The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=225e85513fd7a5e31f649e35f0b99454bb725776
commit 225e85513fd7a5e31f649e35f0b99454bb725776 Author: Kristof Provost <[email protected]> AuthorDate: 2023-03-12 15:08:31 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2023-03-16 09:59:04 +0000 pf tests: test IPv6 fragmentation with link-local addresses We've observed a panic after pf_refragment6() with link-local addresses, because pf_refragment6() calls ip6_forward() even for a simple output case. That results in us entering ip6_forward() with an mbuf with a NULL m->m_pkthdr.rcvif, which can cause a NULL deref (but seemingly not for GUAs. Test sending fragmented link-local packets to pf. MFC after: 3 days Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D39063 --- tests/sys/netpfil/pf/fragmentation.sh | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tests/sys/netpfil/pf/fragmentation.sh b/tests/sys/netpfil/pf/fragmentation.sh index 03ba5030d8aa..554a9fdecc09 100644 --- a/tests/sys/netpfil/pf/fragmentation.sh +++ b/tests/sys/netpfil/pf/fragmentation.sh @@ -103,6 +103,10 @@ v6_body() jexec singsing ifconfig ${epair_link}b inet6 -ifdisabled ifconfig ${epair_send}a inet6 -ifdisabled + ifconfig ${epair_send}a + jexec alcatraz ifconfig ${epair_send}b + lladdr=$(jexec alcatraz ifconfig ${epair_send}b | awk '/ scopeid / { print($2); }' | cut -f 1 -d %) + jexec alcatraz pfctl -e pft_set_rules alcatraz \ "scrub fragment reassemble" \ @@ -120,6 +124,12 @@ v6_body() atf_check -s exit:0 -o ignore\ ping -6 -c 1 -b 70000 -s 65000 2001:db8:42::2 + # Force an NDP lookup + ping -6 -c 1 ${lladdr}%${epair_send}a + + atf_check -s exit:0 -o ignore\ + ping -6 -c 1 -b 70000 -s 65000 ${lladdr}%${epair_send}a + # Forwarding test atf_check -s exit:0 -o ignore \ ping -6 -c 1 2001:db8:43::3
