Page MenuHomeFreeBSD

pf: cope with IPv6 gateways for an IPv4 route in nat64
ClosedPublic

Authored by kp on Feb 21 2025, 4:33 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Nov 18, 11:53 PM
Unknown Object (File)
Mon, Nov 10, 12:38 AM
Unknown Object (File)
Sun, Nov 2, 4:32 AM
Unknown Object (File)
Oct 28 2025, 10:00 AM
Unknown Object (File)
Oct 26 2025, 3:43 PM
Unknown Object (File)
Oct 19 2025, 11:44 PM
Unknown Object (File)
Oct 8 2025, 8:13 AM
Unknown Object (File)
Oct 2 2025, 6:07 PM

Details

Summary

It's possible for an IPv4 next hop to be specified as an IPv6 address. This
broke pf's route lookup in pf_route(), which is required for nat64.

Handle this case just like ip_tryforward(): use the struct sockaddr from the
struct nhop_object, and mark a struct route to indicate if_output() has to use
the gateway.

Add a test case for this.

PR: 284946
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

kp requested review of this revision.Feb 21 2025, 4:33 PM

While this does fix this test case it seems to break others. I’ll debug and update.

fixed version
(Keep rt_addrs for !nat64, use ip_dst for nat64 without gateway)

zlei added a subscriber: zlei.

I have not tested this yet, the changed part of pf_route() and the new test look good to me.

This revision is now accepted and ready to land.Feb 24 2025, 2:24 PM