[Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 (ping, tracertoute) states handling in pf firewall
- Reply: bugzilla-noreply_a_freebsd.org: "[Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 states handling in pf firewall (ping, traceroute)"
- Reply: bugzilla-noreply_a_freebsd.org: "[Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 states handling in pf firewall (ping, traceroute)"
- Reply: bugzilla-noreply_a_freebsd.org: "[Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 states handling in pf firewall (ping, traceroute)"
- Reply: bugzilla-noreply_a_freebsd.org: "[Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 states handling in pf firewall (ping, traceroute)"
- Reply: bugzilla-noreply_a_freebsd.org: "[Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 states handling in pf firewall (ping, traceroute)"
- Reply: bugzilla-noreply_a_freebsd.org: "[Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 states handling in pf firewall (ping, traceroute)"
- Reply: bugzilla-noreply_a_freebsd.org: "[Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 states handling in pf firewall (ping, traceroute)"
- Reply: bugzilla-noreply_a_freebsd.org: "[Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 states handling in pf firewall (ping, traceroute)"
- Reply: bugzilla-noreply_a_freebsd.org: "[Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 states handling in pf firewall (ping, traceroute)"
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 09 Aug 2024 08:34:27 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280701
Bug ID: 280701
Summary: FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 (ping,
tracertoute) states handling in pf firewall
Product: Base System
Version: 14.1-RELEASE
Hardware: Any
OS: Any
Status: New
Severity: Affects Some People
Priority: ---
Component: kern
Assignee: bugs@FreeBSD.org
Reporter: doktornotor@mailinator.com
On systems with the FreeBSD-SA-24:05 fix [1] applied and pf firewall enabled,
replies to ping initiated from machines on networks behind pf firewall/NAT to
anything outside the local networks get blocked (state violation), resulting in
'Request timed out'.
- Reverting the security "fix" fixes the issue.
- Disabling pf completely (pfctl -d) mitigates the issue.
- For IPv4, permitting ICMP time exceeded in addition to echo reply does not
help either (NAT state is missing).
[1] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:05.pf.asc
--
You are receiving this mail because:
You are the assignee for the bug.