From nobody Fri Oct 30 17:34:16 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jGSrn0ddVz6xFb9 for ; Fri, 30 Oct 2026 17:34:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jGSrm5dtNz4YcR for ; Fri, 30 Oct 2026 17:34:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793381656; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iO5HpJwQ2+2sqT2ga+gchCHaG42GQRO0/gBOX1C6WNk=; b=tRzXOvlPvmrADNWhT4sevGUcHLDgwEjnLOFqkICrDnUOQZrE6rYN+YfBmmV1J6vSNgAUBg 0BQvW1a6dv2FWyCenn5gccVqlEpQaKWmOOqnwNWul2MrEkYKgFzIiIKSa8Z0Irp8U5Sy7l wmbntmk8ATArhckHr4FvKY9UAkGRytGK5Ql40iS0xs5dqvYecLRHpPXKE+l9VZok1j+OIY RwjvP6fDGIVV0VURjkVCr0c/UAHloVvmr9w+8Z16YrzOMqdbOkM9gFSzENFhP8X1bxGqq3 5/WslZwBp8GP6IWjjf1T9uaUtj+nF9ZZD/mCO8q8HkLbrIrbKm/lS2HjSfWRjA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793381656; b=dYB0Aq6zOTdzOGz5fXt9PD08VecJgb1+LqCy1+LYdw3MfrNu0xBu7qpTq+dQVofcQmUikp 36gffK2YsgcRGMPm1md/bg8afoshvJRBoQeBGMOaHZlaMokRYgTzWiNpSkTbuggT59ZGra DcUC5FjnSKQZ27AT2dZnZa64eML4//u85hNO/lQayPwyCeapBBvLdzce1uZINIM5+WOd38 +oHI0wc38bA6J3EoTenQvZGzHg05BDq4Ipp/7GGCoXRtyStWuQBhW6ety/kYzJoyNhaleM ZItfa2WTtAUEmAbNaEQrs2mcwV93sBl5nTL57Qh0fQzTfQYszZ5IdGmh3MnRCw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793381656; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=iO5HpJwQ2+2sqT2ga+gchCHaG42GQRO0/gBOX1C6WNk=; b=WmP2xjvYk9MHJ5mAwHDSyGaS/TvZPJGdiRfz3ap2QF/sgF2hx8VE+VQRns0YXh6hcmaCXe 6lu6Q/tGXwNd5Tm8UqNhArBJgzrO3pAPrgYfpfS2HQoWtDwSCbkPeseKd7cC8llooLT1OV mXGydLs6dzZWluR6dXGYRwIMG4PxCN2zkJO5xZddSzWRFZZeaTMHyzymnkijWtSAeWpomu C+eNSovcYS3iqKnH/RZRLfq5z8NsPMKjuixF5sRQnhekHIY1aus3iGvQWWchkE22qDUHdX r48D4n/k7qexs+jSs+FqbR/ir/GQNS5WMC2uKO8ch/AgDni1hw9LNnU0NWm6HA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jGSrm51YLzdtX for ; Fri, 30 Oct 2026 17:34:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4068c by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 30 Oct 2026 17:34:16 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: R. Christian McDonald Subject: git: 8c73c0f1230d - main - netinet6: Set PFIL_FWD in ip6_tryforward() List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rcm X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 8c73c0f1230dde0a65474b1ae9a94f27f6568bda Auto-Submitted: auto-generated Date: Fri, 30 Oct 2026 17:34:16 +0000 Message-Id: <6ae4d518.4068c.2cf867ee@gitrepo.freebsd.org> The branch main has been updated by rcm: URL: https://cgit.FreeBSD.org/src/commit/?id=8c73c0f1230dde0a65474b1ae9a94f27f6568bda commit 8c73c0f1230dde0a65474b1ae9a94f27f6568bda Author: R. Christian McDonald AuthorDate: 2026-10-30 17:31:37 +0000 Commit: R. Christian McDonald CommitDate: 2026-10-30 17:31:37 +0000 netinet6: Set PFIL_FWD in ip6_tryforward() ip6_forward() has run the outbound hooks with pfil_mbuf_fwd() since b52b61c0b6b1, and ip_tryforward() since 1f4c3887e3fa, but ip6_tryforward() still calls pfil_mbuf_out(). pf therefore handles a packet on the IPv6 fast path as locally generated: it skips the packet-too-big error it sends with the untranslated addresses, and pf_refragment6() sends reassembled packets out through ip6_output() instead of ip6_forward(), so their fragments leave with the hop limit not decremented. Use pfil_mbuf_fwd() in ip6_tryforward() as well. The new fragmentation_pass:v6_refrag_hlim test sends a packet that pf reassembles and refragments through the fast path, and checks that its fragments leave with the hop limit decremented once; before this change they leave with it unchanged. Reviewed by: kp Fixes: b52b61c0 ("pf: distinguish forwarding and output cases for ...") MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D61033 --- sys/netinet6/ip6_fastfwd.c | 2 +- tests/sys/netpfil/pf/fragmentation_pass.sh | 55 ++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+), 1 deletion(-) diff --git a/sys/netinet6/ip6_fastfwd.c b/sys/netinet6/ip6_fastfwd.c index 8a288eb19891..f6d6df4c7b96 100644 --- a/sys/netinet6/ip6_fastfwd.c +++ b/sys/netinet6/ip6_fastfwd.c @@ -218,7 +218,7 @@ passin: /* * Outgoing packet firewall processing. */ - if (pfil_mbuf_out(V_inet6_pfil_head, &m, nh->nh_ifp, + if (pfil_mbuf_fwd(V_inet6_pfil_head, &m, nh->nh_ifp, NULL) != PFIL_PASS) goto dropout; diff --git a/tests/sys/netpfil/pf/fragmentation_pass.sh b/tests/sys/netpfil/pf/fragmentation_pass.sh index c749aac793ee..d5310d6eeb58 100644 --- a/tests/sys/netpfil/pf/fragmentation_pass.sh +++ b/tests/sys/netpfil/pf/fragmentation_pass.sh @@ -155,6 +155,60 @@ v6_cleanup() pft_cleanup } +# refrag_hlim REDIRECT: with net.inet6.ip6.redirect at REDIRECT on the router +# (0: ip6_tryforward(), 1: ip6_forward()), a forwarded packet that pf +# reassembles and refragments loses one hop: the echo reply comes back +# through alcatraz in fragments, with the hop limit singsing sent minus one. +refrag_hlim() +{ + jexec alcatraz sysctl net.inet6.ip6.redirect=$1 + atf_check -o match:"icmp_seq=0 hlim=63 " \ + ping -6 -c 1 -m 64 -s 4500 2001:db8:43::3 +} + +atf_test_case "v6_refrag_hlim" "cleanup" +v6_refrag_hlim_head() +{ + atf_set descr 'Refragmented forwarded IPv6 loses one hop' + atf_set require.user root +} + +v6_refrag_hlim_body() +{ + pft_init + + epair_send=$(vnet_mkepair) + epair_link=$(vnet_mkepair) + + vnet_mkjail alcatraz ${epair_send}b ${epair_link}a + vnet_mkjail singsing ${epair_link}b + + ifconfig ${epair_send}a inet6 2001:db8:42::1/64 no_dad up + + jexec alcatraz ifconfig ${epair_send}b inet6 2001:db8:42::2/64 no_dad up + jexec alcatraz ifconfig ${epair_link}a inet6 2001:db8:43::2/64 no_dad up + jexec alcatraz sysctl net.inet6.ip6.forwarding=1 + + jexec singsing ifconfig ${epair_link}b inet6 2001:db8:43::3/64 no_dad up + jexec singsing route add -6 2001:db8:42::/64 2001:db8:43::2 + route add -6 2001:db8:43::/64 2001:db8:42::2 + + jexec alcatraz pfctl -e + pft_set_rules alcatraz \ + "set reassemble yes" \ + "pass" + + atf_check -o ignore ping -6 -c 1 2001:db8:43::3 + + # The fast path: pf must refragment through ip6_forward(). + refrag_hlim 0 +} + +v6_refrag_hlim_cleanup() +{ + pft_cleanup +} + atf_test_case "v6_route_to" "cleanup" v6_route_to_head() { @@ -718,6 +772,7 @@ atf_init_test_cases() { atf_add_test_case "too_many_fragments" atf_add_test_case "v6" + atf_add_test_case "v6_refrag_hlim" atf_add_test_case "v6_route_to" atf_add_test_case "mtu_diff" atf_add_test_case "overreplace"