>Number: 146832
>Category: kern
>Synopsis: [pf] "(self)" not always mathing all local IPv6 addresses
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Sat May 22 15:10:01 UTC 2010
>Closed-Date:
>Last-Modified:
>Originator: Christian Laursen
>Release: FreeBSD 8.0-RELEASE-p2 amd64
>Organization:
The Border Worlds
>Environment:
System: FreeBSD talaxian.borderworlds.dk 8.0-RELEASE-p2 FreeBSD 8.0-RELEASE-p2
#4: Thu Jan 7 21:11:54 CET 2010
r...@talaxian.borderworlds.dk:/usr/obj/usr/src/sys/TALAXIAN amd64
>Description:
I have tripped over what I believe is a bug in pf.
On my test machine I have this fairly simple ruleset:
===============================================
set block-policy return
set skip on lo0
block in all
pass out proto { tcp, udp } all keep state
pass in proto {icmp,icmp6} all
pass out proto {icmp,icmp6} all
pass in proto tcp from any to (self) port 22
===============================================
After booting the machine ifconfig for em0 looks like this:
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
ether 08:00:27:73:96:a9
inet6 fe80::a00:27ff:fe73:96a9%em0 prefixlen 64 scopeid 0x1
inet 10.1.0.40 netmask 0xffff0000 broadcast 10.1.255.255
inet6 2001:6c8:6:6:a00:27ff:fe73:96a9 prefixlen 64 autoconf
nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
The problem is that when I try to ssh to the machine the connection is not
allowed through:
[...@talaxian ~]$ ssh 2001:6c8:6:6:a00:27ff:fe73:96a9
ssh: connect to host 2001:6c8:6:6:a00:27ff:fe73:96a9 port 22: Connection refused
I have tried various things when I tried to figure out what is going on here.
In this case it helps to add another IPv6 address to em0:
ifconfig em0 inet6 2001:6c8:6:6::2
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=9b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM>
ether 08:00:27:73:96:a9
inet6 fe80::a00:27ff:fe73:96a9%em0 prefixlen 64 scopeid 0x1
inet 10.1.0.40 netmask 0xffff0000 broadcast 10.1.255.255
inet6 2001:6c8:6:6:a00:27ff:fe73:96a9 prefixlen 64 autoconf
inet6 2001:6c8:6:6::2 prefixlen 64
nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
After doing this, ssh works:
[...@talaxian ~]$ ssh 2001:6c8:6:6:a00:27ff:fe73:96a9
Last login: Tue Apr 6 21:56:48 2010 from 10.1.0.2
I have observed this problem on 7.3, 8.0 and -CURRENT (From april 1).
I can mention that changing "(self)" to "self" in the ruleset works as expected
and the problem returns when changing it back.
When I see this behaviour, it can also be "fixed" by adding another interface,
eg. "ifconfig gif0 create".
I hope that this makes sense and that someone more familiar with the inner
workings of pf is able to reproduce it. I like using "(self)" but when it
doesn't work reliably I'm forced to resort to workarounds.
If I need to provide more info, I'll be happy to do so.
Thanks in advance.
>How-To-Repeat:
Use "(self)" in your pf ruleset along with IPv6.
I have not been able to figure out exactly when this behaviour is triggered but
it has happened to me often
enough to be annoying.
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
_______________________________________________
freebsd-bugs@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-bugs
To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
