Date: Wed, 21 Aug 2024 12:43:56 +0000 From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 states handling in pf firewall (ping, traceroute) Message-ID: <bug-280701-7501-YcQzWeCmEQ@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-280701-7501@https.bugs.freebsd.org/bugzilla/> References: <bug-280701-7501@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D280701 --- Comment #31 from Franco Fichtner <franco@opnsense.org> --- According to multiple users the ICMP patch series causes stalls in neighbor discovery and only a full revert brings back the desired behaviour. A TCP dump showed that the Cisco is sending ICMP6 neighbour solicitations, which are answered by the opnsense with a large delay. The cisco switch looses it's IPv6 neighbour. tcpdump -n -i ix0 icmp6 and host fe80::86b8:2ff:fe1a:c67f 07:34:42.764553 IP6 fe80::86b8:2ff:fe1a:c67f > 2001:xxxx:x:x::x:2: ICMP6, neighbor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:43.852542 IP6 fe80::86b8:2ff:fe1a:c67f > 2001:xxxx:x:x::x:2: ICMP6, neighbor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:44.940525 IP6 fe80::86b8:2ff:fe1a:c67f > 2001:xxxx:x:x::x:2: ICMP6, neighbor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:46.094207 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:47.120778 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:48.201460 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:49.336747 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:50.360952 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:51.385618 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:52.436467 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:53.529962 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:54.617082 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:55.717592 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:56.765964 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:57.796680 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:58.888994 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:58.889051 IP6 fe80::3eec:efff:fe70:7326 > fe80::86b8:2ff:fe1a:c67f: ICMP6, neighbor advertisement, tgt is 2001:xxxx:x:x::x:2, length 32 via: https://github.com/opnsense/src/issues/217 --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-280701-7501-YcQzWeCmEQ>