Subject: kern/28921: ipf not matching packets correctly
To: None <,,>
From: None <>
List: netbsd-bugs
Date: 01/09/2005 17:42:00
>Number:         28921
>Category:       kern
>Synopsis:       ipf not matching packets correctly
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Jan 09 17:42:00 +0000 2005
>Originator:     Kimmo Suominen
>Release:        NetBSD 2.99.11 from between 2004-12-15 and 2005-01-01
Kimmo Suominen
System: NetBSD 2.99.11 NetBSD 2.99.11 (GW-GENERIC) #85: Sat Jan 1 11:30:14 EST 2005 i386
Architecture: i386
Machine: i386
Looking at "ipfstat -o -h" output:

    0 pass out quick proto udp from port = isakmp to 212.83.96.
    0 pass out quick proto ah from to
    0 pass out quick proto esp from to

As you can see, no packets have matched.  On the other hand:

    32031 pass out quick all keep state

Lots of packets match there...

Looking at /var/log/ipmon I can see this:

    Jan  9 12:20:18 dit ipmon[536]: 12:20:18.020064
    STATE:NEW,500 ->,500 PR udp

That should clearly have matched the first of the rules shown in the
ipfstat output above.  Yet it seems to have gone all the way to the
last out rule matching all packets, and a state was created.
Add similar rules and run racoon to negotate ISAKMP states.