pf: fix udp_mapping cleanup

If we fail to obtain a new source port (pf_get_sport()) while we've
created a udp_mapping (for 'endpoint independent nat') we must free the
udp_mapping in pf_get_sport(). Otherwise the calling function will call
pf_udp_mapping_release(). This will then attempt to remove the udp_mapping from
a list it's not in, and crash.

Actually free the udp_mapping in all failure cases. While here sprinkle in a few
more assertions to ensure we don't forget leak udp_mappings and add a test case
to provoke this problem.

Reviewed by:	thj
MFC after:	1 week
See also:	https://redmine.pfsense.org/issues/16517
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D53737

2 files changed, 52 insertions, 7 deletions

diff --git a/sys/netpfil/pf/pf_lb.c b/sys/netpfil/pf/pf_lb.c
index 7aeb8266ca8c..3227d2906fb5 100644
--- a/sys/netpfil/pf/pf_lb.c
+++ b/sys/netpfil/pf/pf_lb.c
@@ -301,9 +301,8 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r, struct pf_addr *naddr,
 
 	bzero(&init_addr, sizeof(init_addr));
 
-	if (udp_mapping) {
-		MPASS(*udp_mapping == NULL);
-	}
+	MPASS(udp_mapping == NULL ||
+	    *udp_mapping == NULL);
 
 	/*
 	 * If we are UDP and have an existing mapping we can get source port
@@ -354,16 +353,22 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r, struct pf_addr *naddr,
 		if (pd->ndport == htons(ICMP_ECHO)) {
 			low = 1;
 			high = 65535;
-		} else
+		} else {
+			MPASS(udp_mapping == NULL ||
+			    *udp_mapping == NULL);
 			return (0);	/* Don't try to modify non-echo ICMP */
+		}
 	}
 #ifdef INET6
 	if (pd->proto == IPPROTO_ICMPV6) {
 		if (pd->ndport == htons(ICMP6_ECHO_REQUEST)) {
 			low = 1;
 			high = 65535;
-		} else
+		} else {
+			MPASS(udp_mapping == NULL ||
+			    *udp_mapping == NULL);
 			return (0);	/* Don't try to modify non-echo ICMP */
+		}
 	}
 #endif /* INET6 */
 
@@ -386,6 +391,8 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r, struct pf_addr *naddr,
 		 */
 		if (pd->proto == IPPROTO_SCTP) {
 			key.port[sidx] = pd->nsport;
+			MPASS(udp_mapping == NULL ||
+			    *udp_mapping == NULL);
 			if (!pf_find_state_all_exists(&key, dir)) {
 				*nport = pd->nsport;
 				return (0);
@@ -400,6 +407,8 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r, struct pf_addr *naddr,
 			 */
 			key.port[sidx] = pd->nsport;
 			if (!pf_find_state_all_exists(&key, dir)) {
+				MPASS(udp_mapping == NULL ||
+				    *udp_mapping == NULL);
 				*nport = pd->nsport;
 				return (0);
 			}
@@ -413,6 +422,8 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r, struct pf_addr *naddr,
 						return (0);
 					}
 				} else {
+					MPASS(udp_mapping == NULL ||
+					    *udp_mapping == NULL);
 					*nport = htons(low);
 					return (0);
 				}
@@ -440,6 +451,8 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r, struct pf_addr *naddr,
 					key.port[sidx] = htons(tmp);
 					if (!pf_find_state_all_exists(&key, dir)) {
 						*nport = htons(tmp);
+						MPASS(udp_mapping == NULL ||
+						    *udp_mapping == NULL);
 						return (0);
 					}
 				}
@@ -457,6 +470,8 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r, struct pf_addr *naddr,
 				} else {
 					key.port[sidx] = htons(tmp);
 					if (!pf_find_state_all_exists(&key, dir)) {
+						MPASS(udp_mapping == NULL ||
+						    *udp_mapping == NULL);
 						*nport = htons(tmp);
 						return (0);
 					}
@@ -473,13 +488,13 @@ pf_get_sport(struct pf_pdesc *pd, struct pf_krule *r, struct pf_addr *naddr,
 			 */
 			if (pf_map_addr_sn(pd->naf, r, &pd->nsaddr, naddr,
 			    &(pd->naf), NULL, &init_addr, rpool, sn_type))
-				return (1);
+				goto failed;
 			break;
 		case PF_POOL_NONE:
 		case PF_POOL_SRCHASH:
 		case PF_POOL_BITMASK:
 		default:
-			return (1);
+			goto failed;
 		}
 	} while (! PF_AEQ(&init_addr, naddr, pd->naf) );
 
diff --git a/tests/sys/netpfil/pf/nat.sh b/tests/sys/netpfil/pf/nat.sh
index 0824671fa0f1..788eacdc3369 100644
--- a/tests/sys/netpfil/pf/nat.sh
+++ b/tests/sys/netpfil/pf/nat.sh
@@ -260,6 +260,35 @@ endpoint_independent_compat_cleanup()
 	rm -f server2.out
 }
 
+atf_test_case "endpoint_independent_exhaust" "cleanup"
+endpoint_independent_exhaust_head()
+{
+	atf_set descr 'Test that a client behind NAT gets the same external IP:port for different servers'
+	atf_set require.user root
+}
+
+endpoint_independent_exhaust_body()
+{
+	endpoint_independent_setup # Sets ${epair_…} variables
+
+	endpoint_independent_common \
+		"nat on ${epair_nat}a inet from ! (${epair_nat}a) to any -> (${epair_nat}a)" \
+		"nat on ${epair_nat}a inet from ! (${epair_nat}a) to any -> (${epair_nat}a) port 3000:3001 sticky-address endpoint-independent"
+
+	# Exhaust the available nat ports
+	for i in $(seq 1 10); do
+		echo "ping" | jexec client nc -u 198.51.100.32 1234 -w 0
+		echo "ping" | jexec client nc -u 198.51.100.22 1234 -w 0
+	done
+}
+
+endpoint_independent_exhaust_cleanup()
+{
+	pft_cleanup
+	rm -f server1.out
+	rm -f server2.out
+}
+
 atf_test_case "endpoint_independent_pass" "cleanup"
 endpoint_independent_pass_head()
 {
@@ -900,6 +929,7 @@ atf_init_test_cases()
 	atf_add_test_case "exhaust"
 	atf_add_test_case "nested_anchor"
 	atf_add_test_case "endpoint_independent_compat"
+	atf_add_test_case "endpoint_independent_exhaust"
 	atf_add_test_case "endpoint_independent_pass"
 	atf_add_test_case "nat6_nolinklocal"
 	atf_add_test_case "empty_table_source_hash"