db8::2/64 up no_dad + jexec lan_rtr route -6 add default 2001:db8::1 + jexec lan_rtr sysctl net.inet6.ip6.forwarding=1 + + vnet_mkjail rtr ${epair_lan_link}b ${epair_link}a + jexec rtr ifconfig ${epair_lan_link}b inet6 2001:db8::1/64 up no_dad + jexec rtr ifconfig ${epair_link}a 192.0.2.1/24 up + jexec rtr route -6 add default 2001:db8::2 + + vnet_mkjail dst ${epair_link}b + jexec dst ifconfig ${epair_link}b 192.0.2.2/24 up + jexec dst route add default 192.0.2.1 + + # Sanity checks + atf_check -s exit:0 -o ignore \ + ping6 -c 1 2001:db8:1::1 + atf_check -s exit:0 -o ignore \ + ping6 -c 1 2001:db8::1 + atf_check -s exit:0 -o ignore \ + jexec dst ping -c 1 192.0.2.1 + + jexec rtr pfctl -e + pft_set_rules rtr \ + "set reassemble yes" \ + "set state-policy if-bound" \ + "pass in on ${epair_lan_link}b inet6 from any to 64:ff9b::/96 af-to inet from (${epair_link}a)" + + # One ping + atf_check -s exit:0 -o ignore \ + ping6 -c 1 64:ff9b::192.0.2.2 + + # Make sure packets make it even when state is established + atf_check -s exit:0 \ + -o match:'5 packets transmitted, 5 packets received, 0.0% packet loss' \ + ping6 -c 5 64:ff9b::192.0.2.2 +} + +gateway6_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "icmp_echo" @@ -624,4 +686,5 @@ atf_init_test_cases() atf_add_test_case "table_range" atf_add_test_case "table_round_robin" atf_add_test_case "dummynet" + atf_add_test_case "gateway6" }