Date: Wed, 24 Jan 2024 14:27:19 +0100 From: Kristof Provost <kp@FreeBSD.org> To: "Herbert J. Skuhra" <herbert@gojira.at> Cc: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: Re: git: 54c62e3e5d8c - main - pf: work around icmp6 packet-too-big not being sent when binat-ing Message-ID: <880FAE40-9D91-4AA6-92BA-2D582D23B745@FreeBSD.org> In-Reply-To: <87sf2nm4et.wl-herbert@gojira.at> References: <202401221252.40MCqpf6047526@gitrepo.freebsd.org> <87v87jkii9.wl-herbert@gojira.at> <1E1C3472-0AF3-457B-A27A-89679770EA62@FreeBSD.org> <87sf2nm4et.wl-herbert@gojira.at>
next in thread | previous in thread | raw e-mail | index | archive | help
--=_MailMate_8499D0A2-F28D-49C8-9CAD-F3540B67C559_= Content-Type: text/plain; format=flowed Content-Transfer-Encoding: quoted-printable On 24 Jan 2024, at 11:06, Herbert J. Skuhra wrote: > On Tue, 23 Jan 2024 19:42:10 +0100, Kristof Provost wrote: >> On 23 Jan 2024, at 19:32, Herbert J. Skuhra wrote: >>> On Mon, 22 Jan 2024 13:52:51 +0100, Kristof Provost wrote: >>>> >>>> The branch main has been updated by kp: >>>> >>>> URL: = >>>> https://cgit.FreeBSD.org/src/commit/?id=3D54c62e3e5d8cd90c5571a1d4c8= c5f062d580480e >>>> >>>> commit 54c62e3e5d8cd90c5571a1d4c8c5f062d580480e >>>> Author: Kristof Provost <kp@FreeBSD.org> >>>> AuthorDate: 2024-01-17 17:11:27 +0000 >>>> Commit: Kristof Provost <kp@FreeBSD.org> >>>> CommitDate: 2024-01-22 11:52:14 +0000 >>>> >>>> pf: work around icmp6 packet-too-big not being sent when = >>>> binat-ing >>>> >>>> If we're applying NPTv6 we pass a packet with a modified source = >>>> and/or >>>> destination address to the network stack. >>>> >>>> If that packet then turns out to be larger than the MTU of the = >>>> sending >>>> interface the stack will attempt to generate an icmp6 = >>>> packet-too-big >>>> error, but may fail to look up the appropriate source address = >>>> for that >>>> error message. Even if it does, pf would still have to undo the = >>>> binat >>>> operation inside the icmp6 packet so the sending host can make = >>>> sense of >>>> the error. >>>> >>>> We can avoid both problems entirely by having pf also perform = >>>> the MTU >>>> check (taking the potential refragmentation into account), and >>>> generating the icmp6 error directly in pf. >>>> >>>> See also: https://redmine.pfsense.org/issues/14290 >>>> Sponsored by: Rubicon Communications, LLC ("Netgate") >>>> Differential Revision: https://reviews.freebsd.org/D43499 >>>> --- >>>> sys/net/pfvar.h | 1 + >>>> sys/netpfil/pf/pf.c | 12 ++++++++++++ >>>> sys/netpfil/pf/pf_norm.c | 15 +++++++++++++++ >>>> 3 files changed, 28 insertions(+) >>> >>> Does this change cause problems for others too? >>> >>> - ssh over IPv6 permanently disconnecting >>> (client_loop: send disconnect: Broken pipe) >>> - ssh connections over IPv6 hanging >>> - git pull not working >>> Fssh_ssh_dispatch_run_fatal: Connection to = >>> 2604:1380:4091:a001::24ca:1 port 22: Permission denied >>> fatal: Could not read from remote repository. >>> >> Can you include your pf.conf and a packet capture demonstrating one = >> of these issues? > > So I assume this issue affects only me or this server (igb nic). > Disabling tso6 seems to resolve the issue. > Ah. A Clue(tm)! Try this: diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 38a5a45d7991..2dc6d02d330a 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -8515,7 +8515,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, = struct mbuf **m0, struct inpcb * confused and fail to send the icmp6 packet too big error. = Just send * it here, before we do any NAT. */ - if (dir =3D=3D PF_OUT && IN6_LINKMTU(ifp) < pf_max_frag_size(m))= { + if (dir =3D=3D PF_OUT && pflags & PFIL_FWD && IN6_LINKMTU(ifp) <= = pf_max_frag_size(m)) { PF_RULES_RUNLOCK(); *m0 =3D NULL; icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, = IN6_LINKMTU(ifp)); Best regards, Kristof --=_MailMate_8499D0A2-F28D-49C8-9CAD-F3540B67C559_= Content-Type: text/html Content-Transfer-Encoding: quoted-printable <!DOCTYPE html> <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/xhtml; charset=3Dutf-8"= > </head> <body><div style=3D"font-family: sans-serif;"><div class=3D"markdown" sty= le=3D"white-space: normal;"> <p dir=3D"auto">On 24 Jan 2024, at 11:06, Herbert J. Skuhra wrote:</p> </div><div class=3D"plaintext" style=3D"white-space: normal;"><blockquote= style=3D"margin: 0 0 5px; padding-left: 5px; border-left: 2px solid #136= BCE; color: #136BCE;"><p dir=3D"auto">On Tue, 23 Jan 2024 19:42:10 +0100,= Kristof Provost wrote:</p> <blockquote style=3D"margin: 0 0 5px; padding-left: 5px; border-left: 2px= solid #136BCE; border-left-color: #4B89CF; color: #4B89CF;"><p dir=3D"au= to">On 23 Jan 2024, at 19:32, Herbert J. Skuhra wrote:</p> <blockquote style=3D"margin: 0 0 5px; padding-left: 5px; border-left: 2px= solid #136BCE; border-left-color: #4B89CF; color: #4B89CF;"><p dir=3D"au= to">On Mon, 22 Jan 2024 13:52:51 +0100, Kristof Provost wrote:</p> <blockquote style=3D"margin: 0 0 5px; padding-left: 5px; border-left: 2px= solid #136BCE; border-left-color: #4B89CF; color: #4B89CF;"><p dir=3D"au= to">The branch main has been updated by kp:</p> <p dir=3D"auto">URL: <a href=3D"https://cgit.FreeBSD.org/src/commit/?id=3D= 54c62e3e5d8cd90c5571a1d4c8c5f062d580480e">https://cgit.FreeBSD.org/src/co= mmit/?id=3D54c62e3e5d8cd90c5571a1d4c8c5f062d580480e</a></p> <p dir=3D"auto">commit 54c62e3e5d8cd90c5571a1d4c8c5f062d580480e <br> Author: Kristof Provost <kp@FreeBSD.org> <br> AuthorDate: 2024-01-17 17:11:27 +0000 <br> Commit: Kristof Provost <kp@FreeBSD.org> <br> CommitDate: 2024-01-22 11:52:14 +0000</p> <p dir=3D"auto"> pf: work around icmp6 packet-too-big not being sent w= hen binat-ing</p> <p dir=3D"auto"> If we're applying NPTv6 we pass a packet with a modif= ied source and/or <br> destination address to the network stack.</p> <p dir=3D"auto"> If that packet then turns out to be larger than the M= TU of the sending <br> interface the stack will attempt to generate an icmp6 packet-too-big <br> error, but may fail to look up the appropriate source address for tha= t <br> error message. Even if it does, pf would still have to undo the binat= <br> operation inside the icmp6 packet so the sending host can make sense = of <br> the error.</p> <p dir=3D"auto"> We can avoid both problems entirely by having pf also= perform the MTU <br> check (taking the potential refragmentation into account), and <br> generating the icmp6 error directly in pf.</p> <p dir=3D"auto"> See also: <a href=3D"https://redmine.pfsense.or= g/issues/14290">https://redmine.pfsense.org/issues/14290</a>; <br> Sponsored by: Rubicon Communications, LLC ("Netgate") <br> Differential Revision: <a href=3D"https://reviews.freebsd.org/D43499= ">https://reviews.freebsd.org/D43499</a>; <br> --- <br> sys/net/pfvar.h | 1 + <br> sys/netpfil/pf/pf.c | 12 ++++++++++++ <br> sys/netpfil/pf/pf_norm.c | 15 +++++++++++++++ <br> 3 files changed, 28 insertions(+)</p> </blockquote><p dir=3D"auto">Does this change cause problems for others t= oo?</p> <p dir=3D"auto">- ssh over IPv6 permanently disconnecting <br> (client_loop: send disconnect: Broken pipe) <br> - ssh connections over IPv6 hanging <br> - git pull not working <br> Fssh_ssh_dispatch_run_fatal: Connection to 2604:1380:4091:a001::24ca:1 po= rt 22: Permission denied <br> fatal: Could not read from remote repository.</p> </blockquote><p dir=3D"auto">Can you include your pf.conf and a packet ca= pture demonstrating one of these issues?</p> </blockquote><p dir=3D"auto">So I assume this issue affects only me or th= is server (igb nic). <br> Disabling tso6 seems to resolve the issue.</p> <br></blockquote></div> <div class=3D"markdown" style=3D"white-space: normal;"> <p dir=3D"auto">Ah. A Clue(tm)!</p> <p dir=3D"auto">Try this:</p> <pre style=3D"margin-left: 15px; margin-right: 15px; padding: 5px; border= : thin solid gray; overflow-x: auto; max-width: 90vw; background-color: #= E4E4E4;"><code style=3D"padding: 0 0.25em; background-color: #E4E4E4;">di= ff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 38a5a45d7991..2dc6d02d330a 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -8515,7 +8515,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, st= ruct mbuf **m0, struct inpcb * confused and fail to send the icmp6 packet too big error. Just= send * it here, before we do any NAT. */ - if (dir =3D=3D PF_OUT && IN6_LINKMTU(ifp) < pf_max_fra= g_size(m)) { + if (dir =3D=3D PF_OUT && pflags & PFIL_FWD &&= IN6_LINKMTU(ifp) < pf_max_frag_size(m)) { PF_RULES_RUNLOCK(); *m0 =3D NULL; icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, IN6_LINKMTU(ifp))= ; </code></pre> <p dir=3D"auto">Best regards,<br> Kristof</p> </div> </div> </body> </html> --=_MailMate_8499D0A2-F28D-49C8-9CAD-F3540B67C559_=--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?880FAE40-9D91-4AA6-92BA-2D582D23B745>