Page MenuHomeFreeBSD
Files F162732975

D57010.id178301.diff
No OneTemporary
Actions

D57010.id178301.diff
View Options

diff --git a/sbin/ipfw/ipfw.8 b/sbin/ipfw/ipfw.8
--- a/sbin/ipfw/ipfw.8
+++ b/sbin/ipfw/ipfw.8
@@ -1,5 +1,5 @@
.\"
-.Dd March 1, 2026
+.Dd May 21, 2026
.Dt IPFW 8
.Os
.Sh NAME
@@ -3519,6 +3519,7 @@
Skip instance in case of global state lookup (see below).
.It Cm port_range Ar lower-upper
Set the aliasing ports between the ranges given.
+Ports must be in the range 1024-65535.
Upper port has to be greater than lower.
.It Cm udp_eim
When enabled, UDP packets use endpoint-independent mapping (EIM) from RFC 4787
diff --git a/sbin/ipfw/nat.c b/sbin/ipfw/nat.c
--- a/sbin/ipfw/nat.c
+++ b/sbin/ipfw/nat.c
@@ -757,25 +757,28 @@
}
static int
-nat_port_alias_parse(char *str, u_short *lpout, u_short *hpout) {
+nat_port_alias_parse(char *str, u_short *lpout, u_short *hpout)
+{
long lp, hp;
- char *ptr;
+ char *ptr, *substr;
+
+ substr = strsep(&str, "-");
+ if (substr == NULL || str == NULL)
+ return (0);
+
/* Lower port parsing */
- lp = (long) strtol(str, &ptr, 10);
- if (lp < 1024 || lp > 65535)
- return 0;
- if (!ptr || *ptr != '-')
- return 0;
+ lp = (long) strtol(substr, &ptr, 0);
+ if (*ptr != '\0' || lp < 1024 || lp > 65535)
+ return (0);
+
/* Upper port parsing */
- hp = (long) strtol(ptr, &ptr, 10);
- if (hp < 1024 || hp > 65535)
- return 0;
- if (ptr)
- return 0;
+ hp = (long) strtol(str, &ptr, 0);
+ if (*ptr != '\0' || hp < 1024 || hp > 65535)
+ return (0);
*lpout = (u_short) lp;
*hpout = (u_short) hp;
- return 1;
+ return (1);
}
void
diff --git a/tests/sys/netpfil/common/nat.sh b/tests/sys/netpfil/common/nat.sh
--- a/tests/sys/netpfil/common/nat.sh
+++ b/tests/sys/netpfil/common/nat.sh
@@ -26,6 +26,8 @@
#
#
+set -e
+
. $(atf_get_srcdir)/utils.subr
. $(atf_get_srcdir)/runner.subr
@@ -178,13 +180,13 @@
atf_check -s exit:2 -o ignore jexec client1 ping -t 1 -c 1 198.51.100.2
atf_check -s exit:2 -o ignore jexec client2 ping -t 1 -c 1 198.51.100.2
- if [[ $portalias ]]; then
+ if [ ${portalias} = "true" ]; then
firewall_config nat $firewall \
"ipfw" \
- "ipfw -q nat 123 config if ${epair_host_nat}b unreg_cgn port_alias 2000-2999" \
- "ipfw -q nat 456 config if ${epair_host_nat}b unreg_cgn port_alias 3000-3999" \
- "ipfw -q add 1000 nat 123 all from any to 198.51.100.2 2000-2999 in via ${epair_host_nat}b" \
- "ipfw -q add 2000 nat 456 all from any to 198.51.100.2 3000-3999 in via ${epair_host_nat}b" \
+ "ipfw -q nat 123 config if ${epair_host_nat}b unreg_cgn port_range 2000-2999" \
+ "ipfw -q nat 456 config if ${epair_host_nat}b unreg_cgn port_range 3000-3999" \
+ "ipfw -q add 1000 nat 123 all from any to 198.51.100.0/24 2000-2999 in via ${epair_host_nat}b" \
+ "ipfw -q add 2000 nat 456 all from any to 198.51.100.0/24 3000-3999 in via ${epair_host_nat}b" \
"ipfw -q add 3000 nat 123 all from 100.64.0.2 to any out via ${epair_host_nat}b" \
"ipfw -q add 4000 nat 456 all from 100.64.1.2 to any out via ${epair_host_nat}b"
else
@@ -194,16 +196,16 @@
"ipfw -q add 1000 nat 123 all from any to any"
fi
- # ping is successful now
- atf_check -s exit:0 -o ignore jexec client1 ping -t 1 -c 1 198.51.100.2
- atf_check -s exit:0 -o ignore jexec client2 ping -t 1 -c 1 198.51.100.2
-
# if portalias, test a tcp server/client with nc
- if [[ $portalias ]]; then
+ if [ ${portalias} = "true" ]; then
for inst in 1 2; do
- daemon nc -p 198.51.100.2 7
- atf_check -s exit:0 -o ignore jexec client$inst sh -c "echo | nc -N 198.51.100.2 7"
+ daemon nc -l 198.51.100.2 7
+ atf_check -s exit:0 -o ignore -e ignore jexec client$inst nc -z 198.51.100.2 7
done
+ else
+ # ping is successful now
+ atf_check -s exit:0 -o ignore jexec client1 ping -t 1 -c 1 198.51.100.2
+ atf_check -s exit:0 -o ignore jexec client2 ping -t 1 -c 1 198.51.100.2
fi
}

File Metadata

Mime Type
text/plain
Expires
Fri, Jul 17, 7:00 AM (18 h, 44 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
35129193
Default Alt Text
D57010.id178301.diff (3 KB)

Event Timeline