Re: kern/48956: ipv6-icmp ipfilter keep state issue

[Takahiro HAYASHI <t.hash425%gmail.com@localhost>]

The following reply was made to PR kern/48956; it has been noted by GNATS.

From: Takahiro HAYASHI <t.hash425%gmail.com@localhost>
To: gnats-bugs%NetBSD.org@localhost, kern-bug-people%netbsd.org@localhost
Cc: 
Subject: Re: kern/48956: ipv6-icmp ipfilter keep state issue
Date: Tue, 01 Jul 2014 17:17:48 +0900

 (07/01/14 04:50), 6bone%6bone.informatik.uni-leipzig.de@localhost wrote:
 >> Description:
 > if you configure a router and add a 'keep state' ipfilter rule like
 >
 > pass in on vlan1 from 2001:638:902::/64 to 2000::/3 keep state
 >
 > icmp6 echo replay packets incoming in interface vlan1 are dropped. This is 
 > wrong because a ping from outside into the network connected to interface 
 > vlan1 is not forbidden.
 
 This rule seems to block implicitly ipv6-icmp neighbor advertisement
 packets from outside host.
 If 'quick' modifier is added, this does not happen.
 
 -- 
 t-hash