Page MenuHomeFreeBSD
Differential D49143

pf: fix ICMP source address translation for nat64
ClosedPublic
Actions

Authored by kp on Feb 26 2025, 10:42 PM.
Tags
None
Referenced Files
Unknown Object (File)
Fri, Aug 14, 8:09 PM
Unknown Object (File)
Wed, Aug 12, 10:00 PM
Unknown Object (File)
Wed, Aug 12, 10:00 PM
Unknown Object (File)
Wed, Aug 12, 10:00 PM
Unknown Object (File)
Tue, Aug 11, 4:31 PM
Unknown Object (File)
Mon, Jul 27, 4:01 AM
Unknown Object (File)
Sun, Jul 26, 10:18 PM
Unknown Object (File)
Wed, Jul 22, 6:56 AM
View All Files
Subscribers
farrokhi
glebius
imp
ivy
melifaro
vegeta_tuxpowered.net

Details

Reviewers
None
Group Reviewers
pfsense
network
Commits
rGe9a490b10d6c: pf: fix ICMP source address translation for nat64
Summary

While handling an ICMP error related to another state (e.g. TTL expired, port
closed, fragmentation needed, ...) we can't just use the state's source address
as the ICMP source address. We have to translate the IPv4 address back to an
IPv6 nat64 address.

Failing to do so breaks things like traceroute, where the intermediate router
generates an ICMP error message, and the traceroute tool uses the source address
to build the path.

PR: 284944
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 62752
Build 59636: arc lint + arc unit

Event Timeline

kp created this revision.Feb 26 2025, 10:42 PM
Herald added subscribers: vegeta_tuxpowered.net, glebius, melifaro and 2 others. · View Herald TranscriptFeb 26 2025, 10:42 PM
kp requested review of this revision.Feb 26 2025, 10:42 PM
Harbormaster completed remote builds in B62643: Diff 151537.Feb 26 2025, 10:42 PM
kp added a child revision: D49144: pf tests: test ICMP error translation with nat64.Feb 26 2025, 10:42 PM
kp updated this revision to Diff 151666.Feb 28 2025, 11:00 AM

Use the approach from OpenBSD's proposed patch.
That's a bit simpler and still works.

Harbormaster completed remote builds in B62670: Diff 151666.Feb 28 2025, 11:00 AM
ivy added a subscriber: ivy.Feb 28 2025, 11:12 AM
kp updated this revision to Diff 151864.Mar 4 2025, 5:38 PM

Update to the committed OpenBSD version of this fix.

Harbormaster completed remote builds in B62752: Diff 151864.Mar 4 2025, 5:38 PM
This revision was not accepted when it landed; it landed in state Needs Review.Mar 5 2025, 9:38 AM
Closed by commit rGe9a490b10d6c: pf: fix ICMP source address translation for nat64 (authored by kp). · Explain Why
This revision was automatically updated to reflect the committed changes.
kp added a commit: rGe9a490b10d6c: pf: fix ICMP source address translation for nat64.

Revision Contents
Changeset List

PathSize
sys/
netpfil/
pf/
72 lines

Diff 151864

View Options

sys/netpfil/pf/pf.c

Loading...