Date: Wed, 24 Jan 2024 11:16:43 +0100 From: tuexen@freebsd.org To: "Herbert J. Skuhra" <herbert@gojira.at> Cc: Kristof Provost <kp@FreeBSD.org>, "src-committers@freebsd.org" <src-committers@FreeBSD.org>, "dev-commits-src-all@freebsd.org" <dev-commits-src-all@FreeBSD.org>, "dev-commits-src-main@freebsd.org" <dev-commits-src-main@FreeBSD.org> Subject: Re: git: 54c62e3e5d8c - main - pf: work around icmp6 packet-too-big not being sent when binat-ing Message-ID: <413C7C6F-8B6F-4EAD-8EF7-7C9245BE78BF@freebsd.org> In-Reply-To: <87sf2nm4et.wl-herbert@gojira.at> References: <202401221252.40MCqpf6047526@gitrepo.freebsd.org> <87v87jkii9.wl-herbert@gojira.at> <1E1C3472-0AF3-457B-A27A-89679770EA62@FreeBSD.org> <87sf2nm4et.wl-herbert@gojira.at>
next in thread | previous in thread | raw e-mail | index | archive | help
> On Jan 24, 2024, at 11:06, Herbert J. Skuhra <herbert@gojira.at> wrote: > > On Tue, 23 Jan 2024 19:42:10 +0100, Kristof Provost wrote: >> >> On 23 Jan 2024, at 19:32, Herbert J. Skuhra wrote: >>> On Mon, 22 Jan 2024 13:52:51 +0100, Kristof Provost wrote: >>>> >>>> The branch main has been updated by kp: >>>> >>>> URL: https://cgit.FreeBSD.org/src/commit/?id=54c62e3e5d8cd90c5571a1d4c8c5f062d580480e >>>> >>>> commit 54c62e3e5d8cd90c5571a1d4c8c5f062d580480e >>>> Author: Kristof Provost <kp@FreeBSD.org> >>>> AuthorDate: 2024-01-17 17:11:27 +0000 >>>> Commit: Kristof Provost <kp@FreeBSD.org> >>>> CommitDate: 2024-01-22 11:52:14 +0000 >>>> >>>> pf: work around icmp6 packet-too-big not being sent when binat-ing >>>> >>>> If we're applying NPTv6 we pass a packet with a modified source and/or >>>> destination address to the network stack. >>>> >>>> If that packet then turns out to be larger than the MTU of the sending >>>> interface the stack will attempt to generate an icmp6 packet-too-big >>>> error, but may fail to look up the appropriate source address for that >>>> error message. Even if it does, pf would still have to undo the binat >>>> operation inside the icmp6 packet so the sending host can make sense of >>>> the error. >>>> >>>> We can avoid both problems entirely by having pf also perform the MTU >>>> check (taking the potential refragmentation into account), and >>>> generating the icmp6 error directly in pf. >>>> >>>> See also: https://redmine.pfsense.org/issues/14290 >>>> Sponsored by: Rubicon Communications, LLC ("Netgate") >>>> Differential Revision: https://reviews.freebsd.org/D43499 >>>> --- >>>> sys/net/pfvar.h | 1 + >>>> sys/netpfil/pf/pf.c | 12 ++++++++++++ >>>> sys/netpfil/pf/pf_norm.c | 15 +++++++++++++++ >>>> 3 files changed, 28 insertions(+) >>> >>> Does this change cause problems for others too? >>> >>> - ssh over IPv6 permanently disconnecting >>> (client_loop: send disconnect: Broken pipe) >>> - ssh connections over IPv6 hanging >>> - git pull not working >>> Fssh_ssh_dispatch_run_fatal: Connection to 2604:1380:4091:a001::24ca:1 port 22: Permission denied >>> fatal: Could not read from remote repository. >>> >> Can you include your pf.conf and a packet capture demonstrating one of these issues? > > So I assume this issue affects only me or this server (igb nic). > Disabling tso6 seems to resolve the issue. > > I also have an issue with rack enabled. I only works with lro disabled > or net.inet.tcp.rack.features.cmpack=0. I think I know what the issue is (some hooks are not called when in the compressed ack code path), some dtrace probes are also affected. I'm working on a fix for that. Best regards Michael > > I'll check pf.conf and packet capture later. > > Thanks. > > -- > Herbert
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?413C7C6F-8B6F-4EAD-8EF7-7C9245BE78BF>