Page MenuHomeFreeBSD

pf: Use different address family for source and redirection address
ClosedPublic

Authored by vegeta_tuxpowered.net on Thu, Jul 31, 5:54 PM.
Tags
None
Referenced Files
F125605139: D51659.diff
Sat, Aug 9, 8:36 PM
F125589306: D51659.id159512.diff
Sat, Aug 9, 4:07 PM
F125550633: D51659.diff
Sat, Aug 9, 2:53 AM
Unknown Object (File)
Tue, Aug 5, 6:19 PM
Unknown Object (File)
Tue, Aug 5, 5:42 PM
Unknown Object (File)
Tue, Aug 5, 4:20 PM
Unknown Object (File)
Tue, Aug 5, 3:40 PM
Unknown Object (File)
Tue, Aug 5, 11:29 AM

Details

Summary

The function pf_map_addr() and source tracking operate on a single address
family. This made sense before introducing address translation. When
combining af-to with route-to or with sticky-address, the next-hop or the
NAT address are of different address family than the source address. For
example in NAT64 scenario an IPv6 source address is translated to an IPv4
address and routed over IPv4 gateway.

Make source nodes dual-AF, that is have a separate source AF and redirection
AF. Store route AF in struct pf_kstate, export it to pfctl. When loading
rules with redirection pools with pfctl store address family of each
address. When printing states don't deduce next-hop's address family from
af-to, use the one stored in state.

This patch contains parts picked from D50781 (RFC5549 / prefer-ipv6-nexthop) which make sense and fix bugs on their own.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped