From owner-freebsd-pf@FreeBSD.ORG Tue Nov 20 10:20:59 2007 Return-Path: Delivered-To: freebsd-pf@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8C67116A418; Tue, 20 Nov 2007 10:20:59 +0000 (UTC) (envelope-from dhartmei@insomnia.benzedrine.cx) Received: from insomnia.benzedrine.cx (insomnia.benzedrine.cx [IPv6:2001:6f8:1098::2]) by mx1.freebsd.org (Postfix) with ESMTP id D2E9413C455; Tue, 20 Nov 2007 10:20:57 +0000 (UTC) (envelope-from dhartmei@insomnia.benzedrine.cx) Received: from insomnia.benzedrine.cx (localhost.benzedrine.cx [127.0.0.1]) by insomnia.benzedrine.cx (8.14.1/8.13.4) with ESMTP id lAKAKunG009271 (version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO); Tue, 20 Nov 2007 11:20:56 +0100 (MET) Received: (from dhartmei@localhost) by insomnia.benzedrine.cx (8.14.1/8.12.10/Submit) id lAKAKuF6004999; Tue, 20 Nov 2007 11:20:56 +0100 (MET) Date: Tue, 20 Nov 2007 11:20:56 +0100 From: Daniel Hartmeier To: Jan Srzednicki Message-ID: <20071120102056.GK29432@insomnia.benzedrine.cx> References: <20071119202142.GI2045@oak.pl> <20071120065334.GJ29432@insomnia.benzedrine.cx> <20071120095041.GJ2045@oak.pl> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20071120095041.GJ2045@oak.pl> User-Agent: Mutt/1.5.12-2006-07-14 Cc: freebsd-stable@freebsd.org, freebsd-pf@freebsd.org Subject: Re: pf(4) using inapropriate timeout values, 6.2-R X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Nov 2007 10:20:59 -0000 On Tue, Nov 20, 2007 at 10:50:41AM +0100, Jan Srzednicki wrote: > And the state becomes: > > self tcp MY_IP_HERE:12525 <- MY_IP_HERE:64829 ESTABLISHED:FIN_WAIT_2 > [390096685 + 66608] wscale 1 [3173294128 + 66608] wscale 1 > age 00:00:04, expires in 00:00:05, 4:3 pkts, 441:168 bytes, rule 30 > id: 47207d980002e600 creatorid: 082298e6 > self tcp MY_IP_HERE:64829 -> MY_IP_HERE:12525 FIN_WAIT_2:ESTABLISHED > [3173294128 + 66608] wscale 1 [390096685 + 66608] wscale 1 > age 00:00:04, expires in 00:00:05, 4:3 pkts, 441:168 bytes, rule 30 > id: 47207d980002e5ff creatorid: 082298e6 That's fine so far, ESTABLISHED:FIN_WAIT_2 is correct in this case. Look at your /usr/src/sys/contrib/pf/net/pf.c, in pf_test_state_tcp() there's a section like /* update expire time */ (*state)->expire = time_second; if (src->state >= TCPS_FIN_WAIT_2 && dst->state >= TCPS_FIN_WAIT_2) (*state)->timeout = PFTM_TCP_CLOSED; else if (src->state >= TCPS_CLOSING && dst->state >= TCPS_CLOSING) (*state)->timeout = PFTM_TCP_FIN_WAIT; else if (src->state < TCPS_ESTABLISHED || dst->state < TCPS_ESTABLISHED) (*state)->timeout = PFTM_TCP_OPENING; else if (src->state >= TCPS_CLOSING || dst->state >= TCPS_CLOSING) (*state)->timeout = PFTM_TCP_CLOSING; else (*state)->timeout = PFTM_TCP_ESTABLISHED; In 6.2-release this was, according to http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/contrib/pf/net/pf.c?rev=1.34.2.4;content-type=text%2Fplain /* update expire time */ (*state)->expire = time_second; if (src->state >= TCPS_FIN_WAIT_2 && dst->state >= TCPS_FIN_WAIT_2) (*state)->timeout = PFTM_TCP_CLOSED; else if (src->state >= TCPS_FIN_WAIT_2 || dst->state >= TCPS_FIN_WAIT_2) (*state)->timeout = PFTM_TCP_FIN_WAIT; else if (src->state < TCPS_ESTABLISHED || dst->state < TCPS_ESTABLISHED) (*state)->timeout = PFTM_TCP_OPENING; else if (src->state >= TCPS_CLOSING || dst->state >= TCPS_CLOSING) (*state)->timeout = PFTM_TCP_CLOSING; else (*state)->timeout = PFTM_TCP_ESTABLISHED; Note the slight difference, which explains your observations. It looks like this change was never backported/merged to RELENG_6. Try the newer (first) version, it should resolve your problem. Daniel