[Bug 284866] pf: state-policy if-bound breaks ICMPv6 error delivery

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=284866

            Bug ID: 284866
           Summary: pf: state-policy if-bound breaks ICMPv6 error delivery
           Product: Base System
           Version: 15.0-CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: lexi@hemlock.eden.le-fay.org

interface configuration:

--o<--
cxl3: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0
mtu 1500
       
options=6ec07bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,VLAN_HWTSO,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6,HWSTATS,HWRXTSTMP,MEXTPG>
        ether 00:07:43:3f:e7:78
        inet 81.2.96.162/28 broadcast 81.2.96.175
        inet6 fe80::207:43ff:fe3f:e778%cxl3/64 scopeid 0x4
        inet6 2001:8b0:aab5:c401::1:5/64
        inet6 fd5b:a83:b06b:c401::1:5/64
        media: Ethernet 10Gbase-Twinax <full-duplex,rxpause,txpause>
        status: active
        nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
--o<--

pf.conf:

--o<--
set skip on lo
set reassemble yes
set state-policy floating

block return in log
block return in quick proto tcp flags /S
pass out

# + a few 'pass in on cxl3 ...' rules for services
--o<--

with state-policy floating, traceroute works:

# traceroute6 -I ns1.burble.dn42
traceroute6 to ns1.burble.dn42 (fd42:4242:2601:ac53::1) from
fd5b:a83:b06b:c401::1:5, 64 hops max, 20 byte packets
 1  vlan401.core-1.inet.eden.le-fay.dn42 (fd5b:a83:b06b:c401::1)  0.219 ms 
0.144 ms  0.136 ms
 2  ix0-3004.willow.eden.le-fay.org (2001:8b0:aab5:3004::2)  0.139 ms  0.081 ms
 0.073 ms
 3  yarrow.eden.le-fay.dn42 (fd5b:a83:b06b:10::1)  6.846 ms  7.246 ms  6.996 ms
 4  uk-lon1.burble.dn42 (fd42:4242:2601:35::1)  8.576 ms  8.873 ms  8.756 ms
 5  ns1.burble.dn42 (fd42:4242:2601:ac53::1)  8.445 ms  8.829 ms  8.325 ms

with state-policy if-bound, traceroute doesn't work:

# traceroute6 -I ns1.burble.dn42
traceroute6 to ns1.burble.dn42 (fd42:4242:2601:ac53::1) from
fd5b:a83:b06b:c401::1:5, 64 hops max, 20 byte packets
 1  * * *
 2  * * *

because the ICMP errors are blocked by pf:

21:53:39.119122 rule 0/0(match): block in on cxl3: fd5b:a83:b06b:c401::1 >
fd5b:a83:b06b:c401::1:5: ICMP6, time exceeded in-transit for
fd42:4242:2601:ac53::1, length 68
21:53:44.174904 rule 0/0(match): block in on cxl3: fd5b:a83:b06b:c401::1 >
fd5b:a83:b06b:c401::1:5: ICMP6, time exceeded in-transit for
fd42:4242:2601:ac53::1, length 68
21:53:49.724459 rule 0/0(match): block in on cxl3: fd5b:a83:b06b:c401::1 >
fd5b:a83:b06b:c401::1:5: ICMP6, time exceeded in-transit for
fd42:4242:2601:ac53::1, length 68
21:53:54.846427 rule 0/0(match): block in on cxl3: 2001:8b0:aab5:3004::2 >
fd5b:a83:b06b:c401::1:5: ICMP6, time exceeded in-transit for
fd42:4242:2601:ac53::1, length 68
21:54:00.869729 rule 0/0(match): block in on cxl3: 2001:8b0:aab5:3004::2 >
fd5b:a83:b06b:c401::1:5: ICMP6, time exceeded in-transit for
fd42:4242:2601:ac53::1, length 68
21:54:06.568530 rule 0/0(match): block in on cxl3: 2001:8b0:aab5:3004::2 >
fd5b:a83:b06b:c401::1:5: ICMP6, time exceeded in-transit for
fd42:4242:2601:ac53::1, length 68

using src f5aff1871d3273b3cd3621ea5d3e37cdd807e66f on amd64, pf is statically
compiler with PF_DEFAULT_TO_DROP.

-- 
You are receiving this mail because:
You are the assignee for the bug.