Page MenuHomeFreeBSD

pf: cope with IPv6 gateways for an IPv4 route in nat64
ClosedPublic

Authored by kp on Feb 21 2025, 4:33 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, Apr 7, 10:55 AM
Unknown Object (File)
Sun, Apr 6, 1:37 AM
Unknown Object (File)
Fri, Mar 21, 1:02 PM
Unknown Object (File)
Mar 15 2025, 3:35 PM
Unknown Object (File)
Mar 11 2025, 10:59 AM
Unknown Object (File)
Mar 9 2025, 8:40 AM
Unknown Object (File)
Mar 8 2025, 3:07 PM
Unknown Object (File)
Feb 27 2025, 11:30 AM

Details

Summary

It's possible for an IPv4 next hop to be specified as an IPv6 address. This
broke pf's route lookup in pf_route(), which is required for nat64.

Handle this case just like ip_tryforward(): use the struct sockaddr from the
struct nhop_object, and mark a struct route to indicate if_output() has to use
the gateway.

Add a test case for this.

PR: 284946
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

kp requested review of this revision.Feb 21 2025, 4:33 PM

While this does fix this test case it seems to break others. I’ll debug and update.

fixed version
(Keep rt_addrs for !nat64, use ip_dst for nat64 without gateway)

zlei added a subscriber: zlei.

I have not tested this yet, the changed part of pf_route() and the new test look good to me.

This revision is now accepted and ready to land.Feb 24 2025, 2:24 PM