All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jiri Popelka <jpopelka@redhat.com>
To: netfilter@vger.kernel.org
Subject: conntrack thinks that ICMPv6 Echo reply to ICMPv6 Echo request sent to IPv6 multicast address is INVALID
Date: Fri, 23 Mar 2012 14:19:58 +0100	[thread overview]
Message-ID: <4F6C787E.90708@redhat.com> (raw)

Hi all,

1) I have two virtual machines with interfaces on the same link:
A) fe80::5054:ff:fe09:e0b9/64
B) fe80::5054:ff:fe80:d951/64

2) I set up IPv6 packet filter on A with ip6tables:
# ip6tables -F
# ip6tables -A INPUT -m conntrack --ctstate INVALID -j REJECT --reject-with icmp6-adm-prohibited
# ip6tables -A INPUT -p ipv6-icmp -j ACCEPT
# ip6tables -A INPUT -j REJECT --reject-with icmp6-adm-prohibited

3) ping6 B from A:
# ping6 -I eth2 fe80::5054:ff:fe80:d951
PING fe80::5054:ff:fe80:d951(fe80::5054:ff:fe80:d951) from
fe80::5054:ff:fe09:e0b9 eth2: 56 data bytes
64 bytes from fe80::5054:ff:fe80:d951: icmp_seq=1 ttl=64 time=0.265 ms
<OK>

4) ping6 'all nodes' from A:
# ping6 -I eth2 ff02::1
PING ff02::1(ff02::1) from fe80::5054:ff:fe09:e0b9 eth2: 56 data bytes
<no response, reply is rejected>

5) remove the first line from ip6tables
# ip6tables -D INPUT 1

6) ping6 'all nodes' from A:
# ping6 -I eth2 ff02::1
PING ff02::1(ff02::1) from fe80::5054:ff:fe09:e0b9 eth2: 56 data bytes
64 bytes from fe80::5054:ff:fe09:e0b9: icmp_seq=1 ttl=64 time=0.072 ms
64 bytes from fe80::5054:ff:fe80:d951: icmp_seq=1 ttl=64 time=0.318 ms (DUP!)
<OK>

I see this with kernels 2.6.32 and 3.3.0.
Is it a known bug or my misunderstanding ?

thanks
--
Jiri


             reply	other threads:[~2012-03-23 13:19 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-03-23 13:19 Jiri Popelka [this message]
2012-03-23 18:39 ` conntrack thinks that ICMPv6 Echo reply to ICMPv6 Echo request sent to IPv6 multicast address is INVALID Humberto Jucá
  -- strict thread matches above, loose matches on Subject: below --
2012-03-23 18:07 Jiri Popelka

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4F6C787E.90708@redhat.com \
    --to=jpopelka@redhat.com \
    --cc=netfilter@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.