From nobody Fri Oct 30 17:34:17 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jGSrp3q0zz6xFwL for ; Fri, 30 Oct 2026 17:34:18 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jGSrn6DcCz4Ynq for ; Fri, 30 Oct 2026 17:34:17 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793381657; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LO640uq2Uoc5Xyurq5gZ8whonQs8smItWOHSBzlyMkQ=; b=Vy3i2f7OFKs1XITdo1r6C1QuF82uuIqjpSNyXYduWex52N3NfLFHbzNgwgn6/zpX9fPtiA QIF9Fu21gEGdXPaQjBWZMQc5u2TuK6Ho27xWrlN1LTZ+WvtlCGBQBdpYVDRUkYY590C7fr Z8oLUtXR/ys/NGktByyr7kU6IJ5VrGQ7PcjBcS6FadKsp4HtmvYUrpp7q5WCbvvtOkFS15 8GC/rpQh0HDW2Yc01A5RjpCow3SpI1eFAfIp7cvcXJldefifVoqN8TUAEnXPmdbQG4IxXv 50+SqZ0V7PF5n0TOoaz/lvxqvOv0mmaqdLTA+ByBji/OU+ybGLfmoZjrnENN8w== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793381657; b=H0m8sm2P6I61RwoZKDac883DEmE2OEj1OxtcsOl4A+ouDJSwZeNaIuV53Nc4y5QVkTRp+3 6wwZ6RaSCGYAsGaIkvlkSycUD4U80OvxP79lSs9equYdMVjAxZXl+pzTWqoJ7GJiasUQ0Q bpNiKPJEeU/9aBK93itLLGKZHZGTHcFAPpS8jaSLnv1Mpy1A1KJz0ose36qMdF8DmgS9+s EzkmlKyYdpUhmytWGbo6eG3gPdHSnCPKDJRf2gXRMVrvicHUWSlaA9JNFl3+Tq4mgiuFSK EMGVLjoeLMlS5tK5QKzIw+TjT+o08ok82MkdmTHODpOKn2g6EE+zSJdBCU/9Ig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793381657; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=LO640uq2Uoc5Xyurq5gZ8whonQs8smItWOHSBzlyMkQ=; b=Bqlj9OvI5M2lyausiPAeaqZNltVdM0QJYC9fE7ub8P5g6/zriwlMEtsgFkm4uFtFf++VGg glsQvFF1550xpUHojrYXzcTFLyX57m1clDtaLLK055km6r7GglpYvdZ+26w3xZk//7s96u C/avHqTEYeCPwLb82OSU4rEXqgZ5HFNZilzZfUKUFS/f1GsXHCoJjtCiq5O4A9tdqAmKCp gcnZSmgLff6wn6d2NWFgaCoZqIr2uihyhwUVQ0EmCu/BpH/h6C+opAkgJZibWObJcWVVO/ OETIe/eMq+stxxgt7r+YgWbKOqgmljNbcS7akl6n/fOmcwyntvChhljHj1+5gg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jGSrn5rzJzdb4 for ; Fri, 30 Oct 2026 17:34:17 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3e467 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 30 Oct 2026 17:34:17 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: R. Christian McDonald Subject: git: cb007621bc72 - main - netinet6: Check the hop limit after pfil in ip6_tryforward() List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: rcm X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: cb007621bc729c346e59b3e5e7e4234f5578d3a0 Auto-Submitted: auto-generated Date: Fri, 30 Oct 2026 17:34:17 +0000 Message-Id: <6ae4d519.3e467.5fd3ec04@gitrepo.freebsd.org> The branch main has been updated by rcm: URL: https://cgit.FreeBSD.org/src/commit/?id=cb007621bc729c346e59b3e5e7e4234f5578d3a0 commit cb007621bc729c346e59b3e5e7e4234f5578d3a0 Author: R. Christian McDonald AuthorDate: 2026-10-30 17:32:37 +0000 Commit: R. Christian McDonald CommitDate: 2026-10-30 17:32:37 +0000 netinet6: Check the hop limit after pfil in ip6_tryforward() ip6_tryforward() sends time exceeded for an expiring packet before the inbound pfil hooks have seen it, whereas ip_tryforward() and ip6_forward(), which ip6_input() calls after the hooks, check it afterwards. On the fast path the router therefore answers packets the firewall blocks inbound, and pf never handles the expiry itself: a nat64 (af-to) packet with hop limit 1 gets a time exceeded error from the router, which a "block" ruleset then drops on the way out, instead of the one pf_translate_af() sends with the untranslated addresses. Check the hop limit after the inbound hooks. Reviewed by: kp Fixes: 5a1842a2 ("Add ip6_tryforward() - a run to completion ...") MFC after: 1 week Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D61034 --- sys/netinet6/ip6_fastfwd.c | 26 +++++++++++----------- tests/sys/netpfil/pf/forward.sh | 49 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 62 insertions(+), 13 deletions(-) diff --git a/sys/netinet6/ip6_fastfwd.c b/sys/netinet6/ip6_fastfwd.c index f6d6df4c7b96..4e60e18a8067 100644 --- a/sys/netinet6/ip6_fastfwd.c +++ b/sys/netinet6/ip6_fastfwd.c @@ -145,19 +145,6 @@ ip6_tryforward(struct mbuf *m) m->m_pkthdr.len); } - /* - * Hop limit. - */ -#ifdef IPSTEALTH - if (!V_ip6stealth) -#endif - if (ip6->ip6_hlim <= IPV6_HLIMDEC) { - icmp6_error(m, ICMP6_TIME_EXCEEDED, - ICMP6_TIME_EXCEED_TRANSIT, 0); - m = NULL; - goto dropin; - } - bzero(&dst, sizeof(dst)); dst.sin6_family = AF_INET6; dst.sin6_len = sizeof(dst); @@ -197,6 +184,19 @@ ip6_tryforward(struct mbuf *m) dst.sin6_addr = ip6->ip6_dst; } passin: + /* + * Hop limit, checked after the inbound hooks as on the other + * forwarding paths: a packet they drop gets no time exceeded error. + */ +#ifdef IPSTEALTH + if (!V_ip6stealth) +#endif + if (ip6->ip6_hlim <= IPV6_HLIMDEC) { + icmp6_error(m, ICMP6_TIME_EXCEEDED, + ICMP6_TIME_EXCEED_TRANSIT, 0); + m = NULL; + goto dropin; + } /* * Find route to destination. */ diff --git a/tests/sys/netpfil/pf/forward.sh b/tests/sys/netpfil/pf/forward.sh index e9539bc9d278..a01da5f62e7a 100644 --- a/tests/sys/netpfil/pf/forward.sh +++ b/tests/sys/netpfil/pf/forward.sh @@ -163,8 +163,57 @@ v6_cleanup() pft_cleanup } +atf_test_case "v6_hlim" "cleanup" +v6_hlim_head() +{ + atf_set descr 'Test that packets pf blocks get no time exceeded error' + atf_set require.user root +} + +v6_hlim_body() +{ + pft_init + + epair_send=$(vnet_mkepair) + epair_recv=$(vnet_mkepair) + + ifconfig ${epair_send}a inet6 2001:db8:42::1/64 up no_dad -ifdisabled + ifconfig ${epair_recv}a up + + vnet_mkjail alcatraz ${epair_send}b ${epair_recv}b + + jexec alcatraz ifconfig ${epair_send}b inet6 2001:db8:42::2/64 up no_dad + jexec alcatraz ifconfig ${epair_recv}b inet6 2001:db8:43::2/64 up no_dad + jexec alcatraz sysctl net.inet6.ip6.forwarding=1 + jexec alcatraz ndp -s 2001:db8:43::3 00:01:02:03:04:05 + route add -6 2001:db8:43::/64 2001:db8:42::2 + + jexec alcatraz pfctl -e + pft_set_rules alcatraz \ + "block in inet6 proto icmp6 icmp6-type echoreq" + + for redirect in 0 1; do + jexec alcatraz sysctl net.inet6.ip6.redirect=${redirect} + atf_check -s exit:2 -o ignore \ + ping -6 -c 1 -m 1 -W 1 2001:db8:43::3 + atf_check -o match:"[[:space:]]0 time exceed transit" \ + jexec alcatraz netstat -s -p icmp6 + done + + pft_set_rules alcatraz "pass" + atf_check -s exit:2 -o ignore ping -6 -c 1 -m 1 -W 1 2001:db8:43::3 + atf_check -o match:"[[:space:]]1 time exceed transit" \ + jexec alcatraz netstat -s -p icmp6 +} + +v6_hlim_cleanup() +{ + pft_cleanup +} + atf_init_test_cases() { atf_add_test_case "v4" atf_add_test_case "v6" + atf_add_test_case "v6_hlim" }