ipfilter strangeness with ipv6-icmp

From: Bob Grant <bglists_at_gmail.com>
Date: Thu, 16 Jun 2022 16:59:34 UTC
I'm using ipf to secure a FreeBSD 13.1 system that receives its IPV6
address via Router Advertisements.  When setting up my IPV6 rules I placed
a ipv6-icmp rule to allow all packets in.  However the Router
Advertisements were still blocked.  I found I had to specifically allow
icmp-type routerad.  This seems like a bug or I'm not understanding what
the unadorned version of the ipv6-icmp rule does.

The following is an abbreviated version of the relevant IPV6 ipf rules:

====== /etc/ipf.rules (abbreviated) ==========
#V6 eth0 Block in by default and allow all out
block in on eth0 family inet6 head 200
pass out quick on eth0 family inet6 all keep state

# ICMP try to allow all but log the blocks in case some don't work correctly
block in log proto ipv6-icmp from any to any group 200
# router advertisements fail with following rule
pass in quick family inet6 proto ipv6-icmp from any to any group 200
# router advertisements succeed with following rule and fail if commented
out
pass in log quick family inet6 proto ipv6-icmp from any to any icmp-type
routerad group 200
==============================================

The logs show the final pass being the rule that matched.  I can't
understand why the previous general one fails.  It is not the expected
behavior.

I spent a few hours looking through both the ipf source files to see how
things are parsed and encoded and also the ipfilter kernel module.  I was
unable to see where/how the icmp-type any was implemented.

I also looked around for the best place to post this and didn't find one.
Darren Reed's site for IPFilter seems down and the official mailing list is
no more.  Let me know if there is a better forum.

Best regards,

Bob