From nobody Fri May 29 08:02:44 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gRbSN2TqDz6g8hL for ; Fri, 29 May 2026 08:02:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gRbSN1Zfhz3F9m for ; Fri, 29 May 2026 08:02:44 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780041764; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=C7LfmktbCcBaDLxTfCO2SrmPji+9YCM4+hibWHikFss=; b=dX446koPf/ALPdwBVlVcbwWjZTebot3PakYDNzhlxzS8ZECO/OcpbQKHXQrrhkwqRKILUi F9NCCR7bFANyh5lBJC6O0yXNT8kZjURUJarhSliKM+C58ZUpulTxmStvaMznhLLFFUv+Zf GEJb2jlqrstWKVHV1ZEFCSQ6U2dqnF+fS3niuU4LBIbzZl5AVWbgpfItYpx7EID6CXiZly JHGh/xLm4CHjH2lm69JVTi8AOxpk3beAyA3AAOF58pUwC5JGgPO3jdnn95LMEyG9JwSguY me32wFAI6IGS/1S/+qRgUs79fqZo93zSCm1McfA/auU2/rzpTL9dfLvs3lZUuQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1780041764; a=rsa-sha256; cv=none; b=bmbCTP+LjzzIxm8JSd6d5D/hV6zUENMM1TefKgjKoYenAbU+maSfR9wkXL7CvW86zU9xjE 4GOtv54wHA83a0MylZj2PssEoLn1En7rlCE3F8xVSbTUMl/hZaWQDp/nFLWUh0WZ6krzam YKBtco8Da4w31Q60vRGcUMZquzIB2zFtihcNEOo5DMnUnT6noH3zV5zQD0mTDhFrRfqile u9j3wSZNsMkTLB/6UyUD0S0ZgH0zwTQDz6bsIcu1oqGAB5O6vx3+kNNN11iHCQp216H45P 5E/bAVILUEAq+13CDx5WsX2KmqeyhgzaFg6lNeDbywpiiyhgQ9695C7hqJV1Iw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780041764; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=C7LfmktbCcBaDLxTfCO2SrmPji+9YCM4+hibWHikFss=; b=wBacHseZEDdz4syQI9vtUw09ZhcH5pACEVb1BzkZvTBTlp11hs8t3YfUBIYbRocs6jqYLb 7qLm6F34Vqvwms+g1K+aq3jAmDZWycZfGCr5ZGummpEc+Nyyuw7pKWYGqK3ycPpKW3IB7N hD+ouhVSYYxjmkjdYdvF5XsbaNY5uxq2XHDKizX5e7oP/97aEft9B7Ig6NjY+k4bgAmqNs AHutysBiBwZHodHZ4p6PWARSKItUtkqjBtSM0Sy6MApJX69nKvQZJpajY5XfRRq4T7E3Jw pu+lkdlESD3v57NNlsCXJLGbx+Udb9pRrivf3u6P5YsljVkNasJoS1e3Y0DvVQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gRbSN13CMz8TN for ; Fri, 29 May 2026 08:02:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 222c1 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 29 May 2026 08:02:44 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Vyacheslav Terehov From: Andrey V. Elsukov Subject: git: 33cafd3fadd0 - stable/15 - ipfw: fix parsing error in nat config port_range List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: ae X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 33cafd3fadd07ea49b18559a4fe397951c6a844f Auto-Submitted: auto-generated Date: Fri, 29 May 2026 08:02:44 +0000 Message-Id: <6a194824.222c1.adb86ef@gitrepo.freebsd.org> The branch stable/15 has been updated by ae: URL: https://cgit.FreeBSD.org/src/commit/?id=33cafd3fadd07ea49b18559a4fe397951c6a844f commit 33cafd3fadd07ea49b18559a4fe397951c6a844f Author: Vyacheslav Terehov AuthorDate: 2026-05-21 07:15:22 +0000 Commit: Andrey V. Elsukov CommitDate: 2026-05-29 08:01:00 +0000 ipfw: fix parsing error in nat config port_range Also fix the corresponding tests. PR: 263240 Differential Revision: https://reviews.freebsd.org/D57010 (cherry picked from commit 6eba055fcf5b0bbfbebcac59f5982d13815001b0) --- sbin/ipfw/ipfw.8 | 3 ++- sbin/ipfw/nat.c | 29 ++++++++++++++++------------- tests/sys/netpfil/common/nat.sh | 26 ++++++++++++++------------ 3 files changed, 32 insertions(+), 26 deletions(-) diff --git a/sbin/ipfw/ipfw.8 b/sbin/ipfw/ipfw.8 index b72341c685e7..2d683286ed4e 100644 --- a/sbin/ipfw/ipfw.8 +++ b/sbin/ipfw/ipfw.8 @@ -1,5 +1,5 @@ .\" -.Dd March 1, 2026 +.Dd May 21, 2026 .Dt IPFW 8 .Os .Sh NAME @@ -3521,6 +3521,7 @@ Obey transparent proxy rules only, packet aliasing is not performed. Skip instance in case of global state lookup (see below). .It Cm port_range Ar lower-upper Set the aliasing ports between the ranges given. +Ports must be in the range 1024-65535. Upper port has to be greater than lower. .It Cm udp_eim When enabled, UDP packets use endpoint-independent mapping (EIM) from RFC 4787 diff --git a/sbin/ipfw/nat.c b/sbin/ipfw/nat.c index db74abaab233..a5691200943c 100644 --- a/sbin/ipfw/nat.c +++ b/sbin/ipfw/nat.c @@ -757,25 +757,28 @@ nat_show_cfg(struct nat44_cfg_nat *n, void *arg __unused) } static int -nat_port_alias_parse(char *str, u_short *lpout, u_short *hpout) { +nat_port_alias_parse(char *str, u_short *lpout, u_short *hpout) +{ long lp, hp; - char *ptr; + char *ptr, *substr; + + substr = strsep(&str, "-"); + if (substr == NULL || str == NULL) + return (0); + /* Lower port parsing */ - lp = (long) strtol(str, &ptr, 10); - if (lp < 1024 || lp > 65535) - return 0; - if (!ptr || *ptr != '-') - return 0; + lp = (long) strtol(substr, &ptr, 0); + if (*ptr != '\0' || lp < 1024 || lp > 65535) + return (0); + /* Upper port parsing */ - hp = (long) strtol(ptr, &ptr, 10); - if (hp < 1024 || hp > 65535) - return 0; - if (ptr) - return 0; + hp = (long) strtol(str, &ptr, 0); + if (*ptr != '\0' || hp < 1024 || hp > 65535) + return (0); *lpout = (u_short) lp; *hpout = (u_short) hp; - return 1; + return (1); } void diff --git a/tests/sys/netpfil/common/nat.sh b/tests/sys/netpfil/common/nat.sh index 023b0742ec6b..2b828dc03fdc 100644 --- a/tests/sys/netpfil/common/nat.sh +++ b/tests/sys/netpfil/common/nat.sh @@ -26,6 +26,8 @@ # # +set -e + . $(atf_get_srcdir)/utils.subr . $(atf_get_srcdir)/runner.subr @@ -178,13 +180,13 @@ common_cgn() { atf_check -s exit:2 -o ignore jexec client1 ping -t 1 -c 1 198.51.100.2 atf_check -s exit:2 -o ignore jexec client2 ping -t 1 -c 1 198.51.100.2 - if [[ $portalias ]]; then + if [ ${portalias} = "true" ]; then firewall_config nat $firewall \ "ipfw" \ - "ipfw -q nat 123 config if ${epair_host_nat}b unreg_cgn port_alias 2000-2999" \ - "ipfw -q nat 456 config if ${epair_host_nat}b unreg_cgn port_alias 3000-3999" \ - "ipfw -q add 1000 nat 123 all from any to 198.51.100.2 2000-2999 in via ${epair_host_nat}b" \ - "ipfw -q add 2000 nat 456 all from any to 198.51.100.2 3000-3999 in via ${epair_host_nat}b" \ + "ipfw -q nat 123 config if ${epair_host_nat}b unreg_cgn port_range 2000-2999" \ + "ipfw -q nat 456 config if ${epair_host_nat}b unreg_cgn port_range 3000-3999" \ + "ipfw -q add 1000 nat 123 all from any to 198.51.100.0/24 2000-2999 in via ${epair_host_nat}b" \ + "ipfw -q add 2000 nat 456 all from any to 198.51.100.0/24 3000-3999 in via ${epair_host_nat}b" \ "ipfw -q add 3000 nat 123 all from 100.64.0.2 to any out via ${epair_host_nat}b" \ "ipfw -q add 4000 nat 456 all from 100.64.1.2 to any out via ${epair_host_nat}b" else @@ -194,16 +196,16 @@ common_cgn() { "ipfw -q add 1000 nat 123 all from any to any" fi - # ping is successful now - atf_check -s exit:0 -o ignore jexec client1 ping -t 1 -c 1 198.51.100.2 - atf_check -s exit:0 -o ignore jexec client2 ping -t 1 -c 1 198.51.100.2 - # if portalias, test a tcp server/client with nc - if [[ $portalias ]]; then + if [ ${portalias} = "true" ]; then for inst in 1 2; do - daemon nc -p 198.51.100.2 7 - atf_check -s exit:0 -o ignore jexec client$inst sh -c "echo | nc -N 198.51.100.2 7" + daemon nc -l 198.51.100.2 7 + atf_check -s exit:0 -o ignore -e ignore jexec client$inst nc -z 198.51.100.2 7 done + else + # ping is successful now + atf_check -s exit:0 -o ignore jexec client1 ping -t 1 -c 1 198.51.100.2 + atf_check -s exit:0 -o ignore jexec client2 ping -t 1 -c 1 198.51.100.2 fi }