[Bug 280701] FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 (ping, tracertoute) states handling in pf firewall

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=280701

            Bug ID: 280701
           Summary: FreeBSD-SA-24:05 fix breaks ICMP/ICMP6 (ping,
                    tracertoute) states handling in pf firewall
           Product: Base System
           Version: 14.1-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: doktornotor@mailinator.com

On systems with the FreeBSD-SA-24:05 fix [1] applied and pf firewall enabled,
replies to ping initiated from machines on networks behind pf firewall/NAT to
anything outside the local networks get blocked (state violation), resulting in
'Request timed out'.

- Reverting the security "fix" fixes the issue.
- Disabling pf completely (pfctl -d) mitigates the issue.
- For IPv4, permitting ICMP time exceeded in addition to echo reply does not
help either (NAT state is missing).

[1] https://www.freebsd.org/security/advisories/FreeBSD-SA-24:05.pf.asc

-- 
You are receiving this mail because:
You are the assignee for the bug.