Bug 294733 - ipfw ::/0 expands to me6
Summary: ipfw ::/0 expands to me6
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 15.0-STABLE
Hardware: amd64 Any
: --- Affects Only Me
Assignee: freebsd-ipfw (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-04-23 17:43 UTC by Marco Moock
Modified: 2026-06-07 09:11 UTC (History)
2 users (show)

See Also:
linimon: maintainer-feedback? (ipfw)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marco Moock 2026-04-23 17:43:43 UTC 
Hello!


Running
ipfw add 01000 allow tcp from ::/0 to me 80
results in
01000 allow tcp from me6 to me 80

Which isn't any IPv6 address (like the wildcard should represent), but only the addresses assigned to the machine.

This should be either fixed or rejected with an error message.

kind regards
Comment 1 commit-hook freebsd_committer freebsd_triage 2026-05-17 10:15:34 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=2872268c7f6d473aae9b02ebb5d2c24fc2cff9b1

commit 2872268c7f6d473aae9b02ebb5d2c24fc2cff9b1
Author:     Andrey V. Elsukov <ae@FreeBSD.org>
AuthorDate: 2026-05-17 10:12:20 +0000
Commit:     Andrey V. Elsukov <ae@FreeBSD.org>
CommitDate: 2026-05-17 10:12:20 +0000

    ipfw: treat ipv6 address with zero mask as 'any'

    Make the behaviour similar for both IPv4 and IPv6. Also add
    the corresponding tests.

    PR:             294733
    MFC after:      1 week
    Differential Revision:  https://reviews.freebsd.org/D56618

 sbin/ipfw/ipfw2.c                          |  7 ++++---
 sbin/ipfw/ipv6.c                           | 11 +++++++----
 sbin/ipfw/tests/test_add_rule.py           | 24 ++++++++++++++++++++++++
 tests/atf_python/sys/netpfil/ipfw/insns.py |  2 ++
 4 files changed, 37 insertions(+), 7 deletions(-)
Comment 2 commit-hook freebsd_committer freebsd_triage 2026-05-25 07:06:11 UTC 
A commit in branch stable/15 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=9acea8aa36e98d636f8d183ac06ec5d2d25de0e1

commit 9acea8aa36e98d636f8d183ac06ec5d2d25de0e1
Author:     Andrey V. Elsukov <ae@FreeBSD.org>
AuthorDate: 2026-05-17 10:12:20 +0000
Commit:     Andrey V. Elsukov <ae@FreeBSD.org>
CommitDate: 2026-05-25 07:03:05 +0000

    ipfw: treat ipv6 address with zero mask as 'any'

    Make the behaviour similar for both IPv4 and IPv6. Also add
    the corresponding tests.

    PR:             294733
    Differential Revision:  https://reviews.freebsd.org/D56618

    (cherry picked from commit 2872268c7f6d473aae9b02ebb5d2c24fc2cff9b1)

 sbin/ipfw/ipfw2.c                          |  7 ++++---
 sbin/ipfw/ipv6.c                           | 11 +++++++----
 sbin/ipfw/tests/test_add_rule.py           | 24 ++++++++++++++++++++++++
 tests/atf_python/sys/netpfil/ipfw/insns.py |  2 ++
 4 files changed, 37 insertions(+), 7 deletions(-)
Comment 3 commit-hook freebsd_committer freebsd_triage 2026-05-25 07:07:13 UTC 
A commit in branch stable/14 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=7ba922959d7ed6e73fde54d0bd72ef0bcd8bc49a

commit 7ba922959d7ed6e73fde54d0bd72ef0bcd8bc49a
Author:     Andrey V. Elsukov <ae@FreeBSD.org>
AuthorDate: 2026-05-17 10:12:20 +0000
Commit:     Andrey V. Elsukov <ae@FreeBSD.org>
CommitDate: 2026-05-25 07:04:48 +0000

    ipfw: treat ipv6 address with zero mask as 'any'

    Make the behaviour similar for both IPv4 and IPv6. Also add
    the corresponding tests.

    PR:             294733
    Differential Revision:  https://reviews.freebsd.org/D56618

    (cherry picked from commit 2872268c7f6d473aae9b02ebb5d2c24fc2cff9b1)

 sbin/ipfw/ipfw2.c                          |  7 ++++---
 sbin/ipfw/ipv6.c                           | 11 +++++++----
 sbin/ipfw/tests/test_add_rule.py           | 24 ++++++++++++++++++++++++
 tests/atf_python/sys/netpfil/ipfw/insns.py |  2 ++
 4 files changed, 37 insertions(+), 7 deletions(-)