Bug 577419 - kernel ipv6 connection tracking module missing
Summary: kernel ipv6 connection tracking module missing
Keywords:
Status: CLOSED DUPLICATE of bug 232933
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: kernel
Version: 5.4
Hardware: All
OS: Linux
high
urgent
Target Milestone: rc
: ---
Assignee: Thomas Graf
QA Contact: Red Hat Kernel QE team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-03-26 21:57 UTC by Rok Potocnik
Modified: 2014-06-18 08:30 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-08-24 08:08:37 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Rok Potocnik 2010-03-26 21:57:21 UTC
Description of problem:
the kernel lacks the ipv6 connection tracking module, statefull firewalling is not possible

Version-Release number of selected component (if applicable):
kernel-2.6.18-164.15.1.el5 

How reproducible:
every time

Steps to Reproduce:
1. ip6tables -I OUTPUT -j ACCEPT
2. ip6tables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
3. ip6tables -A INPUT -j DROP

Actual results:
incoming IPv6 traffic gets dopped

Expected results:
incoming IPv6 traffic should get accepted in case the packet is a direct response of initially outbound IPv6 traffic

Additional info:
even though ip6tables has the correct code (.../iptables/libip6t_state.so) the kernel ignores it whatsoever, the problem is also very noticable in case the server is also a router (e.g. FORWARD table)

Comment 1 Thomas Graf 2010-08-24 08:08:37 UTC

*** This bug has been marked as a duplicate of bug 232933 ***


Note You need to log in before you can comment on or make changes to this bug.