From owner-freebsd-pf@FreeBSD.ORG  Fri Jul 21 08:57:39 2006
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id D19EA16A4DE;
	Fri, 21 Jul 2006 08:57:39 +0000 (UTC)
	(envelope-from mime@traveller.cz)
Received: from ss.eunet.cz (ss.eunet.cz [193.85.228.13])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 4732C43D49;
	Fri, 21 Jul 2006 08:57:38 +0000 (GMT)
	(envelope-from mime@traveller.cz)
Received: from localhost.i.cz (ss.eunet.cz [193.85.228.13])
	by ss.eunet.cz (8.13.6/8.13.6) with ESMTP id k6L8vaF8030088
	(version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO);
	Fri, 21 Jul 2006 10:57:36 +0200 (CEST)
	(envelope-from mime@traveller.cz)
From: Michal Mertl <mime@traveller.cz>
To: Max Laier <max@love2party.net>
In-Reply-To: <200607210205.51614.max@love2party.net>
References: <1153410809.1126.66.camel@genius.i.cz>
	<200607210205.51614.max@love2party.net>
Content-Type: text/plain; charset=ISO-8859-2
Date: Fri, 21 Jul 2006 10:57:28 +0200
Message-Id: <1153472248.1140.13.camel@genius.i.cz>
Mime-Version: 1.0
X-Mailer: Evolution 2.6.1 FreeBSD GNOME Team Port 
Content-Transfer-Encoding: 8bit
Cc: freebsd-stable@freebsd.org, freebsd-pf@freebsd.org
Subject: Re: Kernel panic with PF
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 21 Jul 2006 08:57:39 -0000

Max Laier píše v pá 21. 07. 2006 v 02:05 +0200:
> [CC'ing -pf]
> 
> On Thursday 20 July 2006 17:53, Michal Mertl wrote:
> > Hello,
> >
> > I am deploying FreeBSD based application proxies' based firewall
> > (www.kernun.com, but not much English there) and am having frequent
> > panics of RELENG_6_1 under load. The server has IP forwarding disabled.
> >
> > I've got two machines in a carp cluster and the transparent proxies use
> > PF to get the data.
> 
> Which proxies are you using?  The "pool_ticket: 1429 != 1430" messages you 
> quote below indicate a synchronization problem within the app talking to pf 
> via ioctl's.  Tickets are used to ensure atomic commits for operations that 
> require more than one ioctl.  If your proxy app runs in parallel it might 
> screw up the internal state and thus leave it undefined afterwards.  I give 
> you that this shouldn't cause a kernel problem, but if we could fix the app 
> we can probably find the right sanity check more easily.

The proxy in fact runs in parallel (according to "pfctl -s info" it did
about 50 inserts and removal in the state table per second - some 10Mbit
of traffic, probably mostly HTTP) and it is quite possible that your
explanation is correct. I will forward your suspicion to the vendor.
This functionality of the software (using PF with anchors) is quite new
- they used different mechanisms in previous versions so it may well
have some bugs.

Thanks

Michal