From owner-freebsd-pf@freebsd.org Mon Feb 18 18:07:37 2019 Return-Path: Delivered-To: freebsd-pf@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 2364814E64A1 for ; Mon, 18 Feb 2019 18:07:37 +0000 (UTC) (envelope-from glebius@freebsd.org) Received: from cell.glebi.us (glebi.us [198.45.61.253]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) server-signature RSA-PSS (4096 bits) client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "cell.glebi.us", Issuer "cell.glebi.us" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 777CC759A5; Mon, 18 Feb 2019 18:07:36 +0000 (UTC) (envelope-from glebius@freebsd.org) Received: from cell.glebi.us (localhost [127.0.0.1]) by cell.glebi.us (8.15.2/8.15.2) with ESMTPS id x1II7T4c076215 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO); Mon, 18 Feb 2019 10:07:29 -0800 (PST) (envelope-from glebius@freebsd.org) Received: (from glebius@localhost) by cell.glebi.us (8.15.2/8.15.2/Submit) id x1II7T3f076214; Mon, 18 Feb 2019 10:07:29 -0800 (PST) (envelope-from glebius@freebsd.org) X-Authentication-Warning: cell.glebi.us: glebius set sender to glebius@freebsd.org using -f Date: Mon, 18 Feb 2019 10:07:29 -0800 From: Gleb Smirnoff To: Andreas Longwitz Cc: Konstantin Belousov , freebsd-pf@freebsd.org, Kristof Provost Subject: Re: rdr pass for proto tcp sometimes creates states with expire time zero and so breaking connections Message-ID: <20190218180729.GP83215@FreeBSD.org> References: <5BEB3B9A.9080402@incore.de> <20181113222533.GJ9744@FreeBSD.org> <5C49ECAA.7060505@incore.de> <20190124203802.GU24863@kib.kiev.ua> <5C4A37A1.80206@incore.de> <20190125131409.GZ24863@kib.kiev.ua> <5C557065.10600@incore.de> <20190202184208.GG24863@kib.kiev.ua> <5C6AEBB8.2030305@incore.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5C6AEBB8.2030305@incore.de> User-Agent: Mutt/1.10.1 (2018-07-13) X-Rspamd-Queue-Id: 777CC759A5 X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org X-Spamd-Result: default: False [-2.96 / 15.00]; local_wl_from(0.00)[freebsd.org]; NEURAL_HAM_MEDIUM(-1.00)[-0.999,0]; NEURAL_HAM_LONG(-1.00)[-0.999,0]; NEURAL_HAM_SHORT(-0.96)[-0.957,0]; ASN(0.00)[asn:2906, ipnet:198.45.48.0/20, country:US] X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Feb 2019 18:07:37 -0000 Thanks, Andreas! Kristof, will you handle that? If you are busy, I can try to refresh my memory. On Mon, Feb 18, 2019 at 06:30:32PM +0100, Andreas Longwitz wrote: A> Hello, A> A> > Ok, thanks, I will commit the patch shortly. I do not see a point in waiting A> > for two more weeks, sure report me if anything goes wrong. A> A> your patch for counter(9) on i386 definitely solves my problem discussed A> in this thread. A> A> Because fetching a counter is a rather expansive function we should use A> counter_u64_fetch() in pf_state_expires() only when necessary. A "rdr A> pass" rule should not cause more effort than separate "rdr" and "pass" A> rules. For rules with adaptive timeout values the call of A> counter_u64_fetch() should be accepted, but otherwise not. A> A> For a small gain in performance especially for "rdr pass" rules I A> suggest something like A> A> --- pf.c.orig 2019-02-18 17:49:22.944751000 +0100 A> +++ pf.c 2019-02-18 17:55:07.396163000 +0100 A> @@ -1558,7 +1558,7 @@ A> if (!timeout) A> timeout = V_pf_default_rule.timeout[state->timeout]; A> start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START]; A> - if (start) { A> + if (start && state->rule.ptr != &V_pf_default_rule) { A> end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END]; A> states = counter_u64_fetch(state->rule.ptr->states_cur); A> } else { A> A> -- A> Andreas A> -- Gleb Smirnoff