Date: Fri, 19 Nov 2021 18:54:18 +0100 From: Kurt Jaeger <pi@freebsd.org> To: "Andrey V. Elsukov" <bu7cher@yandex.ru> Cc: tuexen@freebsd.org, freebsd-net@freebsd.org Subject: Workaround: Re: dtrace to trace incoming connection not suceeding ? Message-ID: <YZfkyisWEabI1/Vj@fc.opsec.eu> In-Reply-To: <YZFKPIEROC1cwcOQ@fc.opsec.eu> References: <YY5nhomjYRnRojwa-v2@fc.opsec.eu> <866D4765-25EF-4C5F-AA2E-D6BE8D5EBEEB@freebsd.org> <YY6C2/OyG3KTvV%2BM@fc.opsec.eu> <43FC040E-E5DE-4F4E-B91E-AAA807207D05@freebsd.org> <YY6ITiq%2B8x5nw5a/@fc.opsec.eu> <36CCF1D0-34EE-4E1C-B593-71CF936F4DE7@freebsd.org> <YY6k1JzP4EbKCF7m@fc.opsec.eu> <eec5880e-3164-f0a2-3748-687098de3026@yandex.ru> <YZFKPIEROC1cwcOQ@fc.opsec.eu>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi! > > > There's one small diff between the two that I do not understand: > > > - 18040 times no signature provided by segment > > > + 18045 times no signature provided by segment > > > > This means, that received TCP segment has not TCP-MD5 signature, but > > listen socket expects it. Such SYN segment will be dropped by syncache > > code. Probably your BGP daemon configured to use TCP-MD5 for connection, > > but remote side does not. > > Thanks, that might be another possible cause. Thanks to your pointer, analysis done by KlaraSystems shows that the problem seems to be like this: frr has this open socket where it listens on incoming tcp/179: tcp4 0 0 *.179 *.* LISTEN tcp6 0 0 *.179 *.* LISTEN The problem starts sometime after FreeBSD 12.1p8, when some of the bgp peers have tcp-md5 set and others have not. If any bgp peer has tcp-md5, it seems, some (all?) non-tcp-md5 secured bgp peers will fail to connect, until a tcp-md5 secret is configured. Therefore, we can use this workaround for now and investigate frr and/or FreeBSD for a proper fix without too much hurry. -- pi@FreeBSD.org +49 171 3101372 Now what ?
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?YZfkyisWEabI1/Vj>