From owner-freebsd-pf@freebsd.org  Fri May 20 08:53:52 2016
Return-Path: <owner-freebsd-pf@freebsd.org>
Delivered-To: freebsd-pf@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id E6F08B43ABF
 for <freebsd-pf@mailman.ysv.freebsd.org>; Fri, 20 May 2016 08:53:52 +0000 (UTC)
 (envelope-from kp@FreeBSD.org)
Received: from venus.codepro.be (venus.codepro.be [IPv6:2a01:4f8:162:1127::2])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256
 bits))
 (Client CN "*.codepro.be", Issuer "Gandi Standard SSL CA 2" (verified OK))
 by mx1.freebsd.org (Postfix) with ESMTPS id B68321FBC
 for <freebsd-pf@FreeBSD.org>; Fri, 20 May 2016 08:53:52 +0000 (UTC)
 (envelope-from kp@FreeBSD.org)
Received: from [192.168.228.1] (unknown [45.113.64.253])
 (Authenticated sender: kp)
 by venus.codepro.be (Postfix) with ESMTPSA id 639C29736;
 Fri, 20 May 2016 10:53:47 +0200 (CEST)
From: "Kristof Provost" <kp@FreeBSD.org>
To: Max <maximos@als.nnov.ru>
Cc: freebsd-pf@FreeBSD.org
Subject: Re: fragments processing
Date: Fri, 20 May 2016 14:23:42 +0530
Message-ID: <0ED6BC86-1DDF-4C80-9C05-6ED19049AB92@FreeBSD.org>
In-Reply-To: <93ccf602-31d6-fe36-4ccc-96ab1a1e2cc1@als.nnov.ru>
References: <93ccf602-31d6-fe36-4ccc-96ab1a1e2cc1@als.nnov.ru>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Mailer: MailMate Trial (1.9.4r5234)
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
 \(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf/>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 20 May 2016 08:53:53 -0000

Hi Max,


On 19 May 2016, at 19:49, Max wrote:
> The number of used frags (almost) never decreases. I don't have enough 
> experience in programming. But I guess that the problem may be in 
> "frag->fr_timeout = time_second;" in pf_fillup_fragment() (pf_norm.c). 
> It should be "frag->fr_timeout = time_uptime;". Actually, I don't now 
> the difference between those variables. So, correct me if I'm wrong.
>
I think you’re right. If I’m reading the code right time_second is 
unix time,
but time_uptime is the number of seconds the system has been up.

Either one should work, but we have to be consistent.
The rest of the code seems to use time_uptime, so this untested patch 
should fix your problem.

diff --git a/sys/netpfil/pf/pf_norm.c b/sys/netpfil/pf/pf_norm.c
index a2841a2..dbc8818 100644
--- a/sys/netpfil/pf/pf_norm.c
+++ b/sys/netpfil/pf/pf_norm.c
@@ -374,7 +374,7 @@ pf_fillup_fragment(struct pf_fragment_cmp *key, 
struct pf_frent *frent,
                 }

                 *(struct pf_fragment_cmp *)frag = *key;
-               frag->fr_timeout = time_second;
+               frag->fr_timeout = time_uptime;
                 frag->fr_maxlen = frent->fe_len;
                 TAILQ_INIT(&frag->fr_queue);

> P.P.S. I confirm the bug 
> https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=201519.

It’s on my list, but unfortunately it’s a very long list.

Regards,
Kristof