Date: Tue, 08 Aug 2023 07:38:19 +0000 From: bugzilla-noreply@freebsd.org To: pf@FreeBSD.org Subject: [Bug 272908] [14.0 CURRENT] Kernel panic in the pf_find_state_all_exists() Message-ID: <bug-272908-16861-PboguRFt6X@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-272908-16861@https.bugs.freebsd.org/bugzilla/> References: <bug-272908-16861@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D272908 --- Comment #2 from Alfa <burak.sn@outlook.com> --- (In reply to Kristof Provost from comment #1) Hi, "pf rules" set optimization aggressive set timeout { adaptive.start 0, adaptive.end 0 } set limit states 200000 set limit src-nodes 20000 set timeout interval 10 set timeout frag 30 #Interface defines loopback =3D "lo0" igc1_if_gateway =3D "10.10.10.1" igc2_if_gateway =3D "192.168.111.1" igc0_if =3D "igc0" pppoe_igc1_if =3D "pppoe_igc1" igc2_if =3D "igc2" igc3_if =3D "igc3" igc4_if =3D "igc4" igc5_if =3D "igc5" igc3_20_if =3D "igc3.20" igc4_4093_if =3D "igc4.4093" igc3_2_if =3D "igc3.2" # Private networks, we are going to block incoming traffic from them priv_nets =3D "{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }" table <country_xyz> persist file "/etc/pf/country_xyz.txt" table <quarantine_ip_list> { } table <block_ip_list> persist file "/tmp/block_ip_list.txt" table <botnet_ip_list> persist file "/tmp/botnet_ip_list.txt" table <interface_ip_addresses> { 192.168.111.100,192.168.10.1,10.10.20.1,192.168.169.1,172.16.0.0/24 } ### options set block-policy drop set loginterface igc1 #Global Mac Adress ether anchor "global_mac" #Captive Portal Rules ether pass on { igc3.20 } tag "captiveportal_rdr_igc3.20" ether anchor "captiveportal_allowed_mac_igc3.20" on { igc3.20 } ether anchor "captiveportal_allowed_ip_igc3.20" on { igc3.20 } ether anchor "captiveportal_auth_igc3.20" on { igc3.20 } ### Scrub scrub from any to <vpn_networks> fragment no reassemble scrub from <vpn_networks> to any fragment no reassemble scrub in log nat-anchor "ftp-proxy/*" rdr-anchor "ftp-proxy/*" #### LOOPBACK NAT=20 no nat proto carp all nat on igc0 from { 10.10.10.1/24 } to { 10.10.10.1/24 } -> 10.10.10.1 nat on igc3 from { 192.168.10.1/24 } to { 192.168.10.1/24 } -> 192.168.10.1 nat on igc3.20 from { 10.10.20.1/24 } to { 10.10.20.1/24 } -> 10.10.20.1 nat on wg0 from any to { 192.168.237.1/24 } -> 192.168.237.1/32 source-hash= =20 #### NAT RULES=20 nat on igc2 inet from { any } to { a.b.c.d/32 } -> igc2:0 source-has= h=20=20 nat on enc0 inet from { 192.168.10.0/24 } to { 192.168.1.0/24 } ->= =20 x.y.z.t/32 source-hash=20=20 nat on igc2 inet from { any } to { a.b.c.d/32 } -> igc2:0 source-has= h=20=20 #nat_id=3D17 nat on enc0 inet from { 192.168.10.0/24 } to { 192.168.1.0/24 } ->= =20 x.y.z.t/32 source-hash=20=20 #DEFAULT NAT RULES=20 nat on pppoe_igc1 inet from { !pppoe_igc1 } to any port 500 -> (pppoe_igc1:= 0) static-port #static-port -> for_ipsec nat on pppoe_igc1 inet from { !pppoe_igc1 } to any -> (pppoe_igc1:0) port 1024:65535 nat on igc2 inet from { !igc2 } to any port 500 -> (igc2:0) static-port #static-port -> for_ipsec nat on igc2 inet from { !igc2 } to any -> (igc2:0) port 1024:65535 nat on igc4 inet from { !igc4 } to any port 500 -> (igc4:0) static-port #static-port -> for_ipsec nat on igc4 inet from { !igc4 } to any -> (igc4:0) port 1024:65535 #captive_portal_redirect rules rdr pass on igc3.20 proto { tcp } from any to !10.10.20.1 port { 80 } tagg= ed captiveportal_rdr_igc3.20 -> 10.10.20.1 port 80 rdr pass on igc3.20 proto { tcp } from any to !10.10.20.1 port { 443 } tag= ged captiveportal_rdr_igc3.20 -> 10.10.20.1 port 443 #Port Forwarding Rules rdr log on igc3 proto { tcp udp } from any to any port { 53 } -> 192.168.= 10.1 port 53 #LAN_interface_redirect_rule_130 #WAN_interface_redirect_rule_111 rdr log on { pppoe_igc1 } proto { tcp } from { any } to any port { 21 } -> 172.16.0.2 port 21 #forwarding_111 ### CARP Firewall Failover pass in quick on igc0 proto carp from any to any keep state pass in quick on igc2 proto carp from any to any keep state pass in quick on igc3 proto carp from any to any keep state pass in quick on igc4 proto carp from any to any keep state pass in quick on igc5 proto carp from any to any keep state pass in quick on lo0 inet from 127.0.0.1 to 127.0.0.1 keep state pass out quick on lo0 inet from 127.0.0.1 to 127.0.0.1 keep state #### DROP Mysql/Postgresql Ports #### pass in quick inet proto { tcp udp } from 127.0.0.1 to 127.0.0.1 block drop in log quick inet proto { tcp, udp } from any to (self) port 9300 block drop in log quick inet proto { tcp, udp } from any to (self) port 9200 block drop in log quick inet proto { tcp, udp } from any to (self) port 6379 ## Quarantine IP List block in log quick inet from <quarantine_ip_list> to any block in log quick inet from any to <quarantine_ip_list> block out log quick inet from <quarantine_ip_list> to any block out log quick inet from any to <quarantine_ip_list> ## BLOCK botnet AND blocked ip list block in log quick inet from <block_ip_list> to any block in log quick inet from any to <block_ip_list> block out log quick inet from <block_ip_list> to any block out log quick inet from any to <block_ip_list> block in log quick inet from <botnet_ip_list> to any block in log quick inet from any to <botnet_ip_list> block out log quick inet from <botnet_ip_list> to any block out log quick inet from any to <botnet_ip_list> ## block ipv6 block in quick inet6 all block out quick inet6 all load anchor "anomaly" from "/etc/anomaly.txt" #anomaly anchor "anomaly" ## Port Forwarding Allow Rules=20 # Antispoof WAN ports antispoof log for pppoe_igc1 antispoof log for igc2 antispoof log for igc4 # IPSec Allow Rule pass out quick route-to ( igc2 192.168.111.1 ) proto udp from (self) to a.b= .c.d port =3D 500 keep state label "ipsec_vpn_1_500" pass in quick on igc2 reply-to ( igc2 192.168.111.1 ) proto udp from a.b.c.= d to (self) port =3D 500 keep state label "ipsec_vpn_1_500" pass out quick route-to ( igc2 192.168.111.1 ) proto udp from (self) to a.b= .c.d port =3D 4500 keep state label "ipsec_vpn_1_4500" pass in quick on igc2 reply-to ( igc2 192.168.111.1 ) proto udp from a.b.c.= d to (self) port =3D 4500 keep state label "ipsec_vpn_1_4500" pass out quick route-to ( igc2 192.168.111.1 ) proto esp from (self) to a.b= .c.d keep state label "ipsec_vpn_1_esp" pass in quick on igc2 reply-to ( igc2 192.168.111.1 ) proto udp from a.b.c.= d to (self) keep state label "ipsec_vpn_1_esp" # SSLVPN Allow Rule pass out log quick route-to ( pppoe_igc1 10.10.10.1 ) proto { udp } from (s= elf) port 1194 to any keep state label "ssl_vpn_1" pass in log quick on pppoe_igc1 reply-to ( pppoe_igc1 10.10.10.1 ) proto udp from any to (self) port =3D 1194 keep state label "ssl_vpn_1" #### Lan access rule=20 pass in quick on igc0 from any to (igc0) keep state label "anti_lock_rule" pass in quick on igc3 from any to (igc3) keep state label "anti_lock_rule" pass in quick on igc5 from any to (igc5) keep state label "anti_lock_rule" pass in quick on igc3.20 from any to (igc3.20) keep state label "anti_lock_rule" pass in quick on igc4.4093 from any to (igc4.4093) keep state label "anti_lock_rule" pass in quick on igc3.2 from any to (igc3.2) keep state label "anti_lock_ru= le" #Syslog send=20 pass out quick proto { udp } from any to 192.168.10.244 port 514 pass out quick proto { udp } from any to 192.168.10.233 port 514 #Captive Portal Allow rules=20 #captive_portal_pass_rules pass in quick on igc3.20 proto { tcp } from any to 10.10.20.1 port { 80 } k= eep state(sloppy) pass out quick on igc3.20 proto { tcp } from 10.10.20.1 port { 80 } to any flags any keep state(sloppy) block in quick on igc3.20 from any to !10.10.20.1 tagged captiveportal_rdr_igc3.20 # Custom Rules=20 pass in log quick on { LAN_ZONE } inet from { 192.168.10.233/32 } to { = any } flags S/SA keep state label "custom_rule_57" tag "ltag_57" block drop in log quick on { igc0 } inet from { any } to { 192.168.10.0= /24 } label "custom_rule_71" tag "ltag_71" block drop in log quick on { igc3 } proto { tcp udp } from { any } to { a= ny } port { 25 } label "custom_rule_40" tag "ltag_40" pass in log quick on { igc3 } inet from { 192.168.10.1/32 } to {=20 192.168.10.244/32 } flags S/SA keep state label "custom_rule_59" tag "ltag_59" block drop in log quick on { igc3 } inet from { 192.168.10.244/32 } to {= =20 any } label "custom_rule_56" tag "ltag_56" pass in log quick on { igc3.20 } inet from { any } to { 192.168.10.183= /32 } flags S/SA keep state label "custom_rule_61" tag "ltag_61" block drop in log quick on { igc3.20 } inet from { any } to {=20 192.168.10.0/24 172.16.0.0/24 } label "custom_rule_50" tag "ltag_50" pass in log quick on { igc3 igc0 } inet from { any } to { any } flags S/SA keep state label "custom_rule_41" tag "ltag_41" pass out log quick reply-to { ( pppoe_igc1 10.10.10.1 ) } proto { tcp } from { any } to { any } port { 3535 } flags S/SA keep state label "custom_rule_73" tag "ltag_73" # WAN to LAN deny all block drop in log quick on pppoe_igc1 from any to any label "custom_rule_-1" tag "ltag_-1" block drop in log quick on igc2 from any to any label "custom_rule_-1" tag "ltag_-1" block drop in log quick on igc4 from any to any label "custom_rule_-1" tag "ltag_-1" pass in log label "custom_rule_-2" tag "ltag_-2" pass out log label "custom_rule_-3" tag "ltag_-3" ########################################################### # ether rules=20 # pfctl -se ether anchor "global_mac" l3 all ether pass on igc3.20 l3 all tag captiveportal_rdr_igc3.20 ether anchor "captiveportal_allowed_mac_igc3.20" on igc3.20 l3 all ether anchor "captiveportal_allowed_ip_igc3.20" on igc3.20 l3 all ether anchor "captiveportal_auth_igc3.20" on igc3.20 l3 all # pfctl -a captiveportal_auth_igc3.20 -se ether pass in quick from 7c:6a:ab:7d:da:a6 l3 all tag captiveportal_auth_igc3.20 dnpipe 1006 ether pass out quick to 7c:6a:ab:7d:da:a6 l3 all tag captiveportal_auth_igc= 3.20 dnpipe 6 # pipes # dnctl pipe 1006 show you have mail 01006: 2.000 Mbit/s 0 ms burst 0=20 q132078 50 sl. 0 flows (1 buckets) sched 66542 weight 0 lmax 0 pri 0 dropt= ail sched 66542 type FIFO flags 0x1 64 buckets 0 active mask: 0x00 0xffffffff/0x0000 -> 0x00000000/0x0000 # dnctl pipe 6 show 00006: 10.000 Mbit/s 0 ms burst 0=20 q131078 50 sl. 0 flows (1 buckets) sched 65542 weight 0 lmax 0 pri 0 dropt= ail sched 65542 type FIFO flags 0x1 64 buckets 0 active mask: 0x00 0x00000000/0x0000 -> 0xffffffff/0x0000 # kldstat you have mail Id Refs Address Size Name 1 74 0xffffffff80200000 1d4f6a0 kernel 2 1 0xffffffff81f50000 108e8 carp.ko 3 2 0xffffffff81f62000 946c8 pf.ko 4 2 0xffffffff81ff7000 4c108 ipfw.ko 5 1 0xffffffff82600000 462be0 zfs.ko 6 1 0xffffffff82520000 4240 ichsmb.ko 7 1 0xffffffff82525000 2178 smbus.ko 8 1 0xffffffff82528000 12808 dummynet.ko 9 1 0xffffffff8253b000 42a0 ipfw_nat.ko 10 1 0xffffffff82540000 d932 libalias.ko 11 1 0xffffffff8254e000 2e560 if_wg.ko 12 1 0xffffffff8257d000 2240 pflog.ko 13 1 0xffffffff82580000 2224 speaker.ko 14 1 0xffffffff82583000 72f8 if_vxlan.ko 15 1 0xffffffff8258b000 25b8 if_enc.ko 16 1 0xffffffff8258e000 76b0 if_ovpn.ko 17 1 0xffffffff82596000 12848 ipsec.ko 18 1 0xffffffff825a9000 52e0 ng_pppoe.ko 19 8 0xffffffff825af000 bb28 netgraph.ko 20 1 0xffffffff825bb000 38b8 ng_socket.ko 21 1 0xffffffff825bf000 4404 ng_mppc.ko 22 1 0xffffffff825c4000 20b0 rc4.ko 23 1 0xffffffff825c7000 23b8 ng_iface.ko 24 1 0xffffffff825ca000 61e8 ng_ppp.ko 25 1 0xffffffff825d1000 2138 ng_tee.ko 26 1 0xffffffff825d4000 31c8 ng_ether.ko 27 1 0xffffffff825d8000 2138 ng_tcpmss.ko 28 1 0xffffffff825db000 2538 ipdivert.ko igc0@pci0:1:0:0: class=3D0x020000 rev=3D0x04 hdr=3D0x00 vendor=3D0x8= 086 device=3D0x125c subvendor=3D0x8086 subdevice=3D0x0000 vendor =3D 'Intel Corporation' device =3D 'Ethernet Controller I226-V' class =3D network subclass =3D ethernet "Can this be reproduced? Consistently or intermittently?" It occurs intermittently. When this panic happens, four days later the same panic occurred again --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-272908-16861-PboguRFt6X>