From owner-freebsd-pf@FreeBSD.ORG Tue May 22 11:52:57 2012 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id AF5D9106564A; Tue, 22 May 2012 11:52:57 +0000 (UTC) (envelope-from Joerg.Pulz@frm2.tum.de) Received: from mailhost.frm2.tum.de (mailhost.frm2.tum.de [129.187.179.12]) by mx1.freebsd.org (Postfix) with ESMTP id 5007A8FC12; Tue, 22 May 2012 11:52:57 +0000 (UTC) Received: from mailhost.frm2.tum.de (localhost [127.0.0.1]) by mailhost.frm2.tum.de (8.14.4/8.14.4) with ESMTP id q4MBpwIY038517; Tue, 22 May 2012 13:51:58 +0200 (CEST) (envelope-from Joerg.Pulz@frm2.tum.de) X-Virus-Scanned: at mailhost.frm2.tum.de Received: from hades.admin.frm2 (hades.admin.frm2 [172.25.1.10]) (authenticated bits=0) by mailhost.frm2.tum.de (8.14.4/8.14.4) with ESMTP id q4MBpsux038513 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Tue, 22 May 2012 13:51:54 +0200 (CEST) (envelope-from Joerg.Pulz@frm2.tum.de) Date: Tue, 22 May 2012 13:51:51 +0200 (CEST) From: Joerg Pulz To: Daniel Hartmeier In-Reply-To: <20120522112601.GE29536@insomnia.benzedrine.cx> Message-ID: References: <201205220610.q4M6A3oY036772@freefall.freebsd.org> <20120522112601.GE29536@insomnia.benzedrine.cx> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.6 (mailhost.frm2.tum.de [129.187.179.12]); Tue, 22 May 2012 13:51:54 +0200 (CEST) Cc: FreeBSD-gnats-submit@freebsd.org, freebsd-pf@freebsd.org Subject: Re: kern/168190: [pf] panic when using pf and route-to (maybe: bad fragment handling?) X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 May 2012 11:52:57 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tue, 22 May 2012, Daniel Hartmeier wrote: > This (or something similar) was reported before: > > help w/panic under heavy load - 5.4 > http://www.mail-archive.com/freebsd-hackers@freebsd.org/msg52452.html > > panic on ip_input, ip_len byte ordering problem? > http://lists.freebsd.org/pipermail/freebsd-net/2009-July/022473.html > > But no resolutions were posted. Maybe Max remembers? > > Are you using other pfil hooks (ipfw, ipfilter, etc.)? > > IP fast forwarding? divert? netgraph? dup-to? > > What network interfaces are used (enc, gre, gif, fxp0)? > > What checksumming support (ifconfig if)? Daniel, mails to your personal eMail address are bouncing. relay=insomnia.benzedrine.cx. [62.65.145.30], dsn=4.0.0, stat=Deferred: insomnia.benzedrine.cx.: No route to host I've found another report and a patch which i already tried without success, so i reverted back to stock 9.0-p1. http://lists.freebsd.org/pipermail/freebsd-pf/2005-March/000922.html I've the following relevant options in the kernel configuration: options IPFIREWALL options IPFIREWALL_VERBOSE options IPFIREWALL_VERBOSE_LIMIT=100 options IPFIREWALL_DEFAULT_TO_ACCEPT options IPDIVERT options IPFILTER options IPFILTER_LOG options IPSTEALTH options ALTQ options ALTQ_CBQ # Class Bases Queueing options ALTQ_RED # Random Early Drop options ALTQ_RIO # RED In/Out options ALTQ_HFSC # Hierarchical Packet Scheduler options ALTQ_CDNR # Traffic conditioner options ALTQ_PRIQ # Priority Queueing options ALTQ_NOPCC # Required for SMP build options IPSEC options IPSEC_NAT_T device crypto device cryptodev device hifn device enc device pf # PF OpenBSD packet-filter firewall device pflog # logging support interface for PF device pfsync # synchronization interface for PF device carp # common address redundancy protocol Only pf(4) is configured and used. net.inet.ip.forwarding: 1 net.inet.ip.fastforwarding: 0 net.inet6.ip6.forwarding: 0 No netgraph, divert or dup-to. Interface list: bge0: flags=8843 metric 0 mtu 1500 options=8009b bge1: flags=8843 metric 0 mtu 1500 options=8009b pflog0: flags=0<> metric 0 mtu 33152 pfsync0: flags=0<> metric 0 mtu 1500 ipfw0: flags=8801 metric 0 mtu 65536 lo0: flags=8049 metric 0 mtu 16384 options=3 enc0: flags=0<> metric 0 mtu 1536 Only bge0 and bge1 are configured and used. bge0 ist $ext_if and bge1 is $int_if. Kind regards Joerg - -- The beginning is the most important part of the work. -Plato -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.18 (FreeBSD) iD8DBQFPu33aSPOsGF+KA+MRAjkLAJ0Z6K0Smp5M2p9r/VcSAUy1nqnkAACgqMq7 oHMudSKOjU3nQIGaq3M0fAo= =SuIg -----END PGP SIGNATURE-----