src/sys/netgraph/ng_nat.c, branch main

ng_nat: fix potential crash when attaching to L2 directly

2025-08-26T04:34:45Z

Fix potential crash in the ng_nat module when attaching directly to the layer 2 (ethernet) while calculating TCP checksum. The issue is due to in_delayed_cksum() expecting to access IP header at the offset 0 from the mbuf start, while if we are attached to the L2 directly, the IP header at going to be at the certain offset. Reviewed by: markj, tuexen Approved by: tuexen Sponsored by: Sippy Software, Inc. Differential Revision: https://reviews.freebsd.org/D49677 MFC After: 2 weeks

netgraph: Enable support for EIM NAT

2024-12-06T09:31:58Z

Enable support for endpoint-independent mapping ("full cone NAT") via Libalias's UDP NAT. Reviewed by: igoro, thj Differential Revision: https://reviews.freebsd.org/D46689

netgraph: provide separate malloc type for nodes that are missing it

2024-05-31T16:19:54Z

The kernel option NG_SEPARATE_MALLOC helps to debug memory leaks in netgraph(4). Several nodes were missing the support.

netpfil: Use accessor functions and named constants for all tcphdr flags

2023-12-25T12:18:01Z

Update all remaining references to the struct tcphdr th_x2 field. This completes the compatibilty of various aspects with AccECN (TH_AE), after the internal ipfw "re-checksum required" was moved to use the TH_RES1 flag. No functional change. Reviewed By: tuexen, #transport, glebius Sponsored by: NetApp, Inc. Differential Revision: https://reviews.freebsd.org/D43172

sys: Remove $FreeBSD$: two-line .h pattern

2023-08-16T17:54:11Z

Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/

spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSD

2023-05-12T16:44:03Z

The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch up to that fact and revert to their recommended match of BSD-2-Clause. Discussed with: pfg MFC After: 3 days Sponsored by: Netflix

netgraph/ng_nat: Add RFC 6598/Carrier Grade NAT support

2021-01-24T19:38:35Z

This extends upon the RFC 6598 support to libalias/ipfw in r357092. Reviewed By: manpages (bcr), donner, adrian, kp Approved by: kp (mentor) MFC after: 1 month Differential Revision: https://reviews.freebsd.org/D23461

net: clean up empty lines in .c and .h files

2020-09-01T21:19:14Z

ng_nat: avoid panic if attached directly to ng_ether and got short packet

2020-02-12T00:31:00Z

From the beginning, ng_nat safely assumed cleansed traffic because of limited ways it could be attached to NETGRAPH: ng_ipfw or ng_ppp only. Now as it may be attached with ng_ether too, the assumption proven wrong. Add needed check to the ng_nat. Thanks for markj for debugging this. PR: 243096 Submitted by: Lutz Donnerhacke Reported by: Robert James Hernandez Reviewed by: markj and others MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D23091

ng_nat: Pass IPv6 packets through.

2020-01-23T16:45:48Z

ng_nat implements NAT for IPv4 traffic only. When connected to an ng_ether node it erroneously handled IPv6 packets as well. This change is not sufficient: ng_nat does not do any validation of IP packets in this mode, even though they have not yet passed through ip_input(). PR: 243096 Reported by: Robert James Hernandez Reviewed by: julian Differential Revision: https://reviews.freebsd.org/D23080