On Tue, 14 Feb 2012 at 23:02:26, Freek Dijkstra wrote: > Hi, > > I added a few rules to my firewall to prevent spoofing source IP > addresses. I encountered some (to me) unexpected behaviour where IPv6 > traffic originating at the host would match an ipfw rule with "in" and > "recv <interface>" set. > > I very much appreciate it if someone could replicate the following > behaviour, and report the results. > > 1. Add a firewall rule: > "count log ipv6 from me to me not recv lo0" > 2. On the host, ping6 to one of it's IP addresses. > > Here is the result for me: > > 2001:610:767:4ec1::1 is an IPv6 address of my host. So I would expect > that pinging the IP from host itself would use the loopback interface. > route get confirms this: > > % route get -inet6 2001:610:767:4ec1::1 > route to: 2001:610:767:4ec1::1 > destination: 2001:610:767:4ec1::1 > interface: lo0 > flags: <UP,HOST,DONE,STATIC> > recvpipe sendpipe ssthresh rtt,msec mtu weight expire > 0 0 0 0 16384 1 0 > However, ipfw thinks the traffic is received through another interface: > > % ipfw add 1200 count log ipv6 from me to me not recv lo0 > % ipfw add 1201 count log ipv6 from me to me out not recv lo0 > % ipfw add 1202 count log ipv6 from me to me in not recv lo0 > % ping6 -c 1 2001:610:767:4ec1::1 > >> ipfw: 1200 Count ICMPv6:128.0 [2001:610:767:4ec1::1] >> [2001:610:767:4ec1::1] in via em3 ipfw: 1202 Count ICMPv6:128.0 >> [2001:610:767:4ec1::1] > [2001:610:767:4ec1::1] in via em3 > [snip]
I have replicated what you're doing for ipv4 and ipv6, results are attached. There is a difference, ping seems to use 127.0.0.1 to send the echo request and ping6 doesn't use ::1 to send it. Possibly this is by design. -- Regards, T. Koeman, MTh/BSc/BPsy; Technical Monk MediaMonks B.V. (www.mediamonks.com) Please quote relevant replies in correspondence.
# route get -inet 217.195.117.150 route to: ns1.mediamonks.net destination: ns1.mediamonks.net interface: lo0 flags: <UP,HOST,DONE,STATIC> recvpipe sendpipe ssthresh rtt,msec mtu weight expire 0 0 0 0 16384 1 0 ------------ # ping -c 1 217.195.117.150 PING 217.195.117.150 (217.195.117.150): 56 data bytes 64 bytes from 217.195.117.150: icmp_seq=0 ttl=64 time=0.028 ms --- 217.195.117.150 ping statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 0.028/0.028/0.028/0.000 ms ------------ 00011 count log logamount 200 ip from me to me not recv lo0 00012 count log logamount 200 ip from me to me out not recv lo0 00013 count log logamount 200 ip from me to me in not recv lo0 ------------ Feb 15 00:17:52 obhasa kernel: ipfw: 11 Count ICMP:8.0 127.0.0.1 217.195.117.150 out via lo0 Feb 15 00:17:52 obhasa kernel: ipfw: 12 Count ICMP:8.0 127.0.0.1 217.195.117.150 out via lo0 Feb 15 00:17:52 obhasa kernel: ipfw: 11 Count ICMP:0.0 217.195.117.150 127.0.0.1 out via lo0 Feb 15 00:17:52 obhasa kernel: ipfw: 12 Count ICMP:0.0 217.195.117.150 127.0.0.1 out via lo0 ------------
# route get -inet6 2a03:5500:236:0:217:195:117:150 route to: ns1.mediamonks.net destination: ns1.mediamonks.net interface: lo0 flags: <UP,HOST,DONE,STATIC> recvpipe sendpipe ssthresh rtt,msec mtu weight expire 0 0 0 0 16384 1 0 ------------ # ping6 -c 1 2a03:5500:236:0:217:195:117:150 PING6(56=40+8+8 bytes) 2a03:5500:236:0:217:195:117:150 --> 2a03:5500:236:0:217:195:117:150 16 bytes from 2a03:5500:236:0:217:195:117:150, icmp_seq=0 hlim=64 time=0.274 ms --- 2a03:5500:236:0:217:195:117:150 ping6 statistics --- 1 packets transmitted, 1 packets received, 0.0% packet loss round-trip min/avg/max/std-dev = 0.274/0.274/0.274/0.000 ms ------------ 00001 count log logamount 200 ip6 from me6 to me6 not recv lo0 00002 count log logamount 200 ip6 from me6 to me6 out not recv lo0 00003 count log logamount 200 ip6 from me6 to me6 in not recv lo0 ------------ Feb 15 00:19:41 obhasa kernel: ipfw: 1 Count ICMPv6:128.0 [2a03:5500:236:0:217:195:117:150] [2a03:5500:236:0:217:195:117:150] out via lo0 Feb 15 00:19:41 obhasa kernel: ipfw: 2 Count ICMPv6:128.0 [2a03:5500:236:0:217:195:117:150] [2a03:5500:236:0:217:195:117:150] out via lo0 Feb 15 00:19:41 obhasa kernel: ipfw: 1 Count ICMPv6:128.0 [2a03:5500:236:0:217:195:117:150] [2a03:5500:236:0:217:195:117:150] in via em0 Feb 15 00:19:41 obhasa kernel: ipfw: 3 Count ICMPv6:128.0 [2a03:5500:236:0:217:195:117:150] [2a03:5500:236:0:217:195:117:150] in via em0 Feb 15 00:19:41 obhasa kernel: ipfw: 1 Count ICMPv6:129.0 [2a03:5500:236:0:217:195:117:150] [2a03:5500:236:0:217:195:117:150] out via lo0 Feb 15 00:19:41 obhasa kernel: ipfw: 2 Count ICMPv6:129.0 [2a03:5500:236:0:217:195:117:150] [2a03:5500:236:0:217:195:117:150] out via lo0 Feb 15 00:19:41 obhasa kernel: ipfw: 1 Count ICMPv6:129.0 [2a03:5500:236:0:217:195:117:150] [2a03:5500:236:0:217:195:117:150] in via em0 Feb 15 00:19:41 obhasa kernel: ipfw: 3 Count ICMPv6:129.0 [2a03:5500:236:0:217:195:117:150] [2a03:5500:236:0:217:195:117:150] in via em0 ------------
smime.p7s
Description: S/MIME cryptographic signature