"LDFLAGS= -lutil" dropped LDFLAGS from make.conf for every test in the
directory.
Approved by: glebius
Fixes: c3ac06161d ("nmount: Introduce the "check_fsid" option")
Sponsored by: Netflix
This fixes the flaky testcase in CI[0].
While here:
* fix a typo in a comment
* remove an unnecessary import
* fix this deprecation warning:
/usr/local/lib/python3.12/site-packages/scapy/contrib/igmp.py:12:
DeprecationWarning: scapy.contrib.igmp is deprecated. Please use
scapy.layers.igmp instead !
[0] https://ci.freebsd.org/job/FreeBSD-main-amd64-test/29813/testReport/junit/sys.netpfil.pf.igmp/py/TestIGMP__test_ip_opts/
Reviewed by: kp
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
While here, remove two munmap(2) calls on mappings the tests require to
have failed, since they are practically dead.
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60800
libpfctl sends a table definition in chunks of 256 addresses, each as
its own PFNL_CMD_INA_DEFINE. The kernel treated every chunk as a new
definition and replaced the shadow table, so only the last chunk
survived.
Mark the chunks after the first with PF_ID_APPEND and have the kernel
add them to the shadow table in progress. A request without the
attribute still replaces the shadow; one with it and no definition in
progress fails with EINVAL. Old kernels ignore the attribute, so both
halves are needed; the ioctl sends all addresses at once and is not
affected. Mask the flags userland passes to PFR_FLAG_ALLMASK, as
PFR_FLAG_APPEND is kernel-internal.
Add a test that defines a table of 1,000 addresses, also in an anchor.
Reviewed by: kp
Fixes: 219ce30638 ("pf: convert DIOCRINADEFINE to netlink")
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60876
pfr_remove_kentry() returns without removing an entry whose mark is
set. The mark is scratch space for the operations that handle a list
of addresses: each resets it before use and leaves it set on the
entries it kept, so after "pfctl -T replace" or "pfctl -T zero" of an
address the entry stays marked. An address a source limiter put in
its table is then never taken out again when the source falls below
the low-water mark.
Remove the entry whether it is marked or not; nothing else is in the
work queue.
Add a regression test.
Reviewed by: kp
Fixes: 4616481212 ("pf: introduce source and state limiters")
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60530
This is the program that found the races fixed in 1f1043d550. One
thread keeps a pattern in f14-f31 across a signal, while helpers pinned
to the same CPU keep different patterns in the real registers and get
woken up from another CPU to preempt it at random points. If the kernel
ever hands it somebody else's registers, the pattern doesn't match.
The register loads, the thr_kill() and the handshake with the helper are
in assembly so that nothing touches the FP registers between sigreturn
and the check. It runs for ten seconds and is skipped with fewer than
two CPUs.
Requested by: adrian
Approved by: jhibbits
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60411
* ggatel: fix piped output. Flush stdout before daemonizing, so the
output can be read when it's in a command pipeline.
* ggated: bind the port _before_ daemonizing, so an invoking script can
be sure that the port is bound as soon as the command returns.
* tests: allow ggatec or ggatel to automatically allocate a device
number instead of choosing one in a racy way.
With all of these changes I can no run the tests 1000 times without
fail. And in parallel, too.
MFC after: 1 week
Sponsored by: ConnectWise
PR: 298942
Reported by: siva
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D60707
sndbuf_resize() and sndbuf_remalloc() drop the channel lock in order to
allocate the new buffer(s) with M_WAITOK. Before doing that they verify
that the buffer is not mapped, but this could change while the lock is
dropped, as there is no higher-level synchronization which prevents
buffer resize (e.g., via the SNDCTL_DSP_SETBLKSIZE ioctl) from happening
concurrently with mmap. Thus, these checks are insufficient.
Modify sndbuf_resize() and sndbuf_remalloc() to revalidate after
reacquiring the lock. Extend them to check for a couple of channel
flags, mirroring the check in chn_resizebuf(). Modify chn_resizebuf()
to revalidate state after reacquiring the channel lock.
We could also allocate new buffers with M_NOWAIT and so avoid dropping
the lock. Then, I think we could go even further and invoke
CHANNEL_SETBLOCKSIZE and CHANNEL_SETFRAGMENTS with the channel lock
held. But really it would be better to ensure that dsp operations are
serialized; there is no reason for mmap and chn_resizebuf() to be able
to run in parallel, we should not be relying on the channel lock for
this. So, let's keep a more minimal approach here.
Add a simple regression test.
Approved by: so
Security: FreeBSD-SA-26:71.sound
Security: CVE-2026-101308
Reviewed by: christos
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60554
Cover the interface identifier selection in in6_ifadd(): a /64
link-local address provides the identifier, while a /128 link-local
address or no link-local address at all yields the EUI-64 identifier
derived from the MAC address. Each case asserts the exact
autoconfigured address. ndp_prefix_len_mismatch reaches the same
fallback with a /127 link-local address, but only checks that some
address was configured.
Stable addresses (RFC 7217) are the default and bypass both paths, so
the host disables them. The advertisement goes to all nodes, and an
interface only joins that group with its first address, so the case
without a link-local address gives the host a static address from
another prefix.
ra.py now takes the Ethernet source address from --sendif rather than
from a route lookup; for ff02::1 that lookup fails in scapy 2.7.0.
Reviewed by: pouria
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60520
pf_hash_pool() hashes the first address of a pool as a whole struct
pf_addr_wrap, including the union that holds the kernel's pfi_dynaddr
or pfr_ktable pointer.
An interface pool such as "-> ($ext_if)" gets a new pfi_dynaddr on
every load, so with "set keepcounters" the rule never matches its
predecessor and loses its counters on every reload. The pointers also
differ between hosts: once a filter rule in the main ruleset has an
interface or table pool, pfsync peers disagree on the ruleset checksum
and bind every synced state to the default rule.
Hash the address with that union cleared. The rest of the address,
including the prefix length of an interface address, is hashed as
before, and the hash of a rule with a plain address pool does not
change.
Reviewed by: kp
Fixes: c6bcf6e6fd ("pf: include all elements when hashing rules")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60370
When an ICMPv6 query or reply matches a translated state,
pf_test_state_icmp() copies the state's virtual id into icmp6_id. Only
echo messages have an identifier there. For all other types the
virtual id is 0 and those two bytes hold something else; in a neighbour
advertisement they hold the R, S and O flags. The checksum was not
updated either, so icmp6_input() dropped the advertisement as a bad
checksum.
Unicast NUD probes to a link-local neighbour, such as the default
router, are sent from the link-local address. With a nat rule that
matches it (e.g. "from any"), every advertisement answering a probe was
dropped: NUD failed, the neighbour cache entry was deleted, and traffic
to the neighbour stalled until it was resolved again.
Only rewrite the id of echo messages, as the ICMPv6 error path already
does, and update the checksum, as the IPv4 path does.
Add a regression test.
Reviewed by: kp
Fixes: f1ddd7f1da ("pf: add forgotten fixup for icmp6 id's when translating")
See also: https://redmine.pfsense.org/issues/16236
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60542
Ensure we stop evaluating nat rules if we find a match in a nat-anchor.
PR: 299320
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
ndp_prefix_len_mismatch exercises the fallback in in6_ifadd() for an
interface whose link-local address does not have the advertised prefix
length (9e792f7ef7). Since a2eb0894b7 made stable addresses
(RFC 7217) the default, in6_ifadd() takes the interface identifier from
in6_get_stableifid() and never looks at the link-local address, so the
case passes without reaching the fallback. Turn stable addresses off
on the interface.
Sponsored by: Rubicon Communications, LLC ("Netgate")
Check that once fsync(2), fdatasync(2), or a write(2) with O_SYNC or
O_DSYNC returns, the new data, the file size and every block pointer
leading to the data are on disk. The cases append a block, fill a hole,
append the first block that needs an indirect block and append below an
existing indirect block. Two more append after another write left a
new direct block unsynced, which with soft updates cuts the size and the
later pointers of an inode written meanwhile. With O_SYNC and O_DSYNC
on soft updates, those also check that the open already made the
unsynced block durable.
Each case runs on UFS without soft updates, with soft updates and with
SU+J.
The file systems live on md(4) and the checks read the inode, the
indirect block and the data block straight from the device with libufs
right after the synchronous call returns. There is no cache in front
of the disk device, so this shows what would survive a crash at that
moment without having to crash anything.
Sponsored by: Sippy Software, Inc.
Reviewed by: pho
Tested by: pho
Differential Revision: https://reviews.freebsd.org/D60134
MFC after: 1 month
pf_source_used() puts a source in the table of its source limiter when
the source has more states than the high-water mark, and
pf_source_rele() takes it out again below the low-water mark. Both
changed the table in place: pf_source_used() from pf_create_state(),
with the rules lock held for reading, and pf_source_rele() from
pf_remove_state(), with no rules lock at all. A table may only be
changed with the rules lock held for writing, as packets look addresses
up in its radix tree at the same time. With INVARIANTS the first
insertion panics ("Lock pf rulesets not exclusively locked" in
pfr_route_kentry()); without, the tree can be corrupted.
Queue the changes instead, as pf_overload_task() does for overload
tables, and make them from a task with the rules lock held for writing.
An entry names the limiter by its id and remembers its table: the
limiter, or its table, may be gone or replaced by the time the task
runs, and then the entry is dropped. pfsr_intable changes only once
the change is queued, so a failed allocation is retried the next time
the source crosses a mark; a removal is also retried when the source is
purged. Drain the task when a vnet goes away, after its last state.
Add a regression test.
Reviewed by: kp
Fixes: 4616481212 ("pf: introduce source and state limiters")
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60526
When a message outgrows the writer's buffer, _nlmsg_refill_buffer()
allocates a larger one and moves the unfinished message there. The new
buffer was sized for the data about to be added alone, so with enough of
the message already written the caller wrote past its end and left it
with datalen > buflen. A 20-byte message plus an attribute of 8176
bytes got a buffer of 8192 bytes for 8200 bytes of data, and reading it
panicked an INVARIANTS kernel in nl_soreceive().
Size the new buffer for both, and add a ktest for it.
Reviewed by: glebius
Fixes: 7e5bf68495 ("netlink: add netlink support")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60541
In principle, inotify can be used to leak timing information about I/O
device accesses by privileged process, which might be sensitive, e.g.,
in the case of /dev/input. See https://inoti.fyi/#1-linux-inter-keystroke-timing
In practice this does not work since I/O to devfs nodes does not go
through vnodes, so the INOTIFY() calls in various VOP hooks do not fire.
But, let's explicitly define a no-op VOP_INOTIFY to help ensure that no
one tries to "fix" this bug.
Alternately we could simply ignore VCHR/VBLK vnodes in vn_inotify().
However, maybe someday it'll be desirable to enable inotify for specific
device files, in which case the filtering should live in devfs.
Add a regression test.
Reported by: Sudheendra Raghav Neela <[email protected]>
Reviewed by: kib
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D60364
The test pinged an unanswered address and then deleted the resulting
INCOMPLETE neighbor entry.
The kernel frees that entry after about 3s, so on a loaded VM,
ndp -d could run too late and fail with ENOENT.
Configure 2001:db8::2 on epair0b so the ping gets a reply and the
entry becomes REACHABLE.
Approved by: pouria
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D60348
linux and linux64 are file names, not module names. The corresponding
module names are linuxelf and linux64elf, respectively, so these tests
were always being skipped.
Fixes: b98d169d1f ("tests/sys/vfs: add ABI-root absolute symlink tests")
Sponsored by: The FreeBSD Foundation
The PFNL_CMD_TABLE_TEST_ADDRS reply carries only the match count, so
the per-address feedback from pfr_tst_addrs() is lost:
"pfctl -v -T test" lists nothing and "pfctl -vv -T test" reports
every address as "nomatch".
Return each address, as updated by pfr_tst_addrs(), in a nested
PF_TAS_ADDR attribute, and decode them into the caller's array in
libpfctl. PF_TA_ADDR is not reused: it shares its value with
PF_TAS_ASTATS, which older libpfctl would decode into an
uninitialised target. That target was also read when no reply was
parsed, so the match count could be garbage; initialise it.
Add a regression test.
Reviewed by: kp
Approved by: kp (mentor)
Fixes: 281282e935 ("pf: convert DIOCRTSTADDRS to netlink")
See also: https://redmine.pfsense.org/issues/17135
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60146
The chunked table address functions (set, add, del, clr_astats) add
each chunk's result to the caller's counter without initialising it.
pfctl reuses nadd for the number of tables created, so a replace that
also creates the table is off by one:
pfctl -t foo -T replace 192.0.2.1
reports "2 addresses added".
Zero the counters first, as pfctl_test_addrs() already does. Remove
the workaround for the add case from pfctl (da64f6e047), which is
no longer needed.
Add a regression test.
Reviewed by: kp
Approved by: kp (mentor)
Fixes: 08ed87a4a2 ("pf: convert DIOCRSETADDRS to netlink")
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60174
geom_subr.sh serves both legacy TAP tests and ATF tests. It defaults to the
TAP path, so ATF tests must set ATF_TEST=true before sourcing it.
Sponsored by: Netflix
The netlink encoding of struct pfr_addr omits pfra_fback, so no
per-address feedback reaches userspace. In particular,
pfr_get_astats() marks entries of tables without counters with
PFR_FB_NOCOUNT, which pfctl uses to skip their counters, so
"pfctl -v -T show" prints zero counters for such tables.
Add PFR_A_FBACK, emit it from the kernel and decode it in libpfctl.
Add a regression test.
Reviewed by: kp
Approved by: kp (mentor)
Fixes: 08f54dfca1 ("pf: convert DIOCRGETASTATS to netlink")
Sponsored by: Rubicon Communications, LLC ("Netgate")
When an fdescfs mount has the nodup option set, fdesc_lookup(/dev/fd/n)
returns the vnode referenced by file descriptor n, rather than returning
an fdescfs vnode. This meant that fd metadata attached to fd n was not
preserved when reopening the file, which is contrary to the expected
semantics for capsicum rights and the UF_RESOLVE_BENEATH fd flag. For
regular fdescfs mounts, this metadata is copied via dupfdopen().
Fix the problem by passing up this metadata through the nameidata
structure. Thus, if one opens /dev/fd/n, the returned fd will inherit
UF_RESOLVE_BENEATH and the capability rights of fd n. Add some
regression tests as well.
Approved by: so
Security: FreeBSD-SA-26:66.jail
Security: CVE-2026-101304
Reported by: Jan Bramkamp
Reviewed by: kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59886
pfr_clr_astats() looks up each address it is given and inserts the entry
it finds at the head of a work queue. If the same address is given more
than once, the entry is inserted twice and the second insertion makes it
its own successor. pfr_clstats_kentries() then walks the queue forever,
with the rules lock held for writing, so packet processing and every
other pf operation in that vnet stop as well. To reproduce:
pfctl -e
pfctl -t foo -T add 192.0.2.1
pfctl -t foo -T zero 192.0.2.1 192.0.2.1
Do as pfr_del_addrs() does: clear pfrke_mark on the entries named, then
queue an entry only the first time it is seen. An address given more
than once is cleared, and counted, once. Validate all addresses before
any entry is touched.
Add a regression test.
Reviewed by: kp
Approved by: kp (mentor)
MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D60103
Since DIOCRSETADDRS was converted to netlink, pf_handle_table_set_addrs()
calls pfr_set_addrs() with a NULL size2, as the netlink interface has no
buffer to return the deleted addresses in. pfr_set_addrs() only checked
size2 for NULL at the end of the function; with PFR_FLAG_FEEDBACK set it
dereferenced it unconditionally first. pfctl sets PFR_FLAG_FEEDBACK
when run with -v, so "pfctl -v -t foo -T replace ..." panicked the
kernel with a NULL pointer dereference. To reproduce:
pfctl -e
pfctl -t foo -T add 192.0.2.1
pfctl -v -t foo -T replace 192.0.2.2
Check size2 for NULL before dereferencing it, as is already done at the
end of the function. The per-address feedback for added and changed
addresses is still copied back as before; only the list of deleted
addresses, which the netlink caller has no room for, is skipped.
While here, compare size2 against NULL explicitly in the second check as
well, per style(9).
Add a regression test.
Approved by: kp (mentor)
Fixes: 08ed87a4a2 ("pf: convert DIOCRSETADDRS to netlink")
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D60096
Pin the overlay namei(9) uses for Linux ABI processes: a target under
the ABI root wins (PR 289739), a native-only target should retry from
the native root (PR 297426), an ENOENT past a resolved ABI target is
not retried, and the plain no-symlink native fallback is unchanged.
Skip without a Linux userland so CI stays green. The two native-only
cases use atf_expect_fail until the retry lands.
PR: 297426
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D59990
unix_connectat's fdescfs cases call mount_fdescfs(), which skipped on ENODEV.
nmount(2) never returns ENODEV: vfs_donmount() remaps the ENODEV from a failed
fdescfs module load to EINVAL with errmsg "Invalid fstype", so the skip never
fired and the cases failed on kernels without fdescfs.
Approved by: ngie, asomers
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D59227
If a daemon never responds to FUSE_INIT, but some process attempts to
access the mountpoint, and a different process (possibly the daemon
itself) attempts to unmount, a deadlock would result.
Fix this bug by blocking any thread that enters fuse_vfsop_root until
the daemon responds to FUSE_INIT or it times out. That will block any
thread attempting to lookup a path in the fuse mountpoint, before it
even gets to fuse VOPs. Remove less thorough initialization checks in
fuse_ticket_fetch and fuse_vnop_access that are no longer necessary.
And add a test case.
PR: 287431
MFC after: 2 weeks
Sponsored by: ConnectWise
Reviewed by: js
Differential Revision: https://reviews.freebsd.org/D59737
If the entire plaintext is zero-filled, the backwards walk in
tls13_find_record_type() would return the offset of the last byte of the
TLS header. This causes an underflow when decrypting, resulting in a
null pointer dereference.
Fix the bug and add a regression test.
Reviewed by: gallatin, jhb
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59767
Test that ipfw's layer-2 hook copes with unmapped mbufs, on the pass
and on the deny path.
Reviewed by: glebius
Assisted-by: Claude Code (Fable 5, Opus 5)
Differential Revision: https://reviews.freebsd.org/D59390
This avoids globally set timeouts for the group of
tarfs_large tests on slower emulated architectures.
While here, lower each testcase's timeout to reflect
the reduction of work. On QEMU aarch64, the largest case
runs in ~500s on a modern desktop, so double that for a
conservative estimate.
Discussed with: des
MFC after: 3 days
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D59033
When one pfsync host clears states it informs its peers about this.
While processing such messages, in pfsync_in_clr() we failed to take the
interface name into account.
This meant that if one host cleared states on one interface the peers
would clear all states, not just those on the affected interface.
Actually check for the interface in pfsync_in_clr()
Sponsored by: Rubicon Communications, LLC ("Netgate")
The script was passing the wrong device name to `graid3 insert` and
didn't notice that the command was failing.
MFC after: 1 week
Event: EuroBSDcon 2026 DevSummit
Reviewed by: delphij
Differential Revision: https://reviews.freebsd.org/D59564
Linux resolves a path below /proc/self/fd/N in the directory the
descriptor names, and linprocfs makes /proc/<pid>/fd a symlink to
/dev/fd. Under linrdlnk the fdescfs node carries only VV_READLINK,
which namei will not walk through, so such a path fails with ENOTDIR.
Return the underlying vnode from fdesc_lookup for a non-final component,
or a trailing slash, reusing the machinery the nodup option already
uses. The last component is untouched, so open("/dev/fd/N") keeps its
dup(2) semantic; a descriptor with no vnode behind it, such as a pipe,
yields ENOTDIR.
Add ATF coverage for traversal, descriptor reuse, and preservation of
last-component and mount-option semantics.
Approved by: adrian (mentor)
Reviewed by: kib, adrian
Differential Revision: https://reviews.freebsd.org/D59393
Signed-off-by: Nick Price <[email protected]>
PF-administered priority need not impose an access VLAN. Permit the
existing VLAN PCP attribute in either access or trunk mode, while
keeping VLAN identifier and protocol access only.
Display trunk PCP in ifconfig and document the broader meaning in the
kernel snapshot, libifconfig, and rtnetlink contracts. This changes no
attribute numbers, wire encoding, or structure layout.
Reported by: kib
Sponsored by: BBOX.io
As per RFC 3590 MLD Report and Done messages are permitted to use the
unspecified address as a source address (e.g. during duplicate address
detection for the first IPv6 address). Allow this, but only this.
Reported by: Alexander Leidinger <[email protected]>
Reviewed by: bms
See also: OpenBSD, sashan <[email protected]>, 60036e8507
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D59334
Add a transport neutral kernel snapshot for NIC-specific SR-IOV VF
status and an optional iflib provider method. Providers gather state
under driver defined synchronization.
Honor RTEXT_FILTER_VF on RTM_GETLINK requests and encode the status as
native typed route Netlink attributes. Represent VFs, driver
namespaces, and namespace fields as directly repeated nested attributes.
Presence masks in consumers can distinguish omission from false or zero.
Drivers may add custom status under stable, versioned namespaces. The
named, typed representation lets generic transports and consumers carry
or display fields without knowing their driver-specific schemas, while
the driver retains ownership of their names and meanings.
Document the ABI and add parser and RTM_GETLINK coverage.
Reviewed by: melifaro, iflib (gallatin), kgalazka (previous version)
Sponsored by: BBOX.io
Differential Revision: https://reviews.freebsd.org/D58776
Olivier Cochard