From owner-freebsd-stable@FreeBSD.ORG  Thu Sep  9 15:39:16 2010
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 30A9310656C6
	for <stable@freebsd.org>; Thu,  9 Sep 2010 15:39:16 +0000 (UTC)
	(envelope-from bsd@lordcow.org)
Received: from lordcow.org (lordcow.org [41.203.5.188])
	by mx1.freebsd.org (Postfix) with ESMTP id 58BEA8FC19
	for <stable@freebsd.org>; Thu,  9 Sep 2010 15:39:14 +0000 (UTC)
Received: from lordcow.org (localhost [127.0.0.1])
	by lordcow.org (8.14.4/8.14.4) with ESMTP id o89Fd7Pr028830
	(version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO)
	for <stable@freebsd.org>; Thu, 9 Sep 2010 17:39:07 +0200 (SAST)
	(envelope-from lordcow@lordcow.org)
Received: (from lordcow@localhost)
	by lordcow.org (8.14.4/8.14.4/Submit) id o89Fd25X028829
	for stable@freebsd.org; Thu, 9 Sep 2010 17:39:02 +0200 (SAST)
	(envelope-from lordcow)
Date: Thu, 9 Sep 2010 17:39:02 +0200
From: Gareth de Vaux <bsd@lordcow.org>
To: stable@freebsd.org
Message-ID: <20100909153902.GA28341@lordcow.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.4.2.3i
X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED
	autolearn=unavailable version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on lordcow.org
Cc: 
Subject: ipfw: Too many dynamic rules
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 09 Sep 2010 15:39:16 -0000

Hi again, I use some keep-state rules in ipfw, but get the following
kernel message:

kernel: ipfw: install_state: Too many dynamic rules

when presumably my state table reaches its limit (and I effectively
get DoS'd).

netstat shows tons of connections in FIN_WAIT_2 state, mostly to
my webserver. Consequently net.inet.ip.fw.dyn_count is large too.

I can increase my net.inet.ip.fw.dyn_max but the new limit will
simply be reached later on.

I currently get around this with a cronjob that sets
net.inet.ip.fw.dyn_keepalive to 0 for just less than 5 minutes
every night. If I leave it at 0 for longer or indefinitely then
idle ssh sessions and the like are dropped. This works fine for
me but it looks like there's some bug with net.inet.ip.fw.dyn_keepalive=1?
Or with Apache?

I'm using 8.1-STABLE, GENERIC kernel. Experienced the same behaviour
on 8.0-RELEASE, but not on 6.1-RELEASE where I had a similar setup. I
have a KeepAliveTimeout of 4 in Apache (2.2.16).