From owner-freebsd-stable@FreeBSD.ORG Tue Jul 10 19:59:48 2007 Return-Path: X-Original-To: freebsd-stable@freebsd.org Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id ABEAB16A421 for ; Tue, 10 Jul 2007 19:59:48 +0000 (UTC) (envelope-from Stephen.Clark@seclark.us) Received: from smtpout08.prod.mesa1.secureserver.net (smtpout08-04.prod.mesa1.secureserver.net [64.202.165.12]) by mx1.freebsd.org (Postfix) with SMTP id 7565613C43E for ; Tue, 10 Jul 2007 19:59:48 +0000 (UTC) (envelope-from Stephen.Clark@seclark.us) Received: (qmail 21538 invoked from network); 10 Jul 2007 19:59:47 -0000 Received: from unknown (24.144.77.243) by smtpout08-04.prod.mesa1.secureserver.net (64.202.165.12) with ESMTP; 10 Jul 2007 19:59:47 -0000 Message-ID: <4693E532.3060902@seclark.us> Date: Tue, 10 Jul 2007 15:59:46 -0400 From: Stephen Clark User-Agent: Mozilla/5.0 (X11; U; Linux 2.2.16-22smp i686; en-US; m18) Gecko/20010110 Netscape6/6.5 X-Accept-Language: en-us, en MIME-Version: 1.0 To: freebsd-stable@freebsd.org Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: plynn Subject: ipfilter 4.13 - http traffic going thru ftp proxy X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Stephen.Clark@seclark.us List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Jul 2007 19:59:48 -0000 Hello List, I posted a while ago that our testers of our network appliance were complaining that browsing was slower when using our appliance based on 6.x as compared to our appliance using 4.9 FreeBSD. Well it turns out they were right! After spending much time trying to figure out what was going on we discovered that all http traffic was being routed thru the ipf ftp proxy module. Does anyone know why this is happening? ******************************************************************************** Here is 4.9 ******************************************************************************** H101491# ipnat -l List of active MAP/Redirect filters: map rl1 from 192.168.1.0/24 to any -> 10.0.133.44/32 proxy port ftp ftp/tcp map rl1 from 192.168.1.0/24 to any -> 10.0.133.44/32 portmap tcp/udp 40000:60000 map rl1 from 192.168.1.0/24 to any -> 10.0.133.44/32 List of active sessions: MAP 192.168.1.9 2949 <- -> 10.0.133.44 40075 [64.154.83.47 80] MAP 192.168.1.9 2948 <- -> 10.0.133.44 40074 [209.67.78.5 80] MAP 192.168.1.9 2947 <- -> 10.0.133.44 40073 [216.168.252.103 443] MAP 192.168.1.9 2946 <- -> 10.0.133.44 40072 [65.243.74.133 80] MAP 192.168.1.9 2945 <- -> 10.0.133.44 40071 [216.168.252.103 443] MAP 192.168.1.9 2944 <- -> 10.0.133.44 40070 [66.155.171.116 80] MAP 192.168.1.9 2943 <- -> 10.0.133.44 40069 [64.9.212.6 80] MAP 192.168.1.9 2942 <- -> 10.0.133.44 40068 [209.104.135.123 80] MAP 192.168.1.9 2941 <- -> 10.0.133.44 40067 [65.243.74.133 80] MAP 192.168.1.9 2940 <- -> 10.0.133.44 40066 [65.243.74.133 80] MAP 192.168.1.9 2939 <- -> 10.0.133.44 40065 [65.243.74.133 80] MAP 192.168.1.9 2938 <- -> 10.0.133.44 40064 [216.239.51.95 80] MAP 192.168.1.9 2924 <- -> 10.0.133.44 40050 [64.233.169.99 80] MAP 192.168.1.9 2922 <- -> 10.0.133.44 40048 [64.233.169.99 80] MAP 192.168.1.9 2920 <- -> 10.0.133.44 40046 [64.233.169.147 80] MAP 192.168.1.9 1031 <- -> 10.0.133.44 40045 [198.6.1.2 53] MAP 192.168.1.9 2884 <- -> 10.0.133.44 40012 [207.159.120.157 80] ************************************************************************************ Here is 6.2 Notice in the mappings for port 80 the source port is not being mapped into the 40000:60000 range. Also notice that the ftp proxy thought it found something and dumps out some diags. ************************************************************************************ H101490# ipnat -l List of active MAP/Redirect filters: map rl1 from 192.168.1.0/24 to any -> 10.0.133.77/32 proxy port ftp ftp/tcp map rl1 from 192.168.1.0/24 to any -> 10.0.133.77/32 portmap tcp/udp 40000:60000 map rl1 from 192.168.1.0/24 to any -> 10.0.133.77/32 List of active sessions: MAP 192.168.1.88 1397 <- -> 10.0.133.77 1397 [64.154.83.47 80] MAP 192.168.1.88 1396 <- -> 10.0.133.77 1396 [209.67.78.5 80] MAP 192.168.1.88 1395 <- -> 10.0.133.77 1395 [216.168.252.103 443] MAP 192.168.1.88 1394 <- -> 10.0.133.77 1394 [216.168.252.103 443] MAP 192.168.1.88 1393 <- -> 10.0.133.77 1393 [65.243.74.144 80] MAP 192.168.1.88 1392 <- -> 10.0.133.77 1392 [65.243.74.144 80] MAP 192.168.1.88 1378 <- -> 10.0.133.77 1378 [64.233.169.103 80] proxy ftp/6 use -54 flags 0 proto 6 flags 0 bytes 0 pkts 0 data YES size 312 FTP Proxy: passok: 1 Client: seq 0 (ack 0) len 0 junk 0 cmds 0 buf [\000] Server: seq 2b451493 (ack 0) len 0 junk 0 cmds 0 buf [\000] MAP 192.168.1.88 1391 <- -> 10.0.133.77 1391 [65.205.8.52 80] MAP 192.168.1.88 1390 <- -> 10.0.133.77 1390 [65.203.229.71 80] MAP 192.168.1.88 1389 <- -> 10.0.133.77 1389 [72.247.8.26 80] MAP 192.168.1.88 1388 <- -> 10.0.133.77 1388 [216.239.51.93 80] MAP 192.168.1.88 1033 <- -> 10.0.133.77 40000 [198.6.1.2 53] -- "They that give up essential liberty to obtain temporary safety, deserve neither liberty nor safety." (Ben Franklin) "The course of history shows that as a government grows, liberty decreases." (Thomas Jefferson)