pf: fix nat64 ICMP translation
ClosedPublic
Actions

Authored by kp on Mar 4 2025, 5:39 PM.

Details

Reviewers

None

Group Reviewers

pfsense
network

Commits

rG6e7f24e0a526: pf: fix nat64 ICMP translation

Summary

Fix more incorrect use of the iih pointer, this time causing corruption in nat64
translated ICMP error messages.
Extend the relevant test case to catch this bug.

Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

kp created this revision.Mar 4 2025, 5:39 PM

Herald added subscribers: vegeta_tuxpowered.net, glebius, melifaro and 2 others. · View Herald TranscriptMar 4 2025, 5:39 PM

kp requested review of this revision.Mar 4 2025, 5:39 PM

Harbormaster completed remote builds in B62753: Diff 151865.Mar 4 2025, 5:39 PM

ivy added a subscriber: ivy.Mar 5 2025, 2:14 AM

This revision was not accepted when it landed; it landed in state Needs Review.Mar 5 2025, 9:39 AM

Closed by commit rG6e7f24e0a526: pf: fix nat64 ICMP translation (authored by kp). · Explain Why

This revision was automatically updated to reflect the committed changes.

kp added a commit: rG6e7f24e0a526: pf: fix nat64 ICMP translation.

Revision Contents
Changeset List

Path

Size

sys/

netpfil/

pf/

pf.c

4 lines

tests/

sys/

netpfil/

pf/

nat64.py

6 lines

Diff 151903

View Options

sys/netpfil/pf/pf.c

	Show First 20 Lines • Show All 57 Lines • ▼ Show 20 Lines
	#ifdef _KERNEL			#ifdef _KERNEL
	typedef struct {			typedef struct {
	struct iso_node *inop;			struct iso_node *inop;
	int fields; /* interesting fields in this analysis */			int fields; /* interesting fields in this analysis */
	daddr_t iso_ce_blk; /* block of continuation area */			daddr_t iso_ce_blk; /* block of continuation area */
	off_t iso_ce_off; /* offset of continuation area */			off_t iso_ce_off; /* offset of continuation area */
	int iso_ce_len; /* length of continuation area */			int iso_ce_len; /* length of continuation area */
	struct iso_mnt imp; / mount structure */			struct iso_mnt imp; / mount structure */
	cd_ino_t inump; / inode number pointer */			ino_t inump; / inode number pointer */
	char outbuf; / name/symbolic link output area */			char outbuf; / name/symbolic link output area */
	u_short outlen; / length of above */			u_short outlen; / length of above */
	u_short maxlen; /* maximum length of above */			u_short maxlen; /* maximum length of above */
	int cont; /* continuation of above */			int cont; /* continuation of above */
	} ISO_RRIP_ANALYZE;			} ISO_RRIP_ANALYZE;

	struct iso_directory_record;			struct iso_directory_record;

	int cd9660_rrip_analyze(struct iso_directory_record *isodir,			int cd9660_rrip_analyze(struct iso_directory_record *isodir,
	struct iso_node inop, struct iso_mnt imp);			struct iso_node inop, struct iso_mnt imp);
	int cd9660_rrip_getname(struct iso_directory_record *isodir,			int cd9660_rrip_getname(struct iso_directory_record *isodir,
	char outbuf, u_short outlen,			char outbuf, u_short outlen,
	cd_ino_t inump, struct iso_mnt imp);			ino_t inump, struct iso_mnt imp);
	int cd9660_rrip_getsymname(struct iso_directory_record *isodir,			int cd9660_rrip_getsymname(struct iso_directory_record *isodir,
	char outbuf, u_short outlen,			char outbuf, u_short outlen,
	struct iso_mnt *imp);			struct iso_mnt *imp);
	int cd9660_rrip_offset(struct iso_directory_record *isodir,			int cd9660_rrip_offset(struct iso_directory_record *isodir,
	struct iso_mnt *imp);			struct iso_mnt *imp);
	#endif /* _KERNEL */			#endif /* _KERNEL */

	#endif /* _ISOFS_CD9660_ISO_RRIP_H_ */			#endif /* _ISOFS_CD9660_ISO_RRIP_H_ */