Date: Mon, 22 Apr 2024 07:59:48 +0200 From: Gerrit =?UTF-8?B?S8O8aG4=?= <gerrit.kuehn@aei.mpg.de> To: Dag-Erling =?UTF-8?B?U23DuHJncmF2?= <des@FreeBSD.org> Cc: freebsd-stable@freebsd.org Subject: Re: possible regression handling packet fragmentation in 14.0 with tftp/pxe Message-ID: <20240422075948.5bb856ac@arc.aei.uni-hannover.de> In-Reply-To: <86y1999wwe.fsf@ltc.des.dev> References: <20240419153951.5a23ce5f@arc.aei.uni-hannover.de> <86y1999wwe.fsf@ltc.des.dev>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --]
Am Fri, 19 Apr 2024 17:48:01 +0200
schrieb Dag-Erling Smørgrav <des@FreeBSD.org>:
> Since you control the routers and endpoints, I would suggest running
> tcpdump at various points to see what is the tunnel and pf are doing to
> the UDP packets. They are presumably getting fragmented at some point,
> and hopefully reassembled somewhere else.
Yes, I can acces all tap, bridge, and ethernet interfaces along the way
(well, apart from what the pxe client actually receives, this is hidden
in its firmware).
However, I already did that last week but was not able to spot the
culprit (the packet being sent back to the pxe client machine is 1460
bytes, so it looks complete to me but is obviously not accepted on the
client's end). I'll probably have to read up more on tcpdump and
fragmentation handling first to get a better understanding of what I am
actually looking for.
Any idea what the "bad length 1460 > 1392" message on the 13.3 system
means (and why everything is still working)?
> Meanwhile you can also set the net.inet.udp.maxdgram sysctl to 1425 on
> the NFS server, as tftpd will cap the blocksize to that value.
That's an interesting hint I didn't see before. thanks. As the server is
used by a bunch of systems and the "-o" option works around the issue for
me right now, I will probably refrain from toying with the setting on the
production system and see if I can come up with a separate test setup
instead.
I am working on a new server machine that will come with a migration from
syslinux/mbr to ipxe/uefi and thus reduce the usage of tftp (it will only
be used for the first ipxe firmware/bootloader step then - bootmenu,
kernel and initramfs will be transferred over http). This might give me a
good test environment where I can try things without breaking the
production system.
As this appears to be different behaviour on 13.3 and 14.0, I had hoped
this might already be sufficient to ring a bell for someone here reading
this (like "oh, yes, there were changes in pf that cause different
handling of fragmented udp packets"). I hope I can soon dig up more
information.
cu
Gerrit
[-- Attachment #2 --]
0 *H
010
`He 0 *H
0200
*H
0{1 0 UGB10U Greater Manchester10U Salford10U
Comodo CA Limited1!0 U AAA Certificate Services0
040101000000Z
281231235959Z0{1 0 UGB10U Greater Manchester10U Salford10U
Comodo CA Limited1!0 U AAA Certificate Services0"0
*H
0
@nv MEDFȃ* ]P1 p"I-Tc̶nhF SL$rNT
z3`ډU"XOhF'v5,^deHav PfxbV1 8'2Xok+c_s8x6Qx:B /I-߬tMG)b&{>%ݝ5h Ä
^/ 00 U
#>)00U 0U 00{U t0r08642http://crl.comodoca.com/AAACertificateServices.crl06420http://crl.comodo.net/AAACertificateServices.crl0
*H
V{DO X̦Ihv]`֍PO&N氥tTAOZ``J¿Ĺt-}kF/j4,}Z
/\:l7U S@lXen<ZƞYH0!el!s7Χ,,&"`^tԢShnlhV+8: k-?cb,j AP96n00i9rD:"Ql150
*H
0{1 0 UGB10U Greater Manchester10U Salford10U
Comodo CA Limited1!0 U AAA Certificate Services0
190312000000Z
281231235959Z01 0 UUS10U
New Jersey10U Jersey City1 0 U
The USERTRUST Network1.0,U%USERTrust RSA Certification Authority0"0
*H
0
e6ЬW
v'LPa M -d Ή=ӱ{7(+G9Ƽ:_}cBv;+o >tbdj"<{ QgFQˆT?3~lQ5frg!fԛxP:ܼL5 WZ=,T:ML\ ="4~;hfDNFS3`S7sC2S۪tNik` 2̓;Qxg=V i%&k3mnGsC~f)|2cU
T0}7]:l5\AکI bf%̈́?9L|k^̸g[L[s#;- 5Ut IIX6Q&} MC&пA_@DDWP WT>tc/Pe XB.CL%GY &FJPxgW cb_U.\(%9+L ?
R/ 00 U #0
#>)00 U SyZ+JT؛f0U 0U 00U
00U 0CU <0:08642http://crl.comodoca.com/AAACertificateServices.crl04+(0&0$+0http://ocsp.comodoca.com0
*H
Qt!='3.^"our -J~or<C;?\Ʈ{C6|?Cd~}}B+XfvN M2q[A
" ͒7;:E&u?{w;= \9?{
E͓/]YO?QE?Jat#
Ps'DG]*k1jLjxϸvr ב_00Π1p5$VI0
*H
01 0 UUS10U
New Jersey10U Jersey City1 0 U
The USERTRUST Network1.0,U%USERTrust RSA Certification Authority0
200218000000Z
330501235959Z0F1 0 UNL10U
GEANT Vereniging1 0UGEANT Personal CA 40"0
*H
0
J"^'[[52 1@P DʯJa-b3j-Bʖ<p=hxn<0d[Iep^¾r{D$8Uӡ};' Q܌=32 0ѬgGx& 5ꄪi7tbLdjK2@v7 *!즃ɽZD3'6Q_*YR4o>DAt|ز?ui+Pglwi3PeV"JD"<"KښoKv+1u#8!͋G1ߛf"Qi> g%NY.^rax1ym"x~Ti/
]r nY Hϴ,,q5;}&~Wmf*r| :ؖ8ŧjraC3jf|kXo+V)25nE!u;-/
%l>v&L3 (;pogS`Ӹ>/ 00 U #0SyZ+JT؛f0 U i !X
ݧQ0U 0U 0 0 U %0++08U 10/0-U 0%0#+https://sectigo.com/CPS0PU I0G0ECA?http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v+j0h0?+03http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%+0http://ocsp.usertrust.com0
*H
N{
9 obx?G]tC@ `JϐDW# kz9QҞ,=1t3?S
< 7D5(/Mn7j\y|A̵/k>5 C1C1XEO 4sjq#(61Ym A<K_~4J5Pf7VG li/+5O7f|Pk D!Uk4Odyep@W o[+0k/5֬HM{ْY6G`43d
ԦnV0[<URO\^<ɵ((o w"*u 51]+m0 3ĂVMbFNb@ڱɛ{~␘&jYzptYB
-:Ej#dDݧ/cBtFԼ3=\];62hPj)l/T#6 " 8$2x]si0K03 &V) vQZ0
*H
0F1 0 UNL10U
GEANT Vereniging1 0UGEANT Personal CA 40
230815000000Z
260814235959Z010 U805391G0EU
>Max-Planck-Gesellschaft zur Förderung der Wissenschaften e.V.10U Hofgartenstraße 810
UBayern1 0 UDE10U Gerrit Kuehn1&0$ *H
gerrit.kuehn@aei.mpg.de0"0
*H
0
~D-!!&t/ʍDp~ Οr}Vkry{{%E]iZU+;UH88>6iBW(R?cHhc{}'4V>56T~x@eঊRԪo+"ktuK@0&OI%mgl2b60~Y0;cI ;s.
~i7RUPQRC }>BkȻN(Il9@pbNX^El d~ ~¦^t Q
ھV/p&-t )o,l~(5zK 9r%dzeGvGsV+>n8uY`@=eNK]Qx-S~o =eMU R5yѩv S (a{
Qغ`:m}ROgtWVd<O%!V
rL|#_g{g\/REce+ 00 U #0i !X
ݧQ0 U p̴%c? 0U 0 U 0 0 U %0++0?U 80604 +1O0%0#+https://sectigo.com/CPS0BU ;0907531http://GEANT.crl.sectigo.com/GEANTPersonalCA4.crl0x+l0j0=+01http://GEANT.crt.sectigo.com/GEANTPersonalCA4.crt0)+0 http://GEANT.ocsp.sectigo.com0"U 0gerrit.kuehn@aei.mpg.de0
*H
m@{kg/{:gl
JO[X[: F9F&OFM:;_ 9IhuȘXsJ!饈$C5UbW8SF 7 hA =e<0 ALhƺO T(]9 ˌ, 釻] BU1\Fl4m> P1c
o/VE l9YF `xIQjũ%;3,#Ӊ*xŵ~RLEADUYụƗ|(J/yzP%%LBh4f*~
$T 1=]Dnϧ~ѱZ"YU *q*`_@Gֽo
1&X| c?V*36ؖ7=j
lY .|8$7ZEϪY|@9D6i IFR/N2n"lȭ9,RFi/ySݷa-Ds п1,0(0[0F1 0 UNL10U
GEANT Vereniging1 0UGEANT Personal CA 4 &V) vQZ0
`He 0 *H
1 *H
0 *H
1
240422055948Z0( *H
100 `He0
*H
0? *H
120Jn)[57%vnVPՑM- 5nq|]Ԅ
M 0
*H
d\[W'R%f{?izn Wpa5 ntyٜն+x_fG-E\VIs7owTd಄v{:i!W\o G4S!41drT8+bo(#wa ބiHU ^)AHTM u$yTct7eF0emܑ zG `^/}XDӨ+ǾP\9o.xۜ]i"y ' B>!2uwO8?OL5݇
u]JIa1F, 2HD~fZ M$jQW&Ur0
a'Y̳gδxJ8ճda-a`xa' F&+̄y!FpcJi[)]Ah3l.bc|Mկ@ң+~G7 dܱH nckfu
%l$Y
help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20240422075948.5bb856ac>