From owner-freebsd-pf@FreeBSD.ORG  Thu Mar 13 19:20:08 2008
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
Delivered-To: freebsd-pf@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 755EA1065671
	for <freebsd-pf@hub.freebsd.org>; Thu, 13 Mar 2008 19:20:08 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
	[IPv6:2001:4f8:fff6::28])
	by mx1.freebsd.org (Postfix) with ESMTP id 5EF458FC24
	for <freebsd-pf@hub.freebsd.org>; Thu, 13 Mar 2008 19:20:08 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1])
	by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id m2DJK8WZ004453
	for <freebsd-pf@freefall.freebsd.org>; Thu, 13 Mar 2008 19:20:08 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.14.2/8.14.1/Submit) id m2DJK8or004452;
	Thu, 13 Mar 2008 19:20:08 GMT (envelope-from gnats)
Date: Thu, 13 Mar 2008 19:20:08 GMT
Message-Id: <200803131920.m2DJK8or004452@freefall.freebsd.org>
To: freebsd-pf@FreeBSD.org
From: Laurent Frigault <lfrigault@agneau.org>
Cc: 
Subject: Re: kern/121668: connect randomly fails with EPERM with some pf
	rules
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: Laurent Frigault <lfrigault@agneau.org>
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 13 Mar 2008 19:20:08 -0000

The following reply was made to PR kern/121668; it has been noted by GNATS.

From: Laurent Frigault <lfrigault@agneau.org>
To: Kian Mohageri <kian@restek.wwu.edu>
Cc: bug-followup@FreeBSD.org
Subject: Re: kern/121668: connect randomly fails with EPERM with some pf rules
Date: Thu, 13 Mar 2008 20:16:58 +0100

 On Thu, Mar 13, 2008 at 11:29:52AM -0700, Kian Mohageri wrote:
 > Does state-mismatch counter increase when this happens (pfctl -si)?
 
 I re-run the teste and yes and the state-mismatch counter increase is
 exactly the number of connect failling with EPERM.
 
 > I remember similar behavior and it was caused by source port reuse on
 > the client (so the new connection caused a state mismatch on an old
 > state).
 
 The previous connection are closed.
 If the source port can't be reused yet, then the kernel should use an
 other one for the new connection. If it can, then pf should allow it.
 
 If the connect (SYN) does not match an existing state, The pf rule
 should create a new state. 
 
 Am I wrong ?
 
 I don't fixe the source port in my sample and mysql client don't either.
 
 How can I work around this ?
 
 Regards,
 -- 
 Laurent Frigault | <url:http://www.agneau.org/>