Date: Tue, 20 Nov 2007 11:20:56 +0100 From: Daniel Hartmeier <daniel@benzedrine.cx> To: Jan Srzednicki <w@wrzask.pl> Cc: freebsd-stable@freebsd.org, freebsd-pf@freebsd.org Subject: Re: pf(4) using inapropriate timeout values, 6.2-R Message-ID: <20071120102056.GK29432@insomnia.benzedrine.cx> In-Reply-To: <20071120095041.GJ2045@oak.pl> References: <20071119202142.GI2045@oak.pl> <20071120065334.GJ29432@insomnia.benzedrine.cx> <20071120095041.GJ2045@oak.pl>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Nov 20, 2007 at 10:50:41AM +0100, Jan Srzednicki wrote: > And the state becomes: > > self tcp MY_IP_HERE:12525 <- MY_IP_HERE:64829 ESTABLISHED:FIN_WAIT_2 > [390096685 + 66608] wscale 1 [3173294128 + 66608] wscale 1 > age 00:00:04, expires in 00:00:05, 4:3 pkts, 441:168 bytes, rule 30 > id: 47207d980002e600 creatorid: 082298e6 > self tcp MY_IP_HERE:64829 -> MY_IP_HERE:12525 FIN_WAIT_2:ESTABLISHED > [3173294128 + 66608] wscale 1 [390096685 + 66608] wscale 1 > age 00:00:04, expires in 00:00:05, 4:3 pkts, 441:168 bytes, rule 30 > id: 47207d980002e5ff creatorid: 082298e6 That's fine so far, ESTABLISHED:FIN_WAIT_2 is correct in this case. Look at your /usr/src/sys/contrib/pf/net/pf.c, in pf_test_state_tcp() there's a section like /* update expire time */ (*state)->expire = time_second; if (src->state >= TCPS_FIN_WAIT_2 && dst->state >= TCPS_FIN_WAIT_2) (*state)->timeout = PFTM_TCP_CLOSED; else if (src->state >= TCPS_CLOSING && dst->state >= TCPS_CLOSING) (*state)->timeout = PFTM_TCP_FIN_WAIT; else if (src->state < TCPS_ESTABLISHED || dst->state < TCPS_ESTABLISHED) (*state)->timeout = PFTM_TCP_OPENING; else if (src->state >= TCPS_CLOSING || dst->state >= TCPS_CLOSING) (*state)->timeout = PFTM_TCP_CLOSING; else (*state)->timeout = PFTM_TCP_ESTABLISHED; In 6.2-release this was, according to http://www.freebsd.org/cgi/cvsweb.cgi/src/sys/contrib/pf/net/pf.c?rev=1.34.2.4;content-type=text%2Fplain /* update expire time */ (*state)->expire = time_second; if (src->state >= TCPS_FIN_WAIT_2 && dst->state >= TCPS_FIN_WAIT_2) (*state)->timeout = PFTM_TCP_CLOSED; else if (src->state >= TCPS_FIN_WAIT_2 || dst->state >= TCPS_FIN_WAIT_2) (*state)->timeout = PFTM_TCP_FIN_WAIT; else if (src->state < TCPS_ESTABLISHED || dst->state < TCPS_ESTABLISHED) (*state)->timeout = PFTM_TCP_OPENING; else if (src->state >= TCPS_CLOSING || dst->state >= TCPS_CLOSING) (*state)->timeout = PFTM_TCP_CLOSING; else (*state)->timeout = PFTM_TCP_ESTABLISHED; Note the slight difference, which explains your observations. It looks like this change was never backported/merged to RELENG_6. Try the newer (first) version, it should resolve your problem. Daniel
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20071120102056.GK29432>