Author: cy
Date: Sun Aug 19 13:45:03 2018
New Revision: 338047
URL: https://svnweb.freebsd.org/changeset/base/338047
Log:
The bucket index is subtracted by one at lines 2304 and 2314. When 0 it
becomes -1, except these are unsigned integers, so they become very large
numbers. Thus are always larger than the maximum bucket; the hash table
insertion fails causing NAT to fail.
This commit ensures that if the index is already zero it is not reduced
prior to insertion into the hash table.
PR: 208566
Modified:
head/sys/contrib/ipfilter/netinet/ip_nat.c
Modified: head/sys/contrib/ipfilter/netinet/ip_nat.c
==============================================================================
--- head/sys/contrib/ipfilter/netinet/ip_nat.c Sun Aug 19 13:44:59 2018
(r338046)
+++ head/sys/contrib/ipfilter/netinet/ip_nat.c Sun Aug 19 13:45:03 2018
(r338047)
@@ -2304,14 +2304,16 @@ ipf_nat_delete(softc, nat, logtype)
bkt = nat->nat_hv[0] % softn->ipf_nat_table_sz;
nss = &softn->ipf_nat_stats.ns_side[0];
- nss->ns_bucketlen[bkt]--;
+ if (nss->ns_bucketlen[bkt] > 0)
+ nss->ns_bucketlen[bkt]--;
if (nss->ns_bucketlen[bkt] == 0) {
nss->ns_inuse--;
}
bkt = nat->nat_hv[1] % softn->ipf_nat_table_sz;
nss = &softn->ipf_nat_stats.ns_side[1];
- nss->ns_bucketlen[bkt]--;
+ if (nss->ns_bucketlen[bkt] > 0)
+ nss->ns_bucketlen[bkt]--;
if (nss->ns_bucketlen[bkt] == 0) {
nss->ns_inuse--;
}
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
