Date: Thu, 6 Aug 2026 18:28:06 +0200 (CEST) From: freebsd@oldach.net (Helge Oldach) To: bnovkov@FreeBSD.org (Bojan =?us-ascii?Q?Novk=3D=3Fiso=2D8859=2D15=3Fb=3Fb3ZpPw=3D=3D=3F=3D?=) Cc: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: Re: git: 978b9026b018 - stable/15 - bind(2): Lookup local address in current FIB if '*.bind_all_fibs' is active Message-ID: <202608061628.676GS6mx091706@mp80.oldach.net> In-Reply-To: <6a74a791.18343.42b24743@gitrepo.freebsd.org> from =?us-ascii?Q?Bojan_Novk=3D=3Fiso=2D8859=2D15=3Fb=3Fb3ZpPw=3D=3D?= =?us-ascii?Q?=3F=3D?= at "6 Aug 2026 15:26:09"
index | next in thread | previous in thread | raw e-mail
Bojan Novk=?iso-8859-15?b?b3ZpPw==?= wrote on Thu, 06 Aug 2026 17:26:09 +0200 (CEST): > The branch stable/15 has been updated by bnovkov: > > URL: https://cgit.FreeBSD.org/src/commit/?id=978b9026b01852bc78289fd2c8c747c78441b5f1 > > commit 978b9026b01852bc78289fd2c8c747c78441b5f1 > Author: Bojan Novkovi<U+0107> <bnovkov@FreeBSD.org> > AuthorDate: 2026-07-15 13:47:01 +0000 > Commit: Bojan Novkovi<U+0107> <bnovkov@FreeBSD.org> > CommitDate: 2026-08-06 15:25:24 +0000 > > bind(2): Lookup local address in current FIB if '*.bind_all_fibs' is active > > When a protocol-specific 'bind_all_fibs' tunable is set to 0, a > listening socket will only receive traffic originating from the FIB > it was bound to. However, there are no checks to determine whether > an address exists in the target FIB when binding the socket, which can > lead to a situation where a socket and the address it was bound to > belong to different FIBs. > > Prevent this footgun by looking up the requested address in the current > FIB if 'bind_all_fibs' is active and returning an error if the address > does not exist. > > Sponsored by: Stormshield > Sponsored by: Klara, Inc. > Differential Revision: https://reviews.freebsd.org/D58281 > Reviewed by: glebius, pouria, markj > MFC after: 2 weeks > > (cherry picked from commit 948ad32ae1e0811f45e1d38f26636fefed5051f0) > --- > sys/netinet/in_pcb.c | 2 +- > sys/netinet/raw_ip.c | 7 ++- > sys/netinet6/in6_pcb.c | 2 +- > sys/netinet6/raw_ip6.c | 7 ++- > tests/sys/netinet/Makefile | 1 + > tests/sys/netinet/fib_bind.py | 100 ++++++++++++++++++++++++++++++++++++++++++ > 6 files changed, 113 insertions(+), 6 deletions(-) cc -target x86_64-unknown-freebsd15.1 --sysroot=/usr/obj/usr/src/amd64.amd64/tmp -B/usr/obj/usr/src/amd64.amd64/tmp/usr/bin -c -O2 -pipe -fno-strict-aliasing -g -nostdinc -I. -I/usr/src/sys -I/usr/src/sys/contrib/ck/include -I/usr/src/sys/contrib/libfdt -D_KERNEL -DHAVE_KERNEL_OPTION_HEADERS -include opt_global.h -fno-common -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer -MD -MF.depend.in_pcb.o -MTin_pcb.o -ffile-prefix-map=/usr/src/sys=/usr/src/sys -ffile-prefix-map=/usr/obj/usr/src/amd64.amd64/sys/GENERIC=/usr/obj/usr/src/amd64.amd64/sys/GENERIC -ffile-prefix-map=/usr/obj/usr/src/amd64.amd64/tmp=/sysroot -fdebug-prefix-map=./machine=/usr/src/sys/amd64/include -fdebug-prefix-map=./x86=/usr/src/sys/x86/include -fdebug-prefix-map=./i386=/usr/src/sys/i386/include -mcmodel=kernel -mno-red-zone -mno-mmx -mno-sse -msoft-float -fno-asynchronous-unwind-tables -ffreestanding -fwrapv -fstack-protector-strong -gdwarf-4 -Wall -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Wcast-qual -Wundef -Wno-pointer-sign -D__printf__=__freebsd_kprintf__ -Wmissing-include-dirs -fdiagnostics-show-option -Wno-unknown-pragmas -Wswitch -Wno-error=tautological-compare -Wno-error=empty-body -Wno-error=parentheses-equality -Wno-error=unused-function -Wno-error=pointer-sign -Wno-error=shift-negative-value -Wno-address-of-packed-member -Wno-format-zero-length -mno-aes -mno-avx -std=gnu17 -Werror /usr/src/sys/netinet/in_pcb.c /usr/src/sys/netinet/in_pcb.c:954:7: error: call to undeclared function 'ifa_ifwithaddr_fib_check'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] 954 | ifa_ifwithaddr_fib_check((const struct sockaddr *)&s... | ^ /usr/src/sys/netinet/in_pcb.c:954:7: note: did you mean 'ifa_ifwithaddr_check'? /usr/src/sys/net/if_var.h:551:6: note: 'ifa_ifwithaddr_check' declared here 551 | int ifa_ifwithaddr_check(const struct sockaddr *); | ^ 1 error generated. *** Error code 1 Stop. make[2]: stopped making "all" in /usr/obj/usr/src/amd64.amd64/sys/GENERIC 429.20 real 410.50 user 18.43 sys *** Error code 1 Stop. make[1]: stopped making "buildkernel" in /usr/src *** Error code 1 Stop. make: stopped making "buildkernel" in /usr/srchome | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202608061628.676GS6mx091706>