From wei@algol.adsl.nerim.net  Mon Nov 25 08:48:43 2002
Return-Path: <wei@algol.adsl.nerim.net>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2EA8937B401
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 25 Nov 2002 08:48:43 -0800 (PST)
Received: from algol.adsl.nerim.net (algol.adsl.nerim.net [62.212.97.189])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 2FDAA43E4A
	for <FreeBSD-gnats-submit@freebsd.org>; Mon, 25 Nov 2002 08:48:42 -0800 (PST)
	(envelope-from wei@algol.adsl.nerim.net)
Received: (from root@localhost)
	by algol.adsl.nerim.net (8.12.6/8.11.6) id gAPHgjIj001681;
	Mon, 25 Nov 2002 18:42:45 +0100 (CET)
	(envelope-from wei)
Message-Id: <200211251742.gAPHgjIj001681@algol.adsl.nerim.net>
Date: Mon, 25 Nov 2002 18:42:45 +0100 (CET)
From: Harald Weis <wei@algol.adsl.nerim.net>
Reply-To: "hawei@nerim.net" <wei@algol.adsl.nerim.net>
To: FreeBSD-gnats-submit@freebsd.org
Cc: hawei@nerim.net
Subject: ipfilter's flags and icmp-type processing 
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         45721
>Category:       bin
>Synopsis:       ipfilter's flags and icmp-type processing
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    darrenr
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Nov 25 08:50:01 PST 2002
>Closed-Date:    Tue Aug 30 10:14:28 GMT 2005
>Last-Modified:  Tue Aug 30 10:14:28 GMT 2005
>Originator:     Harald Weis
>Release:        FreeBSD 4.7-STABLE i386
>Organization:
>Environment:
System: FreeBSD algol.adsl.nerim.net 4.7-STABLE FreeBSD 4.7-STABLE #0: Sun Nov 24 20:06:48 CET 2002 wei@algol.adsl.nerim.net:/usr/local/src/sys/compile/ALGOL i386


	
>Description:
	
	ping packets do no longer match the rule
	``pass in quick on tun0 proto icmp from any to my_ip_addr/32 icmp-type echo keep state''
	They do match if I suppress ``icmp-type echo''.
	ssh packets do no longer match the rule
	``pass in quick on tun0 proto tcp from any to my_ip_addr/32 port = 22 flags S/FSRPAU keep state''
	They do match if I replace ``S/FSRPAU'' by ``S/S'' or if I suppress the flags entirely.
	Both worked perfectly under 4.5-STABLE from where I upgraded to 4.7-STABLE.
	The remote machine is an ``ibook'' (MacOS X), connected via modem to Internet,
	the ibook has not received any update whatsoever.
	It makes no difference whether ipfilter is compiled into the kernel or not.
	
>How-To-Repeat:
	
>Fix:

	


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->darrenr 
Responsible-Changed-By: johan 
Responsible-Changed-When: Fri Nov 29 12:43:46 PST 2002 
Responsible-Changed-Why:  
Over to ipfilter author. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=45721 
State-Changed-From-To: open->feedback 
State-Changed-By: darrenr 
State-Changed-When: Tue Apr 20 06:55:58 PDT 2004 
State-Changed-Why:  
this should be fixed in the current freebsd4.x and if not will be fixed 
in the next ipfilter import and mfc 

http://www.freebsd.org/cgi/query-pr.cgi?pr=45721 
State-Changed-From-To: feedback->closed 
State-Changed-By: matteo 
State-Changed-When: Tue Aug 30 10:14:15 GMT 2005 
State-Changed-Why:  
feedback timeout 

http://www.freebsd.org/cgi/query-pr.cgi?pr=45721 
>Unformatted:
