Fix IPv6 flow label match in ipfw
ClosedPublic
Actions

Authored by lytboris_gmail.com on May 7 2026, 4:23 PM.

Details

Reviewers

pouria

Group Reviewers

network

Commits

Summary

Address a number of IPv6 flow label bugs scattered across different parts of ipfw:

kernel module: IPV6_FLOWLABEL_MASK is not being applied before comparison in flow6id_match() so flow-id opcode never matches a flow label alone (one need to take protocol version and traffic class into account)
kernel module: off-by-one bug leading to out-of-bounds read
sbin/ipfw: flow-id opcode allows just ip6 as a proto while ipv6-icmp, tcp, udp should be fine too.

Test Plan

ipv6-flow-id.sh test is provided

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

I'm not an expert on IPFW. But the code, and logic LGTM.

tests/sys/netpfil/ipfw/ipv6-flow-id.sh
2–28	Please use new format. recently, @ziaee updated the preferred format: https://docs.freebsd.org/en/articles/license-guide/ Even that `-` at the first line is no longer required.
43	Could be nice to use `ifconfig -j` instead. Of course, I understand this pattern is repeated across the ipfw tests.
tests/sys/netpfil/ipfw/lookup.sh
59 ↗	(On Diff #177369)	This is not really related to this change. I suggest to separate it into another commit/review.
144 ↗	(On Diff #177369)	This is not really related to this change. I suggest to separate it into another commit/review.