From owner-freebsd-pf@FreeBSD.ORG  Tue Aug  1 17:20:48 2006
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 2511116A4DE
	for <freebsd-pf@freebsd.org>; Tue,  1 Aug 2006 17:20:48 +0000 (UTC)
	(envelope-from steinex@nognu.de)
Received: from shodan.nognu.de (shodan.nognu.de [85.14.216.230])
	by mx1.FreeBSD.org (Postfix) with ESMTP id D184843D9A
	for <freebsd-pf@freebsd.org>; Tue,  1 Aug 2006 17:20:46 +0000 (GMT)
	(envelope-from steinex@nognu.de)
Received: by shodan.nognu.de (Postfix, from userid 1002)
	id 5ED63B81E; Tue,  1 Aug 2006 19:20:45 +0200 (CEST)
Date: Tue, 1 Aug 2006 19:20:45 +0200
From: Frank Steinborn <steinex@nognu.de>
To: Max Laier <max@love2party.net>
Mail-Followup-To: Max Laier <max@love2party.net>, freebsd-pf@freebsd.org
References: <20060801142925.54F5CB828@shodan.nognu.de>
	<200608011905.55505.max@love2party.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <200608011905.55505.max@love2party.net>
User-Agent: mutt-ng/devel-r804 (FreeBSD)
Message-Id: <20060801172045.5ED63B81E@shodan.nognu.de>
Cc: freebsd-pf@freebsd.org
Subject: Re: I'm getting sick - Problems filtering IPv6.
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Aug 2006 17:20:48 -0000

Max Laier wrote:
> On Tuesday 01 August 2006 16:29, Frank Steinborn wrote:
> > That's it. It's not possible, and i'm really frustrated for days now.
> > What is actually borked here? Let's have a look on the pflog0, what's
> > dropping:
> >
> > 15:26:35.983709 rule 1/0(match): block in on gif0:
> > 2001:1638:17ad::3.53 > 2001:1638:17ad::3.59761:  tcp 40 [bad hdr
> > length 4 - too short, < 20]
> >
> > Hmm. Bad hdr lenght? What's up here? If i change the rule
> 
> This really just is an artefact from a too short snaplen.  Use -s 1500 and you 
> get rid of it.
> 
> The strange thing, however, is that this is the reply *from* port 53.  So this 
> means the initial SYN got through alright.  Can you check if a state has been 
> created (pfctl -vss) for that connection, please.  I suspect that it has and 
> the problem would be that the reply doesn't match the state - for what ever 
> reason.  Please check if there is a state and let me know - thanks.

Hello Max,

a state is created, yes:

self tcp 2001:1638:17ad::3[53] <- 2001:1638:17ad::3[62810]
SYN_SENT:ESTABLISHED
   [342525613 + 65536](+2469478632) wscale 1  [3355548528 +
65537](+82545723) wscale 1
   [1845438366 + 4880](+1776883750)  [3423429433 + 65535](+3331864375)
   age 00:37:53, expires in 00:00:59, 2204:15980 pkts, 107106:2269450
bytes
   age 01:22:57, expires in 00:01:00, 5472:42944 pkts, 324485:6199453
bytes
   age 02:00:22, expires in 00:00:59, 11249:53620 pkts, 967458:7637333
bytes


Strange thing :-(

Thanks,
Frank