From nobody Wed Aug 21 12:43:56 2024 X-Original-To: net@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4WpmH12t5Fz5Tpw7 for ; Wed, 21 Aug 2024 12:43:57 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R11" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4WpmH11sblz449M for ; Wed, 21 Aug 2024 12:43:57 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1724244237; a=rsa-sha256; cv=none; b=N6Gu6ZAVar8jvMnLiYdpqXQpS2imLZsD6nsESh3hrpp35SqZoGbGOthEPpzNdHpZg5P2fr pBOGJVZwp2yIwxySp70yX+5JTDoQTbCSvlAPB7KegJ41XRLc2tEvih4yWf0//96mmSSQf3 Mrd3KhyOgAolKYGslwAoRJTpH+BvUqGFz+F9EkdJNeyEJg8xCFDNTiaV7XfgYT8sI3cJoH /AUUdXKg7/CtqddX+AlfjbmgvJanxKooDTCG9IjnROB2pKwhAsGLZZ4E4932TPJHpkkLbV qKAW66FiQ2A1OLZ6hbOAkHXt95K8A2g+J1buHMaTX/TaVNMbCA8eAosJgXI8dw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1724244237; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=dMCJLFzfLPu+qewLQEvBNOZ1xgpAi9sTW5L9Z4qiNao=; b=rEZML+QY3rnFC8hI5qDOVN1F1JJ31muIZJRYK2D7SArmk6ngorla3+T0Krz1iNLId4z1cH oZ0yZHKu9ncqDh8oMKz341Zr52eYjof4q135IJOe5q0vuZBcKDemhSomkYZRd3MQKEcC7K 6Y45eMhjVk1lau7Y0peVFK2hERIbzkt3oy4ImhId9fQe0Z/eZjOXYd1p71hDnXvpZ1tG14 1i1kNoasDIztuY2aynfp3/Yg5GnUU/TWx90jnkx3bUyxQZutki5Lar88Il2jH4naRximWS EO3xsvC4fxeZaDsUuj0/tMty50VAlXlXOPtmxFsm5CA7xqkMU/H3sgddFIzVgQ== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4WpmH11RSCzksY for ; Wed, 21 Aug 2024 12:43:57 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 47LChv0x082787 for ; Wed, 21 Aug 2024 12:43:57 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 47LChvjr082786 for net@FreeBSD.org; Wed, 21 Aug 2024 12:43:57 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: net@FreeBSD.org Subject: [Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 states handling in pf firewall (ping, traceroute) Date: Wed, 21 Aug 2024 12:43:56 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: kern X-Bugzilla-Version: 14.1-RELEASE X-Bugzilla-Keywords: regression X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: franco@opnsense.org X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: net@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Networking and TCP/IP with FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-net List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-net@FreeBSD.org MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D280701 --- Comment #31 from Franco Fichtner --- According to multiple users the ICMP patch series causes stalls in neighbor discovery and only a full revert brings back the desired behaviour. A TCP dump showed that the Cisco is sending ICMP6 neighbour solicitations, which are answered by the opnsense with a large delay. The cisco switch looses it's IPv6 neighbour. tcpdump -n -i ix0 icmp6 and host fe80::86b8:2ff:fe1a:c67f 07:34:42.764553 IP6 fe80::86b8:2ff:fe1a:c67f > 2001:xxxx:x:x::x:2: ICMP6, neighbor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:43.852542 IP6 fe80::86b8:2ff:fe1a:c67f > 2001:xxxx:x:x::x:2: ICMP6, neighbor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:44.940525 IP6 fe80::86b8:2ff:fe1a:c67f > 2001:xxxx:x:x::x:2: ICMP6, neighbor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:46.094207 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:47.120778 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:48.201460 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:49.336747 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:50.360952 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:51.385618 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:52.436467 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:53.529962 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:54.617082 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:55.717592 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:56.765964 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:57.796680 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:58.888994 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neigh= bor solicitation, who has 2001:xxxx:x:x::x:2, length 32 07:34:58.889051 IP6 fe80::3eec:efff:fe70:7326 > fe80::86b8:2ff:fe1a:c67f: ICMP6, neighbor advertisement, tgt is 2001:xxxx:x:x::x:2, length 32 via: https://github.com/opnsense/src/issues/217 --=20 You are receiving this mail because: You are the assignee for the bug.=