FreeBSD 11.1-RELEASE: Kernel panic in ipv6_output() via tcp6_usr_connect()

Tue Oct 31 16:40:25 UTC 2017

> On Oct 31, 2017, at 7:34 AM, Andrey V. Elsukov <bu7cher at yandex.ru> wrote:
> 
> can you show your nat rules?

Sure, igb0 is outside, igb1 is inside, the external IP
address is 100.2.39.101/24, the internal is 192.168.1.1/24.
The machine is the DNS server for the inside network and
does not NAT DNS traffic (makes thousands of DNS queries
per second when doing DANE scans, and would quickly exhaust
the state tables).  I also don't NAT NTP, or TCP 22/88 to
the server.  There's no IPv6 on the internal network, so
at present the IPv6 rules are rudimentary, just anti-spoof
the loopback interface and boilerplate ICMP6 rules.

$ cat /etc/rc.homenet
#! /bin/sh

oif=igb0
oaddr=100.2.39.101
iif=igb1
inet=192.168.1.0/24
iaddr=192.168.1.1

ipfw() { command ipfw -q "$@"; }

kldload -n libalias
kldload -n ipfw_nat

ipfw -f flush
ipfw table 1 flush

# RFC 1918 addresses
ipfw table 1 add 10.0.0.0/8
ipfw table 1 add 172.16.0.0/12
ipfw table 1 add 192.168.0.0/16

# reserved addresses
ipfw table 1 add 0.0.0.0/8
ipfw table 1 add 169.254.0.0/16
ipfw table 1 add 192.0.2.0/24
ipfw table 1 add 224.0.0.0/4
ipfw table 1 add 240.0.0.0/4

# Block RFC1918 and reserved addresses on outside interface
ipfw add deny all from any to "table(1)" via ${oif}

# Anti-spoof loopback
ipfw add allow ip from any to any via lo0
ipfw add deny ip from any to 127.0.0.0/8
ipfw add deny ip from 127.0.0.0/8 to any
ipfw add deny ip from any to ::1
ipfw add deny ip from ::1 to any

# V6 icmp
ipfw add allow ipv6-icmp from :: to ff02::/16
ipfw add allow ipv6-icmp from fe80::/10 to fe80::/10
ipfw add allow ipv6-icmp from fe80::/10 to ff02::/16
ipfw add allow ipv6-icmp from any to any ip6 icmp6types 1
ipfw add allow ipv6-icmp from any to any ip6 icmp6types 2,135,136

# Anti-spoof inside and outside
ipfw add deny ip from $inet to any in via "${oif}"
ipfw add deny ip from $oaddr to any in via "${oif}"
ipfw add deny ip from not $inet to any in via "${iif}"
ipfw add deny ip from $iaddr to any in via "${iif}"

# NAT exceptions:

# All DNS traffic
ipfw add allow tcp from any 53 to me
ipfw add allow udp from any 53 to me
ipfw add allow udp from me to any dst-port 53
ipfw add allow tcp from me to any dst-port 53
ipfw add allow tcp from any to me dst-port 53
ipfw add allow udp from any to me dst-port 53
ipfw add allow udp from me 53 to any
ipfw add allow tcp from me 53 to any

# My NTP server
ipfw add allow tcp from any 123 to me dst-port 123
ipfw add allow udp from any 123 to me dst-port 123
ipfw add allow udp from me 123 to any dst-port 123
ipfw add allow tcp from me 123 to any dst-port 123

# My SSH server
ipfw add allow tcp from any to me dst-port 22
ipfw add allow tcp from me 22 to any

# My KDC
ipfw add allow tcp from any to me dst-port 88
ipfw add allow tcp from me 88 to any

# NAT the rest
ipfw nat 1 config if "$oif" unreg_only reset same_ports
ipfw add nat 1 ip from any to any via "$oif"

# Drop reserved addresses that fail to NAT
ipfw add deny ip from "table(1)" to any via "$oif"

# Permit the rest
ipfw add allow ip from any to any

> Also what will show following commands in kgdb:
> 
> f 9
> i lo

m = <value optimized out>
hdrsplit = <value optimized out>
unfragpartlen = 40
plen = <value optimized out>
optlen = <value optimized out>
error = 0
exthdrs = {ip6e_ip6 = 0x0, ip6e_hbh = 0x0, ip6e_dest1 = 0x0, ip6e_rthdr = 0x0, ip6e_dest2 = 0x0}
ip6 = <value optimized out>
nexthdrp = <value optimized out>
mprev = <value optimized out>
ro_pmtu = <value optimized out>
hlen = 40
dst = (struct sockaddr_in6 *) 0xfffff800118bed60
ia = <value optimized out>
fwd_tag = (struct m_tag *) 0x0
dst0 = {__u6_addr = {__u6_addr8 = 0xfffffe1041cc7398 "*\001[@", __u6_addr16 = 0xfffffe1041cc7398, 
    __u6_addr32 = 0xfffffe1041cc7398}}
src_sa = {sin6_len = 28 '\034', sin6_family = 28 '\034', sin6_port = 0, sin6_flowinfo = 0, sin6_addr = {__u6_addr = {
      __u6_addr8 = 0xfffffe1041cc7350 " \002d\002'e", __u6_addr16 = 0xfffffe1041cc7350, __u6_addr32 = 0xfffffe1041cc7350}}, 
  sin6_scope_id = 0}
origifp = (struct ifnet *) 0xfffff8001006b000
src0 = {__u6_addr = {__u6_addr8 = 0xfffffe1041cc7388 " \002d\002'e", __u6_addr16 = 0xfffffe1041cc7388, 
    __u6_addr32 = 0xfffffe1041cc7388}}
dst_sa = {sin6_len = 28 '\034', sin6_family = 28 '\034', sin6_port = 0, sin6_flowinfo = 0, sin6_addr = {__u6_addr = {
      __u6_addr8 = 0xfffffe1041cc7470 "*\001[@", __u6_addr16 = 0xfffffe1041cc7470, __u6_addr32 = 0xfffffe1041cc7470}}, 
  sin6_scope_id = 0}
fibnum = <value optimized out>
rt = (struct rtentry *) 0xfffff80022ecfd00
ifp = <value optimized out>
zone = <value optimized out>
mtu = <value optimized out>
needfiblookup = <value optimized out>
tso = <value optimized out>
sw_csum = <value optimized out>
len = 1448
id = <value optimized out>

> p *ifp

(kgdb) p *ifp
Cannot access memory at address 0x1300000049

> p *ro

(kgdb) p *ro
$1 = {ro_rt = 0xfffff80022ecfd00, ro_lle = 0x0, ro_prepend = 0x0, ro_plen = 0, ro_flags = 256, ro_mtu = 0, spare = 0, ro_dst = {
    sin6_len = 28 '\034', sin6_family = 28 '\034', sin6_port = 0, sin6_flowinfo = 0, sin6_addr = {__u6_addr = {
        __u6_addr8 = 0xfffff80329e90558 "*\001[@", __u6_addr16 = 0xfffff80329e90558, __u6_addr32 = 0xfffff80329e90558}}, 
    sin6_scope_id = 0}}

> p *m

(kgdb) p *m
$2 = {{m_next = 0xfffff80022ecfd00, m_slist = {sle_next = 0xfffff80022ecfd00}, m_stailq = {stqe_next = 0xfffff80022ecfd00}}, {
    m_nextpkt = 0x0, m_slistpkt = {sle_next = 0x0}, m_stailqpkt = {stqe_next = 0x0}}, m_data = 0x0, m_len = 16777216, 
  m_type = 0, m_flags = 0, {{m_pkthdr = {rcvif = 0x1c1c, tags = {slh_first = 0x1220000405b012a}, len = 0, flowid = 16777216, 
        csum_flags = 0, fibnum = 1856, cosqos = 233 '�', rsstype = 41 ')', l2hlen = 3 '\003', l3hlen = 248 '�', 
        l4hlen = 255 '�', l5hlen = 255 '�', PH_per = {eight = 0xfffff80329e90578 "��6\017", sixteen = 0xfffff80329e90578, 
          thirtytwo = 0xfffff80329e90578, sixtyfour = 0xfffff80329e90578, unintptr = 0xfffff80329e90578, 
          ptr = 0xfffffe000f36c3e0}, PH_loc = {eight = 0xfffff80329e90580 "", sixteen = 0xfffff80329e90580, 
          thirtytwo = 0xfffff80329e90580, sixtyfour = 0xfffff80329e90580, unintptr = 0xfffff80329e90580, ptr = 0x0}}, {m_ext = {{
            ext_count = 0, ext_cnt = 0x0}, ext_buf = 0xfffff80329e90740 "", ext_size = 2178721104, ext_type = 255, 
          ext_flags = 16777215, ext_free = 0, ext_arg1 = 0xffffffff81dca558, ext_arg2 = 0x0}, 
        m_pktdat = 0xfffff80329e90588 ""}}, m_dat = 0xfffff80329e90550 "\034\034"}}

-- 
	Viktor.