ipfw: fix parsing error in nat config port_range

Also fix the corresponding tests.

PR: 263240
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D57010

ipfw: fix IPv6 flow label matching

* do not require just only ip6 proto for flow-id opcode in ipfw(8).
ipv6-icmp, tcp, udp should be fine too.
* fix off-by-one bug leading to out-of-bounds read.
*

ipfw: fix IPv6 flow label matching

* do not require just only ip6 proto for flow-id opcode in ipfw(8).
ipv6-icmp, tcp, udp should be fine too.
* fix off-by-one bug leading to out-of-bounds read.
* apply IPV6_FLOWLABEL_MASK before comparison in flow6id_match(),
so flow-id opcode will match a specified flow label. No need to
take protocol version and traffic class into account.
* add the test to verify that opcode is working correctly.

Reviewed by: pouria
Obtained from: Yandex LLC
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D56869

show more ...

pfctl: relax interface name requirement

The FreeBSD network stack, for better or worse, does not impose any
requirements on interface names. As such it's valid for an interface
name to start with a

pfctl: relax interface name requirement

The FreeBSD network stack, for better or worse, does not impose any
requirements on interface names. As such it's valid for an interface
name to start with a number (or indeed, be something like '⭐').

Allow this in pfctl, and add a test case for the specific case of
interface names starting with a number.

Note that we don't support UTF-8 names fully, so those may still fail.

PR: 295064
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pfctl: optionally print the rule in the state overview

When dumping states optionally (at '-vv') also show the rule which
created the state. This can be helpful if the ruleset changed and we
want to

pfctl: optionally print the rule in the state overview

When dumping states optionally (at '-vv') also show the rule which
created the state. This can be helpful if the ruleset changed and we
want to know what rule created the state.

Sponsored by: Rubicon Communications, LLC ("Netgate")

show more ...

pf: do not reject rules with colliding hashes

We insert rules in pf_krule_global solely for the benefit of the
'keepcounters' feature. Failing to insert (beause the rule hash
collides, or an identic

pf: do not reject rules with colliding hashes

We insert rules in pf_krule_global solely for the benefit of the
'keepcounters' feature. Failing to insert (beause the rule hash
collides, or an identical rule already exists) would be worse than
restoring counts to the wrong rule (or failing to restore them at all).

PR: 282863, 294860, 294859, 294858
MFC after: 3 days
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D56745

show more ...

pf: improve SCTP validation

As per RFC5061 "4.2. New Parameter Types" the add/delete IP address
parameters (0xc001, 0xc002) may not be present in an INIT or INIT-ACK
chunk. They are only allowed to

pf: improve SCTP validation

As per RFC5061 "4.2. New Parameter Types" the add/delete IP address
parameters (0xc001, 0xc002) may not be present in an INIT or INIT-ACK
chunk. They are only allowed to be present in an ASCONF chunk.

This also prevents unbounded recursion while parsing an SCTP packet.

Approved by: so
Security: FreeBSD-SA-26:14.pf
Security: CVE-2026-7164
PR: 294799
Reported by: Igor Gabriel Sousa e Souza
Sponsored by: Orange Business Services

show more ...

tests/ipfw: Make tests run more reliably in parallel

- Don't use /dev/null as the pidfile for inetd, that doesn't work
properly. Create a pidfile in the per-test scratch directory.
- Use atf_chec

tests/ipfw: Make tests run more reliably in parallel

- Don't use /dev/null as the pidfile for inetd, that doesn't work
properly. Create a pidfile in the per-test scratch directory.
- Use atf_check to validate results from setup commands.

MFC after: 1 week

show more ...