Panic Crash in PING with IPv6 address

Draco

I tried to use the Diagnostics/Ping with ipv6 to both 26:3:10:10:0:3:0:3:0:0:0:0:0:0:0:5B (microsoft), which failed saying it was an invalid host, then with the abbreviated form 26:3:10:10:0:3:0:3:5B, which led to this crash dump:

Crash report begins. Anonymous machine information:

amd64
15.0-CURRENT
FreeBSD 15.0-CURRENT #0 plus-RELENG_24_11-n256407-1bbb3194162: Fri Nov 22 05:08:46 UTC 2024 root@freebsd:/var/jenkins/workspace/pfSense-Plus-snapshots-24_11-main/obj/amd64/AKWlAIiM/var/jenkins/workspace/pfSense-Plus-snapshots-24_11-main/sources/FreeBS

Crash report details:

PHP Errors:
[18-Jan-2025 15:50:26 PST8PDT] PHP Fatal error: Uncaught ValueError: str_repeat(): Argument #2 ($times) must be greater than or equal to 0 in /usr/local/share/pear/Net/IPv6.php:684
Stack trace:
#0 /usr/local/share/pear/Net/IPv6.php(684): str_repeat()
#1 /usr/local/share/pear/Net/IPv6.php(931): Net_IPv6::uncompress()
#2 /usr/local/share/pear/Net/IPv6.php(985): Net_IPv6::SplitV64()
#3 /etc/inc/util.inc(861): Net_IPv6::checkIPv6()
#4 /etc/inc/util.inc(830): is_ipaddrv6()
#5 /usr/local/www/diag_ping.php(72): is_ipaddr()
#6 {main}
thrown in /usr/local/share/pear/Net/IPv6.php on line 684

No FreeBSD crash data found.

This is what the PHP log held:
[18-Jan-2025 15:50:26 PST8PDT] PHP Fatal error: Uncaught ValueError: str_repeat(): Argument #2 ($times) must be greater than or equal to 0 in /usr/local/share/pear/Net/IPv6.php:684
Stack trace:
#0 /usr/local/share/pear/Net/IPv6.php(684): str_repeat()
#1 /usr/local/share/pear/Net/IPv6.php(931): Net_IPv6::uncompress()
#2 /usr/local/share/pear/Net/IPv6.php(985): Net_IPv6::SplitV64()
#3 /etc/inc/util.inc(861): Net_IPv6::checkIPv6()
#4 /etc/inc/util.inc(830): is_ipaddrv6()
#5 /usr/local/www/diag_ping.php(72): is_ipaddr()
#6 {main}
thrown in /usr/local/share/pear/Net/IPv6.php on line 684

Should this be reported as a bug??

JKnott

@Draco said in Panic Crash in PING with IPv6 address:

I tried to use the Diagnostics/Ping with ipv6 to both 26:3:10:10:0:3:0:3:0:0:0:0:0:0:0:5B (microsoft)

Are you sure about that address? It doesn't work here:

ping 26:3:10:10:0:3:0:3:0:0:0:0:0:0:0:5B
ping: 26:3:10:10:0:3:0:3:0:0:0:0:0:0:0:5B: Name or service not known

26:3:10:10:0:3:0:3:5B

That's definitely wrong. It should be 26:3:10:10:0:3:0:3::5B. When you get rid of a long string of 0, you replace it with :: and you can only do that once.

Draco

Sorry, the abbreviated form was not "26:3:10:10:0:3:0:3:5B" but "26:3:10:10:0:3:0:3::5B". Regardless of whether or not I copied the Microsoft AAAA info correctly, pfSense should not have crashed, right?

stephenw10

Yeah that's not a valid IPv6 address. It looks like you are trying to use: 2603:1010:3:3::5b which could be expanded to 2603:1010:0003:0003:0000:0000:0000:005b.

But the gui ping should check that first so there is a bug there IMO.

stephenw10

Hmm, I can't replicate that though.

Screenshot from 2025-01-19 01-19-09.png

Correctly shows it as invalid.

You're testing in 24.11 amd64?

marcosm

Thanks for the report. The issue may be tracked here:
https://redmine.pfsense.org/issues/16005