From nobody Wed Oct 1 16:10:52 2025 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4ccKfN5N7Rz69sPj; Wed, 01 Oct 2025 16:10:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4ccKfN4bpLz3Pw7; Wed, 01 Oct 2025 16:10:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1759335052; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yKjQSd280hYRW0kf+E+cnp8uBGEN90wNKe7VwzuujdY=; b=gnGw90rdOxM3v/ULbyqd8NkOpi/mFvE8SC9GBbINpLzvclR9nD93ywrrfctHglTCBlfW+N xq4PIqeL0PcpYw1EUoRa4e0MLBxXMkSuBchHVUle6ka0EcxZgGVQ/RYU770HckEvpYbQ5N 3hymXkBSllpDUi9C5V3WX8zqFoLjRbwEdkk9QpA9gkCfXBPLR0kxt0zuhaNMaPaFpRpq5l KH7i3hpjSrIChCQaNkIUZLIVMkLQsrLpjALR6ZFB/vsD+6NZZrA7f7X24x09Qruv9eGiqL sGYvrSR/wTy/XGQyb4Ly4dQSE5wqiZhSlZDzxJ6UH4ldvbhu59Y+2mT7jVLaIQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1759335052; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=yKjQSd280hYRW0kf+E+cnp8uBGEN90wNKe7VwzuujdY=; b=Kre7NXOl2ooRtLNMQ/kRQIpteUFYRflo7d48YawfMiOe0QeQ3K8DjOMpTLd5szf66bNG5S wB6/3K4LImnQhH38piUA5qrrvb47giJGTV9BQY7H5YXsz6wVFmSnKeYA5Y/NeRUr78t7zI 85z07UjRLJCig9g/YP2c90dbA1Mqa+ExCj41sBvbEaTvXeqjk3e9mAZX/0VK4Nr4nqZ6uu 5TCLJ1P2+pt4YK+AugNc6u7BxjJMl4333N3iNsdz/44zG+5Ai1yoW7krKF+CZIsWF4ICrQ HmGuGUmg8Cx9qq7TFyFo8VZWqKXHlAiwRMO+uzSnJHnXgLScIfylCyLyJOuXjA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1759335052; a=rsa-sha256; cv=none; b=Bu+MX/0K2gD5UX4ORvfstTghzYv5liXBYhkKR1kVRDzfmzkH/qJir7KItuvGbgR4o8B+jy n3j4xT0r27Yr2flKybNsDnVwFXZaSTe7lgYujx5qz/TjNksTEV/ADh74/8lYD9e9F4dNiA pLI47UkdUkn3ng7Hh0oFYcnkC467onBPFNNcyCaubilnaLS2cqw1df/Cezr+cJ1dQtH1sf kfvFS81e6IvyBZtaoLMtygpJL7B8oeQzMleilX6OhA5xNKOXbnlvDkYl9pzAWuLZHuoN/H PHJjGdKdbv55KcKUg94N0nEdRGQ+6S1Cm/FJWf6TlZnatEVQfCXpRdIZ0g53jA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4ccKfN44yszDTv; Wed, 01 Oct 2025 16:10:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 591GAqco066121; Wed, 1 Oct 2025 16:10:52 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 591GAqVI066118; Wed, 1 Oct 2025 16:10:52 GMT (envelope-from git) Date: Wed, 1 Oct 2025 16:10:52 GMT Message-Id: <202510011610.591GAqVI066118@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kajetan Staszkiewicz Subject: git: f12dba5d1746 - stable/15 - pf: Fix interface binding for af-to with route-to List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ks X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: f12dba5d17466d591f7adbeca5e9eec06ef06d66 Auto-Submitted: auto-generated The branch stable/15 has been updated by ks: URL: https://cgit.FreeBSD.org/src/commit/?id=f12dba5d17466d591f7adbeca5e9eec06ef06d66 commit f12dba5d17466d591f7adbeca5e9eec06ef06d66 Author: Kajetan Staszkiewicz AuthorDate: 2025-09-07 10:48:15 +0000 Commit: Kajetan Staszkiewicz CommitDate: 2025-10-01 15:59:45 +0000 pf: Fix interface binding for af-to with route-to States created by inbound af-to rules bypass outbound filtering and span both the inbound and outbound interfaces. When the first packet for such rule creates a state, this state has st->orig_kif set the original inbound interface and kif set to V_pfi_all. When the outbound interface is eventually known st->kif is updated to that interface. When not using route-to, the outbound route and its interface are determined for the new address family and st->kif is set to that interface. However when using route-to, ifp is explicitely given and the code for updating st->kif is not run for the first packet. When the returning packet matches the state, the code is run but updates st->kif to the original inbound interface, which is now the outbound interface. The state ends up with st->kif == st->orig_kif and won't forward any more returning packets. There is another block of code performing such update, but only for reply-to. Perform the update of st->kif in a single place no matter if ifp was explicitely given or found by routing lookup. For checks using pings check if really all pings have been replied to, because a single reply is enough to have ping exit with a successful exit code. Reviewed by: kp Sponsored by: InnoGames GmbH Differential Revision: https://reviews.freebsd.org/D52445 (cherry picked from commit 42441d342071767f32cfe507466135dc79052a56) --- sys/netpfil/pf/pf.c | 64 +++++++++++++++++---------------------- tests/sys/netpfil/pf/nat64.sh | 6 +++- tests/sys/netpfil/pf/src_track.sh | 6 ++-- 3 files changed, 36 insertions(+), 40 deletions(-) diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 3a047ea44c47..3311260aa157 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -9163,26 +9163,8 @@ pf_route(struct pf_krule *r, struct ifnet *oifp, } else { dst->sin.sin_addr = ip->ip_dst; } - - /* - * Bind to the correct interface if we're - * if-bound. We don't know which interface - * that will be until here, so we've inserted - * the state on V_pf_all. Fix that now. - */ - if (s->kif == V_pfi_all && ifp != NULL && - r->rule_flag & PFRULE_IFBOUND) - s->kif = ifp->if_pf_kif; } } - - if (r->rule_flag & PFRULE_IFBOUND && - pd->act.rt == PF_REPLYTO && - s->kif == V_pfi_all) { - s->kif = pd->act.rt_kif; - s->orig_kif = oifp->if_pf_kif; - } - PF_STATE_UNLOCK(s); } @@ -9197,6 +9179,20 @@ pf_route(struct pf_krule *r, struct ifnet *oifp, goto bad; } + /* + * Bind to the correct interface if we're if-bound. We don't know which + * interface that will be until here, so we've inserted the state + * on V_pf_all. Fix that now. + */ + if (s != NULL && s->kif == V_pfi_all && r->rule_flag & PFRULE_IFBOUND) { + /* Verify that we're here because of BOUND_IFACE */ + MPASS(r->rt == PF_REPLYTO || (pd->af != pd->naf && s->direction == PF_IN)); + s->kif = ifp->if_pf_kif; + if (pd->act.rt == PF_REPLYTO) { + s->orig_kif = oifp->if_pf_kif; + } + } + if (r->rt == PF_DUPTO) skip_test = true; @@ -9477,26 +9473,8 @@ pf_route6(struct pf_krule *r, struct ifnet *oifp, sizeof(dst.sin6_addr)); else dst.sin6_addr = ip6->ip6_dst; - - /* - * Bind to the correct interface if we're - * if-bound. We don't know which interface - * that will be until here, so we've inserted - * the state on V_pf_all. Fix that now. - */ - if (s->kif == V_pfi_all && ifp != NULL && - r->rule_flag & PFRULE_IFBOUND) - s->kif = ifp->if_pf_kif; } } - - if (r->rule_flag & PFRULE_IFBOUND && - pd->act.rt == PF_REPLYTO && - s->kif == V_pfi_all) { - s->kif = pd->act.rt_kif; - s->orig_kif = oifp->if_pf_kif; - } - PF_STATE_UNLOCK(s); } @@ -9518,6 +9496,20 @@ pf_route6(struct pf_krule *r, struct ifnet *oifp, goto bad; } + /* + * Bind to the correct interface if we're if-bound. We don't know which + * interface that will be until here, so we've inserted the state + * on V_pf_all. Fix that now. + */ + if (s != NULL && s->kif == V_pfi_all && r->rule_flag & PFRULE_IFBOUND) { + /* Verify that we're here because of BOUND_IFACE */ + MPASS(r->rt == PF_REPLYTO || (pd->af != pd->naf && s->direction == PF_IN)); + s->kif = ifp->if_pf_kif; + if (pd->act.rt == PF_REPLYTO) { + s->orig_kif = oifp->if_pf_kif; + } + } + if (r->rt == PF_DUPTO) skip_test = true; diff --git a/tests/sys/netpfil/pf/nat64.sh b/tests/sys/netpfil/pf/nat64.sh index 4438ad6abb85..d930e2ee5763 100644 --- a/tests/sys/netpfil/pf/nat64.sh +++ b/tests/sys/netpfil/pf/nat64.sh @@ -1039,13 +1039,14 @@ route_to_body() "pass in on ${epair}b route-to (${epair_link}a 192.0.2.2) inet6 from any to 64:ff9b::/96 af-to inet from (${epair_link}a)" atf_check -s exit:0 -o ignore \ + -o match:'3 packets transmitted, 3 packets received, 0.0% packet loss' \ ping6 -c 3 64:ff9b::192.0.2.2 states=$(mktemp) || exit 1 jexec rtr pfctl -qvvss | normalize_pfctl_s > $states for state_regexp in \ - "${epair}b ipv6-icmp 192.0.2.1:.* \(2001:db8::2\[[0-9]+\]\) -> 192.0.2.2:8 \(64:ff9b::c000:202\[[0-9]+\]\).*4:2 pkts.*route-to: 192.0.2.2@${epair_link}a" \ + "${epair_link}a ipv6-icmp 192.0.2.1:.* \(2001:db8::2\[[0-9]+\]\) -> 192.0.2.2:8 \(64:ff9b::c000:202\[[0-9]+\]\).*6:6 pkts.*route-to: 192.0.2.2@${epair_link}a origif: ${epair}b" \ ; do grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'" done @@ -1094,6 +1095,7 @@ reply_to_body() "pass in on ${epair}b reply-to (${epair}b 2001:db8::2) inet6 from any to 64:ff9b::/96 af-to inet from 192.0.2.1" atf_check -s exit:0 -o ignore \ + -o match:'3 packets transmitted, 3 packets received, 0.0% packet loss' \ ping6 -c 3 64:ff9b::192.0.2.2 } @@ -1155,8 +1157,10 @@ v6_gateway_body() "pass in on ${epair_lan}b inet6 from any to 64:ff9b::/96 af-to inet from (${epair_wan_one}a)" atf_check -s exit:0 -o ignore \ + -o match:'3 packets transmitted, 3 packets received, 0.0% packet loss' \ ping6 -c 3 64:ff9b::192.0.2.2 atf_check -s exit:0 -o ignore \ + -o match:'3 packets transmitted, 3 packets received, 0.0% packet loss' \ ping6 -c 3 64:ff9b::198.51.100.1 } diff --git a/tests/sys/netpfil/pf/src_track.sh b/tests/sys/netpfil/pf/src_track.sh index e12d0464ee8c..d86b4ce6c466 100755 --- a/tests/sys/netpfil/pf/src_track.sh +++ b/tests/sys/netpfil/pf/src_track.sh @@ -565,9 +565,9 @@ mixed_af_body() # FIXME: Sticky-address is broken for af-to pools! # The SN is created but apparently not used, as seen in states. for state_regexp in \ - "${epair_tester}b tcp 203.0.113.0:4201 \(2001:db8:44::1\[4201\]\) -> 192.0.2.100:9 \(64:ff9b::c000:264\[9\]\) .* route-to: 2001:db8:4202::2@${epair_server2}a" \ - "${epair_tester}b tcp 203.0.113.1:4202 \(2001:db8:44::1\[4202\]\) -> 192.0.2.100:9 \(64:ff9b::c000:264\[9\]\) .* route-to: 2001:db8:4202::2@${epair_server2}a" \ - "${epair_tester}b tcp 203.0.113.2:4203 \(2001:db8:44::2\[4203\]\) -> 192.0.2.100:9 \(64:ff9b::c000:264\[9\]\) .* route-to: 198.51.100.18@${epair_server1}a" \ + "${epair_server2}a tcp 203.0.113.0:4201 \(2001:db8:44::1\[4201\]\) -> 192.0.2.100:9 \(64:ff9b::c000:264\[9\]\) .* route-to: 2001:db8:4202::2@${epair_server2}a origif: ${epair_tester}b" \ + "${epair_server2}a tcp 203.0.113.1:4202 \(2001:db8:44::1\[4202\]\) -> 192.0.2.100:9 \(64:ff9b::c000:264\[9\]\) .* route-to: 2001:db8:4202::2@${epair_server2}a origif: ${epair_tester}b" \ + "${epair_server1}a tcp 203.0.113.2:4203 \(2001:db8:44::2\[4203\]\) -> 192.0.2.100:9 \(64:ff9b::c000:264\[9\]\) .* route-to: 198.51.100.18@${epair_server1}a origif: ${epair_tester}b" \ ; do grep -qE "${state_regexp}" $states || atf_fail "State not found for '${state_regexp}'" done