git: 7dedc3c21436 - main - pf: fix another endpoint-independent crash

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/commit/?id=7dedc3c21436bb5a1220f8901992d2772a163f78

commit 7dedc3c21436bb5a1220f8901992d2772a163f78
Author:     Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2025-11-21 09:03:36 +0000
Commit:     Kristof Provost <kp@FreeBSD.org>
CommitDate: 2025-11-21 15:23:46 +0000

    pf: fix another endpoint-independent crash
    
    In c12013f5bb38 we fixed udp_mapping cleanup issues in pf_get_sport(), but
    missed the static-port case (i.e. low == 0 && high == 0). We could still exit
    pf_get_sport() without either inserting the udp_mapping or freeing it.
    
    Address this and add a test case to provoke the problem.
    
    Reviewed by:    thj
    MFC after:      1 week
    Sponsored by:   Rubicon Communications, LLC ("Netgate")
    Differential Revision:  https://reviews.freebsd.org/D53856
---
 sys/netpfil/pf/pf_lb.c      | 16 ++++++++++++----
 tests/sys/netpfil/pf/nat.sh | 30 ++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/sys/netpfil/pf/pf_lb.c b/sys/netpfil/pf/pf_lb.c
index 3227d2906fb5..3510de3c6b3d 100644
--- a/sys/netpfil/pf/pf_lb.c
+++ b/sys/netpfil/pf/pf_lb.c
@@ -407,10 +407,18 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r, struct pf_addr *naddr,
 			 */
 			key.port[sidx] = pd->nsport;
 			if (!pf_find_state_all_exists(&key, dir)) {
-				MPASS(udp_mapping == NULL ||
-				    *udp_mapping == NULL);
-				*nport = pd->nsport;
-				return (0);
+				if (udp_mapping && *udp_mapping != NULL) {
+					(*udp_mapping)->endpoints[1].port = pd->nsport;
+					if (pf_udp_mapping_insert(*udp_mapping) == 0) {
+						*nport = pd->nsport;
+						return (0);
+					}
+				} else {
+					MPASS(udp_mapping == NULL ||
+					    *udp_mapping == NULL);
+					*nport = pd->nsport;
+					return (0);
+				}
 			}
 		} else if (low == high) {
 			key.port[sidx] = htons(low);
diff --git a/tests/sys/netpfil/pf/nat.sh b/tests/sys/netpfil/pf/nat.sh
index 788eacdc3369..3d953b495953 100644
--- a/tests/sys/netpfil/pf/nat.sh
+++ b/tests/sys/netpfil/pf/nat.sh
@@ -289,6 +289,35 @@ endpoint_independent_exhaust_cleanup()
 	rm -f server2.out
 }
 
+atf_test_case "endpoint_independent_static_port" "cleanup"
+endpoint_independent_static_port_head()
+{
+	atf_set descr 'Test that a client behind NAT gets the same external IP:port for different servers, with static-port'
+	atf_set require.user root
+}
+
+endpoint_independent_static_port_body()
+{
+	endpoint_independent_setup # Sets ${epair_…} variables
+
+	endpoint_independent_common \
+		"nat on ${epair_nat}a inet from ! (${epair_nat}a) to any -> (${epair_nat}a)" \
+		"nat on ${epair_nat}a inet from ! (${epair_nat}a) to any -> (${epair_nat}a) static-port sticky-address endpoint-independent"
+
+	# Exhaust the available nat ports
+	for i in $(seq 1 10); do
+		echo "ping" | jexec client nc -u 198.51.100.32 1234 -w 0
+		echo "ping" | jexec client nc -u 198.51.100.22 1234 -w 0
+	done
+}
+
+endpoint_independent_static_port_cleanup()
+{
+	pft_cleanup
+	rm -f server1.out
+	rm -f server2.out
+}
+
 atf_test_case "endpoint_independent_pass" "cleanup"
 endpoint_independent_pass_head()
 {
@@ -930,6 +959,7 @@ atf_init_test_cases()
 	atf_add_test_case "nested_anchor"
 	atf_add_test_case "endpoint_independent_compat"
 	atf_add_test_case "endpoint_independent_exhaust"
+	atf_add_test_case "endpoint_independent_static_port"
 	atf_add_test_case "endpoint_independent_pass"
 	atf_add_test_case "nat6_nolinklocal"
 	atf_add_test_case "empty_table_source_hash"