From nobody Wed Jan 24 13:27:19 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4TKlB26v2lz58GJM; Wed, 24 Jan 2024 13:27:22 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: from smtp.freebsd.org (smtp.freebsd.org [IPv6:2610:1c1:1:606c::24b:4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4TKlB26K7xz4Z86; Wed, 24 Jan 2024 13:27:22 +0000 (UTC) (envelope-from kp@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1706102842; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=vBs9/LnhFF35E+9r6CPKScxbrDKob4NOa5erLXgFL0c=; b=DrloTmUGZ/wNODHtuqCw00/YJ2aDF806NGmVnM3V4VTJhdy2RMmI0TjNy0MyKXFXstP+UG DQVbMsqwlGjr/WTPB7ysYR7vwTTgHJArmObwvvcZnaqNi1L52ZrSM1lmjLBrR1qs7OqSHi OlcX0mNjQE4g7Dw8a/u/P15rGxB7L9QC2J5HGHcYh2pixPfhqVjSylysoebv4V0aT4xuqB UzXpV5QrNDN1IialW5sfy/rYZEumjcCM6qDuCHPsJesjfR61pMdVb1c0yLF1vuO7trnveY 51aEPyDpIfFsjmImw8OLv6lSZ8oh8aMMnh8FyUIr+bgDDXV90KcPs594YSXAhg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1706102842; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=vBs9/LnhFF35E+9r6CPKScxbrDKob4NOa5erLXgFL0c=; b=yVbxA0RoFtHC6LDQG4B01TZYvearhoPxGypieBk280fQGe7d3lMpsHOcS09Z3REpnOQZIQ NEZEu0lqGjCkpeHofGzvNYVEAXgdDIc5QEthulDfku+6G7pif9y8H5fGUl4iO25olH6SGJ 9pZKjWOWOu6paLRQUl8piXiB2brYrH4JgZ9Mx74FqkinnVWUIH1357fW+LjzpfBaSvi+S7 vxWchbaHlSa/HeIIe7Mo0mqp/Ej8yH//MLS+0YyteITLWb5SuRPbUnRxFKVbFpkYltk9ho 2DqOkjptG78HiqBcSEOPp6IpeVVtUyAIve65mnjqHmY/JAjDBtAteI3sWoZFUA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1706102842; a=rsa-sha256; cv=none; b=DzCPEaWSwJzvPkNrkL7QFvbaNBqEDq5p8FNeYTdKPYKx85bP79uUKFpLHyJbkOaF6qJuHb +tPZkhvtV8Cdp2IUU6gEnkAWPk1gj1v6tv2XuBFEVRWgpL+4c8oVjvHeRb8wn6wwyeI70x CDPu3vX5I/FgIXmxUI0sD4nHJ5mKLFOJ+HdTK/F2fneZvRDr6/oWC6zy3cjSB+6fCcnv1f 1v2eYzbTIWK6FMnvMko7/dM5Bz5TlyULgFNjmvy4XYObTgG8vbydAVFkSCW5K95nO+UAsP YBA6khAYup1jM+CGIXMFxthcweTdryAeCv84olOtxA7vG4k0wLSqLoOtLA2ehQ== Received: from venus.codepro.be (venus.codepro.be [5.9.86.228]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "mx1.codepro.be", Issuer "R3" (verified OK)) (Authenticated sender: kp) by smtp.freebsd.org (Postfix) with ESMTPSA id 4TKlB23mKSzXMd; Wed, 24 Jan 2024 13:27:22 +0000 (UTC) (envelope-from kp@FreeBSD.org) Received: by venus.codepro.be (Postfix, authenticated sender kp) id B1FE5138E4; Wed, 24 Jan 2024 14:27:20 +0100 (CET) From: Kristof Provost To: "Herbert J. Skuhra" Cc: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: Re: git: 54c62e3e5d8c - main - pf: work around icmp6 packet-too-big not being sent when binat-ing Date: Wed, 24 Jan 2024 14:27:19 +0100 X-Mailer: MailMate (1.14r5937) Message-ID: <880FAE40-9D91-4AA6-92BA-2D582D23B745@FreeBSD.org> In-Reply-To: <87sf2nm4et.wl-herbert@gojira.at> References: <202401221252.40MCqpf6047526@gitrepo.freebsd.org> <87v87jkii9.wl-herbert@gojira.at> <1E1C3472-0AF3-457B-A27A-89679770EA62@FreeBSD.org> <87sf2nm4et.wl-herbert@gojira.at> List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="=_MailMate_8499D0A2-F28D-49C8-9CAD-F3540B67C559_=" --=_MailMate_8499D0A2-F28D-49C8-9CAD-F3540B67C559_= Content-Type: text/plain; format=flowed Content-Transfer-Encoding: quoted-printable On 24 Jan 2024, at 11:06, Herbert J. Skuhra wrote: > On Tue, 23 Jan 2024 19:42:10 +0100, Kristof Provost wrote: >> On 23 Jan 2024, at 19:32, Herbert J. Skuhra wrote: >>> On Mon, 22 Jan 2024 13:52:51 +0100, Kristof Provost wrote: >>>> >>>> The branch main has been updated by kp: >>>> >>>> URL: = >>>> https://cgit.FreeBSD.org/src/commit/?id=3D54c62e3e5d8cd90c5571a1d4c8= c5f062d580480e >>>> >>>> commit 54c62e3e5d8cd90c5571a1d4c8c5f062d580480e >>>> Author: Kristof Provost >>>> AuthorDate: 2024-01-17 17:11:27 +0000 >>>> Commit: Kristof Provost >>>> CommitDate: 2024-01-22 11:52:14 +0000 >>>> >>>> pf: work around icmp6 packet-too-big not being sent when = >>>> binat-ing >>>> >>>> If we're applying NPTv6 we pass a packet with a modified source = >>>> and/or >>>> destination address to the network stack. >>>> >>>> If that packet then turns out to be larger than the MTU of the = >>>> sending >>>> interface the stack will attempt to generate an icmp6 = >>>> packet-too-big >>>> error, but may fail to look up the appropriate source address = >>>> for that >>>> error message. Even if it does, pf would still have to undo the = >>>> binat >>>> operation inside the icmp6 packet so the sending host can make = >>>> sense of >>>> the error. >>>> >>>> We can avoid both problems entirely by having pf also perform = >>>> the MTU >>>> check (taking the potential refragmentation into account), and >>>> generating the icmp6 error directly in pf. >>>> >>>> See also: https://redmine.pfsense.org/issues/14290 >>>> Sponsored by: Rubicon Communications, LLC ("Netgate") >>>> Differential Revision: https://reviews.freebsd.org/D43499 >>>> --- >>>> sys/net/pfvar.h | 1 + >>>> sys/netpfil/pf/pf.c | 12 ++++++++++++ >>>> sys/netpfil/pf/pf_norm.c | 15 +++++++++++++++ >>>> 3 files changed, 28 insertions(+) >>> >>> Does this change cause problems for others too? >>> >>> - ssh over IPv6 permanently disconnecting >>> (client_loop: send disconnect: Broken pipe) >>> - ssh connections over IPv6 hanging >>> - git pull not working >>> Fssh_ssh_dispatch_run_fatal: Connection to = >>> 2604:1380:4091:a001::24ca:1 port 22: Permission denied >>> fatal: Could not read from remote repository. >>> >> Can you include your pf.conf and a packet capture demonstrating one = >> of these issues? > > So I assume this issue affects only me or this server (igb nic). > Disabling tso6 seems to resolve the issue. > Ah. A Clue(tm)! Try this: diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 38a5a45d7991..2dc6d02d330a 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -8515,7 +8515,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, = struct mbuf **m0, struct inpcb * confused and fail to send the icmp6 packet too big error. = Just send * it here, before we do any NAT. */ - if (dir =3D=3D PF_OUT && IN6_LINKMTU(ifp) < pf_max_frag_size(m))= { + if (dir =3D=3D PF_OUT && pflags & PFIL_FWD && IN6_LINKMTU(ifp) <= = pf_max_frag_size(m)) { PF_RULES_RUNLOCK(); *m0 =3D NULL; icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, = IN6_LINKMTU(ifp)); Best regards, Kristof --=_MailMate_8499D0A2-F28D-49C8-9CAD-F3540B67C559_= Content-Type: text/html Content-Transfer-Encoding: quoted-printable

On 24 Jan 2024, at 11:06, Herbert J. Skuhra wrote:

On Tue, 23 Jan 2024 19:42:10 +0100,= Kristof Provost wrote:

On 23 Jan 2024, at 19:32, Herbert J. Skuhra wrote:

On Mon, 22 Jan 2024 13:52:51 +0100, Kristof Provost wrote:

The branch main has been updated by kp:

URL: https://cgit.FreeBSD.org/src/co= mmit/?id=3D54c62e3e5d8cd90c5571a1d4c8c5f062d580480e

commit 54c62e3e5d8cd90c5571a1d4c8c5f062d580480e
Author: Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2024-01-17 17:11:27 +0000
Commit: Kristof Provost <kp@FreeBSD.org>
CommitDate: 2024-01-22 11:52:14 +0000

pf: work around icmp6 packet-too-big not being sent w= hen binat-ing

If we're applying NPTv6 we pass a packet with a modif= ied source and/or
destination address to the network stack.

If that packet then turns out to be larger than the M= TU of the sending
interface the stack will attempt to generate an icmp6 packet-too-big
error, but may fail to look up the appropriate source address for tha= t
error message. Even if it does, pf would still have to undo the binat=
operation inside the icmp6 packet so the sending host can make sense = of
the error.

We can avoid both problems entirely by having pf also= perform the MTU
check (taking the potential refragmentation into account), and
generating the icmp6 error directly in pf.

See also: https://redmine.pfsense.org/issues/14290
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D43499
---
sys/net/pfvar.h | 1 +
sys/netpfil/pf/pf.c | 12 ++++++++++++
sys/netpfil/pf/pf_norm.c | 15 +++++++++++++++
3 files changed, 28 insertions(+)

Does this change cause problems for others t= oo?

- ssh over IPv6 permanently disconnecting
(client_loop: send disconnect: Broken pipe)
- ssh connections over IPv6 hanging
- git pull not working
Fssh_ssh_dispatch_run_fatal: Connection to 2604:1380:4091:a001::24ca:1 po= rt 22: Permission denied
fatal: Could not read from remote repository.

Can you include your pf.conf and a packet ca= pture demonstrating one of these issues?

So I assume this issue affects only me or th= is server (igb nic).
Disabling tso6 seems to resolve the issue.


Ah. A Clue(tm)!

Try this:

di=
ff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c
index 38a5a45d7991..2dc6d02d330a 100644
--- a/sys/netpfil/pf/pf.c
+++ b/sys/netpfil/pf/pf.c
@@ -8515,7 +8515,7 @@ pf_test6(int dir, int pflags, struct ifnet *ifp, st=
ruct mbuf **m0, struct inpcb
         * confused and fail to send the icmp6 packet too big error. Just=
 send
         * it here, before we do any NAT.
         */
-       if (dir =3D=3D PF_OUT && IN6_LINKMTU(ifp) < pf_max_fra=
g_size(m)) {
+       if (dir =3D=3D PF_OUT && pflags & PFIL_FWD &&=
 IN6_LINKMTU(ifp) < pf_max_frag_size(m)) {
                PF_RULES_RUNLOCK();
                *m0 =3D NULL;
                icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, IN6_LINKMTU(ifp))=
;

Best regards,
Kristof

--=_MailMate_8499D0A2-F28D-49C8-9CAD-F3540B67C559_=--