From owner-freebsd-questions@FreeBSD.ORG Thu Jul 26 20:20:04 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id F3FDF16A418 for ; Thu, 26 Jul 2007 20:20:03 +0000 (UTC) (envelope-from jgordeev@dir.bg) Received: from dir.bg (mail.dir.bg [194.145.63.28]) by mx1.freebsd.org (Postfix) with ESMTP id 838A213C481 for ; Thu, 26 Jul 2007 20:20:02 +0000 (UTC) (envelope-from jgordeev@dir.bg) Received: from [77.85.115.15] (account jgordeev HELO [10.102.9.50]) by dir.bg (CommuniGate Pro SMTP 4.2.10) with ESMTP-TLS id 24235065; Thu, 26 Jul 2007 23:19:59 +0300 Message-ID: <46A90266.5050204@dir.bg> Date: Thu, 26 Jul 2007 23:21:58 +0300 From: Jordan Gordeev User-Agent: Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.7) Gecko/20070411 X-Accept-Language: bg, en MIME-Version: 1.0 To: freebsd-pf@freebsd.org References: <200702252202.l1PM2r46003312@cheyenne.sixcompanies.com> <200702261159.l1QBx46X006755@cheyenne.sixcompanies.com> <46A1EA91.5000306@dir.bg> <200707252055.50780.max@love2party.net> In-Reply-To: <200707252055.50780.max@love2party.net> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-questions@freebsd.org Subject: Re: pf and keep/modulate state on 6.2 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jul 2007 20:20:04 -0000 Max Laier wrote: >On Saturday 21 July 2007, Jordan Gordeev wrote: > >>I'm replying to an old and long-forgotten thread to report my recent >>findings. >>There's a bug in PF with modulate/synproxy state. Modulate/synproxy >>state modulate sequence numbers, but don't modulate sequence numbers in >>TCP SACK options. Some firewalls block TCP segments with sequence >>numbers in the SACK option pointing outside the window, which causes >>connection stalls. The bug was fixed in OpenBSD with revision 1.509 of >>src/sys/net/pf.c about an year and a half ago. The bug is present in >>FreeBSD-STABLE. A fix for the bug was imported in FreeBSD-CURRENT with >>the big import of PF from OpenBSD 4.1. >>I'm CC-ing Max to notify him of the bug present in -STABLE and to ask >>him to deal with the issue by either porting the fix from OpenBSD, or >>by documenting that modulate/synproxy state is broken. >> >> > >Good catch - sorry for the delay. Here is the diff (almost verbatim from >OPENBSD_3_8). Please test and report back. I plan to commit this to >RELENG_6 in a bit. > > > The patch fixed the problem I was having with modulate state and SACK on my lightly loaded personal NAT box.