<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - [log] reports dropping ICMPv6 type 134 for blocked ether type vlan frames"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1468#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - [log] reports dropping ICMPv6 type 134 for blocked ether type vlan frames"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1468">bug 1468</a>
from <span class="vcard"><a class="email" href="mailto:vtolkm@gmail.com" title="vtolkm@gmail.com">vtolkm@gmail.com</a>
</span></b>
<pre>weird, seems more of an issue with the logging facility instead since the
package arrives at the inet family for processing, which should not if it was
dropped in netdev according to the below config:
[Sat Sep 26 08:48:48 2020] nd et DROP: IN=eth2 OUT= MACSRC=78:ba:f9:73:f5:74
MACDST=33:33:00:00:00:01 MACPROTO=86dd
SRC=fe80:0000:0000:0000:7aba:f9ff:fe73:f574
DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=224 HOPLIMIT=255
FLOWLBL=0 PROTO=ICMPv6 TYPE=134 CODE=0
[Sat Sep 26 08:48:49 2020] icmp6 ra: IN=eth2 OUT= MACSRC=78:ba:f9:73:f5:74
MACDST=33:33:00:00:00:01 MACPROTO=86dd
SRC=fe80:0000:0000:0000:7aba:f9ff:fe73:f574
DST=ff02:0000:0000:0000:0000:0000:0000:0001 LEN=72 TC=224 HOPLIMIT=255
FLOWLBL=0 PROTO=ICMPv6 TYPE=134 CODE=0
____
table netdev filter {
set et {
typeof ether type
flags constant
counter
elements = { vlan }
}
chain eth_in {
type filter hook ingress device "eth2" priority -500; policy
accept;
goto input
}
chain pppoe_in {
type filter hook ingress device "pppoe-wan" priority -500;
policy accept;
goto input
}
chain input {
ether type @et log prefix "nd et DROP: " flags all drop
}
}
table inet filter {
set if_wan {
type ifname
flags constant
elements = { "eth2",
"pppoe-wan" }
}
chain input {
type filter hook input priority filter; policy drop;
iifname @if_wan jump wan_in
}
chain wan_in {
icmpv6 type nd-router-advert ip6 hoplimit 255 ip6 saddr
fe80::/10 ip6 daddr ff02::1 log prefix "icmp6 ra: " flags all accept
}
}</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>