git: 221d978bccda - stable/15 - ipfw/nat64: Fix type confusion panic when using wrong NAT64 instance type

The branch stable/15 has been updated by kbowling:

URL: https://cgit.FreeBSD.org/src/commit/?id=221d978bccda79a0acf6425551b9ec3592e1b76e

commit 221d978bccda79a0acf6425551b9ec3592e1b76e
Author:     Teddy Engel <engel.teddy@gmail.com>
AuthorDate: 2026-06-02 16:24:57 +0000
Commit:     Kevin Bowling <kbowling@FreeBSD.org>
CommitDate: 2026-10-30 17:50:38 +0000

    ipfw/nat64: Fix type confusion panic when using wrong NAT64 instance type
    
    Add etlv type validation to ipfw_nat64clat() and ipfw_nat64stl() to
    verify that the retrieved instance is actually a nat64clat instance
    before use.
    
    All NAT64 instance types share the same srvstate[] array but have
    different struct layouts.
    Without type validation, using the wrong instance type with
    a handler causes type confusion and kernel panic.
    
    Signed-off-by:  Teddy Engel <engel.teddy@gmail.com>
    PR:             292023
    Reviewed by:    pouria
    Pull Request:   https://github.com/freebsd/freebsd-src/pull/2259
    
    (cherry picked from commit 2e6b22abf44d99b84abf17fe25ca2e8f89716c04)
---
 sys/netpfil/ipfw/nat64/nat64clat.c | 3 ++-
 sys/netpfil/ipfw/nat64/nat64stl.c  | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/sys/netpfil/ipfw/nat64/nat64clat.c b/sys/netpfil/ipfw/nat64/nat64clat.c
index d524652e9a99..4b88c0695813 100644
--- a/sys/netpfil/ipfw/nat64/nat64clat.c
+++ b/sys/netpfil/ipfw/nat64/nat64clat.c
@@ -214,7 +214,8 @@ ipfw_nat64clat(struct ip_fw_chain *chain, struct ip_fw_args *args,
 	if (cmd->opcode != O_EXTERNAL_ACTION ||
 	    insntod(cmd, kidx)->kidx != V_nat64clat_eid ||
 	    icmd->opcode != O_EXTERNAL_INSTANCE ||
-	    (cfg = NAT64_LOOKUP(chain, icmd)) == NULL)
+	    (cfg = NAT64_LOOKUP(chain, icmd)) == NULL ||
+	    cfg->no.etlv != IPFW_TLV_NAT64CLAT_NAME)
 		return (0);
 
 	switch (args->f_id.addr_type) {
diff --git a/sys/netpfil/ipfw/nat64/nat64stl.c b/sys/netpfil/ipfw/nat64/nat64stl.c
index ad1f2b3ec378..c188548549aa 100644
--- a/sys/netpfil/ipfw/nat64/nat64stl.c
+++ b/sys/netpfil/ipfw/nat64/nat64stl.c
@@ -217,7 +217,8 @@ ipfw_nat64stl(struct ip_fw_chain *chain, struct ip_fw_args *args,
 	if (cmd->opcode != O_EXTERNAL_ACTION ||
 	    insntod(cmd, kidx)->kidx != V_nat64stl_eid ||
 	    icmd->opcode != O_EXTERNAL_INSTANCE ||
-	    (cfg = NAT64_LOOKUP(chain, icmd)) == NULL)
+	    (cfg = NAT64_LOOKUP(chain, icmd)) == NULL ||
+	    cfg->no.etlv != IPFW_TLV_NAT64STL_NAME)
 		return (0);
 
 	switch (args->f_id.addr_type) {