FreeBSD/src
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2026-06-02 11:24:32 +00:00
Code Issues Projects Releases Wiki Activity

nat64lsn: Fix type confusion panic when using wrong NAT64 instance type

Browse Source 
When an ipfw rule references a NAT64 instance by name using
'nat64lsn', the kernel looks up the instance in the shared
srvstate[] array without verifying the instance type.
If the named instance is actually a nat64clat or nat64stl
instance (created with 'nat64clat' or 'nat64stl'), the code
incorrectly casts the instance to nat64lsn_instance and
dereferences the ->cfg pointer, which causes a kernel panic.

The root cause is that all NAT64 instance types share the same
srvstate[] array but have different struct layouts.
For nat64lsn_instance, the field after 'no' is a pointer to nat64lsn_cfg.
For nat64clat_cfg, the same offset contains an embedded nat64_config struct.

Fix by adding a type check after NAT64_LOOKUP() to verify that the
instance's etlv matches IPFW_TLV_NAT64LSN_NAME before proceeding.
If the type doesn't match, return IP_FW_DENY to reject the packet
safely rather than crashing.

Signed-off-by:	Teddy Engel <engel.teddy@gmail.com>
PR:		292023
Reported by:	pouria
Reviewed by:	ae
Pull-Request:	https://github.com/freebsd/freebsd-src/pull/2249
This commit is contained in:
Teddy Engel
2026-06-01 17:42:56 +01:00
committed by Pouria Mousavizadeh Tehrani
parent 1cef7e9eb0
commit ea4888e63f
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sys/netpfil/ipfw/nat64/nat64lsn.c
+2 -1
View File
@@ -1731,7 +1731,8 @@ ipfw_nat64lsn(struct ip_fw_chain *ch, struct ip_fw_args *args,
if (cmd->opcode != O_EXTERNAL_ACTION ||
insntod(cmd, kidx)->kidx != V_nat64lsn_eid ||
icmd->opcode != O_EXTERNAL_INSTANCE ||
(i = NAT64_LOOKUP(ch, icmd)) == NULL)
(i = NAT64_LOOKUP(ch, icmd)) == NULL ||
i->no.etlv != IPFW_TLV_NAT64LSN_NAME)
return (IP_FW_DENY);
*done = 1; /* terminate the search */