[Bug 281395] FreeBSD-SA-24:05 fix breaks ICMPv6 neighbor discovery

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281395

            Bug ID: 281395
           Summary: FreeBSD-SA-24:05 fix breaks ICMPv6 neighbor discovery
           Product: Base System
           Version: 14.1-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: freebsd_email@congenio.de

As already stated in https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280701,
FreeBSD-SA-24:05 causes ICMPv6 neighbor discovery to fail.

I quote the info given there by Franco:

According to multiple users the ICMP patch series causes stalls in neighbor
discovery and only a full revert brings back the desired behaviour.

A TCP dump showed that the Cisco is sending ICMP6 neighbour solicitations,
which are answered by the opnsense with a large delay.
The cisco switch looses it's IPv6 neighbour.

tcpdump -n -i ix0 icmp6 and host fe80::86b8:2ff:fe1a:c67f

07:34:42.764553 IP6 fe80::86b8:2ff:fe1a:c67f > 2001:xxxx:x:x::x:2: ICMP6,
neighbor solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:43.852542 IP6 fe80::86b8:2ff:fe1a:c67f > 2001:xxxx:x:x::x:2: ICMP6,
neighbor solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:44.940525 IP6 fe80::86b8:2ff:fe1a:c67f > 2001:xxxx:x:x::x:2: ICMP6,
neighbor solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:46.094207 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neighbor
solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:47.120778 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neighbor
solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:48.201460 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neighbor
solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:49.336747 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neighbor
solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:50.360952 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neighbor
solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:51.385618 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neighbor
solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:52.436467 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neighbor
solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:53.529962 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neighbor
solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:54.617082 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neighbor
solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:55.717592 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neighbor
solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:56.765964 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neighbor
solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:57.796680 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neighbor
solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:58.888994 IP6 fe80::86b8:2ff:fe1a:c67f > ff02::1:ff56:2: ICMP6, neighbor
solicitation, who has 2001:xxxx:x:x::x:2, length 32
07:34:58.889051 IP6 fe80::3eec:efff:fe70:7326 > fe80::86b8:2ff:fe1a:c67f:
ICMP6, neighbor advertisement, tgt is 2001:xxxx:x:x::x:2, length 32

via: https://github.com/opnsense/src/issues/217


If you want to construct a test setup to cover this, try directing the
following command from another machine to a FreeBSD machine and look at the
results:

while :
do
        ndisc6 -m -n -r 1 fe80::1111:2222:3333:4444 eth0
done

Of course, fill in the target's EUI-64 instead of 1111:2222:3333:4444 and use
the correct interface instead of eth0.

You will find that a machine with the SA applied does not always respond in due
time to these requests and the requests time out, whereas a machine without the
SA always answers correctly.


P.S.: As noted, this is another fallout of not applying the full set of OpenBSD
patches to address the issus with stateful ICMPv6 handling introduced by the
SA.

-- 
You are receiving this mail because:
You are the assignee for the bug.