Page MenuHomeFreeBSD

pf: cope with IPv6 gateways for an IPv4 route in nat64
ClosedPublic

Authored by kp on Feb 21 2025, 4:33 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Oct 8, 8:13 AM
Unknown Object (File)
Thu, Oct 2, 6:07 PM
Unknown Object (File)
Sun, Sep 28, 3:16 AM
Unknown Object (File)
Sat, Sep 27, 7:39 PM
Unknown Object (File)
Thu, Sep 25, 2:02 PM
Unknown Object (File)
Wed, Sep 24, 2:05 AM
Unknown Object (File)
Tue, Sep 16, 3:56 AM
Unknown Object (File)
Sun, Sep 14, 5:04 AM

Details

Summary

It's possible for an IPv4 next hop to be specified as an IPv6 address. This
broke pf's route lookup in pf_route(), which is required for nat64.

Handle this case just like ip_tryforward(): use the struct sockaddr from the
struct nhop_object, and mark a struct route to indicate if_output() has to use
the gateway.

Add a test case for this.

PR: 284946
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

kp requested review of this revision.Feb 21 2025, 4:33 PM

While this does fix this test case it seems to break others. I’ll debug and update.

fixed version
(Keep rt_addrs for !nat64, use ip_dst for nat64 without gateway)

zlei added a subscriber: zlei.

I have not tested this yet, the changed part of pf_route() and the new test look good to me.

This revision is now accepted and ready to land.Feb 24 2025, 2:24 PM