Date: Wed, 24 Jan 2024 14:27:19 +0100 From: Kristof Provost <kp@FreeBSD.org> To: "Herbert J. Skuhra" <herbert@gojira.at> Cc: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: Re: git: 54c62e3e5d8c - main - pf: work around icmp6 packet-too-big not being sent when binat-ing Message-ID: <880FAE40-9D91-4AA6-92BA-2D582D23B745@FreeBSD.org> In-Reply-To: <87sf2nm4et.wl-herbert@gojira.at> References: <202401221252.40MCqpf6047526@gitrepo.freebsd.org> <87v87jkii9.wl-herbert@gojira.at> <1E1C3472-0AF3-457B-A27A-89679770EA62@FreeBSD.org> <87sf2nm4et.wl-herbert@gojira.at>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On 24 Jan 2024, at 11:06, Herbert J. Skuhra wrote: > On Tue, 23 Jan 2024 19:42:10 +0100, Kristof Provost wrote: >> On 23 Jan 2024, at 19:32, Herbert J. Skuhra wrote: >>> On Mon, 22 Jan 2024 13:52:51 +0100, Kristof Provost wrote: >>>> >>>> The branch main has been updated by kp: >>>> >>>> URL: >>>> https://cgit.FreeBSD.org/src/commit/?id=54c62e3e5d8cd90c5571a1d4c8c5f062d580480e >>>> >>>> commit 54c62e3e5d8cd90c5571a1d4c8c5f062d580480e >>>> Author: Kristof Provost <kp@FreeBSD.org> >>>> AuthorDate: 2024-01-17 17:11:27 +0000 >>>> Commit: Kristof Provost <kp@FreeBSD.org> >>>> CommitDate: 2024-01-22 11:52:14 +0000 >>>> >>>> pf: work around icmp6 packet-too-big not being sent when >>>> binat-ing >>>> >>>> If we're applying NPTv6 we pass a packet with a modified source >>>> and/or >>>> destination address to the network stack. >>>> >>>> If that packet then turns out to be larger than the MTU of the >>>> sending >>>> interface the stack will attempt to generate an icmp6 >>>> packet-too-big >>>> error, but may fail to look up the appropriate source address >>>> for that >>>> error message. Even if it does, pf would still have to undo the >>>> binat >>>> operation inside the icmp6 packet so the sending host can make >>>> sense of >>>> the error. >>>> >>>> We can avoid both problems entirely by having pf also perform >>>> the MTU >>>> check (taking the potential refragmentation into account), and >>>> generating the icmp6 error directly in pf. >>>> >>>> See also: https://redmine.pfsense.org/issues/14290 >>>> Sponsored by: Rubicon Communications, LLC ("Netgate") >>>> Differential Revision: https://reviews.freebsd.org/D43499 >>>> --- >>>> sys/net/pfvar.h | 1 + >>>> sys/netpfil/pf/pf.c | 12 ++++++++++++ >>>> sys/netpfil/pf/pf_norm.c | 15 +++++++++++++++ >>>> 3 files changed, 28 insertions(+) >>> >>> Does this change cause problems for others too? >>> >>> - ssh over IPv6 permanently disconnecting >>> (client_loop: send disconnect: Broken pipe) >>> - ssh connections over IPv6 hanging >>> - git pull not working >>> Fssh_ssh_dispatch_run_fatal: Connection to >>> 2604:1380:4091:a001::24ca:1 port 22: Permission denied >>> fatal: Could not read from remote repository. >>> >> Can you include your pf.conf and a packet capture demonstrating one >> of these issues? > > So I assume this issue affects only me or this server (igb nic). > Disabling tso6 seems to resolve the issue. > Ah. A Clue(tm)! Try this: diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 38a5a45d7991..2dc6d02d330a 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -8515,7 +8515,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb * confused and fail to send the icmp6 packet too big error. Just send * it here, before we do any NAT. */ - if (dir == PF_OUT && IN6_LINKMTU(ifp) < pf_max_frag_size(m)) { + if (dir == PF_OUT && pflags & PFIL_FWD && IN6_LINKMTU(ifp) < pf_max_frag_size(m)) { PF_RULES_RUNLOCK(); *m0 = NULL; icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, IN6_LINKMTU(ifp)); Best regards, Kristof [-- Attachment #2 --] <!DOCTYPE html> <html> <head> <meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8"> </head> <body><div style="font-family: sans-serif;"><div class="markdown" style="white-space: normal;"> <p dir="auto">On 24 Jan 2024, at 11:06, Herbert J. Skuhra wrote:</p> </div><div class="plaintext" style="white-space: normal;"><blockquote style="margin: 0 0 5px; padding-left: 5px; border-left: 2px solid #136BCE; color: #136BCE;"><p dir="auto">On Tue, 23 Jan 2024 19:42:10 +0100, Kristof Provost wrote:</p> <blockquote style="margin: 0 0 5px; padding-left: 5px; border-left: 2px solid #136BCE; border-left-color: #4B89CF; color: #4B89CF;"><p dir="auto">On 23 Jan 2024, at 19:32, Herbert J. Skuhra wrote:</p> <blockquote style="margin: 0 0 5px; padding-left: 5px; border-left: 2px solid #136BCE; border-left-color: #4B89CF; color: #4B89CF;"><p dir="auto">On Mon, 22 Jan 2024 13:52:51 +0100, Kristof Provost wrote:</p> <blockquote style="margin: 0 0 5px; padding-left: 5px; border-left: 2px solid #136BCE; border-left-color: #4B89CF; color: #4B89CF;"><p dir="auto">The branch main has been updated by kp:</p> <p dir="auto">URL: <a href="https://cgit.FreeBSD.org/src/commit/?id=54c62e3e5d8cd90c5571a1d4c8c5f062d580480e">https://cgit.FreeBSD.org/src/commit/?id=54c62e3e5d8cd90c5571a1d4c8c5f062d580480e</a></p>; <p dir="auto">commit 54c62e3e5d8cd90c5571a1d4c8c5f062d580480e <br> Author: Kristof Provost <kp@FreeBSD.org> <br> AuthorDate: 2024-01-17 17:11:27 +0000 <br> Commit: Kristof Provost <kp@FreeBSD.org> <br> CommitDate: 2024-01-22 11:52:14 +0000</p> <p dir="auto"> pf: work around icmp6 packet-too-big not being sent when binat-ing</p> <p dir="auto"> If we're applying NPTv6 we pass a packet with a modified source and/or <br> destination address to the network stack.</p> <p dir="auto"> If that packet then turns out to be larger than the MTU of the sending <br> interface the stack will attempt to generate an icmp6 packet-too-big <br> error, but may fail to look up the appropriate source address for that <br> error message. Even if it does, pf would still have to undo the binat <br> operation inside the icmp6 packet so the sending host can make sense of <br> the error.</p> <p dir="auto"> We can avoid both problems entirely by having pf also perform the MTU <br> check (taking the potential refragmentation into account), and <br> generating the icmp6 error directly in pf.</p> <p dir="auto"> See also: <a href="https://redmine.pfsense.org/issues/14290">https://redmine.pfsense.org/issues/14290</a>; <br> Sponsored by: Rubicon Communications, LLC ("Netgate") <br> Differential Revision: <a href="https://reviews.freebsd.org/D43499">https://reviews.freebsd.org/D43499</a>; <br> --- <br> sys/net/pfvar.h | 1 + <br> sys/netpfil/pf/pf.c | 12 ++++++++++++ <br> sys/netpfil/pf/pf_norm.c | 15 +++++++++++++++ <br> 3 files changed, 28 insertions(+)</p> </blockquote><p dir="auto">Does this change cause problems for others too?</p> <p dir="auto">- ssh over IPv6 permanently disconnecting <br> (client_loop: send disconnect: Broken pipe) <br> - ssh connections over IPv6 hanging <br> - git pull not working <br> Fssh_ssh_dispatch_run_fatal: Connection to 2604:1380:4091:a001::24ca:1 port 22: Permission denied <br> fatal: Could not read from remote repository.</p> </blockquote><p dir="auto">Can you include your pf.conf and a packet capture demonstrating one of these issues?</p> </blockquote><p dir="auto">So I assume this issue affects only me or this server (igb nic). <br> Disabling tso6 seems to resolve the issue.</p> <br></blockquote></div> <div class="markdown" style="white-space: normal;"> <p dir="auto">Ah. A Clue(tm)!</p> <p dir="auto">Try this:</p> <pre style="margin-left: 15px; margin-right: 15px; padding: 5px; border: thin solid gray; overflow-x: auto; max-width: 90vw; background-color: #E4E4E4;"><code style="padding: 0 0.25em; background-color: #E4E4E4;">diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 38a5a45d7991..2dc6d02d330a 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -8515,7 +8515,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, struct mbuf **m0, struct inpcb * confused and fail to send the icmp6 packet too big error. Just send * it here, before we do any NAT. */ - if (dir == PF_OUT && IN6_LINKMTU(ifp) < pf_max_frag_size(m)) { + if (dir == PF_OUT && pflags & PFIL_FWD && IN6_LINKMTU(ifp) < pf_max_frag_size(m)) { PF_RULES_RUNLOCK(); *m0 = NULL; icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, IN6_LINKMTU(ifp)); </code></pre> <p dir="auto">Best regards,<br> Kristof</p> </div> </div> </body> </html>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?880FAE40-9D91-4AA6-92BA-2D582D23B745>