Page MenuHomeFreeBSD
Files F148972660

D53737.1789308412.diff
No OneTemporary
Actions

Size
3 KB
Referenced Files
None
Subscribers
None

D53737.1789308412.diff
View Options

diff --git a/sys/netpfil/pf/pf_lb.c b/sys/netpfil/pf/pf_lb.c
--- a/sys/netpfil/pf/pf_lb.c
+++ b/sys/netpfil/pf/pf_lb.c
@@ -301,9 +301,8 @@
bzero(&init_addr, sizeof(init_addr));
- if (udp_mapping) {
- MPASS(*udp_mapping == NULL);
- }
+ MPASS(udp_mapping == NULL ||
+ *udp_mapping == NULL);
/*
* If we are UDP and have an existing mapping we can get source port
@@ -354,16 +353,22 @@
if (pd->ndport == htons(ICMP_ECHO)) {
low = 1;
high = 65535;
- } else
+ } else {
+ MPASS(udp_mapping == NULL ||
+ *udp_mapping == NULL);
return (0); /* Don't try to modify non-echo ICMP */
+ }
}
#ifdef INET6
if (pd->proto == IPPROTO_ICMPV6) {
if (pd->ndport == htons(ICMP6_ECHO_REQUEST)) {
low = 1;
high = 65535;
- } else
+ } else {
+ MPASS(udp_mapping == NULL ||
+ *udp_mapping == NULL);
return (0); /* Don't try to modify non-echo ICMP */
+ }
}
#endif /* INET6 */
@@ -386,6 +391,8 @@
*/
if (pd->proto == IPPROTO_SCTP) {
key.port[sidx] = pd->nsport;
+ MPASS(udp_mapping == NULL ||
+ *udp_mapping == NULL);
if (!pf_find_state_all_exists(&key, dir)) {
*nport = pd->nsport;
return (0);
@@ -400,6 +407,8 @@
*/
key.port[sidx] = pd->nsport;
if (!pf_find_state_all_exists(&key, dir)) {
+ MPASS(udp_mapping == NULL ||
+ *udp_mapping == NULL);
*nport = pd->nsport;
return (0);
}
@@ -413,6 +422,8 @@
return (0);
}
} else {
+ MPASS(udp_mapping == NULL ||
+ *udp_mapping == NULL);
*nport = htons(low);
return (0);
}
@@ -440,6 +451,8 @@
key.port[sidx] = htons(tmp);
if (!pf_find_state_all_exists(&key, dir)) {
*nport = htons(tmp);
+ MPASS(udp_mapping == NULL ||
+ *udp_mapping == NULL);
return (0);
}
}
@@ -457,6 +470,8 @@
} else {
key.port[sidx] = htons(tmp);
if (!pf_find_state_all_exists(&key, dir)) {
+ MPASS(udp_mapping == NULL ||
+ *udp_mapping == NULL);
*nport = htons(tmp);
return (0);
}
@@ -473,13 +488,13 @@
*/
if (pf_map_addr_sn(pd->naf, r, &pd->nsaddr, naddr,
&(pd->naf), NULL, &init_addr, rpool, sn_type))
- return (1);
+ goto failed;
break;
case PF_POOL_NONE:
case PF_POOL_SRCHASH:
case PF_POOL_BITMASK:
default:
- return (1);
+ goto failed;
}
} while (! PF_AEQ(&init_addr, naddr, pd->naf) );
diff --git a/tests/sys/netpfil/pf/nat.sh b/tests/sys/netpfil/pf/nat.sh
--- a/tests/sys/netpfil/pf/nat.sh
+++ b/tests/sys/netpfil/pf/nat.sh
@@ -260,6 +260,35 @@
rm -f server2.out
}
+atf_test_case "endpoint_independent_exhaust" "cleanup"
+endpoint_independent_exhaust_head()
+{
+ atf_set descr 'Test that a client behind NAT gets the same external IP:port for different servers'
+ atf_set require.user root
+}
+
+endpoint_independent_exhaust_body()
+{
+ endpoint_independent_setup # Sets ${epair_…} variables
+
+ endpoint_independent_common \
+ "nat on ${epair_nat}a inet from ! (${epair_nat}a) to any -> (${epair_nat}a)" \
+ "nat on ${epair_nat}a inet from ! (${epair_nat}a) to any -> (${epair_nat}a) port 3000:3001 sticky-address endpoint-independent"
+
+ # Exhaust the available nat ports
+ for i in $(seq 1 10); do
+ echo "ping" | jexec client nc -u 198.51.100.32 1234 -w 0
+ echo "ping" | jexec client nc -u 198.51.100.22 1234 -w 0
+ done
+}
+
+endpoint_independent_exhaust_cleanup()
+{
+ pft_cleanup
+ rm -f server1.out
+ rm -f server2.out
+}
+
atf_test_case "endpoint_independent_pass" "cleanup"
endpoint_independent_pass_head()
{
@@ -900,6 +929,7 @@
atf_add_test_case "exhaust"
atf_add_test_case "nested_anchor"
atf_add_test_case "endpoint_independent_compat"
+ atf_add_test_case "endpoint_independent_exhaust"
atf_add_test_case "endpoint_independent_pass"
atf_add_test_case "nat6_nolinklocal"
atf_add_test_case "empty_table_source_hash"

File Metadata

Mime Type
text/plain
Expires
Sun, Sep 13, 2:06 PM (17 h, 20 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
29591399
Default Alt Text
D53737.1789308412.diff (3 KB)

Event Timeline