kern/52470: ipf fails to return-icmp on a link-local address

[ef%math.uni-bonn.de@localhost]

>Number:         52470
>Category:       kern
>Synopsis:       ipf fails to return-icmp on a link-local address
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Aug 07 14:35:00 +0000 2017
>Originator:     Edgar Fuß
>Release:        6.1, 7.1
>Organization:
Mathematisches Institut der Universität Bonn
>Environment:
>Description:
If a block rule with a "return-icmp" qualifier matches on a link-local address, no ICMP packet is sent. The problem is that ipf_send_icmp_err() calls ipf_ifpaddr() to find an address of the interface in question, but that routine discards link local addresses. 
>How-To-Repeat:
Install a block rule with "return-icmp" and make it match a packet addressed to a link-local address. Observe no ICMP being sent.
>Fix:
I guess the best fix is to simply use the destination address instead if it is link local, i.e. treat the rule as if return-icmp-as-dest was given in this case.

Note you will also need the fix from kern/52469 or the ICMP packet will fail to get properly routed.

Index: ip_fil_netbsd.c
===================================================================
RCS file: /cvsroot/src/sys/external/bsd/ipf/netinet/ip_fil_netbsd.c,v
retrieving revision 1.11
diff -u -p -r1.11 ip_fil_netbsd.c
--- ip_fil_netbsd.c	25 Jul 2014 08:10:39 -0000	1.11
+++ ip_fil_netbsd.c	20 Jul 2017 15:30:20 -0000
@@ -944,7 +944,7 @@ ipf_send_icmp_err(int type, fr_info_t *f
 		}
 		xtra = MIN(fin->fin_plen, avail - iclen - max_linkhdr);
 		xtra = MIN(xtra, IPV6_MMTU - iclen);
-		if (dst == 0) {
+		if (dst == 0 && !IN6_IS_ADDR_LINKLOCAL(&fin->fin_dst6.in6)) {
 			if (ipf_ifpaddr(&ipfmain, 6, FRI_NORMAL, ifp,
 				       &dst6, NULL) == -1) {
 				FREE_MB_T(m);