From owner-freebsd-net@FreeBSD.ORG  Sat Nov 27 12:01:52 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 3B12E16A4CE; Sat, 27 Nov 2004 12:01:52 +0000 (GMT)
Received: from insomnia.benzedrine.cx (insomnia.benzedrine.cx [62.65.145.30])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 6292743D5D; Sat, 27 Nov 2004 12:01:51 +0000 (GMT)
	(envelope-from dhartmei@insomnia.benzedrine.cx)
Received: from insomnia.benzedrine.cx (dhartmei@localhost [127.0.0.1])
	iARC1nMZ022263
	(version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO);
	Sat, 27 Nov 2004 13:01:50 +0100 (MET)
Received: (from dhartmei@localhost)
	by insomnia.benzedrine.cx (8.13.1/8.12.10/Submit) id iARC1n57008056;
	Sat, 27 Nov 2004 13:01:49 +0100 (MET)
Date: Sat, 27 Nov 2004 13:01:49 +0100
From: Daniel Hartmeier <daniel@benzedrine.cx>
To: freebsd-net@freebsd.org, freebsd-current@freebsd.org
Message-ID: <20041127120149.GE23786@insomnia.benzedrine.cx>
References: <20041126203354.GB81834@astral-on.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20041126203354.GB81834@astral-on.net>
User-Agent: Mutt/1.4.1i
Subject: Re: rsh is malfunctioning due to pf
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 27 Nov 2004 12:01:52 -0000

On Fri, Nov 26, 2004 at 10:33:54PM +0200, Andrew Degtiariov wrote:

> I have ipcad installed on 2 PC's running 5.3-RELEASE and 5-STABLE from
> Nov 21. ipcad (ports/net-mgmt/ipcad) provides ability to control them
> by rsh (ipcad implement rsh server by yourself). While using pf with
> primitive rulesets rsh stops its working. It seems like pf drop short
> packets.

The 'short' reason is a little overloaded, it can have two meanings.
The less likely case is where the mbuf didn't contain a complete IP
header. More likely, the packet contains IP options, which pf blocks by
default. You can isolate the problem by

  a) enabling debug logging with pfctl -xm and watching the console
     or /var/log/messages for messages from 'pf: '
  b) dumping an entire packet that is being blocked, with
     tcpdump -s 1600 -nvvvetttSXi pflog0
  c) adding 'allow-opts' to all your pass rules and see if the problem
     goes away

Daniel