[Bug 219803] [patch] PF: implement RFC 4787 REQ 1 and 3 (full cone NAT)

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219803

--- Comment #6 from Kristof Provost <kp at freebsd.org> ---
With this patch my gateway box (pf and vimage jails) panics pretty quickly
during boot.

#0  doadump (textdump=0) at pcpu.h:232
#1  0xffffffff803a4c2b in db_dump (dummy=<value optimized out>, dummy2=<value
optimized out>, dummy3=<value optimized out>, dummy4=<value optimized out>)
    at /usr/src/sys/ddb/db_command.c:546
#2  0xffffffff803a4a1f in db_command (cmd_table=<value optimized out>) at
/usr/src/sys/ddb/db_command.c:453
#3  0xffffffff803a4754 in db_command_loop () at
/usr/src/sys/ddb/db_command.c:506
#4  0xffffffff803a781f in db_trap (type=<value optimized out>, code=<value
optimized out>) at /usr/src/sys/ddb/db_main.c:248
#5  0xffffffff80a9bd33 in kdb_trap (type=12, code=0, tf=<value optimized out>)
at /usr/src/sys/kern/subr_kdb.c:654
#6  0xffffffff80efb4f2 in trap_fatal (frame=0xfffffe022fefaf50, eva=48) at
/usr/src/sys/amd64/amd64/trap.c:796
#7  0xffffffff80efb5a2 in trap_pfault (frame=0xfffffe022fefaf50, usermode=0) at
pcpu.h:232
#8  0xffffffff80efad3d in trap (frame=0xfffffe022fefaf50) at
/usr/src/sys/amd64/amd64/trap.c:421
#9  0xffffffff80edcf31 in calltrap () at
/usr/src/sys/amd64/amd64/exception.S:236
#10 0xffffffff8267409a in pf_addrcpy (dst=0x30, src=0xfffff8002d09f590, af=2
'\002') at pcpu.h:231
#11 0xffffffff82689ead in pf_get_translation (pd=0xfffffe022fefc351, m=<value
optimized out>, off=<value optimized out>, direction=2, kif=<value optimized
out>,
    sn=0xfffffe022fefb438, skp=<value optimized out>, nkp=<value optimized
out>, saddr=<value optimized out>, daddr=<value optimized out>, sport=<value
optimized out>,
    dport=<value optimized out>, anchor_stack=<value optimized out>) at
/usr/src/sys/netpfil/pf/pf_lb.c:262
#12 0xffffffff8267dd08 in pf_test_rule (rm=0xfffffe022fefb6d0,
sm=0xfffffe022fefb6e0, direction=2, kif=0xfffff80006dddb00,
m=0xfffff8002d23f000, off=20,
    pd=<value optimized out>, am=0xfffffe022fefb6a0, inp=<value optimized out>)
at /usr/src/sys/netpfil/pf/pf.c:3336
#13 0xffffffff8267af11 in pf_test (dir=<value optimized out>, ifp=<value
optimized out>, m0=<value optimized out>, inp=0x0) at
/usr/src/sys/netpfil/pf/pf.c:6088
#14 0xffffffff8268cd9d in pf_check_out (arg=<value optimized out>,
m=0xfffffe022fefb7c0, ifp=<value optimized out>, dir=<value optimized out>,
inp=<value optimized out>)
    at /usr/src/sys/netpfil/pf/pf_ioctl.c:3582
#15 0xffffffff80b74314 in pfil_run_hooks (ph=0xfffffe0000de7a18,
mp=0xfffffe022fefb818, ifp=0xfffff80006e1d800, dir=2, inp=0x0) at
/usr/src/sys/net/pfil.c:108
#16 0xffffffff80bdbf80 in ip_tryforward (m=0xfffff8002d23f000) at
/usr/src/sys/netinet/ip_fastfwd.c:306
#17 0xffffffff80bde9f1 in ip_input (m=0xfffff8002d23f000) at
/usr/src/sys/netinet/ip_input.c:570
#18 0xffffffff80b731bf in netisr_dispatch_src (proto=1, source=0,
m=0xfffff8002d23f000) at /usr/src/sys/net/netisr.c:1120
#19 0xffffffff80b593be in ether_demux (ifp=0xfffff80006e1c000, m=<value
optimized out>) at /usr/src/sys/net/if_ethersubr.c:848
#20 0xffffffff80b5a3f2 in ether_nh_input (m=<value optimized out>) at
/usr/src/sys/net/if_ethersubr.c:637
#21 0xffffffff80b731bf in netisr_dispatch_src (proto=5, source=0,
m=0xfffff8002d23f000) at /usr/src/sys/net/netisr.c:1120
#22 0xffffffff80b5977f in ether_input (ifp=0xfffff80006e1c000, m=0x0) at
/usr/src/sys/net/if_ethersubr.c:757
#23 0xffffffff80b54d6a in if_input (ifp=<value optimized out>, sendmp=<value
optimized out>) at /usr/src/sys/net/if.c:3993
#24 0xffffffff804ff9cc in bge_rxeof () at /usr/src/sys/dev/bge/if_bge.c:4424
#25 0xffffffff804fd0d2 in bge_intr_task (arg=0xfffffe0000fe5000, pending=<value
optimized out>) at /usr/src/sys/dev/bge/if_bge.c:4654
#26 0xffffffff80aae22d in taskqueue_run_locked (queue=0xfffff80005637400) at
/usr/src/sys/kern/subr_taskqueue.c:454
#27 0xffffffff80aaefe8 in taskqueue_thread_loop (arg=<value optimized out>) at
/usr/src/sys/kern/subr_taskqueue.c:746
#28 0xffffffff80a1ab44 in fork_exit (callout=0xffffffff80aaef60
<taskqueue_thread_loop>, arg=0xfffffe0000fec568, frame=0xfffffe022fefbc00) at
/usr/src/sys/kern/kern_fork.c:1038
#29 0xffffffff80edd46e in fork_trampoline () at
/usr/src/sys/amd64/amd64/exception.S:611
#30 0x0000000000000000 in ?? ()

...

#11 0xffffffff82689ead in pf_get_translation (pd=0xfffffe022fefc351, m=<value
optimized out>, off=<value optimized out>, direction=2, kif=<value optimized
out>,
    sn=0xfffffe022fefb438, skp=<value optimized out>, nkp=<value optimized
out>, saddr=<value optimized out>, daddr=<value optimized out>, sport=<value
optimized out>,
    dport=<value optimized out>, anchor_stack=<value optimized out>) at
/usr/src/sys/netpfil/pf/pf_lb.c:262
262                     PF_ACPY(&(*udp_mapping)->endpoints[1].addr, naddr, af);
(kgdb) p udp_mapping
Cannot access memory at address 0x0
(kgdb)

I'm not quite sure how that happens, but it's easy to reproduce.

My pf.conf is a pretty typical gateway config. A nat rule and a couple of rdr
rules (including for UDP).

-- 
You are receiving this mail because:
You are the assignee for the bug.