Wrong timeout variable for inbound TCP/UDP state cleanup: 6x/3x premature expiry
Summary
nat_cleanup_func_dispatch: inbound TCP states(:971) checked against sysctl_var_icmp_timeout(default 10s) instead of sysctl_var_tcp_timeout(60s). Inbound UDP states(:989) checked against icmp_timeout instead of udp_timeout(30s). Same in ip_fw3_ctl_nat_get_record(:632/:688). Inbound entries vanish 6x/3x faster than configured breaking idle TCP connections NAT mappings. Fix: use tcp_timeout at :971/:632 udp_timeout at :989/:688.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-0575 · 1 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Wrong timeout variable for inbound TCP/UDP state cleanup: 6x/3x premature expiry | 444 B | view raw |
Fix verification
fixedfix.diff applied + combined nativekernel build rc=0 (-Werror)
fix.diff applied + combined nativekernel build rc=0 (-Werror)
Confirmed kernel references
—
Detail
Exploit chain
none (Info severity)
Evidence (decisive lines)
Source-confirmed at sys/net/ipfw3_nat/ip_fw3_nat.c:971: wrong timeout variable for inbound TCP/UDP cleanup (6x/3x premature expiry)
Verified recommended fix
Source-confirmed at sys/net/ipfw3_nat/ip_fw3_nat.c:971: wrong timeout variable for inbound TCP/UDP cleanup (6x/3x premature expiry)
Verdict
Source-confirmed at sys/net/ipfw3_nat/ip_fw3_nat.c:971: wrong timeout variable for inbound TCP/UDP cleanup (6x/3x premature expiry)
No comments yet.