Page MenuHomeFreeBSD

pf: cope with IPv6 gateways for an IPv4 route in nat64
ClosedPublic

Authored by kp on Feb 21 2025, 4:33 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Feb 8, 12:21 PM
Unknown Object (File)
Sun, Feb 8, 7:39 AM
Unknown Object (File)
Sun, Feb 8, 4:11 AM
Unknown Object (File)
Fri, Jan 30, 4:08 PM
Unknown Object (File)
Fri, Jan 16, 3:33 PM
Unknown Object (File)
Fri, Jan 16, 12:07 PM
Unknown Object (File)
Dec 13 2025, 10:10 PM
Unknown Object (File)
Dec 6 2025, 12:23 AM

Details

Summary

It's possible for an IPv4 next hop to be specified as an IPv6 address. This
broke pf's route lookup in pf_route(), which is required for nat64.

Handle this case just like ip_tryforward(): use the struct sockaddr from the
struct nhop_object, and mark a struct route to indicate if_output() has to use
the gateway.

Add a test case for this.

PR: 284946
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

kp requested review of this revision.Feb 21 2025, 4:33 PM

While this does fix this test case it seems to break others. I’ll debug and update.

fixed version
(Keep rt_addrs for !nat64, use ip_dst for nat64 without gateway)

zlei added a subscriber: zlei.

I have not tested this yet, the changed part of pf_route() and the new test look good to me.

This revision is now accepted and ready to land.Feb 24 2025, 2:24 PM